security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76
  77 #define XATTR_SELINUX_SUFFIX "selinux"
  78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  79
  80 extern unsigned int policydb_loaded_version;
  81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  82
  83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  84 int selinux_enforcing = 0;
  85
  86 static int __init enforcing_setup(char *str)
  87 {
  88         selinux_enforcing = simple_strtol(str,NULL,0);
  89         return 1;
  90 }
  91 __setup("enforcing=", enforcing_setup);
  92 #endif
  93
  94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  96
  97 static int __init selinux_enabled_setup(char *str)
  98 {
  99         selinux_enabled = simple_strtol(str, NULL, 0);
 100         return 1;
 101 }
 102 __setup("selinux=", selinux_enabled_setup);
 103 #endif
 104
 105 /* Original (dummy) security module. */
 106 static struct security_operations *original_ops = NULL;
 107
 108 /* Minimal support for a secondary security module,
 109    just to allow the use of the dummy or capability modules.
 110    The owlsm module can alternatively be used as a secondary
 111    module as long as CONFIG_OWLSM_FD is not enabled. */
 112 static struct security_operations *secondary_ops = NULL;
 113
 114 /* Lists of inode and superblock security structures initialized
 115    before the policy was loaded. */
 116 static LIST_HEAD(superblock_security_head);
 117 static DEFINE_SPINLOCK(sb_security_lock);
 118
 119 /* Allocate and free functions for each kind of security blob. */
 120
 121 static int task_alloc_security(struct task_struct *task)
 122 {
 123         struct task_security_struct *tsec;
 124
 125         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 126         if (!tsec)
 127                 return -ENOMEM;
 128
 129         tsec->magic = SELINUX_MAGIC;
 130         tsec->task = task;
 131         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 132         task->security = tsec;
 133
 134         return 0;
 135 }
 136
 137 static void task_free_security(struct task_struct *task)
 138 {
 139         struct task_security_struct *tsec = task->security;
 140
 141         if (!tsec || tsec->magic != SELINUX_MAGIC)
 142                 return;
 143
 144         task->security = NULL;
 145         kfree(tsec);
 146 }
 147
 148 static int inode_alloc_security(struct inode *inode)
 149 {
 150         struct task_security_struct *tsec = current->security;
 151         struct inode_security_struct *isec;
 152
 153         isec = kzalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 154         if (!isec)
 155                 return -ENOMEM;
 156
 157         init_MUTEX(&isec->sem);
 158         INIT_LIST_HEAD(&isec->list);
 159         isec->magic = SELINUX_MAGIC;
 160         isec->inode = inode;
 161         isec->sid = SECINITSID_UNLABELED;
 162         isec->sclass = SECCLASS_FILE;
 163         if (tsec && tsec->magic == SELINUX_MAGIC)
 164                 isec->task_sid = tsec->sid;
 165         else
 166                 isec->task_sid = SECINITSID_UNLABELED;
 167         inode->i_security = isec;
 168
 169         return 0;
 170 }
 171
 172 static void inode_free_security(struct inode *inode)
 173 {
 174         struct inode_security_struct *isec = inode->i_security;
 175         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 176
 177         if (!isec || isec->magic != SELINUX_MAGIC)
 178                 return;
 179
 180         spin_lock(&sbsec->isec_lock);
 181         if (!list_empty(&isec->list))
 182                 list_del_init(&isec->list);
 183         spin_unlock(&sbsec->isec_lock);
 184
 185         inode->i_security = NULL;
 186         kfree(isec);
 187 }
 188
 189 static int file_alloc_security(struct file *file)
 190 {
 191         struct task_security_struct *tsec = current->security;
 192         struct file_security_struct *fsec;
 193
 194         fsec = kzalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 195         if (!fsec)
 196                 return -ENOMEM;
 197
 198         fsec->magic = SELINUX_MAGIC;
 199         fsec->file = file;
 200         if (tsec && tsec->magic == SELINUX_MAGIC) {
 201                 fsec->sid = tsec->sid;
 202                 fsec->fown_sid = tsec->sid;
 203         } else {
 204                 fsec->sid = SECINITSID_UNLABELED;
 205                 fsec->fown_sid = SECINITSID_UNLABELED;
 206         }
 207         file->f_security = fsec;
 208
 209         return 0;
 210 }
 211
 212 static void file_free_security(struct file *file)
 213 {
 214         struct file_security_struct *fsec = file->f_security;
 215
 216         if (!fsec || fsec->magic != SELINUX_MAGIC)
 217                 return;
 218
 219         file->f_security = NULL;
 220         kfree(fsec);
 221 }
 222
 223 static int superblock_alloc_security(struct super_block *sb)
 224 {
 225         struct superblock_security_struct *sbsec;
 226
 227         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 228         if (!sbsec)
 229                 return -ENOMEM;
 230
 231         init_MUTEX(&sbsec->sem);
 232         INIT_LIST_HEAD(&sbsec->list);
 233         INIT_LIST_HEAD(&sbsec->isec_head);
 234         spin_lock_init(&sbsec->isec_lock);
 235         sbsec->magic = SELINUX_MAGIC;
 236         sbsec->sb = sb;
 237         sbsec->sid = SECINITSID_UNLABELED;
 238         sbsec->def_sid = SECINITSID_FILE;
 239         sb->s_security = sbsec;
 240
 241         return 0;
 242 }
 243
 244 static void superblock_free_security(struct super_block *sb)
 245 {
 246         struct superblock_security_struct *sbsec = sb->s_security;
 247
 248         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 249                 return;
 250
 251         spin_lock(&sb_security_lock);
 252         if (!list_empty(&sbsec->list))
 253                 list_del_init(&sbsec->list);
 254         spin_unlock(&sb_security_lock);
 255
 256         sb->s_security = NULL;
 257         kfree(sbsec);
 258 }
 259
 260 #ifdef CONFIG_SECURITY_NETWORK
 261 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 262 {
 263         struct sk_security_struct *ssec;
 264
 265         if (family != PF_UNIX)
 266                 return 0;
 267
 268         ssec = kzalloc(sizeof(*ssec), priority);
 269         if (!ssec)
 270                 return -ENOMEM;
 271
 272         ssec->magic = SELINUX_MAGIC;
 273         ssec->sk = sk;
 274         ssec->peer_sid = SECINITSID_UNLABELED;
 275         sk->sk_security = ssec;
 276
 277         return 0;
 278 }
 279
 280 static void sk_free_security(struct sock *sk)
 281 {
 282         struct sk_security_struct *ssec = sk->sk_security;
 283
 284         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 285                 return;
 286
 287         sk->sk_security = NULL;
 288         kfree(ssec);
 289 }
 290 #endif  /* CONFIG_SECURITY_NETWORK */
 291
 292 /* The security server must be initialized before
 293    any labeling or access decisions can be provided. */
 294 extern int ss_initialized;
 295
 296 /* The file system's label must be initialized prior to use. */
 297
 298 static char *labeling_behaviors[6] = {
 299         "uses xattr",
 300         "uses transition SIDs",
 301         "uses task SIDs",
 302         "uses genfs_contexts",
 303         "not configured for labeling",
 304         "uses mountpoint labeling",
 305 };
 306
 307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 308
 309 static inline int inode_doinit(struct inode *inode)
 310 {
 311         return inode_doinit_with_dentry(inode, NULL);
 312 }
 313
 314 enum {
 315         Opt_context = 1,
 316         Opt_fscontext = 2,
 317         Opt_defcontext = 4,
 318 };
 319
 320 static match_table_t tokens = {
 321         {Opt_context, "context=%s"},
 322         {Opt_fscontext, "fscontext=%s"},
 323         {Opt_defcontext, "defcontext=%s"},
 324 };
 325
 326 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 327
 328 static int try_context_mount(struct super_block *sb, void *data)
 329 {
 330         char *context = NULL, *defcontext = NULL;
 331         const char *name;
 332         u32 sid;
 333         int alloc = 0, rc = 0, seen = 0;
 334         struct task_security_struct *tsec = current->security;
 335         struct superblock_security_struct *sbsec = sb->s_security;
 336
 337         if (!data)
 338                 goto out;
 339
 340         name = sb->s_type->name;
 341
 342         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 343
 344                 /* NFS we understand. */
 345                 if (!strcmp(name, "nfs")) {
 346                         struct nfs_mount_data *d = data;
 347
 348                         if (d->version <  NFS_MOUNT_VERSION)
 349                                 goto out;
 350
 351                         if (d->context[0]) {
 352                                 context = d->context;
 353                                 seen |= Opt_context;
 354                         }
 355                 } else
 356                         goto out;
 357
 358         } else {
 359                 /* Standard string-based options. */
 360                 char *p, *options = data;
 361
 362                 while ((p = strsep(&options, ",")) != NULL) {
 363                         int token;
 364                         substring_t args[MAX_OPT_ARGS];
 365
 366                         if (!*p)
 367                                 continue;
 368
 369                         token = match_token(p, tokens, args);
 370
 371                         switch (token) {
 372                         case Opt_context:
 373                                 if (seen) {
 374                                         rc = -EINVAL;
 375                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 376                                         goto out_free;
 377                                 }
 378                                 context = match_strdup(&args[0]);
 379                                 if (!context) {
 380                                         rc = -ENOMEM;
 381                                         goto out_free;
 382                                 }
 383                                 if (!alloc)
 384                                         alloc = 1;
 385                                 seen |= Opt_context;
 386                                 break;
 387
 388                         case Opt_fscontext:
 389                                 if (seen & (Opt_context|Opt_fscontext)) {
 390                                         rc = -EINVAL;
 391                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 392                                         goto out_free;
 393                                 }
 394                                 context = match_strdup(&args[0]);
 395                                 if (!context) {
 396                                         rc = -ENOMEM;
 397                                         goto out_free;
 398                                 }
 399                                 if (!alloc)
 400                                         alloc = 1;
 401                                 seen |= Opt_fscontext;
 402                                 break;
 403
 404                         case Opt_defcontext:
 405                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 406                                         rc = -EINVAL;
 407                                         printk(KERN_WARNING "SELinux:  "
 408                                                "defcontext option is invalid "
 409                                                "for this filesystem type\n");
 410                                         goto out_free;
 411                                 }
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 defcontext = match_strdup(&args[0]);
 418                                 if (!defcontext) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_defcontext;
 425                                 break;
 426
 427                         default:
 428                                 rc = -EINVAL;
 429                                 printk(KERN_WARNING "SELinux:  unknown mount "
 430                                        "option\n");
 431                                 goto out_free;
 432
 433                         }
 434                 }
 435         }
 436
 437         if (!seen)
 438                 goto out;
 439
 440         if (context) {
 441                 rc = security_context_to_sid(context, strlen(context), &sid);
 442                 if (rc) {
 443                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 444                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 445                                context, sb->s_id, name, rc);
 446                         goto out_free;
 447                 }
 448
 449                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 450                                   FILESYSTEM__RELABELFROM, NULL);
 451                 if (rc)
 452                         goto out_free;
 453
 454                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELTO, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 sbsec->sid = sid;
 460
 461                 if (seen & Opt_context)
 462                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 463         }
 464
 465         if (defcontext) {
 466                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 467                 if (rc) {
 468                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 469                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 470                                defcontext, sb->s_id, name, rc);
 471                         goto out_free;
 472                 }
 473
 474                 if (sid == sbsec->def_sid)
 475                         goto out_free;
 476
 477                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                                   FILESYSTEM__RELABELFROM, NULL);
 479                 if (rc)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__ASSOCIATE, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 sbsec->def_sid = sid;
 488         }
 489
 490 out_free:
 491         if (alloc) {
 492                 kfree(context);
 493                 kfree(defcontext);
 494         }
 495 out:
 496         return rc;
 497 }
 498
 499 static int superblock_doinit(struct super_block *sb, void *data)
 500 {
 501         struct superblock_security_struct *sbsec = sb->s_security;
 502         struct dentry *root = sb->s_root;
 503         struct inode *inode = root->d_inode;
 504         int rc = 0;
 505
 506         down(&sbsec->sem);
 507         if (sbsec->initialized)
 508                 goto out;
 509
 510         if (!ss_initialized) {
 511                 /* Defer initialization until selinux_complete_init,
 512                    after the initial policy is loaded and the security
 513                    server is ready to handle calls. */
 514                 spin_lock(&sb_security_lock);
 515                 if (list_empty(&sbsec->list))
 516                         list_add(&sbsec->list, &superblock_security_head);
 517                 spin_unlock(&sb_security_lock);
 518                 goto out;
 519         }
 520
 521         /* Determine the labeling behavior to use for this filesystem type. */
 522         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 523         if (rc) {
 524                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 525                        __FUNCTION__, sb->s_type->name, rc);
 526                 goto out;
 527         }
 528
 529         rc = try_context_mount(sb, data);
 530         if (rc)
 531                 goto out;
 532
 533         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 534                 /* Make sure that the xattr handler exists and that no
 535                    error other than -ENODATA is returned by getxattr on
 536                    the root directory.  -ENODATA is ok, as this may be
 537                    the first boot of the SELinux kernel before we have
 538                    assigned xattr values to the filesystem. */
 539                 if (!inode->i_op->getxattr) {
 540                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 541                                "xattr support\n", sb->s_id, sb->s_type->name);
 542                         rc = -EOPNOTSUPP;
 543                         goto out;
 544                 }
 545                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 546                 if (rc < 0 && rc != -ENODATA) {
 547                         if (rc == -EOPNOTSUPP)
 548                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 549                                        "%s) has no security xattr handler\n",
 550                                        sb->s_id, sb->s_type->name);
 551                         else
 552                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 553                                        "%s) getxattr errno %d\n", sb->s_id,
 554                                        sb->s_type->name, -rc);
 555                         goto out;
 556                 }
 557         }
 558
 559         if (strcmp(sb->s_type->name, "proc") == 0)
 560                 sbsec->proc = 1;
 561
 562         sbsec->initialized = 1;
 563
 564         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 565                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 566                        sb->s_id, sb->s_type->name);
 567         }
 568         else {
 569                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 570                        sb->s_id, sb->s_type->name,
 571                        labeling_behaviors[sbsec->behavior-1]);
 572         }
 573
 574         /* Initialize the root inode. */
 575         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 576
 577         /* Initialize any other inodes associated with the superblock, e.g.
