security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/ext2_fs.h>
  32 #include <linux/sched.h>
  33 #include <linux/security.h>
  34 #include <linux/xattr.h>
  35 #include <linux/capability.h>
  36 #include <linux/unistd.h>
  37 #include <linux/mm.h>
  38 #include <linux/mman.h>
  39 #include <linux/slab.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/proc_fs.h>
  42 #include <linux/swap.h>
  43 #include <linux/spinlock.h>
  44 #include <linux/syscalls.h>
  45 #include <linux/dcache.h>
  46 #include <linux/file.h>
  47 #include <linux/fdtable.h>
  48 #include <linux/namei.h>
  49 #include <linux/mount.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <linux/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85
  86 #include "avc.h"
  87 #include "objsec.h"
  88 #include "netif.h"
  89 #include "netnode.h"
  90 #include "netport.h"
  91 #include "xfrm.h"
  92 #include "netlabel.h"
  93 #include "audit.h"
  94 #include "avc_ss.h"
  95
  96 #define NUM_SEL_MNT_OPTS 5
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (atomic_read(&selinux_secmark_refcount) > 0);
 146 }
 147
 148 /*
 149  * initialise the security for the init task
 150  */
 151 static void cred_init_security(void)
 152 {
 153         struct cred *cred = (struct cred *) current->real_cred;
 154         struct task_security_struct *tsec;
 155
 156         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 157         if (!tsec)
 158                 panic("SELinux:  Failed to initialize initial task.\n");
 159
 160         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 161         cred->security = tsec;
 162 }
 163
 164 /*
 165  * get the security ID of a set of credentials
 166  */
 167 static inline u32 cred_sid(const struct cred *cred)
 168 {
 169         const struct task_security_struct *tsec;
 170
 171         tsec = cred->security;
 172         return tsec->sid;
 173 }
 174
 175 /*
 176  * get the objective security ID of a task
 177  */
 178 static inline u32 task_sid(const struct task_struct *task)
 179 {
 180         u32 sid;
 181
 182         rcu_read_lock();
 183         sid = cred_sid(__task_cred(task));
 184         rcu_read_unlock();
 185         return sid;
 186 }
 187
 188 /*
 189  * get the subjective security ID of the current task
 190  */
 191 static inline u32 current_sid(void)
 192 {
 193         const struct task_security_struct *tsec = current_security();
 194
 195         return tsec->sid;
 196 }
 197
 198 /* Allocate and free functions for each kind of security blob. */
 199
 200 static int inode_alloc_security(struct inode *inode)
 201 {
 202         struct inode_security_struct *isec;
 203         u32 sid = current_sid();
 204
 205         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 206         if (!isec)
 207                 return -ENOMEM;
 208
 209         mutex_init(&isec->lock);
 210         INIT_LIST_HEAD(&isec->list);
 211         isec->inode = inode;
 212         isec->sid = SECINITSID_UNLABELED;
 213         isec->sclass = SECCLASS_FILE;
 214         isec->task_sid = sid;
 215         inode->i_security = isec;
 216
 217         return 0;
 218 }
 219
 220 static void inode_free_rcu(struct rcu_head *head)
 221 {
 222         struct inode_security_struct *isec;
 223
 224         isec = container_of(head, struct inode_security_struct, rcu);
 225         kmem_cache_free(sel_inode_cache, isec);
 226 }
 227
 228 static void inode_free_security(struct inode *inode)
 229 {
 230         struct inode_security_struct *isec = inode->i_security;
 231         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 232
 233         spin_lock(&sbsec->isec_lock);
 234         if (!list_empty(&isec->list))
 235                 list_del_init(&isec->list);
 236         spin_unlock(&sbsec->isec_lock);
 237
 238         /*
 239          * The inode may still be referenced in a path walk and
 240          * a call to selinux_inode_permission() can be made
 241          * after inode_free_security() is called. Ideally, the VFS
 242          * wouldn't do this, but fixing that is a much harder
 243          * job. For now, simply free the i_security via RCU, and
 244          * leave the current inode->i_security pointer intact.
 245          * The inode will be freed after the RCU grace period too.
 246          */
 247         call_rcu(&isec->rcu, inode_free_rcu);
 248 }
 249
 250 static int file_alloc_security(struct file *file)
 251 {
 252         struct file_security_struct *fsec;
 253         u32 sid = current_sid();
 254
 255         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 256         if (!fsec)
 257                 return -ENOMEM;
 258
 259         fsec->sid = sid;
 260         fsec->fown_sid = sid;
 261         file->f_security = fsec;
 262
 263         return 0;
 264 }
 265
 266 static void file_free_security(struct file *file)
 267 {
 268         struct file_security_struct *fsec = file->f_security;
 269         file->f_security = NULL;
 270         kfree(fsec);
 271 }
 272
 273 static int superblock_alloc_security(struct super_block *sb)
 274 {
 275         struct superblock_security_struct *sbsec;
 276
 277         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 278         if (!sbsec)
 279                 return -ENOMEM;
 280
 281         mutex_init(&sbsec->lock);
 282         INIT_LIST_HEAD(&sbsec->isec_head);
 283         spin_lock_init(&sbsec->isec_lock);
 284         sbsec->sb = sb;
 285         sbsec->sid = SECINITSID_UNLABELED;
 286         sbsec->def_sid = SECINITSID_FILE;
 287         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 288         sb->s_security = sbsec;
 289
 290         return 0;
 291 }
 292
 293 static void superblock_free_security(struct super_block *sb)
 294 {
 295         struct superblock_security_struct *sbsec = sb->s_security;
 296         sb->s_security = NULL;
 297         kfree(sbsec);
 298 }
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static const char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_error = -1,
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 3,
 323         Opt_rootcontext = 4,
 324         Opt_labelsupport = 5,
 325 };
 326
 327 static const match_table_t tokens = {
 328         {Opt_context, CONTEXT_STR "%s"},
 329         {Opt_fscontext, FSCONTEXT_STR "%s"},
 330         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 331         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 332         {Opt_labelsupport, LABELSUPP_STR},
 333         {Opt_error, NULL},
 334 };
 335
 336 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 337
 338 static int may_context_mount_sb_relabel(u32 sid,
 339                         struct superblock_security_struct *sbsec,
 340                         const struct cred *cred)
 341 {
 342         const struct task_security_struct *tsec = cred->security;
 343         int rc;
 344
 345         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELFROM, NULL);
 347         if (rc)
 348                 return rc;
 349
 350         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 351                           FILESYSTEM__RELABELTO, NULL);
 352         return rc;
 353 }
 354
 355 static int may_context_mount_inode_relabel(u32 sid,
 356                         struct superblock_security_struct *sbsec,
 357                         const struct cred *cred)
 358 {
 359         const struct task_security_struct *tsec = cred->security;
 360         int rc;
 361         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__RELABELFROM, NULL);
 363         if (rc)
 364                 return rc;
 365
 366         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 367                           FILESYSTEM__ASSOCIATE, NULL);
 368         return rc;
 369 }
 370
 371 static int sb_finish_set_opts(struct super_block *sb)
 372 {
 373         struct superblock_security_struct *sbsec = sb->s_security;
 374         struct dentry *root = sb->s_root;
 375         struct inode *root_inode = root->d_inode;
 376         int rc = 0;
 377
 378         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 379                 /* Make sure that the xattr handler exists and that no
 380                    error other than -ENODATA is returned by getxattr on
 381                    the root directory.  -ENODATA is ok, as this may be
 382                    the first boot of the SELinux kernel before we have
 383                    assigned xattr values to the filesystem. */
 384                 if (!root_inode->i_op->getxattr) {
 385                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 386                                "xattr support\n", sb->s_id, sb->s_type->name);
 387                         rc = -EOPNOTSUPP;
 388                         goto out;
 389                 }
 390                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 391                 if (rc < 0 && rc != -ENODATA) {
 392                         if (rc == -EOPNOTSUPP)
 393                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 394                                        "%s) has no security xattr handler\n",
 395                                        sb->s_id, sb->s_type->name);
 396                         else
 397                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 398                                        "%s) getxattr errno %d\n", sb->s_id,
 399                                        sb->s_type->name, -rc);
 400                         goto out;
 401                 }
 402         }
 403
 404         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 405
 406         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 407                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 408                        sb->s_id, sb->s_type->name);
 409         else
 410                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 411                        sb->s_id, sb->s_type->name,
 412                        labeling_behaviors[sbsec->behavior-1]);
 413
 414         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 415             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 416             sbsec->behavior == SECURITY_FS_USE_NONE ||
 417             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 418                 sbsec->flags &= ~SE_SBLABELSUPP;
 419
 420         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 421         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 422                 sbsec->flags |= SE_SBLABELSUPP;
 423
 424         /* Initialize the root inode. */
 425         rc = inode_doinit_with_dentry(root_inode, root);
 426
 427         /* Initialize any other inodes associated with the superblock, e.g.
 428            inodes created prior to initial policy load or inodes created
 429            during get_sb by a pseudo filesystem that directly
 430            populates itself. */
 431         spin_lock(&sbsec->isec_lock);
 432 next_inode:
 433         if (!list_empty(&sbsec->isec_head)) {
 434                 struct inode_security_struct *isec =
 435                                 list_entry(sbsec->isec_head.next,
 436                                            struct inode_security_struct, list);
 437                 struct inode *inode = isec->inode;
 438                 list_del_init(&isec->list);
 439                 spin_unlock(&sbsec->isec_lock);
 440                 inode = igrab(inode);
 441                 if (inode) {
 442                         if (!IS_PRIVATE(inode))
 443                                 inode_doinit(inode);
 444                         iput(inode);
 445                 }
 446                 spin_lock(&sbsec->isec_lock);
 447                 goto next_inode;
 448         }
 449         spin_unlock(&sbsec->isec_lock);
 450 out:
 451         return rc;
 452 }
 453
 454 /*
 455  * This function should allow an FS to ask what it's mount security
 456  * options were so it can use those later for submounts, displaying
 457  * mount options, or whatever.
 458  */
 459 static int selinux_get_mnt_opts(const struct super_block *sb,
 460                                 struct security_mnt_opts *opts)
 461 {
 462         int rc = 0, i;
 463         struct superblock_security_struct *sbsec = sb->s_security;
 464         char *context = NULL;
 465         u32 len;
 466         char tmp;
 467
 468         security_init_mnt_opts(opts);
 469
 470         if (!(sbsec->flags & SE_SBINITIALIZED))
 471                 return -EINVAL;
 472
 473         if (!ss_initialized)
 474                 return -EINVAL;
 475
 476         tmp = sbsec->flags & SE_MNTMASK;
 477         /* count the number of mount options for this sb */
 478         for (i = 0; i < 8; i++) {
 479                 if (tmp & 0x01)
 480                         opts->num_mnt_opts++;
 481                 tmp >>= 1;
 482         }
 483         /* Check if the Label support flag is set */
 484         if (sbsec->flags & SE_SBLABELSUPP)
 485                 opts->num_mnt_opts++;
 486
 487         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 488         if (!opts->mnt_opts) {
 489                 rc = -ENOMEM;
 490                 goto out_free;
 491         }
 492
 493         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 494         if (!opts->mnt_opts_flags) {
 495                 rc = -ENOMEM;
 496                 goto out_free;
 497         }
 498
 499         i = 0;
 500         if (sbsec->flags & FSCONTEXT_MNT) {
 501                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 502                 if (rc)
 503                         goto out_free;
 504                 opts->mnt_opts[i] = context;
 505                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 506         }
 507         if (sbsec->flags & CONTEXT_MNT) {
 508                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 509                 if (rc)
 510                         goto out_free;
 511                 opts->mnt_opts[i] = context;
 512                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 513         }
 514         if (sbsec->flags & DEFCONTEXT_MNT) {
 515                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 516                 if (rc)
 517                         goto out_free;
 518                 opts->mnt_opts[i] = context;
 519                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 520         }
 521         if (sbsec->flags & ROOTCONTEXT_MNT) {
 522                 struct inode *root = sbsec->sb->s_root->d_inode;
 523                 struct inode_security_struct *isec = root->i_security;
 524
 525                 rc = security_sid_to_context(isec->sid, &context, &len);
 526                 if (rc)
 527                         goto out_free;
 528                 opts->mnt_opts[i] = context;
 529                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 530         }
 531         if (sbsec->flags & SE_SBLABELSUPP) {
 532                 opts->mnt_opts[i] = NULL;
 533                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 534         }
 535
 536         BUG_ON(i != opts->num_mnt_opts);
 537
 538         return 0;
 539
 540 out_free:
 541         security_free_mnt_opts(opts);
 542         return rc;
 543 }
 544
 545 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 546                       u32 old_sid, u32 new_sid)
 547 {
 548         char mnt_flags = sbsec->flags & SE_MNTMASK;
 549
 550         /* check if the old mount command had the same options */
 551         if (sbsec->flags & SE_SBINITIALIZED)
 552                 if (!(sbsec->flags & flag) ||
 553                     (old_sid != new_sid))
 554                         return 1;
 555
 556         /* check if we were passed the same options twice,
 557          * aka someone passed context=a,context=b
 558          */
 559         if (!(sbsec->flags & SE_SBINITIALIZED))
 560                 if (mnt_flags & flag)
 561                         return 1;
 562         return 0;
 563 }
 564
 565 /*
 566  * Allow filesystems with binary mount data to explicitly set mount point
 567  * labeling information.
 568  */
 569 static int selinux_set_mnt_opts(struct super_block *sb,
 570                                 struct security_mnt_opts *opts)
 571 {
 572         const struct cred *cred = current_cred();
 573         int rc = 0, i;
 574         struct superblock_security_struct *sbsec = sb->s_security;
 575         const char *name = sb->s_type->name;
 576         struct inode *inode = sbsec->sb->s_root->d_inode;
 577         struct inode_security_struct *root_isec = inode->i_security;
 578         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 579         u32 defcontext_sid = 0;
 580         char **mount_options = opts->mnt_opts;
 581         int *flags = opts->mnt_opts_flags;
 582         int num_opts = opts->num_mnt_opts;
 583
 584         mutex_lock(&sbsec->lock);
 585
 586         if (!ss_initialized) {
 587                 if (!num_opts) {
 588                         /* Defer initialization until selinux_complete_init,
 589                            after the initial policy is loaded and the security
 590                            server is ready to handle calls. */
 591                         goto out;
 592                 }
 593                 rc = -EINVAL;
 594                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 595                         "before the security server is initialized\n");
 596                 goto out;
 597         }
 598
 599         /*
 600          * Binary mount data FS will come through this function twice.  Once
 601          * from an explicit call and once from the generic calls from the vfs.
 602          * Since the generic VFS calls will not contain any security mount data
 603          * we need to skip the double mount verification.
 604          *
 605          * This does open a hole in which we will not notice if the first
 606          * mount using this sb set explict options and a second mount using
 607          * this sb does not set any security options.  (The first options
 608          * will be used for both mounts)
 609          */
 610         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 611             && (num_opts == 0))
 612                 goto out;
 613
 614         /*
 615          * parse the mount options, check if they are valid sids.
 616          * also check if someone is trying to mount the same sb more
 617          * than once with different security options.
 618          */
 619         for (i = 0; i < num_opts; i++) {
 620                 u32 sid;
 621
 622                 if (flags[i] == SE_SBLABELSUPP)
 623                         continue;
 624                 rc = security_context_to_sid(mount_options[i],
 625                                              strlen(mount_options[i]), &sid);
 626                 if (rc) {
 627                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 628                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 629                                mount_options[i], sb->s_id, name, rc);
 630                         goto out;
 631                 }
 632                 switch (flags[i]) {
 633                 case FSCONTEXT_MNT:
 634                         fscontext_sid = sid;
 635
 636                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 637                                         fscontext_sid))
 638                                 goto out_double_mount;
 639
 640                         sbsec->flags |= FSCONTEXT_MNT;
 641                         break;
 642                 case CONTEXT_MNT:
 643                         context_sid = sid;
 644
 645                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 646                                         context_sid))
 647                                 goto out_double_mount;
 648
 649                         sbsec->flags |= CONTEXT_MNT;
 650                         break;
 651                 case ROOTCONTEXT_MNT:
 652                         rootcontext_sid = sid;
 653
 654                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 655                                         rootcontext_sid))
 656                                 goto out_double_mount;
 657
 658                         sbsec->flags |= ROOTCONTEXT_MNT;
 659
 660                         break;
 661                 case DEFCONTEXT_MNT:
 662                         defcontext_sid = sid;
 663
 664                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 665                                         defcontext_sid))
 666                                 goto out_double_mount;
 667
 668                         sbsec->flags |= DEFCONTEXT_MNT;
 669
 670                         break;
 671                 default:
 672                         rc = -EINVAL;
 673                         goto out;
 674                 }
 675         }
 676
 677         if (sbsec->flags & SE_SBINITIALIZED) {
 678                 /* previously mounted with options, but not on this attempt? */
 679                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 680                         goto out_double_mount;
 681                 rc = 0;
 682                 goto out;
 683         }
 684
 685         if (strcmp(sb->s_type->name, "proc") == 0)
 686                 sbsec->flags |= SE_SBPROC;
 687
 688         /* Determine the labeling behavior to use for this filesystem type. */
 689         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 690         if (rc) {
 691                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 692                        __func__, sb->s_type->name, rc);
 693                 goto out;
 694         }
 695
 696         /* sets the context of the superblock for the fs being mounted. */
 697         if (fscontext_sid) {
 698                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 699                 if (rc)
 700                         goto out;
 701
 702                 sbsec->sid = fscontext_sid;
 703         }
 704
 705         /*
 706          * Switch to using mount point labeling behavior.
 707          * sets the label used on all file below the mountpoint, and will set
 708          * the superblock context if not already set.
