security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *              Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/fdtable.h>
  43 #include <linux/namei.h>
  44 #include <linux/mount.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <net/net_namespace.h>
  53 #include <net/netlabel.h>
  54 #include <linux/uaccess.h>
  55 #include <asm/ioctls.h>
  56 #include <asm/atomic.h>
  57 #include <linux/bitops.h>
  58 #include <linux/interrupt.h>
  59 #include <linux/netdevice.h>    /* for network interface checks */
  60 #include <linux/netlink.h>
  61 #include <linux/tcp.h>
  62 #include <linux/udp.h>
  63 #include <linux/dccp.h>
  64 #include <linux/quota.h>
  65 #include <linux/un.h>           /* for Unix socket types */
  66 #include <net/af_unix.h>        /* for Unix socket types */
  67 #include <linux/parser.h>
  68 #include <linux/nfs_mount.h>
  69 #include <net/ipv6.h>
  70 #include <linux/hugetlb.h>
  71 #include <linux/personality.h>
  72 #include <linux/sysctl.h>
  73 #include <linux/audit.h>
  74 #include <linux/string.h>
  75 #include <linux/selinux.h>
  76 #include <linux/mutex.h>
  77
  78 #include "avc.h"
  79 #include "objsec.h"
  80 #include "netif.h"
  81 #include "netnode.h"
  82 #include "netport.h"
  83 #include "xfrm.h"
  84 #include "netlabel.h"
  85 #include "audit.h"
  86
  87 #define XATTR_SELINUX_SUFFIX "selinux"
  88 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  89
  90 #define NUM_SEL_MNT_OPTS 4
  91
  92 extern unsigned int policydb_loaded_version;
  93 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  94 extern int selinux_compat_net;
  95 extern struct security_operations *security_ops;
  96
  97 /* SECMARK reference count */
  98 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!strict_strtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!strict_strtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 /* Original (dummy) security module. */
 129 static struct security_operations *original_ops;
 130
 131 /* Minimal support for a secondary security module,
 132    just to allow the use of the dummy or capability modules.
 133    The owlsm module can alternatively be used as a secondary
 134    module as long as CONFIG_OWLSM_FD is not enabled. */
 135 static struct security_operations *secondary_ops;
 136
 137 /* Lists of inode and superblock security structures initialized
 138    before the policy was loaded. */
 139 static LIST_HEAD(superblock_security_head);
 140 static DEFINE_SPINLOCK(sb_security_lock);
 141
 142 static struct kmem_cache *sel_inode_cache;
 143
 144 /**
 145  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 146  *
 147  * Description:
 148  * This function checks the SECMARK reference counter to see if any SECMARK
 149  * targets are currently configured, if the reference counter is greater than
 150  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 151  * enabled, false (0) if SECMARK is disabled.
 152  *
 153  */
 154 static int selinux_secmark_enabled(void)
 155 {
 156         return (atomic_read(&selinux_secmark_refcount) > 0);
 157 }
 158
 159 /* Allocate and free functions for each kind of security blob. */
 160
 161 static int task_alloc_security(struct task_struct *task)
 162 {
 163         struct task_security_struct *tsec;
 164
 165         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 166         if (!tsec)
 167                 return -ENOMEM;
 168
 169         tsec->osid = tsec->sid = SECINITSID_UNLABELED;
 170         task->security = tsec;
 171
 172         return 0;
 173 }
 174
 175 static void task_free_security(struct task_struct *task)
 176 {
 177         struct task_security_struct *tsec = task->security;
 178         task->security = NULL;
 179         kfree(tsec);
 180 }
 181
 182 static int inode_alloc_security(struct inode *inode)
 183 {
 184         struct task_security_struct *tsec = current->security;
 185         struct inode_security_struct *isec;
 186
 187         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 188         if (!isec)
 189                 return -ENOMEM;
 190
 191         mutex_init(&isec->lock);
 192         INIT_LIST_HEAD(&isec->list);
 193         isec->inode = inode;
 194         isec->sid = SECINITSID_UNLABELED;
 195         isec->sclass = SECCLASS_FILE;
 196         isec->task_sid = tsec->sid;
 197         inode->i_security = isec;
 198
 199         return 0;
 200 }
 201
 202 static void inode_free_security(struct inode *inode)
 203 {
 204         struct inode_security_struct *isec = inode->i_security;
 205         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 206
 207         spin_lock(&sbsec->isec_lock);
 208         if (!list_empty(&isec->list))
 209                 list_del_init(&isec->list);
 210         spin_unlock(&sbsec->isec_lock);
 211
 212         inode->i_security = NULL;
 213         kmem_cache_free(sel_inode_cache, isec);
 214 }
 215
 216 static int file_alloc_security(struct file *file)
 217 {
 218         struct task_security_struct *tsec = current->security;
 219         struct file_security_struct *fsec;
 220
 221         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 222         if (!fsec)
 223                 return -ENOMEM;
 224
 225         fsec->sid = tsec->sid;
 226         fsec->fown_sid = tsec->sid;
 227         file->f_security = fsec;
 228
 229         return 0;
 230 }
 231
 232 static void file_free_security(struct file *file)
 233 {
 234         struct file_security_struct *fsec = file->f_security;
 235         file->f_security = NULL;
 236         kfree(fsec);
 237 }
 238
 239 static int superblock_alloc_security(struct super_block *sb)
 240 {
 241         struct superblock_security_struct *sbsec;
 242
 243         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 244         if (!sbsec)
 245                 return -ENOMEM;
 246
 247         mutex_init(&sbsec->lock);
 248         INIT_LIST_HEAD(&sbsec->list);
 249         INIT_LIST_HEAD(&sbsec->isec_head);
 250         spin_lock_init(&sbsec->isec_lock);
 251         sbsec->sb = sb;
 252         sbsec->sid = SECINITSID_UNLABELED;
 253         sbsec->def_sid = SECINITSID_FILE;
 254         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 255         sb->s_security = sbsec;
 256
 257         return 0;
 258 }
 259
 260 static void superblock_free_security(struct super_block *sb)
 261 {
 262         struct superblock_security_struct *sbsec = sb->s_security;
 263
 264         spin_lock(&sb_security_lock);
 265         if (!list_empty(&sbsec->list))
 266                 list_del_init(&sbsec->list);
 267         spin_unlock(&sb_security_lock);
 268
 269         sb->s_security = NULL;
 270         kfree(sbsec);
 271 }
 272
 273 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 274 {
 275         struct sk_security_struct *ssec;
 276
 277         ssec = kzalloc(sizeof(*ssec), priority);
 278         if (!ssec)
 279                 return -ENOMEM;
 280
 281         ssec->peer_sid = SECINITSID_UNLABELED;
 282         ssec->sid = SECINITSID_UNLABELED;
 283         sk->sk_security = ssec;
 284
 285         selinux_netlbl_sk_security_reset(ssec, family);
 286
 287         return 0;
 288 }
 289
 290 static void sk_free_security(struct sock *sk)
 291 {
 292         struct sk_security_struct *ssec = sk->sk_security;
 293
 294         sk->sk_security = NULL;
 295         kfree(ssec);
 296 }
 297
 298 /* The security server must be initialized before
 299    any labeling or access decisions can be provided. */
 300 extern int ss_initialized;
 301
 302 /* The file system's label must be initialized prior to use. */
 303
 304 static char *labeling_behaviors[6] = {
 305         "uses xattr",
 306         "uses transition SIDs",
 307         "uses task SIDs",
 308         "uses genfs_contexts",
 309         "not configured for labeling",
 310         "uses mountpoint labeling",
 311 };
 312
 313 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 314
 315 static inline int inode_doinit(struct inode *inode)
 316 {
 317         return inode_doinit_with_dentry(inode, NULL);
 318 }
 319
 320 enum {
 321         Opt_error = -1,
 322         Opt_context = 1,
 323         Opt_fscontext = 2,
 324         Opt_defcontext = 3,
 325         Opt_rootcontext = 4,
 326 };
 327
 328 static match_table_t tokens = {
 329         {Opt_context, CONTEXT_STR "%s"},
 330         {Opt_fscontext, FSCONTEXT_STR "%s"},
 331         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 332         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 333         {Opt_error, NULL},
 334 };
 335
 336 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 337
 338 static int may_context_mount_sb_relabel(u32 sid,
 339                         struct superblock_security_struct *sbsec,
 340                         struct task_security_struct *tsec)
 341 {
 342         int rc;
 343
 344         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 345                           FILESYSTEM__RELABELFROM, NULL);
 346         if (rc)
 347                 return rc;
 348
 349         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 350                           FILESYSTEM__RELABELTO, NULL);
 351         return rc;
 352 }
 353
 354 static int may_context_mount_inode_relabel(u32 sid,
 355                         struct superblock_security_struct *sbsec,
 356                         struct task_security_struct *tsec)
 357 {
 358         int rc;
 359         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 360                           FILESYSTEM__RELABELFROM, NULL);
 361         if (rc)
 362                 return rc;
 363
 364         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 365                           FILESYSTEM__ASSOCIATE, NULL);
 366         return rc;
 367 }
 368
 369 static int sb_finish_set_opts(struct super_block *sb)
 370 {
 371         struct superblock_security_struct *sbsec = sb->s_security;
 372         struct dentry *root = sb->s_root;
 373         struct inode *root_inode = root->d_inode;
 374         int rc = 0;
 375
 376         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 377                 /* Make sure that the xattr handler exists and that no
 378                    error other than -ENODATA is returned by getxattr on
 379                    the root directory.  -ENODATA is ok, as this may be
 380                    the first boot of the SELinux kernel before we have
 381                    assigned xattr values to the filesystem. */
 382                 if (!root_inode->i_op->getxattr) {
 383                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 384                                "xattr support\n", sb->s_id, sb->s_type->name);
 385                         rc = -EOPNOTSUPP;
 386                         goto out;
 387                 }
 388                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 389                 if (rc < 0 && rc != -ENODATA) {
 390                         if (rc == -EOPNOTSUPP)
 391                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 392                                        "%s) has no security xattr handler\n",
 393                                        sb->s_id, sb->s_type->name);
 394                         else
 395                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 396                                        "%s) getxattr errno %d\n", sb->s_id,
 397                                        sb->s_type->name, -rc);
 398                         goto out;
 399                 }
 400         }
 401
 402         sbsec->initialized = 1;
 403
 404         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 405                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 406                        sb->s_id, sb->s_type->name);
 407         else
 408                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 409                        sb->s_id, sb->s_type->name,
 410                        labeling_behaviors[sbsec->behavior-1]);
 411
 412         /* Initialize the root inode. */
 413         rc = inode_doinit_with_dentry(root_inode, root);
 414
 415         /* Initialize any other inodes associated with the superblock, e.g.
 416            inodes created prior to initial policy load or inodes created
 417            during get_sb by a pseudo filesystem that directly
 418            populates itself. */
 419         spin_lock(&sbsec->isec_lock);
 420 next_inode:
 421         if (!list_empty(&sbsec->isec_head)) {
 422                 struct inode_security_struct *isec =
 423                                 list_entry(sbsec->isec_head.next,
 424                                            struct inode_security_struct, list);
 425                 struct inode *inode = isec->inode;
 426                 spin_unlock(&sbsec->isec_lock);
 427                 inode = igrab(inode);
 428                 if (inode) {
 429                         if (!IS_PRIVATE(inode))
 430                                 inode_doinit(inode);
 431                         iput(inode);
 432                 }
 433                 spin_lock(&sbsec->isec_lock);
 434                 list_del_init(&isec->list);
 435                 goto next_inode;
 436         }
 437         spin_unlock(&sbsec->isec_lock);
 438 out:
 439         return rc;
 440 }
 441
 442 /*
 443  * This function should allow an FS to ask what it's mount security
 444  * options were so it can use those later for submounts, displaying
 445  * mount options, or whatever.
 446  */
 447 static int selinux_get_mnt_opts(const struct super_block *sb,
 448                                 struct security_mnt_opts *opts)
 449 {
 450         int rc = 0, i;
 451         struct superblock_security_struct *sbsec = sb->s_security;
 452         char *context = NULL;
 453         u32 len;
 454         char tmp;
 455
 456         security_init_mnt_opts(opts);
 457
 458         if (!sbsec->initialized)
 459                 return -EINVAL;
 460
 461         if (!ss_initialized)
 462                 return -EINVAL;
 463
 464         /*
 465          * if we ever use sbsec flags for anything other than tracking mount
 466          * settings this is going to need a mask
 467          */
 468         tmp = sbsec->flags;
 469         /* count the number of mount options for this sb */
 470         for (i = 0; i < 8; i++) {
 471                 if (tmp & 0x01)
 472                         opts->num_mnt_opts++;
 473                 tmp >>= 1;
 474         }
 475
 476         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 477         if (!opts->mnt_opts) {
 478                 rc = -ENOMEM;
 479                 goto out_free;
 480         }
 481
 482         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 483         if (!opts->mnt_opts_flags) {
 484                 rc = -ENOMEM;
 485                 goto out_free;
 486         }
 487
 488         i = 0;
 489         if (sbsec->flags & FSCONTEXT_MNT) {
 490                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 491                 if (rc)
 492                         goto out_free;
 493                 opts->mnt_opts[i] = context;
 494                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 495         }
 496         if (sbsec->flags & CONTEXT_MNT) {
 497                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 498                 if (rc)
 499                         goto out_free;
 500                 opts->mnt_opts[i] = context;
 501                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 502         }
 503         if (sbsec->flags & DEFCONTEXT_MNT) {
 504                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 505                 if (rc)
 506                         goto out_free;
 507                 opts->mnt_opts[i] = context;
 508                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 509         }
 510         if (sbsec->flags & ROOTCONTEXT_MNT) {
 511                 struct inode *root = sbsec->sb->s_root->d_inode;
 512                 struct inode_security_struct *isec = root->i_security;
 513
 514                 rc = security_sid_to_context(isec->sid, &context, &len);
 515                 if (rc)
 516                         goto out_free;
 517                 opts->mnt_opts[i] = context;
 518                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 519         }
 520
 521         BUG_ON(i != opts->num_mnt_opts);
 522
 523         return 0;
 524
 525 out_free:
 526         security_free_mnt_opts(opts);
 527         return rc;
 528 }
 529
 530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 531                       u32 old_sid, u32 new_sid)
 532 {
 533         /* check if the old mount command had the same options */
 534         if (sbsec->initialized)
 535                 if (!(sbsec->flags & flag) ||
 536                     (old_sid != new_sid))
 537                         return 1;
 538
 539         /* check if we were passed the same options twice,
 540          * aka someone passed context=a,context=b
 541          */
 542         if (!sbsec->initialized)
 543                 if (sbsec->flags & flag)
 544                         return 1;
 545         return 0;
 546 }
 547
 548 /*
 549  * Allow filesystems with binary mount data to explicitly set mount point
 550  * labeling information.
 551  */
 552 static int selinux_set_mnt_opts(struct super_block *sb,
 553                                 struct security_mnt_opts *opts)
 554 {
 555         int rc = 0, i;
 556         struct task_security_struct *tsec = current->security;
 557         struct superblock_security_struct *sbsec = sb->s_security;
 558         const char *name = sb->s_type->name;
 559         struct dentry *root = sb->s_root;
 560         struct inode *root_inode = root->d_inode;
 561         struct inode_security_struct *root_isec = root_inode->i_security;
 562         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 563         u32 defcontext_sid = 0;
 564         char **mount_options = opts->mnt_opts;
 565         int *flags = opts->mnt_opts_flags;
 566         int num_opts = opts->num_mnt_opts;
 567         bool can_xattr = false;
 568
 569         mutex_lock(&sbsec->lock);
 570
 571         if (!ss_initialized) {
 572                 if (!num_opts) {
 573                         /* Defer initialization until selinux_complete_init,
 574                            after the initial policy is loaded and the security
 575                            server is ready to handle calls. */
 576                         spin_lock(&sb_security_lock);
 577                         if (list_empty(&sbsec->list))
 578                                 list_add(&sbsec->list, &superblock_security_head);
 579                         spin_unlock(&sb_security_lock);
 580                         goto out;
 581                 }
 582                 rc = -EINVAL;
 583                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 584                         "before the security server is initialized\n");
 585                 goto out;
 586         }
 587
 588         /*
 589          * Binary mount data FS will come through this function twice.  Once
 590          * from an explicit call and once from the generic calls from the vfs.
 591          * Since the generic VFS calls will not contain any security mount data
 592          * we need to skip the double mount verification.
 593          *
 594          * This does open a hole in which we will not notice if the first
 595          * mount using this sb set explict options and a second mount using
 596          * this sb does not set any security options.  (The first options
 597          * will be used for both mounts)
 598          */
 599         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 600             && (num_opts == 0))
 601                 goto out;
 602
 603         /*
 604          * parse the mount options, check if they are valid sids.
 605          * also check if someone is trying to mount the same sb more
 606          * than once with different security options.
 607          */
 608         for (i = 0; i < num_opts; i++) {
 609                 u32 sid;
 610                 rc = security_context_to_sid(mount_options[i],
 611                                              strlen(mount_options[i]), &sid);
 612                 if (rc) {
 613                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 614                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 615                                mount_options[i], sb->s_id, name, rc);
 616                         goto out;
 617                 }
 618                 switch (flags[i]) {
 619                 case FSCONTEXT_MNT:
 620                         fscontext_sid = sid;
 621
 622                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 623                                         fscontext_sid))
 624                                 goto out_double_mount;
 625
 626                         sbsec->flags |= FSCONTEXT_MNT;
 627                         break;
 628                 case CONTEXT_MNT:
 629                         context_sid = sid;
 630
 631                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 632                                         context_sid))
 633                                 goto out_double_mount;
 634
 635                         sbsec->flags |= CONTEXT_MNT;
 636                         break;
 637                 case ROOTCONTEXT_MNT:
 638                         rootcontext_sid = sid;
 639
 640                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 641                                         rootcontext_sid))
 642                                 goto out_double_mount;
 643
 644                         sbsec->flags |= ROOTCONTEXT_MNT;
 645
 646                         break;
 647                 case DEFCONTEXT_MNT:
 648                         defcontext_sid = sid;
 649
 650                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 651                                         defcontext_sid))
 652                                 goto out_double_mount;
 653
 654                         sbsec->flags |= DEFCONTEXT_MNT;
 655
 656                         break;
 657                 default:
 658                         rc = -EINVAL;
 659                         goto out;
 660                 }
 661         }
 662
 663         if (sbsec->initialized) {
 664                 /* previously mounted with options, but not on this attempt? */
 665                 if (sbsec->flags && !num_opts)
 666                         goto out_double_mount;
 667                 rc = 0;
 668                 goto out;
 669         }
 670
 671         if (strcmp(name, "proc") == 0)
 672                 sbsec->proc = 1;
 673
 674         /*
 675          * test if the fs supports xattrs, fs_use might make use of this if the
 676          * fs has no definition in policy.
 677          */
 678         if (root_inode->i_op->getxattr) {
 679                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 680                 if (rc >= 0 || rc == -ENODATA)
 681                         can_xattr = true;
 682         }
 683
 684         /* Determine the labeling behavior to use for this filesystem type. */
 685         rc = security_fs_use(name, &sbsec->behavior, &sbsec->sid, can_xattr);
 686         if (rc) {
 687                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 688                        __func__, name, rc);
 689                 goto out;
 690         }
 691
 692         /* sets the context of the superblock for the fs being mounted. */
 693         if (fscontext_sid) {
 694
 695                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 696                 if (rc)
 697                         goto out;
 698
 699                 sbsec->sid = fscontext_sid;
 700         }
 701
 702         /*
 703          * Switch to using mount point labeling behavior.
 704          * sets the label used on all file below the mountpoint, and will set
 705          * the superblock context if not already set.