 578            inodes created prior to initial policy load or inodes created
 579            during get_sb by a pseudo filesystem that directly
 580            populates itself. */
 581         spin_lock(&sbsec->isec_lock);
 582 next_inode:
 583         if (!list_empty(&sbsec->isec_head)) {
 584                 struct inode_security_struct *isec =
 585                                 list_entry(sbsec->isec_head.next,
 586                                            struct inode_security_struct, list);
 587                 struct inode *inode = isec->inode;
 588                 spin_unlock(&sbsec->isec_lock);
 589                 inode = igrab(inode);
 590                 if (inode) {
 591                         if (!IS_PRIVATE (inode))
 592                                 inode_doinit(inode);
 593                         iput(inode);
 594                 }
 595                 spin_lock(&sbsec->isec_lock);
 596                 list_del_init(&isec->list);
 597                 goto next_inode;
 598         }
 599         spin_unlock(&sbsec->isec_lock);
 600 out:
 601         up(&sbsec->sem);
 602         return rc;
 603 }
 604
 605 static inline u16 inode_mode_to_security_class(umode_t mode)
 606 {
 607         switch (mode & S_IFMT) {
 608         case S_IFSOCK:
 609                 return SECCLASS_SOCK_FILE;
 610         case S_IFLNK:
 611                 return SECCLASS_LNK_FILE;
 612         case S_IFREG:
 613                 return SECCLASS_FILE;
 614         case S_IFBLK:
 615                 return SECCLASS_BLK_FILE;
 616         case S_IFDIR:
 617                 return SECCLASS_DIR;
 618         case S_IFCHR:
 619                 return SECCLASS_CHR_FILE;
 620         case S_IFIFO:
 621                 return SECCLASS_FIFO_FILE;
 622
 623         }
 624
 625         return SECCLASS_FILE;
 626 }
 627
 628 static inline int default_protocol_stream(int protocol)
 629 {
 630         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 631 }
 632
 633 static inline int default_protocol_dgram(int protocol)
 634 {
 635         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 636 }
 637
 638 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 639 {
 640         switch (family) {
 641         case PF_UNIX:
 642                 switch (type) {
 643                 case SOCK_STREAM:
 644                 case SOCK_SEQPACKET:
 645                         return SECCLASS_UNIX_STREAM_SOCKET;
 646                 case SOCK_DGRAM:
 647                         return SECCLASS_UNIX_DGRAM_SOCKET;
 648                 }
 649                 break;
 650         case PF_INET:
 651         case PF_INET6:
 652                 switch (type) {
 653                 case SOCK_STREAM:
 654                         if (default_protocol_stream(protocol))
 655                                 return SECCLASS_TCP_SOCKET;
 656                         else
 657                                 return SECCLASS_RAWIP_SOCKET;
 658                 case SOCK_DGRAM:
 659                         if (default_protocol_dgram(protocol))
 660                                 return SECCLASS_UDP_SOCKET;
 661                         else
 662                                 return SECCLASS_RAWIP_SOCKET;
 663                 default:
 664                         return SECCLASS_RAWIP_SOCKET;
 665                 }
 666                 break;
 667         case PF_NETLINK:
 668                 switch (protocol) {
 669                 case NETLINK_ROUTE:
 670                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 671                 case NETLINK_FIREWALL:
 672                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 673                 case NETLINK_INET_DIAG:
 674                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 675                 case NETLINK_NFLOG:
 676                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 677                 case NETLINK_XFRM:
 678                         return SECCLASS_NETLINK_XFRM_SOCKET;
 679                 case NETLINK_SELINUX:
 680                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 681                 case NETLINK_AUDIT:
 682                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 683                 case NETLINK_IP6_FW:
 684                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 685                 case NETLINK_DNRTMSG:
 686                         return SECCLASS_NETLINK_DNRT_SOCKET;
 687                 case NETLINK_KOBJECT_UEVENT:
 688                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 689                 default:
 690                         return SECCLASS_NETLINK_SOCKET;
 691                 }
 692         case PF_PACKET:
 693                 return SECCLASS_PACKET_SOCKET;
 694         case PF_KEY:
 695                 return SECCLASS_KEY_SOCKET;
 696         }
 697
 698         return SECCLASS_SOCKET;
 699 }
 700
 701 #ifdef CONFIG_PROC_FS
 702 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 703                                 u16 tclass,
 704                                 u32 *sid)
 705 {
 706         int buflen, rc;
 707         char *buffer, *path, *end;
 708
 709         buffer = (char*)__get_free_page(GFP_KERNEL);
 710         if (!buffer)
 711                 return -ENOMEM;
 712
 713         buflen = PAGE_SIZE;
 714         end = buffer+buflen;
 715         *--end = '\0';
 716         buflen--;
 717         path = end-1;
 718         *path = '/';
 719         while (de && de != de->parent) {
 720                 buflen -= de->namelen + 1;
 721                 if (buflen < 0)
 722                         break;
 723                 end -= de->namelen;
 724                 memcpy(end, de->name, de->namelen);
 725                 *--end = '/';
 726                 path = end;
 727                 de = de->parent;
 728         }
 729         rc = security_genfs_sid("proc", path, tclass, sid);
 730         free_page((unsigned long)buffer);
 731         return rc;
 732 }
 733 #else
 734 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 735                                 u16 tclass,
 736                                 u32 *sid)
 737 {
 738         return -EINVAL;
 739 }
 740 #endif
 741
 742 /* The inode's security attributes must be initialized before first use. */
 743 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 744 {
 745         struct superblock_security_struct *sbsec = NULL;
 746         struct inode_security_struct *isec = inode->i_security;
 747         u32 sid;
 748         struct dentry *dentry;
 749 #define INITCONTEXTLEN 255
 750         char *context = NULL;
 751         unsigned len = 0;
 752         int rc = 0;
 753         int hold_sem = 0;
 754
 755         if (isec->initialized)
 756                 goto out;
 757
 758         down(&isec->sem);
 759         hold_sem = 1;
 760         if (isec->initialized)
 761                 goto out;
 762
 763         sbsec = inode->i_sb->s_security;
 764         if (!sbsec->initialized) {
 765                 /* Defer initialization until selinux_complete_init,
 766                    after the initial policy is loaded and the security
 767                    server is ready to handle calls. */
 768                 spin_lock(&sbsec->isec_lock);
 769                 if (list_empty(&isec->list))
 770                         list_add(&isec->list, &sbsec->isec_head);
 771                 spin_unlock(&sbsec->isec_lock);
 772                 goto out;
 773         }
 774
 775         switch (sbsec->behavior) {
 776         case SECURITY_FS_USE_XATTR:
 777                 if (!inode->i_op->getxattr) {
 778                         isec->sid = sbsec->def_sid;
 779                         break;
 780                 }
 781
 782                 /* Need a dentry, since the xattr API requires one.
 783                    Life would be simpler if we could just pass the inode. */
 784                 if (opt_dentry) {
 785                         /* Called from d_instantiate or d_splice_alias. */
 786                         dentry = dget(opt_dentry);
 787                 } else {
 788                         /* Called from selinux_complete_init, try to find a dentry. */
 789                         dentry = d_find_alias(inode);
 790                 }
 791                 if (!dentry) {
 792                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 793                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 794                                inode->i_ino);
 795                         goto out;
 796                 }
 797
 798                 len = INITCONTEXTLEN;
 799                 context = kmalloc(len, GFP_KERNEL);
 800                 if (!context) {
 801                         rc = -ENOMEM;
 802                         dput(dentry);
 803                         goto out;
 804                 }
 805                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 806                                            context, len);
 807                 if (rc == -ERANGE) {
 808                         /* Need a larger buffer.  Query for the right size. */
 809                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 810                                                    NULL, 0);
 811                         if (rc < 0) {
 812                                 dput(dentry);
 813                                 goto out;
 814                         }
 815                         kfree(context);
 816                         len = rc;
 817                         context = kmalloc(len, GFP_KERNEL);
 818                         if (!context) {
 819                                 rc = -ENOMEM;
 820                                 dput(dentry);
 821                                 goto out;
 822                         }
 823                         rc = inode->i_op->getxattr(dentry,
 824                                                    XATTR_NAME_SELINUX,
 825                                                    context, len);
 826                 }
 827                 dput(dentry);
 828                 if (rc < 0) {
 829                         if (rc != -ENODATA) {
 830                                 printk(KERN_WARNING "%s:  getxattr returned "
 831                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 832                                        -rc, inode->i_sb->s_id, inode->i_ino);
 833                                 kfree(context);
 834                                 goto out;
 835                         }
 836                         /* Map ENODATA to the default file SID */
 837                         sid = sbsec->def_sid;
 838                         rc = 0;
 839                 } else {
 840                         rc = security_context_to_sid_default(context, rc, &sid,
 841                                                              sbsec->def_sid);
 842                         if (rc) {
 843                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 844                                        "returned %d for dev=%s ino=%ld\n",
 845                                        __FUNCTION__, context, -rc,
 846                                        inode->i_sb->s_id, inode->i_ino);
 847                                 kfree(context);
 848                                 /* Leave with the unlabeled SID */
 849                                 rc = 0;
 850                                 break;
 851                         }
 852                 }
 853                 kfree(context);
 854                 isec->sid = sid;
 855                 break;
 856         case SECURITY_FS_USE_TASK:
 857                 isec->sid = isec->task_sid;
 858                 break;
 859         case SECURITY_FS_USE_TRANS:
 860                 /* Default to the fs SID. */
 861                 isec->sid = sbsec->sid;
 862
 863                 /* Try to obtain a transition SID. */
 864                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 865                 rc = security_transition_sid(isec->task_sid,
 866                                              sbsec->sid,
 867                                              isec->sclass,
 868                                              &sid);
 869                 if (rc)
 870                         goto out;
 871                 isec->sid = sid;
 872                 break;
 873         default:
 874                 /* Default to the fs SID. */
 875                 isec->sid = sbsec->sid;
 876
 877                 if (sbsec->proc) {
 878                         struct proc_inode *proci = PROC_I(inode);
 879                         if (proci->pde) {
 880                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 881                                 rc = selinux_proc_get_sid(proci->pde,
 882                                                           isec->sclass,
 883                                                           &sid);
 884                                 if (rc)
 885                                         goto out;
 886                                 isec->sid = sid;
 887                         }
 888                 }
 889                 break;
 890         }
 891
 892         isec->initialized = 1;
 893
 894 out:
 895         if (isec->sclass == SECCLASS_FILE)
 896                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 897
 898         if (hold_sem)
 899                 up(&isec->sem);
 900         return rc;
 901 }
 902
 903 /* Convert a Linux signal to an access vector. */
 904 static inline u32 signal_to_av(int sig)
 905 {
 906         u32 perm = 0;
 907
 908         switch (sig) {
 909         case SIGCHLD:
 910                 /* Commonly granted from child to parent. */
 911                 perm = PROCESS__SIGCHLD;
 912                 break;
 913         case SIGKILL:
 914                 /* Cannot be caught or ignored */
 915                 perm = PROCESS__SIGKILL;
 916                 break;
 917         case SIGSTOP:
 918                 /* Cannot be caught or ignored */
 919                 perm = PROCESS__SIGSTOP;
 920                 break;
 921         default:
 922                 /* All other signals. */
 923                 perm = PROCESS__SIGNAL;
 924                 break;
 925         }
 926
 927         return perm;
 928 }
 929
 930 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 931    fork check, ptrace check, etc. */
 932 static int task_has_perm(struct task_struct *tsk1,
 933                          struct task_struct *tsk2,
 934                          u32 perms)
 935 {
 936         struct task_security_struct *tsec1, *tsec2;
 937
 938         tsec1 = tsk1->security;
 939         tsec2 = tsk2->security;
 940         return avc_has_perm(tsec1->sid, tsec2->sid,
 941                             SECCLASS_PROCESS, perms, NULL);
 942 }
 943
 944 /* Check whether a task is allowed to use a capability. */
 945 static int task_has_capability(struct task_struct *tsk,
 946                                int cap)
 947 {
 948         struct task_security_struct *tsec;
 949         struct avc_audit_data ad;
 950
 951         tsec = tsk->security;
 952
 953         AVC_AUDIT_DATA_INIT(&ad,CAP);
 954         ad.tsk = tsk;
 955         ad.u.cap = cap;
 956
 957         return avc_has_perm(tsec->sid, tsec->sid,
 958                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 959 }
 960
 961 /* Check whether a task is allowed to use a system operation. */
 962 static int task_has_system(struct task_struct *tsk,
 963                            u32 perms)
 964 {
 965         struct task_security_struct *tsec;
 966
 967         tsec = tsk->security;
 968
 969         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 970                             SECCLASS_SYSTEM, perms, NULL);
 971 }
 972
 973 /* Check whether a task has a particular permission to an inode.
 974    The 'adp' parameter is optional and allows other audit
 975    data to be passed (e.g. the dentry). */
 976 static int inode_has_perm(struct task_struct *tsk,
 977                           struct inode *inode,
 978                           u32 perms,
 979                           struct avc_audit_data *adp)
 980 {
 981         struct task_security_struct *tsec;
 982         struct inode_security_struct *isec;
 983         struct avc_audit_data ad;
 984
 985         tsec = tsk->security;
 986         isec = inode->i_security;
 987
 988         if (!adp) {
 989                 adp = &ad;
 990                 AVC_AUDIT_DATA_INIT(&ad, FS);
 991                 ad.u.fs.inode = inode;
 992         }
 993
 994         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 995 }
 996
 997 /* Same as inode_has_perm, but pass explicit audit data containing
 998    the dentry to help the auditing code to more easily generate the
 999    pathname if needed. */
1000 static inline int dentry_has_perm(struct task_struct *tsk,
1001                                   struct vfsmount *mnt,
1002                                   struct dentry *dentry,
1003                                   u32 av)
1004 {
1005         struct inode *inode = dentry->d_inode;
1006         struct avc_audit_data ad;
1007         AVC_AUDIT_DATA_INIT(&ad,FS);
1008         ad.u.fs.mnt = mnt;
1009         ad.u.fs.dentry = dentry;
1010         return inode_has_perm(tsk, inode, av, &ad);
1011 }
1012
1013 /* Check whether a task can use an open file descriptor to
1014    access an inode in a given way.  Check access to the
1015    descriptor itself, and then use dentry_has_perm to
1016    check a particular permission to the file.