 709          */
 710         if (context_sid) {
 711                 if (!fscontext_sid) {
 712                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 713                                                           cred);
 714                         if (rc)
 715                                 goto out;
 716                         sbsec->sid = context_sid;
 717                 } else {
 718                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 719                                                              cred);
 720                         if (rc)
 721                                 goto out;
 722                 }
 723                 if (!rootcontext_sid)
 724                         rootcontext_sid = context_sid;
 725
 726                 sbsec->mntpoint_sid = context_sid;
 727                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 728         }
 729
 730         if (rootcontext_sid) {
 731                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 732                                                      cred);
 733                 if (rc)
 734                         goto out;
 735
 736                 root_isec->sid = rootcontext_sid;
 737                 root_isec->initialized = 1;
 738         }
 739
 740         if (defcontext_sid) {
 741                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 742                         rc = -EINVAL;
 743                         printk(KERN_WARNING "SELinux: defcontext option is "
 744                                "invalid for this filesystem type\n");
 745                         goto out;
 746                 }
 747
 748                 if (defcontext_sid != sbsec->def_sid) {
 749                         rc = may_context_mount_inode_relabel(defcontext_sid,
 750                                                              sbsec, cred);
 751                         if (rc)
 752                                 goto out;
 753                 }
 754
 755                 sbsec->def_sid = defcontext_sid;
 756         }
 757
 758         rc = sb_finish_set_opts(sb);
 759 out:
 760         mutex_unlock(&sbsec->lock);
 761         return rc;
 762 out_double_mount:
 763         rc = -EINVAL;
 764         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 765                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 766         goto out;
 767 }
 768
 769 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 770                                         struct super_block *newsb)
 771 {
 772         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 773         struct superblock_security_struct *newsbsec = newsb->s_security;
 774
 775         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 776         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 777         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 778
 779         /*
 780          * if the parent was able to be mounted it clearly had no special lsm
 781          * mount options.  thus we can safely deal with this superblock later
 782          */
 783         if (!ss_initialized)
 784                 return;
 785
 786         /* how can we clone if the old one wasn't set up?? */
 787         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 788
 789         /* if fs is reusing a sb, just let its options stand... */
 790         if (newsbsec->flags & SE_SBINITIALIZED)
 791                 return;
 792
 793         mutex_lock(&newsbsec->lock);
 794
 795         newsbsec->flags = oldsbsec->flags;
 796
 797         newsbsec->sid = oldsbsec->sid;
 798         newsbsec->def_sid = oldsbsec->def_sid;
 799         newsbsec->behavior = oldsbsec->behavior;
 800
 801         if (set_context) {
 802                 u32 sid = oldsbsec->mntpoint_sid;
 803
 804                 if (!set_fscontext)
 805                         newsbsec->sid = sid;
 806                 if (!set_rootcontext) {
 807                         struct inode *newinode = newsb->s_root->d_inode;
 808                         struct inode_security_struct *newisec = newinode->i_security;
 809                         newisec->sid = sid;
 810                 }
 811                 newsbsec->mntpoint_sid = sid;
 812         }
 813         if (set_rootcontext) {
 814                 const struct inode *oldinode = oldsb->s_root->d_inode;
 815                 const struct inode_security_struct *oldisec = oldinode->i_security;
 816                 struct inode *newinode = newsb->s_root->d_inode;
 817                 struct inode_security_struct *newisec = newinode->i_security;
 818
 819                 newisec->sid = oldisec->sid;
 820         }
 821
 822         sb_finish_set_opts(newsb);
 823         mutex_unlock(&newsbsec->lock);
 824 }
 825
 826 static int selinux_parse_opts_str(char *options,
 827                                   struct security_mnt_opts *opts)
 828 {
 829         char *p;
 830         char *context = NULL, *defcontext = NULL;
 831         char *fscontext = NULL, *rootcontext = NULL;
 832         int rc, num_mnt_opts = 0;
 833
 834         opts->num_mnt_opts = 0;
 835
 836         /* Standard string-based options. */
 837         while ((p = strsep(&options, "|")) != NULL) {
 838                 int token;
 839                 substring_t args[MAX_OPT_ARGS];
 840
 841                 if (!*p)
 842                         continue;
 843
 844                 token = match_token(p, tokens, args);
 845
 846                 switch (token) {
 847                 case Opt_context:
 848                         if (context || defcontext) {
 849                                 rc = -EINVAL;
 850                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 851                                 goto out_err;
 852                         }
 853                         context = match_strdup(&args[0]);
 854                         if (!context) {
 855                                 rc = -ENOMEM;
 856                                 goto out_err;
 857                         }
 858                         break;
 859
 860                 case Opt_fscontext:
 861                         if (fscontext) {
 862                                 rc = -EINVAL;
 863                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 864                                 goto out_err;
 865                         }
 866                         fscontext = match_strdup(&args[0]);
 867                         if (!fscontext) {
 868                                 rc = -ENOMEM;
 869                                 goto out_err;
 870                         }
 871                         break;
 872
 873                 case Opt_rootcontext:
 874                         if (rootcontext) {
 875                                 rc = -EINVAL;
 876                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 877                                 goto out_err;
 878                         }
 879                         rootcontext = match_strdup(&args[0]);
 880                         if (!rootcontext) {
 881                                 rc = -ENOMEM;
 882                                 goto out_err;
 883                         }
 884                         break;
 885
 886                 case Opt_defcontext:
 887                         if (context || defcontext) {
 888                                 rc = -EINVAL;
 889                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 890                                 goto out_err;
 891                         }
 892                         defcontext = match_strdup(&args[0]);
 893                         if (!defcontext) {
 894                                 rc = -ENOMEM;
 895                                 goto out_err;
 896                         }
 897                         break;
 898                 case Opt_labelsupport:
 899                         break;
 900                 default:
 901                         rc = -EINVAL;
 902                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 903                         goto out_err;
 904
 905                 }
 906         }
 907
 908         rc = -ENOMEM;
 909         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 910         if (!opts->mnt_opts)
 911                 goto out_err;
 912
 913         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 914         if (!opts->mnt_opts_flags)
 915                 goto out_err;
 916
 917         if (fscontext) {
 918                 opts->mnt_opts[num_mnt_opts] = fscontext;
 919                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 920         }
 921         if (context) {
 922                 opts->mnt_opts[num_mnt_opts] = context;
 923                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 924         }
 925         if (rootcontext) {
 926                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 927                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 928         }
 929         if (defcontext) {
 930                 opts->mnt_opts[num_mnt_opts] = defcontext;
 931                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 932         }
 933
 934         opts->num_mnt_opts = num_mnt_opts;
 935         return 0;
 936
 937 out_err:
 938         security_free_mnt_opts(opts);
 939         kfree(context);
 940         kfree(defcontext);
 941         kfree(fscontext);
 942         kfree(rootcontext);
 943         return rc;
 944 }
 945 /*
 946  * string mount options parsing and call set the sbsec
 947  */
 948 static int superblock_doinit(struct super_block *sb, void *data)
 949 {
 950         int rc = 0;
 951         char *options = data;
 952         struct security_mnt_opts opts;
 953
 954         security_init_mnt_opts(&opts);
 955
 956         if (!data)
 957                 goto out;
 958
 959         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 960
 961         rc = selinux_parse_opts_str(options, &opts);
 962         if (rc)
 963                 goto out_err;
 964
 965 out:
 966         rc = selinux_set_mnt_opts(sb, &opts);
 967
 968 out_err:
 969         security_free_mnt_opts(&opts);
 970         return rc;
 971 }
 972
 973 static void selinux_write_opts(struct seq_file *m,
 974                                struct security_mnt_opts *opts)
 975 {
 976         int i;
 977         char *prefix;
 978
 979         for (i = 0; i < opts->num_mnt_opts; i++) {
 980                 char *has_comma;
 981
 982                 if (opts->mnt_opts[i])
 983                         has_comma = strchr(opts->mnt_opts[i], ',');
 984                 else
 985                         has_comma = NULL;
 986
 987                 switch (opts->mnt_opts_flags[i]) {
 988                 case CONTEXT_MNT:
 989                         prefix = CONTEXT_STR;
 990                         break;
 991                 case FSCONTEXT_MNT:
 992                         prefix = FSCONTEXT_STR;
 993                         break;
 994                 case ROOTCONTEXT_MNT:
 995                         prefix = ROOTCONTEXT_STR;
 996                         break;
 997                 case DEFCONTEXT_MNT:
 998                         prefix = DEFCONTEXT_STR;
 999                         break;
1000                 case SE_SBLABELSUPP:
1001                         seq_putc(m, ',');
1002                         seq_puts(m, LABELSUPP_STR);
1003                         continue;
1004                 default:
1005                         BUG();
1006                         return;
1007                 };
1008                 /* we need a comma before each option */
1009                 seq_putc(m, ',');
1010                 seq_puts(m, prefix);
1011                 if (has_comma)
1012                         seq_putc(m, '\"');
1013                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1014                 if (has_comma)
1015                         seq_putc(m, '\"');
1016         }
1017 }
1018
1019 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1020 {
1021         struct security_mnt_opts opts;
1022         int rc;
1023
1024         rc = selinux_get_mnt_opts(sb, &opts);
1025         if (rc) {
1026                 /* before policy load we may get EINVAL, don't show anything */
1027                 if (rc == -EINVAL)
1028                         rc = 0;
1029                 return rc;
1030         }
1031
1032         selinux_write_opts(m, &opts);
1033
1034         security_free_mnt_opts(&opts);
1035
1036         return rc;
1037 }
1038
1039 static inline u16 inode_mode_to_security_class(umode_t mode)
1040 {
1041         switch (mode & S_IFMT) {
1042         case S_IFSOCK:
1043                 return SECCLASS_SOCK_FILE;
1044         case S_IFLNK:
1045                 return SECCLASS_LNK_FILE;
1046         case S_IFREG:
1047                 return SECCLASS_FILE;
1048         case S_IFBLK:
1049                 return SECCLASS_BLK_FILE;
1050         case S_IFDIR:
1051                 return SECCLASS_DIR;
1052         case S_IFCHR:
1053                 return SECCLASS_CHR_FILE;
1054         case S_IFIFO:
1055                 return SECCLASS_FIFO_FILE;
1056
1057         }
1058
1059         return SECCLASS_FILE;
1060 }
1061
1062 static inline int default_protocol_stream(int protocol)
1063 {
1064         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1065 }
1066
1067 static inline int default_protocol_dgram(int protocol)
1068 {
1069         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1070 }
1071
1072 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1073 {
1074         switch (family) {
1075         case PF_UNIX:
1076                 switch (type) {
1077                 case SOCK_STREAM:
1078                 case SOCK_SEQPACKET:
1079                         return SECCLASS_UNIX_STREAM_SOCKET;
1080                 case SOCK_DGRAM:
1081                         return SECCLASS_UNIX_DGRAM_SOCKET;
1082                 }
1083                 break;
1084         case PF_INET:
1085         case PF_INET6:
1086                 switch (type) {
1087                 case SOCK_STREAM:
1088                         if (default_protocol_stream(protocol))
1089                                 return SECCLASS_TCP_SOCKET;
1090                         else
1091                                 return SECCLASS_RAWIP_SOCKET;
1092                 case SOCK_DGRAM:
1093                         if (default_protocol_dgram(protocol))
1094                                 return SECCLASS_UDP_SOCKET;
1095                         else
1096                                 return SECCLASS_RAWIP_SOCKET;
1097                 case SOCK_DCCP:
1098                         return SECCLASS_DCCP_SOCKET;
1099                 default:
1100                         return SECCLASS_RAWIP_SOCKET;
1101                 }
1102                 break;
1103         case PF_NETLINK:
1104                 switch (protocol) {
1105                 case NETLINK_ROUTE:
1106                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1107                 case NETLINK_FIREWALL:
1108                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1109                 case NETLINK_INET_DIAG:
1110                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1111                 case NETLINK_NFLOG:
1112                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1113                 case NETLINK_XFRM:
1114                         return SECCLASS_NETLINK_XFRM_SOCKET;
1115                 case NETLINK_SELINUX:
1116                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1117                 case NETLINK_AUDIT:
1118                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1119                 case NETLINK_IP6_FW:
1120                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1121                 case NETLINK_DNRTMSG:
1122                         return SECCLASS_NETLINK_DNRT_SOCKET;
1123                 case NETLINK_KOBJECT_UEVENT:
1124                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1125                 default:
1126                         return SECCLASS_NETLINK_SOCKET;
1127                 }
1128         case PF_PACKET:
1129                 return SECCLASS_PACKET_SOCKET;
1130         case PF_KEY:
1131                 return SECCLASS_KEY_SOCKET;
1132         case PF_APPLETALK:
1133                 return SECCLASS_APPLETALK_SOCKET;
1134         }
1135
1136         return SECCLASS_SOCKET;
1137 }
1138
1139 #ifdef CONFIG_PROC_FS
1140 static int selinux_proc_get_sid(struct dentry *dentry,
1141                                 u16 tclass,
1142                                 u32 *sid)
1143 {
1144         int rc;
1145         char *buffer, *path;
1146
1147         buffer = (char *)__get_free_page(GFP_KERNEL);
1148         if (!buffer)
1149                 return -ENOMEM;
1150
1151         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1152         if (IS_ERR(path))
1153                 rc = PTR_ERR(path);
1154         else {
1155                 /* each process gets a /proc/PID/ entry. Strip off the
1156                  * PID part to get a valid selinux labeling.
1157                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1158                 while (path[1] >= '0' && path[1] <= '9') {
1159                         path[1] = '/';
1160                         path++;
1161                 }
1162                 rc = security_genfs_sid("proc", path, tclass, sid);
1163         }
1164         free_page((unsigned long)buffer);
1165         return rc;
1166 }
1167 #else
1168 static int selinux_proc_get_sid(struct dentry *dentry,
1169                                 u16 tclass,
1170                                 u32 *sid)
1171 {
1172         return -EINVAL;
1173 }
1174 #endif
1175
1176 /* The inode's security attributes must be initialized before first use. */
1177 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1178 {
1179         struct superblock_security_struct *sbsec = NULL;
1180         struct inode_security_struct *isec = inode->i_security;
1181         u32 sid;
1182         struct dentry *dentry;
1183 #define INITCONTEXTLEN 255
1184         char *context = NULL;
1185         unsigned len = 0;
1186         int rc = 0;
1187
1188         if (isec->initialized)
1189                 goto out;
1190
1191         mutex_lock(&isec->lock);
1192         if (isec->initialized)
1193                 goto out_unlock;
1194
1195         sbsec = inode->i_sb->s_security;
1196         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1197                 /* Defer initialization until selinux_complete_init,
1198                    after the initial policy is loaded and the security
1199                    server is ready to handle calls. */
1200                 spin_lock(&sbsec->isec_lock);
1201                 if (list_empty(&isec->list))
1202                         list_add(&isec->list, &sbsec->isec_head);
1203                 spin_unlock(&sbsec->isec_lock);
1204                 goto out_unlock;
1205         }
1206
1207         switch (sbsec->behavior) {
1208         case SECURITY_FS_USE_XATTR:
1209                 if (!inode->i_op->getxattr) {
1210                         isec->sid = sbsec->def_sid;
1211                         break;
1212                 }
1213
1214                 /* Need a dentry, since the xattr API requires one.
1215                    Life would be simpler if we could just pass the inode. */
1216                 if (opt_dentry) {
1217                         /* Called from d_instantiate or d_splice_alias. */
1218                         dentry = dget(opt_dentry);
1219                 } else {
1220                         /* Called from selinux_complete_init, try to find a dentry. */
1221                         dentry = d_find_alias(inode);
1222                 }
1223                 if (!dentry) {
1224                         /*
1225                          * this is can be hit on boot when a file is accessed
1226                          * before the policy is loaded.  When we load policy we
1227                          * may find inodes that have no dentry on the
1228                          * sbsec->isec_head list.  No reason to complain as these
1229                          * will get fixed up the next time we go through
1230                          * inode_doinit with a dentry, before these inodes could
1231                          * be used again by userspace.
1232                          */
1233                         goto out_unlock;
1234                 }
1235
1236                 len = INITCONTEXTLEN;
1237                 context = kmalloc(len+1, GFP_NOFS);
1238                 if (!context) {
1239                         rc = -ENOMEM;
1240                         dput(dentry);
1241                         goto out_unlock;
1242                 }
1243                 context[len] = '\0';
1244                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1245                                            context, len);
1246                 if (rc == -ERANGE) {
1247                         kfree(context);
1248
1249                         /* Need a larger buffer.  Query for the right size. */
1250                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1251                                                    NULL, 0);
1252                         if (rc < 0) {
1253                                 dput(dentry);
1254                                 goto out_unlock;
1255                         }
1256                         len = rc;
1257                         context = kmalloc(len+1, GFP_NOFS);
1258                         if (!context) {
1259                                 rc = -ENOMEM;
1260                                 dput(dentry);
1261                                 goto out_unlock;
1262                         }
1263                         context[len] = '\0';
1264                         rc = inode->i_op->getxattr(dentry,
1265                                                    XATTR_NAME_SELINUX,
1266                                                    context, len);
1267                 }
1268                 dput(dentry);
1269                 if (rc < 0) {
1270                         if (rc != -ENODATA) {
1271                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1272                                        "%d for dev=%s ino=%ld\n", __func__,
1273                                        -rc, inode->i_sb->s_id, inode->i_ino);
1274                                 kfree(context);
1275                                 goto out_unlock;
1276                         }
1277                         /* Map ENODATA to the default file SID */
1278                         sid = sbsec->def_sid;
1279                         rc = 0;
1280                 } else {
1281                         rc = security_context_to_sid_default(context, rc, &sid,
1282                                                              sbsec->def_sid,
1283                                                              GFP_NOFS);
1284                         if (rc) {
1285                                 char *dev = inode->i_sb->s_id;
1286                                 unsigned long ino = inode->i_ino;
1287
1288                                 if (rc == -EINVAL) {
1289                                         if (printk_ratelimit())
1290                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1291                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1292                                                         "filesystem in question.\n", ino, dev, context);
1293                                 } else {
1294                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1295                                                "returned %d for dev=%s ino=%ld\n",
1296                                                __func__, context, -rc, dev, ino);
1297                                 }
1298                                 kfree(context);
1299                                 /* Leave with the unlabeled SID */
1300                                 rc = 0;
1301                                 break;
1302                         }
1303                 }
1304                 kfree(context);
1305                 isec->sid = sid;
1306                 break;
1307         case SECURITY_FS_USE_TASK:
1308                 isec->sid = isec->task_sid;
1309                 break;
1310         case SECURITY_FS_USE_TRANS:
1311                 /* Default to the fs SID. */
1312                 isec->sid = sbsec->sid;
1313
1314                 /* Try to obtain a transition SID. */
1315                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1316                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1317                                              isec->sclass, NULL, &sid);
1318                 if (rc)
1319                         goto out_unlock;
1320                 isec->sid = sid;
1321                 break;
1322         case SECURITY_FS_USE_MNTPOINT:
1323                 isec->sid = sbsec->mntpoint_sid;
1324                 break;
1325         default:
1326                 /* Default to the fs superblock SID. */
1327                 isec->sid = sbsec->sid;
1328
1329                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1330                         /* We must have a dentry to determine the label on
1331                          * procfs inodes */
1332                         if (opt_dentry)
1333                                 /* Called from d_instantiate or
1334                                  * d_splice_alias. */
1335                                 dentry = dget(opt_dentry);
1336                         else
1337                                 /* Called from selinux_complete_init, try to
1338                                  * find a dentry. */
1339                                 dentry = d_find_alias(inode);
1340                         /*
1341                          * This can be hit on boot when a file is accessed
1342                          * before the policy is loaded.  When we load policy we
1343                          * may find inodes that have no dentry on the
1344                          * sbsec->isec_head list.  No reason to complain as
1345                          * these will get fixed up the next time we go through
1346                          * inode_doinit() with a dentry, before these inodes
1347                          * could be used again by userspace.
1348                          */
1349                         if (!dentry)
1350                                 goto out_unlock;
1351                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1352                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1353                         dput(dentry);
1354                         if (rc)
1355                                 goto out_unlock;
1356                         isec->sid = sid;
1357                 }
1358                 break;
1359         }
1360
1361         isec->initialized = 1;
1362
1363 out_unlock:
1364         mutex_unlock(&isec->lock);
1365 out:
1366         if (isec->sclass == SECCLASS_FILE)
1367                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1368         return rc;
1369 }
1370
1371 /* Convert a Linux signal to an access vector. */
1372 static inline u32 signal_to_av(int sig)
1373 {
1374         u32 perm = 0;
1375
1376         switch (sig) {
1377         case SIGCHLD:
1378                 /* Commonly granted from child to parent. */
1379                 perm = PROCESS__SIGCHLD;
1380                 break;
1381         case SIGKILL:
1382                 /* Cannot be caught or ignored */
1383                 perm = PROCESS__SIGKILL;
1384                 break;
1385         case SIGSTOP:
1386                 /* Cannot be caught or ignored */
1387                 perm = PROCESS__SIGSTOP;
1388                 break;
1389         default:
1390                 /* All other signals. */
1391                 perm = PROCESS__SIGNAL;
1392                 break;
1393         }
1394
1395         return perm;
1396 }
1397
1398 /*
1399  * Check permission between a pair of credentials
1400  * fork check, ptrace check, etc.
1401  */
1402 static int cred_has_perm(const struct cred *actor,
1403                          const struct cred *target,
1404                          u32 perms)
1405 {
1406         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1407
1408         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1409 }
1410
1411 /*
1412  * Check permission between a pair of tasks, e.g. signal checks,
1413  * fork check, ptrace check, etc.
1414  * tsk1 is the actor and tsk2 is the target
1415  * - this uses the default subjective creds of tsk1
1416  */
1417 static int task_has_perm(const struct task_struct *tsk1,
1418                          const struct task_struct *tsk2,
1419                          u32 perms)
1420 {
1421         const struct task_security_struct *__tsec1, *__tsec2;
1422         u32 sid1, sid2;
1423
1424         rcu_read_lock();
1425         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1426         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1427         rcu_read_unlock();
1428         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1429 }
1430
1431 /*
1432  * Check permission between current and another task, e.g. signal checks,
1433  * fork check, ptrace check, etc.
1434  * current is the actor and tsk2 is the target
1435  * - this uses current's subjective creds
1436  */
1437 static int current_has_perm(const struct task_struct *tsk,
1438                             u32 perms)
1439 {
1440         u32 sid, tsid;
1441
1442         sid = current_sid();
1443         tsid = task_sid(tsk);
1444         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1445 }
1446
1447 #if CAP_LAST_CAP > 63
1448 #error Fix SELinux to handle capabilities > 63.
1449 #endif
1450
1451 /* Check whether a task is allowed to use a capability. */
1452 static int task_has_capability(struct task_struct *tsk,
1453                                const struct cred *cred,
1454                                int cap, int audit)
1455 {
1456         struct common_audit_data ad;
1457         struct av_decision avd;
1458         u16 sclass;
1459         u32 sid = cred_sid(cred);
1460         u32 av = CAP_TO_MASK(cap);
1461         int rc;
1462
1463         COMMON_AUDIT_DATA_INIT(&ad, CAP);
1464         ad.tsk = tsk;
1465         ad.u.cap = cap;
1466
1467         switch (CAP_TO_INDEX(cap)) {
1468         case 0:
1469                 sclass = SECCLASS_CAPABILITY;
1470                 break;
1471         case 1:
1472                 sclass = SECCLASS_CAPABILITY2;
1473                 break;
1474         default:
1475                 printk(KERN_ERR
1476                        "SELinux:  out of range capability %d\n", cap);
1477                 BUG();
1478                 return -EINVAL;
1479         }
1480
1481         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1482         if (audit == SECURITY_CAP_AUDIT) {
1483                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1484                 if (rc2)
1485                         return rc2;
1486         }
1487         return rc;
1488 }
1489
1490 /* Check whether a task is allowed to use a system operation. */
1491 static int task_has_system(struct task_struct *tsk,
1492                            u32 perms)
1493 {
1494         u32 sid = task_sid(tsk);
1495
1496         return avc_has_perm(sid, SECINITSID_KERNEL,
1497                             SECCLASS_SYSTEM, perms, NULL);
1498 }
1499
1500 /* Check whether a task has a particular permission to an inode.