 706          */
 707         if (context_sid) {
 708                 if (!fscontext_sid) {
 709                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 710                         if (rc)
 711                                 goto out;
 712                         sbsec->sid = context_sid;
 713                 } else {
 714                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 715                         if (rc)
 716                                 goto out;
 717                 }
 718                 if (!rootcontext_sid)
 719                         rootcontext_sid = context_sid;
 720
 721                 sbsec->mntpoint_sid = context_sid;
 722                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 723         }
 724
 725         if (rootcontext_sid) {
 726                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 727                 if (rc)
 728                         goto out;
 729
 730                 root_isec->sid = rootcontext_sid;
 731                 root_isec->initialized = 1;
 732         }
 733
 734         if (defcontext_sid) {
 735                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 736                         rc = -EINVAL;
 737                         printk(KERN_WARNING "SELinux: defcontext option is "
 738                                "invalid for this filesystem type\n");
 739                         goto out;
 740                 }
 741
 742                 if (defcontext_sid != sbsec->def_sid) {
 743                         rc = may_context_mount_inode_relabel(defcontext_sid,
 744                                                              sbsec, tsec);
 745                         if (rc)
 746                                 goto out;
 747                 }
 748
 749                 sbsec->def_sid = defcontext_sid;
 750         }
 751
 752         rc = sb_finish_set_opts(sb);
 753 out:
 754         mutex_unlock(&sbsec->lock);
 755         return rc;
 756 out_double_mount:
 757         rc = -EINVAL;
 758         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 759                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 760         goto out;
 761 }
 762
 763 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 764                                         struct super_block *newsb)
 765 {
 766         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 767         struct superblock_security_struct *newsbsec = newsb->s_security;
 768
 769         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 770         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 771         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 772
 773         /*
 774          * if the parent was able to be mounted it clearly had no special lsm
 775          * mount options.  thus we can safely put this sb on the list and deal
 776          * with it later
 777          */
 778         if (!ss_initialized) {
 779                 spin_lock(&sb_security_lock);
 780                 if (list_empty(&newsbsec->list))
 781                         list_add(&newsbsec->list, &superblock_security_head);
 782                 spin_unlock(&sb_security_lock);
 783                 return;
 784         }
 785
 786         /* how can we clone if the old one wasn't set up?? */
 787         BUG_ON(!oldsbsec->initialized);
 788
 789         /* if fs is reusing a sb, just let its options stand... */
 790         if (newsbsec->initialized)
 791                 return;
 792
 793         mutex_lock(&newsbsec->lock);
 794
 795         newsbsec->flags = oldsbsec->flags;
 796
 797         newsbsec->sid = oldsbsec->sid;
 798         newsbsec->def_sid = oldsbsec->def_sid;
 799         newsbsec->behavior = oldsbsec->behavior;
 800
 801         if (set_context) {
 802                 u32 sid = oldsbsec->mntpoint_sid;
 803
 804                 if (!set_fscontext)
 805                         newsbsec->sid = sid;
 806                 if (!set_rootcontext) {
 807                         struct inode *newinode = newsb->s_root->d_inode;
 808                         struct inode_security_struct *newisec = newinode->i_security;
 809                         newisec->sid = sid;
 810                 }
 811                 newsbsec->mntpoint_sid = sid;
 812         }
 813         if (set_rootcontext) {
 814                 const struct inode *oldinode = oldsb->s_root->d_inode;
 815                 const struct inode_security_struct *oldisec = oldinode->i_security;
 816                 struct inode *newinode = newsb->s_root->d_inode;
 817                 struct inode_security_struct *newisec = newinode->i_security;
 818
 819                 newisec->sid = oldisec->sid;
 820         }
 821
 822         sb_finish_set_opts(newsb);
 823         mutex_unlock(&newsbsec->lock);
 824 }
 825
 826 static int selinux_parse_opts_str(char *options,
 827                                   struct security_mnt_opts *opts)
 828 {
 829         char *p;
 830         char *context = NULL, *defcontext = NULL;
 831         char *fscontext = NULL, *rootcontext = NULL;
 832         int rc, num_mnt_opts = 0;
 833
 834         opts->num_mnt_opts = 0;
 835
 836         /* Standard string-based options. */
 837         while ((p = strsep(&options, "|")) != NULL) {
 838                 int token;
 839                 substring_t args[MAX_OPT_ARGS];
 840
 841                 if (!*p)
 842                         continue;
 843
 844                 token = match_token(p, tokens, args);
 845
 846                 switch (token) {
 847                 case Opt_context:
 848                         if (context || defcontext) {
 849                                 rc = -EINVAL;
 850                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 851                                 goto out_err;
 852                         }
 853                         context = match_strdup(&args[0]);
 854                         if (!context) {
 855                                 rc = -ENOMEM;
 856                                 goto out_err;
 857                         }
 858                         break;
 859
 860                 case Opt_fscontext:
 861                         if (fscontext) {
 862                                 rc = -EINVAL;
 863                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 864                                 goto out_err;
 865                         }
 866                         fscontext = match_strdup(&args[0]);
 867                         if (!fscontext) {
 868                                 rc = -ENOMEM;
 869                                 goto out_err;
 870                         }
 871                         break;
 872
 873                 case Opt_rootcontext:
 874                         if (rootcontext) {
 875                                 rc = -EINVAL;
 876                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 877                                 goto out_err;
 878                         }
 879                         rootcontext = match_strdup(&args[0]);
 880                         if (!rootcontext) {
 881                                 rc = -ENOMEM;
 882                                 goto out_err;
 883                         }
 884                         break;
 885
 886                 case Opt_defcontext:
 887                         if (context || defcontext) {
 888                                 rc = -EINVAL;
 889                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 890                                 goto out_err;
 891                         }
 892                         defcontext = match_strdup(&args[0]);
 893                         if (!defcontext) {
 894                                 rc = -ENOMEM;
 895                                 goto out_err;
 896                         }
 897                         break;
 898
 899                 default:
 900                         rc = -EINVAL;
 901                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 902                         goto out_err;
 903
 904                 }
 905         }
 906
 907         rc = -ENOMEM;
 908         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 909         if (!opts->mnt_opts)
 910                 goto out_err;
 911
 912         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 913         if (!opts->mnt_opts_flags) {
 914                 kfree(opts->mnt_opts);
 915                 goto out_err;
 916         }
 917
 918         if (fscontext) {
 919                 opts->mnt_opts[num_mnt_opts] = fscontext;
 920                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 921         }
 922         if (context) {
 923                 opts->mnt_opts[num_mnt_opts] = context;
 924                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 925         }
 926         if (rootcontext) {
 927                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 928                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 929         }
 930         if (defcontext) {
 931                 opts->mnt_opts[num_mnt_opts] = defcontext;
 932                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 933         }
 934
 935         opts->num_mnt_opts = num_mnt_opts;
 936         return 0;
 937
 938 out_err:
 939         kfree(context);
 940         kfree(defcontext);
 941         kfree(fscontext);
 942         kfree(rootcontext);
 943         return rc;
 944 }
 945 /*
 946  * string mount options parsing and call set the sbsec
 947  */
 948 static int superblock_doinit(struct super_block *sb, void *data)
 949 {
 950         int rc = 0;
 951         char *options = data;
 952         struct security_mnt_opts opts;
 953
 954         security_init_mnt_opts(&opts);
 955
 956         if (!data)
 957                 goto out;
 958
 959         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 960
 961         rc = selinux_parse_opts_str(options, &opts);
 962         if (rc)
 963                 goto out_err;
 964
 965 out:
 966         rc = selinux_set_mnt_opts(sb, &opts);
 967
 968 out_err:
 969         security_free_mnt_opts(&opts);
 970         return rc;
 971 }
 972
 973 static inline u16 inode_mode_to_security_class(umode_t mode)
 974 {
 975         switch (mode & S_IFMT) {
 976         case S_IFSOCK:
 977                 return SECCLASS_SOCK_FILE;
 978         case S_IFLNK:
 979                 return SECCLASS_LNK_FILE;
 980         case S_IFREG:
 981                 return SECCLASS_FILE;
 982         case S_IFBLK:
 983                 return SECCLASS_BLK_FILE;
 984         case S_IFDIR:
 985                 return SECCLASS_DIR;
 986         case S_IFCHR:
 987                 return SECCLASS_CHR_FILE;
 988         case S_IFIFO:
 989                 return SECCLASS_FIFO_FILE;
 990
 991         }
 992
 993         return SECCLASS_FILE;
 994 }
 995
 996 static inline int default_protocol_stream(int protocol)
 997 {
 998         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 999 }
1000
1001 static inline int default_protocol_dgram(int protocol)
1002 {
1003         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1004 }
1005
1006 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1007 {
1008         switch (family) {
1009         case PF_UNIX:
1010                 switch (type) {
1011                 case SOCK_STREAM:
1012                 case SOCK_SEQPACKET:
1013                         return SECCLASS_UNIX_STREAM_SOCKET;
1014                 case SOCK_DGRAM:
1015                         return SECCLASS_UNIX_DGRAM_SOCKET;
1016                 }
1017                 break;
1018         case PF_INET:
1019         case PF_INET6:
1020                 switch (type) {
1021                 case SOCK_STREAM:
1022                         if (default_protocol_stream(protocol))
1023                                 return SECCLASS_TCP_SOCKET;
1024                         else
1025                                 return SECCLASS_RAWIP_SOCKET;
1026                 case SOCK_DGRAM:
1027                         if (default_protocol_dgram(protocol))
1028                                 return SECCLASS_UDP_SOCKET;
1029                         else
1030                                 return SECCLASS_RAWIP_SOCKET;
1031                 case SOCK_DCCP:
1032                         return SECCLASS_DCCP_SOCKET;
1033                 default:
1034                         return SECCLASS_RAWIP_SOCKET;
1035                 }
1036                 break;
1037         case PF_NETLINK:
1038                 switch (protocol) {
1039                 case NETLINK_ROUTE:
1040                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1041                 case NETLINK_FIREWALL:
1042                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1043                 case NETLINK_INET_DIAG:
1044                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1045                 case NETLINK_NFLOG:
1046                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1047                 case NETLINK_XFRM:
1048                         return SECCLASS_NETLINK_XFRM_SOCKET;
1049                 case NETLINK_SELINUX:
1050                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1051                 case NETLINK_AUDIT:
1052                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1053                 case NETLINK_IP6_FW:
1054                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1055                 case NETLINK_DNRTMSG:
1056                         return SECCLASS_NETLINK_DNRT_SOCKET;
1057                 case NETLINK_KOBJECT_UEVENT:
1058                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1059                 default:
1060                         return SECCLASS_NETLINK_SOCKET;
1061                 }
1062         case PF_PACKET:
1063                 return SECCLASS_PACKET_SOCKET;
1064         case PF_KEY:
1065                 return SECCLASS_KEY_SOCKET;
1066         case PF_APPLETALK:
1067                 return SECCLASS_APPLETALK_SOCKET;
1068         }
1069
1070         return SECCLASS_SOCKET;
1071 }
1072
1073 #ifdef CONFIG_PROC_FS
1074 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1075                                 u16 tclass,
1076                                 u32 *sid)
1077 {
1078         int buflen, rc;
1079         char *buffer, *path, *end;
1080
1081         buffer = (char *)__get_free_page(GFP_KERNEL);
1082         if (!buffer)
1083                 return -ENOMEM;
1084
1085         buflen = PAGE_SIZE;
1086         end = buffer+buflen;
1087         *--end = '\0';
1088         buflen--;
1089         path = end-1;
1090         *path = '/';
1091         while (de && de != de->parent) {
1092                 buflen -= de->namelen + 1;
1093                 if (buflen < 0)
1094                         break;
1095                 end -= de->namelen;
1096                 memcpy(end, de->name, de->namelen);
1097                 *--end = '/';
1098                 path = end;
1099                 de = de->parent;
1100         }
1101         rc = security_genfs_sid("proc", path, tclass, sid);
1102         free_page((unsigned long)buffer);
1103         return rc;
1104 }
1105 #else
1106 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1107                                 u16 tclass,
1108                                 u32 *sid)
1109 {
1110         return -EINVAL;
1111 }
1112 #endif
1113
1114 /* The inode's security attributes must be initialized before first use. */
1115 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1116 {
1117         struct superblock_security_struct *sbsec = NULL;
1118         struct inode_security_struct *isec = inode->i_security;
1119         u32 sid;
1120         struct dentry *dentry;
1121 #define INITCONTEXTLEN 255
1122         char *context = NULL;
1123         unsigned len = 0;
1124         int rc = 0;
1125
1126         if (isec->initialized)
1127                 goto out;
1128
1129         mutex_lock(&isec->lock);
1130         if (isec->initialized)
1131                 goto out_unlock;
1132
1133         sbsec = inode->i_sb->s_security;
1134         if (!sbsec->initialized) {
1135                 /* Defer initialization until selinux_complete_init,
1136                    after the initial policy is loaded and the security
1137                    server is ready to handle calls. */
1138                 spin_lock(&sbsec->isec_lock);
1139                 if (list_empty(&isec->list))
1140                         list_add(&isec->list, &sbsec->isec_head);
1141                 spin_unlock(&sbsec->isec_lock);
1142                 goto out_unlock;
1143         }
1144
1145         switch (sbsec->behavior) {
1146         case SECURITY_FS_USE_XATTR:
1147                 if (!inode->i_op->getxattr) {
1148                         isec->sid = sbsec->def_sid;
1149                         break;
1150                 }
1151
1152                 /* Need a dentry, since the xattr API requires one.
1153                    Life would be simpler if we could just pass the inode. */
1154                 if (opt_dentry) {
1155                         /* Called from d_instantiate or d_splice_alias. */
1156                         dentry = dget(opt_dentry);
1157                 } else {
1158                         /* Called from selinux_complete_init, try to find a dentry. */
1159                         dentry = d_find_alias(inode);
1160                 }
1161                 if (!dentry) {
1162                         printk(KERN_WARNING "SELinux: %s:  no dentry for dev=%s "
1163                                "ino=%ld\n", __func__, inode->i_sb->s_id,
1164                                inode->i_ino);
1165                         goto out_unlock;
1166                 }
1167
1168                 len = INITCONTEXTLEN;
1169                 context = kmalloc(len, GFP_NOFS);
1170                 if (!context) {
1171                         rc = -ENOMEM;
1172                         dput(dentry);
1173                         goto out_unlock;
1174                 }
1175                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1176                                            context, len);
1177                 if (rc == -ERANGE) {
1178                         /* Need a larger buffer.  Query for the right size. */
1179                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1180                                                    NULL, 0);
1181                         if (rc < 0) {
1182                                 dput(dentry);
1183                                 goto out_unlock;
1184                         }
1185                         kfree(context);
1186                         len = rc;
1187                         context = kmalloc(len, GFP_NOFS);
1188                         if (!context) {
1189                                 rc = -ENOMEM;
1190                                 dput(dentry);
1191                                 goto out_unlock;
1192                         }
1193                         rc = inode->i_op->getxattr(dentry,
1194                                                    XATTR_NAME_SELINUX,
1195                                                    context, len);
1196                 }
1197                 dput(dentry);
1198                 if (rc < 0) {
1199                         if (rc != -ENODATA) {
1200                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1201                                        "%d for dev=%s ino=%ld\n", __func__,
1202                                        -rc, inode->i_sb->s_id, inode->i_ino);
1203                                 kfree(context);
1204                                 goto out_unlock;
1205                         }
1206                         /* Map ENODATA to the default file SID */
1207                         sid = sbsec->def_sid;
1208                         rc = 0;
1209                 } else {
1210                         rc = security_context_to_sid_default(context, rc, &sid,
1211                                                              sbsec->def_sid,
1212                                                              GFP_NOFS);
1213                         if (rc) {
1214                                 printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1215                                        "returned %d for dev=%s ino=%ld\n",
1216                                        __func__, context, -rc,
1217                                        inode->i_sb->s_id, inode->i_ino);
1218                                 kfree(context);
1219                                 /* Leave with the unlabeled SID */
1220                                 rc = 0;
1221                                 break;
1222                         }
1223                 }
1224                 kfree(context);
1225                 isec->sid = sid;
1226                 break;
1227         case SECURITY_FS_USE_TASK:
1228                 isec->sid = isec->task_sid;
1229                 break;
1230         case SECURITY_FS_USE_TRANS:
1231                 /* Default to the fs SID. */
1232                 isec->sid = sbsec->sid;
1233
1234                 /* Try to obtain a transition SID. */
1235                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1236                 rc = security_transition_sid(isec->task_sid,
1237                                              sbsec->sid,
1238                                              isec->sclass,
1239                                              &sid);
1240                 if (rc)
1241                         goto out_unlock;
1242                 isec->sid = sid;
1243                 break;
1244         case SECURITY_FS_USE_MNTPOINT:
1245                 isec->sid = sbsec->mntpoint_sid;
1246                 break;
1247         default:
1248                 /* Default to the fs superblock SID. */
1249                 isec->sid = sbsec->sid;
1250
1251                 if (sbsec->proc) {
1252                         struct proc_inode *proci = PROC_I(inode);
1253                         if (proci->pde) {
1254                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1255                                 rc = selinux_proc_get_sid(proci->pde,
1256                                                           isec->sclass,
1257                                                           &sid);
1258                                 if (rc)
1259                                         goto out_unlock;
1260                                 isec->sid = sid;
1261                         }
1262                 }
1263                 break;
1264         }
1265
1266         isec->initialized = 1;
1267
1268 out_unlock:
1269         mutex_unlock(&isec->lock);
1270 out:
1271         if (isec->sclass == SECCLASS_FILE)
1272                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1273         return rc;
1274 }
1275
1276 /* Convert a Linux signal to an access vector. */
1277 static inline u32 signal_to_av(int sig)
1278 {
1279         u32 perm = 0;
1280
1281         switch (sig) {
1282         case SIGCHLD:
1283                 /* Commonly granted from child to parent. */
1284                 perm = PROCESS__SIGCHLD;
1285                 break;
1286         case SIGKILL:
1287                 /* Cannot be caught or ignored */
1288                 perm = PROCESS__SIGKILL;
1289                 break;
1290         case SIGSTOP:
1291                 /* Cannot be caught or ignored */
1292                 perm = PROCESS__SIGSTOP;
1293                 break;
1294         default:
1295                 /* All other signals. */
1296                 perm = PROCESS__SIGNAL;
1297                 break;
1298         }
1299
1300         return perm;
1301 }
1302
1303 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1304    fork check, ptrace check, etc. */
1305 static int task_has_perm(struct task_struct *tsk1,
1306                          struct task_struct *tsk2,
1307                          u32 perms)
1308 {
1309         struct task_security_struct *tsec1, *tsec2;
1310
1311         tsec1 = tsk1->security;
1312         tsec2 = tsk2->security;
1313         return avc_has_perm(tsec1->sid, tsec2->sid,
1314                             SECCLASS_PROCESS, perms, NULL);
1315 }
1316
1317 #if CAP_LAST_CAP > 63
1318 #error Fix SELinux to handle capabilities > 63.
1319 #endif
1320
1321 /* Check whether a task is allowed to use a capability. */
1322 static int task_has_capability(struct task_struct *tsk,
1323                                int cap)
1324 {
1325         struct task_security_struct *tsec;
1326         struct avc_audit_data ad;
1327         u16 sclass;
1328         u32 av = CAP_TO_MASK(cap);
1329
1330         tsec = tsk->security;
1331
1332         AVC_AUDIT_DATA_INIT(&ad, CAP);
1333         ad.tsk = tsk;
1334         ad.u.cap = cap;
1335
1336         switch (CAP_TO_INDEX(cap)) {
1337         case 0:
1338                 sclass = SECCLASS_CAPABILITY;
1339                 break;
1340         case 1:
1341                 sclass = SECCLASS_CAPABILITY2;
1342                 break;
1343         default:
1344                 printk(KERN_ERR
1345                        "SELinux:  out of range capability %d\n", cap);
1346                 BUG();
1347         }
1348         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1349 }
1350
1351 /* Check whether a task is allowed to use a system operation. */
1352 static int task_has_system(struct task_struct *tsk,
1353                            u32 perms)
1354 {
1355         struct task_security_struct *tsec;
1356
1357         tsec = tsk->security;
1358
1359         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1360                             SECCLASS_SYSTEM, perms, NULL);
1361 }
1362
1363 /* Check whether a task has a particular permission to an inode.
1364    The 'adp' parameter is optional and allows other audit
1365    data to be passed (e.g. the dentry). */
1366 static int inode_has_perm(struct task_struct *tsk,
1367                           struct inode *inode,
1368                           u32 perms,
1369                           struct avc_audit_data *adp)
1370 {
1371         struct task_security_struct *tsec;
1372         struct inode_security_struct *isec;
1373         struct avc_audit_data ad;
1374
1375         if (unlikely(IS_PRIVATE(inode)))
1376                 return 0;
1377
1378         tsec = tsk->security;
1379         isec = inode->i_security;
1380
1381         if (!adp) {
1382                 adp = &ad;
1383                 AVC_AUDIT_DATA_INIT(&ad, FS);
1384                 ad.u.fs.inode = inode;
1385         }
1386
1387         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1388 }
1389
1390 /* Same as inode_has_perm, but pass explicit audit data containing
1391    the dentry to help the auditing code to more easily generate the
1392    pathname if needed. */
1393 static inline int dentry_has_perm(struct task_struct *tsk,
1394                                   struct vfsmount *mnt,
1395                                   struct dentry *dentry,
1396                                   u32 av)
1397 {
1398         struct inode *inode = dentry->d_inode;
1399         struct avc_audit_data ad;
1400         AVC_AUDIT_DATA_INIT(&ad, FS);
1401         ad.u.fs.path.mnt = mnt;
1402         ad.u.fs.path.dentry = dentry;
1403         return inode_has_perm(tsk, inode, av, &ad);
1404 }
1405
1406 /* Check whether a task can use an open file descriptor to
1407    access an inode in a given way.  Check access to the
1408    descriptor itself, and then use dentry_has_perm to
1409    check a particular permission to the file.