1017    Access to the descriptor is implicitly granted if it
1018    has the same SID as the process.  If av is zero, then
1019    access to the file is not checked, e.g. for cases
1020    where only the descriptor is affected like seek. */
1021 static inline int file_has_perm(struct task_struct *tsk,
1022                                 struct file *file,
1023                                 u32 av)
1024 {
1025         struct task_security_struct *tsec = tsk->security;
1026         struct file_security_struct *fsec = file->f_security;
1027         struct vfsmount *mnt = file->f_vfsmnt;
1028         struct dentry *dentry = file->f_dentry;
1029         struct inode *inode = dentry->d_inode;
1030         struct avc_audit_data ad;
1031         int rc;
1032
1033         AVC_AUDIT_DATA_INIT(&ad, FS);
1034         ad.u.fs.mnt = mnt;
1035         ad.u.fs.dentry = dentry;
1036
1037         if (tsec->sid != fsec->sid) {
1038                 rc = avc_has_perm(tsec->sid, fsec->sid,
1039                                   SECCLASS_FD,
1040                                   FD__USE,
1041                                   &ad);
1042                 if (rc)
1043                         return rc;
1044         }
1045
1046         /* av is zero if only checking access to the descriptor. */
1047         if (av)
1048                 return inode_has_perm(tsk, inode, av, &ad);
1049
1050         return 0;
1051 }
1052
1053 /* Check whether a task can create a file. */
1054 static int may_create(struct inode *dir,
1055                       struct dentry *dentry,
1056                       u16 tclass)
1057 {
1058         struct task_security_struct *tsec;
1059         struct inode_security_struct *dsec;
1060         struct superblock_security_struct *sbsec;
1061         u32 newsid;
1062         struct avc_audit_data ad;
1063         int rc;
1064
1065         tsec = current->security;
1066         dsec = dir->i_security;
1067         sbsec = dir->i_sb->s_security;
1068
1069         AVC_AUDIT_DATA_INIT(&ad, FS);
1070         ad.u.fs.dentry = dentry;
1071
1072         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1073                           DIR__ADD_NAME | DIR__SEARCH,
1074                           &ad);
1075         if (rc)
1076                 return rc;
1077
1078         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1079                 newsid = tsec->create_sid;
1080         } else {
1081                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1082                                              &newsid);
1083                 if (rc)
1084                         return rc;
1085         }
1086
1087         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1088         if (rc)
1089                 return rc;
1090
1091         return avc_has_perm(newsid, sbsec->sid,
1092                             SECCLASS_FILESYSTEM,
1093                             FILESYSTEM__ASSOCIATE, &ad);
1094 }
1095
1096 #define MAY_LINK   0
1097 #define MAY_UNLINK 1
1098 #define MAY_RMDIR  2
1099
1100 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1101 static int may_link(struct inode *dir,
1102                     struct dentry *dentry,
1103                     int kind)
1104
1105 {
1106         struct task_security_struct *tsec;
1107         struct inode_security_struct *dsec, *isec;
1108         struct avc_audit_data ad;
1109         u32 av;
1110         int rc;
1111
1112         tsec = current->security;
1113         dsec = dir->i_security;
1114         isec = dentry->d_inode->i_security;
1115
1116         AVC_AUDIT_DATA_INIT(&ad, FS);
1117         ad.u.fs.dentry = dentry;
1118
1119         av = DIR__SEARCH;
1120         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1121         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1122         if (rc)
1123                 return rc;
1124
1125         switch (kind) {
1126         case MAY_LINK:
1127                 av = FILE__LINK;
1128                 break;
1129         case MAY_UNLINK:
1130                 av = FILE__UNLINK;
1131                 break;
1132         case MAY_RMDIR:
1133                 av = DIR__RMDIR;
1134                 break;
1135         default:
1136                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1137                 return 0;
1138         }
1139
1140         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1141         return rc;
1142 }
1143
1144 static inline int may_rename(struct inode *old_dir,
1145                              struct dentry *old_dentry,
1146                              struct inode *new_dir,
1147                              struct dentry *new_dentry)
1148 {
1149         struct task_security_struct *tsec;
1150         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1151         struct avc_audit_data ad;
1152         u32 av;
1153         int old_is_dir, new_is_dir;
1154         int rc;
1155
1156         tsec = current->security;
1157         old_dsec = old_dir->i_security;
1158         old_isec = old_dentry->d_inode->i_security;
1159         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1160         new_dsec = new_dir->i_security;
1161
1162         AVC_AUDIT_DATA_INIT(&ad, FS);
1163
1164         ad.u.fs.dentry = old_dentry;
1165         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1166                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1167         if (rc)
1168                 return rc;
1169         rc = avc_has_perm(tsec->sid, old_isec->sid,
1170                           old_isec->sclass, FILE__RENAME, &ad);
1171         if (rc)
1172                 return rc;
1173         if (old_is_dir && new_dir != old_dir) {
1174                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1175                                   old_isec->sclass, DIR__REPARENT, &ad);
1176                 if (rc)
1177                         return rc;
1178         }
1179
1180         ad.u.fs.dentry = new_dentry;
1181         av = DIR__ADD_NAME | DIR__SEARCH;
1182         if (new_dentry->d_inode)
1183                 av |= DIR__REMOVE_NAME;
1184         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1185         if (rc)
1186                 return rc;
1187         if (new_dentry->d_inode) {
1188                 new_isec = new_dentry->d_inode->i_security;
1189                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1190                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1191                                   new_isec->sclass,
1192                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1193                 if (rc)
1194                         return rc;
1195         }
1196
1197         return 0;
1198 }
1199
1200 /* Check whether a task can perform a filesystem operation. */
1201 static int superblock_has_perm(struct task_struct *tsk,
1202                                struct super_block *sb,
1203                                u32 perms,
1204                                struct avc_audit_data *ad)
1205 {
1206         struct task_security_struct *tsec;
1207         struct superblock_security_struct *sbsec;
1208
1209         tsec = tsk->security;
1210         sbsec = sb->s_security;
1211         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1212                             perms, ad);
1213 }
1214
1215 /* Convert a Linux mode and permission mask to an access vector. */
1216 static inline u32 file_mask_to_av(int mode, int mask)
1217 {
1218         u32 av = 0;
1219
1220         if ((mode & S_IFMT) != S_IFDIR) {
1221                 if (mask & MAY_EXEC)
1222                         av |= FILE__EXECUTE;
1223                 if (mask & MAY_READ)
1224                         av |= FILE__READ;
1225
1226                 if (mask & MAY_APPEND)
1227                         av |= FILE__APPEND;
1228                 else if (mask & MAY_WRITE)
1229                         av |= FILE__WRITE;
1230
1231         } else {
1232                 if (mask & MAY_EXEC)
1233                         av |= DIR__SEARCH;
1234                 if (mask & MAY_WRITE)
1235                         av |= DIR__WRITE;
1236                 if (mask & MAY_READ)
1237                         av |= DIR__READ;
1238         }
1239
1240         return av;
1241 }
1242
1243 /* Convert a Linux file to an access vector. */
1244 static inline u32 file_to_av(struct file *file)
1245 {
1246         u32 av = 0;
1247
1248         if (file->f_mode & FMODE_READ)
1249                 av |= FILE__READ;
1250         if (file->f_mode & FMODE_WRITE) {
1251                 if (file->f_flags & O_APPEND)
1252                         av |= FILE__APPEND;
1253                 else
1254                         av |= FILE__WRITE;
1255         }
1256
1257         return av;
1258 }
1259
1260 /* Set an inode's SID to a specified value. */
1261 static int inode_security_set_sid(struct inode *inode, u32 sid)
1262 {
1263         struct inode_security_struct *isec = inode->i_security;
1264         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1265
1266         if (!sbsec->initialized) {
1267                 /* Defer initialization to selinux_complete_init. */
1268                 return 0;
1269         }
1270
1271         down(&isec->sem);
1272         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1273         isec->sid = sid;
1274         isec->initialized = 1;
1275         up(&isec->sem);
1276         return 0;
1277 }
1278
1279 /* Hook functions begin here. */
1280
1281 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1282 {
1283         struct task_security_struct *psec = parent->security;
1284         struct task_security_struct *csec = child->security;
1285         int rc;
1286
1287         rc = secondary_ops->ptrace(parent,child);
1288         if (rc)
1289                 return rc;
1290
1291         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1292         /* Save the SID of the tracing process for later use in apply_creds. */
1293         if (!rc)
1294                 csec->ptrace_sid = psec->sid;
1295         return rc;
1296 }
1297
1298 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1299                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1300 {
1301         int error;
1302
1303         error = task_has_perm(current, target, PROCESS__GETCAP);
1304         if (error)
1305                 return error;
1306
1307         return secondary_ops->capget(target, effective, inheritable, permitted);
1308 }
1309
1310 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1311                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1312 {
1313         int error;
1314
1315         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1316         if (error)
1317                 return error;
1318
1319         return task_has_perm(current, target, PROCESS__SETCAP);
1320 }
1321
1322 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1323                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1324 {
1325         secondary_ops->capset_set(target, effective, inheritable, permitted);
1326 }
1327
1328 static int selinux_capable(struct task_struct *tsk, int cap)
1329 {
1330         int rc;
1331
1332         rc = secondary_ops->capable(tsk, cap);
1333         if (rc)
1334                 return rc;
1335
1336         return task_has_capability(tsk,cap);
1337 }
1338
1339 static int selinux_sysctl(ctl_table *table, int op)
1340 {
1341         int error = 0;
1342         u32 av;
1343         struct task_security_struct *tsec;
1344         u32 tsid;
1345         int rc;
1346
1347         rc = secondary_ops->sysctl(table, op);
1348         if (rc)
1349                 return rc;
1350
1351         tsec = current->security;
1352
1353         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1354                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1355         if (rc) {
1356                 /* Default to the well-defined sysctl SID. */
1357                 tsid = SECINITSID_SYSCTL;
1358         }
1359
1360         /* The op values are "defined" in sysctl.c, thereby creating
1361          * a bad coupling between this module and sysctl.c */
1362         if(op == 001) {
1363                 error = avc_has_perm(tsec->sid, tsid,
1364                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1365         } else {
1366                 av = 0;
1367                 if (op & 004)
1368                         av |= FILE__READ;
1369                 if (op & 002)
1370                         av |= FILE__WRITE;
1371                 if (av)
1372                         error = avc_has_perm(tsec->sid, tsid,
1373                                              SECCLASS_FILE, av, NULL);
1374         }
1375
1376         return error;
1377 }
1378
1379 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1380 {
1381         int rc = 0;
1382
1383         if (!sb)
1384                 return 0;
1385
1386         switch (cmds) {
1387                 case Q_SYNC:
1388                 case Q_QUOTAON:
1389                 case Q_QUOTAOFF:
1390                 case Q_SETINFO:
1391                 case Q_SETQUOTA:
1392                         rc = superblock_has_perm(current,
1393                                                  sb,
1394                                                  FILESYSTEM__QUOTAMOD, NULL);
1395                         break;
1396                 case Q_GETFMT:
1397                 case Q_GETINFO:
1398                 case Q_GETQUOTA:
1399                         rc = superblock_has_perm(current,
1400                                                  sb,
1401                                                  FILESYSTEM__QUOTAGET, NULL);
1402                         break;
1403                 default:
1404                         rc = 0;  /* let the kernel handle invalid cmds */
1405                         break;
1406         }
1407         return rc;
1408 }
1409
1410 static int selinux_quota_on(struct dentry *dentry)
1411 {
1412         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1413 }
1414
1415 static int selinux_syslog(int type)
1416 {
1417         int rc;
1418
1419         rc = secondary_ops->syslog(type);
1420         if (rc)
1421                 return rc;
1422
1423         switch (type) {
1424                 case 3:         /* Read last kernel messages */
1425                 case 10:        /* Return size of the log buffer */
1426                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1427                         break;
1428                 case 6:         /* Disable logging to console */
1429                 case 7:         /* Enable logging to console */
1430                 case 8:         /* Set level of messages printed to console */
1431                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1432                         break;
1433                 case 0:         /* Close log */
1434                 case 1:         /* Open log */
1435                 case 2:         /* Read from log */
1436                 case 4:         /* Read/clear last kernel messages */
1437                 case 5:         /* Clear ring buffer */
1438                 default:
1439                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1440                         break;
1441         }
1442         return rc;
1443 }
1444
1445 /*
1446  * Check that a process has enough memory to allocate a new virtual
1447  * mapping. 0 means there is enough memory for the allocation to
1448  * succeed and -ENOMEM implies there is not.
1449  *
1450  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1451  * if the capability is granted, but __vm_enough_memory requires 1 if
1452  * the capability is granted.
1453  *
1454  * Do not audit the selinux permission check, as this is applied to all
1455  * processes that allocate mappings.
1456  */
1457 static int selinux_vm_enough_memory(long pages)
1458 {
1459         int rc, cap_sys_admin = 0;
1460         struct task_security_struct *tsec = current->security;
1461
1462         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1463         if (rc == 0)
1464                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1465                                         SECCLASS_CAPABILITY,
1466                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1467                                         NULL);
1468
1469         if (rc == 0)
1470                 cap_sys_admin = 1;
1471
1472         return __vm_enough_memory(pages, cap_sys_admin);
1473 }
1474
1475 /* binprm security operations */
1476
1477 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1478 {
1479         struct bprm_security_struct *bsec;
1480
1481         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1482         if (!bsec)
1483                 return -ENOMEM;
1484
1485         bsec->magic = SELINUX_MAGIC;
1486         bsec->bprm = bprm;
1487         bsec->sid = SECINITSID_UNLABELED;
1488         bsec->set = 0;
1489
1490         bprm->security = bsec;
1491         return 0;
1492 }
1493
1494 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1495 {
1496         struct task_security_struct *tsec;
1497         struct inode *inode = bprm->file->f_dentry->d_inode;
1498         struct inode_security_struct *isec;
1499         struct bprm_security_struct *bsec;
1500         u32 newsid;
1501         struct avc_audit_data ad;
1502         int rc;
1503
1504         rc = secondary_ops->bprm_set_security(bprm);
1505         if (rc)
1506                 return rc;
1507
1508         bsec = bprm->security;
1509
1510         if (bsec->set)
1511                 return 0;
1512
1513         tsec = current->security;
1514         isec = inode->i_security;
1515
1516         /* Default to the current task SID. */
1517         bsec->sid = tsec->sid;
1518
1519         /* Reset create SID on execve. */
1520         tsec->create_sid = 0;
1521
1522         if (tsec->exec_sid) {
1523                 newsid = tsec->exec_sid;
1524                 /* Reset exec SID on execve. */
1525                 tsec->exec_sid = 0;
1526         } else {
1527                 /* Check for a default transition on this program. */
1528                 rc = security_transition_sid(tsec->sid, isec->sid,
1529                                              SECCLASS_PROCESS, &newsid);
1530                 if (rc)
1531                         return rc;
1532         }
1533
1534         AVC_AUDIT_DATA_INIT(&ad, FS);
1535         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1536         ad.u.fs.dentry = bprm->file->f_dentry;
1537
1538         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1539                 newsid = tsec->sid;
1540
1541         if (tsec->sid == newsid) {
1542                 rc = avc_has_perm(tsec->sid, isec->sid,
1543                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1544                 if (rc)
1545                         return rc;
1546         } else {
1547                 /* Check permissions for the transition. */
1548                 rc = avc_has_perm(tsec->sid, newsid,
1549                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1550                 if (rc)
1551                         return rc;
1552
1553                 rc = avc_has_perm(newsid, isec->sid,
1554                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1555                 if (rc)
1556                         return rc;
1557
1558                 /* Clear any possibly unsafe personality bits on exec: */
1559                 current->personality &= ~PER_CLEAR_ON_SETID;
1560
1561                 /* Set the security field to the new SID. */
1562                 bsec->sid = newsid;
1563         }
1564
1565         bsec->set = 1;
1566         return 0;
1567 }
1568
1569 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1570 {
1571         return secondary_ops->bprm_check_security(bprm);
1572 }
1573
1574
1575 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1576 {
1577         struct task_security_struct *tsec = current->security;
1578         int atsecure = 0;
1579
1580         if (tsec->osid != tsec->sid) {
1581                 /* Enable secure mode for SIDs transitions unless
1582                    the noatsecure permission is granted between
1583                    the two SIDs, i.e. ahp returns 0. */
1584                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1585                                          SECCLASS_PROCESS,
1586                                          PROCESS__NOATSECURE, NULL);
1587         }
1588
1589         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1590 }
1591
1592 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1593 {
1594         kfree(bprm->security);
1595         bprm->security = NULL;
1596 }
1597
1598 extern struct vfsmount *selinuxfs_mount;
1599 extern struct dentry *selinux_null;
1600
1601 /* Derived from fs/exec.c:flush_old_files. */
1602 static inline void flush_unauthorized_files(struct files_struct * files)
1603 {
1604         struct avc_audit_data ad;
1605         struct file *file, *devnull = NULL;
1606         struct tty_struct *tty = current->signal->tty;
1607         struct fdtable *fdt;
1608         long j = -1;
1609
1610         if (tty) {
1611                 file_list_lock();
1612                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1613                 if (file) {
1614                         /* Revalidate access to controlling tty.
1615                            Use inode_has_perm on the tty inode directly rather
1616                            than using file_has_perm, as this particular open
1617                            file may belong to another process and we are only
1618                            interested in the inode-based check here. */
1619                         struct inode *inode = file->f_dentry->d_inode;
1620                         if (inode_has_perm(current, inode,
1621                                            FILE__READ | FILE__WRITE, NULL)) {
1622                                 /* Reset controlling tty. */
1623                                 current->signal->tty = NULL;
1624                                 current->signal->tty_old_pgrp = 0;
1625                         }
1626                 }
1627                 file_list_unlock();
1628         }
1629
1630         /* Revalidate access to inherited open files. */
1631
1632         AVC_AUDIT_DATA_INIT(&ad,FS);
1633
1634         spin_lock(&files->file_lock);
1635         for (;;) {
1636                 unsigned long set, i;
1637                 int fd;
1638
1639                 j++;
1640                 i = j * __NFDBITS;
1641                 fdt = files_fdtable(files);
1642                 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1643                         break;
1644                 set = fdt->open_fds->fds_bits[j];
1645                 if (!set)
1646                         continue;
1647                 spin_unlock(&files->file_lock);
1648                 for ( ; set ; i++,set >>= 1) {
1649                         if (set & 1) {
1650                                 file = fget(i);
1651                                 if (!file)
1652                                         continue;
1653                                 if (file_has_perm(current,
1654                                                   file,
1655                                                   file_to_av(file))) {
1656                                         sys_close(i);
1657                                         fd = get_unused_fd();
1658                                         if (fd != i) {
1659                                                 if (fd >= 0)
1660                                                         put_unused_fd(fd);
1661                                                 fput(file);
1662                                                 continue;
1663                                         }
1664                                         if (devnull) {
1665                                                 rcuref_inc(&devnull->f_count);
1666                                         } else {
1667                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1668                                                 if (!devnull) {
1669                                                         put_unused_fd(fd);
1670                                                         fput(file);
1671                                                         continue;
1672                                                 }
1673                                         }
1674                                         fd_install(fd, devnull);
1675                                 }
1676                                 fput(file);
1677                         }
1678                 }
1679                 spin_lock(&files->file_lock);
1680
1681         }
1682         spin_unlock(&files->file_lock);
1683 }
1684
1685 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1686 {
1687         struct task_security_struct *tsec;
1688         struct bprm_security_struct *bsec;
1689         u32 sid;
1690         int rc;
1691
1692         secondary_ops->bprm_apply_creds(bprm, unsafe);
1693
1694         tsec = current->security;
1695
1696         bsec = bprm->security;
1697         sid = bsec->sid;
1698
1699         tsec->osid = tsec->sid;
1700         bsec->unsafe = 0;
1701         if (tsec->sid != sid) {
1702                 /* Check for shared state.  If not ok, leave SID
1703                    unchanged and kill. */
1704                 if (unsafe & LSM_UNSAFE_SHARE) {
1705                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1706                                         PROCESS__SHARE, NULL);
1707                         if (rc) {
1708                                 bsec->unsafe = 1;
1709                                 return;
1710                         }
1711                 }
1712
1713                 /* Check for ptracing, and update the task SID if ok.