1501    The 'adp' parameter is optional and allows other audit
1502    data to be passed (e.g. the dentry). */
1503 static int inode_has_perm(const struct cred *cred,
1504                           struct inode *inode,
1505                           u32 perms,
1506                           struct common_audit_data *adp,
1507                           unsigned flags)
1508 {
1509         struct inode_security_struct *isec;
1510         u32 sid;
1511
1512         validate_creds(cred);
1513
1514         if (unlikely(IS_PRIVATE(inode)))
1515                 return 0;
1516
1517         sid = cred_sid(cred);
1518         isec = inode->i_security;
1519
1520         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1521 }
1522
1523 static int inode_has_perm_noadp(const struct cred *cred,
1524                                 struct inode *inode,
1525                                 u32 perms,
1526                                 unsigned flags)
1527 {
1528         struct common_audit_data ad;
1529
1530         COMMON_AUDIT_DATA_INIT(&ad, INODE);
1531         ad.u.inode = inode;
1532         return inode_has_perm(cred, inode, perms, &ad, flags);
1533 }
1534
1535 /* Same as inode_has_perm, but pass explicit audit data containing
1536    the dentry to help the auditing code to more easily generate the
1537    pathname if needed. */
1538 static inline int dentry_has_perm(const struct cred *cred,
1539                                   struct dentry *dentry,
1540                                   u32 av)
1541 {
1542         struct inode *inode = dentry->d_inode;
1543         struct common_audit_data ad;
1544
1545         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1546         ad.u.dentry = dentry;
1547         return inode_has_perm(cred, inode, av, &ad, 0);
1548 }
1549
1550 /* Same as inode_has_perm, but pass explicit audit data containing
1551    the path to help the auditing code to more easily generate the
1552    pathname if needed. */
1553 static inline int path_has_perm(const struct cred *cred,
1554                                 struct path *path,
1555                                 u32 av)
1556 {
1557         struct inode *inode = path->dentry->d_inode;
1558         struct common_audit_data ad;
1559
1560         COMMON_AUDIT_DATA_INIT(&ad, PATH);
1561         ad.u.path = *path;
1562         return inode_has_perm(cred, inode, av, &ad, 0);
1563 }
1564
1565 /* Check whether a task can use an open file descriptor to
1566    access an inode in a given way.  Check access to the
1567    descriptor itself, and then use dentry_has_perm to
1568    check a particular permission to the file.
1569    Access to the descriptor is implicitly granted if it
1570    has the same SID as the process.  If av is zero, then
1571    access to the file is not checked, e.g. for cases
1572    where only the descriptor is affected like seek. */
1573 static int file_has_perm(const struct cred *cred,
1574                          struct file *file,
1575                          u32 av)
1576 {
1577         struct file_security_struct *fsec = file->f_security;
1578         struct inode *inode = file->f_path.dentry->d_inode;
1579         struct common_audit_data ad;
1580         u32 sid = cred_sid(cred);
1581         int rc;
1582
1583         COMMON_AUDIT_DATA_INIT(&ad, PATH);
1584         ad.u.path = file->f_path;
1585
1586         if (sid != fsec->sid) {
1587                 rc = avc_has_perm(sid, fsec->sid,
1588                                   SECCLASS_FD,
1589                                   FD__USE,
1590                                   &ad);
1591                 if (rc)
1592                         goto out;
1593         }
1594
1595         /* av is zero if only checking access to the descriptor. */
1596         rc = 0;
1597         if (av)
1598                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1599
1600 out:
1601         return rc;
1602 }
1603
1604 /* Check whether a task can create a file. */
1605 static int may_create(struct inode *dir,
1606                       struct dentry *dentry,
1607                       u16 tclass)
1608 {
1609         const struct task_security_struct *tsec = current_security();
1610         struct inode_security_struct *dsec;
1611         struct superblock_security_struct *sbsec;
1612         u32 sid, newsid;
1613         struct common_audit_data ad;
1614         int rc;
1615
1616         dsec = dir->i_security;
1617         sbsec = dir->i_sb->s_security;
1618
1619         sid = tsec->sid;
1620         newsid = tsec->create_sid;
1621
1622         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1623         ad.u.dentry = dentry;
1624
1625         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1626                           DIR__ADD_NAME | DIR__SEARCH,
1627                           &ad);
1628         if (rc)
1629                 return rc;
1630
1631         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1632                 rc = security_transition_sid(sid, dsec->sid, tclass,
1633                                              &dentry->d_name, &newsid);
1634                 if (rc)
1635                         return rc;
1636         }
1637
1638         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1639         if (rc)
1640                 return rc;
1641
1642         return avc_has_perm(newsid, sbsec->sid,
1643                             SECCLASS_FILESYSTEM,
1644                             FILESYSTEM__ASSOCIATE, &ad);
1645 }
1646
1647 /* Check whether a task can create a key. */
1648 static int may_create_key(u32 ksid,
1649                           struct task_struct *ctx)
1650 {
1651         u32 sid = task_sid(ctx);
1652
1653         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1654 }
1655
1656 #define MAY_LINK        0
1657 #define MAY_UNLINK      1
1658 #define MAY_RMDIR       2
1659
1660 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1661 static int may_link(struct inode *dir,
1662                     struct dentry *dentry,
1663                     int kind)
1664
1665 {
1666         struct inode_security_struct *dsec, *isec;
1667         struct common_audit_data ad;
1668         u32 sid = current_sid();
1669         u32 av;
1670         int rc;
1671
1672         dsec = dir->i_security;
1673         isec = dentry->d_inode->i_security;
1674
1675         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1676         ad.u.dentry = dentry;
1677
1678         av = DIR__SEARCH;
1679         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1680         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1681         if (rc)
1682                 return rc;
1683
1684         switch (kind) {
1685         case MAY_LINK:
1686                 av = FILE__LINK;
1687                 break;
1688         case MAY_UNLINK:
1689                 av = FILE__UNLINK;
1690                 break;
1691         case MAY_RMDIR:
1692                 av = DIR__RMDIR;
1693                 break;
1694         default:
1695                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1696                         __func__, kind);
1697                 return 0;
1698         }
1699
1700         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1701         return rc;
1702 }
1703
1704 static inline int may_rename(struct inode *old_dir,
1705                              struct dentry *old_dentry,
1706                              struct inode *new_dir,
1707                              struct dentry *new_dentry)
1708 {
1709         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1710         struct common_audit_data ad;
1711         u32 sid = current_sid();
1712         u32 av;
1713         int old_is_dir, new_is_dir;
1714         int rc;
1715
1716         old_dsec = old_dir->i_security;
1717         old_isec = old_dentry->d_inode->i_security;
1718         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1719         new_dsec = new_dir->i_security;
1720
1721         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1722
1723         ad.u.dentry = old_dentry;
1724         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1725                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1726         if (rc)
1727                 return rc;
1728         rc = avc_has_perm(sid, old_isec->sid,
1729                           old_isec->sclass, FILE__RENAME, &ad);
1730         if (rc)
1731                 return rc;
1732         if (old_is_dir && new_dir != old_dir) {
1733                 rc = avc_has_perm(sid, old_isec->sid,
1734                                   old_isec->sclass, DIR__REPARENT, &ad);
1735                 if (rc)
1736                         return rc;
1737         }
1738
1739         ad.u.dentry = new_dentry;
1740         av = DIR__ADD_NAME | DIR__SEARCH;
1741         if (new_dentry->d_inode)
1742                 av |= DIR__REMOVE_NAME;
1743         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1744         if (rc)
1745                 return rc;
1746         if (new_dentry->d_inode) {
1747                 new_isec = new_dentry->d_inode->i_security;
1748                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1749                 rc = avc_has_perm(sid, new_isec->sid,
1750                                   new_isec->sclass,
1751                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1752                 if (rc)
1753                         return rc;
1754         }
1755
1756         return 0;
1757 }
1758
1759 /* Check whether a task can perform a filesystem operation. */
1760 static int superblock_has_perm(const struct cred *cred,
1761                                struct super_block *sb,
1762                                u32 perms,
1763                                struct common_audit_data *ad)
1764 {
1765         struct superblock_security_struct *sbsec;
1766         u32 sid = cred_sid(cred);
1767
1768         sbsec = sb->s_security;
1769         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1770 }
1771
1772 /* Convert a Linux mode and permission mask to an access vector. */
1773 static inline u32 file_mask_to_av(int mode, int mask)
1774 {
1775         u32 av = 0;
1776
1777         if ((mode & S_IFMT) != S_IFDIR) {
1778                 if (mask & MAY_EXEC)
1779                         av |= FILE__EXECUTE;
1780                 if (mask & MAY_READ)
1781                         av |= FILE__READ;
1782
1783                 if (mask & MAY_APPEND)
1784                         av |= FILE__APPEND;
1785                 else if (mask & MAY_WRITE)
1786                         av |= FILE__WRITE;
1787
1788         } else {
1789                 if (mask & MAY_EXEC)
1790                         av |= DIR__SEARCH;
1791                 if (mask & MAY_WRITE)
1792                         av |= DIR__WRITE;
1793                 if (mask & MAY_READ)
1794                         av |= DIR__READ;
1795         }
1796
1797         return av;
1798 }
1799
1800 /* Convert a Linux file to an access vector. */
1801 static inline u32 file_to_av(struct file *file)
1802 {
1803         u32 av = 0;
1804
1805         if (file->f_mode & FMODE_READ)
1806                 av |= FILE__READ;
1807         if (file->f_mode & FMODE_WRITE) {
1808                 if (file->f_flags & O_APPEND)
1809                         av |= FILE__APPEND;
1810                 else
1811                         av |= FILE__WRITE;
1812         }
1813         if (!av) {
1814                 /*
1815                  * Special file opened with flags 3 for ioctl-only use.
1816                  */
1817                 av = FILE__IOCTL;
1818         }
1819
1820         return av;
1821 }
1822
1823 /*
1824  * Convert a file to an access vector and include the correct open
1825  * open permission.
1826  */
1827 static inline u32 open_file_to_av(struct file *file)
1828 {
1829         u32 av = file_to_av(file);
1830
1831         if (selinux_policycap_openperm)
1832                 av |= FILE__OPEN;
1833
1834         return av;
1835 }
1836
1837 /* Hook functions begin here. */
1838
1839 static int selinux_ptrace_access_check(struct task_struct *child,
1840                                      unsigned int mode)
1841 {
1842         int rc;
1843
1844         rc = cap_ptrace_access_check(child, mode);
1845         if (rc)
1846                 return rc;
1847
1848         if (mode & PTRACE_MODE_READ) {
1849                 u32 sid = current_sid();
1850                 u32 csid = task_sid(child);
1851                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1852         }
1853
1854         return current_has_perm(child, PROCESS__PTRACE);
1855 }
1856
1857 static int selinux_ptrace_traceme(struct task_struct *parent)
1858 {
1859         int rc;
1860
1861         rc = cap_ptrace_traceme(parent);
1862         if (rc)
1863                 return rc;
1864
1865         return task_has_perm(parent, current, PROCESS__PTRACE);
1866 }
1867
1868 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1869                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1870 {
1871         int error;
1872
1873         error = current_has_perm(target, PROCESS__GETCAP);
1874         if (error)
1875                 return error;
1876
1877         return cap_capget(target, effective, inheritable, permitted);
1878 }
1879
1880 static int selinux_capset(struct cred *new, const struct cred *old,
1881                           const kernel_cap_t *effective,
1882                           const kernel_cap_t *inheritable,
1883                           const kernel_cap_t *permitted)
1884 {
1885         int error;
1886
1887         error = cap_capset(new, old,
1888                                       effective, inheritable, permitted);
1889         if (error)
1890                 return error;
1891
1892         return cred_has_perm(old, new, PROCESS__SETCAP);
1893 }
1894
1895 /*
1896  * (This comment used to live with the selinux_task_setuid hook,
1897  * which was removed).
1898  *
1899  * Since setuid only affects the current process, and since the SELinux
1900  * controls are not based on the Linux identity attributes, SELinux does not
1901  * need to control this operation.  However, SELinux does control the use of
1902  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1903  */
1904
1905 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1906                            struct user_namespace *ns, int cap, int audit)
1907 {
1908         int rc;
1909
1910         rc = cap_capable(tsk, cred, ns, cap, audit);
1911         if (rc)
1912                 return rc;
1913
1914         return task_has_capability(tsk, cred, cap, audit);
1915 }
1916
1917 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1918 {
1919         const struct cred *cred = current_cred();
1920         int rc = 0;
1921
1922         if (!sb)
1923                 return 0;
1924
1925         switch (cmds) {
1926         case Q_SYNC:
1927         case Q_QUOTAON:
1928         case Q_QUOTAOFF:
1929         case Q_SETINFO:
1930         case Q_SETQUOTA:
1931                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1932                 break;
1933         case Q_GETFMT:
1934         case Q_GETINFO:
1935         case Q_GETQUOTA:
1936                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1937                 break;
1938         default:
1939                 rc = 0;  /* let the kernel handle invalid cmds */
1940                 break;
1941         }
1942         return rc;
1943 }
1944
1945 static int selinux_quota_on(struct dentry *dentry)
1946 {
1947         const struct cred *cred = current_cred();
1948
1949         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1950 }
1951
1952 static int selinux_syslog(int type)
1953 {
1954         int rc;
1955
1956         switch (type) {
1957         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1958         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1959                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1960                 break;
1961         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1962         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1963         /* Set level of messages printed to console */
1964         case SYSLOG_ACTION_CONSOLE_LEVEL:
1965                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1966                 break;
1967         case SYSLOG_ACTION_CLOSE:       /* Close log */
1968         case SYSLOG_ACTION_OPEN:        /* Open log */
1969         case SYSLOG_ACTION_READ:        /* Read from log */
1970         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1971         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1972         default:
1973                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1974                 break;
1975         }
1976         return rc;
1977 }
1978
1979 /*
1980  * Check that a process has enough memory to allocate a new virtual
1981  * mapping. 0 means there is enough memory for the allocation to
1982  * succeed and -ENOMEM implies there is not.
1983  *
1984  * Do not audit the selinux permission check, as this is applied to all
1985  * processes that allocate mappings.
1986  */
1987 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1988 {
1989         int rc, cap_sys_admin = 0;
1990
1991         rc = selinux_capable(current, current_cred(),
1992                              &init_user_ns, CAP_SYS_ADMIN,
1993                              SECURITY_CAP_NOAUDIT);
1994         if (rc == 0)
1995                 cap_sys_admin = 1;
1996
1997         return __vm_enough_memory(mm, pages, cap_sys_admin);
1998 }
1999
2000 /* binprm security operations */
2001
2002 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2003 {
2004         const struct task_security_struct *old_tsec;
2005         struct task_security_struct *new_tsec;
2006         struct inode_security_struct *isec;
2007         struct common_audit_data ad;
2008         struct inode *inode = bprm->file->f_path.dentry->d_inode;
2009         int rc;
2010
2011         rc = cap_bprm_set_creds(bprm);
2012         if (rc)
2013                 return rc;
2014
2015         /* SELinux context only depends on initial program or script and not
2016          * the script interpreter */
2017         if (bprm->cred_prepared)
2018                 return 0;
2019
2020         old_tsec = current_security();
2021         new_tsec = bprm->cred->security;
2022         isec = inode->i_security;
2023
2024         /* Default to the current task SID. */
2025         new_tsec->sid = old_tsec->sid;
2026         new_tsec->osid = old_tsec->sid;
2027
2028         /* Reset fs, key, and sock SIDs on execve. */
2029         new_tsec->create_sid = 0;
2030         new_tsec->keycreate_sid = 0;
2031         new_tsec->sockcreate_sid = 0;
2032
2033         if (old_tsec->exec_sid) {
2034                 new_tsec->sid = old_tsec->exec_sid;
2035                 /* Reset exec SID on execve. */
2036                 new_tsec->exec_sid = 0;
2037         } else {
2038                 /* Check for a default transition on this program. */
2039                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2040                                              SECCLASS_PROCESS, NULL,
2041                                              &new_tsec->sid);
2042                 if (rc)
2043                         return rc;
2044         }
2045
2046         COMMON_AUDIT_DATA_INIT(&ad, PATH);
2047         ad.u.path = bprm->file->f_path;
2048
2049         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2050                 new_tsec->sid = old_tsec->sid;
2051
2052         if (new_tsec->sid == old_tsec->sid) {
2053                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2054                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2055                 if (rc)
2056                         return rc;
2057         } else {
2058                 /* Check permissions for the transition. */
2059                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2060                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2061                 if (rc)
2062                         return rc;
2063
2064                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2065                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2066                 if (rc)
2067                         return rc;
2068
2069                 /* Check for shared state */
2070                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2071                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2072                                           SECCLASS_PROCESS, PROCESS__SHARE,
2073                                           NULL);
2074                         if (rc)
2075                                 return -EPERM;
2076                 }
2077
2078                 /* Make sure that anyone attempting to ptrace over a task that
2079                  * changes its SID has the appropriate permit */
2080                 if (bprm->unsafe &
2081                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2082                         struct task_struct *tracer;
2083                         struct task_security_struct *sec;
2084                         u32 ptsid = 0;
2085
2086                         rcu_read_lock();
2087                         tracer = ptrace_parent(current);
2088                         if (likely(tracer != NULL)) {
2089                                 sec = __task_cred(tracer)->security;
2090                                 ptsid = sec->sid;
2091                         }
2092                         rcu_read_unlock();
2093
2094                         if (ptsid != 0) {
2095                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2096                                                   SECCLASS_PROCESS,
2097                                                   PROCESS__PTRACE, NULL);
2098                                 if (rc)
2099                                         return -EPERM;
2100                         }
2101                 }
2102
2103                 /* Clear any possibly unsafe personality bits on exec: */
2104                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2105         }
2106
2107         return 0;
2108 }
2109
2110 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2111 {
2112         const struct task_security_struct *tsec = current_security();
2113         u32 sid, osid;
2114         int atsecure = 0;
2115
2116         sid = tsec->sid;
2117         osid = tsec->osid;
2118
2119         if (osid != sid) {
2120                 /* Enable secure mode for SIDs transitions unless
2121                    the noatsecure permission is granted between
2122                    the two SIDs, i.e. ahp returns 0. */
2123                 atsecure = avc_has_perm(osid, sid,
2124                                         SECCLASS_PROCESS,
2125                                         PROCESS__NOATSECURE, NULL);
2126         }
2127
2128         return (atsecure || cap_bprm_secureexec(bprm));
2129 }
2130
2131 /* Derived from fs/exec.c:flush_old_files. */
2132 static inline void flush_unauthorized_files(const struct cred *cred,
2133                                             struct files_struct *files)
2134 {
2135         struct common_audit_data ad;
2136         struct file *file, *devnull = NULL;
2137         struct tty_struct *tty;
2138         struct fdtable *fdt;
2139         long j = -1;
2140         int drop_tty = 0;
2141
2142         tty = get_current_tty();
2143         if (tty) {
2144                 spin_lock(&tty_files_lock);
2145                 if (!list_empty(&tty->tty_files)) {
2146                         struct tty_file_private *file_priv;
2147                         struct inode *inode;
2148
2149                         /* Revalidate access to controlling tty.
2150                            Use inode_has_perm on the tty inode directly rather
2151                            than using file_has_perm, as this particular open
2152                            file may belong to another process and we are only
2153                            interested in the inode-based check here. */
2154                         file_priv = list_first_entry(&tty->tty_files,
2155                                                 struct tty_file_private, list);
2156                         file = file_priv->file;
2157                         inode = file->f_path.dentry->d_inode;
2158                         if (inode_has_perm_noadp(cred, inode,
2159                                            FILE__READ | FILE__WRITE, 0)) {
2160                                 drop_tty = 1;
2161                         }
2162                 }
2163                 spin_unlock(&tty_files_lock);
2164                 tty_kref_put(tty);
2165         }
2166         /* Reset controlling tty. */
2167         if (drop_tty)
2168                 no_tty();
2169
2170         /* Revalidate access to inherited open files. */
2171
2172         COMMON_AUDIT_DATA_INIT(&ad, INODE);
2173
2174         spin_lock(&files->file_lock);
2175         for (;;) {
2176                 unsigned long set, i;
2177                 int fd;
2178
2179                 j++;
2180                 i = j * __NFDBITS;
2181                 fdt = files_fdtable(files);
2182                 if (i >= fdt->max_fds)
2183                         break;
2184                 set = fdt->open_fds->fds_bits[j];
2185                 if (!set)
2186                         continue;
2187                 spin_unlock(&files->file_lock);
2188                 for ( ; set ; i++, set >>= 1) {
2189                         if (set & 1) {
2190                                 file = fget(i);
2191                                 if (!file)
2192                                         continue;
2193                                 if (file_has_perm(cred,
2194                                                   file,
2195                                                   file_to_av(file))) {
2196                                         sys_close(i);
2197                                         fd = get_unused_fd();
2198                                         if (fd != i) {
2199                                                 if (fd >= 0)
2200                                                         put_unused_fd(fd);
2201                                                 fput(file);
2202                                                 continue;
2203                                         }
2204                                         if (devnull) {
2205                                                 get_file(devnull);
2206                                         } else {
2207                                                 devnull = dentry_open(
2208                                                         dget(selinux_null),
2209                                                         mntget(selinuxfs_mount),
2210                                                         O_RDWR, cred);
2211                                                 if (IS_ERR(devnull)) {
2212                                                         devnull = NULL;
2213                                                         put_unused_fd(fd);
2214                                                         fput(file);
2215                                                         continue;
2216                                                 }
2217                                         }
2218                                         fd_install(fd, devnull);
2219                                 }
2220                                 fput(file);
2221                         }
2222                 }
2223                 spin_lock(&files->file_lock);
2224
2225         }
2226         spin_unlock(&files->file_lock);
2227 }
2228
2229 /*
2230  * Prepare a process for imminent new credential changes due to exec
2231  */
2232 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2233 {
2234         struct task_security_struct *new_tsec;
2235         struct rlimit *rlim, *initrlim;
2236         int rc, i;
2237
2238         new_tsec = bprm->cred->security;
2239         if (new_tsec->sid == new_tsec->osid)
2240                 return;
2241
2242         /* Close files for which the new task SID is not authorized. */
2243         flush_unauthorized_files(bprm->cred, current->files);
2244
2245         /* Always clear parent death signal on SID transitions. */
2246         current->pdeath_signal = 0;
2247
2248         /* Check whether the new SID can inherit resource limits from the old
2249          * SID.  If not, reset all soft limits to the lower of the current
2250          * task's hard limit and the init task's soft limit.