1410    Access to the descriptor is implicitly granted if it
1411    has the same SID as the process.  If av is zero, then
1412    access to the file is not checked, e.g. for cases
1413    where only the descriptor is affected like seek. */
1414 static int file_has_perm(struct task_struct *tsk,
1415                                 struct file *file,
1416                                 u32 av)
1417 {
1418         struct task_security_struct *tsec = tsk->security;
1419         struct file_security_struct *fsec = file->f_security;
1420         struct inode *inode = file->f_path.dentry->d_inode;
1421         struct avc_audit_data ad;
1422         int rc;
1423
1424         AVC_AUDIT_DATA_INIT(&ad, FS);
1425         ad.u.fs.path = file->f_path;
1426
1427         if (tsec->sid != fsec->sid) {
1428                 rc = avc_has_perm(tsec->sid, fsec->sid,
1429                                   SECCLASS_FD,
1430                                   FD__USE,
1431                                   &ad);
1432                 if (rc)
1433                         return rc;
1434         }
1435
1436         /* av is zero if only checking access to the descriptor. */
1437         if (av)
1438                 return inode_has_perm(tsk, inode, av, &ad);
1439
1440         return 0;
1441 }
1442
1443 /* Check whether a task can create a file. */
1444 static int may_create(struct inode *dir,
1445                       struct dentry *dentry,
1446                       u16 tclass)
1447 {
1448         struct task_security_struct *tsec;
1449         struct inode_security_struct *dsec;
1450         struct superblock_security_struct *sbsec;
1451         u32 newsid;
1452         struct avc_audit_data ad;
1453         int rc;
1454
1455         tsec = current->security;
1456         dsec = dir->i_security;
1457         sbsec = dir->i_sb->s_security;
1458
1459         AVC_AUDIT_DATA_INIT(&ad, FS);
1460         ad.u.fs.path.dentry = dentry;
1461
1462         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1463                           DIR__ADD_NAME | DIR__SEARCH,
1464                           &ad);
1465         if (rc)
1466                 return rc;
1467
1468         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1469                 newsid = tsec->create_sid;
1470         } else {
1471                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1472                                              &newsid);
1473                 if (rc)
1474                         return rc;
1475         }
1476
1477         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1478         if (rc)
1479                 return rc;
1480
1481         return avc_has_perm(newsid, sbsec->sid,
1482                             SECCLASS_FILESYSTEM,
1483                             FILESYSTEM__ASSOCIATE, &ad);
1484 }
1485
1486 /* Check whether a task can create a key. */
1487 static int may_create_key(u32 ksid,
1488                           struct task_struct *ctx)
1489 {
1490         struct task_security_struct *tsec;
1491
1492         tsec = ctx->security;
1493
1494         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1495 }
1496
1497 #define MAY_LINK        0
1498 #define MAY_UNLINK      1
1499 #define MAY_RMDIR       2
1500
1501 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1502 static int may_link(struct inode *dir,
1503                     struct dentry *dentry,
1504                     int kind)
1505
1506 {
1507         struct task_security_struct *tsec;
1508         struct inode_security_struct *dsec, *isec;
1509         struct avc_audit_data ad;
1510         u32 av;
1511         int rc;
1512
1513         tsec = current->security;
1514         dsec = dir->i_security;
1515         isec = dentry->d_inode->i_security;
1516
1517         AVC_AUDIT_DATA_INIT(&ad, FS);
1518         ad.u.fs.path.dentry = dentry;
1519
1520         av = DIR__SEARCH;
1521         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1522         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1523         if (rc)
1524                 return rc;
1525
1526         switch (kind) {
1527         case MAY_LINK:
1528                 av = FILE__LINK;
1529                 break;
1530         case MAY_UNLINK:
1531                 av = FILE__UNLINK;
1532                 break;
1533         case MAY_RMDIR:
1534                 av = DIR__RMDIR;
1535                 break;
1536         default:
1537                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1538                         __func__, kind);
1539                 return 0;
1540         }
1541
1542         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1543         return rc;
1544 }
1545
1546 static inline int may_rename(struct inode *old_dir,
1547                              struct dentry *old_dentry,
1548                              struct inode *new_dir,
1549                              struct dentry *new_dentry)
1550 {
1551         struct task_security_struct *tsec;
1552         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1553         struct avc_audit_data ad;
1554         u32 av;
1555         int old_is_dir, new_is_dir;
1556         int rc;
1557
1558         tsec = current->security;
1559         old_dsec = old_dir->i_security;
1560         old_isec = old_dentry->d_inode->i_security;
1561         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1562         new_dsec = new_dir->i_security;
1563
1564         AVC_AUDIT_DATA_INIT(&ad, FS);
1565
1566         ad.u.fs.path.dentry = old_dentry;
1567         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1568                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1569         if (rc)
1570                 return rc;
1571         rc = avc_has_perm(tsec->sid, old_isec->sid,
1572                           old_isec->sclass, FILE__RENAME, &ad);
1573         if (rc)
1574                 return rc;
1575         if (old_is_dir && new_dir != old_dir) {
1576                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1577                                   old_isec->sclass, DIR__REPARENT, &ad);
1578                 if (rc)
1579                         return rc;
1580         }
1581
1582         ad.u.fs.path.dentry = new_dentry;
1583         av = DIR__ADD_NAME | DIR__SEARCH;
1584         if (new_dentry->d_inode)
1585                 av |= DIR__REMOVE_NAME;
1586         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1587         if (rc)
1588                 return rc;
1589         if (new_dentry->d_inode) {
1590                 new_isec = new_dentry->d_inode->i_security;
1591                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1592                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1593                                   new_isec->sclass,
1594                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1595                 if (rc)
1596                         return rc;
1597         }
1598
1599         return 0;
1600 }
1601
1602 /* Check whether a task can perform a filesystem operation. */
1603 static int superblock_has_perm(struct task_struct *tsk,
1604                                struct super_block *sb,
1605                                u32 perms,
1606                                struct avc_audit_data *ad)
1607 {
1608         struct task_security_struct *tsec;
1609         struct superblock_security_struct *sbsec;
1610
1611         tsec = tsk->security;
1612         sbsec = sb->s_security;
1613         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1614                             perms, ad);
1615 }
1616
1617 /* Convert a Linux mode and permission mask to an access vector. */
1618 static inline u32 file_mask_to_av(int mode, int mask)
1619 {
1620         u32 av = 0;
1621
1622         if ((mode & S_IFMT) != S_IFDIR) {
1623                 if (mask & MAY_EXEC)
1624                         av |= FILE__EXECUTE;
1625                 if (mask & MAY_READ)
1626                         av |= FILE__READ;
1627
1628                 if (mask & MAY_APPEND)
1629                         av |= FILE__APPEND;
1630                 else if (mask & MAY_WRITE)
1631                         av |= FILE__WRITE;
1632
1633         } else {
1634                 if (mask & MAY_EXEC)
1635                         av |= DIR__SEARCH;
1636                 if (mask & MAY_WRITE)
1637                         av |= DIR__WRITE;
1638                 if (mask & MAY_READ)
1639                         av |= DIR__READ;
1640         }
1641
1642         return av;
1643 }
1644
1645 /*
1646  * Convert a file mask to an access vector and include the correct open
1647  * open permission.
1648  */
1649 static inline u32 open_file_mask_to_av(int mode, int mask)
1650 {
1651         u32 av = file_mask_to_av(mode, mask);
1652
1653         if (selinux_policycap_openperm) {
1654                 /*
1655                  * lnk files and socks do not really have an 'open'
1656                  */
1657                 if (S_ISREG(mode))
1658                         av |= FILE__OPEN;
1659                 else if (S_ISCHR(mode))
1660                         av |= CHR_FILE__OPEN;
1661                 else if (S_ISBLK(mode))
1662                         av |= BLK_FILE__OPEN;
1663                 else if (S_ISFIFO(mode))
1664                         av |= FIFO_FILE__OPEN;
1665                 else if (S_ISDIR(mode))
1666                         av |= DIR__OPEN;
1667                 else
1668                         printk(KERN_ERR "SELinux: WARNING: inside %s with "
1669                                 "unknown mode:%x\n", __func__, mode);
1670         }
1671         return av;
1672 }
1673
1674 /* Convert a Linux file to an access vector. */
1675 static inline u32 file_to_av(struct file *file)
1676 {
1677         u32 av = 0;
1678
1679         if (file->f_mode & FMODE_READ)
1680                 av |= FILE__READ;
1681         if (file->f_mode & FMODE_WRITE) {
1682                 if (file->f_flags & O_APPEND)
1683                         av |= FILE__APPEND;
1684                 else
1685                         av |= FILE__WRITE;
1686         }
1687         if (!av) {
1688                 /*
1689                  * Special file opened with flags 3 for ioctl-only use.
1690                  */
1691                 av = FILE__IOCTL;
1692         }
1693
1694         return av;
1695 }
1696
1697 /* Hook functions begin here. */
1698
1699 static int selinux_ptrace(struct task_struct *parent,
1700                           struct task_struct *child,
1701                           unsigned int mode)
1702 {
1703         int rc;
1704
1705         rc = secondary_ops->ptrace(parent, child, mode);
1706         if (rc)
1707                 return rc;
1708
1709         if (mode == PTRACE_MODE_READ) {
1710                 struct task_security_struct *tsec = parent->security;
1711                 struct task_security_struct *csec = child->security;
1712                 return avc_has_perm(tsec->sid, csec->sid,
1713                                     SECCLASS_FILE, FILE__READ, NULL);
1714         }
1715
1716         return task_has_perm(parent, child, PROCESS__PTRACE);
1717 }
1718
1719 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1720                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1721 {
1722         int error;
1723
1724         error = task_has_perm(current, target, PROCESS__GETCAP);
1725         if (error)
1726                 return error;
1727
1728         return secondary_ops->capget(target, effective, inheritable, permitted);
1729 }
1730
1731 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1732                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1733 {
1734         int error;
1735
1736         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1737         if (error)
1738                 return error;
1739
1740         return task_has_perm(current, target, PROCESS__SETCAP);
1741 }
1742
1743 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1744                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1745 {
1746         secondary_ops->capset_set(target, effective, inheritable, permitted);
1747 }
1748
1749 static int selinux_capable(struct task_struct *tsk, int cap)
1750 {
1751         int rc;
1752
1753         rc = secondary_ops->capable(tsk, cap);
1754         if (rc)
1755                 return rc;
1756
1757         return task_has_capability(tsk, cap);
1758 }
1759
1760 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1761 {
1762         int buflen, rc;
1763         char *buffer, *path, *end;
1764
1765         rc = -ENOMEM;
1766         buffer = (char *)__get_free_page(GFP_KERNEL);
1767         if (!buffer)
1768                 goto out;
1769
1770         buflen = PAGE_SIZE;
1771         end = buffer+buflen;
1772         *--end = '\0';
1773         buflen--;
1774         path = end-1;
1775         *path = '/';
1776         while (table) {
1777                 const char *name = table->procname;
1778                 size_t namelen = strlen(name);
1779                 buflen -= namelen + 1;
1780                 if (buflen < 0)
1781                         goto out_free;
1782                 end -= namelen;
1783                 memcpy(end, name, namelen);
1784                 *--end = '/';
1785                 path = end;
1786                 table = table->parent;
1787         }
1788         buflen -= 4;
1789         if (buflen < 0)
1790                 goto out_free;
1791         end -= 4;
1792         memcpy(end, "/sys", 4);
1793         path = end;
1794         rc = security_genfs_sid("proc", path, tclass, sid);
1795 out_free:
1796         free_page((unsigned long)buffer);
1797 out:
1798         return rc;
1799 }
1800
1801 static int selinux_sysctl(ctl_table *table, int op)
1802 {
1803         int error = 0;
1804         u32 av;
1805         struct task_security_struct *tsec;
1806         u32 tsid;
1807         int rc;
1808
1809         rc = secondary_ops->sysctl(table, op);
1810         if (rc)
1811                 return rc;
1812
1813         tsec = current->security;
1814
1815         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1816                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1817         if (rc) {
1818                 /* Default to the well-defined sysctl SID. */
1819                 tsid = SECINITSID_SYSCTL;
1820         }
1821
1822         /* The op values are "defined" in sysctl.c, thereby creating
1823          * a bad coupling between this module and sysctl.c */
1824         if (op == 001) {
1825                 error = avc_has_perm(tsec->sid, tsid,
1826                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1827         } else {
1828                 av = 0;
1829                 if (op & 004)
1830                         av |= FILE__READ;
1831                 if (op & 002)
1832                         av |= FILE__WRITE;
1833                 if (av)
1834                         error = avc_has_perm(tsec->sid, tsid,
1835                                              SECCLASS_FILE, av, NULL);
1836         }
1837
1838         return error;
1839 }
1840
1841 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1842 {
1843         int rc = 0;
1844
1845         if (!sb)
1846                 return 0;
1847
1848         switch (cmds) {
1849         case Q_SYNC:
1850         case Q_QUOTAON:
1851         case Q_QUOTAOFF:
1852         case Q_SETINFO:
1853         case Q_SETQUOTA:
1854                 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1855                                          NULL);
1856                 break;
1857         case Q_GETFMT:
1858         case Q_GETINFO:
1859         case Q_GETQUOTA:
1860                 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1861                                          NULL);
1862                 break;
1863         default:
1864                 rc = 0;  /* let the kernel handle invalid cmds */
1865                 break;
1866         }
1867         return rc;
1868 }
1869
1870 static int selinux_quota_on(struct dentry *dentry)
1871 {
1872         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1873 }
1874
1875 static int selinux_syslog(int type)
1876 {
1877         int rc;
1878
1879         rc = secondary_ops->syslog(type);
1880         if (rc)
1881                 return rc;
1882
1883         switch (type) {
1884         case 3:         /* Read last kernel messages */
1885         case 10:        /* Return size of the log buffer */
1886                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1887                 break;
1888         case 6:         /* Disable logging to console */
1889         case 7:         /* Enable logging to console */
1890         case 8:         /* Set level of messages printed to console */
1891                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1892                 break;
1893         case 0:         /* Close log */
1894         case 1:         /* Open log */
1895         case 2:         /* Read from log */
1896         case 4:         /* Read/clear last kernel messages */
1897         case 5:         /* Clear ring buffer */
1898         default:
1899                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1900                 break;
1901         }
1902         return rc;
1903 }
1904
1905 /*
1906  * Check that a process has enough memory to allocate a new virtual
1907  * mapping. 0 means there is enough memory for the allocation to
1908  * succeed and -ENOMEM implies there is not.
1909  *
1910  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1911  * if the capability is granted, but __vm_enough_memory requires 1 if
1912  * the capability is granted.
1913  *
1914  * Do not audit the selinux permission check, as this is applied to all
1915  * processes that allocate mappings.
1916  */
1917 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1918 {
1919         int rc, cap_sys_admin = 0;
1920         struct task_security_struct *tsec = current->security;
1921
1922         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1923         if (rc == 0)
1924                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1925                                           SECCLASS_CAPABILITY,
1926                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1927                                           0,
1928                                           NULL);
1929
1930         if (rc == 0)
1931                 cap_sys_admin = 1;
1932
1933         return __vm_enough_memory(mm, pages, cap_sys_admin);
1934 }
1935
1936 /**
1937  * task_tracer_task - return the task that is tracing the given task
1938  * @task:               task to consider
1939  *
1940  * Returns NULL if noone is tracing @task, or the &struct task_struct
1941  * pointer to its tracer.
1942  *
1943  * Must be called under rcu_read_lock().
1944  */
1945 static struct task_struct *task_tracer_task(struct task_struct *task)
1946 {
1947         if (task->ptrace & PT_PTRACED)
1948                 return rcu_dereference(task->parent);
1949         return NULL;
1950 }
1951
1952 /* binprm security operations */
1953
1954 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1955 {
1956         struct bprm_security_struct *bsec;
1957
1958         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1959         if (!bsec)
1960                 return -ENOMEM;
1961
1962         bsec->sid = SECINITSID_UNLABELED;
1963         bsec->set = 0;
1964
1965         bprm->security = bsec;
1966         return 0;
1967 }
1968
1969 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1970 {
1971         struct task_security_struct *tsec;
1972         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1973         struct inode_security_struct *isec;
1974         struct bprm_security_struct *bsec;
1975         u32 newsid;
1976         struct avc_audit_data ad;
1977         int rc;
1978
1979         rc = secondary_ops->bprm_set_security(bprm);
1980         if (rc)
1981                 return rc;
1982
1983         bsec = bprm->security;
1984
1985         if (bsec->set)
1986                 return 0;
1987
1988         tsec = current->security;
1989         isec = inode->i_security;
1990
1991         /* Default to the current task SID. */
1992         bsec->sid = tsec->sid;
1993
1994         /* Reset fs, key, and sock SIDs on execve. */
1995         tsec->create_sid = 0;
1996         tsec->keycreate_sid = 0;
1997         tsec->sockcreate_sid = 0;
1998
1999         if (tsec->exec_sid) {
2000                 newsid = tsec->exec_sid;
2001                 /* Reset exec SID on execve. */
2002                 tsec->exec_sid = 0;
2003         } else {
2004                 /* Check for a default transition on this program. */
2005                 rc = security_transition_sid(tsec->sid, isec->sid,
2006                                              SECCLASS_PROCESS, &newsid);
2007                 if (rc)
2008                         return rc;
2009         }
2010
2011         AVC_AUDIT_DATA_INIT(&ad, FS);
2012         ad.u.fs.path = bprm->file->f_path;
2013
2014         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2015                 newsid = tsec->sid;
2016
2017         if (tsec->sid == newsid) {
2018                 rc = avc_has_perm(tsec->sid, isec->sid,
2019                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2020                 if (rc)
2021                         return rc;
2022         } else {
2023                 /* Check permissions for the transition. */
2024                 rc = avc_has_perm(tsec->sid, newsid,
2025                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2026                 if (rc)
2027                         return rc;
2028
2029                 rc = avc_has_perm(newsid, isec->sid,
2030                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2031                 if (rc)
2032                         return rc;
2033
2034                 /* Clear any possibly unsafe personality bits on exec: */
2035                 current->personality &= ~PER_CLEAR_ON_SETID;
2036
2037                 /* Set the security field to the new SID. */
2038                 bsec->sid = newsid;
2039         }
2040
2041         bsec->set = 1;
2042         return 0;
2043 }
2044
2045 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2046 {
2047         return secondary_ops->bprm_check_security(bprm);
2048 }
2049
2050
2051 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2052 {
2053         struct task_security_struct *tsec = current->security;
2054         int atsecure = 0;
2055
2056         if (tsec->osid != tsec->sid) {
2057                 /* Enable secure mode for SIDs transitions unless
2058                    the noatsecure permission is granted between
2059                    the two SIDs, i.e. ahp returns 0. */
2060                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2061                                          SECCLASS_PROCESS,
2062                                          PROCESS__NOATSECURE, NULL);
2063         }
2064
2065         return (atsecure || secondary_ops->bprm_secureexec(bprm));
2066 }
2067
2068 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2069 {
2070         kfree(bprm->security);
2071         bprm->security = NULL;
2072 }
2073
2074 extern struct vfsmount *selinuxfs_mount;
2075 extern struct dentry *selinux_null;
2076
2077 /* Derived from fs/exec.c:flush_old_files. */
2078 static inline void flush_unauthorized_files(struct files_struct *files)
2079 {
2080         struct avc_audit_data ad;
2081         struct file *file, *devnull = NULL;
2082         struct tty_struct *tty;
2083         struct fdtable *fdt;
2084         long j = -1;
2085         int drop_tty = 0;
2086
2087         mutex_lock(&tty_mutex);
2088         tty = get_current_tty();
2089         if (tty) {
2090                 file_list_lock();
2091                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2092                 if (file) {
2093                         /* Revalidate access to controlling tty.