1714                    Otherwise, leave SID unchanged and kill. */
1715                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1716                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1717                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1718                                           NULL);
1719                         if (rc) {
1720                                 bsec->unsafe = 1;
1721                                 return;
1722                         }
1723                 }
1724                 tsec->sid = sid;
1725         }
1726 }
1727
1728 /*
1729  * called after apply_creds without the task lock held
1730  */
1731 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1732 {
1733         struct task_security_struct *tsec;
1734         struct rlimit *rlim, *initrlim;
1735         struct itimerval itimer;
1736         struct bprm_security_struct *bsec;
1737         int rc, i;
1738
1739         tsec = current->security;
1740         bsec = bprm->security;
1741
1742         if (bsec->unsafe) {
1743                 force_sig_specific(SIGKILL, current);
1744                 return;
1745         }
1746         if (tsec->osid == tsec->sid)
1747                 return;
1748
1749         /* Close files for which the new task SID is not authorized. */
1750         flush_unauthorized_files(current->files);
1751
1752         /* Check whether the new SID can inherit signal state
1753            from the old SID.  If not, clear itimers to avoid
1754            subsequent signal generation and flush and unblock
1755            signals. This must occur _after_ the task SID has
1756           been updated so that any kill done after the flush
1757           will be checked against the new SID. */
1758         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1759                           PROCESS__SIGINH, NULL);
1760         if (rc) {
1761                 memset(&itimer, 0, sizeof itimer);
1762                 for (i = 0; i < 3; i++)
1763                         do_setitimer(i, &itimer, NULL);
1764                 flush_signals(current);
1765                 spin_lock_irq(&current->sighand->siglock);
1766                 flush_signal_handlers(current, 1);
1767                 sigemptyset(&current->blocked);
1768                 recalc_sigpending();
1769                 spin_unlock_irq(&current->sighand->siglock);
1770         }
1771
1772         /* Check whether the new SID can inherit resource limits
1773            from the old SID.  If not, reset all soft limits to
1774            the lower of the current task's hard limit and the init
1775            task's soft limit.  Note that the setting of hard limits
1776            (even to lower them) can be controlled by the setrlimit
1777            check. The inclusion of the init task's soft limit into
1778            the computation is to avoid resetting soft limits higher
1779            than the default soft limit for cases where the default
1780            is lower than the hard limit, e.g. RLIMIT_CORE or
1781            RLIMIT_STACK.*/
1782         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1783                           PROCESS__RLIMITINH, NULL);
1784         if (rc) {
1785                 for (i = 0; i < RLIM_NLIMITS; i++) {
1786                         rlim = current->signal->rlim + i;
1787                         initrlim = init_task.signal->rlim+i;
1788                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1789                 }
1790                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1791                         /*
1792                          * This will cause RLIMIT_CPU calculations
1793                          * to be refigured.
1794                          */
1795                         current->it_prof_expires = jiffies_to_cputime(1);
1796                 }
1797         }
1798
1799         /* Wake up the parent if it is waiting so that it can
1800            recheck wait permission to the new task SID. */
1801         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1802 }
1803
1804 /* superblock security operations */
1805
1806 static int selinux_sb_alloc_security(struct super_block *sb)
1807 {
1808         return superblock_alloc_security(sb);
1809 }
1810
1811 static void selinux_sb_free_security(struct super_block *sb)
1812 {
1813         superblock_free_security(sb);
1814 }
1815
1816 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1817 {
1818         if (plen > olen)
1819                 return 0;
1820
1821         return !memcmp(prefix, option, plen);
1822 }
1823
1824 static inline int selinux_option(char *option, int len)
1825 {
1826         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1827                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1828                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1829 }
1830
1831 static inline void take_option(char **to, char *from, int *first, int len)
1832 {
1833         if (!*first) {
1834                 **to = ',';
1835                 *to += 1;
1836         }
1837         else
1838                 *first = 0;
1839         memcpy(*to, from, len);
1840         *to += len;
1841 }
1842
1843 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1844 {
1845         int fnosec, fsec, rc = 0;
1846         char *in_save, *in_curr, *in_end;
1847         char *sec_curr, *nosec_save, *nosec;
1848
1849         in_curr = orig;
1850         sec_curr = copy;
1851
1852         /* Binary mount data: just copy */
1853         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1854                 copy_page(sec_curr, in_curr);
1855                 goto out;
1856         }
1857
1858         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1859         if (!nosec) {
1860                 rc = -ENOMEM;
1861                 goto out;
1862         }
1863
1864         nosec_save = nosec;
1865         fnosec = fsec = 1;
1866         in_save = in_end = orig;
1867
1868         do {
1869                 if (*in_end == ',' || *in_end == '\0') {
1870                         int len = in_end - in_curr;
1871
1872                         if (selinux_option(in_curr, len))
1873                                 take_option(&sec_curr, in_curr, &fsec, len);
1874                         else
1875                                 take_option(&nosec, in_curr, &fnosec, len);
1876
1877                         in_curr = in_end + 1;
1878                 }
1879         } while (*in_end++);
1880
1881         strcpy(in_save, nosec_save);
1882         free_page((unsigned long)nosec_save);
1883 out:
1884         return rc;
1885 }
1886
1887 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1888 {
1889         struct avc_audit_data ad;
1890         int rc;
1891
1892         rc = superblock_doinit(sb, data);
1893         if (rc)
1894                 return rc;
1895
1896         AVC_AUDIT_DATA_INIT(&ad,FS);
1897         ad.u.fs.dentry = sb->s_root;
1898         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1899 }
1900
1901 static int selinux_sb_statfs(struct super_block *sb)
1902 {
1903         struct avc_audit_data ad;
1904
1905         AVC_AUDIT_DATA_INIT(&ad,FS);
1906         ad.u.fs.dentry = sb->s_root;
1907         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1908 }
1909
1910 static int selinux_mount(char * dev_name,
1911                          struct nameidata *nd,
1912                          char * type,
1913                          unsigned long flags,
1914                          void * data)
1915 {
1916         int rc;
1917
1918         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1919         if (rc)
1920                 return rc;
1921
1922         if (flags & MS_REMOUNT)
1923                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1924                                            FILESYSTEM__REMOUNT, NULL);
1925         else
1926                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1927                                        FILE__MOUNTON);
1928 }
1929
1930 static int selinux_umount(struct vfsmount *mnt, int flags)
1931 {
1932         int rc;
1933
1934         rc = secondary_ops->sb_umount(mnt, flags);
1935         if (rc)
1936                 return rc;
1937
1938         return superblock_has_perm(current,mnt->mnt_sb,
1939                                    FILESYSTEM__UNMOUNT,NULL);
1940 }
1941
1942 /* inode security operations */
1943
1944 static int selinux_inode_alloc_security(struct inode *inode)
1945 {
1946         return inode_alloc_security(inode);
1947 }
1948
1949 static void selinux_inode_free_security(struct inode *inode)
1950 {
1951         inode_free_security(inode);
1952 }
1953
1954 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1955                                        char **name, void **value,
1956                                        size_t *len)
1957 {
1958         struct task_security_struct *tsec;
1959         struct inode_security_struct *dsec;
1960         struct superblock_security_struct *sbsec;
1961         struct inode_security_struct *isec;
1962         u32 newsid, clen;
1963         int rc;
1964         char *namep = NULL, *context;
1965
1966         tsec = current->security;
1967         dsec = dir->i_security;
1968         sbsec = dir->i_sb->s_security;
1969         isec = inode->i_security;
1970
1971         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1972                 newsid = tsec->create_sid;
1973         } else {
1974                 rc = security_transition_sid(tsec->sid, dsec->sid,
1975                                              inode_mode_to_security_class(inode->i_mode),
1976                                              &newsid);
1977                 if (rc) {
1978                         printk(KERN_WARNING "%s:  "
1979                                "security_transition_sid failed, rc=%d (dev=%s "
1980                                "ino=%ld)\n",
1981                                __FUNCTION__,
1982                                -rc, inode->i_sb->s_id, inode->i_ino);
1983                         return rc;
1984                 }
1985         }
1986
1987         inode_security_set_sid(inode, newsid);
1988
1989         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
1990                 return -EOPNOTSUPP;
1991
1992         if (name) {
1993                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
1994                 if (!namep)
1995                         return -ENOMEM;
1996                 *name = namep;
1997         }
1998
1999         if (value && len) {
2000                 rc = security_sid_to_context(newsid, &context, &clen);
2001                 if (rc) {
2002                         kfree(namep);
2003                         return rc;
2004                 }
2005                 *value = context;
2006                 *len = clen;
2007         }
2008
2009         return 0;
2010 }
2011
2012 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2013 {
2014         return may_create(dir, dentry, SECCLASS_FILE);
2015 }
2016
2017 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2018 {
2019         int rc;
2020
2021         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2022         if (rc)
2023                 return rc;
2024         return may_link(dir, old_dentry, MAY_LINK);
2025 }
2026
2027 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2028 {
2029         int rc;
2030
2031         rc = secondary_ops->inode_unlink(dir, dentry);
2032         if (rc)
2033                 return rc;
2034         return may_link(dir, dentry, MAY_UNLINK);
2035 }
2036
2037 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2038 {
2039         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2040 }
2041
2042 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2043 {
2044         return may_create(dir, dentry, SECCLASS_DIR);
2045 }
2046
2047 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2048 {
2049         return may_link(dir, dentry, MAY_RMDIR);
2050 }
2051
2052 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2053 {
2054         int rc;
2055
2056         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2057         if (rc)
2058                 return rc;
2059
2060         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2061 }
2062
2063 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2064                                 struct inode *new_inode, struct dentry *new_dentry)
2065 {
2066         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2067 }
2068
2069 static int selinux_inode_readlink(struct dentry *dentry)
2070 {
2071         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2072 }
2073
2074 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2075 {
2076         int rc;
2077
2078         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2079         if (rc)
2080                 return rc;
2081         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2082 }
2083
2084 static int selinux_inode_permission(struct inode *inode, int mask,
2085                                     struct nameidata *nd)
2086 {
2087         int rc;
2088
2089         rc = secondary_ops->inode_permission(inode, mask, nd);
2090         if (rc)
2091                 return rc;
2092
2093         if (!mask) {
2094                 /* No permission to check.  Existence test. */
2095                 return 0;
2096         }
2097
2098         return inode_has_perm(current, inode,
2099                                file_mask_to_av(inode->i_mode, mask), NULL);
2100 }
2101
2102 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2103 {
2104         int rc;
2105
2106         rc = secondary_ops->inode_setattr(dentry, iattr);
2107         if (rc)
2108                 return rc;
2109
2110         if (iattr->ia_valid & ATTR_FORCE)
2111                 return 0;
2112
2113         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2114                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2115                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2116
2117         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2118 }
2119
2120 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2121 {
2122         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2123 }
2124
2125 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2126 {
2127         struct task_security_struct *tsec = current->security;
2128         struct inode *inode = dentry->d_inode;
2129         struct inode_security_struct *isec = inode->i_security;
2130         struct superblock_security_struct *sbsec;
2131         struct avc_audit_data ad;
2132         u32 newsid;
2133         int rc = 0;
2134
2135         if (strcmp(name, XATTR_NAME_SELINUX)) {
2136                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2137                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2138                     !capable(CAP_SYS_ADMIN)) {
2139                         /* A different attribute in the security namespace.
2140                            Restrict to administrator. */
2141                         return -EPERM;
2142                 }
2143
2144                 /* Not an attribute we recognize, so just check the
2145                    ordinary setattr permission. */
2146                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2147         }
2148
2149         sbsec = inode->i_sb->s_security;
2150         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2151                 return -EOPNOTSUPP;
2152
2153         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2154                 return -EPERM;
2155
2156         AVC_AUDIT_DATA_INIT(&ad,FS);
2157         ad.u.fs.dentry = dentry;
2158
2159         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2160                           FILE__RELABELFROM, &ad);
2161         if (rc)
2162                 return rc;
2163
2164         rc = security_context_to_sid(value, size, &newsid);
2165         if (rc)
2166                 return rc;
2167
2168         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2169                           FILE__RELABELTO, &ad);
2170         if (rc)
2171                 return rc;
2172
2173         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2174                                           isec->sclass);
2175         if (rc)
2176                 return rc;
2177
2178         return avc_has_perm(newsid,
2179                             sbsec->sid,
2180                             SECCLASS_FILESYSTEM,
2181                             FILESYSTEM__ASSOCIATE,
2182                             &ad);
2183 }
2184
2185 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2186                                         void *value, size_t size, int flags)
2187 {
2188         struct inode *inode = dentry->d_inode;
2189         struct inode_security_struct *isec = inode->i_security;
2190         u32 newsid;
2191         int rc;
2192
2193         if (strcmp(name, XATTR_NAME_SELINUX)) {
2194                 /* Not an attribute we recognize, so nothing to do. */
2195                 return;
2196         }
2197
2198         rc = security_context_to_sid(value, size, &newsid);
2199         if (rc) {
2200                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2201                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2202                 return;
2203         }
2204
2205         isec->sid = newsid;
2206         return;
2207 }
2208
2209 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2210 {
2211         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2212 }
2213
2214 static int selinux_inode_listxattr (struct dentry *dentry)
2215 {
2216         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2217 }
2218
2219 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2220 {
2221         if (strcmp(name, XATTR_NAME_SELINUX)) {
2222                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2223                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2224                     !capable(CAP_SYS_ADMIN)) {
2225                         /* A different attribute in the security namespace.
2226                            Restrict to administrator. */
2227                         return -EPERM;
2228                 }
2229
2230                 /* Not an attribute we recognize, so just check the
2231                    ordinary setattr permission. Might want a separate
2232                    permission for removexattr. */
2233                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2234         }
2235
2236         /* No one is allowed to remove a SELinux security label.
2237            You can change the label, but all data must be labeled. */
2238         return -EACCES;
2239 }
2240
2241 /*
2242  * Copy the in-core inode security context value to the user.  If the
2243  * getxattr() prior to this succeeded, check to see if we need to
2244  * canonicalize the value to be finally returned to the user.
2245  *
2246  * Permission check is handled by selinux_inode_getxattr hook.
2247  */
2248 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size, int err)
2249 {
2250         struct inode_security_struct *isec = inode->i_security;
2251         char *context;
2252         unsigned len;
2253         int rc;
2254
2255         if (strcmp(name, XATTR_SELINUX_SUFFIX)) {
2256                 rc = -EOPNOTSUPP;
2257                 goto out;
2258         }
2259
2260         rc = security_sid_to_context(isec->sid, &context, &len);
2261         if (rc)
2262                 goto out;
2263
2264         /* Probe for required buffer size */
2265         if (!buffer || !size) {
2266                 rc = len;
2267                 goto out_free;
2268         }
2269
2270         if (size < len) {
2271                 rc = -ERANGE;
2272                 goto out_free;
2273         }
2274
2275         if (err > 0) {
2276                 if ((len == err) && !(memcmp(context, buffer, len))) {
2277                         /* Don't need to canonicalize value */
2278                         rc = err;
2279                         goto out_free;
2280                 }
2281                 memset(buffer, 0, size);
2282         }
2283         memcpy(buffer, context, len);
2284         rc = len;
2285 out_free:
2286         kfree(context);
2287 out:
2288         return rc;
2289 }
2290
2291 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2292                                      const void *value, size_t size, int flags)
2293 {
2294         struct inode_security_struct *isec = inode->i_security;
2295         u32 newsid;
2296         int rc;
2297
2298         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2299                 return -EOPNOTSUPP;
2300
2301         if (!value || !size)
2302                 return -EACCES;
2303
2304         rc = security_context_to_sid((void*)value, size, &newsid);
2305         if (rc)
2306                 return rc;
2307
2308         isec->sid = newsid;
2309         return 0;
2310 }
2311
2312 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2313 {
2314         const int len = sizeof(XATTR_NAME_SELINUX);
2315         if (buffer && len <= buffer_size)
2316                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2317         return len;
2318 }
2319
2320 /* file security operations */
2321
2322 static int selinux_file_permission(struct file *file, int mask)
2323 {
2324         struct inode *inode = file->f_dentry->d_inode;
2325
2326         if (!mask) {
2327                 /* No permission to check.  Existence test. */
2328                 return 0;
2329         }
2330
2331         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2332         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2333                 mask |= MAY_APPEND;
2334
2335         return file_has_perm(current, file,
2336                              file_mask_to_av(inode->i_mode, mask));
2337 }
2338
2339 static int selinux_file_alloc_security(struct file *file)
2340 {
2341         return file_alloc_security(file);
2342 }
2343
2344 static void selinux_file_free_security(struct file *file)
2345 {
2346         file_free_security(file);
2347 }
2348
2349 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2350                               unsigned long arg)
2351 {
2352         int error = 0;
2353
2354         switch (cmd) {
2355                 case FIONREAD:
2356                 /* fall through */
2357                 case FIBMAP:
2358                 /* fall through */
2359                 case FIGETBSZ:
2360                 /* fall through */
2361                 case EXT2_IOC_GETFLAGS:
2362                 /* fall through */
2363                 case EXT2_IOC_GETVERSION:
2364                         error = file_has_perm(current, file, FILE__GETATTR);
2365                         break;
2366
2367                 case EXT2_IOC_SETFLAGS:
2368                 /* fall through */
2369                 case EXT2_IOC_SETVERSION:
2370                         error = file_has_perm(current, file, FILE__SETATTR);
2371                         break;
2372
2373                 /* sys_ioctl() checks */
2374                 case FIONBIO:
2375                 /* fall through */
2376                 case FIOASYNC:
2377                         error = file_has_perm(current, file, 0);
2378                         break;
2379
2380                 case KDSKBENT:
2381                 case KDSKBSENT:
2382                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2383                         break;
2384
2385                 /* default case assumes that the command will go
2386                  * to the file's ioctl() function.