2251          *
2252          * Note that the setting of hard limits (even to lower them) can be
2253          * controlled by the setrlimit check.  The inclusion of the init task's
2254          * soft limit into the computation is to avoid resetting soft limits
2255          * higher than the default soft limit for cases where the default is
2256          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2257          */
2258         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2259                           PROCESS__RLIMITINH, NULL);
2260         if (rc) {
2261                 /* protect against do_prlimit() */
2262                 task_lock(current);
2263                 for (i = 0; i < RLIM_NLIMITS; i++) {
2264                         rlim = current->signal->rlim + i;
2265                         initrlim = init_task.signal->rlim + i;
2266                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2267                 }
2268                 task_unlock(current);
2269                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2270         }
2271 }
2272
2273 /*
2274  * Clean up the process immediately after the installation of new credentials
2275  * due to exec
2276  */
2277 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2278 {
2279         const struct task_security_struct *tsec = current_security();
2280         struct itimerval itimer;
2281         u32 osid, sid;
2282         int rc, i;
2283
2284         osid = tsec->osid;
2285         sid = tsec->sid;
2286
2287         if (sid == osid)
2288                 return;
2289
2290         /* Check whether the new SID can inherit signal state from the old SID.
2291          * If not, clear itimers to avoid subsequent signal generation and
2292          * flush and unblock signals.
2293          *
2294          * This must occur _after_ the task SID has been updated so that any
2295          * kill done after the flush will be checked against the new SID.
2296          */
2297         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2298         if (rc) {
2299                 memset(&itimer, 0, sizeof itimer);
2300                 for (i = 0; i < 3; i++)
2301                         do_setitimer(i, &itimer, NULL);
2302                 spin_lock_irq(&current->sighand->siglock);
2303                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2304                         __flush_signals(current);
2305                         flush_signal_handlers(current, 1);
2306                         sigemptyset(&current->blocked);
2307                 }
2308                 spin_unlock_irq(&current->sighand->siglock);
2309         }
2310
2311         /* Wake up the parent if it is waiting so that it can recheck
2312          * wait permission to the new task SID. */
2313         read_lock(&tasklist_lock);
2314         __wake_up_parent(current, current->real_parent);
2315         read_unlock(&tasklist_lock);
2316 }
2317
2318 /* superblock security operations */
2319
2320 static int selinux_sb_alloc_security(struct super_block *sb)
2321 {
2322         return superblock_alloc_security(sb);
2323 }
2324
2325 static void selinux_sb_free_security(struct super_block *sb)
2326 {
2327         superblock_free_security(sb);
2328 }
2329
2330 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2331 {
2332         if (plen > olen)
2333                 return 0;
2334
2335         return !memcmp(prefix, option, plen);
2336 }
2337
2338 static inline int selinux_option(char *option, int len)
2339 {
2340         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2341                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2342                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2343                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2344                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2345 }
2346
2347 static inline void take_option(char **to, char *from, int *first, int len)
2348 {
2349         if (!*first) {
2350                 **to = ',';
2351                 *to += 1;
2352         } else
2353                 *first = 0;
2354         memcpy(*to, from, len);
2355         *to += len;
2356 }
2357
2358 static inline void take_selinux_option(char **to, char *from, int *first,
2359                                        int len)
2360 {
2361         int current_size = 0;
2362
2363         if (!*first) {
2364                 **to = '|';
2365                 *to += 1;
2366         } else
2367                 *first = 0;
2368
2369         while (current_size < len) {
2370                 if (*from != '"') {
2371                         **to = *from;
2372                         *to += 1;
2373                 }
2374                 from += 1;
2375                 current_size += 1;
2376         }
2377 }
2378
2379 static int selinux_sb_copy_data(char *orig, char *copy)
2380 {
2381         int fnosec, fsec, rc = 0;
2382         char *in_save, *in_curr, *in_end;
2383         char *sec_curr, *nosec_save, *nosec;
2384         int open_quote = 0;
2385
2386         in_curr = orig;
2387         sec_curr = copy;
2388
2389         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2390         if (!nosec) {
2391                 rc = -ENOMEM;
2392                 goto out;
2393         }
2394
2395         nosec_save = nosec;
2396         fnosec = fsec = 1;
2397         in_save = in_end = orig;
2398
2399         do {
2400                 if (*in_end == '"')
2401                         open_quote = !open_quote;
2402                 if ((*in_end == ',' && open_quote == 0) ||
2403                                 *in_end == '\0') {
2404                         int len = in_end - in_curr;
2405
2406                         if (selinux_option(in_curr, len))
2407                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2408                         else
2409                                 take_option(&nosec, in_curr, &fnosec, len);
2410
2411                         in_curr = in_end + 1;
2412                 }
2413         } while (*in_end++);
2414
2415         strcpy(in_save, nosec_save);
2416         free_page((unsigned long)nosec_save);
2417 out:
2418         return rc;
2419 }
2420
2421 static int selinux_sb_remount(struct super_block *sb, void *data)
2422 {
2423         int rc, i, *flags;
2424         struct security_mnt_opts opts;
2425         char *secdata, **mount_options;
2426         struct superblock_security_struct *sbsec = sb->s_security;
2427
2428         if (!(sbsec->flags & SE_SBINITIALIZED))
2429                 return 0;
2430
2431         if (!data)
2432                 return 0;
2433
2434         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2435                 return 0;
2436
2437         security_init_mnt_opts(&opts);
2438         secdata = alloc_secdata();
2439         if (!secdata)
2440                 return -ENOMEM;
2441         rc = selinux_sb_copy_data(data, secdata);
2442         if (rc)
2443                 goto out_free_secdata;
2444
2445         rc = selinux_parse_opts_str(secdata, &opts);
2446         if (rc)
2447                 goto out_free_secdata;
2448
2449         mount_options = opts.mnt_opts;
2450         flags = opts.mnt_opts_flags;
2451
2452         for (i = 0; i < opts.num_mnt_opts; i++) {
2453                 u32 sid;
2454                 size_t len;
2455
2456                 if (flags[i] == SE_SBLABELSUPP)
2457                         continue;
2458                 len = strlen(mount_options[i]);
2459                 rc = security_context_to_sid(mount_options[i], len, &sid);
2460                 if (rc) {
2461                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2462                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2463                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2464                         goto out_free_opts;
2465                 }
2466                 rc = -EINVAL;
2467                 switch (flags[i]) {
2468                 case FSCONTEXT_MNT:
2469                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2470                                 goto out_bad_option;
2471                         break;
2472                 case CONTEXT_MNT:
2473                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2474                                 goto out_bad_option;
2475                         break;
2476                 case ROOTCONTEXT_MNT: {
2477                         struct inode_security_struct *root_isec;
2478                         root_isec = sb->s_root->d_inode->i_security;
2479
2480                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2481                                 goto out_bad_option;
2482                         break;
2483                 }
2484                 case DEFCONTEXT_MNT:
2485                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2486                                 goto out_bad_option;
2487                         break;
2488                 default:
2489                         goto out_free_opts;
2490                 }
2491         }
2492
2493         rc = 0;
2494 out_free_opts:
2495         security_free_mnt_opts(&opts);
2496 out_free_secdata:
2497         free_secdata(secdata);
2498         return rc;
2499 out_bad_option:
2500         printk(KERN_WARNING "SELinux: unable to change security options "
2501                "during remount (dev %s, type=%s)\n", sb->s_id,
2502                sb->s_type->name);
2503         goto out_free_opts;
2504 }
2505
2506 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2507 {
2508         const struct cred *cred = current_cred();
2509         struct common_audit_data ad;
2510         int rc;
2511
2512         rc = superblock_doinit(sb, data);
2513         if (rc)
2514                 return rc;
2515
2516         /* Allow all mounts performed by the kernel */
2517         if (flags & MS_KERNMOUNT)
2518                 return 0;
2519
2520         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2521         ad.u.dentry = sb->s_root;
2522         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2523 }
2524
2525 static int selinux_sb_statfs(struct dentry *dentry)
2526 {
2527         const struct cred *cred = current_cred();
2528         struct common_audit_data ad;
2529
2530         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2531         ad.u.dentry = dentry->d_sb->s_root;
2532         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2533 }
2534
2535 static int selinux_mount(char *dev_name,
2536                          struct path *path,
2537                          char *type,
2538                          unsigned long flags,
2539                          void *data)
2540 {
2541         const struct cred *cred = current_cred();
2542
2543         if (flags & MS_REMOUNT)
2544                 return superblock_has_perm(cred, path->mnt->mnt_sb,
2545                                            FILESYSTEM__REMOUNT, NULL);
2546         else
2547                 return path_has_perm(cred, path, FILE__MOUNTON);
2548 }
2549
2550 static int selinux_umount(struct vfsmount *mnt, int flags)
2551 {
2552         const struct cred *cred = current_cred();
2553
2554         return superblock_has_perm(cred, mnt->mnt_sb,
2555                                    FILESYSTEM__UNMOUNT, NULL);
2556 }
2557
2558 /* inode security operations */
2559
2560 static int selinux_inode_alloc_security(struct inode *inode)
2561 {
2562         return inode_alloc_security(inode);
2563 }
2564
2565 static void selinux_inode_free_security(struct inode *inode)
2566 {
2567         inode_free_security(inode);
2568 }
2569
2570 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2571                                        const struct qstr *qstr, char **name,
2572                                        void **value, size_t *len)
2573 {
2574         const struct task_security_struct *tsec = current_security();
2575         struct inode_security_struct *dsec;
2576         struct superblock_security_struct *sbsec;
2577         u32 sid, newsid, clen;
2578         int rc;
2579         char *namep = NULL, *context;
2580
2581         dsec = dir->i_security;
2582         sbsec = dir->i_sb->s_security;
2583
2584         sid = tsec->sid;
2585         newsid = tsec->create_sid;
2586
2587         if ((sbsec->flags & SE_SBINITIALIZED) &&
2588             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2589                 newsid = sbsec->mntpoint_sid;
2590         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2591                 rc = security_transition_sid(sid, dsec->sid,
2592                                              inode_mode_to_security_class(inode->i_mode),
2593                                              qstr, &newsid);
2594                 if (rc) {
2595                         printk(KERN_WARNING "%s:  "
2596                                "security_transition_sid failed, rc=%d (dev=%s "
2597                                "ino=%ld)\n",
2598                                __func__,
2599                                -rc, inode->i_sb->s_id, inode->i_ino);
2600                         return rc;
2601                 }
2602         }
2603
2604         /* Possibly defer initialization to selinux_complete_init. */
2605         if (sbsec->flags & SE_SBINITIALIZED) {
2606                 struct inode_security_struct *isec = inode->i_security;
2607                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2608                 isec->sid = newsid;
2609                 isec->initialized = 1;
2610         }
2611
2612         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2613                 return -EOPNOTSUPP;
2614
2615         if (name) {
2616                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2617                 if (!namep)
2618                         return -ENOMEM;
2619                 *name = namep;
2620         }
2621
2622         if (value && len) {
2623                 rc = security_sid_to_context_force(newsid, &context, &clen);
2624                 if (rc) {
2625                         kfree(namep);
2626                         return rc;
2627                 }
2628                 *value = context;
2629                 *len = clen;
2630         }
2631
2632         return 0;
2633 }
2634
2635 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2636 {
2637         return may_create(dir, dentry, SECCLASS_FILE);
2638 }
2639
2640 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2641 {
2642         return may_link(dir, old_dentry, MAY_LINK);
2643 }
2644
2645 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2646 {
2647         return may_link(dir, dentry, MAY_UNLINK);
2648 }
2649
2650 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2651 {
2652         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2653 }
2654
2655 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2656 {
2657         return may_create(dir, dentry, SECCLASS_DIR);
2658 }
2659
2660 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2661 {
2662         return may_link(dir, dentry, MAY_RMDIR);
2663 }
2664
2665 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2666 {
2667         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2668 }
2669
2670 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2671                                 struct inode *new_inode, struct dentry *new_dentry)
2672 {
2673         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2674 }
2675
2676 static int selinux_inode_readlink(struct dentry *dentry)
2677 {
2678         const struct cred *cred = current_cred();
2679
2680         return dentry_has_perm(cred, dentry, FILE__READ);
2681 }
2682
2683 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2684 {
2685         const struct cred *cred = current_cred();
2686
2687         return dentry_has_perm(cred, dentry, FILE__READ);
2688 }
2689
2690 static int selinux_inode_permission(struct inode *inode, int mask)
2691 {
2692         const struct cred *cred = current_cred();
2693         struct common_audit_data ad;
2694         u32 perms;
2695         bool from_access;
2696         unsigned flags = mask & MAY_NOT_BLOCK;
2697
2698         from_access = mask & MAY_ACCESS;
2699         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2700
2701         /* No permission to check.  Existence test. */
2702         if (!mask)
2703                 return 0;
2704
2705         COMMON_AUDIT_DATA_INIT(&ad, INODE);
2706         ad.u.inode = inode;
2707
2708         if (from_access)
2709                 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2710
2711         perms = file_mask_to_av(inode->i_mode, mask);
2712
2713         return inode_has_perm(cred, inode, perms, &ad, flags);
2714 }
2715
2716 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2717 {
2718         const struct cred *cred = current_cred();
2719         unsigned int ia_valid = iattr->ia_valid;
2720
2721         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2722         if (ia_valid & ATTR_FORCE) {
2723                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2724                               ATTR_FORCE);
2725                 if (!ia_valid)
2726                         return 0;
2727         }
2728
2729         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2730                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2731                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2732
2733         return dentry_has_perm(cred, dentry, FILE__WRITE);
2734 }
2735
2736 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2737 {
2738         const struct cred *cred = current_cred();
2739         struct path path;
2740
2741         path.dentry = dentry;
2742         path.mnt = mnt;
2743
2744         return path_has_perm(cred, &path, FILE__GETATTR);
2745 }
2746
2747 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2748 {
2749         const struct cred *cred = current_cred();
2750
2751         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2752                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2753                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2754                         if (!capable(CAP_SETFCAP))
2755                                 return -EPERM;
2756                 } else if (!capable(CAP_SYS_ADMIN)) {
2757                         /* A different attribute in the security namespace.
2758                            Restrict to administrator. */
2759                         return -EPERM;
2760                 }
2761         }
2762
2763         /* Not an attribute we recognize, so just check the
2764            ordinary setattr permission. */
2765         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2766 }
2767
2768 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2769                                   const void *value, size_t size, int flags)
2770 {
2771         struct inode *inode = dentry->d_inode;
2772         struct inode_security_struct *isec = inode->i_security;
2773         struct superblock_security_struct *sbsec;
2774         struct common_audit_data ad;
2775         u32 newsid, sid = current_sid();
2776         int rc = 0;
2777
2778         if (strcmp(name, XATTR_NAME_SELINUX))
2779                 return selinux_inode_setotherxattr(dentry, name);
2780
2781         sbsec = inode->i_sb->s_security;
2782         if (!(sbsec->flags & SE_SBLABELSUPP))
2783                 return -EOPNOTSUPP;
2784
2785         if (!inode_owner_or_capable(inode))
2786                 return -EPERM;
2787
2788         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2789         ad.u.dentry = dentry;
2790
2791         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2792                           FILE__RELABELFROM, &ad);
2793         if (rc)
2794                 return rc;
2795
2796         rc = security_context_to_sid(value, size, &newsid);
2797         if (rc == -EINVAL) {
2798                 if (!capable(CAP_MAC_ADMIN))
2799                         return rc;
2800                 rc = security_context_to_sid_force(value, size, &newsid);
2801         }
2802         if (rc)
2803                 return rc;
2804
2805         rc = avc_has_perm(sid, newsid, isec->sclass,
2806                           FILE__RELABELTO, &ad);
2807         if (rc)
2808                 return rc;
2809
2810         rc = security_validate_transition(isec->sid, newsid, sid,
2811                                           isec->sclass);
2812         if (rc)
2813                 return rc;
2814
2815         return avc_has_perm(newsid,
2816                             sbsec->sid,
2817                             SECCLASS_FILESYSTEM,
2818                             FILESYSTEM__ASSOCIATE,
2819                             &ad);
2820 }
2821
2822 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2823                                         const void *value, size_t size,
2824                                         int flags)
2825 {
2826         struct inode *inode = dentry->d_inode;
2827         struct inode_security_struct *isec = inode->i_security;
2828         u32 newsid;
2829         int rc;
2830
2831         if (strcmp(name, XATTR_NAME_SELINUX)) {
2832                 /* Not an attribute we recognize, so nothing to do. */
2833                 return;
2834         }
2835
2836         rc = security_context_to_sid_force(value, size, &newsid);
2837         if (rc) {
2838                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2839                        "for (%s, %lu), rc=%d\n",
2840                        inode->i_sb->s_id, inode->i_ino, -rc);
2841                 return;
2842         }
2843
2844         isec->sid = newsid;
2845         return;
2846 }
2847
2848 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2849 {
2850         const struct cred *cred = current_cred();
2851
2852         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2853 }
2854
2855 static int selinux_inode_listxattr(struct dentry *dentry)
2856 {
2857         const struct cred *cred = current_cred();
2858
2859         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2860 }
2861
2862 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2863 {
2864         if (strcmp(name, XATTR_NAME_SELINUX))
2865                 return selinux_inode_setotherxattr(dentry, name);
2866
2867         /* No one is allowed to remove a SELinux security label.
2868            You can change the label, but all data must be labeled. */
2869         return -EACCES;
2870 }
2871
2872 /*
2873  * Copy the inode security context value to the user.
2874  *
2875  * Permission check is handled by selinux_inode_getxattr hook.
2876  */
2877 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2878 {
2879         u32 size;
2880         int error;
2881         char *context = NULL;
2882         struct inode_security_struct *isec = inode->i_security;
2883
2884         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2885                 return -EOPNOTSUPP;
2886
2887         /*
2888          * If the caller has CAP_MAC_ADMIN, then get the raw context
2889          * value even if it is not defined by current policy; otherwise,
2890          * use the in-core value under current policy.
2891          * Use the non-auditing forms of the permission checks since
2892          * getxattr may be called by unprivileged processes commonly
2893          * and lack of permission just means that we fall back to the
2894          * in-core context value, not a denial.
2895          */
2896         error = selinux_capable(current, current_cred(),
2897                                 &init_user_ns, CAP_MAC_ADMIN,
2898                                 SECURITY_CAP_NOAUDIT);
2899         if (!error)
2900                 error = security_sid_to_context_force(isec->sid, &context,
2901                                                       &size);
2902         else
2903                 error = security_sid_to_context(isec->sid, &context, &size);
2904         if (error)
2905                 return error;
2906         error = size;
2907         if (alloc) {
2908                 *buffer = context;
2909                 goto out_nofree;
2910         }
2911         kfree(context);
2912 out_nofree:
2913         return error;
2914 }
2915
2916 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2917                                      const void *value, size_t size, int flags)
2918 {
2919         struct inode_security_struct *isec = inode->i_security;
2920         u32 newsid;
2921         int rc;
2922
2923         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2924                 return -EOPNOTSUPP;
2925
2926         if (!value || !size)
2927                 return -EACCES;
2928
2929         rc = security_context_to_sid((void *)value, size, &newsid);
2930         if (rc)
2931                 return rc;
2932
2933         isec->sid = newsid;
2934         isec->initialized = 1;
2935         return 0;
2936 }
2937
2938 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2939 {
2940         const int len = sizeof(XATTR_NAME_SELINUX);
2941         if (buffer && len <= buffer_size)
2942                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2943         return len;
2944 }
2945
2946 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2947 {
2948         struct inode_security_struct *isec = inode->i_security;
2949         *secid = isec->sid;
2950 }
2951
2952 /* file security operations */
2953
2954 static int selinux_revalidate_file_permission(struct file *file, int mask)
2955 {
2956         const struct cred *cred = current_cred();
2957         struct inode *inode = file->f_path.dentry->d_inode;
2958
2959         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2960         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2961                 mask |= MAY_APPEND;
2962
2963         return file_has_perm(cred, file,
2964                              file_mask_to_av(inode->i_mode, mask));
2965 }
2966
2967 static int selinux_file_permission(struct file *file, int mask)
2968 {
2969         struct inode *inode = file->f_path.dentry->d_inode;
2970         struct file_security_struct *fsec = file->f_security;
2971         struct inode_security_struct *isec = inode->i_security;
2972         u32 sid = current_sid();
2973
2974         if (!mask)
2975                 /* No permission to check.  Existence test. */
2976                 return 0;
2977
2978         if (sid == fsec->sid && fsec->isid == isec->sid &&
2979             fsec->pseqno == avc_policy_seqno())
2980                 /* No change since dentry_open check. */
2981                 return 0;
2982
2983         return selinux_revalidate_file_permission(file, mask);
2984 }
2985
2986 static int selinux_file_alloc_security(struct file *file)
2987 {
2988         return file_alloc_security(file);
2989 }
2990
2991 static void selinux_file_free_security(struct file *file)
2992 {
2993         file_free_security(file);
2994 }
2995
2996 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2997                               unsigned long arg)
2998 {
2999         const struct cred *cred = current_cred();
3000         int error = 0;
3001
3002         switch (cmd) {
3003         case FIONREAD:
3004         /* fall through */
3005         case FIBMAP:
3006         /* fall through */
3007         case FIGETBSZ:
3008         /* fall through */
3009         case EXT2_IOC_GETFLAGS:
3010         /* fall through */
3011         case EXT2_IOC_GETVERSION:
3012                 error = file_has_perm(cred, file, FILE__GETATTR);
3013                 break;
3014
3015         case EXT2_IOC_SETFLAGS:
3016         /* fall through */
3017         case EXT2_IOC_SETVERSION:
3018                 error = file_has_perm(cred, file, FILE__SETATTR);
3019                 break;
3020
3021         /* sys_ioctl() checks */
3022         case FIONBIO:
3023         /* fall through */
3024         case FIOASYNC:
3025                 error = file_has_perm(cred, file, 0);
3026                 break;
3027
3028         case KDSKBENT:
3029         case KDSKBSENT:
3030                 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
3031                                         SECURITY_CAP_AUDIT);
3032                 break;
3033
3034         /* default case assumes that the command will go
3035          * to the file's ioctl() function.