2094                            Use inode_has_perm on the tty inode directly rather
2095                            than using file_has_perm, as this particular open
2096                            file may belong to another process and we are only
2097                            interested in the inode-based check here. */
2098                         struct inode *inode = file->f_path.dentry->d_inode;
2099                         if (inode_has_perm(current, inode,
2100                                            FILE__READ | FILE__WRITE, NULL)) {
2101                                 drop_tty = 1;
2102                         }
2103                 }
2104                 file_list_unlock();
2105         }
2106         mutex_unlock(&tty_mutex);
2107         /* Reset controlling tty. */
2108         if (drop_tty)
2109                 no_tty();
2110
2111         /* Revalidate access to inherited open files. */
2112
2113         AVC_AUDIT_DATA_INIT(&ad, FS);
2114
2115         spin_lock(&files->file_lock);
2116         for (;;) {
2117                 unsigned long set, i;
2118                 int fd;
2119
2120                 j++;
2121                 i = j * __NFDBITS;
2122                 fdt = files_fdtable(files);
2123                 if (i >= fdt->max_fds)
2124                         break;
2125                 set = fdt->open_fds->fds_bits[j];
2126                 if (!set)
2127                         continue;
2128                 spin_unlock(&files->file_lock);
2129                 for ( ; set ; i++, set >>= 1) {
2130                         if (set & 1) {
2131                                 file = fget(i);
2132                                 if (!file)
2133                                         continue;
2134                                 if (file_has_perm(current,
2135                                                   file,
2136                                                   file_to_av(file))) {
2137                                         sys_close(i);
2138                                         fd = get_unused_fd();
2139                                         if (fd != i) {
2140                                                 if (fd >= 0)
2141                                                         put_unused_fd(fd);
2142                                                 fput(file);
2143                                                 continue;
2144                                         }
2145                                         if (devnull) {
2146                                                 get_file(devnull);
2147                                         } else {
2148                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2149                                                 if (IS_ERR(devnull)) {
2150                                                         devnull = NULL;
2151                                                         put_unused_fd(fd);
2152                                                         fput(file);
2153                                                         continue;
2154                                                 }
2155                                         }
2156                                         fd_install(fd, devnull);
2157                                 }
2158                                 fput(file);
2159                         }
2160                 }
2161                 spin_lock(&files->file_lock);
2162
2163         }
2164         spin_unlock(&files->file_lock);
2165 }
2166
2167 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2168 {
2169         struct task_security_struct *tsec;
2170         struct bprm_security_struct *bsec;
2171         u32 sid;
2172         int rc;
2173
2174         secondary_ops->bprm_apply_creds(bprm, unsafe);
2175
2176         tsec = current->security;
2177
2178         bsec = bprm->security;
2179         sid = bsec->sid;
2180
2181         tsec->osid = tsec->sid;
2182         bsec->unsafe = 0;
2183         if (tsec->sid != sid) {
2184                 /* Check for shared state.  If not ok, leave SID
2185                    unchanged and kill. */
2186                 if (unsafe & LSM_UNSAFE_SHARE) {
2187                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2188                                         PROCESS__SHARE, NULL);
2189                         if (rc) {
2190                                 bsec->unsafe = 1;
2191                                 return;
2192                         }
2193                 }
2194
2195                 /* Check for ptracing, and update the task SID if ok.
2196                    Otherwise, leave SID unchanged and kill. */
2197                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2198                         struct task_struct *tracer;
2199                         struct task_security_struct *sec;
2200                         u32 ptsid = 0;
2201
2202                         rcu_read_lock();
2203                         tracer = task_tracer_task(current);
2204                         if (likely(tracer != NULL)) {
2205                                 sec = tracer->security;
2206                                 ptsid = sec->sid;
2207                         }
2208                         rcu_read_unlock();
2209
2210                         if (ptsid != 0) {
2211                                 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2212                                                   PROCESS__PTRACE, NULL);
2213                                 if (rc) {
2214                                         bsec->unsafe = 1;
2215                                         return;
2216                                 }
2217                         }
2218                 }
2219                 tsec->sid = sid;
2220         }
2221 }
2222
2223 /*
2224  * called after apply_creds without the task lock held
2225  */
2226 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2227 {
2228         struct task_security_struct *tsec;
2229         struct rlimit *rlim, *initrlim;
2230         struct itimerval itimer;
2231         struct bprm_security_struct *bsec;
2232         int rc, i;
2233
2234         tsec = current->security;
2235         bsec = bprm->security;
2236
2237         if (bsec->unsafe) {
2238                 force_sig_specific(SIGKILL, current);
2239                 return;
2240         }
2241         if (tsec->osid == tsec->sid)
2242                 return;
2243
2244         /* Close files for which the new task SID is not authorized. */
2245         flush_unauthorized_files(current->files);
2246
2247         /* Check whether the new SID can inherit signal state
2248            from the old SID.  If not, clear itimers to avoid
2249            subsequent signal generation and flush and unblock
2250            signals. This must occur _after_ the task SID has
2251           been updated so that any kill done after the flush
2252           will be checked against the new SID. */
2253         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2254                           PROCESS__SIGINH, NULL);
2255         if (rc) {
2256                 memset(&itimer, 0, sizeof itimer);
2257                 for (i = 0; i < 3; i++)
2258                         do_setitimer(i, &itimer, NULL);
2259                 flush_signals(current);
2260                 spin_lock_irq(&current->sighand->siglock);
2261                 flush_signal_handlers(current, 1);
2262                 sigemptyset(&current->blocked);
2263                 recalc_sigpending();
2264                 spin_unlock_irq(&current->sighand->siglock);
2265         }
2266
2267         /* Always clear parent death signal on SID transitions. */
2268         current->pdeath_signal = 0;
2269
2270         /* Check whether the new SID can inherit resource limits
2271            from the old SID.  If not, reset all soft limits to
2272            the lower of the current task's hard limit and the init
2273            task's soft limit.  Note that the setting of hard limits
2274            (even to lower them) can be controlled by the setrlimit
2275            check. The inclusion of the init task's soft limit into
2276            the computation is to avoid resetting soft limits higher
2277            than the default soft limit for cases where the default
2278            is lower than the hard limit, e.g. RLIMIT_CORE or
2279            RLIMIT_STACK.*/
2280         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2281                           PROCESS__RLIMITINH, NULL);
2282         if (rc) {
2283                 for (i = 0; i < RLIM_NLIMITS; i++) {
2284                         rlim = current->signal->rlim + i;
2285                         initrlim = init_task.signal->rlim+i;
2286                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2287                 }
2288                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2289                         /*
2290                          * This will cause RLIMIT_CPU calculations
2291                          * to be refigured.
2292                          */
2293                         current->it_prof_expires = jiffies_to_cputime(1);
2294                 }
2295         }
2296
2297         /* Wake up the parent if it is waiting so that it can
2298            recheck wait permission to the new task SID. */
2299         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2300 }
2301
2302 /* superblock security operations */
2303
2304 static int selinux_sb_alloc_security(struct super_block *sb)
2305 {
2306         return superblock_alloc_security(sb);
2307 }
2308
2309 static void selinux_sb_free_security(struct super_block *sb)
2310 {
2311         superblock_free_security(sb);
2312 }
2313
2314 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2315 {
2316         if (plen > olen)
2317                 return 0;
2318
2319         return !memcmp(prefix, option, plen);
2320 }
2321
2322 static inline int selinux_option(char *option, int len)
2323 {
2324         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2325                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2326                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2327                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2328 }
2329
2330 static inline void take_option(char **to, char *from, int *first, int len)
2331 {
2332         if (!*first) {
2333                 **to = ',';
2334                 *to += 1;
2335         } else
2336                 *first = 0;
2337         memcpy(*to, from, len);
2338         *to += len;
2339 }
2340
2341 static inline void take_selinux_option(char **to, char *from, int *first,
2342                                        int len)
2343 {
2344         int current_size = 0;
2345
2346         if (!*first) {
2347                 **to = '|';
2348                 *to += 1;
2349         } else
2350                 *first = 0;
2351
2352         while (current_size < len) {
2353                 if (*from != '"') {
2354                         **to = *from;
2355                         *to += 1;
2356                 }
2357                 from += 1;
2358                 current_size += 1;
2359         }
2360 }
2361
2362 static int selinux_sb_copy_data(char *orig, char *copy)
2363 {
2364         int fnosec, fsec, rc = 0;
2365         char *in_save, *in_curr, *in_end;
2366         char *sec_curr, *nosec_save, *nosec;
2367         int open_quote = 0;
2368
2369         in_curr = orig;
2370         sec_curr = copy;
2371
2372         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2373         if (!nosec) {
2374                 rc = -ENOMEM;
2375                 goto out;
2376         }
2377
2378         nosec_save = nosec;
2379         fnosec = fsec = 1;
2380         in_save = in_end = orig;
2381
2382         do {
2383                 if (*in_end == '"')
2384                         open_quote = !open_quote;
2385                 if ((*in_end == ',' && open_quote == 0) ||
2386                                 *in_end == '\0') {
2387                         int len = in_end - in_curr;
2388
2389                         if (selinux_option(in_curr, len))
2390                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2391                         else
2392                                 take_option(&nosec, in_curr, &fnosec, len);
2393
2394                         in_curr = in_end + 1;
2395                 }
2396         } while (*in_end++);
2397
2398         strcpy(in_save, nosec_save);
2399         free_page((unsigned long)nosec_save);
2400 out:
2401         return rc;
2402 }
2403
2404 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2405 {
2406         struct avc_audit_data ad;
2407         int rc;
2408
2409         rc = superblock_doinit(sb, data);
2410         if (rc)
2411                 return rc;
2412
2413         AVC_AUDIT_DATA_INIT(&ad, FS);
2414         ad.u.fs.path.dentry = sb->s_root;
2415         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2416 }
2417
2418 static int selinux_sb_statfs(struct dentry *dentry)
2419 {
2420         struct avc_audit_data ad;
2421
2422         AVC_AUDIT_DATA_INIT(&ad, FS);
2423         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2424         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2425 }
2426
2427 static int selinux_mount(char *dev_name,
2428                          struct path *path,
2429                          char *type,
2430                          unsigned long flags,
2431                          void *data)
2432 {
2433         int rc;
2434
2435         rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2436         if (rc)
2437                 return rc;
2438
2439         if (flags & MS_REMOUNT)
2440                 return superblock_has_perm(current, path->mnt->mnt_sb,
2441                                            FILESYSTEM__REMOUNT, NULL);
2442         else
2443                 return dentry_has_perm(current, path->mnt, path->dentry,
2444                                        FILE__MOUNTON);
2445 }
2446
2447 static int selinux_umount(struct vfsmount *mnt, int flags)
2448 {
2449         int rc;
2450
2451         rc = secondary_ops->sb_umount(mnt, flags);
2452         if (rc)
2453                 return rc;
2454
2455         return superblock_has_perm(current, mnt->mnt_sb,
2456                                    FILESYSTEM__UNMOUNT, NULL);
2457 }
2458
2459 /* inode security operations */
2460
2461 static int selinux_inode_alloc_security(struct inode *inode)
2462 {
2463         return inode_alloc_security(inode);
2464 }
2465
2466 static void selinux_inode_free_security(struct inode *inode)
2467 {
2468         inode_free_security(inode);
2469 }
2470
2471 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2472                                        char **name, void **value,
2473                                        size_t *len)
2474 {
2475         struct task_security_struct *tsec;
2476         struct inode_security_struct *dsec;
2477         struct superblock_security_struct *sbsec;
2478         u32 newsid, clen;
2479         int rc;
2480         char *namep = NULL, *context;
2481
2482         tsec = current->security;
2483         dsec = dir->i_security;
2484         sbsec = dir->i_sb->s_security;
2485
2486         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2487                 newsid = tsec->create_sid;
2488         } else {
2489                 rc = security_transition_sid(tsec->sid, dsec->sid,
2490                                              inode_mode_to_security_class(inode->i_mode),
2491                                              &newsid);
2492                 if (rc) {
2493                         printk(KERN_WARNING "%s:  "
2494                                "security_transition_sid failed, rc=%d (dev=%s "
2495                                "ino=%ld)\n",
2496                                __func__,
2497                                -rc, inode->i_sb->s_id, inode->i_ino);
2498                         return rc;
2499                 }
2500         }
2501
2502         /* Possibly defer initialization to selinux_complete_init. */
2503         if (sbsec->initialized) {
2504                 struct inode_security_struct *isec = inode->i_security;
2505                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2506                 isec->sid = newsid;
2507                 isec->initialized = 1;
2508         }
2509
2510         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2511                 return -EOPNOTSUPP;
2512
2513         if (name) {
2514                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2515                 if (!namep)
2516                         return -ENOMEM;
2517                 *name = namep;
2518         }
2519
2520         if (value && len) {
2521                 rc = security_sid_to_context_force(newsid, &context, &clen);
2522                 if (rc) {
2523                         kfree(namep);
2524                         return rc;
2525                 }
2526                 *value = context;
2527                 *len = clen;
2528         }
2529
2530         return 0;
2531 }
2532
2533 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2534 {
2535         return may_create(dir, dentry, SECCLASS_FILE);
2536 }
2537
2538 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2539 {
2540         int rc;
2541
2542         rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2543         if (rc)
2544                 return rc;
2545         return may_link(dir, old_dentry, MAY_LINK);
2546 }
2547
2548 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2549 {
2550         int rc;
2551
2552         rc = secondary_ops->inode_unlink(dir, dentry);
2553         if (rc)
2554                 return rc;
2555         return may_link(dir, dentry, MAY_UNLINK);
2556 }
2557
2558 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2559 {
2560         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2561 }
2562
2563 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2564 {
2565         return may_create(dir, dentry, SECCLASS_DIR);
2566 }
2567
2568 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2569 {
2570         return may_link(dir, dentry, MAY_RMDIR);
2571 }
2572
2573 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2574 {
2575         int rc;
2576
2577         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2578         if (rc)
2579                 return rc;
2580
2581         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2582 }
2583
2584 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2585                                 struct inode *new_inode, struct dentry *new_dentry)
2586 {
2587         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2588 }
2589
2590 static int selinux_inode_readlink(struct dentry *dentry)
2591 {
2592         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2593 }
2594
2595 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2596 {
2597         int rc;
2598
2599         rc = secondary_ops->inode_follow_link(dentry, nameidata);
2600         if (rc)
2601                 return rc;
2602         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2603 }
2604
2605 static int selinux_inode_permission(struct inode *inode, int mask,
2606                                     struct nameidata *nd)
2607 {
2608         int rc;
2609
2610         rc = secondary_ops->inode_permission(inode, mask, nd);
2611         if (rc)
2612                 return rc;
2613
2614         if (!mask) {
2615                 /* No permission to check.  Existence test. */
2616                 return 0;
2617         }
2618
2619         return inode_has_perm(current, inode,
2620                                open_file_mask_to_av(inode->i_mode, mask), NULL);
2621 }
2622
2623 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2624 {
2625         int rc;
2626
2627         rc = secondary_ops->inode_setattr(dentry, iattr);
2628         if (rc)
2629                 return rc;
2630
2631         if (iattr->ia_valid & ATTR_FORCE)
2632                 return 0;
2633
2634         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2635                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2636                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2637
2638         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2639 }
2640
2641 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2642 {
2643         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2644 }
2645
2646 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2647 {
2648         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2649                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2650                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2651                         if (!capable(CAP_SETFCAP))
2652                                 return -EPERM;
2653                 } else if (!capable(CAP_SYS_ADMIN)) {
2654                         /* A different attribute in the security namespace.
2655                            Restrict to administrator. */
2656                         return -EPERM;
2657                 }
2658         }
2659
2660         /* Not an attribute we recognize, so just check the
2661            ordinary setattr permission. */
2662         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2663 }
2664
2665 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2666                                   const void *value, size_t size, int flags)
2667 {
2668         struct task_security_struct *tsec = current->security;
2669         struct inode *inode = dentry->d_inode;
2670         struct inode_security_struct *isec = inode->i_security;
2671         struct superblock_security_struct *sbsec;
2672         struct avc_audit_data ad;
2673         u32 newsid;
2674         int rc = 0;
2675
2676         if (strcmp(name, XATTR_NAME_SELINUX))
2677                 return selinux_inode_setotherxattr(dentry, name);
2678
2679         sbsec = inode->i_sb->s_security;
2680         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2681                 return -EOPNOTSUPP;
2682
2683         if (!is_owner_or_cap(inode))
2684                 return -EPERM;
2685
2686         AVC_AUDIT_DATA_INIT(&ad, FS);
2687         ad.u.fs.path.dentry = dentry;
2688
2689         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2690                           FILE__RELABELFROM, &ad);
2691         if (rc)
2692                 return rc;
2693
2694         rc = security_context_to_sid(value, size, &newsid);
2695         if (rc == -EINVAL) {
2696                 if (!capable(CAP_MAC_ADMIN))
2697                         return rc;
2698                 rc = security_context_to_sid_force(value, size, &newsid);
2699         }
2700         if (rc)
2701                 return rc;
2702
2703         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2704                           FILE__RELABELTO, &ad);
2705         if (rc)
2706                 return rc;
2707
2708         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2709                                           isec->sclass);
2710         if (rc)
2711                 return rc;
2712
2713         return avc_has_perm(newsid,
2714                             sbsec->sid,
2715                             SECCLASS_FILESYSTEM,
2716                             FILESYSTEM__ASSOCIATE,
2717                             &ad);
2718 }
2719
2720 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2721                                         const void *value, size_t size,
2722                                         int flags)
2723 {
2724         struct inode *inode = dentry->d_inode;
2725         struct inode_security_struct *isec = inode->i_security;
2726         u32 newsid;
2727         int rc;
2728
2729         if (strcmp(name, XATTR_NAME_SELINUX)) {
2730                 /* Not an attribute we recognize, so nothing to do. */
2731                 return;
2732         }
2733
2734         rc = security_context_to_sid_force(value, size, &newsid);
2735         if (rc) {
2736                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2737                        "for (%s, %lu), rc=%d\n",
2738                        inode->i_sb->s_id, inode->i_ino, -rc);
2739                 return;
2740         }
2741
2742         isec->sid = newsid;
2743         return;
2744 }
2745
2746 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2747 {
2748         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2749 }
2750
2751 static int selinux_inode_listxattr(struct dentry *dentry)
2752 {
2753         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2754 }
2755
2756 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2757 {
2758         if (strcmp(name, XATTR_NAME_SELINUX))
2759                 return selinux_inode_setotherxattr(dentry, name);
2760
2761         /* No one is allowed to remove a SELinux security label.
2762            You can change the label, but all data must be labeled. */
2763         return -EACCES;
2764 }
2765
2766 /*
2767  * Copy the inode security context value to the user.
2768  *
2769  * Permission check is handled by selinux_inode_getxattr hook.
2770  */
2771 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2772 {
2773         u32 size;
2774         int error;
2775         char *context = NULL;
2776         struct task_security_struct *tsec = current->security;
2777         struct inode_security_struct *isec = inode->i_security;
2778
2779         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2780                 return -EOPNOTSUPP;
2781
2782         /*
2783          * If the caller has CAP_MAC_ADMIN, then get the raw context
2784          * value even if it is not defined by current policy; otherwise,
2785          * use the in-core value under current policy.
2786          * Use the non-auditing forms of the permission checks since
2787          * getxattr may be called by unprivileged processes commonly
2788          * and lack of permission just means that we fall back to the
2789          * in-core context value, not a denial.
2790          */
2791         error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2792         if (!error)
2793                 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2794                                              SECCLASS_CAPABILITY2,
2795                                              CAPABILITY2__MAC_ADMIN,
2796                                              0,
2797                                              NULL);
2798         if (!error)
2799                 error = security_sid_to_context_force(isec->sid, &context,
2800                                                       &size);
2801         else
2802                 error = security_sid_to_context(isec->sid, &context, &size);
2803         if (error)
2804                 return error;
2805         error = size;
2806         if (alloc) {
2807                 *buffer = context;
2808                 goto out_nofree;
2809         }
2810         kfree(context);
2811 out_nofree:
2812         return error;
2813 }
2814
2815 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2816                                      const void *value, size_t size, int flags)
2817 {
2818         struct inode_security_struct *isec = inode->i_security;
2819         u32 newsid;
2820         int rc;
2821
2822         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2823                 return -EOPNOTSUPP;
2824
2825         if (!value || !size)
2826                 return -EACCES;
2827
2828         rc = security_context_to_sid((void *)value, size, &newsid);
2829         if (rc)
2830                 return rc;
2831
2832         isec->sid = newsid;
2833         return 0;
2834 }
2835
2836 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2837 {
2838         const int len = sizeof(XATTR_NAME_SELINUX);
2839         if (buffer && len <= buffer_size)
2840                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2841         return len;
2842 }
2843
2844 static int selinux_inode_need_killpriv(struct dentry *dentry)
2845 {
2846         return secondary_ops->inode_need_killpriv(dentry);
2847 }
2848
2849 static int selinux_inode_killpriv(struct dentry *dentry)
2850 {
2851         return secondary_ops->inode_killpriv(dentry);
2852 }
2853
2854 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2855 {
2856         struct inode_security_struct *isec = inode->i_security;
2857         *secid = isec->sid;
2858 }
2859
2860 /* file security operations */
2861
2862 static int selinux_revalidate_file_permission(struct file *file, int mask)
2863 {
2864         int rc;
2865         struct inode *inode = file->f_path.dentry->d_inode;
2866
2867         if (!mask) {
2868                 /* No permission to check.  Existence test. */
2869                 return 0;
2870         }
2871
2872         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2873         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2874                 mask |= MAY_APPEND;
2875
2876         rc = file_has_perm(current, file,
2877                            file_mask_to_av(inode->i_mode, mask));
2878         if (rc)
2879                 return rc;
2880
2881         return selinux_netlbl_inode_permission(inode, mask);
2882 }
2883
2884 static int selinux_file_permission(struct file *file, int mask)
2885 {
2886         struct inode *inode = file->f_path.dentry->d_inode;
2887         struct task_security_struct *tsec = current->security;
2888         struct file_security_struct *fsec = file->f_security;
2889         struct inode_security_struct *isec = inode->i_security;
2890
2891         if (!mask) {
2892                 /* No permission to check.  Existence test. */
2893                 return 0;
2894         }
2895
2896         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2897             && fsec->pseqno == avc_policy_seqno())
2898                 return selinux_netlbl_inode_permission(inode, mask);
2899
2900         return selinux_revalidate_file_permission(file, mask);
2901 }
2902
2903 static int selinux_file_alloc_security(struct file *file)
2904 {
2905         return file_alloc_security(file);
2906 }
2907
2908 static void selinux_file_free_security(struct file *file)
2909 {
2910         file_free_security(file);
2911 }
2912
2913 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2914                               unsigned long arg)
2915 {
2916         u32 av = 0;
2917
2918         if (_IOC_DIR(cmd) & _IOC_WRITE)
2919                 av |= FILE__WRITE;
2920         if (_IOC_DIR(cmd) & _IOC_READ)
2921                 av |= FILE__READ;
2922         if (!av)
2923                 av = FILE__IOCTL;
2924
2925         return file_has_perm(current, file, av);
2926 }
2927
2928 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2929 {
2930 #ifndef CONFIG_PPC32
2931         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2932                 /*
2933                  * We are making executable an anonymous mapping or a
2934                  * private file mapping that will also be writable.