2387                  */
2388                 default:
2389                         error = file_has_perm(current, file, FILE__IOCTL);
2390
2391         }
2392         return error;
2393 }
2394
2395 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2396 {
2397 #ifndef CONFIG_PPC32
2398         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2399                 /*
2400                  * We are making executable an anonymous mapping or a
2401                  * private file mapping that will also be writable.
2402                  * This has an additional check.
2403                  */
2404                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2405                 if (rc)
2406                         return rc;
2407         }
2408 #endif
2409
2410         if (file) {
2411                 /* read access is always possible with a mapping */
2412                 u32 av = FILE__READ;
2413
2414                 /* write access only matters if the mapping is shared */
2415                 if (shared && (prot & PROT_WRITE))
2416                         av |= FILE__WRITE;
2417
2418                 if (prot & PROT_EXEC)
2419                         av |= FILE__EXECUTE;
2420
2421                 return file_has_perm(current, file, av);
2422         }
2423         return 0;
2424 }
2425
2426 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2427                              unsigned long prot, unsigned long flags)
2428 {
2429         int rc;
2430
2431         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2432         if (rc)
2433                 return rc;
2434
2435         if (selinux_checkreqprot)
2436                 prot = reqprot;
2437
2438         return file_map_prot_check(file, prot,
2439                                    (flags & MAP_TYPE) == MAP_SHARED);
2440 }
2441
2442 static int selinux_file_mprotect(struct vm_area_struct *vma,
2443                                  unsigned long reqprot,
2444                                  unsigned long prot)
2445 {
2446         int rc;
2447
2448         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2449         if (rc)
2450                 return rc;
2451
2452         if (selinux_checkreqprot)
2453                 prot = reqprot;
2454
2455 #ifndef CONFIG_PPC32
2456         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2457            (vma->vm_start >= vma->vm_mm->start_brk &&
2458             vma->vm_end <= vma->vm_mm->brk)) {
2459                 /*
2460                  * We are making an executable mapping in the brk region.
2461                  * This has an additional execheap check.
2462                  */
2463                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2464                 if (rc)
2465                         return rc;
2466         }
2467         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2468                 /*
2469                  * We are making executable a file mapping that has
2470                  * had some COW done. Since pages might have been written,
2471                  * check ability to execute the possibly modified content.
2472                  * This typically should only occur for text relocations.
2473                  */
2474                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2475                 if (rc)
2476                         return rc;
2477         }
2478         if (!vma->vm_file && (prot & PROT_EXEC) &&
2479                 vma->vm_start <= vma->vm_mm->start_stack &&
2480                 vma->vm_end >= vma->vm_mm->start_stack) {
2481                 /* Attempt to make the process stack executable.
2482                  * This has an additional execstack check.
2483                  */
2484                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2485                 if (rc)
2486                         return rc;
2487         }
2488 #endif
2489
2490         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2491 }
2492
2493 static int selinux_file_lock(struct file *file, unsigned int cmd)
2494 {
2495         return file_has_perm(current, file, FILE__LOCK);
2496 }
2497
2498 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2499                               unsigned long arg)
2500 {
2501         int err = 0;
2502
2503         switch (cmd) {
2504                 case F_SETFL:
2505                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2506                                 err = -EINVAL;
2507                                 break;
2508                         }
2509
2510                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2511                                 err = file_has_perm(current, file,FILE__WRITE);
2512                                 break;
2513                         }
2514                         /* fall through */
2515                 case F_SETOWN:
2516                 case F_SETSIG:
2517                 case F_GETFL:
2518                 case F_GETOWN:
2519                 case F_GETSIG:
2520                         /* Just check FD__USE permission */
2521                         err = file_has_perm(current, file, 0);
2522                         break;
2523                 case F_GETLK:
2524                 case F_SETLK:
2525                 case F_SETLKW:
2526 #if BITS_PER_LONG == 32
2527                 case F_GETLK64:
2528                 case F_SETLK64:
2529                 case F_SETLKW64:
2530 #endif
2531                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2532                                 err = -EINVAL;
2533                                 break;
2534                         }
2535                         err = file_has_perm(current, file, FILE__LOCK);
2536                         break;
2537         }
2538
2539         return err;
2540 }
2541
2542 static int selinux_file_set_fowner(struct file *file)
2543 {
2544         struct task_security_struct *tsec;
2545         struct file_security_struct *fsec;
2546
2547         tsec = current->security;
2548         fsec = file->f_security;
2549         fsec->fown_sid = tsec->sid;
2550
2551         return 0;
2552 }
2553
2554 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2555                                        struct fown_struct *fown, int signum)
2556 {
2557         struct file *file;
2558         u32 perm;
2559         struct task_security_struct *tsec;
2560         struct file_security_struct *fsec;
2561
2562         /* struct fown_struct is never outside the context of a struct file */
2563         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2564
2565         tsec = tsk->security;
2566         fsec = file->f_security;
2567
2568         if (!signum)
2569                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2570         else
2571                 perm = signal_to_av(signum);
2572
2573         return avc_has_perm(fsec->fown_sid, tsec->sid,
2574                             SECCLASS_PROCESS, perm, NULL);
2575 }
2576
2577 static int selinux_file_receive(struct file *file)
2578 {
2579         return file_has_perm(current, file, file_to_av(file));
2580 }
2581
2582 /* task security operations */
2583
2584 static int selinux_task_create(unsigned long clone_flags)
2585 {
2586         int rc;
2587
2588         rc = secondary_ops->task_create(clone_flags);
2589         if (rc)
2590                 return rc;
2591
2592         return task_has_perm(current, current, PROCESS__FORK);
2593 }
2594
2595 static int selinux_task_alloc_security(struct task_struct *tsk)
2596 {
2597         struct task_security_struct *tsec1, *tsec2;
2598         int rc;
2599
2600         tsec1 = current->security;
2601
2602         rc = task_alloc_security(tsk);
2603         if (rc)
2604                 return rc;
2605         tsec2 = tsk->security;
2606
2607         tsec2->osid = tsec1->osid;
2608         tsec2->sid = tsec1->sid;
2609
2610         /* Retain the exec and create SIDs across fork */
2611         tsec2->exec_sid = tsec1->exec_sid;
2612         tsec2->create_sid = tsec1->create_sid;
2613
2614         /* Retain ptracer SID across fork, if any.
2615            This will be reset by the ptrace hook upon any
2616            subsequent ptrace_attach operations. */
2617         tsec2->ptrace_sid = tsec1->ptrace_sid;
2618
2619         return 0;
2620 }
2621
2622 static void selinux_task_free_security(struct task_struct *tsk)
2623 {
2624         task_free_security(tsk);
2625 }
2626
2627 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2628 {
2629         /* Since setuid only affects the current process, and
2630            since the SELinux controls are not based on the Linux
2631            identity attributes, SELinux does not need to control
2632            this operation.  However, SELinux does control the use
2633            of the CAP_SETUID and CAP_SETGID capabilities using the
2634            capable hook. */
2635         return 0;
2636 }
2637
2638 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2639 {
2640         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2641 }
2642
2643 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2644 {
2645         /* See the comment for setuid above. */
2646         return 0;
2647 }
2648
2649 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2650 {
2651         return task_has_perm(current, p, PROCESS__SETPGID);
2652 }
2653
2654 static int selinux_task_getpgid(struct task_struct *p)
2655 {
2656         return task_has_perm(current, p, PROCESS__GETPGID);
2657 }
2658
2659 static int selinux_task_getsid(struct task_struct *p)
2660 {
2661         return task_has_perm(current, p, PROCESS__GETSESSION);
2662 }
2663
2664 static int selinux_task_setgroups(struct group_info *group_info)
2665 {
2666         /* See the comment for setuid above. */
2667         return 0;
2668 }
2669
2670 static int selinux_task_setnice(struct task_struct *p, int nice)
2671 {
2672         int rc;
2673
2674         rc = secondary_ops->task_setnice(p, nice);
2675         if (rc)
2676                 return rc;
2677
2678         return task_has_perm(current,p, PROCESS__SETSCHED);
2679 }
2680
2681 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2682 {
2683         struct rlimit *old_rlim = current->signal->rlim + resource;
2684         int rc;
2685
2686         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2687         if (rc)
2688                 return rc;
2689
2690         /* Control the ability to change the hard limit (whether
2691            lowering or raising it), so that the hard limit can
2692            later be used as a safe reset point for the soft limit
2693            upon context transitions. See selinux_bprm_apply_creds. */
2694         if (old_rlim->rlim_max != new_rlim->rlim_max)
2695                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2696
2697         return 0;
2698 }
2699
2700 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2701 {
2702         return task_has_perm(current, p, PROCESS__SETSCHED);
2703 }
2704
2705 static int selinux_task_getscheduler(struct task_struct *p)
2706 {
2707         return task_has_perm(current, p, PROCESS__GETSCHED);
2708 }
2709
2710 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2711 {
2712         u32 perm;
2713         int rc;
2714
2715         rc = secondary_ops->task_kill(p, info, sig);
2716         if (rc)
2717                 return rc;
2718
2719         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2720                 return 0;
2721
2722         if (!sig)
2723                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2724         else
2725                 perm = signal_to_av(sig);
2726
2727         return task_has_perm(current, p, perm);
2728 }
2729
2730 static int selinux_task_prctl(int option,
2731                               unsigned long arg2,
2732                               unsigned long arg3,
2733                               unsigned long arg4,
2734                               unsigned long arg5)
2735 {
2736         /* The current prctl operations do not appear to require
2737            any SELinux controls since they merely observe or modify
2738            the state of the current process. */
2739         return 0;
2740 }
2741
2742 static int selinux_task_wait(struct task_struct *p)
2743 {
2744         u32 perm;
2745
2746         perm = signal_to_av(p->exit_signal);
2747
2748         return task_has_perm(p, current, perm);
2749 }
2750
2751 static void selinux_task_reparent_to_init(struct task_struct *p)
2752 {
2753         struct task_security_struct *tsec;
2754
2755         secondary_ops->task_reparent_to_init(p);
2756
2757         tsec = p->security;
2758         tsec->osid = tsec->sid;
2759         tsec->sid = SECINITSID_KERNEL;
2760         return;
2761 }
2762
2763 static void selinux_task_to_inode(struct task_struct *p,
2764                                   struct inode *inode)
2765 {
2766         struct task_security_struct *tsec = p->security;
2767         struct inode_security_struct *isec = inode->i_security;
2768
2769         isec->sid = tsec->sid;
2770         isec->initialized = 1;
2771         return;
2772 }
2773
2774 #ifdef CONFIG_SECURITY_NETWORK
2775
2776 /* Returns error only if unable to parse addresses */
2777 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2778 {
2779         int offset, ihlen, ret = -EINVAL;
2780         struct iphdr _iph, *ih;
2781
2782         offset = skb->nh.raw - skb->data;
2783         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2784         if (ih == NULL)
2785                 goto out;
2786
2787         ihlen = ih->ihl * 4;
2788         if (ihlen < sizeof(_iph))
2789                 goto out;
2790
2791         ad->u.net.v4info.saddr = ih->saddr;
2792         ad->u.net.v4info.daddr = ih->daddr;
2793         ret = 0;
2794
2795         switch (ih->protocol) {
2796         case IPPROTO_TCP: {
2797                 struct tcphdr _tcph, *th;
2798
2799                 if (ntohs(ih->frag_off) & IP_OFFSET)
2800                         break;
2801
2802                 offset += ihlen;
2803                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2804                 if (th == NULL)
2805                         break;
2806
2807                 ad->u.net.sport = th->source;
2808                 ad->u.net.dport = th->dest;
2809                 break;
2810         }
2811
2812         case IPPROTO_UDP: {
2813                 struct udphdr _udph, *uh;
2814
2815                 if (ntohs(ih->frag_off) & IP_OFFSET)
2816                         break;
2817
2818                 offset += ihlen;
2819                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2820                 if (uh == NULL)
2821                         break;
2822
2823                 ad->u.net.sport = uh->source;
2824                 ad->u.net.dport = uh->dest;
2825                 break;
2826         }
2827
2828         default:
2829                 break;
2830         }
2831 out:
2832         return ret;
2833 }
2834
2835 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2836
2837 /* Returns error only if unable to parse addresses */
2838 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2839 {
2840         u8 nexthdr;
2841         int ret = -EINVAL, offset;
2842         struct ipv6hdr _ipv6h, *ip6;
2843
2844         offset = skb->nh.raw - skb->data;
2845         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2846         if (ip6 == NULL)
2847                 goto out;
2848
2849         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2850         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2851         ret = 0;
2852
2853         nexthdr = ip6->nexthdr;
2854         offset += sizeof(_ipv6h);
2855         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2856         if (offset < 0)
2857                 goto out;
2858
2859         switch (nexthdr) {
2860         case IPPROTO_TCP: {
2861                 struct tcphdr _tcph, *th;
2862
2863                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2864                 if (th == NULL)
2865                         break;
2866
2867                 ad->u.net.sport = th->source;
2868                 ad->u.net.dport = th->dest;
2869                 break;
2870         }
2871
2872         case IPPROTO_UDP: {
2873                 struct udphdr _udph, *uh;
2874
2875                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2876                 if (uh == NULL)
2877                         break;
2878
2879                 ad->u.net.sport = uh->source;
2880                 ad->u.net.dport = uh->dest;
2881                 break;
2882         }
2883
2884         /* includes fragments */
2885         default:
2886                 break;
2887         }
2888 out:
2889         return ret;
2890 }
2891
2892 #endif /* IPV6 */
2893
2894 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2895                              char **addrp, int *len, int src)
2896 {
2897         int ret = 0;
2898
2899         switch (ad->u.net.family) {
2900         case PF_INET:
2901                 ret = selinux_parse_skb_ipv4(skb, ad);
2902                 if (ret || !addrp)
2903                         break;
2904                 *len = 4;
2905                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2906                                         &ad->u.net.v4info.daddr);
2907                 break;
2908
2909 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2910         case PF_INET6:
2911                 ret = selinux_parse_skb_ipv6(skb, ad);
2912                 if (ret || !addrp)
2913                         break;
2914                 *len = 16;
2915                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2916                                         &ad->u.net.v6info.daddr);
2917                 break;
2918 #endif  /* IPV6 */
2919         default:
2920                 break;
2921         }
2922
2923         return ret;
2924 }
2925
2926 /* socket security operations */
2927 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2928                            u32 perms)
2929 {
2930         struct inode_security_struct *isec;
2931         struct task_security_struct *tsec;
2932         struct avc_audit_data ad;
2933         int err = 0;
2934
2935         tsec = task->security;
2936         isec = SOCK_INODE(sock)->i_security;
2937
2938         if (isec->sid == SECINITSID_KERNEL)
2939                 goto out;
2940
2941         AVC_AUDIT_DATA_INIT(&ad,NET);
2942         ad.u.net.sk = sock->sk;
2943         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2944
2945 out:
2946         return err;
2947 }
2948
2949 static int selinux_socket_create(int family, int type,
2950                                  int protocol, int kern)
2951 {
2952         int err = 0;
2953         struct task_security_struct *tsec;
2954
2955         if (kern)
2956                 goto out;
2957
2958         tsec = current->security;
2959         err = avc_has_perm(tsec->sid, tsec->sid,
2960                            socket_type_to_security_class(family, type,
2961                            protocol), SOCKET__CREATE, NULL);
2962
2963 out:
2964         return err;
2965 }
2966
2967 static void selinux_socket_post_create(struct socket *sock, int family,
2968                                        int type, int protocol, int kern)
2969 {
2970         struct inode_security_struct *isec;
2971         struct task_security_struct *tsec;
2972
2973         isec = SOCK_INODE(sock)->i_security;
2974
2975         tsec = current->security;
2976         isec->sclass = socket_type_to_security_class(family, type, protocol);
2977         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2978         isec->initialized = 1;
2979
2980         return;
2981 }
2982
2983 /* Range of port numbers used to automatically bind.