3036          */
3037         default:
3038                 error = file_has_perm(cred, file, FILE__IOCTL);
3039         }
3040         return error;
3041 }
3042
3043 static int default_noexec;
3044
3045 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3046 {
3047         const struct cred *cred = current_cred();
3048         int rc = 0;
3049
3050         if (default_noexec &&
3051             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3052                 /*
3053                  * We are making executable an anonymous mapping or a
3054                  * private file mapping that will also be writable.
3055                  * This has an additional check.
3056                  */
3057                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3058                 if (rc)
3059                         goto error;
3060         }
3061
3062         if (file) {
3063                 /* read access is always possible with a mapping */
3064                 u32 av = FILE__READ;
3065
3066                 /* write access only matters if the mapping is shared */
3067                 if (shared && (prot & PROT_WRITE))
3068                         av |= FILE__WRITE;
3069
3070                 if (prot & PROT_EXEC)
3071                         av |= FILE__EXECUTE;
3072
3073                 return file_has_perm(cred, file, av);
3074         }
3075
3076 error:
3077         return rc;
3078 }
3079
3080 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3081                              unsigned long prot, unsigned long flags,
3082                              unsigned long addr, unsigned long addr_only)
3083 {
3084         int rc = 0;
3085         u32 sid = current_sid();
3086
3087         /*
3088          * notice that we are intentionally putting the SELinux check before
3089          * the secondary cap_file_mmap check.  This is such a likely attempt
3090          * at bad behaviour/exploit that we always want to get the AVC, even
3091          * if DAC would have also denied the operation.
3092          */
3093         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3094                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3095                                   MEMPROTECT__MMAP_ZERO, NULL);
3096                 if (rc)
3097                         return rc;
3098         }
3099
3100         /* do DAC check on address space usage */
3101         rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3102         if (rc || addr_only)
3103                 return rc;
3104
3105         if (selinux_checkreqprot)
3106                 prot = reqprot;
3107
3108         return file_map_prot_check(file, prot,
3109                                    (flags & MAP_TYPE) == MAP_SHARED);
3110 }
3111
3112 static int selinux_file_mprotect(struct vm_area_struct *vma,
3113                                  unsigned long reqprot,
3114                                  unsigned long prot)
3115 {
3116         const struct cred *cred = current_cred();
3117
3118         if (selinux_checkreqprot)
3119                 prot = reqprot;
3120
3121         if (default_noexec &&
3122             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3123                 int rc = 0;
3124                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3125                     vma->vm_end <= vma->vm_mm->brk) {
3126                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3127                 } else if (!vma->vm_file &&
3128                            vma->vm_start <= vma->vm_mm->start_stack &&
3129                            vma->vm_end >= vma->vm_mm->start_stack) {
3130                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3131                 } else if (vma->vm_file && vma->anon_vma) {
3132                         /*
3133                          * We are making executable a file mapping that has
3134                          * had some COW done. Since pages might have been
3135                          * written, check ability to execute the possibly
3136                          * modified content.  This typically should only
3137                          * occur for text relocations.
3138                          */
3139                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3140                 }
3141                 if (rc)
3142                         return rc;
3143         }
3144
3145         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3146 }
3147
3148 static int selinux_file_lock(struct file *file, unsigned int cmd)
3149 {
3150         const struct cred *cred = current_cred();
3151
3152         return file_has_perm(cred, file, FILE__LOCK);
3153 }
3154
3155 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3156                               unsigned long arg)
3157 {
3158         const struct cred *cred = current_cred();
3159         int err = 0;
3160
3161         switch (cmd) {
3162         case F_SETFL:
3163                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3164                         err = -EINVAL;
3165                         break;
3166                 }
3167
3168                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3169                         err = file_has_perm(cred, file, FILE__WRITE);
3170                         break;
3171                 }
3172                 /* fall through */
3173         case F_SETOWN:
3174         case F_SETSIG:
3175         case F_GETFL:
3176         case F_GETOWN:
3177         case F_GETSIG:
3178                 /* Just check FD__USE permission */
3179                 err = file_has_perm(cred, file, 0);
3180                 break;
3181         case F_GETLK:
3182         case F_SETLK:
3183         case F_SETLKW:
3184 #if BITS_PER_LONG == 32
3185         case F_GETLK64:
3186         case F_SETLK64:
3187         case F_SETLKW64:
3188 #endif
3189                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3190                         err = -EINVAL;
3191                         break;
3192                 }
3193                 err = file_has_perm(cred, file, FILE__LOCK);
3194                 break;
3195         }
3196
3197         return err;
3198 }
3199
3200 static int selinux_file_set_fowner(struct file *file)
3201 {
3202         struct file_security_struct *fsec;
3203
3204         fsec = file->f_security;
3205         fsec->fown_sid = current_sid();
3206
3207         return 0;
3208 }
3209
3210 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3211                                        struct fown_struct *fown, int signum)
3212 {
3213         struct file *file;
3214         u32 sid = task_sid(tsk);
3215         u32 perm;
3216         struct file_security_struct *fsec;
3217
3218         /* struct fown_struct is never outside the context of a struct file */
3219         file = container_of(fown, struct file, f_owner);
3220
3221         fsec = file->f_security;
3222
3223         if (!signum)
3224                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3225         else
3226                 perm = signal_to_av(signum);
3227
3228         return avc_has_perm(fsec->fown_sid, sid,
3229                             SECCLASS_PROCESS, perm, NULL);
3230 }
3231
3232 static int selinux_file_receive(struct file *file)
3233 {
3234         const struct cred *cred = current_cred();
3235
3236         return file_has_perm(cred, file, file_to_av(file));
3237 }
3238
3239 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3240 {
3241         struct file_security_struct *fsec;
3242         struct inode *inode;
3243         struct inode_security_struct *isec;
3244
3245         inode = file->f_path.dentry->d_inode;
3246         fsec = file->f_security;
3247         isec = inode->i_security;
3248         /*
3249          * Save inode label and policy sequence number
3250          * at open-time so that selinux_file_permission
3251          * can determine whether revalidation is necessary.
3252          * Task label is already saved in the file security
3253          * struct as its SID.
3254          */
3255         fsec->isid = isec->sid;
3256         fsec->pseqno = avc_policy_seqno();
3257         /*
3258          * Since the inode label or policy seqno may have changed
3259          * between the selinux_inode_permission check and the saving
3260          * of state above, recheck that access is still permitted.
3261          * Otherwise, access might never be revalidated against the
3262          * new inode label or new policy.
3263          * This check is not redundant - do not remove.
3264          */
3265         return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
3266 }
3267
3268 /* task security operations */
3269
3270 static int selinux_task_create(unsigned long clone_flags)
3271 {
3272         return current_has_perm(current, PROCESS__FORK);
3273 }
3274
3275 /*
3276  * allocate the SELinux part of blank credentials
3277  */
3278 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3279 {
3280         struct task_security_struct *tsec;
3281
3282         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3283         if (!tsec)
3284                 return -ENOMEM;
3285
3286         cred->security = tsec;
3287         return 0;
3288 }
3289
3290 /*
3291  * detach and free the LSM part of a set of credentials
3292  */
3293 static void selinux_cred_free(struct cred *cred)
3294 {
3295         struct task_security_struct *tsec = cred->security;
3296
3297         /*
3298          * cred->security == NULL if security_cred_alloc_blank() or
3299          * security_prepare_creds() returned an error.
3300          */
3301         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3302         cred->security = (void *) 0x7UL;
3303         kfree(tsec);
3304 }
3305
3306 /*
3307  * prepare a new set of credentials for modification
3308  */
3309 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3310                                 gfp_t gfp)
3311 {
3312         const struct task_security_struct *old_tsec;
3313         struct task_security_struct *tsec;
3314
3315         old_tsec = old->security;
3316
3317         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3318         if (!tsec)
3319                 return -ENOMEM;
3320
3321         new->security = tsec;
3322         return 0;
3323 }
3324
3325 /*
3326  * transfer the SELinux data to a blank set of creds
3327  */
3328 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3329 {
3330         const struct task_security_struct *old_tsec = old->security;
3331         struct task_security_struct *tsec = new->security;
3332
3333         *tsec = *old_tsec;
3334 }
3335
3336 /*
3337  * set the security data for a kernel service
3338  * - all the creation contexts are set to unlabelled
3339  */
3340 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3341 {
3342         struct task_security_struct *tsec = new->security;
3343         u32 sid = current_sid();
3344         int ret;
3345
3346         ret = avc_has_perm(sid, secid,
3347                            SECCLASS_KERNEL_SERVICE,
3348                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3349                            NULL);
3350         if (ret == 0) {
3351                 tsec->sid = secid;
3352                 tsec->create_sid = 0;
3353                 tsec->keycreate_sid = 0;
3354                 tsec->sockcreate_sid = 0;
3355         }
3356         return ret;
3357 }
3358
3359 /*
3360  * set the file creation context in a security record to the same as the
3361  * objective context of the specified inode
3362  */
3363 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3364 {
3365         struct inode_security_struct *isec = inode->i_security;
3366         struct task_security_struct *tsec = new->security;
3367         u32 sid = current_sid();
3368         int ret;
3369
3370         ret = avc_has_perm(sid, isec->sid,
3371                            SECCLASS_KERNEL_SERVICE,
3372                            KERNEL_SERVICE__CREATE_FILES_AS,
3373                            NULL);
3374
3375         if (ret == 0)
3376                 tsec->create_sid = isec->sid;
3377         return ret;
3378 }
3379
3380 static int selinux_kernel_module_request(char *kmod_name)
3381 {
3382         u32 sid;
3383         struct common_audit_data ad;
3384
3385         sid = task_sid(current);
3386
3387         COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3388         ad.u.kmod_name = kmod_name;
3389
3390         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3391                             SYSTEM__MODULE_REQUEST, &ad);
3392 }
3393
3394 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3395 {
3396         return current_has_perm(p, PROCESS__SETPGID);
3397 }
3398
3399 static int selinux_task_getpgid(struct task_struct *p)
3400 {
3401         return current_has_perm(p, PROCESS__GETPGID);
3402 }
3403
3404 static int selinux_task_getsid(struct task_struct *p)
3405 {
3406         return current_has_perm(p, PROCESS__GETSESSION);
3407 }
3408
3409 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3410 {
3411         *secid = task_sid(p);
3412 }
3413
3414 static int selinux_task_setnice(struct task_struct *p, int nice)
3415 {
3416         int rc;
3417
3418         rc = cap_task_setnice(p, nice);
3419         if (rc)
3420                 return rc;
3421
3422         return current_has_perm(p, PROCESS__SETSCHED);
3423 }
3424
3425 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3426 {
3427         int rc;
3428
3429         rc = cap_task_setioprio(p, ioprio);
3430         if (rc)
3431                 return rc;
3432
3433         return current_has_perm(p, PROCESS__SETSCHED);
3434 }
3435
3436 static int selinux_task_getioprio(struct task_struct *p)
3437 {
3438         return current_has_perm(p, PROCESS__GETSCHED);
3439 }
3440
3441 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3442                 struct rlimit *new_rlim)
3443 {
3444         struct rlimit *old_rlim = p->signal->rlim + resource;
3445
3446         /* Control the ability to change the hard limit (whether
3447            lowering or raising it), so that the hard limit can
3448            later be used as a safe reset point for the soft limit
3449            upon context transitions.  See selinux_bprm_committing_creds. */
3450         if (old_rlim->rlim_max != new_rlim->rlim_max)
3451                 return current_has_perm(p, PROCESS__SETRLIMIT);
3452
3453         return 0;
3454 }
3455
3456 static int selinux_task_setscheduler(struct task_struct *p)
3457 {
3458         int rc;
3459
3460         rc = cap_task_setscheduler(p);
3461         if (rc)
3462                 return rc;
3463
3464         return current_has_perm(p, PROCESS__SETSCHED);
3465 }
3466
3467 static int selinux_task_getscheduler(struct task_struct *p)
3468 {
3469         return current_has_perm(p, PROCESS__GETSCHED);
3470 }
3471
3472 static int selinux_task_movememory(struct task_struct *p)
3473 {
3474         return current_has_perm(p, PROCESS__SETSCHED);
3475 }
3476
3477 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3478                                 int sig, u32 secid)
3479 {
3480         u32 perm;
3481         int rc;
3482
3483         if (!sig)
3484                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3485         else
3486                 perm = signal_to_av(sig);
3487         if (secid)
3488                 rc = avc_has_perm(secid, task_sid(p),
3489                                   SECCLASS_PROCESS, perm, NULL);
3490         else
3491                 rc = current_has_perm(p, perm);
3492         return rc;
3493 }
3494
3495 static int selinux_task_wait(struct task_struct *p)
3496 {
3497         return task_has_perm(p, current, PROCESS__SIGCHLD);
3498 }
3499
3500 static void selinux_task_to_inode(struct task_struct *p,
3501                                   struct inode *inode)
3502 {
3503         struct inode_security_struct *isec = inode->i_security;
3504         u32 sid = task_sid(p);
3505
3506         isec->sid = sid;
3507         isec->initialized = 1;
3508 }
3509
3510 /* Returns error only if unable to parse addresses */
3511 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3512                         struct common_audit_data *ad, u8 *proto)
3513 {
3514         int offset, ihlen, ret = -EINVAL;
3515         struct iphdr _iph, *ih;
3516
3517         offset = skb_network_offset(skb);
3518         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3519         if (ih == NULL)
3520                 goto out;
3521
3522         ihlen = ih->ihl * 4;
3523         if (ihlen < sizeof(_iph))
3524                 goto out;
3525
3526         ad->u.net.v4info.saddr = ih->saddr;
3527         ad->u.net.v4info.daddr = ih->daddr;
3528         ret = 0;
3529
3530         if (proto)
3531                 *proto = ih->protocol;
3532
3533         switch (ih->protocol) {
3534         case IPPROTO_TCP: {
3535                 struct tcphdr _tcph, *th;
3536
3537                 if (ntohs(ih->frag_off) & IP_OFFSET)
3538                         break;
3539
3540                 offset += ihlen;
3541                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3542                 if (th == NULL)
3543                         break;
3544
3545                 ad->u.net.sport = th->source;
3546                 ad->u.net.dport = th->dest;
3547                 break;
3548         }
3549
3550         case IPPROTO_UDP: {
3551                 struct udphdr _udph, *uh;
3552
3553                 if (ntohs(ih->frag_off) & IP_OFFSET)
3554                         break;
3555
3556                 offset += ihlen;
3557                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3558                 if (uh == NULL)
3559                         break;
3560
3561                 ad->u.net.sport = uh->source;
3562                 ad->u.net.dport = uh->dest;
3563                 break;
3564         }
3565
3566         case IPPROTO_DCCP: {
3567                 struct dccp_hdr _dccph, *dh;
3568
3569                 if (ntohs(ih->frag_off) & IP_OFFSET)
3570                         break;
3571
3572                 offset += ihlen;
3573                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3574                 if (dh == NULL)
3575                         break;
3576
3577                 ad->u.net.sport = dh->dccph_sport;
3578                 ad->u.net.dport = dh->dccph_dport;
3579                 break;
3580         }
3581
3582         default:
3583                 break;
3584         }
3585 out:
3586         return ret;
3587 }
3588
3589 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3590
3591 /* Returns error only if unable to parse addresses */
3592 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3593                         struct common_audit_data *ad, u8 *proto)
3594 {
3595         u8 nexthdr;
3596         int ret = -EINVAL, offset;
3597         struct ipv6hdr _ipv6h, *ip6;
3598
3599         offset = skb_network_offset(skb);
3600         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3601         if (ip6 == NULL)
3602                 goto out;
3603
3604         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3605         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3606         ret = 0;
3607
3608         nexthdr = ip6->nexthdr;
3609         offset += sizeof(_ipv6h);
3610         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3611         if (offset < 0)
3612                 goto out;
3613
3614         if (proto)
3615                 *proto = nexthdr;
3616
3617         switch (nexthdr) {
3618         case IPPROTO_TCP: {
3619                 struct tcphdr _tcph, *th;
3620
3621                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3622                 if (th == NULL)
3623                         break;
3624
3625                 ad->u.net.sport = th->source;
3626                 ad->u.net.dport = th->dest;
3627                 break;
3628         }
3629
3630         case IPPROTO_UDP: {
3631                 struct udphdr _udph, *uh;
3632
3633                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3634                 if (uh == NULL)
3635                         break;
3636
3637                 ad->u.net.sport = uh->source;
3638                 ad->u.net.dport = uh->dest;
3639                 break;
3640         }
3641
3642         case IPPROTO_DCCP: {
3643                 struct dccp_hdr _dccph, *dh;
3644
3645                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3646                 if (dh == NULL)
3647                         break;
3648
3649                 ad->u.net.sport = dh->dccph_sport;
3650                 ad->u.net.dport = dh->dccph_dport;
3651                 break;
3652         }
3653
3654         /* includes fragments */
3655         default:
3656                 break;
3657         }
3658 out:
3659         return ret;
3660 }
3661
3662 #endif /* IPV6 */
3663
3664 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3665                              char **_addrp, int src, u8 *proto)
3666 {
3667         char *addrp;
3668         int ret;
3669
3670         switch (ad->u.net.family) {
3671         case PF_INET:
3672                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3673                 if (ret)
3674                         goto parse_error;
3675                 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3676                                        &ad->u.net.v4info.daddr);
3677                 goto okay;
3678
3679 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3680         case PF_INET6:
3681                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3682                 if (ret)
3683                         goto parse_error;
3684                 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3685                                        &ad->u.net.v6info.daddr);
3686                 goto okay;
3687 #endif  /* IPV6 */
3688         default:
3689                 addrp = NULL;
3690                 goto okay;
3691         }
3692
3693 parse_error:
3694         printk(KERN_WARNING
3695                "SELinux: failure in selinux_parse_skb(),"
3696                " unable to parse packet\n");
3697         return ret;
3698
3699 okay:
3700         if (_addrp)
3701                 *_addrp = addrp;
3702         return 0;
3703 }
3704
3705 /**
3706  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3707  * @skb: the packet
3708  * @family: protocol family
3709  * @sid: the packet's peer label SID
3710  *
3711  * Description:
3712  * Check the various different forms of network peer labeling and determine
3713  * the peer label/SID for the packet; most of the magic actually occurs in
3714  * the security server function security_net_peersid_cmp().  The function
3715  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3716  * or -EACCES if @sid is invalid due to inconsistencies with the different
3717  * peer labels.
3718  *
3719  */
3720 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3721 {
3722         int err;
3723         u32 xfrm_sid;
3724         u32 nlbl_sid;
3725         u32 nlbl_type;
3726
3727         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3728         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3729
3730         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3731         if (unlikely(err)) {
3732                 printk(KERN_WARNING
3733                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3734                        " unable to determine packet's peer label\n");
3735                 return -EACCES;
3736         }
3737
3738         return 0;
3739 }
3740
3741 /**
3742  * selinux_conn_sid - Determine the child socket label for a connection
3743  * @sk_sid: the parent socket's SID
3744  * @skb_sid: the packet's SID
3745  * @conn_sid: the resulting connection SID
3746  *
3747  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3748  * combined with the MLS information from @skb_sid in order to create
3749  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3750  * of @sk_sid.  Returns zero on success, negative values on failure.