2935                  * This has an additional check.
2936                  */
2937                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2938                 if (rc)
2939                         return rc;
2940         }
2941 #endif
2942
2943         if (file) {
2944                 /* read access is always possible with a mapping */
2945                 u32 av = FILE__READ;
2946
2947                 /* write access only matters if the mapping is shared */
2948                 if (shared && (prot & PROT_WRITE))
2949                         av |= FILE__WRITE;
2950
2951                 if (prot & PROT_EXEC)
2952                         av |= FILE__EXECUTE;
2953
2954                 return file_has_perm(current, file, av);
2955         }
2956         return 0;
2957 }
2958
2959 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2960                              unsigned long prot, unsigned long flags,
2961                              unsigned long addr, unsigned long addr_only)
2962 {
2963         int rc = 0;
2964         u32 sid = ((struct task_security_struct *)(current->security))->sid;
2965
2966         if (addr < mmap_min_addr)
2967                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2968                                   MEMPROTECT__MMAP_ZERO, NULL);
2969         if (rc || addr_only)
2970                 return rc;
2971
2972         if (selinux_checkreqprot)
2973                 prot = reqprot;
2974
2975         return file_map_prot_check(file, prot,
2976                                    (flags & MAP_TYPE) == MAP_SHARED);
2977 }
2978
2979 static int selinux_file_mprotect(struct vm_area_struct *vma,
2980                                  unsigned long reqprot,
2981                                  unsigned long prot)
2982 {
2983         int rc;
2984
2985         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2986         if (rc)
2987                 return rc;
2988
2989         if (selinux_checkreqprot)
2990                 prot = reqprot;
2991
2992 #ifndef CONFIG_PPC32
2993         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2994                 rc = 0;
2995                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2996                     vma->vm_end <= vma->vm_mm->brk) {
2997                         rc = task_has_perm(current, current,
2998                                            PROCESS__EXECHEAP);
2999                 } else if (!vma->vm_file &&
3000                            vma->vm_start <= vma->vm_mm->start_stack &&
3001                            vma->vm_end >= vma->vm_mm->start_stack) {
3002                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3003                 } else if (vma->vm_file && vma->anon_vma) {
3004                         /*
3005                          * We are making executable a file mapping that has
3006                          * had some COW done. Since pages might have been
3007                          * written, check ability to execute the possibly
3008                          * modified content.  This typically should only
3009                          * occur for text relocations.
3010                          */
3011                         rc = file_has_perm(current, vma->vm_file,
3012                                            FILE__EXECMOD);
3013                 }
3014                 if (rc)
3015                         return rc;
3016         }
3017 #endif
3018
3019         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3020 }
3021
3022 static int selinux_file_lock(struct file *file, unsigned int cmd)
3023 {
3024         return file_has_perm(current, file, FILE__LOCK);
3025 }
3026
3027 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3028                               unsigned long arg)
3029 {
3030         int err = 0;
3031
3032         switch (cmd) {
3033         case F_SETFL:
3034                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3035                         err = -EINVAL;
3036                         break;
3037                 }
3038
3039                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3040                         err = file_has_perm(current, file, FILE__WRITE);
3041                         break;
3042                 }
3043                 /* fall through */
3044         case F_SETOWN:
3045         case F_SETSIG:
3046         case F_GETFL:
3047         case F_GETOWN:
3048         case F_GETSIG:
3049                 /* Just check FD__USE permission */
3050                 err = file_has_perm(current, file, 0);
3051                 break;
3052         case F_GETLK:
3053         case F_SETLK:
3054         case F_SETLKW:
3055 #if BITS_PER_LONG == 32
3056         case F_GETLK64:
3057         case F_SETLK64:
3058         case F_SETLKW64:
3059 #endif
3060                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3061                         err = -EINVAL;
3062                         break;
3063                 }
3064                 err = file_has_perm(current, file, FILE__LOCK);
3065                 break;
3066         }
3067
3068         return err;
3069 }
3070
3071 static int selinux_file_set_fowner(struct file *file)
3072 {
3073         struct task_security_struct *tsec;
3074         struct file_security_struct *fsec;
3075
3076         tsec = current->security;
3077         fsec = file->f_security;
3078         fsec->fown_sid = tsec->sid;
3079
3080         return 0;
3081 }
3082
3083 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3084                                        struct fown_struct *fown, int signum)
3085 {
3086         struct file *file;
3087         u32 perm;
3088         struct task_security_struct *tsec;
3089         struct file_security_struct *fsec;
3090
3091         /* struct fown_struct is never outside the context of a struct file */
3092         file = container_of(fown, struct file, f_owner);
3093
3094         tsec = tsk->security;
3095         fsec = file->f_security;
3096
3097         if (!signum)
3098                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3099         else
3100                 perm = signal_to_av(signum);
3101
3102         return avc_has_perm(fsec->fown_sid, tsec->sid,
3103                             SECCLASS_PROCESS, perm, NULL);
3104 }
3105
3106 static int selinux_file_receive(struct file *file)
3107 {
3108         return file_has_perm(current, file, file_to_av(file));
3109 }
3110
3111 static int selinux_dentry_open(struct file *file)
3112 {
3113         struct file_security_struct *fsec;
3114         struct inode *inode;
3115         struct inode_security_struct *isec;
3116         inode = file->f_path.dentry->d_inode;
3117         fsec = file->f_security;
3118         isec = inode->i_security;
3119         /*
3120          * Save inode label and policy sequence number
3121          * at open-time so that selinux_file_permission
3122          * can determine whether revalidation is necessary.
3123          * Task label is already saved in the file security
3124          * struct as its SID.
3125          */
3126         fsec->isid = isec->sid;
3127         fsec->pseqno = avc_policy_seqno();
3128         /*
3129          * Since the inode label or policy seqno may have changed
3130          * between the selinux_inode_permission check and the saving
3131          * of state above, recheck that access is still permitted.
3132          * Otherwise, access might never be revalidated against the
3133          * new inode label or new policy.
3134          * This check is not redundant - do not remove.
3135          */
3136         return inode_has_perm(current, inode, file_to_av(file), NULL);
3137 }
3138
3139 /* task security operations */
3140
3141 static int selinux_task_create(unsigned long clone_flags)
3142 {
3143         int rc;
3144
3145         rc = secondary_ops->task_create(clone_flags);
3146         if (rc)
3147                 return rc;
3148
3149         return task_has_perm(current, current, PROCESS__FORK);
3150 }
3151
3152 static int selinux_task_alloc_security(struct task_struct *tsk)
3153 {
3154         struct task_security_struct *tsec1, *tsec2;
3155         int rc;
3156
3157         tsec1 = current->security;
3158
3159         rc = task_alloc_security(tsk);
3160         if (rc)
3161                 return rc;
3162         tsec2 = tsk->security;
3163
3164         tsec2->osid = tsec1->osid;
3165         tsec2->sid = tsec1->sid;
3166
3167         /* Retain the exec, fs, key, and sock SIDs across fork */
3168         tsec2->exec_sid = tsec1->exec_sid;
3169         tsec2->create_sid = tsec1->create_sid;
3170         tsec2->keycreate_sid = tsec1->keycreate_sid;
3171         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3172
3173         return 0;
3174 }
3175
3176 static void selinux_task_free_security(struct task_struct *tsk)
3177 {
3178         task_free_security(tsk);
3179 }
3180
3181 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3182 {
3183         /* Since setuid only affects the current process, and
3184            since the SELinux controls are not based on the Linux
3185            identity attributes, SELinux does not need to control
3186            this operation.  However, SELinux does control the use
3187            of the CAP_SETUID and CAP_SETGID capabilities using the
3188            capable hook. */
3189         return 0;
3190 }
3191
3192 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3193 {
3194         return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3195 }
3196
3197 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3198 {
3199         /* See the comment for setuid above. */
3200         return 0;
3201 }
3202
3203 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3204 {
3205         return task_has_perm(current, p, PROCESS__SETPGID);
3206 }
3207
3208 static int selinux_task_getpgid(struct task_struct *p)
3209 {
3210         return task_has_perm(current, p, PROCESS__GETPGID);
3211 }
3212
3213 static int selinux_task_getsid(struct task_struct *p)
3214 {
3215         return task_has_perm(current, p, PROCESS__GETSESSION);
3216 }
3217
3218 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3219 {
3220         struct task_security_struct *tsec = p->security;
3221         *secid = tsec->sid;
3222 }
3223
3224 static int selinux_task_setgroups(struct group_info *group_info)
3225 {
3226         /* See the comment for setuid above. */
3227         return 0;
3228 }
3229
3230 static int selinux_task_setnice(struct task_struct *p, int nice)
3231 {
3232         int rc;
3233
3234         rc = secondary_ops->task_setnice(p, nice);
3235         if (rc)
3236                 return rc;
3237
3238         return task_has_perm(current, p, PROCESS__SETSCHED);
3239 }
3240
3241 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3242 {
3243         int rc;
3244
3245         rc = secondary_ops->task_setioprio(p, ioprio);
3246         if (rc)
3247                 return rc;
3248
3249         return task_has_perm(current, p, PROCESS__SETSCHED);
3250 }
3251
3252 static int selinux_task_getioprio(struct task_struct *p)
3253 {
3254         return task_has_perm(current, p, PROCESS__GETSCHED);
3255 }
3256
3257 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3258 {
3259         struct rlimit *old_rlim = current->signal->rlim + resource;
3260         int rc;
3261
3262         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3263         if (rc)
3264                 return rc;
3265
3266         /* Control the ability to change the hard limit (whether
3267            lowering or raising it), so that the hard limit can
3268            later be used as a safe reset point for the soft limit
3269            upon context transitions. See selinux_bprm_apply_creds. */
3270         if (old_rlim->rlim_max != new_rlim->rlim_max)
3271                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3272
3273         return 0;
3274 }
3275
3276 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3277 {
3278         int rc;
3279
3280         rc = secondary_ops->task_setscheduler(p, policy, lp);
3281         if (rc)
3282                 return rc;
3283
3284         return task_has_perm(current, p, PROCESS__SETSCHED);
3285 }
3286
3287 static int selinux_task_getscheduler(struct task_struct *p)
3288 {
3289         return task_has_perm(current, p, PROCESS__GETSCHED);
3290 }
3291
3292 static int selinux_task_movememory(struct task_struct *p)
3293 {
3294         return task_has_perm(current, p, PROCESS__SETSCHED);
3295 }
3296
3297 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3298                                 int sig, u32 secid)
3299 {
3300         u32 perm;
3301         int rc;
3302         struct task_security_struct *tsec;
3303
3304         rc = secondary_ops->task_kill(p, info, sig, secid);
3305         if (rc)
3306                 return rc;
3307
3308         if (!sig)
3309                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3310         else
3311                 perm = signal_to_av(sig);
3312         tsec = p->security;
3313         if (secid)
3314                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3315         else
3316                 rc = task_has_perm(current, p, perm);
3317         return rc;
3318 }
3319
3320 static int selinux_task_prctl(int option,
3321                               unsigned long arg2,
3322                               unsigned long arg3,
3323                               unsigned long arg4,
3324                               unsigned long arg5,
3325                               long *rc_p)
3326 {
3327         /* The current prctl operations do not appear to require
3328            any SELinux controls since they merely observe or modify
3329            the state of the current process. */
3330         return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3331 }
3332
3333 static int selinux_task_wait(struct task_struct *p)
3334 {
3335         return task_has_perm(p, current, PROCESS__SIGCHLD);
3336 }
3337
3338 static void selinux_task_reparent_to_init(struct task_struct *p)
3339 {
3340         struct task_security_struct *tsec;
3341
3342         secondary_ops->task_reparent_to_init(p);
3343
3344         tsec = p->security;
3345         tsec->osid = tsec->sid;
3346         tsec->sid = SECINITSID_KERNEL;
3347         return;
3348 }
3349
3350 static void selinux_task_to_inode(struct task_struct *p,
3351                                   struct inode *inode)
3352 {
3353         struct task_security_struct *tsec = p->security;
3354         struct inode_security_struct *isec = inode->i_security;
3355
3356         isec->sid = tsec->sid;
3357         isec->initialized = 1;
3358         return;
3359 }
3360
3361 /* Returns error only if unable to parse addresses */
3362 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3363                         struct avc_audit_data *ad, u8 *proto)
3364 {
3365         int offset, ihlen, ret = -EINVAL;
3366         struct iphdr _iph, *ih;
3367
3368         offset = skb_network_offset(skb);
3369         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3370         if (ih == NULL)
3371                 goto out;
3372
3373         ihlen = ih->ihl * 4;
3374         if (ihlen < sizeof(_iph))
3375                 goto out;
3376
3377         ad->u.net.v4info.saddr = ih->saddr;
3378         ad->u.net.v4info.daddr = ih->daddr;
3379         ret = 0;
3380
3381         if (proto)
3382                 *proto = ih->protocol;
3383
3384         switch (ih->protocol) {
3385         case IPPROTO_TCP: {
3386                 struct tcphdr _tcph, *th;
3387
3388                 if (ntohs(ih->frag_off) & IP_OFFSET)
3389                         break;
3390
3391                 offset += ihlen;
3392                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3393                 if (th == NULL)
3394                         break;
3395
3396                 ad->u.net.sport = th->source;
3397                 ad->u.net.dport = th->dest;
3398                 break;
3399         }
3400
3401         case IPPROTO_UDP: {
3402                 struct udphdr _udph, *uh;
3403
3404                 if (ntohs(ih->frag_off) & IP_OFFSET)
3405                         break;
3406
3407                 offset += ihlen;
3408                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3409                 if (uh == NULL)
3410                         break;
3411
3412                 ad->u.net.sport = uh->source;
3413                 ad->u.net.dport = uh->dest;
3414                 break;
3415         }
3416
3417         case IPPROTO_DCCP: {
3418                 struct dccp_hdr _dccph, *dh;
3419
3420                 if (ntohs(ih->frag_off) & IP_OFFSET)
3421                         break;
3422
3423                 offset += ihlen;
3424                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3425                 if (dh == NULL)
3426                         break;
3427
3428                 ad->u.net.sport = dh->dccph_sport;
3429                 ad->u.net.dport = dh->dccph_dport;
3430                 break;
3431         }
3432
3433         default:
3434                 break;
3435         }
3436 out:
3437         return ret;
3438 }
3439
3440 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3441
3442 /* Returns error only if unable to parse addresses */
3443 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3444                         struct avc_audit_data *ad, u8 *proto)
3445 {
3446         u8 nexthdr;
3447         int ret = -EINVAL, offset;
3448         struct ipv6hdr _ipv6h, *ip6;
3449
3450         offset = skb_network_offset(skb);
3451         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3452         if (ip6 == NULL)
3453                 goto out;
3454
3455         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3456         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3457         ret = 0;
3458
3459         nexthdr = ip6->nexthdr;
3460         offset += sizeof(_ipv6h);
3461         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3462         if (offset < 0)
3463                 goto out;
3464
3465         if (proto)
3466                 *proto = nexthdr;
3467
3468         switch (nexthdr) {
3469         case IPPROTO_TCP: {
3470                 struct tcphdr _tcph, *th;
3471
3472                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3473                 if (th == NULL)
3474                         break;
3475
3476                 ad->u.net.sport = th->source;
3477                 ad->u.net.dport = th->dest;
3478                 break;
3479         }
3480
3481         case IPPROTO_UDP: {
3482                 struct udphdr _udph, *uh;
3483
3484                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3485                 if (uh == NULL)
3486                         break;
3487
3488                 ad->u.net.sport = uh->source;
3489                 ad->u.net.dport = uh->dest;
3490                 break;
3491         }
3492
3493         case IPPROTO_DCCP: {
3494                 struct dccp_hdr _dccph, *dh;
3495
3496                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3497                 if (dh == NULL)
3498                         break;
3499
3500                 ad->u.net.sport = dh->dccph_sport;
3501                 ad->u.net.dport = dh->dccph_dport;
3502                 break;
3503         }
3504
3505         /* includes fragments */
3506         default:
3507                 break;
3508         }
3509 out:
3510         return ret;
3511 }
3512
3513 #endif /* IPV6 */
3514
3515 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3516                              char **addrp, int src, u8 *proto)
3517 {
3518         int ret = 0;
3519
3520         switch (ad->u.net.family) {
3521         case PF_INET:
3522                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3523                 if (ret || !addrp)
3524                         break;
3525                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3526                                         &ad->u.net.v4info.daddr);
3527                 break;
3528
3529 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3530         case PF_INET6:
3531                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3532                 if (ret || !addrp)
3533                         break;
3534                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3535                                         &ad->u.net.v6info.daddr);
3536                 break;
3537 #endif  /* IPV6 */
3538         default:
3539                 break;
3540         }
3541
3542         if (unlikely(ret))
3543                 printk(KERN_WARNING
3544                        "SELinux: failure in selinux_parse_skb(),"
3545                        " unable to parse packet\n");
3546
3547         return ret;
3548 }
3549
3550 /**
3551  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3552  * @skb: the packet
3553  * @family: protocol family
3554  * @sid: the packet's peer label SID
3555  *
3556  * Description:
3557  * Check the various different forms of network peer labeling and determine
3558  * the peer label/SID for the packet; most of the magic actually occurs in
3559  * the security server function security_net_peersid_cmp().  The function
3560  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3561  * or -EACCES if @sid is invalid due to inconsistencies with the different
3562  * peer labels.
3563  *
3564  */
3565 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3566 {
3567         int err;
3568         u32 xfrm_sid;
3569         u32 nlbl_sid;
3570         u32 nlbl_type;
3571
3572         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3573         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3574
3575         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3576         if (unlikely(err)) {
3577                 printk(KERN_WARNING
3578                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3579                        " unable to determine packet's peer label\n");
3580                 return -EACCES;
3581         }
3582
3583         return 0;
3584 }
3585
3586 /* socket security operations */
3587 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3588                            u32 perms)
3589 {
3590         struct inode_security_struct *isec;
3591         struct task_security_struct *tsec;
3592         struct avc_audit_data ad;
3593         int err = 0;
3594
3595         tsec = task->security;
3596         isec = SOCK_INODE(sock)->i_security;
3597
3598         if (isec->sid == SECINITSID_KERNEL)
3599                 goto out;
3600
3601         AVC_AUDIT_DATA_INIT(&ad, NET);
3602         ad.u.net.sk = sock->sk;
3603         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3604
3605 out:
3606         return err;
3607 }
3608
3609 static int selinux_socket_create(int family, int type,
3610                                  int protocol, int kern)
3611 {
3612         int err = 0;
3613         struct task_security_struct *tsec;
3614         u32 newsid;
3615
3616         if (kern)
3617                 goto out;
3618
3619         tsec = current->security;
3620         newsid = tsec->sockcreate_sid ? : tsec->sid;
3621         err = avc_has_perm(tsec->sid, newsid,
3622                            socket_type_to_security_class(family, type,
3623                            protocol), SOCKET__CREATE, NULL);
3624
3625 out:
3626         return err;
3627 }
3628
3629 static int selinux_socket_post_create(struct socket *sock, int family,
3630                                       int type, int protocol, int kern)
3631 {
3632         int err = 0;
3633         struct inode_security_struct *isec;
3634         struct task_security_struct *tsec;
3635         struct sk_security_struct *sksec;
3636         u32 newsid;
3637
3638         isec = SOCK_INODE(sock)->i_security;
3639
3640         tsec = current->security;
3641         newsid = tsec->sockcreate_sid ? : tsec->sid;
3642         isec->sclass = socket_type_to_security_class(family, type, protocol);
3643         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3644         isec->initialized = 1;
3645
3646         if (sock->sk) {
3647                 sksec = sock->sk->sk_security;
3648                 sksec->sid = isec->sid;
3649                 sksec->sclass = isec->sclass;
3650                 err = selinux_netlbl_socket_post_create(sock);
3651         }
3652
3653         return err;
3654 }
3655
3656 /* Range of port numbers used to automatically bind.
3657    Need to determine whether we should perform a name_bind
3658    permission check between the socket and the port number. */
3659
3660 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3661 {
3662         u16 family;
3663         int err;
3664
3665         err = socket_has_perm(current, sock, SOCKET__BIND);
3666         if (err)
3667                 goto out;
3668
3669         /*
3670          * If PF_INET or PF_INET6, check name_bind permission for the port.