2984    Need to determine whether we should perform a name_bind
2985    permission check between the socket and the port number. */
2986 #define ip_local_port_range_0 sysctl_local_port_range[0]
2987 #define ip_local_port_range_1 sysctl_local_port_range[1]
2988
2989 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2990 {
2991         u16 family;
2992         int err;
2993
2994         err = socket_has_perm(current, sock, SOCKET__BIND);
2995         if (err)
2996                 goto out;
2997
2998         /*
2999          * If PF_INET or PF_INET6, check name_bind permission for the port.
3000          * Multiple address binding for SCTP is not supported yet: we just
3001          * check the first address now.
3002          */
3003         family = sock->sk->sk_family;
3004         if (family == PF_INET || family == PF_INET6) {
3005                 char *addrp;
3006                 struct inode_security_struct *isec;
3007                 struct task_security_struct *tsec;
3008                 struct avc_audit_data ad;
3009                 struct sockaddr_in *addr4 = NULL;
3010                 struct sockaddr_in6 *addr6 = NULL;
3011                 unsigned short snum;
3012                 struct sock *sk = sock->sk;
3013                 u32 sid, node_perm, addrlen;
3014
3015                 tsec = current->security;
3016                 isec = SOCK_INODE(sock)->i_security;
3017
3018                 if (family == PF_INET) {
3019                         addr4 = (struct sockaddr_in *)address;
3020                         snum = ntohs(addr4->sin_port);
3021                         addrlen = sizeof(addr4->sin_addr.s_addr);
3022                         addrp = (char *)&addr4->sin_addr.s_addr;
3023                 } else {
3024                         addr6 = (struct sockaddr_in6 *)address;
3025                         snum = ntohs(addr6->sin6_port);
3026                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3027                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3028                 }
3029
3030                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3031                            snum > ip_local_port_range_1)) {
3032                         err = security_port_sid(sk->sk_family, sk->sk_type,
3033                                                 sk->sk_protocol, snum, &sid);
3034                         if (err)
3035                                 goto out;
3036                         AVC_AUDIT_DATA_INIT(&ad,NET);
3037                         ad.u.net.sport = htons(snum);
3038                         ad.u.net.family = family;
3039                         err = avc_has_perm(isec->sid, sid,
3040                                            isec->sclass,
3041                                            SOCKET__NAME_BIND, &ad);
3042                         if (err)
3043                                 goto out;
3044                 }
3045
3046                 switch(isec->sclass) {
3047                 case SECCLASS_TCP_SOCKET:
3048                         node_perm = TCP_SOCKET__NODE_BIND;
3049                         break;
3050
3051                 case SECCLASS_UDP_SOCKET:
3052                         node_perm = UDP_SOCKET__NODE_BIND;
3053                         break;
3054
3055                 default:
3056                         node_perm = RAWIP_SOCKET__NODE_BIND;
3057                         break;
3058                 }
3059
3060                 err = security_node_sid(family, addrp, addrlen, &sid);
3061                 if (err)
3062                         goto out;
3063
3064                 AVC_AUDIT_DATA_INIT(&ad,NET);
3065                 ad.u.net.sport = htons(snum);
3066                 ad.u.net.family = family;
3067
3068                 if (family == PF_INET)
3069                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3070                 else
3071                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3072
3073                 err = avc_has_perm(isec->sid, sid,
3074                                    isec->sclass, node_perm, &ad);
3075                 if (err)
3076                         goto out;
3077         }
3078 out:
3079         return err;
3080 }
3081
3082 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3083 {
3084         struct inode_security_struct *isec;
3085         int err;
3086
3087         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3088         if (err)
3089                 return err;
3090
3091         /*
3092          * If a TCP socket, check name_connect permission for the port.
3093          */
3094         isec = SOCK_INODE(sock)->i_security;
3095         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3096                 struct sock *sk = sock->sk;
3097                 struct avc_audit_data ad;
3098                 struct sockaddr_in *addr4 = NULL;
3099                 struct sockaddr_in6 *addr6 = NULL;
3100                 unsigned short snum;
3101                 u32 sid;
3102
3103                 if (sk->sk_family == PF_INET) {
3104                         addr4 = (struct sockaddr_in *)address;
3105                         if (addrlen < sizeof(struct sockaddr_in))
3106                                 return -EINVAL;
3107                         snum = ntohs(addr4->sin_port);
3108                 } else {
3109                         addr6 = (struct sockaddr_in6 *)address;
3110                         if (addrlen < SIN6_LEN_RFC2133)
3111                                 return -EINVAL;
3112                         snum = ntohs(addr6->sin6_port);
3113                 }
3114
3115                 err = security_port_sid(sk->sk_family, sk->sk_type,
3116                                         sk->sk_protocol, snum, &sid);
3117                 if (err)
3118                         goto out;
3119
3120                 AVC_AUDIT_DATA_INIT(&ad,NET);
3121                 ad.u.net.dport = htons(snum);
3122                 ad.u.net.family = sk->sk_family;
3123                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3124                                    TCP_SOCKET__NAME_CONNECT, &ad);
3125                 if (err)
3126                         goto out;
3127         }
3128
3129 out:
3130         return err;
3131 }
3132
3133 static int selinux_socket_listen(struct socket *sock, int backlog)
3134 {
3135         return socket_has_perm(current, sock, SOCKET__LISTEN);
3136 }
3137
3138 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3139 {
3140         int err;
3141         struct inode_security_struct *isec;
3142         struct inode_security_struct *newisec;
3143
3144         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3145         if (err)
3146                 return err;
3147
3148         newisec = SOCK_INODE(newsock)->i_security;
3149
3150         isec = SOCK_INODE(sock)->i_security;
3151         newisec->sclass = isec->sclass;
3152         newisec->sid = isec->sid;
3153         newisec->initialized = 1;
3154
3155         return 0;
3156 }
3157
3158 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3159                                   int size)
3160 {
3161         return socket_has_perm(current, sock, SOCKET__WRITE);
3162 }
3163
3164 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3165                                   int size, int flags)
3166 {
3167         return socket_has_perm(current, sock, SOCKET__READ);
3168 }
3169
3170 static int selinux_socket_getsockname(struct socket *sock)
3171 {
3172         return socket_has_perm(current, sock, SOCKET__GETATTR);
3173 }
3174
3175 static int selinux_socket_getpeername(struct socket *sock)
3176 {
3177         return socket_has_perm(current, sock, SOCKET__GETATTR);
3178 }
3179
3180 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3181 {
3182         return socket_has_perm(current, sock, SOCKET__SETOPT);
3183 }
3184
3185 static int selinux_socket_getsockopt(struct socket *sock, int level,
3186                                      int optname)
3187 {
3188         return socket_has_perm(current, sock, SOCKET__GETOPT);
3189 }
3190
3191 static int selinux_socket_shutdown(struct socket *sock, int how)
3192 {
3193         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3194 }
3195
3196 static int selinux_socket_unix_stream_connect(struct socket *sock,
3197                                               struct socket *other,
3198                                               struct sock *newsk)
3199 {
3200         struct sk_security_struct *ssec;
3201         struct inode_security_struct *isec;
3202         struct inode_security_struct *other_isec;
3203         struct avc_audit_data ad;
3204         int err;
3205
3206         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3207         if (err)
3208                 return err;
3209
3210         isec = SOCK_INODE(sock)->i_security;
3211         other_isec = SOCK_INODE(other)->i_security;
3212
3213         AVC_AUDIT_DATA_INIT(&ad,NET);
3214         ad.u.net.sk = other->sk;
3215
3216         err = avc_has_perm(isec->sid, other_isec->sid,
3217                            isec->sclass,
3218                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3219         if (err)
3220                 return err;
3221
3222         /* connecting socket */
3223         ssec = sock->sk->sk_security;
3224         ssec->peer_sid = other_isec->sid;
3225
3226         /* server child socket */
3227         ssec = newsk->sk_security;
3228         ssec->peer_sid = isec->sid;
3229
3230         return 0;
3231 }
3232
3233 static int selinux_socket_unix_may_send(struct socket *sock,
3234                                         struct socket *other)
3235 {
3236         struct inode_security_struct *isec;
3237         struct inode_security_struct *other_isec;
3238         struct avc_audit_data ad;
3239         int err;
3240
3241         isec = SOCK_INODE(sock)->i_security;
3242         other_isec = SOCK_INODE(other)->i_security;
3243
3244         AVC_AUDIT_DATA_INIT(&ad,NET);
3245         ad.u.net.sk = other->sk;
3246
3247         err = avc_has_perm(isec->sid, other_isec->sid,
3248                            isec->sclass, SOCKET__SENDTO, &ad);
3249         if (err)
3250                 return err;
3251
3252         return 0;
3253 }
3254
3255 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3256 {
3257         u16 family;
3258         char *addrp;
3259         int len, err = 0;
3260         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3261         u32 sock_sid = 0;
3262         u16 sock_class = 0;
3263         struct socket *sock;
3264         struct net_device *dev;
3265         struct avc_audit_data ad;
3266
3267         family = sk->sk_family;
3268         if (family != PF_INET && family != PF_INET6)
3269                 goto out;
3270
3271         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3272         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3273                 family = PF_INET;
3274
3275         read_lock_bh(&sk->sk_callback_lock);
3276         sock = sk->sk_socket;
3277         if (sock) {
3278                 struct inode *inode;
3279                 inode = SOCK_INODE(sock);
3280                 if (inode) {
3281                         struct inode_security_struct *isec;
3282                         isec = inode->i_security;
3283                         sock_sid = isec->sid;
3284                         sock_class = isec->sclass;
3285                 }
3286         }
3287         read_unlock_bh(&sk->sk_callback_lock);
3288         if (!sock_sid)
3289                 goto out;
3290
3291         dev = skb->dev;
3292         if (!dev)
3293                 goto out;
3294
3295         err = sel_netif_sids(dev, &if_sid, NULL);
3296         if (err)
3297                 goto out;
3298
3299         switch (sock_class) {
3300         case SECCLASS_UDP_SOCKET:
3301                 netif_perm = NETIF__UDP_RECV;
3302                 node_perm = NODE__UDP_RECV;
3303                 recv_perm = UDP_SOCKET__RECV_MSG;
3304                 break;
3305
3306         case SECCLASS_TCP_SOCKET:
3307                 netif_perm = NETIF__TCP_RECV;
3308                 node_perm = NODE__TCP_RECV;
3309                 recv_perm = TCP_SOCKET__RECV_MSG;
3310                 break;
3311
3312         default:
3313                 netif_perm = NETIF__RAWIP_RECV;
3314                 node_perm = NODE__RAWIP_RECV;
3315                 break;
3316         }
3317
3318         AVC_AUDIT_DATA_INIT(&ad, NET);
3319         ad.u.net.netif = dev->name;
3320         ad.u.net.family = family;
3321
3322         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3323         if (err)
3324                 goto out;
3325
3326         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3327         if (err)
3328                 goto out;
3329
3330         /* Fixme: this lookup is inefficient */
3331         err = security_node_sid(family, addrp, len, &node_sid);
3332         if (err)
3333                 goto out;
3334
3335         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3336         if (err)
3337                 goto out;
3338
3339         if (recv_perm) {
3340                 u32 port_sid;
3341
3342                 /* Fixme: make this more efficient */
3343                 err = security_port_sid(sk->sk_family, sk->sk_type,
3344                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3345                                         &port_sid);
3346                 if (err)
3347                         goto out;
3348
3349                 err = avc_has_perm(sock_sid, port_sid,
3350                                    sock_class, recv_perm, &ad);
3351         }
3352 out:
3353         return err;
3354 }
3355
3356 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3357                                      int __user *optlen, unsigned len)
3358 {
3359         int err = 0;
3360         char *scontext;
3361         u32 scontext_len;
3362         struct sk_security_struct *ssec;
3363         struct inode_security_struct *isec;
3364
3365         isec = SOCK_INODE(sock)->i_security;
3366         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3367                 err = -ENOPROTOOPT;
3368                 goto out;
3369         }
3370
3371         ssec = sock->sk->sk_security;
3372
3373         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3374         if (err)
3375                 goto out;
3376
3377         if (scontext_len > len) {
3378                 err = -ERANGE;
3379                 goto out_len;
3380         }
3381
3382         if (copy_to_user(optval, scontext, scontext_len))
3383                 err = -EFAULT;
3384
3385 out_len:
3386         if (put_user(scontext_len, optlen))
3387                 err = -EFAULT;
3388
3389         kfree(scontext);
3390 out:
3391         return err;
3392 }
3393
3394 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3395 {
3396         return sk_alloc_security(sk, family, priority);
3397 }
3398
3399 static void selinux_sk_free_security(struct sock *sk)
3400 {
3401         sk_free_security(sk);
3402 }
3403
3404 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3405 {
3406         int err = 0;
3407         u32 perm;
3408         struct nlmsghdr *nlh;
3409         struct socket *sock = sk->sk_socket;
3410         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3411
3412         if (skb->len < NLMSG_SPACE(0)) {
3413                 err = -EINVAL;
3414                 goto out;
3415         }
3416         nlh = (struct nlmsghdr *)skb->data;
3417
3418         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3419         if (err) {
3420                 if (err == -EINVAL) {
3421                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3422                                   "SELinux:  unrecognized netlink message"
3423                                   " type=%hu for sclass=%hu\n",
3424                                   nlh->nlmsg_type, isec->sclass);
3425                         if (!selinux_enforcing)
3426                                 err = 0;
3427                 }
3428
3429                 /* Ignore */
3430                 if (err == -ENOENT)
3431                         err = 0;
3432                 goto out;
3433         }
3434
3435         err = socket_has_perm(current, sock, perm);
3436 out:
3437         return err;
3438 }
3439
3440 #ifdef CONFIG_NETFILTER
3441
3442 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3443                                               struct sk_buff **pskb,
3444                                               const struct net_device *in,
3445                                               const struct net_device *out,
3446                                               int (*okfn)(struct sk_buff *),
3447                                               u16 family)
3448 {
3449         char *addrp;
3450         int len, err = NF_ACCEPT;
3451         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3452         struct sock *sk;
3453         struct socket *sock;
3454         struct inode *inode;
3455         struct sk_buff *skb = *pskb;
3456         struct inode_security_struct *isec;
3457         struct avc_audit_data ad;
3458         struct net_device *dev = (struct net_device *)out;
3459
3460         sk = skb->sk;
3461         if (!sk)
3462                 goto out;
3463
3464         sock = sk->sk_socket;
3465         if (!sock)
3466                 goto out;
3467
3468         inode = SOCK_INODE(sock);
3469         if (!inode)
3470                 goto out;
3471
3472         err = sel_netif_sids(dev, &if_sid, NULL);
3473         if (err)
3474                 goto out;
3475
3476         isec = inode->i_security;
3477
3478         switch (isec->sclass) {
3479         case SECCLASS_UDP_SOCKET:
3480                 netif_perm = NETIF__UDP_SEND;
3481                 node_perm = NODE__UDP_SEND;
3482                 send_perm = UDP_SOCKET__SEND_MSG;
3483                 break;
3484
3485         case SECCLASS_TCP_SOCKET:
3486                 netif_perm = NETIF__TCP_SEND;
3487                 node_perm = NODE__TCP_SEND;
3488                 send_perm = TCP_SOCKET__SEND_MSG;
3489                 break;
3490
3491         default:
3492                 netif_perm = NETIF__RAWIP_SEND;
3493                 node_perm = NODE__RAWIP_SEND;
3494                 break;
3495         }
3496
3497
3498         AVC_AUDIT_DATA_INIT(&ad, NET);
3499         ad.u.net.netif = dev->name;
3500         ad.u.net.family = family;
3501
3502         err = selinux_parse_skb(skb, &ad, &addrp,
3503                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3504         if (err != NF_ACCEPT)
3505                 goto out;
3506
3507         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3508                            netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3509         if (err != NF_ACCEPT)
3510                 goto out;
3511
3512         /* Fixme: this lookup is inefficient */
3513         err = security_node_sid(family, addrp, len,
3514                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3515         if (err != NF_ACCEPT)
3516                 goto out;
3517
3518         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3519                            node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3520         if (err != NF_ACCEPT)
3521                 goto out;
3522
3523         if (send_perm) {
3524                 u32 port_sid;
3525
3526                 /* Fixme: make this more efficient */
3527                 err = security_port_sid(sk->sk_family,
3528                                         sk->sk_type,
3529                                         sk->sk_protocol,
3530                                         ntohs(ad.u.net.dport),
3531                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3532                 if (err != NF_ACCEPT)
3533                         goto out;