3751  *
3752  */
3753 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3754 {
3755         int err = 0;
3756
3757         if (skb_sid != SECSID_NULL)
3758                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3759         else
3760                 *conn_sid = sk_sid;
3761
3762         return err;
3763 }
3764
3765 /* socket security operations */
3766
3767 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3768                                  u16 secclass, u32 *socksid)
3769 {
3770         if (tsec->sockcreate_sid > SECSID_NULL) {
3771                 *socksid = tsec->sockcreate_sid;
3772                 return 0;
3773         }
3774
3775         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3776                                        socksid);
3777 }
3778
3779 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3780 {
3781         struct sk_security_struct *sksec = sk->sk_security;
3782         struct common_audit_data ad;
3783         u32 tsid = task_sid(task);
3784
3785         if (sksec->sid == SECINITSID_KERNEL)
3786                 return 0;
3787
3788         COMMON_AUDIT_DATA_INIT(&ad, NET);
3789         ad.u.net.sk = sk;
3790
3791         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3792 }
3793
3794 static int selinux_socket_create(int family, int type,
3795                                  int protocol, int kern)
3796 {
3797         const struct task_security_struct *tsec = current_security();
3798         u32 newsid;
3799         u16 secclass;
3800         int rc;
3801
3802         if (kern)
3803                 return 0;
3804
3805         secclass = socket_type_to_security_class(family, type, protocol);
3806         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3807         if (rc)
3808                 return rc;
3809
3810         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3811 }
3812
3813 static int selinux_socket_post_create(struct socket *sock, int family,
3814                                       int type, int protocol, int kern)
3815 {
3816         const struct task_security_struct *tsec = current_security();
3817         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3818         struct sk_security_struct *sksec;
3819         int err = 0;
3820
3821         isec->sclass = socket_type_to_security_class(family, type, protocol);
3822
3823         if (kern)
3824                 isec->sid = SECINITSID_KERNEL;
3825         else {
3826                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3827                 if (err)
3828                         return err;
3829         }
3830
3831         isec->initialized = 1;
3832
3833         if (sock->sk) {
3834                 sksec = sock->sk->sk_security;
3835                 sksec->sid = isec->sid;
3836                 sksec->sclass = isec->sclass;
3837                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3838         }
3839
3840         return err;
3841 }
3842
3843 /* Range of port numbers used to automatically bind.
3844    Need to determine whether we should perform a name_bind
3845    permission check between the socket and the port number. */
3846
3847 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3848 {
3849         struct sock *sk = sock->sk;
3850         u16 family;
3851         int err;
3852
3853         err = sock_has_perm(current, sk, SOCKET__BIND);
3854         if (err)
3855                 goto out;
3856
3857         /*
3858          * If PF_INET or PF_INET6, check name_bind permission for the port.
3859          * Multiple address binding for SCTP is not supported yet: we just
3860          * check the first address now.
3861          */
3862         family = sk->sk_family;
3863         if (family == PF_INET || family == PF_INET6) {
3864                 char *addrp;
3865                 struct sk_security_struct *sksec = sk->sk_security;
3866                 struct common_audit_data ad;
3867                 struct sockaddr_in *addr4 = NULL;
3868                 struct sockaddr_in6 *addr6 = NULL;
3869                 unsigned short snum;
3870                 u32 sid, node_perm;
3871
3872                 if (family == PF_INET) {
3873                         addr4 = (struct sockaddr_in *)address;
3874                         snum = ntohs(addr4->sin_port);
3875                         addrp = (char *)&addr4->sin_addr.s_addr;
3876                 } else {
3877                         addr6 = (struct sockaddr_in6 *)address;
3878                         snum = ntohs(addr6->sin6_port);
3879                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3880                 }
3881
3882                 if (snum) {
3883                         int low, high;
3884
3885                         inet_get_local_port_range(&low, &high);
3886
3887                         if (snum < max(PROT_SOCK, low) || snum > high) {
3888                                 err = sel_netport_sid(sk->sk_protocol,
3889                                                       snum, &sid);
3890                                 if (err)
3891                                         goto out;
3892                                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3893                                 ad.u.net.sport = htons(snum);
3894                                 ad.u.net.family = family;
3895                                 err = avc_has_perm(sksec->sid, sid,
3896                                                    sksec->sclass,
3897                                                    SOCKET__NAME_BIND, &ad);
3898                                 if (err)
3899                                         goto out;
3900                         }
3901                 }
3902
3903                 switch (sksec->sclass) {
3904                 case SECCLASS_TCP_SOCKET:
3905                         node_perm = TCP_SOCKET__NODE_BIND;
3906                         break;
3907
3908                 case SECCLASS_UDP_SOCKET:
3909                         node_perm = UDP_SOCKET__NODE_BIND;
3910                         break;
3911
3912                 case SECCLASS_DCCP_SOCKET:
3913                         node_perm = DCCP_SOCKET__NODE_BIND;
3914                         break;
3915
3916                 default:
3917                         node_perm = RAWIP_SOCKET__NODE_BIND;
3918                         break;
3919                 }
3920
3921                 err = sel_netnode_sid(addrp, family, &sid);
3922                 if (err)
3923                         goto out;
3924
3925                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3926                 ad.u.net.sport = htons(snum);
3927                 ad.u.net.family = family;
3928
3929                 if (family == PF_INET)
3930                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3931                 else
3932                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3933
3934                 err = avc_has_perm(sksec->sid, sid,
3935                                    sksec->sclass, node_perm, &ad);
3936                 if (err)
3937                         goto out;
3938         }
3939 out:
3940         return err;
3941 }
3942
3943 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3944 {
3945         struct sock *sk = sock->sk;
3946         struct sk_security_struct *sksec = sk->sk_security;
3947         int err;
3948
3949         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3950         if (err)
3951                 return err;
3952
3953         /*
3954          * If a TCP or DCCP socket, check name_connect permission for the port.
3955          */
3956         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3957             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3958                 struct common_audit_data ad;
3959                 struct sockaddr_in *addr4 = NULL;
3960                 struct sockaddr_in6 *addr6 = NULL;
3961                 unsigned short snum;
3962                 u32 sid, perm;
3963
3964                 if (sk->sk_family == PF_INET) {
3965                         addr4 = (struct sockaddr_in *)address;
3966                         if (addrlen < sizeof(struct sockaddr_in))
3967                                 return -EINVAL;
3968                         snum = ntohs(addr4->sin_port);
3969                 } else {
3970                         addr6 = (struct sockaddr_in6 *)address;
3971                         if (addrlen < SIN6_LEN_RFC2133)
3972                                 return -EINVAL;
3973                         snum = ntohs(addr6->sin6_port);
3974                 }
3975
3976                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3977                 if (err)
3978                         goto out;
3979
3980                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3981                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3982
3983                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3984                 ad.u.net.dport = htons(snum);
3985                 ad.u.net.family = sk->sk_family;
3986                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3987                 if (err)
3988                         goto out;
3989         }
3990
3991         err = selinux_netlbl_socket_connect(sk, address);
3992
3993 out:
3994         return err;
3995 }
3996
3997 static int selinux_socket_listen(struct socket *sock, int backlog)
3998 {
3999         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4000 }
4001
4002 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4003 {
4004         int err;
4005         struct inode_security_struct *isec;
4006         struct inode_security_struct *newisec;
4007
4008         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4009         if (err)
4010                 return err;
4011
4012         newisec = SOCK_INODE(newsock)->i_security;
4013
4014         isec = SOCK_INODE(sock)->i_security;
4015         newisec->sclass = isec->sclass;
4016         newisec->sid = isec->sid;
4017         newisec->initialized = 1;
4018
4019         return 0;
4020 }
4021
4022 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4023                                   int size)
4024 {
4025         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4026 }
4027
4028 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4029                                   int size, int flags)
4030 {
4031         return sock_has_perm(current, sock->sk, SOCKET__READ);
4032 }
4033
4034 static int selinux_socket_getsockname(struct socket *sock)
4035 {
4036         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4037 }
4038
4039 static int selinux_socket_getpeername(struct socket *sock)
4040 {
4041         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4042 }
4043
4044 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4045 {
4046         int err;
4047
4048         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4049         if (err)
4050                 return err;
4051
4052         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4053 }
4054
4055 static int selinux_socket_getsockopt(struct socket *sock, int level,
4056                                      int optname)
4057 {
4058         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4059 }
4060
4061 static int selinux_socket_shutdown(struct socket *sock, int how)
4062 {
4063         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4064 }
4065
4066 static int selinux_socket_unix_stream_connect(struct sock *sock,
4067                                               struct sock *other,
4068                                               struct sock *newsk)
4069 {
4070         struct sk_security_struct *sksec_sock = sock->sk_security;
4071         struct sk_security_struct *sksec_other = other->sk_security;
4072         struct sk_security_struct *sksec_new = newsk->sk_security;
4073         struct common_audit_data ad;
4074         int err;
4075
4076         COMMON_AUDIT_DATA_INIT(&ad, NET);
4077         ad.u.net.sk = other;
4078
4079         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4080                            sksec_other->sclass,
4081                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4082         if (err)
4083                 return err;
4084
4085         /* server child socket */
4086         sksec_new->peer_sid = sksec_sock->sid;
4087         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4088                                     &sksec_new->sid);
4089         if (err)
4090                 return err;
4091
4092         /* connecting socket */
4093         sksec_sock->peer_sid = sksec_new->sid;
4094
4095         return 0;
4096 }
4097
4098 static int selinux_socket_unix_may_send(struct socket *sock,
4099                                         struct socket *other)
4100 {
4101         struct sk_security_struct *ssec = sock->sk->sk_security;
4102         struct sk_security_struct *osec = other->sk->sk_security;
4103         struct common_audit_data ad;
4104
4105         COMMON_AUDIT_DATA_INIT(&ad, NET);
4106         ad.u.net.sk = other->sk;
4107
4108         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4109                             &ad);
4110 }
4111
4112 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4113                                     u32 peer_sid,
4114                                     struct common_audit_data *ad)
4115 {
4116         int err;
4117         u32 if_sid;
4118         u32 node_sid;
4119
4120         err = sel_netif_sid(ifindex, &if_sid);
4121         if (err)
4122                 return err;
4123         err = avc_has_perm(peer_sid, if_sid,
4124                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4125         if (err)
4126                 return err;
4127
4128         err = sel_netnode_sid(addrp, family, &node_sid);
4129         if (err)
4130                 return err;
4131         return avc_has_perm(peer_sid, node_sid,
4132                             SECCLASS_NODE, NODE__RECVFROM, ad);
4133 }
4134
4135 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4136                                        u16 family)
4137 {
4138         int err = 0;
4139         struct sk_security_struct *sksec = sk->sk_security;
4140         u32 sk_sid = sksec->sid;
4141         struct common_audit_data ad;
4142         char *addrp;
4143
4144         COMMON_AUDIT_DATA_INIT(&ad, NET);
4145         ad.u.net.netif = skb->skb_iif;
4146         ad.u.net.family = family;
4147         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4148         if (err)
4149                 return err;
4150
4151         if (selinux_secmark_enabled()) {
4152                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4153                                    PACKET__RECV, &ad);
4154                 if (err)
4155                         return err;
4156         }
4157
4158         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4159         if (err)
4160                 return err;
4161         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4162
4163         return err;
4164 }
4165
4166 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4167 {
4168         int err;
4169         struct sk_security_struct *sksec = sk->sk_security;
4170         u16 family = sk->sk_family;
4171         u32 sk_sid = sksec->sid;
4172         struct common_audit_data ad;
4173         char *addrp;
4174         u8 secmark_active;
4175         u8 peerlbl_active;
4176
4177         if (family != PF_INET && family != PF_INET6)
4178                 return 0;
4179
4180         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4181         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4182                 family = PF_INET;
4183
4184         /* If any sort of compatibility mode is enabled then handoff processing
4185          * to the selinux_sock_rcv_skb_compat() function to deal with the
4186          * special handling.  We do this in an attempt to keep this function
4187          * as fast and as clean as possible. */
4188         if (!selinux_policycap_netpeer)
4189                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4190
4191         secmark_active = selinux_secmark_enabled();
4192         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4193         if (!secmark_active && !peerlbl_active)
4194                 return 0;
4195
4196         COMMON_AUDIT_DATA_INIT(&ad, NET);
4197         ad.u.net.netif = skb->skb_iif;
4198         ad.u.net.family = family;
4199         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4200         if (err)
4201                 return err;
4202
4203         if (peerlbl_active) {
4204                 u32 peer_sid;
4205
4206                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4207                 if (err)
4208                         return err;
4209                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4210                                                peer_sid, &ad);
4211                 if (err) {
4212                         selinux_netlbl_err(skb, err, 0);
4213                         return err;
4214                 }
4215                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4216                                    PEER__RECV, &ad);
4217                 if (err) {
4218                         selinux_netlbl_err(skb, err, 0);
4219                         return err;
4220                 }
4221         }
4222
4223         if (secmark_active) {
4224                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4225                                    PACKET__RECV, &ad);
4226                 if (err)
4227                         return err;
4228         }
4229
4230         return err;
4231 }
4232
4233 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4234                                             int __user *optlen, unsigned len)
4235 {
4236         int err = 0;
4237         char *scontext;
4238         u32 scontext_len;
4239         struct sk_security_struct *sksec = sock->sk->sk_security;
4240         u32 peer_sid = SECSID_NULL;
4241
4242         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4243             sksec->sclass == SECCLASS_TCP_SOCKET)
4244                 peer_sid = sksec->peer_sid;
4245         if (peer_sid == SECSID_NULL)
4246                 return -ENOPROTOOPT;
4247
4248         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4249         if (err)
4250                 return err;
4251
4252         if (scontext_len > len) {
4253                 err = -ERANGE;
4254                 goto out_len;
4255         }
4256
4257         if (copy_to_user(optval, scontext, scontext_len))
4258                 err = -EFAULT;
4259
4260 out_len:
4261         if (put_user(scontext_len, optlen))
4262                 err = -EFAULT;
4263         kfree(scontext);
4264         return err;
4265 }
4266
4267 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4268 {
4269         u32 peer_secid = SECSID_NULL;
4270         u16 family;
4271
4272         if (skb && skb->protocol == htons(ETH_P_IP))
4273                 family = PF_INET;
4274         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4275                 family = PF_INET6;
4276         else if (sock)
4277                 family = sock->sk->sk_family;
4278         else
4279                 goto out;
4280
4281         if (sock && family == PF_UNIX)
4282                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4283         else if (skb)
4284                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4285
4286 out:
4287         *secid = peer_secid;
4288         if (peer_secid == SECSID_NULL)
4289                 return -EINVAL;
4290         return 0;
4291 }
4292
4293 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4294 {
4295         struct sk_security_struct *sksec;
4296
4297         sksec = kzalloc(sizeof(*sksec), priority);
4298         if (!sksec)
4299                 return -ENOMEM;
4300
4301         sksec->peer_sid = SECINITSID_UNLABELED;
4302         sksec->sid = SECINITSID_UNLABELED;
4303         selinux_netlbl_sk_security_reset(sksec);
4304         sk->sk_security = sksec;
4305
4306         return 0;
4307 }
4308
4309 static void selinux_sk_free_security(struct sock *sk)
4310 {
4311         struct sk_security_struct *sksec = sk->sk_security;
4312
4313         sk->sk_security = NULL;
4314         selinux_netlbl_sk_security_free(sksec);
4315         kfree(sksec);
4316 }
4317
4318 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4319 {
4320         struct sk_security_struct *sksec = sk->sk_security;
4321         struct sk_security_struct *newsksec = newsk->sk_security;
4322
4323         newsksec->sid = sksec->sid;
4324         newsksec->peer_sid = sksec->peer_sid;
4325         newsksec->sclass = sksec->sclass;
4326
4327         selinux_netlbl_sk_security_reset(newsksec);
4328 }
4329
4330 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4331 {
4332         if (!sk)
4333                 *secid = SECINITSID_ANY_SOCKET;
4334         else {
4335                 struct sk_security_struct *sksec = sk->sk_security;
4336
4337                 *secid = sksec->sid;
4338         }
4339 }
4340
4341 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4342 {
4343         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4344         struct sk_security_struct *sksec = sk->sk_security;
4345
4346         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4347             sk->sk_family == PF_UNIX)
4348                 isec->sid = sksec->sid;
4349         sksec->sclass = isec->sclass;
4350 }
4351
4352 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4353                                      struct request_sock *req)
4354 {
4355         struct sk_security_struct *sksec = sk->sk_security;
4356         int err;
4357         u16 family = sk->sk_family;
4358         u32 connsid;
4359         u32 peersid;
4360
4361         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4362         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4363                 family = PF_INET;
4364
4365         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4366         if (err)
4367                 return err;
4368         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4369         if (err)
4370                 return err;
4371         req->secid = connsid;
4372         req->peer_secid = peersid;
4373
4374         return selinux_netlbl_inet_conn_request(req, family);
4375 }
4376
4377 static void selinux_inet_csk_clone(struct sock *newsk,
4378                                    const struct request_sock *req)
4379 {
4380         struct sk_security_struct *newsksec = newsk->sk_security;
4381
4382         newsksec->sid = req->secid;
4383         newsksec->peer_sid = req->peer_secid;
4384         /* NOTE: Ideally, we should also get the isec->sid for the
4385            new socket in sync, but we don't have the isec available yet.
4386            So we will wait until sock_graft to do it, by which
4387            time it will have been created and available. */
4388
4389         /* We don't need to take any sort of lock here as we are the only
4390          * thread with access to newsksec */
4391         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4392 }
4393
4394 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4395 {
4396         u16 family = sk->sk_family;
4397         struct sk_security_struct *sksec = sk->sk_security;
4398
4399         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4400         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4401                 family = PF_INET;
4402
4403         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4404 }
4405
4406 static int selinux_secmark_relabel_packet(u32 sid)
4407 {
4408         const struct task_security_struct *__tsec;
4409         u32 tsid;
4410
4411         __tsec = current_security();
4412         tsid = __tsec->sid;
4413
4414         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4415 }
4416
4417 static void selinux_secmark_refcount_inc(void)
4418 {
4419         atomic_inc(&selinux_secmark_refcount);
4420 }
4421
4422 static void selinux_secmark_refcount_dec(void)
4423 {
4424         atomic_dec(&selinux_secmark_refcount);
4425 }
4426
4427 static void selinux_req_classify_flow(const struct request_sock *req,
4428                                       struct flowi *fl)
4429 {
4430         fl->flowi_secid = req->secid;
4431 }
4432
4433 static int selinux_tun_dev_create(void)
4434 {
4435         u32 sid = current_sid();
4436
4437         /* we aren't taking into account the "sockcreate" SID since the socket
4438          * that is being created here is not a socket in the traditional sense,
4439          * instead it is a private sock, accessible only to the kernel, and
4440          * representing a wide range of network traffic spanning multiple
4441          * connections unlike traditional sockets - check the TUN driver to
4442          * get a better understanding of why this socket is special */
4443
4444         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4445                             NULL);
4446 }
4447
4448 static void selinux_tun_dev_post_create(struct sock *sk)
4449 {
4450         struct sk_security_struct *sksec = sk->sk_security;
4451
4452         /* we don't currently perform any NetLabel based labeling here and it
4453          * isn't clear that we would want to do so anyway; while we could apply
4454          * labeling without the support of the TUN user the resulting labeled
4455          * traffic from the other end of the connection would almost certainly
4456          * cause confusion to the TUN user that had no idea network labeling
4457          * protocols were being used */
4458
4459         /* see the comments in selinux_tun_dev_create() about why we don't use
4460          * the sockcreate SID here */
4461
4462         sksec->sid = current_sid();
4463         sksec->sclass = SECCLASS_TUN_SOCKET;
4464 }
4465
4466 static int selinux_tun_dev_attach(struct sock *sk)
4467 {
4468         struct sk_security_struct *sksec = sk->sk_security;
4469         u32 sid = current_sid();
4470         int err;
4471
4472         err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4473                            TUN_SOCKET__RELABELFROM, NULL);
4474         if (err)
4475                 return err;
4476         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4477                            TUN_SOCKET__RELABELTO, NULL);
4478         if (err)
4479                 return err;
4480
4481         sksec->sid = sid;
4482
4483         return 0;
4484 }
4485
4486 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4487 {
4488         int err = 0;
4489         u32 perm;
4490         struct nlmsghdr *nlh;
4491         struct sk_security_struct *sksec = sk->sk_security;
4492
4493         if (skb->len < NLMSG_SPACE(0)) {
4494                 err = -EINVAL;
4495                 goto out;
4496         }
4497         nlh = nlmsg_hdr(skb);
4498
4499         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4500         if (err) {
4501                 if (err == -EINVAL) {
4502                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4503                                   "SELinux:  unrecognized netlink message"
4504                                   " type=%hu for sclass=%hu\n",
4505                                   nlh->nlmsg_type, sksec->sclass);
4506                         if (!selinux_enforcing || security_get_allow_unknown())
4507                                 err = 0;
4508                 }
4509
4510                 /* Ignore */
4511                 if (err == -ENOENT)
4512                         err = 0;
4513                 goto out;
4514         }
4515
4516         err = sock_has_perm(current, sk, perm);
4517 out:
4518         return err;
4519 }
4520
4521 #ifdef CONFIG_NETFILTER
4522
4523 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4524                                        u16 family)
4525 {
4526         int err;
4527         char *addrp;
4528         u32 peer_sid;
4529         struct common_audit_data ad;
4530         u8 secmark_active;
4531         u8 netlbl_active;
4532         u8 peerlbl_active;
4533
4534         if (!selinux_policycap_netpeer)
4535                 return NF_ACCEPT;
4536
4537         secmark_active = selinux_secmark_enabled();
4538         netlbl_active = netlbl_enabled();
4539         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4540         if (!secmark_active && !peerlbl_active)
4541                 return NF_ACCEPT;
4542
4543         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4544                 return NF_DROP;
4545
4546         COMMON_AUDIT_DATA_INIT(&ad, NET);
4547         ad.u.net.netif = ifindex;
4548         ad.u.net.family = family;
4549         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4550                 return NF_DROP;
4551
4552         if (peerlbl_active) {
4553                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4554                                                peer_sid, &ad);
4555                 if (err) {
4556                         selinux_netlbl_err(skb, err, 1);
4557                         return NF_DROP;
4558                 }
4559         }
4560
4561         if (secmark_active)
4562                 if (avc_has_perm(peer_sid, skb->secmark,
4563                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4564                         return NF_DROP;
4565
4566         if (netlbl_active)
4567                 /* we do this in the FORWARD path and not the POST_ROUTING
4568                  * path because we want to make sure we apply the necessary
4569                  * labeling before IPsec is applied so we can leverage AH
4570                  * protection */
4571                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4572                         return NF_DROP;
4573
4574         return NF_ACCEPT;
4575 }
4576
4577 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4578                                          struct sk_buff *skb,
4579                                          const struct net_device *in,
4580                                          const struct net_device *out,
4581                                          int (*okfn)(struct sk_buff *))
4582 {
4583         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4584 }
4585
4586 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4587 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4588                                          struct sk_buff *skb,
4589                                          const struct net_device *in,
4590                                          const struct net_device *out,
4591                                          int (*okfn)(struct sk_buff *))
4592 {
4593         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4594 }
4595 #endif  /* IPV6 */
4596
4597 static unsigned int selinux_ip_output(struct sk_buff *skb,
4598                                       u16 family)
4599 {
4600         struct sock *sk;
4601         u32 sid;
4602
4603         if (!netlbl_enabled())
4604                 return NF_ACCEPT;
4605
4606         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4607          * because we want to make sure we apply the necessary labeling
4608          * before IPsec is applied so we can leverage AH protection */
4609         sk = skb->sk;
4610         if (sk) {
4611                 struct sk_security_struct *sksec;
4612
4613                 if (sk->sk_state == TCP_LISTEN)
4614                         /* if the socket is the listening state then this
4615                          * packet is a SYN-ACK packet which means it needs to
4616                          * be labeled based on the connection/request_sock and
4617                          * not the parent socket.  unfortunately, we can't
4618                          * lookup the request_sock yet as it isn't queued on
4619                          * the parent socket until after the SYN-ACK is sent.