3671          * Multiple address binding for SCTP is not supported yet: we just
3672          * check the first address now.
3673          */
3674         family = sock->sk->sk_family;
3675         if (family == PF_INET || family == PF_INET6) {
3676                 char *addrp;
3677                 struct inode_security_struct *isec;
3678                 struct task_security_struct *tsec;
3679                 struct avc_audit_data ad;
3680                 struct sockaddr_in *addr4 = NULL;
3681                 struct sockaddr_in6 *addr6 = NULL;
3682                 unsigned short snum;
3683                 struct sock *sk = sock->sk;
3684                 u32 sid, node_perm;
3685
3686                 tsec = current->security;
3687                 isec = SOCK_INODE(sock)->i_security;
3688
3689                 if (family == PF_INET) {
3690                         addr4 = (struct sockaddr_in *)address;
3691                         snum = ntohs(addr4->sin_port);
3692                         addrp = (char *)&addr4->sin_addr.s_addr;
3693                 } else {
3694                         addr6 = (struct sockaddr_in6 *)address;
3695                         snum = ntohs(addr6->sin6_port);
3696                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3697                 }
3698
3699                 if (snum) {
3700                         int low, high;
3701
3702                         inet_get_local_port_range(&low, &high);
3703
3704                         if (snum < max(PROT_SOCK, low) || snum > high) {
3705                                 err = sel_netport_sid(sk->sk_protocol,
3706                                                       snum, &sid);
3707                                 if (err)
3708                                         goto out;
3709                                 AVC_AUDIT_DATA_INIT(&ad, NET);
3710                                 ad.u.net.sport = htons(snum);
3711                                 ad.u.net.family = family;
3712                                 err = avc_has_perm(isec->sid, sid,
3713                                                    isec->sclass,
3714                                                    SOCKET__NAME_BIND, &ad);
3715                                 if (err)
3716                                         goto out;
3717                         }
3718                 }
3719
3720                 switch (isec->sclass) {
3721                 case SECCLASS_TCP_SOCKET:
3722                         node_perm = TCP_SOCKET__NODE_BIND;
3723                         break;
3724
3725                 case SECCLASS_UDP_SOCKET:
3726                         node_perm = UDP_SOCKET__NODE_BIND;
3727                         break;
3728
3729                 case SECCLASS_DCCP_SOCKET:
3730                         node_perm = DCCP_SOCKET__NODE_BIND;
3731                         break;
3732
3733                 default:
3734                         node_perm = RAWIP_SOCKET__NODE_BIND;
3735                         break;
3736                 }
3737
3738                 err = sel_netnode_sid(addrp, family, &sid);
3739                 if (err)
3740                         goto out;
3741
3742                 AVC_AUDIT_DATA_INIT(&ad, NET);
3743                 ad.u.net.sport = htons(snum);
3744                 ad.u.net.family = family;
3745
3746                 if (family == PF_INET)
3747                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3748                 else
3749                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3750
3751                 err = avc_has_perm(isec->sid, sid,
3752                                    isec->sclass, node_perm, &ad);
3753                 if (err)
3754                         goto out;
3755         }
3756 out:
3757         return err;
3758 }
3759
3760 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3761 {
3762         struct inode_security_struct *isec;
3763         int err;
3764
3765         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3766         if (err)
3767                 return err;
3768
3769         /*
3770          * If a TCP or DCCP socket, check name_connect permission for the port.
3771          */
3772         isec = SOCK_INODE(sock)->i_security;
3773         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3774             isec->sclass == SECCLASS_DCCP_SOCKET) {
3775                 struct sock *sk = sock->sk;
3776                 struct avc_audit_data ad;
3777                 struct sockaddr_in *addr4 = NULL;
3778                 struct sockaddr_in6 *addr6 = NULL;
3779                 unsigned short snum;
3780                 u32 sid, perm;
3781
3782                 if (sk->sk_family == PF_INET) {
3783                         addr4 = (struct sockaddr_in *)address;
3784                         if (addrlen < sizeof(struct sockaddr_in))
3785                                 return -EINVAL;
3786                         snum = ntohs(addr4->sin_port);
3787                 } else {
3788                         addr6 = (struct sockaddr_in6 *)address;
3789                         if (addrlen < SIN6_LEN_RFC2133)
3790                                 return -EINVAL;
3791                         snum = ntohs(addr6->sin6_port);
3792                 }
3793
3794                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3795                 if (err)
3796                         goto out;
3797
3798                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3799                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3800
3801                 AVC_AUDIT_DATA_INIT(&ad, NET);
3802                 ad.u.net.dport = htons(snum);
3803                 ad.u.net.family = sk->sk_family;
3804                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3805                 if (err)
3806                         goto out;
3807         }
3808
3809 out:
3810         return err;
3811 }
3812
3813 static int selinux_socket_listen(struct socket *sock, int backlog)
3814 {
3815         return socket_has_perm(current, sock, SOCKET__LISTEN);
3816 }
3817
3818 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3819 {
3820         int err;
3821         struct inode_security_struct *isec;
3822         struct inode_security_struct *newisec;
3823
3824         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3825         if (err)
3826                 return err;
3827
3828         newisec = SOCK_INODE(newsock)->i_security;
3829
3830         isec = SOCK_INODE(sock)->i_security;
3831         newisec->sclass = isec->sclass;
3832         newisec->sid = isec->sid;
3833         newisec->initialized = 1;
3834
3835         return 0;
3836 }
3837
3838 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3839                                   int size)
3840 {
3841         int rc;
3842
3843         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3844         if (rc)
3845                 return rc;
3846
3847         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3848 }
3849
3850 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3851                                   int size, int flags)
3852 {
3853         return socket_has_perm(current, sock, SOCKET__READ);
3854 }
3855
3856 static int selinux_socket_getsockname(struct socket *sock)
3857 {
3858         return socket_has_perm(current, sock, SOCKET__GETATTR);
3859 }
3860
3861 static int selinux_socket_getpeername(struct socket *sock)
3862 {
3863         return socket_has_perm(current, sock, SOCKET__GETATTR);
3864 }
3865
3866 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3867 {
3868         int err;
3869
3870         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3871         if (err)
3872                 return err;
3873
3874         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3875 }
3876
3877 static int selinux_socket_getsockopt(struct socket *sock, int level,
3878                                      int optname)
3879 {
3880         return socket_has_perm(current, sock, SOCKET__GETOPT);
3881 }
3882
3883 static int selinux_socket_shutdown(struct socket *sock, int how)
3884 {
3885         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3886 }
3887
3888 static int selinux_socket_unix_stream_connect(struct socket *sock,
3889                                               struct socket *other,
3890                                               struct sock *newsk)
3891 {
3892         struct sk_security_struct *ssec;
3893         struct inode_security_struct *isec;
3894         struct inode_security_struct *other_isec;
3895         struct avc_audit_data ad;
3896         int err;
3897
3898         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3899         if (err)
3900                 return err;
3901
3902         isec = SOCK_INODE(sock)->i_security;
3903         other_isec = SOCK_INODE(other)->i_security;
3904
3905         AVC_AUDIT_DATA_INIT(&ad, NET);
3906         ad.u.net.sk = other->sk;
3907
3908         err = avc_has_perm(isec->sid, other_isec->sid,
3909                            isec->sclass,
3910                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3911         if (err)
3912                 return err;
3913
3914         /* connecting socket */
3915         ssec = sock->sk->sk_security;
3916         ssec->peer_sid = other_isec->sid;
3917
3918         /* server child socket */
3919         ssec = newsk->sk_security;
3920         ssec->peer_sid = isec->sid;
3921         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3922
3923         return err;
3924 }
3925
3926 static int selinux_socket_unix_may_send(struct socket *sock,
3927                                         struct socket *other)
3928 {
3929         struct inode_security_struct *isec;
3930         struct inode_security_struct *other_isec;
3931         struct avc_audit_data ad;
3932         int err;
3933
3934         isec = SOCK_INODE(sock)->i_security;
3935         other_isec = SOCK_INODE(other)->i_security;
3936
3937         AVC_AUDIT_DATA_INIT(&ad, NET);
3938         ad.u.net.sk = other->sk;
3939
3940         err = avc_has_perm(isec->sid, other_isec->sid,
3941                            isec->sclass, SOCKET__SENDTO, &ad);
3942         if (err)
3943                 return err;
3944
3945         return 0;
3946 }
3947
3948 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3949                                     u32 peer_sid,
3950                                     struct avc_audit_data *ad)
3951 {
3952         int err;
3953         u32 if_sid;
3954         u32 node_sid;
3955
3956         err = sel_netif_sid(ifindex, &if_sid);
3957         if (err)
3958                 return err;
3959         err = avc_has_perm(peer_sid, if_sid,
3960                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3961         if (err)
3962                 return err;
3963
3964         err = sel_netnode_sid(addrp, family, &node_sid);
3965         if (err)
3966                 return err;
3967         return avc_has_perm(peer_sid, node_sid,
3968                             SECCLASS_NODE, NODE__RECVFROM, ad);
3969 }
3970
3971 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3972                                                 struct sk_buff *skb,
3973                                                 struct avc_audit_data *ad,
3974                                                 u16 family,
3975                                                 char *addrp)
3976 {
3977         int err;
3978         struct sk_security_struct *sksec = sk->sk_security;
3979         u16 sk_class;
3980         u32 netif_perm, node_perm, recv_perm;
3981         u32 port_sid, node_sid, if_sid, sk_sid;
3982
3983         sk_sid = sksec->sid;
3984         sk_class = sksec->sclass;
3985
3986         switch (sk_class) {
3987         case SECCLASS_UDP_SOCKET:
3988                 netif_perm = NETIF__UDP_RECV;
3989                 node_perm = NODE__UDP_RECV;
3990                 recv_perm = UDP_SOCKET__RECV_MSG;
3991                 break;
3992         case SECCLASS_TCP_SOCKET:
3993                 netif_perm = NETIF__TCP_RECV;
3994                 node_perm = NODE__TCP_RECV;
3995                 recv_perm = TCP_SOCKET__RECV_MSG;
3996                 break;
3997         case SECCLASS_DCCP_SOCKET:
3998                 netif_perm = NETIF__DCCP_RECV;
3999                 node_perm = NODE__DCCP_RECV;
4000                 recv_perm = DCCP_SOCKET__RECV_MSG;
4001                 break;
4002         default:
4003                 netif_perm = NETIF__RAWIP_RECV;
4004                 node_perm = NODE__RAWIP_RECV;
4005                 recv_perm = 0;
4006                 break;
4007         }
4008
4009         err = sel_netif_sid(skb->iif, &if_sid);
4010         if (err)
4011                 return err;
4012         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4013         if (err)
4014                 return err;
4015
4016         err = sel_netnode_sid(addrp, family, &node_sid);
4017         if (err)
4018                 return err;
4019         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4020         if (err)
4021                 return err;
4022
4023         if (!recv_perm)
4024                 return 0;
4025         err = sel_netport_sid(sk->sk_protocol,
4026                               ntohs(ad->u.net.sport), &port_sid);
4027         if (unlikely(err)) {
4028                 printk(KERN_WARNING
4029                        "SELinux: failure in"
4030                        " selinux_sock_rcv_skb_iptables_compat(),"
4031                        " network port label not found\n");
4032                 return err;
4033         }
4034         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4035 }
4036
4037 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4038                                        struct avc_audit_data *ad,
4039                                        u16 family, char *addrp)
4040 {
4041         int err;
4042         struct sk_security_struct *sksec = sk->sk_security;
4043         u32 peer_sid;
4044         u32 sk_sid = sksec->sid;
4045
4046         if (selinux_compat_net)
4047                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4048                                                            family, addrp);
4049         else
4050                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4051                                    PACKET__RECV, ad);
4052         if (err)
4053                 return err;
4054
4055         if (selinux_policycap_netpeer) {
4056                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4057                 if (err)
4058                         return err;
4059                 err = avc_has_perm(sk_sid, peer_sid,
4060                                    SECCLASS_PEER, PEER__RECV, ad);
4061         } else {
4062                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4063                 if (err)
4064                         return err;
4065                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4066         }
4067
4068         return err;
4069 }
4070
4071 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4072 {
4073         int err;
4074         struct sk_security_struct *sksec = sk->sk_security;
4075         u16 family = sk->sk_family;
4076         u32 sk_sid = sksec->sid;
4077         struct avc_audit_data ad;
4078         char *addrp;
4079
4080         if (family != PF_INET && family != PF_INET6)
4081                 return 0;
4082
4083         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4084         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4085                 family = PF_INET;
4086
4087         AVC_AUDIT_DATA_INIT(&ad, NET);
4088         ad.u.net.netif = skb->iif;
4089         ad.u.net.family = family;
4090         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4091         if (err)
4092                 return err;
4093
4094         /* If any sort of compatibility mode is enabled then handoff processing
4095          * to the selinux_sock_rcv_skb_compat() function to deal with the
4096          * special handling.  We do this in an attempt to keep this function
4097          * as fast and as clean as possible. */
4098         if (selinux_compat_net || !selinux_policycap_netpeer)
4099                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4100                                                    family, addrp);
4101
4102         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4103                 u32 peer_sid;
4104
4105                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4106                 if (err)
4107                         return err;
4108                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4109                                                peer_sid, &ad);
4110                 if (err)
4111                         return err;
4112                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4113                                    PEER__RECV, &ad);
4114         }
4115
4116         if (selinux_secmark_enabled()) {
4117                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4118                                    PACKET__RECV, &ad);
4119                 if (err)
4120                         return err;
4121         }
4122
4123         return err;
4124 }
4125
4126 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4127                                             int __user *optlen, unsigned len)
4128 {
4129         int err = 0;
4130         char *scontext;
4131         u32 scontext_len;
4132         struct sk_security_struct *ssec;
4133         struct inode_security_struct *isec;
4134         u32 peer_sid = SECSID_NULL;
4135
4136         isec = SOCK_INODE(sock)->i_security;
4137
4138         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4139             isec->sclass == SECCLASS_TCP_SOCKET) {
4140                 ssec = sock->sk->sk_security;
4141                 peer_sid = ssec->peer_sid;
4142         }
4143         if (peer_sid == SECSID_NULL) {
4144                 err = -ENOPROTOOPT;
4145                 goto out;
4146         }
4147
4148         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4149
4150         if (err)
4151                 goto out;
4152
4153         if (scontext_len > len) {
4154                 err = -ERANGE;
4155                 goto out_len;
4156         }
4157
4158         if (copy_to_user(optval, scontext, scontext_len))
4159                 err = -EFAULT;
4160
4161 out_len:
4162         if (put_user(scontext_len, optlen))
4163                 err = -EFAULT;
4164
4165         kfree(scontext);
4166 out:
4167         return err;
4168 }
4169
4170 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4171 {
4172         u32 peer_secid = SECSID_NULL;
4173         u16 family;
4174
4175         if (sock)
4176                 family = sock->sk->sk_family;
4177         else if (skb && skb->sk)
4178                 family = skb->sk->sk_family;
4179         else
4180                 goto out;
4181
4182         if (sock && family == PF_UNIX)
4183                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4184         else if (skb)
4185                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4186
4187 out:
4188         *secid = peer_secid;
4189         if (peer_secid == SECSID_NULL)
4190                 return -EINVAL;
4191         return 0;
4192 }
4193
4194 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4195 {
4196         return sk_alloc_security(sk, family, priority);
4197 }
4198
4199 static void selinux_sk_free_security(struct sock *sk)
4200 {
4201         sk_free_security(sk);
4202 }
4203
4204 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4205 {
4206         struct sk_security_struct *ssec = sk->sk_security;
4207         struct sk_security_struct *newssec = newsk->sk_security;
4208
4209         newssec->sid = ssec->sid;
4210         newssec->peer_sid = ssec->peer_sid;
4211         newssec->sclass = ssec->sclass;
4212
4213         selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4214 }
4215
4216 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4217 {
4218         if (!sk)
4219                 *secid = SECINITSID_ANY_SOCKET;
4220         else {
4221                 struct sk_security_struct *sksec = sk->sk_security;
4222
4223                 *secid = sksec->sid;
4224         }
4225 }
4226
4227 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4228 {
4229         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4230         struct sk_security_struct *sksec = sk->sk_security;
4231
4232         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4233             sk->sk_family == PF_UNIX)
4234                 isec->sid = sksec->sid;
4235         sksec->sclass = isec->sclass;
4236
4237         selinux_netlbl_sock_graft(sk, parent);
4238 }
4239
4240 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4241                                      struct request_sock *req)
4242 {
4243         struct sk_security_struct *sksec = sk->sk_security;
4244         int err;
4245         u32 newsid;
4246         u32 peersid;
4247
4248         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4249         if (err)
4250                 return err;
4251         if (peersid == SECSID_NULL) {
4252                 req->secid = sksec->sid;
4253                 req->peer_secid = SECSID_NULL;
4254                 return 0;
4255         }
4256
4257         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4258         if (err)
4259                 return err;
4260
4261         req->secid = newsid;
4262         req->peer_secid = peersid;
4263         return 0;
4264 }
4265
4266 static void selinux_inet_csk_clone(struct sock *newsk,
4267                                    const struct request_sock *req)
4268 {
4269         struct sk_security_struct *newsksec = newsk->sk_security;
4270
4271         newsksec->sid = req->secid;
4272         newsksec->peer_sid = req->peer_secid;
4273         /* NOTE: Ideally, we should also get the isec->sid for the
4274            new socket in sync, but we don't have the isec available yet.