3534
3535                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3536                                    send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3537         }
3538
3539 out:
3540         return err;
3541 }
3542
3543 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3544                                                 struct sk_buff **pskb,
3545                                                 const struct net_device *in,
3546                                                 const struct net_device *out,
3547                                                 int (*okfn)(struct sk_buff *))
3548 {
3549         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3550 }
3551
3552 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3553
3554 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3555                                                 struct sk_buff **pskb,
3556                                                 const struct net_device *in,
3557                                                 const struct net_device *out,
3558                                                 int (*okfn)(struct sk_buff *))
3559 {
3560         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3561 }
3562
3563 #endif  /* IPV6 */
3564
3565 #endif  /* CONFIG_NETFILTER */
3566
3567 #else
3568
3569 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3570 {
3571         return 0;
3572 }
3573
3574 #endif  /* CONFIG_SECURITY_NETWORK */
3575
3576 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3577 {
3578         struct task_security_struct *tsec;
3579         struct av_decision avd;
3580         int err;
3581
3582         err = secondary_ops->netlink_send(sk, skb);
3583         if (err)
3584                 return err;
3585
3586         tsec = current->security;
3587
3588         avd.allowed = 0;
3589         avc_has_perm_noaudit(tsec->sid, tsec->sid,
3590                                 SECCLASS_CAPABILITY, ~0, &avd);
3591         cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3592
3593         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3594                 err = selinux_nlmsg_perm(sk, skb);
3595
3596         return err;
3597 }
3598
3599 static int selinux_netlink_recv(struct sk_buff *skb)
3600 {
3601         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3602                 return -EPERM;
3603         return 0;
3604 }
3605
3606 static int ipc_alloc_security(struct task_struct *task,
3607                               struct kern_ipc_perm *perm,
3608                               u16 sclass)
3609 {
3610         struct task_security_struct *tsec = task->security;
3611         struct ipc_security_struct *isec;
3612
3613         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3614         if (!isec)
3615                 return -ENOMEM;
3616
3617         isec->magic = SELINUX_MAGIC;
3618         isec->sclass = sclass;
3619         isec->ipc_perm = perm;
3620         if (tsec) {
3621                 isec->sid = tsec->sid;
3622         } else {
3623                 isec->sid = SECINITSID_UNLABELED;
3624         }
3625         perm->security = isec;
3626
3627         return 0;
3628 }
3629
3630 static void ipc_free_security(struct kern_ipc_perm *perm)
3631 {
3632         struct ipc_security_struct *isec = perm->security;
3633         if (!isec || isec->magic != SELINUX_MAGIC)
3634                 return;
3635
3636         perm->security = NULL;
3637         kfree(isec);
3638 }
3639
3640 static int msg_msg_alloc_security(struct msg_msg *msg)
3641 {
3642         struct msg_security_struct *msec;
3643
3644         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3645         if (!msec)
3646                 return -ENOMEM;
3647
3648         msec->magic = SELINUX_MAGIC;
3649         msec->msg = msg;
3650         msec->sid = SECINITSID_UNLABELED;
3651         msg->security = msec;
3652
3653         return 0;
3654 }
3655
3656 static void msg_msg_free_security(struct msg_msg *msg)
3657 {
3658         struct msg_security_struct *msec = msg->security;
3659         if (!msec || msec->magic != SELINUX_MAGIC)
3660                 return;
3661
3662         msg->security = NULL;
3663         kfree(msec);
3664 }
3665
3666 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3667                         u32 perms)
3668 {
3669         struct task_security_struct *tsec;
3670         struct ipc_security_struct *isec;
3671         struct avc_audit_data ad;
3672
3673         tsec = current->security;
3674         isec = ipc_perms->security;
3675
3676         AVC_AUDIT_DATA_INIT(&ad, IPC);
3677         ad.u.ipc_id = ipc_perms->key;
3678
3679         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3680 }
3681
3682 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3683 {
3684         return msg_msg_alloc_security(msg);
3685 }
3686
3687 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3688 {
3689         msg_msg_free_security(msg);
3690 }
3691
3692 /* message queue security operations */
3693 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3694 {
3695         struct task_security_struct *tsec;
3696         struct ipc_security_struct *isec;
3697         struct avc_audit_data ad;
3698         int rc;
3699
3700         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3701         if (rc)
3702                 return rc;
3703
3704         tsec = current->security;
3705         isec = msq->q_perm.security;
3706
3707         AVC_AUDIT_DATA_INIT(&ad, IPC);
3708         ad.u.ipc_id = msq->q_perm.key;
3709
3710         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3711                           MSGQ__CREATE, &ad);
3712         if (rc) {
3713                 ipc_free_security(&msq->q_perm);
3714                 return rc;
3715         }
3716         return 0;
3717 }
3718
3719 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3720 {
3721         ipc_free_security(&msq->q_perm);
3722 }
3723
3724 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3725 {
3726         struct task_security_struct *tsec;
3727         struct ipc_security_struct *isec;
3728         struct avc_audit_data ad;
3729
3730         tsec = current->security;
3731         isec = msq->q_perm.security;
3732
3733         AVC_AUDIT_DATA_INIT(&ad, IPC);
3734         ad.u.ipc_id = msq->q_perm.key;
3735
3736         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3737                             MSGQ__ASSOCIATE, &ad);
3738 }
3739
3740 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3741 {
3742         int err;
3743         int perms;
3744
3745         switch(cmd) {
3746         case IPC_INFO:
3747         case MSG_INFO:
3748                 /* No specific object, just general system-wide information. */
3749                 return task_has_system(current, SYSTEM__IPC_INFO);
3750         case IPC_STAT:
3751         case MSG_STAT:
3752                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3753                 break;
3754         case IPC_SET:
3755                 perms = MSGQ__SETATTR;
3756                 break;
3757         case IPC_RMID:
3758                 perms = MSGQ__DESTROY;
3759                 break;
3760         default:
3761                 return 0;
3762         }
3763
3764         err = ipc_has_perm(&msq->q_perm, perms);
3765         return err;
3766 }
3767
3768 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3769 {
3770         struct task_security_struct *tsec;
3771         struct ipc_security_struct *isec;
3772         struct msg_security_struct *msec;
3773         struct avc_audit_data ad;
3774         int rc;
3775
3776         tsec = current->security;
3777         isec = msq->q_perm.security;
3778         msec = msg->security;
3779
3780         /*
3781          * First time through, need to assign label to the message
3782          */
3783         if (msec->sid == SECINITSID_UNLABELED) {
3784                 /*
3785                  * Compute new sid based on current process and
3786                  * message queue this message will be stored in
3787                  */
3788                 rc = security_transition_sid(tsec->sid,
3789                                              isec->sid,
3790                                              SECCLASS_MSG,
3791                                              &msec->sid);
3792                 if (rc)
3793                         return rc;
3794         }
3795
3796         AVC_AUDIT_DATA_INIT(&ad, IPC);
3797         ad.u.ipc_id = msq->q_perm.key;
3798
3799         /* Can this process write to the queue? */
3800         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3801                           MSGQ__WRITE, &ad);
3802         if (!rc)
3803                 /* Can this process send the message */
3804                 rc = avc_has_perm(tsec->sid, msec->sid,
3805                                   SECCLASS_MSG, MSG__SEND, &ad);
3806         if (!rc)
3807                 /* Can the message be put in the queue? */
3808                 rc = avc_has_perm(msec->sid, isec->sid,
3809                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3810
3811         return rc;
3812 }
3813
3814 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3815                                     struct task_struct *target,
3816                                     long type, int mode)
3817 {
3818         struct task_security_struct *tsec;
3819         struct ipc_security_struct *isec;
3820         struct msg_security_struct *msec;
3821         struct avc_audit_data ad;
3822         int rc;
3823
3824         tsec = target->security;
3825         isec = msq->q_perm.security;
3826         msec = msg->security;
3827
3828         AVC_AUDIT_DATA_INIT(&ad, IPC);
3829         ad.u.ipc_id = msq->q_perm.key;
3830
3831         rc = avc_has_perm(tsec->sid, isec->sid,
3832                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3833         if (!rc)
3834                 rc = avc_has_perm(tsec->sid, msec->sid,
3835                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3836         return rc;
3837 }
3838
3839 /* Shared Memory security operations */
3840 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3841 {
3842         struct task_security_struct *tsec;
3843         struct ipc_security_struct *isec;
3844         struct avc_audit_data ad;
3845         int rc;
3846
3847         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3848         if (rc)
3849                 return rc;
3850
3851         tsec = current->security;
3852         isec = shp->shm_perm.security;
3853
3854         AVC_AUDIT_DATA_INIT(&ad, IPC);
3855         ad.u.ipc_id = shp->shm_perm.key;
3856
3857         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3858                           SHM__CREATE, &ad);
3859         if (rc) {
3860                 ipc_free_security(&shp->shm_perm);
3861                 return rc;
3862         }
3863         return 0;
3864 }
3865
3866 static void selinux_shm_free_security(struct shmid_kernel *shp)
3867 {
3868         ipc_free_security(&shp->shm_perm);
3869 }
3870
3871 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3872 {
3873         struct task_security_struct *tsec;
3874         struct ipc_security_struct *isec;
3875         struct avc_audit_data ad;
3876
3877         tsec = current->security;
3878         isec = shp->shm_perm.security;
3879
3880         AVC_AUDIT_DATA_INIT(&ad, IPC);
3881         ad.u.ipc_id = shp->shm_perm.key;
3882
3883         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3884                             SHM__ASSOCIATE, &ad);
3885 }
3886
3887 /* Note, at this point, shp is locked down */
3888 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3889 {
3890         int perms;
3891         int err;
3892
3893         switch(cmd) {
3894         case IPC_INFO:
3895         case SHM_INFO:
3896                 /* No specific object, just general system-wide information. */
3897                 return task_has_system(current, SYSTEM__IPC_INFO);
3898         case IPC_STAT:
3899         case SHM_STAT:
3900                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3901                 break;
3902         case IPC_SET:
3903                 perms = SHM__SETATTR;
3904                 break;
3905         case SHM_LOCK:
3906         case SHM_UNLOCK:
3907                 perms = SHM__LOCK;
3908                 break;
3909         case IPC_RMID:
3910                 perms = SHM__DESTROY;
3911                 break;
3912         default:
3913                 return 0;
3914         }
3915
3916         err = ipc_has_perm(&shp->shm_perm, perms);
3917         return err;
3918 }
3919
3920 static int selinux_shm_shmat(struct shmid_kernel *shp,
3921                              char __user *shmaddr, int shmflg)
3922 {
3923         u32 perms;
3924         int rc;
3925
3926         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3927         if (rc)
3928                 return rc;
3929
3930         if (shmflg & SHM_RDONLY)
3931                 perms = SHM__READ;
3932         else
3933                 perms = SHM__READ | SHM__WRITE;
3934
3935         return ipc_has_perm(&shp->shm_perm, perms);
3936 }
3937
3938 /* Semaphore security operations */
3939 static int selinux_sem_alloc_security(struct sem_array *sma)
3940 {
3941         struct task_security_struct *tsec;
3942         struct ipc_security_struct *isec;
3943         struct avc_audit_data ad;
3944         int rc;
3945
3946         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3947         if (rc)
3948                 return rc;
3949
3950         tsec = current->security;
3951         isec = sma->sem_perm.security;
3952
3953         AVC_AUDIT_DATA_INIT(&ad, IPC);
3954         ad.u.ipc_id = sma->sem_perm.key;
3955
3956         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3957                           SEM__CREATE, &ad);
3958         if (rc) {
3959                 ipc_free_security(&sma->sem_perm);
3960                 return rc;
3961         }
3962         return 0;
3963 }
3964
3965 static void selinux_sem_free_security(struct sem_array *sma)
3966 {
3967         ipc_free_security(&sma->sem_perm);
3968 }
3969
3970 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3971 {
3972         struct task_security_struct *tsec;
3973         struct ipc_security_struct *isec;
3974         struct avc_audit_data ad;
3975
3976         tsec = current->security;
3977         isec = sma->sem_perm.security;
3978
3979         AVC_AUDIT_DATA_INIT(&ad, IPC);
3980         ad.u.ipc_id = sma->sem_perm.key;
3981
3982         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3983                             SEM__ASSOCIATE, &ad);
3984 }
3985
3986 /* Note, at this point, sma is locked down */
3987 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3988 {
3989         int err;
3990         u32 perms;
3991
3992         switch(cmd) {
3993         case IPC_INFO:
3994         case SEM_INFO:
3995                 /* No specific object, just general system-wide information. */
3996                 return task_has_system(current, SYSTEM__IPC_INFO);
3997         case GETPID:
3998         case GETNCNT:
3999         case GETZCNT:
4000                 perms = SEM__GETATTR;
4001                 break;
4002         case GETVAL:
4003         case GETALL:
4004                 perms = SEM__READ;
4005                 break;
4006         case SETVAL:
4007         case SETALL:
4008                 perms = SEM__WRITE;
4009                 break;
4010         case IPC_RMID:
4011                 perms = SEM__DESTROY;
4012                 break;
4013         case IPC_SET:
4014                 perms = SEM__SETATTR;
4015                 break;
4016         case IPC_STAT:
4017         case SEM_STAT:
4018                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4019                 break;
4020         default:
4021                 return 0;
4022         }
4023
4024         err = ipc_has_perm(&sma->sem_perm, perms);
4025         return err;
4026 }
4027
4028 static int selinux_sem_semop(struct sem_array *sma,
4029                              struct sembuf *sops, unsigned nsops, int alter)
4030 {
4031         u32 perms;
4032
4033         if (alter)
4034                 perms = SEM__READ | SEM__WRITE;
4035         else
4036                 perms = SEM__READ;
4037
4038         return ipc_has_perm(&sma->sem_perm, perms);
4039 }
4040
4041 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4042 {
4043         u32 av = 0;
4044
4045         av = 0;
4046         if (flag & S_IRUGO)
4047                 av |= IPC__UNIX_READ;
4048         if (flag & S_IWUGO)
4049                 av |= IPC__UNIX_WRITE;
4050
4051         if (av == 0)
4052                 return 0;
4053
4054         return ipc_has_perm(ipcp, av);
4055 }
4056
4057 /* module stacking operations */
4058 static int selinux_register_security (const char *name, struct security_operations *ops)
4059 {
4060         if (secondary_ops != original_ops) {
4061                 printk(KERN_INFO "%s:  There is already a secondary security "
4062                        "module registered.\n", __FUNCTION__);
4063                 return -EINVAL;
4064         }
4065
4066         secondary_ops = ops;
4067
4068         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4069                __FUNCTION__,
4070                name);
4071
4072         return 0;
4073 }
4074
4075 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4076 {
4077         if (ops != secondary_ops) {
4078                 printk (KERN_INFO "%s:  trying to unregister a security module "
4079                         "that is not registered.\n", __FUNCTION__);
4080                 return -EINVAL;
4081         }
4082
4083         secondary_ops = original_ops;
4084
4085         return 0;
4086 }
4087
4088 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4089 {
4090         if (inode)
4091                 inode_doinit_with_dentry(inode, dentry);
4092 }
4093
4094 static int selinux_getprocattr(struct task_struct *p,
4095                                char *name, void *value, size_t size)
4096 {
4097         struct task_security_struct *tsec;
4098         u32 sid, len;
4099         char *context;
4100         int error;
4101
4102         if (current != p) {
4103                 error = task_has_perm(current, p, PROCESS__GETATTR);
4104                 if (error)
4105                         return error;
4106         }
4107
4108         if (!size)
4109                 return -ERANGE;
4110
4111         tsec = p->security;
4112
4113         if (!strcmp(name, "current"))
4114                 sid = tsec->sid;
4115         else if (!strcmp(name, "prev"))
4116                 sid = tsec->osid;
4117         else if (!strcmp(name, "exec"))
4118                 sid = tsec->exec_sid;
4119         else if (!strcmp(name, "fscreate"))
4120                 sid = tsec->create_sid;
4121         else
4122                 return -EINVAL;
4123
4124         if (!sid)
4125                 return 0;
4126
4127         error = security_sid_to_context(sid, &context, &len);
4128         if (error)
4129                 return error;
4130         if (len > size) {
4131                 kfree(context);
4132                 return -ERANGE;
4133         }
4134         memcpy(value, context, len);
4135         kfree(context);
4136         return len;
4137 }
4138
4139 static int selinux_setprocattr(struct task_struct *p,
4140                                char *name, void *value, size_t size)
4141 {
4142         struct task_security_struct *tsec;
4143         u32 sid = 0;
4144         int error;
4145         char *str = value;
4146
4147         if (current != p) {
4148                 /* SELinux only allows a process to change its own
4149                    security attributes. */
4150                 return -EACCES;
4151         }
4152
4153         /*
4154          * Basic control over ability to set these attributes at all.