4620                          * the "solution" is to simply pass the packet as-is
4621                          * as any IP option based labeling should be copied
4622                          * from the initial connection request (in the IP
4623                          * layer).  it is far from ideal, but until we get a
4624                          * security label in the packet itself this is the
4625                          * best we can do. */
4626                         return NF_ACCEPT;
4627
4628                 /* standard practice, label using the parent socket */
4629                 sksec = sk->sk_security;
4630                 sid = sksec->sid;
4631         } else
4632                 sid = SECINITSID_KERNEL;
4633         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4634                 return NF_DROP;
4635
4636         return NF_ACCEPT;
4637 }
4638
4639 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4640                                         struct sk_buff *skb,
4641                                         const struct net_device *in,
4642                                         const struct net_device *out,
4643                                         int (*okfn)(struct sk_buff *))
4644 {
4645         return selinux_ip_output(skb, PF_INET);
4646 }
4647
4648 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4649                                                 int ifindex,
4650                                                 u16 family)
4651 {
4652         struct sock *sk = skb->sk;
4653         struct sk_security_struct *sksec;
4654         struct common_audit_data ad;
4655         char *addrp;
4656         u8 proto;
4657
4658         if (sk == NULL)
4659                 return NF_ACCEPT;
4660         sksec = sk->sk_security;
4661
4662         COMMON_AUDIT_DATA_INIT(&ad, NET);
4663         ad.u.net.netif = ifindex;
4664         ad.u.net.family = family;
4665         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4666                 return NF_DROP;
4667
4668         if (selinux_secmark_enabled())
4669                 if (avc_has_perm(sksec->sid, skb->secmark,
4670                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4671                         return NF_DROP_ERR(-ECONNREFUSED);
4672
4673         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4674                 return NF_DROP_ERR(-ECONNREFUSED);
4675
4676         return NF_ACCEPT;
4677 }
4678
4679 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4680                                          u16 family)
4681 {
4682         u32 secmark_perm;
4683         u32 peer_sid;
4684         struct sock *sk;
4685         struct common_audit_data ad;
4686         char *addrp;
4687         u8 secmark_active;
4688         u8 peerlbl_active;
4689
4690         /* If any sort of compatibility mode is enabled then handoff processing
4691          * to the selinux_ip_postroute_compat() function to deal with the
4692          * special handling.  We do this in an attempt to keep this function
4693          * as fast and as clean as possible. */
4694         if (!selinux_policycap_netpeer)
4695                 return selinux_ip_postroute_compat(skb, ifindex, family);
4696
4697         secmark_active = selinux_secmark_enabled();
4698         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4699         if (!secmark_active && !peerlbl_active)
4700                 return NF_ACCEPT;
4701
4702         sk = skb->sk;
4703
4704 #ifdef CONFIG_XFRM
4705         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4706          * packet transformation so allow the packet to pass without any checks
4707          * since we'll have another chance to perform access control checks
4708          * when the packet is on it's final way out.
4709          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4710          *       is NULL, in this case go ahead and apply access control.
4711          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4712          *       TCP listening state we cannot wait until the XFRM processing
4713          *       is done as we will miss out on the SA label if we do;
4714          *       unfortunately, this means more work, but it is only once per
4715          *       connection. */
4716         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4717             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4718                 return NF_ACCEPT;
4719 #endif
4720
4721         if (sk == NULL) {
4722                 /* Without an associated socket the packet is either coming
4723                  * from the kernel or it is being forwarded; check the packet
4724                  * to determine which and if the packet is being forwarded
4725                  * query the packet directly to determine the security label. */
4726                 if (skb->skb_iif) {
4727                         secmark_perm = PACKET__FORWARD_OUT;
4728                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4729                                 return NF_DROP;
4730                 } else {
4731                         secmark_perm = PACKET__SEND;
4732                         peer_sid = SECINITSID_KERNEL;
4733                 }
4734         } else if (sk->sk_state == TCP_LISTEN) {
4735                 /* Locally generated packet but the associated socket is in the
4736                  * listening state which means this is a SYN-ACK packet.  In
4737                  * this particular case the correct security label is assigned
4738                  * to the connection/request_sock but unfortunately we can't
4739                  * query the request_sock as it isn't queued on the parent
4740                  * socket until after the SYN-ACK packet is sent; the only
4741                  * viable choice is to regenerate the label like we do in
4742                  * selinux_inet_conn_request().  See also selinux_ip_output()
4743                  * for similar problems. */
4744                 u32 skb_sid;
4745                 struct sk_security_struct *sksec = sk->sk_security;
4746                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4747                         return NF_DROP;
4748                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4749                  * and the packet has been through at least one XFRM
4750                  * transformation then we must be dealing with the "final"
4751                  * form of labeled IPsec packet; since we've already applied
4752                  * all of our access controls on this packet we can safely
4753                  * pass the packet. */
4754                 if (skb_sid == SECSID_NULL) {
4755                         switch (family) {
4756                         case PF_INET:
4757                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4758                                         return NF_ACCEPT;
4759                                 break;
4760                         case PF_INET6:
4761                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4762                                         return NF_ACCEPT;
4763                         default:
4764                                 return NF_DROP_ERR(-ECONNREFUSED);
4765                         }
4766                 }
4767                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4768                         return NF_DROP;
4769                 secmark_perm = PACKET__SEND;
4770         } else {
4771                 /* Locally generated packet, fetch the security label from the
4772                  * associated socket. */
4773                 struct sk_security_struct *sksec = sk->sk_security;
4774                 peer_sid = sksec->sid;
4775                 secmark_perm = PACKET__SEND;
4776         }
4777
4778         COMMON_AUDIT_DATA_INIT(&ad, NET);
4779         ad.u.net.netif = ifindex;
4780         ad.u.net.family = family;
4781         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4782                 return NF_DROP;
4783
4784         if (secmark_active)
4785                 if (avc_has_perm(peer_sid, skb->secmark,
4786                                  SECCLASS_PACKET, secmark_perm, &ad))
4787                         return NF_DROP_ERR(-ECONNREFUSED);
4788
4789         if (peerlbl_active) {
4790                 u32 if_sid;
4791                 u32 node_sid;
4792
4793                 if (sel_netif_sid(ifindex, &if_sid))
4794                         return NF_DROP;
4795                 if (avc_has_perm(peer_sid, if_sid,
4796                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4797                         return NF_DROP_ERR(-ECONNREFUSED);
4798
4799                 if (sel_netnode_sid(addrp, family, &node_sid))
4800                         return NF_DROP;
4801                 if (avc_has_perm(peer_sid, node_sid,
4802                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4803                         return NF_DROP_ERR(-ECONNREFUSED);
4804         }
4805
4806         return NF_ACCEPT;
4807 }
4808
4809 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4810                                            struct sk_buff *skb,
4811                                            const struct net_device *in,
4812                                            const struct net_device *out,
4813                                            int (*okfn)(struct sk_buff *))
4814 {
4815         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4816 }
4817
4818 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4819 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4820                                            struct sk_buff *skb,
4821                                            const struct net_device *in,
4822                                            const struct net_device *out,
4823                                            int (*okfn)(struct sk_buff *))
4824 {
4825         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4826 }
4827 #endif  /* IPV6 */
4828
4829 #endif  /* CONFIG_NETFILTER */
4830
4831 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4832 {
4833         int err;
4834
4835         err = cap_netlink_send(sk, skb);
4836         if (err)
4837                 return err;
4838
4839         return selinux_nlmsg_perm(sk, skb);
4840 }
4841
4842 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4843 {
4844         int err;
4845         struct common_audit_data ad;
4846         u32 sid;
4847
4848         err = cap_netlink_recv(skb, capability);
4849         if (err)
4850                 return err;
4851
4852         COMMON_AUDIT_DATA_INIT(&ad, CAP);
4853         ad.u.cap = capability;
4854
4855         security_task_getsecid(current, &sid);
4856         return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4857                             CAP_TO_MASK(capability), &ad);
4858 }
4859
4860 static int ipc_alloc_security(struct task_struct *task,
4861                               struct kern_ipc_perm *perm,
4862                               u16 sclass)
4863 {
4864         struct ipc_security_struct *isec;
4865         u32 sid;
4866
4867         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4868         if (!isec)
4869                 return -ENOMEM;
4870
4871         sid = task_sid(task);
4872         isec->sclass = sclass;
4873         isec->sid = sid;
4874         perm->security = isec;
4875
4876         return 0;
4877 }
4878
4879 static void ipc_free_security(struct kern_ipc_perm *perm)
4880 {
4881         struct ipc_security_struct *isec = perm->security;
4882         perm->security = NULL;
4883         kfree(isec);
4884 }
4885
4886 static int msg_msg_alloc_security(struct msg_msg *msg)
4887 {
4888         struct msg_security_struct *msec;
4889
4890         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4891         if (!msec)
4892                 return -ENOMEM;
4893
4894         msec->sid = SECINITSID_UNLABELED;
4895         msg->security = msec;
4896
4897         return 0;
4898 }
4899
4900 static void msg_msg_free_security(struct msg_msg *msg)
4901 {
4902         struct msg_security_struct *msec = msg->security;
4903
4904         msg->security = NULL;
4905         kfree(msec);
4906 }
4907
4908 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4909                         u32 perms)
4910 {
4911         struct ipc_security_struct *isec;
4912         struct common_audit_data ad;
4913         u32 sid = current_sid();
4914
4915         isec = ipc_perms->security;
4916
4917         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4918         ad.u.ipc_id = ipc_perms->key;
4919
4920         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4921 }
4922
4923 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4924 {
4925         return msg_msg_alloc_security(msg);
4926 }
4927
4928 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4929 {
4930         msg_msg_free_security(msg);
4931 }
4932
4933 /* message queue security operations */
4934 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4935 {
4936         struct ipc_security_struct *isec;
4937         struct common_audit_data ad;
4938         u32 sid = current_sid();
4939         int rc;
4940
4941         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4942         if (rc)
4943                 return rc;
4944
4945         isec = msq->q_perm.security;
4946
4947         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4948         ad.u.ipc_id = msq->q_perm.key;
4949
4950         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4951                           MSGQ__CREATE, &ad);
4952         if (rc) {
4953                 ipc_free_security(&msq->q_perm);
4954                 return rc;
4955         }
4956         return 0;
4957 }
4958
4959 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4960 {
4961         ipc_free_security(&msq->q_perm);
4962 }
4963
4964 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4965 {
4966         struct ipc_security_struct *isec;
4967         struct common_audit_data ad;
4968         u32 sid = current_sid();
4969
4970         isec = msq->q_perm.security;
4971
4972         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4973         ad.u.ipc_id = msq->q_perm.key;
4974
4975         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4976                             MSGQ__ASSOCIATE, &ad);
4977 }
4978
4979 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4980 {
4981         int err;
4982         int perms;
4983
4984         switch (cmd) {
4985         case IPC_INFO:
4986         case MSG_INFO:
4987                 /* No specific object, just general system-wide information. */
4988                 return task_has_system(current, SYSTEM__IPC_INFO);
4989         case IPC_STAT:
4990         case MSG_STAT:
4991                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4992                 break;
4993         case IPC_SET:
4994                 perms = MSGQ__SETATTR;
4995                 break;
4996         case IPC_RMID:
4997                 perms = MSGQ__DESTROY;
4998                 break;
4999         default:
5000                 return 0;
5001         }
5002
5003         err = ipc_has_perm(&msq->q_perm, perms);
5004         return err;
5005 }
5006
5007 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5008 {
5009         struct ipc_security_struct *isec;
5010         struct msg_security_struct *msec;
5011         struct common_audit_data ad;
5012         u32 sid = current_sid();
5013         int rc;
5014
5015         isec = msq->q_perm.security;
5016         msec = msg->security;
5017
5018         /*
5019          * First time through, need to assign label to the message
5020          */
5021         if (msec->sid == SECINITSID_UNLABELED) {
5022                 /*
5023                  * Compute new sid based on current process and
5024                  * message queue this message will be stored in
5025                  */
5026                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5027                                              NULL, &msec->sid);
5028                 if (rc)
5029                         return rc;
5030         }
5031
5032         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5033         ad.u.ipc_id = msq->q_perm.key;
5034
5035         /* Can this process write to the queue? */
5036         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5037                           MSGQ__WRITE, &ad);
5038         if (!rc)
5039                 /* Can this process send the message */
5040                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5041                                   MSG__SEND, &ad);
5042         if (!rc)
5043                 /* Can the message be put in the queue? */
5044                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5045                                   MSGQ__ENQUEUE, &ad);
5046
5047         return rc;
5048 }
5049
5050 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5051                                     struct task_struct *target,
5052                                     long type, int mode)
5053 {
5054         struct ipc_security_struct *isec;
5055         struct msg_security_struct *msec;
5056         struct common_audit_data ad;
5057         u32 sid = task_sid(target);
5058         int rc;
5059
5060         isec = msq->q_perm.security;
5061         msec = msg->security;
5062
5063         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5064         ad.u.ipc_id = msq->q_perm.key;
5065
5066         rc = avc_has_perm(sid, isec->sid,
5067                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5068         if (!rc)
5069                 rc = avc_has_perm(sid, msec->sid,
5070                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5071         return rc;
5072 }
5073
5074 /* Shared Memory security operations */
5075 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5076 {
5077         struct ipc_security_struct *isec;
5078         struct common_audit_data ad;
5079         u32 sid = current_sid();
5080         int rc;
5081
5082         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5083         if (rc)
5084                 return rc;
5085
5086         isec = shp->shm_perm.security;
5087
5088         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5089         ad.u.ipc_id = shp->shm_perm.key;
5090
5091         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5092                           SHM__CREATE, &ad);
5093         if (rc) {
5094                 ipc_free_security(&shp->shm_perm);
5095                 return rc;
5096         }
5097         return 0;
5098 }
5099
5100 static void selinux_shm_free_security(struct shmid_kernel *shp)
5101 {
5102         ipc_free_security(&shp->shm_perm);
5103 }
5104
5105 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5106 {
5107         struct ipc_security_struct *isec;
5108         struct common_audit_data ad;
5109         u32 sid = current_sid();
5110
5111         isec = shp->shm_perm.security;
5112
5113         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5114         ad.u.ipc_id = shp->shm_perm.key;
5115
5116         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5117                             SHM__ASSOCIATE, &ad);
5118 }
5119
5120 /* Note, at this point, shp is locked down */
5121 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5122 {
5123         int perms;
5124         int err;
5125
5126         switch (cmd) {
5127         case IPC_INFO:
5128         case SHM_INFO:
5129                 /* No specific object, just general system-wide information. */
5130                 return task_has_system(current, SYSTEM__IPC_INFO);
5131         case IPC_STAT:
5132         case SHM_STAT:
5133                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5134                 break;
5135         case IPC_SET:
5136                 perms = SHM__SETATTR;
5137                 break;
5138         case SHM_LOCK:
5139         case SHM_UNLOCK:
5140                 perms = SHM__LOCK;
5141                 break;
5142         case IPC_RMID:
5143                 perms = SHM__DESTROY;
5144                 break;
5145         default:
5146                 return 0;
5147         }
5148
5149         err = ipc_has_perm(&shp->shm_perm, perms);
5150         return err;
5151 }
5152
5153 static int selinux_shm_shmat(struct shmid_kernel *shp,
5154                              char __user *shmaddr, int shmflg)
5155 {
5156         u32 perms;
5157
5158         if (shmflg & SHM_RDONLY)
5159                 perms = SHM__READ;
5160         else
5161                 perms = SHM__READ | SHM__WRITE;
5162
5163         return ipc_has_perm(&shp->shm_perm, perms);
5164 }
5165
5166 /* Semaphore security operations */
5167 static int selinux_sem_alloc_security(struct sem_array *sma)
5168 {
5169         struct ipc_security_struct *isec;
5170         struct common_audit_data ad;
5171         u32 sid = current_sid();
5172         int rc;
5173
5174         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5175         if (rc)
5176                 return rc;
5177
5178         isec = sma->sem_perm.security;
5179
5180         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5181         ad.u.ipc_id = sma->sem_perm.key;
5182
5183         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5184                           SEM__CREATE, &ad);
5185         if (rc) {
5186                 ipc_free_security(&sma->sem_perm);
5187                 return rc;
5188         }
5189         return 0;
5190 }
5191
5192 static void selinux_sem_free_security(struct sem_array *sma)
5193 {
5194         ipc_free_security(&sma->sem_perm);
5195 }
5196
5197 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5198 {
5199         struct ipc_security_struct *isec;
5200         struct common_audit_data ad;
5201         u32 sid = current_sid();
5202
5203         isec = sma->sem_perm.security;
5204
5205         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5206         ad.u.ipc_id = sma->sem_perm.key;
5207
5208         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5209                             SEM__ASSOCIATE, &ad);
5210 }
5211
5212 /* Note, at this point, sma is locked down */
5213 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5214 {
5215         int err;
5216         u32 perms;
5217
5218         switch (cmd) {
5219         case IPC_INFO:
5220         case SEM_INFO:
5221                 /* No specific object, just general system-wide information. */
5222                 return task_has_system(current, SYSTEM__IPC_INFO);
5223         case GETPID:
5224         case GETNCNT:
5225         case GETZCNT:
5226                 perms = SEM__GETATTR;
5227                 break;
5228         case GETVAL:
5229         case GETALL:
5230                 perms = SEM__READ;
5231                 break;
5232         case SETVAL:
5233         case SETALL:
5234                 perms = SEM__WRITE;
5235                 break;
5236         case IPC_RMID:
5237                 perms = SEM__DESTROY;
5238                 break;
5239         case IPC_SET:
5240                 perms = SEM__SETATTR;
5241                 break;
5242         case IPC_STAT:
5243         case SEM_STAT:
5244                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5245                 break;
5246         default:
5247                 return 0;
5248         }
5249
5250         err = ipc_has_perm(&sma->sem_perm, perms);
5251         return err;
5252 }
5253
5254 static int selinux_sem_semop(struct sem_array *sma,
5255                              struct sembuf *sops, unsigned nsops, int alter)
5256 {
5257         u32 perms;
5258
5259         if (alter)
5260                 perms = SEM__READ | SEM__WRITE;
5261         else
5262                 perms = SEM__READ;
5263
5264         return ipc_has_perm(&sma->sem_perm, perms);
5265 }
5266
5267 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5268 {
5269         u32 av = 0;
5270
5271         av = 0;
5272         if (flag & S_IRUGO)
5273                 av |= IPC__UNIX_READ;
5274         if (flag & S_IWUGO)
5275                 av |= IPC__UNIX_WRITE;
5276
5277         if (av == 0)
5278                 return 0;
5279
5280         return ipc_has_perm(ipcp, av);
5281 }
5282
5283 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5284 {
5285         struct ipc_security_struct *isec = ipcp->security;
5286         *secid = isec->sid;
5287 }
5288
5289 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5290 {
5291         if (inode)
5292                 inode_doinit_with_dentry(inode, dentry);
5293 }
5294
5295 static int selinux_getprocattr(struct task_struct *p,
5296                                char *name, char **value)
5297 {
5298         const struct task_security_struct *__tsec;
5299         u32 sid;
5300         int error;
5301         unsigned len;
5302
5303         if (current != p) {
5304                 error = current_has_perm(p, PROCESS__GETATTR);
5305                 if (error)
5306                         return error;
5307         }
5308
5309         rcu_read_lock();
5310         __tsec = __task_cred(p)->security;
5311
5312         if (!strcmp(name, "current"))
5313                 sid = __tsec->sid;
5314         else if (!strcmp(name, "prev"))
5315                 sid = __tsec->osid;
5316         else if (!strcmp(name, "exec"))
5317                 sid = __tsec->exec_sid;
5318         else if (!strcmp(name, "fscreate"))
5319                 sid = __tsec->create_sid;
5320         else if (!strcmp(name, "keycreate"))
5321                 sid = __tsec->keycreate_sid;
5322         else if (!strcmp(name, "sockcreate"))
5323                 sid = __tsec->sockcreate_sid;
5324         else
5325                 goto invalid;
5326         rcu_read_unlock();
5327
5328         if (!sid)
5329                 return 0;
5330
5331         error = security_sid_to_context(sid, value, &len);
5332         if (error)
5333                 return error;
5334         return len;
5335
5336 invalid:
5337         rcu_read_unlock();
5338         return -EINVAL;
5339 }
5340
5341 static int selinux_setprocattr(struct task_struct *p,
5342                                char *name, void *value, size_t size)
5343 {
5344         struct task_security_struct *tsec;
5345         struct task_struct *tracer;
5346         struct cred *new;
5347         u32 sid = 0, ptsid;
5348         int error;
5349         char *str = value;
5350
5351         if (current != p) {
5352                 /* SELinux only allows a process to change its own
5353                    security attributes. */
5354                 return -EACCES;
5355         }
5356
5357         /*
5358          * Basic control over ability to set these attributes at all.