4275            So we will wait until sock_graft to do it, by which
4276            time it will have been created and available. */
4277
4278         /* We don't need to take any sort of lock here as we are the only
4279          * thread with access to newsksec */
4280         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4281 }
4282
4283 static void selinux_inet_conn_established(struct sock *sk,
4284                                 struct sk_buff *skb)
4285 {
4286         struct sk_security_struct *sksec = sk->sk_security;
4287
4288         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4289 }
4290
4291 static void selinux_req_classify_flow(const struct request_sock *req,
4292                                       struct flowi *fl)
4293 {
4294         fl->secid = req->secid;
4295 }
4296
4297 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4298 {
4299         int err = 0;
4300         u32 perm;
4301         struct nlmsghdr *nlh;
4302         struct socket *sock = sk->sk_socket;
4303         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4304
4305         if (skb->len < NLMSG_SPACE(0)) {
4306                 err = -EINVAL;
4307                 goto out;
4308         }
4309         nlh = nlmsg_hdr(skb);
4310
4311         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4312         if (err) {
4313                 if (err == -EINVAL) {
4314                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4315                                   "SELinux:  unrecognized netlink message"
4316                                   " type=%hu for sclass=%hu\n",
4317                                   nlh->nlmsg_type, isec->sclass);
4318                         if (!selinux_enforcing)
4319                                 err = 0;
4320                 }
4321
4322                 /* Ignore */
4323                 if (err == -ENOENT)
4324                         err = 0;
4325                 goto out;
4326         }
4327
4328         err = socket_has_perm(current, sock, perm);
4329 out:
4330         return err;
4331 }
4332
4333 #ifdef CONFIG_NETFILTER
4334
4335 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4336                                        u16 family)
4337 {
4338         char *addrp;
4339         u32 peer_sid;
4340         struct avc_audit_data ad;
4341         u8 secmark_active;
4342         u8 peerlbl_active;
4343
4344         if (!selinux_policycap_netpeer)
4345                 return NF_ACCEPT;
4346
4347         secmark_active = selinux_secmark_enabled();
4348         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4349         if (!secmark_active && !peerlbl_active)
4350                 return NF_ACCEPT;
4351
4352         AVC_AUDIT_DATA_INIT(&ad, NET);
4353         ad.u.net.netif = ifindex;
4354         ad.u.net.family = family;
4355         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4356                 return NF_DROP;
4357
4358         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4359                 return NF_DROP;
4360
4361         if (peerlbl_active)
4362                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4363                                              peer_sid, &ad) != 0)
4364                         return NF_DROP;
4365
4366         if (secmark_active)
4367                 if (avc_has_perm(peer_sid, skb->secmark,
4368                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4369                         return NF_DROP;
4370
4371         return NF_ACCEPT;
4372 }
4373
4374 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4375                                          struct sk_buff *skb,
4376                                          const struct net_device *in,
4377                                          const struct net_device *out,
4378                                          int (*okfn)(struct sk_buff *))
4379 {
4380         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4381 }
4382
4383 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4384 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4385                                          struct sk_buff *skb,
4386                                          const struct net_device *in,
4387                                          const struct net_device *out,
4388                                          int (*okfn)(struct sk_buff *))
4389 {
4390         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4391 }
4392 #endif  /* IPV6 */
4393
4394 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4395                                                 int ifindex,
4396                                                 struct avc_audit_data *ad,
4397                                                 u16 family, char *addrp)
4398 {
4399         int err;
4400         struct sk_security_struct *sksec = sk->sk_security;
4401         u16 sk_class;
4402         u32 netif_perm, node_perm, send_perm;
4403         u32 port_sid, node_sid, if_sid, sk_sid;
4404
4405         sk_sid = sksec->sid;
4406         sk_class = sksec->sclass;
4407
4408         switch (sk_class) {
4409         case SECCLASS_UDP_SOCKET:
4410                 netif_perm = NETIF__UDP_SEND;
4411                 node_perm = NODE__UDP_SEND;
4412                 send_perm = UDP_SOCKET__SEND_MSG;
4413                 break;
4414         case SECCLASS_TCP_SOCKET:
4415                 netif_perm = NETIF__TCP_SEND;
4416                 node_perm = NODE__TCP_SEND;
4417                 send_perm = TCP_SOCKET__SEND_MSG;
4418                 break;
4419         case SECCLASS_DCCP_SOCKET:
4420                 netif_perm = NETIF__DCCP_SEND;
4421                 node_perm = NODE__DCCP_SEND;
4422                 send_perm = DCCP_SOCKET__SEND_MSG;
4423                 break;
4424         default:
4425                 netif_perm = NETIF__RAWIP_SEND;
4426                 node_perm = NODE__RAWIP_SEND;
4427                 send_perm = 0;
4428                 break;
4429         }
4430
4431         err = sel_netif_sid(ifindex, &if_sid);
4432         if (err)
4433                 return err;
4434         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4435                 return err;
4436
4437         err = sel_netnode_sid(addrp, family, &node_sid);
4438         if (err)
4439                 return err;
4440         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4441         if (err)
4442                 return err;
4443
4444         if (send_perm != 0)
4445                 return 0;
4446
4447         err = sel_netport_sid(sk->sk_protocol,
4448                               ntohs(ad->u.net.dport), &port_sid);
4449         if (unlikely(err)) {
4450                 printk(KERN_WARNING
4451                        "SELinux: failure in"
4452                        " selinux_ip_postroute_iptables_compat(),"
4453                        " network port label not found\n");
4454                 return err;
4455         }
4456         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4457 }
4458
4459 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4460                                                 int ifindex,
4461                                                 struct avc_audit_data *ad,
4462                                                 u16 family,
4463                                                 char *addrp,
4464                                                 u8 proto)
4465 {
4466         struct sock *sk = skb->sk;
4467         struct sk_security_struct *sksec;
4468
4469         if (sk == NULL)
4470                 return NF_ACCEPT;
4471         sksec = sk->sk_security;
4472
4473         if (selinux_compat_net) {
4474                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4475                                                          ad, family, addrp))
4476                         return NF_DROP;
4477         } else {
4478                 if (avc_has_perm(sksec->sid, skb->secmark,
4479                                  SECCLASS_PACKET, PACKET__SEND, ad))
4480                         return NF_DROP;
4481         }
4482
4483         if (selinux_policycap_netpeer)
4484                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4485                         return NF_DROP;
4486
4487         return NF_ACCEPT;
4488 }
4489
4490 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4491                                          u16 family)
4492 {
4493         u32 secmark_perm;
4494         u32 peer_sid;
4495         struct sock *sk;
4496         struct avc_audit_data ad;
4497         char *addrp;
4498         u8 proto;
4499         u8 secmark_active;
4500         u8 peerlbl_active;
4501
4502         AVC_AUDIT_DATA_INIT(&ad, NET);
4503         ad.u.net.netif = ifindex;
4504         ad.u.net.family = family;
4505         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4506                 return NF_DROP;
4507
4508         /* If any sort of compatibility mode is enabled then handoff processing
4509          * to the selinux_ip_postroute_compat() function to deal with the
4510          * special handling.  We do this in an attempt to keep this function
4511          * as fast and as clean as possible. */
4512         if (selinux_compat_net || !selinux_policycap_netpeer)
4513                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4514                                                    family, addrp, proto);
4515
4516         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4517          * packet transformation so allow the packet to pass without any checks
4518          * since we'll have another chance to perform access control checks
4519          * when the packet is on it's final way out.
4520          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4521          *       is NULL, in this case go ahead and apply access control. */
4522         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4523                 return NF_ACCEPT;
4524
4525         secmark_active = selinux_secmark_enabled();
4526         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4527         if (!secmark_active && !peerlbl_active)
4528                 return NF_ACCEPT;
4529
4530         /* if the packet is locally generated (skb->sk != NULL) then use the
4531          * socket's label as the peer label, otherwise the packet is being
4532          * forwarded through this system and we need to fetch the peer label
4533          * directly from the packet */
4534         sk = skb->sk;
4535         if (sk) {
4536                 struct sk_security_struct *sksec = sk->sk_security;
4537                 peer_sid = sksec->sid;
4538                 secmark_perm = PACKET__SEND;
4539         } else {
4540                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4541                                 return NF_DROP;
4542                 secmark_perm = PACKET__FORWARD_OUT;
4543         }
4544
4545         if (secmark_active)
4546                 if (avc_has_perm(peer_sid, skb->secmark,
4547                                  SECCLASS_PACKET, secmark_perm, &ad))
4548                         return NF_DROP;
4549
4550         if (peerlbl_active) {
4551                 u32 if_sid;
4552                 u32 node_sid;
4553
4554                 if (sel_netif_sid(ifindex, &if_sid))
4555                         return NF_DROP;
4556                 if (avc_has_perm(peer_sid, if_sid,
4557                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4558                         return NF_DROP;
4559
4560                 if (sel_netnode_sid(addrp, family, &node_sid))
4561                         return NF_DROP;
4562                 if (avc_has_perm(peer_sid, node_sid,
4563                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4564                         return NF_DROP;
4565         }
4566
4567         return NF_ACCEPT;
4568 }
4569
4570 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4571                                            struct sk_buff *skb,
4572                                            const struct net_device *in,
4573                                            const struct net_device *out,
4574                                            int (*okfn)(struct sk_buff *))
4575 {
4576         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4577 }
4578
4579 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4580 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4581                                            struct sk_buff *skb,
4582                                            const struct net_device *in,
4583                                            const struct net_device *out,
4584                                            int (*okfn)(struct sk_buff *))
4585 {
4586         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4587 }
4588 #endif  /* IPV6 */
4589
4590 #endif  /* CONFIG_NETFILTER */
4591
4592 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4593 {
4594         int err;
4595
4596         err = secondary_ops->netlink_send(sk, skb);
4597         if (err)
4598                 return err;
4599
4600         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4601                 err = selinux_nlmsg_perm(sk, skb);
4602
4603         return err;
4604 }
4605
4606 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4607 {
4608         int err;
4609         struct avc_audit_data ad;
4610
4611         err = secondary_ops->netlink_recv(skb, capability);
4612         if (err)
4613                 return err;
4614
4615         AVC_AUDIT_DATA_INIT(&ad, CAP);
4616         ad.u.cap = capability;
4617
4618         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4619                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4620 }
4621
4622 static int ipc_alloc_security(struct task_struct *task,
4623                               struct kern_ipc_perm *perm,
4624                               u16 sclass)
4625 {
4626         struct task_security_struct *tsec = task->security;
4627         struct ipc_security_struct *isec;
4628
4629         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4630         if (!isec)
4631                 return -ENOMEM;
4632
4633         isec->sclass = sclass;
4634         isec->sid = tsec->sid;
4635         perm->security = isec;
4636
4637         return 0;
4638 }
4639
4640 static void ipc_free_security(struct kern_ipc_perm *perm)
4641 {
4642         struct ipc_security_struct *isec = perm->security;
4643         perm->security = NULL;
4644         kfree(isec);
4645 }
4646
4647 static int msg_msg_alloc_security(struct msg_msg *msg)
4648 {
4649         struct msg_security_struct *msec;
4650
4651         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4652         if (!msec)
4653                 return -ENOMEM;
4654
4655         msec->sid = SECINITSID_UNLABELED;
4656         msg->security = msec;
4657
4658         return 0;
4659 }
4660
4661 static void msg_msg_free_security(struct msg_msg *msg)
4662 {
4663         struct msg_security_struct *msec = msg->security;
4664
4665         msg->security = NULL;
4666         kfree(msec);
4667 }
4668
4669 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4670                         u32 perms)
4671 {
4672         struct task_security_struct *tsec;
4673         struct ipc_security_struct *isec;
4674         struct avc_audit_data ad;
4675
4676         tsec = current->security;
4677         isec = ipc_perms->security;
4678
4679         AVC_AUDIT_DATA_INIT(&ad, IPC);
4680         ad.u.ipc_id = ipc_perms->key;
4681
4682         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4683 }
4684
4685 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4686 {
4687         return msg_msg_alloc_security(msg);
4688 }
4689
4690 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4691 {
4692         msg_msg_free_security(msg);
4693 }
4694
4695 /* message queue security operations */
4696 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4697 {
4698         struct task_security_struct *tsec;
4699         struct ipc_security_struct *isec;
4700         struct avc_audit_data ad;
4701         int rc;
4702
4703         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4704         if (rc)
4705                 return rc;
4706
4707         tsec = current->security;
4708         isec = msq->q_perm.security;
4709
4710         AVC_AUDIT_DATA_INIT(&ad, IPC);
4711         ad.u.ipc_id = msq->q_perm.key;
4712
4713         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4714                           MSGQ__CREATE, &ad);
4715         if (rc) {
4716                 ipc_free_security(&msq->q_perm);
4717                 return rc;
4718         }
4719         return 0;
4720 }
4721
4722 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4723 {
4724         ipc_free_security(&msq->q_perm);
4725 }
4726
4727 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4728 {
4729         struct task_security_struct *tsec;
4730         struct ipc_security_struct *isec;
4731         struct avc_audit_data ad;
4732
4733         tsec = current->security;
4734         isec = msq->q_perm.security;
4735
4736         AVC_AUDIT_DATA_INIT(&ad, IPC);
4737         ad.u.ipc_id = msq->q_perm.key;
4738
4739         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4740                             MSGQ__ASSOCIATE, &ad);
4741 }
4742
4743 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4744 {
4745         int err;
4746         int perms;
4747
4748         switch (cmd) {
4749         case IPC_INFO:
4750         case MSG_INFO:
4751                 /* No specific object, just general system-wide information. */
4752                 return task_has_system(current, SYSTEM__IPC_INFO);
4753         case IPC_STAT:
4754         case MSG_STAT:
4755                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4756                 break;
4757         case IPC_SET:
4758                 perms = MSGQ__SETATTR;
4759                 break;
4760         case IPC_RMID:
4761                 perms = MSGQ__DESTROY;
4762                 break;
4763         default:
4764                 return 0;
4765         }
4766
4767         err = ipc_has_perm(&msq->q_perm, perms);
4768         return err;
4769 }
4770
4771 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4772 {
4773         struct task_security_struct *tsec;
4774         struct ipc_security_struct *isec;
4775         struct msg_security_struct *msec;
4776         struct avc_audit_data ad;
4777         int rc;
4778
4779         tsec = current->security;
4780         isec = msq->q_perm.security;
4781         msec = msg->security;
4782
4783         /*
4784          * First time through, need to assign label to the message
4785          */
4786         if (msec->sid == SECINITSID_UNLABELED) {
4787                 /*
4788                  * Compute new sid based on current process and
4789                  * message queue this message will be stored in
4790                  */
4791                 rc = security_transition_sid(tsec->sid,
4792                                              isec->sid,
4793                                              SECCLASS_MSG,
4794                                              &msec->sid);
4795                 if (rc)
4796                         return rc;
4797         }
4798
4799         AVC_AUDIT_DATA_INIT(&ad, IPC);
4800         ad.u.ipc_id = msq->q_perm.key;
4801
4802         /* Can this process write to the queue? */
4803         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4804                           MSGQ__WRITE, &ad);
4805         if (!rc)
4806                 /* Can this process send the message */
4807                 rc = avc_has_perm(tsec->sid, msec->sid,
4808                                   SECCLASS_MSG, MSG__SEND, &ad);
4809         if (!rc)
4810                 /* Can the message be put in the queue? */
4811                 rc = avc_has_perm(msec->sid, isec->sid,
4812                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4813
4814         return rc;
4815 }
4816
4817 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4818                                     struct task_struct *target,
4819                                     long type, int mode)
4820 {
4821         struct task_security_struct *tsec;
4822         struct ipc_security_struct *isec;
4823         struct msg_security_struct *msec;
4824         struct avc_audit_data ad;
4825         int rc;
4826
4827         tsec = target->security;
4828         isec = msq->q_perm.security;
4829         msec = msg->security;
4830
4831         AVC_AUDIT_DATA_INIT(&ad, IPC);
4832         ad.u.ipc_id = msq->q_perm.key;
4833
4834         rc = avc_has_perm(tsec->sid, isec->sid,
4835                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4836         if (!rc)
4837                 rc = avc_has_perm(tsec->sid, msec->sid,
4838                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4839         return rc;
4840 }
4841
4842 /* Shared Memory security operations */
4843 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4844 {
4845         struct task_security_struct *tsec;
4846         struct ipc_security_struct *isec;
4847         struct avc_audit_data ad;
4848         int rc;
4849
4850         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4851         if (rc)
4852                 return rc;
4853
4854         tsec = current->security;
4855         isec = shp->shm_perm.security;
4856
4857         AVC_AUDIT_DATA_INIT(&ad, IPC);
4858         ad.u.ipc_id = shp->shm_perm.key;
4859
4860         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4861                           SHM__CREATE, &ad);
4862         if (rc) {
4863                 ipc_free_security(&shp->shm_perm);
4864                 return rc;
4865         }
4866         return 0;
4867 }
4868
4869 static void selinux_shm_free_security(struct shmid_kernel *shp)
4870 {
4871         ipc_free_security(&shp->shm_perm);
4872 }
4873
4874 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4875 {
4876         struct task_security_struct *tsec;
4877         struct ipc_security_struct *isec;
4878         struct avc_audit_data ad;
4879
4880         tsec = current->security;
4881         isec = shp->shm_perm.security;
4882
4883         AVC_AUDIT_DATA_INIT(&ad, IPC);
4884         ad.u.ipc_id = shp->shm_perm.key;
4885
4886         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4887                             SHM__ASSOCIATE, &ad);
4888 }
4889
4890 /* Note, at this point, shp is locked down */
4891 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4892 {
4893         int perms;
4894         int err;
4895
4896         switch (cmd) {
4897         case IPC_INFO:
4898         case SHM_INFO:
4899                 /* No specific object, just general system-wide information. */
4900                 return task_has_system(current, SYSTEM__IPC_INFO);
4901         case IPC_STAT:
4902         case SHM_STAT:
4903                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4904                 break;
4905         case IPC_SET:
4906                 perms = SHM__SETATTR;
4907                 break;
4908         case SHM_LOCK:
4909         case SHM_UNLOCK:
4910                 perms = SHM__LOCK;
4911                 break;
4912         case IPC_RMID:
4913                 perms = SHM__DESTROY;
4914                 break;
4915         default:
4916                 return 0;
4917         }
4918
4919         err = ipc_has_perm(&shp->shm_perm, perms);
4920         return err;
4921 }
4922
4923 static int selinux_shm_shmat(struct shmid_kernel *shp,
4924                              char __user *shmaddr, int shmflg)
4925 {
4926         u32 perms;
4927         int rc;
4928
4929         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4930         if (rc)
4931                 return rc;
4932
4933         if (shmflg & SHM_RDONLY)
4934                 perms = SHM__READ;
4935         else
4936                 perms = SHM__READ | SHM__WRITE;
4937
4938         return ipc_has_perm(&shp->shm_perm, perms);
4939 }
4940
4941 /* Semaphore security operations */
4942 static int selinux_sem_alloc_security(struct sem_array *sma)
4943 {
4944         struct task_security_struct *tsec;
4945         struct ipc_security_struct *isec;
4946         struct avc_audit_data ad;
4947         int rc;
4948
4949         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4950         if (rc)
4951                 return rc;
4952
4953         tsec = current->security;
4954         isec = sma->sem_perm.security;
4955
4956         AVC_AUDIT_DATA_INIT(&ad, IPC);
4957         ad.u.ipc_id = sma->sem_perm.key;
4958
4959         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4960                           SEM__CREATE, &ad);
4961         if (rc) {
4962                 ipc_free_security(&sma->sem_perm);
4963                 return rc;
4964         }
4965         return 0;
4966 }
4967
4968 static void selinux_sem_free_security(struct sem_array *sma)
4969 {
4970         ipc_free_security(&sma->sem_perm);
4971 }
4972
4973 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4974 {
4975         struct task_security_struct *tsec;
4976         struct ipc_security_struct *isec;
4977         struct avc_audit_data ad;
4978
4979         tsec = current->security;
4980         isec = sma->sem_perm.security;
4981
4982         AVC_AUDIT_DATA_INIT(&ad, IPC);
4983         ad.u.ipc_id = sma->sem_perm.key;
4984
4985         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4986                             SEM__ASSOCIATE, &ad);
4987 }
4988
4989 /* Note, at this point, sma is locked down */
4990 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4991 {
4992         int err;
4993         u32 perms;
4994
4995         switch (cmd) {
4996         case IPC_INFO:
4997         case SEM_INFO:
4998                 /* No specific object, just general system-wide information. */
4999                 return task_has_system(current, SYSTEM__IPC_INFO);
5000         case GETPID:
5001         case GETNCNT:
5002         case GETZCNT:
5003                 perms = SEM__GETATTR;
5004                 break;
5005         case GETVAL:
5006         case GETALL:
5007                 perms = SEM__READ;
5008                 break;
5009         case SETVAL:
5010         case SETALL:
5011                 perms = SEM__WRITE;
5012                 break;
5013         case IPC_RMID:
5014                 perms = SEM__DESTROY;
5015                 break;
5016         case IPC_SET:
5017                 perms = SEM__SETATTR;
5018                 break;
5019         case IPC_STAT:
5020         case SEM_STAT:
5021                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5022                 break;
5023         default:
5024                 return 0;
5025         }
5026
5027         err = ipc_has_perm(&sma->sem_perm, perms);
5028         return err;
5029 }
5030
5031 static int selinux_sem_semop(struct sem_array *sma,
5032                              struct sembuf *sops, unsigned nsops, int alter)
5033 {
5034         u32 perms;
5035
5036         if (alter)
5037                 perms = SEM__READ | SEM__WRITE;
5038         else
5039                 perms = SEM__READ;
5040
5041         return ipc_has_perm(&sma->sem_perm, perms);
5042 }
5043
5044 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5045 {
5046         u32 av = 0;
5047
5048         av = 0;
5049         if (flag & S_IRUGO)
5050                 av |= IPC__UNIX_READ;
5051         if (flag & S_IWUGO)
5052                 av |= IPC__UNIX_WRITE;
5053
5054         if (av == 0)
5055                 return 0;
5056
5057         return ipc_has_perm(ipcp, av);
5058 }
5059
5060 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5061 {
5062         struct ipc_security_struct *isec = ipcp->security;
5063         *secid = isec->sid;
5064 }
5065
5066 /* module stacking operations */
5067 static int selinux_register_security(const char *name, struct security_operations *ops)
5068 {
5069         if (secondary_ops != original_ops) {
5070                 printk(KERN_ERR "%s:  There is already a secondary security "
5071                        "module registered.\n", __func__);
5072                 return -EINVAL;
5073         }
5074
5075         secondary_ops = ops;
5076
5077         printk(KERN_INFO "%s:  Registering secondary module %s\n",
5078                __func__,
5079                name);
5080
5081         return 0;
5082 }
5083
5084 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5085 {
5086         if (inode)
5087                 inode_doinit_with_dentry(inode, dentry);
5088 }
5089
5090 static int selinux_getprocattr(struct task_struct *p,
5091                                char *name, char **value)
5092 {
5093         struct task_security_struct *tsec;
5094         u32 sid;
5095         int error;
5096         unsigned len;
5097
5098         if (current != p) {
5099                 error = task_has_perm(current, p, PROCESS__GETATTR);
5100                 if (error)
5101                         return error;
5102         }
5103
5104         tsec = p->security;
5105
5106         if (!strcmp(name, "current"))
5107                 sid = tsec->sid;
5108         else if (!strcmp(name, "prev"))
5109                 sid = tsec->osid;
5110         else if (!strcmp(name, "exec"))
5111                 sid = tsec->exec_sid;
5112         else if (!strcmp(name, "fscreate"))
5113                 sid = tsec->create_sid;
5114         else if (!strcmp(name, "keycreate"))
5115                 sid = tsec->keycreate_sid;
5116         else if (!strcmp(name, "sockcreate"))
5117                 sid = tsec->sockcreate_sid;
5118         else
5119                 return -EINVAL;
5120
5121         if (!sid)
5122                 return 0;
5123
5124         error = security_sid_to_context(sid, value, &len);
5125         if (error)
5126                 return error;
5127         return len;
5128 }
5129
5130 static int selinux_setprocattr(struct task_struct *p,
5131                                char *name, void *value, size_t size)
5132 {
5133         struct task_security_struct *tsec;
5134         struct task_struct *tracer;
5135         u32 sid = 0;
5136         int error;
5137         char *str = value;
5138
5139         if (current != p) {
5140                 /* SELinux only allows a process to change its own
5141                    security attributes. */
5142                 return -EACCES;
5143         }
5144
5145         /*
5146          * Basic control over ability to set these attributes at all.