4155          * current == p, but we'll pass them separately in case the
4156          * above restriction is ever removed.
4157          */
4158         if (!strcmp(name, "exec"))
4159                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4160         else if (!strcmp(name, "fscreate"))
4161                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4162         else if (!strcmp(name, "current"))
4163                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4164         else
4165                 error = -EINVAL;
4166         if (error)
4167                 return error;
4168
4169         /* Obtain a SID for the context, if one was specified. */
4170         if (size && str[1] && str[1] != '\n') {
4171                 if (str[size-1] == '\n') {
4172                         str[size-1] = 0;
4173                         size--;
4174                 }
4175                 error = security_context_to_sid(value, size, &sid);
4176                 if (error)
4177                         return error;
4178         }
4179
4180         /* Permission checking based on the specified context is
4181            performed during the actual operation (execve,
4182            open/mkdir/...), when we know the full context of the
4183            operation.  See selinux_bprm_set_security for the execve
4184            checks and may_create for the file creation checks. The
4185            operation will then fail if the context is not permitted. */
4186         tsec = p->security;
4187         if (!strcmp(name, "exec"))
4188                 tsec->exec_sid = sid;
4189         else if (!strcmp(name, "fscreate"))
4190                 tsec->create_sid = sid;
4191         else if (!strcmp(name, "current")) {
4192                 struct av_decision avd;
4193
4194                 if (sid == 0)
4195                         return -EINVAL;
4196
4197                 /* Only allow single threaded processes to change context */
4198                 if (atomic_read(&p->mm->mm_users) != 1) {
4199                         struct task_struct *g, *t;
4200                         struct mm_struct *mm = p->mm;
4201                         read_lock(&tasklist_lock);
4202                         do_each_thread(g, t)
4203                                 if (t->mm == mm && t != p) {
4204                                         read_unlock(&tasklist_lock);
4205                                         return -EPERM;
4206                                 }
4207                         while_each_thread(g, t);
4208                         read_unlock(&tasklist_lock);
4209                 }
4210
4211                 /* Check permissions for the transition. */
4212                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4213                                      PROCESS__DYNTRANSITION, NULL);
4214                 if (error)
4215                         return error;
4216
4217                 /* Check for ptracing, and update the task SID if ok.
4218                    Otherwise, leave SID unchanged and fail. */
4219                 task_lock(p);
4220                 if (p->ptrace & PT_PTRACED) {
4221                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4222                                                      SECCLASS_PROCESS,
4223                                                      PROCESS__PTRACE, &avd);
4224                         if (!error)
4225                                 tsec->sid = sid;
4226                         task_unlock(p);
4227                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4228                                   PROCESS__PTRACE, &avd, error, NULL);
4229                         if (error)
4230                                 return error;
4231                 } else {
4232                         tsec->sid = sid;
4233                         task_unlock(p);
4234                 }
4235         }
4236         else
4237                 return -EINVAL;
4238
4239         return size;
4240 }
4241
4242 static struct security_operations selinux_ops = {
4243         .ptrace =                       selinux_ptrace,
4244         .capget =                       selinux_capget,
4245         .capset_check =                 selinux_capset_check,
4246         .capset_set =                   selinux_capset_set,
4247         .sysctl =                       selinux_sysctl,
4248         .capable =                      selinux_capable,
4249         .quotactl =                     selinux_quotactl,
4250         .quota_on =                     selinux_quota_on,
4251         .syslog =                       selinux_syslog,
4252         .vm_enough_memory =             selinux_vm_enough_memory,
4253
4254         .netlink_send =                 selinux_netlink_send,
4255         .netlink_recv =                 selinux_netlink_recv,
4256
4257         .bprm_alloc_security =          selinux_bprm_alloc_security,
4258         .bprm_free_security =           selinux_bprm_free_security,
4259         .bprm_apply_creds =             selinux_bprm_apply_creds,
4260         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4261         .bprm_set_security =            selinux_bprm_set_security,
4262         .bprm_check_security =          selinux_bprm_check_security,
4263         .bprm_secureexec =              selinux_bprm_secureexec,
4264
4265         .sb_alloc_security =            selinux_sb_alloc_security,
4266         .sb_free_security =             selinux_sb_free_security,
4267         .sb_copy_data =                 selinux_sb_copy_data,
4268         .sb_kern_mount =                selinux_sb_kern_mount,
4269         .sb_statfs =                    selinux_sb_statfs,
4270         .sb_mount =                     selinux_mount,
4271         .sb_umount =                    selinux_umount,
4272
4273         .inode_alloc_security =         selinux_inode_alloc_security,
4274         .inode_free_security =          selinux_inode_free_security,
4275         .inode_init_security =          selinux_inode_init_security,
4276         .inode_create =                 selinux_inode_create,
4277         .inode_link =                   selinux_inode_link,
4278         .inode_unlink =                 selinux_inode_unlink,
4279         .inode_symlink =                selinux_inode_symlink,
4280         .inode_mkdir =                  selinux_inode_mkdir,
4281         .inode_rmdir =                  selinux_inode_rmdir,
4282         .inode_mknod =                  selinux_inode_mknod,
4283         .inode_rename =                 selinux_inode_rename,
4284         .inode_readlink =               selinux_inode_readlink,
4285         .inode_follow_link =            selinux_inode_follow_link,
4286         .inode_permission =             selinux_inode_permission,
4287         .inode_setattr =                selinux_inode_setattr,
4288         .inode_getattr =                selinux_inode_getattr,
4289         .inode_setxattr =               selinux_inode_setxattr,
4290         .inode_post_setxattr =          selinux_inode_post_setxattr,
4291         .inode_getxattr =               selinux_inode_getxattr,
4292         .inode_listxattr =              selinux_inode_listxattr,
4293         .inode_removexattr =            selinux_inode_removexattr,
4294         .inode_getsecurity =            selinux_inode_getsecurity,
4295         .inode_setsecurity =            selinux_inode_setsecurity,
4296         .inode_listsecurity =           selinux_inode_listsecurity,
4297
4298         .file_permission =              selinux_file_permission,
4299         .file_alloc_security =          selinux_file_alloc_security,
4300         .file_free_security =           selinux_file_free_security,
4301         .file_ioctl =                   selinux_file_ioctl,
4302         .file_mmap =                    selinux_file_mmap,
4303         .file_mprotect =                selinux_file_mprotect,
4304         .file_lock =                    selinux_file_lock,
4305         .file_fcntl =                   selinux_file_fcntl,
4306         .file_set_fowner =              selinux_file_set_fowner,
4307         .file_send_sigiotask =          selinux_file_send_sigiotask,
4308         .file_receive =                 selinux_file_receive,
4309
4310         .task_create =                  selinux_task_create,
4311         .task_alloc_security =          selinux_task_alloc_security,
4312         .task_free_security =           selinux_task_free_security,
4313         .task_setuid =                  selinux_task_setuid,
4314         .task_post_setuid =             selinux_task_post_setuid,
4315         .task_setgid =                  selinux_task_setgid,
4316         .task_setpgid =                 selinux_task_setpgid,
4317         .task_getpgid =                 selinux_task_getpgid,
4318         .task_getsid =                  selinux_task_getsid,
4319         .task_setgroups =               selinux_task_setgroups,
4320         .task_setnice =                 selinux_task_setnice,
4321         .task_setrlimit =               selinux_task_setrlimit,
4322         .task_setscheduler =            selinux_task_setscheduler,
4323         .task_getscheduler =            selinux_task_getscheduler,
4324         .task_kill =                    selinux_task_kill,
4325         .task_wait =                    selinux_task_wait,
4326         .task_prctl =                   selinux_task_prctl,
4327         .task_reparent_to_init =        selinux_task_reparent_to_init,
4328         .task_to_inode =                selinux_task_to_inode,
4329
4330         .ipc_permission =               selinux_ipc_permission,
4331
4332         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4333         .msg_msg_free_security =        selinux_msg_msg_free_security,
4334
4335         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4336         .msg_queue_free_security =      selinux_msg_queue_free_security,
4337         .msg_queue_associate =          selinux_msg_queue_associate,
4338         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4339         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4340         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4341
4342         .shm_alloc_security =           selinux_shm_alloc_security,
4343         .shm_free_security =            selinux_shm_free_security,
4344         .shm_associate =                selinux_shm_associate,
4345         .shm_shmctl =                   selinux_shm_shmctl,
4346         .shm_shmat =                    selinux_shm_shmat,
4347
4348         .sem_alloc_security =           selinux_sem_alloc_security,
4349         .sem_free_security =            selinux_sem_free_security,
4350         .sem_associate =                selinux_sem_associate,
4351         .sem_semctl =                   selinux_sem_semctl,
4352         .sem_semop =                    selinux_sem_semop,
4353
4354         .register_security =            selinux_register_security,
4355         .unregister_security =          selinux_unregister_security,
4356
4357         .d_instantiate =                selinux_d_instantiate,
4358
4359         .getprocattr =                  selinux_getprocattr,
4360         .setprocattr =                  selinux_setprocattr,
4361
4362 #ifdef CONFIG_SECURITY_NETWORK
4363         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4364         .unix_may_send =                selinux_socket_unix_may_send,
4365
4366         .socket_create =                selinux_socket_create,
4367         .socket_post_create =           selinux_socket_post_create,
4368         .socket_bind =                  selinux_socket_bind,
4369         .socket_connect =               selinux_socket_connect,
4370         .socket_listen =                selinux_socket_listen,
4371         .socket_accept =                selinux_socket_accept,
4372         .socket_sendmsg =               selinux_socket_sendmsg,
4373         .socket_recvmsg =               selinux_socket_recvmsg,
4374         .socket_getsockname =           selinux_socket_getsockname,
4375         .socket_getpeername =           selinux_socket_getpeername,
4376         .socket_getsockopt =            selinux_socket_getsockopt,
4377         .socket_setsockopt =            selinux_socket_setsockopt,
4378         .socket_shutdown =              selinux_socket_shutdown,
4379         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4380         .socket_getpeersec =            selinux_socket_getpeersec,
4381         .sk_alloc_security =            selinux_sk_alloc_security,
4382         .sk_free_security =             selinux_sk_free_security,
4383 #endif
4384 };
4385
4386 static __init int selinux_init(void)
4387 {
4388         struct task_security_struct *tsec;
4389
4390         if (!selinux_enabled) {
4391                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4392                 return 0;
4393         }
4394
4395         printk(KERN_INFO "SELinux:  Initializing.\n");
4396
4397         /* Set the security state for the initial task. */
4398         if (task_alloc_security(current))
4399                 panic("SELinux:  Failed to initialize initial task.\n");
4400         tsec = current->security;
4401         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4402
4403         avc_init();
4404
4405         original_ops = secondary_ops = security_ops;
4406         if (!secondary_ops)
4407                 panic ("SELinux: No initial security operations\n");
4408         if (register_security (&selinux_ops))
4409                 panic("SELinux: Unable to register with kernel.\n");
4410
4411         if (selinux_enforcing) {
4412                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4413         } else {
4414                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4415         }
4416         return 0;
4417 }
4418
4419 void selinux_complete_init(void)
4420 {
4421         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4422
4423         /* Set up any superblocks initialized prior to the policy load. */
4424         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4425         spin_lock(&sb_security_lock);
4426 next_sb:
4427         if (!list_empty(&superblock_security_head)) {
4428                 struct superblock_security_struct *sbsec =
4429                                 list_entry(superblock_security_head.next,
4430                                            struct superblock_security_struct,
4431                                            list);
4432                 struct super_block *sb = sbsec->sb;
4433                 spin_lock(&sb_lock);
4434                 sb->s_count++;
4435                 spin_unlock(&sb_lock);
4436                 spin_unlock(&sb_security_lock);
4437                 down_read(&sb->s_umount);
4438                 if (sb->s_root)
4439                         superblock_doinit(sb, NULL);
4440                 drop_super(sb);
4441                 spin_lock(&sb_security_lock);
4442                 list_del_init(&sbsec->list);
4443                 goto next_sb;
4444         }
4445         spin_unlock(&sb_security_lock);
4446 }
4447
4448 /* SELinux requires early initialization in order to label
4449    all processes and objects when they are created. */
4450 security_initcall(selinux_init);
4451
4452 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4453
4454 static struct nf_hook_ops selinux_ipv4_op = {
4455         .hook =         selinux_ipv4_postroute_last,
4456         .owner =        THIS_MODULE,
4457         .pf =           PF_INET,
4458         .hooknum =      NF_IP_POST_ROUTING,
4459         .priority =     NF_IP_PRI_SELINUX_LAST,
4460 };
4461
4462 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4463
4464 static struct nf_hook_ops selinux_ipv6_op = {
4465         .hook =         selinux_ipv6_postroute_last,
4466         .owner =        THIS_MODULE,
4467         .pf =           PF_INET6,
4468         .hooknum =      NF_IP6_POST_ROUTING,
4469         .priority =     NF_IP6_PRI_SELINUX_LAST,
4470 };
4471
4472 #endif  /* IPV6 */
4473
4474 static int __init selinux_nf_ip_init(void)
4475 {
4476         int err = 0;
4477
4478         if (!selinux_enabled)
4479                 goto out;
4480
4481         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4482
4483         err = nf_register_hook(&selinux_ipv4_op);
4484         if (err)
4485                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4486
4487 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4488
4489         err = nf_register_hook(&selinux_ipv6_op);
4490         if (err)
4491                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4492
4493 #endif  /* IPV6 */
4494 out:
4495         return err;
4496 }
4497
4498 __initcall(selinux_nf_ip_init);
4499
4500 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4501 static void selinux_nf_ip_exit(void)
4502 {
4503         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4504
4505         nf_unregister_hook(&selinux_ipv4_op);
4506 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4507         nf_unregister_hook(&selinux_ipv6_op);
4508 #endif  /* IPV6 */
4509 }
4510 #endif
4511
4512 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4513
4514 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4515 #define selinux_nf_ip_exit()
4516 #endif
4517
4518 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4519
4520 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4521 int selinux_disable(void)
4522 {
4523         extern void exit_sel_fs(void);
4524         static int selinux_disabled = 0;
4525
4526         if (ss_initialized) {
4527                 /* Not permitted after initial policy load. */
4528                 return -EINVAL;
4529         }
4530
4531         if (selinux_disabled) {
4532                 /* Only do this once. */
4533                 return -EINVAL;
4534         }
4535
4536         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4537
4538         selinux_disabled = 1;
4539
4540         /* Reset security_ops to the secondary module, dummy or capability. */
4541         security_ops = secondary_ops;
4542
4543         /* Unregister netfilter hooks. */
4544         selinux_nf_ip_exit();
4545
4546         /* Unregister selinuxfs. */
4547         exit_sel_fs();
4548
4549         return 0;
4550 }
4551 #endif
4552
4553