5359          * current == p, but we'll pass them separately in case the
5360          * above restriction is ever removed.
5361          */
5362         if (!strcmp(name, "exec"))
5363                 error = current_has_perm(p, PROCESS__SETEXEC);
5364         else if (!strcmp(name, "fscreate"))
5365                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5366         else if (!strcmp(name, "keycreate"))
5367                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5368         else if (!strcmp(name, "sockcreate"))
5369                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5370         else if (!strcmp(name, "current"))
5371                 error = current_has_perm(p, PROCESS__SETCURRENT);
5372         else
5373                 error = -EINVAL;
5374         if (error)
5375                 return error;
5376
5377         /* Obtain a SID for the context, if one was specified. */
5378         if (size && str[1] && str[1] != '\n') {
5379                 if (str[size-1] == '\n') {
5380                         str[size-1] = 0;
5381                         size--;
5382                 }
5383                 error = security_context_to_sid(value, size, &sid);
5384                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5385                         if (!capable(CAP_MAC_ADMIN))
5386                                 return error;
5387                         error = security_context_to_sid_force(value, size,
5388                                                               &sid);
5389                 }
5390                 if (error)
5391                         return error;
5392         }
5393
5394         new = prepare_creds();
5395         if (!new)
5396                 return -ENOMEM;
5397
5398         /* Permission checking based on the specified context is
5399            performed during the actual operation (execve,
5400            open/mkdir/...), when we know the full context of the
5401            operation.  See selinux_bprm_set_creds for the execve
5402            checks and may_create for the file creation checks. The
5403            operation will then fail if the context is not permitted. */
5404         tsec = new->security;
5405         if (!strcmp(name, "exec")) {
5406                 tsec->exec_sid = sid;
5407         } else if (!strcmp(name, "fscreate")) {
5408                 tsec->create_sid = sid;
5409         } else if (!strcmp(name, "keycreate")) {
5410                 error = may_create_key(sid, p);
5411                 if (error)
5412                         goto abort_change;
5413                 tsec->keycreate_sid = sid;
5414         } else if (!strcmp(name, "sockcreate")) {
5415                 tsec->sockcreate_sid = sid;
5416         } else if (!strcmp(name, "current")) {
5417                 error = -EINVAL;
5418                 if (sid == 0)
5419                         goto abort_change;
5420
5421                 /* Only allow single threaded processes to change context */
5422                 error = -EPERM;
5423                 if (!current_is_single_threaded()) {
5424                         error = security_bounded_transition(tsec->sid, sid);
5425                         if (error)
5426                                 goto abort_change;
5427                 }
5428
5429                 /* Check permissions for the transition. */
5430                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5431                                      PROCESS__DYNTRANSITION, NULL);
5432                 if (error)
5433                         goto abort_change;
5434
5435                 /* Check for ptracing, and update the task SID if ok.
5436                    Otherwise, leave SID unchanged and fail. */
5437                 ptsid = 0;
5438                 rcu_read_lock();
5439                 tracer = ptrace_parent(p);
5440                 if (tracer)
5441                         ptsid = task_sid(tracer);
5442                 rcu_read_unlock();
5443
5444                 if (tracer) {
5445                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5446                                              PROCESS__PTRACE, NULL);
5447                         if (error)
5448                                 goto abort_change;
5449                 }
5450
5451                 tsec->sid = sid;
5452         } else {
5453                 error = -EINVAL;
5454                 goto abort_change;
5455         }
5456
5457         commit_creds(new);
5458         return size;
5459
5460 abort_change:
5461         abort_creds(new);
5462         return error;
5463 }
5464
5465 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5466 {
5467         return security_sid_to_context(secid, secdata, seclen);
5468 }
5469
5470 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5471 {
5472         return security_context_to_sid(secdata, seclen, secid);
5473 }
5474
5475 static void selinux_release_secctx(char *secdata, u32 seclen)
5476 {
5477         kfree(secdata);
5478 }
5479
5480 /*
5481  *      called with inode->i_mutex locked
5482  */
5483 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5484 {
5485         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5486 }
5487
5488 /*
5489  *      called with inode->i_mutex locked
5490  */
5491 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5492 {
5493         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5494 }
5495
5496 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5497 {
5498         int len = 0;
5499         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5500                                                 ctx, true);
5501         if (len < 0)
5502                 return len;
5503         *ctxlen = len;
5504         return 0;
5505 }
5506 #ifdef CONFIG_KEYS
5507
5508 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5509                              unsigned long flags)
5510 {
5511         const struct task_security_struct *tsec;
5512         struct key_security_struct *ksec;
5513
5514         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5515         if (!ksec)
5516                 return -ENOMEM;
5517
5518         tsec = cred->security;
5519         if (tsec->keycreate_sid)
5520                 ksec->sid = tsec->keycreate_sid;
5521         else
5522                 ksec->sid = tsec->sid;
5523
5524         k->security = ksec;
5525         return 0;
5526 }
5527
5528 static void selinux_key_free(struct key *k)
5529 {
5530         struct key_security_struct *ksec = k->security;
5531
5532         k->security = NULL;
5533         kfree(ksec);
5534 }
5535
5536 static int selinux_key_permission(key_ref_t key_ref,
5537                                   const struct cred *cred,
5538                                   key_perm_t perm)
5539 {
5540         struct key *key;
5541         struct key_security_struct *ksec;
5542         u32 sid;
5543
5544         /* if no specific permissions are requested, we skip the
5545            permission check. No serious, additional covert channels
5546            appear to be created. */
5547         if (perm == 0)
5548                 return 0;
5549
5550         sid = cred_sid(cred);
5551
5552         key = key_ref_to_ptr(key_ref);
5553         ksec = key->security;
5554
5555         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5556 }
5557
5558 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5559 {
5560         struct key_security_struct *ksec = key->security;
5561         char *context = NULL;
5562         unsigned len;
5563         int rc;
5564
5565         rc = security_sid_to_context(ksec->sid, &context, &len);
5566         if (!rc)
5567                 rc = len;
5568         *_buffer = context;
5569         return rc;
5570 }
5571
5572 #endif
5573
5574 static struct security_operations selinux_ops = {
5575         .name =                         "selinux",
5576
5577         .ptrace_access_check =          selinux_ptrace_access_check,
5578         .ptrace_traceme =               selinux_ptrace_traceme,
5579         .capget =                       selinux_capget,
5580         .capset =                       selinux_capset,
5581         .capable =                      selinux_capable,
5582         .quotactl =                     selinux_quotactl,
5583         .quota_on =                     selinux_quota_on,
5584         .syslog =                       selinux_syslog,
5585         .vm_enough_memory =             selinux_vm_enough_memory,
5586
5587         .netlink_send =                 selinux_netlink_send,
5588         .netlink_recv =                 selinux_netlink_recv,
5589
5590         .bprm_set_creds =               selinux_bprm_set_creds,
5591         .bprm_committing_creds =        selinux_bprm_committing_creds,
5592         .bprm_committed_creds =         selinux_bprm_committed_creds,
5593         .bprm_secureexec =              selinux_bprm_secureexec,
5594
5595         .sb_alloc_security =            selinux_sb_alloc_security,
5596         .sb_free_security =             selinux_sb_free_security,
5597         .sb_copy_data =                 selinux_sb_copy_data,
5598         .sb_remount =                   selinux_sb_remount,
5599         .sb_kern_mount =                selinux_sb_kern_mount,
5600         .sb_show_options =              selinux_sb_show_options,
5601         .sb_statfs =                    selinux_sb_statfs,
5602         .sb_mount =                     selinux_mount,
5603         .sb_umount =                    selinux_umount,
5604         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5605         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5606         .sb_parse_opts_str =            selinux_parse_opts_str,
5607
5608
5609         .inode_alloc_security =         selinux_inode_alloc_security,
5610         .inode_free_security =          selinux_inode_free_security,
5611         .inode_init_security =          selinux_inode_init_security,
5612         .inode_create =                 selinux_inode_create,
5613         .inode_link =                   selinux_inode_link,
5614         .inode_unlink =                 selinux_inode_unlink,
5615         .inode_symlink =                selinux_inode_symlink,
5616         .inode_mkdir =                  selinux_inode_mkdir,
5617         .inode_rmdir =                  selinux_inode_rmdir,
5618         .inode_mknod =                  selinux_inode_mknod,
5619         .inode_rename =                 selinux_inode_rename,
5620         .inode_readlink =               selinux_inode_readlink,
5621         .inode_follow_link =            selinux_inode_follow_link,
5622         .inode_permission =             selinux_inode_permission,
5623         .inode_setattr =                selinux_inode_setattr,
5624         .inode_getattr =                selinux_inode_getattr,
5625         .inode_setxattr =               selinux_inode_setxattr,
5626         .inode_post_setxattr =          selinux_inode_post_setxattr,
5627         .inode_getxattr =               selinux_inode_getxattr,
5628         .inode_listxattr =              selinux_inode_listxattr,
5629         .inode_removexattr =            selinux_inode_removexattr,
5630         .inode_getsecurity =            selinux_inode_getsecurity,
5631         .inode_setsecurity =            selinux_inode_setsecurity,
5632         .inode_listsecurity =           selinux_inode_listsecurity,
5633         .inode_getsecid =               selinux_inode_getsecid,
5634
5635         .file_permission =              selinux_file_permission,
5636         .file_alloc_security =          selinux_file_alloc_security,
5637         .file_free_security =           selinux_file_free_security,
5638         .file_ioctl =                   selinux_file_ioctl,
5639         .file_mmap =                    selinux_file_mmap,
5640         .file_mprotect =                selinux_file_mprotect,
5641         .file_lock =                    selinux_file_lock,
5642         .file_fcntl =                   selinux_file_fcntl,
5643         .file_set_fowner =              selinux_file_set_fowner,
5644         .file_send_sigiotask =          selinux_file_send_sigiotask,
5645         .file_receive =                 selinux_file_receive,
5646
5647         .dentry_open =                  selinux_dentry_open,
5648
5649         .task_create =                  selinux_task_create,
5650         .cred_alloc_blank =             selinux_cred_alloc_blank,
5651         .cred_free =                    selinux_cred_free,
5652         .cred_prepare =                 selinux_cred_prepare,
5653         .cred_transfer =                selinux_cred_transfer,
5654         .kernel_act_as =                selinux_kernel_act_as,
5655         .kernel_create_files_as =       selinux_kernel_create_files_as,
5656         .kernel_module_request =        selinux_kernel_module_request,
5657         .task_setpgid =                 selinux_task_setpgid,
5658         .task_getpgid =                 selinux_task_getpgid,
5659         .task_getsid =                  selinux_task_getsid,
5660         .task_getsecid =                selinux_task_getsecid,
5661         .task_setnice =                 selinux_task_setnice,
5662         .task_setioprio =               selinux_task_setioprio,
5663         .task_getioprio =               selinux_task_getioprio,
5664         .task_setrlimit =               selinux_task_setrlimit,
5665         .task_setscheduler =            selinux_task_setscheduler,
5666         .task_getscheduler =            selinux_task_getscheduler,
5667         .task_movememory =              selinux_task_movememory,
5668         .task_kill =                    selinux_task_kill,
5669         .task_wait =                    selinux_task_wait,
5670         .task_to_inode =                selinux_task_to_inode,
5671
5672         .ipc_permission =               selinux_ipc_permission,
5673         .ipc_getsecid =                 selinux_ipc_getsecid,
5674
5675         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5676         .msg_msg_free_security =        selinux_msg_msg_free_security,
5677
5678         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5679         .msg_queue_free_security =      selinux_msg_queue_free_security,
5680         .msg_queue_associate =          selinux_msg_queue_associate,
5681         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5682         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5683         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5684
5685         .shm_alloc_security =           selinux_shm_alloc_security,
5686         .shm_free_security =            selinux_shm_free_security,
5687         .shm_associate =                selinux_shm_associate,
5688         .shm_shmctl =                   selinux_shm_shmctl,
5689         .shm_shmat =                    selinux_shm_shmat,
5690
5691         .sem_alloc_security =           selinux_sem_alloc_security,
5692         .sem_free_security =            selinux_sem_free_security,
5693         .sem_associate =                selinux_sem_associate,
5694         .sem_semctl =                   selinux_sem_semctl,
5695         .sem_semop =                    selinux_sem_semop,
5696
5697         .d_instantiate =                selinux_d_instantiate,
5698
5699         .getprocattr =                  selinux_getprocattr,
5700         .setprocattr =                  selinux_setprocattr,
5701
5702         .secid_to_secctx =              selinux_secid_to_secctx,
5703         .secctx_to_secid =              selinux_secctx_to_secid,
5704         .release_secctx =               selinux_release_secctx,
5705         .inode_notifysecctx =           selinux_inode_notifysecctx,
5706         .inode_setsecctx =              selinux_inode_setsecctx,
5707         .inode_getsecctx =              selinux_inode_getsecctx,
5708
5709         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5710         .unix_may_send =                selinux_socket_unix_may_send,
5711
5712         .socket_create =                selinux_socket_create,
5713         .socket_post_create =           selinux_socket_post_create,
5714         .socket_bind =                  selinux_socket_bind,
5715         .socket_connect =               selinux_socket_connect,
5716         .socket_listen =                selinux_socket_listen,
5717         .socket_accept =                selinux_socket_accept,
5718         .socket_sendmsg =               selinux_socket_sendmsg,
5719         .socket_recvmsg =               selinux_socket_recvmsg,
5720         .socket_getsockname =           selinux_socket_getsockname,
5721         .socket_getpeername =           selinux_socket_getpeername,
5722         .socket_getsockopt =            selinux_socket_getsockopt,
5723         .socket_setsockopt =            selinux_socket_setsockopt,
5724         .socket_shutdown =              selinux_socket_shutdown,
5725         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5726         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5727         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5728         .sk_alloc_security =            selinux_sk_alloc_security,
5729         .sk_free_security =             selinux_sk_free_security,
5730         .sk_clone_security =            selinux_sk_clone_security,
5731         .sk_getsecid =                  selinux_sk_getsecid,
5732         .sock_graft =                   selinux_sock_graft,
5733         .inet_conn_request =            selinux_inet_conn_request,
5734         .inet_csk_clone =               selinux_inet_csk_clone,
5735         .inet_conn_established =        selinux_inet_conn_established,
5736         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5737         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5738         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5739         .req_classify_flow =            selinux_req_classify_flow,
5740         .tun_dev_create =               selinux_tun_dev_create,
5741         .tun_dev_post_create =          selinux_tun_dev_post_create,
5742         .tun_dev_attach =               selinux_tun_dev_attach,
5743
5744 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5745         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5746         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5747         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5748         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5749         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5750         .xfrm_state_free_security =     selinux_xfrm_state_free,
5751         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5752         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5753         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5754         .xfrm_decode_session =          selinux_xfrm_decode_session,
5755 #endif
5756
5757 #ifdef CONFIG_KEYS
5758         .key_alloc =                    selinux_key_alloc,
5759         .key_free =                     selinux_key_free,
5760         .key_permission =               selinux_key_permission,
5761         .key_getsecurity =              selinux_key_getsecurity,
5762 #endif
5763
5764 #ifdef CONFIG_AUDIT
5765         .audit_rule_init =              selinux_audit_rule_init,
5766         .audit_rule_known =             selinux_audit_rule_known,
5767         .audit_rule_match =             selinux_audit_rule_match,
5768         .audit_rule_free =              selinux_audit_rule_free,
5769 #endif
5770 };
5771
5772 static __init int selinux_init(void)
5773 {
5774         if (!security_module_enable(&selinux_ops)) {
5775                 selinux_enabled = 0;
5776                 return 0;
5777         }
5778
5779         if (!selinux_enabled) {
5780                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5781                 return 0;
5782         }
5783
5784         printk(KERN_INFO "SELinux:  Initializing.\n");
5785
5786         /* Set the security state for the initial task. */
5787         cred_init_security();
5788
5789         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5790
5791         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5792                                             sizeof(struct inode_security_struct),
5793                                             0, SLAB_PANIC, NULL);
5794         avc_init();
5795
5796         if (register_security(&selinux_ops))
5797                 panic("SELinux: Unable to register with kernel.\n");
5798
5799         if (selinux_enforcing)
5800                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5801         else
5802                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5803
5804         return 0;
5805 }
5806
5807 static void delayed_superblock_init(struct super_block *sb, void *unused)
5808 {
5809         superblock_doinit(sb, NULL);
5810 }
5811
5812 void selinux_complete_init(void)
5813 {
5814         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5815
5816         /* Set up any superblocks initialized prior to the policy load. */
5817         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5818         iterate_supers(delayed_superblock_init, NULL);
5819 }
5820
5821 /* SELinux requires early initialization in order to label
5822    all processes and objects when they are created. */
5823 security_initcall(selinux_init);
5824
5825 #if defined(CONFIG_NETFILTER)
5826
5827 static struct nf_hook_ops selinux_ipv4_ops[] = {
5828         {
5829                 .hook =         selinux_ipv4_postroute,
5830                 .owner =        THIS_MODULE,
5831                 .pf =           PF_INET,
5832                 .hooknum =      NF_INET_POST_ROUTING,
5833                 .priority =     NF_IP_PRI_SELINUX_LAST,
5834         },
5835         {
5836                 .hook =         selinux_ipv4_forward,
5837                 .owner =        THIS_MODULE,
5838                 .pf =           PF_INET,
5839                 .hooknum =      NF_INET_FORWARD,
5840                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5841         },
5842         {
5843                 .hook =         selinux_ipv4_output,
5844                 .owner =        THIS_MODULE,
5845                 .pf =           PF_INET,
5846                 .hooknum =      NF_INET_LOCAL_OUT,
5847                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5848         }
5849 };
5850
5851 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5852
5853 static struct nf_hook_ops selinux_ipv6_ops[] = {
5854         {
5855                 .hook =         selinux_ipv6_postroute,
5856                 .owner =        THIS_MODULE,
5857                 .pf =           PF_INET6,
5858                 .hooknum =      NF_INET_POST_ROUTING,
5859                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5860         },
5861         {
5862                 .hook =         selinux_ipv6_forward,
5863                 .owner =        THIS_MODULE,
5864                 .pf =           PF_INET6,
5865                 .hooknum =      NF_INET_FORWARD,
5866                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5867         }
5868 };
5869
5870 #endif  /* IPV6 */
5871
5872 static int __init selinux_nf_ip_init(void)
5873 {
5874         int err = 0;
5875
5876         if (!selinux_enabled)
5877                 goto out;
5878
5879         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5880
5881         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5882         if (err)
5883                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5884
5885 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5886         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5887         if (err)
5888                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5889 #endif  /* IPV6 */
5890
5891 out:
5892         return err;
5893 }
5894
5895 __initcall(selinux_nf_ip_init);
5896
5897 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5898 static void selinux_nf_ip_exit(void)
5899 {
5900         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5901
5902         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5903 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5904         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5905 #endif  /* IPV6 */
5906 }
5907 #endif
5908
5909 #else /* CONFIG_NETFILTER */
5910
5911 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5912 #define selinux_nf_ip_exit()
5913 #endif
5914
5915 #endif /* CONFIG_NETFILTER */
5916
5917 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5918 static int selinux_disabled;
5919
5920 int selinux_disable(void)
5921 {
5922         if (ss_initialized) {
5923                 /* Not permitted after initial policy load. */
5924                 return -EINVAL;
5925         }
5926
5927         if (selinux_disabled) {
5928                 /* Only do this once. */
5929                 return -EINVAL;
5930         }
5931
5932         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5933
5934         selinux_disabled = 1;
5935         selinux_enabled = 0;
5936
5937         reset_security_ops();
5938
5939         /* Try to destroy the avc node cache */
5940         avc_disable();
5941
5942         /* Unregister netfilter hooks. */
5943         selinux_nf_ip_exit();
5944
5945         /* Unregister selinuxfs. */
5946         exit_sel_fs();
5947
5948         return 0;
5949 }
5950 #endif