5147          * current == p, but we'll pass them separately in case the
5148          * above restriction is ever removed.
5149          */
5150         if (!strcmp(name, "exec"))
5151                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5152         else if (!strcmp(name, "fscreate"))
5153                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5154         else if (!strcmp(name, "keycreate"))
5155                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5156         else if (!strcmp(name, "sockcreate"))
5157                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5158         else if (!strcmp(name, "current"))
5159                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5160         else
5161                 error = -EINVAL;
5162         if (error)
5163                 return error;
5164
5165         /* Obtain a SID for the context, if one was specified. */
5166         if (size && str[1] && str[1] != '\n') {
5167                 if (str[size-1] == '\n') {
5168                         str[size-1] = 0;
5169                         size--;
5170                 }
5171                 error = security_context_to_sid(value, size, &sid);
5172                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5173                         if (!capable(CAP_MAC_ADMIN))
5174                                 return error;
5175                         error = security_context_to_sid_force(value, size,
5176                                                               &sid);
5177                 }
5178                 if (error)
5179                         return error;
5180         }
5181
5182         /* Permission checking based on the specified context is
5183            performed during the actual operation (execve,
5184            open/mkdir/...), when we know the full context of the
5185            operation.  See selinux_bprm_set_security for the execve
5186            checks and may_create for the file creation checks. The
5187            operation will then fail if the context is not permitted. */
5188         tsec = p->security;
5189         if (!strcmp(name, "exec"))
5190                 tsec->exec_sid = sid;
5191         else if (!strcmp(name, "fscreate"))
5192                 tsec->create_sid = sid;
5193         else if (!strcmp(name, "keycreate")) {
5194                 error = may_create_key(sid, p);
5195                 if (error)
5196                         return error;
5197                 tsec->keycreate_sid = sid;
5198         } else if (!strcmp(name, "sockcreate"))
5199                 tsec->sockcreate_sid = sid;
5200         else if (!strcmp(name, "current")) {
5201                 struct av_decision avd;
5202
5203                 if (sid == 0)
5204                         return -EINVAL;
5205
5206                 /* Only allow single threaded processes to change context */
5207                 if (atomic_read(&p->mm->mm_users) != 1) {
5208                         struct task_struct *g, *t;
5209                         struct mm_struct *mm = p->mm;
5210                         read_lock(&tasklist_lock);
5211                         do_each_thread(g, t) {
5212                                 if (t->mm == mm && t != p) {
5213                                         read_unlock(&tasklist_lock);
5214                                         return -EPERM;
5215                                 }
5216                         } while_each_thread(g, t);
5217                         read_unlock(&tasklist_lock);
5218                 }
5219
5220                 /* Check permissions for the transition. */
5221                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5222                                      PROCESS__DYNTRANSITION, NULL);
5223                 if (error)
5224                         return error;
5225
5226                 /* Check for ptracing, and update the task SID if ok.
5227                    Otherwise, leave SID unchanged and fail. */
5228                 task_lock(p);
5229                 rcu_read_lock();
5230                 tracer = task_tracer_task(p);
5231                 if (tracer != NULL) {
5232                         struct task_security_struct *ptsec = tracer->security;
5233                         u32 ptsid = ptsec->sid;
5234                         rcu_read_unlock();
5235                         error = avc_has_perm_noaudit(ptsid, sid,
5236                                                      SECCLASS_PROCESS,
5237                                                      PROCESS__PTRACE, 0, &avd);
5238                         if (!error)
5239                                 tsec->sid = sid;
5240                         task_unlock(p);
5241                         avc_audit(ptsid, sid, SECCLASS_PROCESS,
5242                                   PROCESS__PTRACE, &avd, error, NULL);
5243                         if (error)
5244                                 return error;
5245                 } else {
5246                         rcu_read_unlock();
5247                         tsec->sid = sid;
5248                         task_unlock(p);
5249                 }
5250         } else
5251                 return -EINVAL;
5252
5253         return size;
5254 }
5255
5256 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5257 {
5258         return security_sid_to_context(secid, secdata, seclen);
5259 }
5260
5261 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5262 {
5263         return security_context_to_sid(secdata, seclen, secid);
5264 }
5265
5266 static void selinux_release_secctx(char *secdata, u32 seclen)
5267 {
5268         kfree(secdata);
5269 }
5270
5271 #ifdef CONFIG_KEYS
5272
5273 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5274                              unsigned long flags)
5275 {
5276         struct task_security_struct *tsec = tsk->security;
5277         struct key_security_struct *ksec;
5278
5279         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5280         if (!ksec)
5281                 return -ENOMEM;
5282
5283         if (tsec->keycreate_sid)
5284                 ksec->sid = tsec->keycreate_sid;
5285         else
5286                 ksec->sid = tsec->sid;
5287         k->security = ksec;
5288
5289         return 0;
5290 }
5291
5292 static void selinux_key_free(struct key *k)
5293 {
5294         struct key_security_struct *ksec = k->security;
5295
5296         k->security = NULL;
5297         kfree(ksec);
5298 }
5299
5300 static int selinux_key_permission(key_ref_t key_ref,
5301                             struct task_struct *ctx,
5302                             key_perm_t perm)
5303 {
5304         struct key *key;
5305         struct task_security_struct *tsec;
5306         struct key_security_struct *ksec;
5307
5308         key = key_ref_to_ptr(key_ref);
5309
5310         tsec = ctx->security;
5311         ksec = key->security;
5312
5313         /* if no specific permissions are requested, we skip the
5314            permission check. No serious, additional covert channels
5315            appear to be created. */
5316         if (perm == 0)
5317                 return 0;
5318
5319         return avc_has_perm(tsec->sid, ksec->sid,
5320                             SECCLASS_KEY, perm, NULL);
5321 }
5322
5323 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5324 {
5325         struct key_security_struct *ksec = key->security;
5326         char *context = NULL;
5327         unsigned len;
5328         int rc;
5329
5330         rc = security_sid_to_context(ksec->sid, &context, &len);
5331         if (!rc)
5332                 rc = len;
5333         *_buffer = context;
5334         return rc;
5335 }
5336
5337 #endif
5338
5339 static struct security_operations selinux_ops = {
5340         .name =                         "selinux",
5341
5342         .ptrace =                       selinux_ptrace,
5343         .capget =                       selinux_capget,
5344         .capset_check =                 selinux_capset_check,
5345         .capset_set =                   selinux_capset_set,
5346         .sysctl =                       selinux_sysctl,
5347         .capable =                      selinux_capable,
5348         .quotactl =                     selinux_quotactl,
5349         .quota_on =                     selinux_quota_on,
5350         .syslog =                       selinux_syslog,
5351         .vm_enough_memory =             selinux_vm_enough_memory,
5352
5353         .netlink_send =                 selinux_netlink_send,
5354         .netlink_recv =                 selinux_netlink_recv,
5355
5356         .bprm_alloc_security =          selinux_bprm_alloc_security,
5357         .bprm_free_security =           selinux_bprm_free_security,
5358         .bprm_apply_creds =             selinux_bprm_apply_creds,
5359         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5360         .bprm_set_security =            selinux_bprm_set_security,
5361         .bprm_check_security =          selinux_bprm_check_security,
5362         .bprm_secureexec =              selinux_bprm_secureexec,
5363
5364         .sb_alloc_security =            selinux_sb_alloc_security,
5365         .sb_free_security =             selinux_sb_free_security,
5366         .sb_copy_data =                 selinux_sb_copy_data,
5367         .sb_kern_mount =                selinux_sb_kern_mount,
5368         .sb_statfs =                    selinux_sb_statfs,
5369         .sb_mount =                     selinux_mount,
5370         .sb_umount =                    selinux_umount,
5371         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5372         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5373         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5374         .sb_parse_opts_str =            selinux_parse_opts_str,
5375
5376
5377         .inode_alloc_security =         selinux_inode_alloc_security,
5378         .inode_free_security =          selinux_inode_free_security,
5379         .inode_init_security =          selinux_inode_init_security,
5380         .inode_create =                 selinux_inode_create,
5381         .inode_link =                   selinux_inode_link,
5382         .inode_unlink =                 selinux_inode_unlink,
5383         .inode_symlink =                selinux_inode_symlink,
5384         .inode_mkdir =                  selinux_inode_mkdir,
5385         .inode_rmdir =                  selinux_inode_rmdir,
5386         .inode_mknod =                  selinux_inode_mknod,
5387         .inode_rename =                 selinux_inode_rename,
5388         .inode_readlink =               selinux_inode_readlink,
5389         .inode_follow_link =            selinux_inode_follow_link,
5390         .inode_permission =             selinux_inode_permission,
5391         .inode_setattr =                selinux_inode_setattr,
5392         .inode_getattr =                selinux_inode_getattr,
5393         .inode_setxattr =               selinux_inode_setxattr,
5394         .inode_post_setxattr =          selinux_inode_post_setxattr,
5395         .inode_getxattr =               selinux_inode_getxattr,
5396         .inode_listxattr =              selinux_inode_listxattr,
5397         .inode_removexattr =            selinux_inode_removexattr,
5398         .inode_getsecurity =            selinux_inode_getsecurity,
5399         .inode_setsecurity =            selinux_inode_setsecurity,
5400         .inode_listsecurity =           selinux_inode_listsecurity,
5401         .inode_need_killpriv =          selinux_inode_need_killpriv,
5402         .inode_killpriv =               selinux_inode_killpriv,
5403         .inode_getsecid =               selinux_inode_getsecid,
5404
5405         .file_permission =              selinux_file_permission,
5406         .file_alloc_security =          selinux_file_alloc_security,
5407         .file_free_security =           selinux_file_free_security,
5408         .file_ioctl =                   selinux_file_ioctl,
5409         .file_mmap =                    selinux_file_mmap,
5410         .file_mprotect =                selinux_file_mprotect,
5411         .file_lock =                    selinux_file_lock,
5412         .file_fcntl =                   selinux_file_fcntl,
5413         .file_set_fowner =              selinux_file_set_fowner,
5414         .file_send_sigiotask =          selinux_file_send_sigiotask,
5415         .file_receive =                 selinux_file_receive,
5416
5417         .dentry_open =                  selinux_dentry_open,
5418
5419         .task_create =                  selinux_task_create,
5420         .task_alloc_security =          selinux_task_alloc_security,
5421         .task_free_security =           selinux_task_free_security,
5422         .task_setuid =                  selinux_task_setuid,
5423         .task_post_setuid =             selinux_task_post_setuid,
5424         .task_setgid =                  selinux_task_setgid,
5425         .task_setpgid =                 selinux_task_setpgid,
5426         .task_getpgid =                 selinux_task_getpgid,
5427         .task_getsid =                  selinux_task_getsid,
5428         .task_getsecid =                selinux_task_getsecid,
5429         .task_setgroups =               selinux_task_setgroups,
5430         .task_setnice =                 selinux_task_setnice,
5431         .task_setioprio =               selinux_task_setioprio,
5432         .task_getioprio =               selinux_task_getioprio,
5433         .task_setrlimit =               selinux_task_setrlimit,
5434         .task_setscheduler =            selinux_task_setscheduler,
5435         .task_getscheduler =            selinux_task_getscheduler,
5436         .task_movememory =              selinux_task_movememory,
5437         .task_kill =                    selinux_task_kill,
5438         .task_wait =                    selinux_task_wait,
5439         .task_prctl =                   selinux_task_prctl,
5440         .task_reparent_to_init =        selinux_task_reparent_to_init,
5441         .task_to_inode =                selinux_task_to_inode,
5442
5443         .ipc_permission =               selinux_ipc_permission,
5444         .ipc_getsecid =                 selinux_ipc_getsecid,
5445
5446         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5447         .msg_msg_free_security =        selinux_msg_msg_free_security,
5448
5449         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5450         .msg_queue_free_security =      selinux_msg_queue_free_security,
5451         .msg_queue_associate =          selinux_msg_queue_associate,
5452         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5453         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5454         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5455
5456         .shm_alloc_security =           selinux_shm_alloc_security,
5457         .shm_free_security =            selinux_shm_free_security,
5458         .shm_associate =                selinux_shm_associate,
5459         .shm_shmctl =                   selinux_shm_shmctl,
5460         .shm_shmat =                    selinux_shm_shmat,
5461
5462         .sem_alloc_security =           selinux_sem_alloc_security,
5463         .sem_free_security =            selinux_sem_free_security,
5464         .sem_associate =                selinux_sem_associate,
5465         .sem_semctl =                   selinux_sem_semctl,
5466         .sem_semop =                    selinux_sem_semop,
5467
5468         .register_security =            selinux_register_security,
5469
5470         .d_instantiate =                selinux_d_instantiate,
5471
5472         .getprocattr =                  selinux_getprocattr,
5473         .setprocattr =                  selinux_setprocattr,
5474
5475         .secid_to_secctx =              selinux_secid_to_secctx,
5476         .secctx_to_secid =              selinux_secctx_to_secid,
5477         .release_secctx =               selinux_release_secctx,
5478
5479         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5480         .unix_may_send =                selinux_socket_unix_may_send,
5481
5482         .socket_create =                selinux_socket_create,
5483         .socket_post_create =           selinux_socket_post_create,
5484         .socket_bind =                  selinux_socket_bind,
5485         .socket_connect =               selinux_socket_connect,
5486         .socket_listen =                selinux_socket_listen,
5487         .socket_accept =                selinux_socket_accept,
5488         .socket_sendmsg =               selinux_socket_sendmsg,
5489         .socket_recvmsg =               selinux_socket_recvmsg,
5490         .socket_getsockname =           selinux_socket_getsockname,
5491         .socket_getpeername =           selinux_socket_getpeername,
5492         .socket_getsockopt =            selinux_socket_getsockopt,
5493         .socket_setsockopt =            selinux_socket_setsockopt,
5494         .socket_shutdown =              selinux_socket_shutdown,
5495         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5496         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5497         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5498         .sk_alloc_security =            selinux_sk_alloc_security,
5499         .sk_free_security =             selinux_sk_free_security,
5500         .sk_clone_security =            selinux_sk_clone_security,
5501         .sk_getsecid =                  selinux_sk_getsecid,
5502         .sock_graft =                   selinux_sock_graft,
5503         .inet_conn_request =            selinux_inet_conn_request,
5504         .inet_csk_clone =               selinux_inet_csk_clone,
5505         .inet_conn_established =        selinux_inet_conn_established,
5506         .req_classify_flow =            selinux_req_classify_flow,
5507
5508 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5509         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5510         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5511         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5512         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5513         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5514         .xfrm_state_free_security =     selinux_xfrm_state_free,
5515         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5516         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5517         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5518         .xfrm_decode_session =          selinux_xfrm_decode_session,
5519 #endif
5520
5521 #ifdef CONFIG_KEYS
5522         .key_alloc =                    selinux_key_alloc,
5523         .key_free =                     selinux_key_free,
5524         .key_permission =               selinux_key_permission,
5525         .key_getsecurity =              selinux_key_getsecurity,
5526 #endif
5527
5528 #ifdef CONFIG_AUDIT
5529         .audit_rule_init =              selinux_audit_rule_init,
5530         .audit_rule_known =             selinux_audit_rule_known,
5531         .audit_rule_match =             selinux_audit_rule_match,
5532         .audit_rule_free =              selinux_audit_rule_free,
5533 #endif
5534 };
5535
5536 static __init int selinux_init(void)
5537 {
5538         struct task_security_struct *tsec;
5539
5540         if (!security_module_enable(&selinux_ops)) {
5541                 selinux_enabled = 0;
5542                 return 0;
5543         }
5544
5545         if (!selinux_enabled) {
5546                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5547                 return 0;
5548         }
5549
5550         printk(KERN_INFO "SELinux:  Initializing.\n");
5551
5552         /* Set the security state for the initial task. */
5553         if (task_alloc_security(current))
5554                 panic("SELinux:  Failed to initialize initial task.\n");
5555         tsec = current->security;
5556         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5557
5558         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5559                                             sizeof(struct inode_security_struct),
5560                                             0, SLAB_PANIC, NULL);
5561         avc_init();
5562
5563         original_ops = secondary_ops = security_ops;
5564         if (!secondary_ops)
5565                 panic("SELinux: No initial security operations\n");
5566         if (register_security(&selinux_ops))
5567                 panic("SELinux: Unable to register with kernel.\n");
5568
5569         if (selinux_enforcing)
5570                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5571         else
5572                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5573
5574         return 0;
5575 }
5576
5577 void selinux_complete_init(void)
5578 {
5579         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5580
5581         /* Set up any superblocks initialized prior to the policy load. */
5582         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5583         spin_lock(&sb_lock);
5584         spin_lock(&sb_security_lock);
5585 next_sb:
5586         if (!list_empty(&superblock_security_head)) {
5587                 struct superblock_security_struct *sbsec =
5588                                 list_entry(superblock_security_head.next,
5589                                            struct superblock_security_struct,
5590                                            list);
5591                 struct super_block *sb = sbsec->sb;
5592                 sb->s_count++;
5593                 spin_unlock(&sb_security_lock);
5594                 spin_unlock(&sb_lock);
5595                 down_read(&sb->s_umount);
5596                 if (sb->s_root)
5597                         superblock_doinit(sb, NULL);
5598                 drop_super(sb);
5599                 spin_lock(&sb_lock);
5600                 spin_lock(&sb_security_lock);
5601                 list_del_init(&sbsec->list);
5602                 goto next_sb;
5603         }
5604         spin_unlock(&sb_security_lock);
5605         spin_unlock(&sb_lock);
5606 }
5607
5608 /* SELinux requires early initialization in order to label
5609    all processes and objects when they are created. */
5610 security_initcall(selinux_init);
5611
5612 #if defined(CONFIG_NETFILTER)
5613
5614 static struct nf_hook_ops selinux_ipv4_ops[] = {
5615         {
5616                 .hook =         selinux_ipv4_postroute,
5617                 .owner =        THIS_MODULE,
5618                 .pf =           PF_INET,
5619                 .hooknum =      NF_INET_POST_ROUTING,
5620                 .priority =     NF_IP_PRI_SELINUX_LAST,
5621         },
5622         {
5623                 .hook =         selinux_ipv4_forward,
5624                 .owner =        THIS_MODULE,
5625                 .pf =           PF_INET,
5626                 .hooknum =      NF_INET_FORWARD,
5627                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5628         }
5629 };
5630
5631 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5632
5633 static struct nf_hook_ops selinux_ipv6_ops[] = {
5634         {
5635                 .hook =         selinux_ipv6_postroute,
5636                 .owner =        THIS_MODULE,
5637                 .pf =           PF_INET6,
5638                 .hooknum =      NF_INET_POST_ROUTING,
5639                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5640         },
5641         {
5642                 .hook =         selinux_ipv6_forward,
5643                 .owner =        THIS_MODULE,
5644                 .pf =           PF_INET6,
5645                 .hooknum =      NF_INET_FORWARD,
5646                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5647         }
5648 };
5649
5650 #endif  /* IPV6 */
5651
5652 static int __init selinux_nf_ip_init(void)
5653 {
5654         int err = 0;
5655         u32 iter;
5656
5657         if (!selinux_enabled)
5658                 goto out;
5659
5660         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5661
5662         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5663                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5664                 if (err)
5665                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5666                               err);
5667         }
5668
5669 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5670         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5671                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5672                 if (err)
5673                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5674                               err);
5675         }
5676 #endif  /* IPV6 */
5677
5678 out:
5679         return err;
5680 }
5681
5682 __initcall(selinux_nf_ip_init);
5683
5684 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5685 static void selinux_nf_ip_exit(void)
5686 {
5687         u32 iter;
5688
5689         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5690
5691         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5692                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5693 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5694         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5695                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5696 #endif  /* IPV6 */
5697 }
5698 #endif
5699
5700 #else /* CONFIG_NETFILTER */
5701
5702 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5703 #define selinux_nf_ip_exit()
5704 #endif
5705
5706 #endif /* CONFIG_NETFILTER */
5707
5708 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5709 static int selinux_disabled;
5710
5711 int selinux_disable(void)
5712 {
5713         extern void exit_sel_fs(void);
5714
5715         if (ss_initialized) {
5716                 /* Not permitted after initial policy load. */
5717                 return -EINVAL;
5718         }
5719
5720         if (selinux_disabled) {
5721                 /* Only do this once. */
5722                 return -EINVAL;
5723         }
5724
5725         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5726
5727         selinux_disabled = 1;
5728         selinux_enabled = 0;
5729
5730         /* Reset security_ops to the secondary module, dummy or capability. */
5731         security_ops = secondary_ops;
5732
5733         /* Unregister netfilter hooks. */
5734         selinux_nf_ip_exit();
5735
5736         /* Unregister selinuxfs. */
5737         exit_sel_fs();
5738
5739         return 0;
5740 }
5741 #endif