security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (isec->initialized == LABEL_INVALID) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static void inode_security_revalidate(struct inode *inode)
 277 {
 278         __inode_security_revalidate(inode, NULL, true);
 279 }
 280
 281 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 282 {
 283         return inode->i_security;
 284 }
 285
 286 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 287 {
 288         int error;
 289
 290         error = __inode_security_revalidate(inode, NULL, !rcu);
 291         if (error)
 292                 return ERR_PTR(error);
 293         return inode->i_security;
 294 }
 295
 296 /*
 297  * Get the security label of an inode.
 298  */
 299 static struct inode_security_struct *inode_security(struct inode *inode)
 300 {
 301         __inode_security_revalidate(inode, NULL, true);
 302         return inode->i_security;
 303 }
 304
 305 /*
 306  * Get the security label of a dentry's backing inode.
 307  */
 308 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 309 {
 310         struct inode *inode = d_backing_inode(dentry);
 311
 312         __inode_security_revalidate(inode, dentry, true);
 313         return inode->i_security;
 314 }
 315
 316 static void inode_free_rcu(struct rcu_head *head)
 317 {
 318         struct inode_security_struct *isec;
 319
 320         isec = container_of(head, struct inode_security_struct, rcu);
 321         kmem_cache_free(sel_inode_cache, isec);
 322 }
 323
 324 static void inode_free_security(struct inode *inode)
 325 {
 326         struct inode_security_struct *isec = inode->i_security;
 327         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 328
 329         /*
 330          * As not all inode security structures are in a list, we check for
 331          * empty list outside of the lock to make sure that we won't waste
 332          * time taking a lock doing nothing.
 333          *
 334          * The list_del_init() function can be safely called more than once.
 335          * It should not be possible for this function to be called with
 336          * concurrent list_add(), but for better safety against future changes
 337          * in the code, we use list_empty_careful() here.
 338          */
 339         if (!list_empty_careful(&isec->list)) {
 340                 spin_lock(&sbsec->isec_lock);
 341                 list_del_init(&isec->list);
 342                 spin_unlock(&sbsec->isec_lock);
 343         }
 344
 345         /*
 346          * The inode may still be referenced in a path walk and
 347          * a call to selinux_inode_permission() can be made
 348          * after inode_free_security() is called. Ideally, the VFS
 349          * wouldn't do this, but fixing that is a much harder
 350          * job. For now, simply free the i_security via RCU, and
 351          * leave the current inode->i_security pointer intact.
 352          * The inode will be freed after the RCU grace period too.
 353          */
 354         call_rcu(&isec->rcu, inode_free_rcu);
 355 }
 356
 357 static int file_alloc_security(struct file *file)
 358 {
 359         struct file_security_struct *fsec;
 360         u32 sid = current_sid();
 361
 362         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 363         if (!fsec)
 364                 return -ENOMEM;
 365
 366         fsec->sid = sid;
 367         fsec->fown_sid = sid;
 368         file->f_security = fsec;
 369
 370         return 0;
 371 }
 372
 373 static void file_free_security(struct file *file)
 374 {
 375         struct file_security_struct *fsec = file->f_security;
 376         file->f_security = NULL;
 377         kmem_cache_free(file_security_cache, fsec);
 378 }
 379
 380 static int superblock_alloc_security(struct super_block *sb)
 381 {
 382         struct superblock_security_struct *sbsec;
 383
 384         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 385         if (!sbsec)
 386                 return -ENOMEM;
 387
 388         mutex_init(&sbsec->lock);
 389         INIT_LIST_HEAD(&sbsec->isec_head);
 390         spin_lock_init(&sbsec->isec_lock);
 391         sbsec->sb = sb;
 392         sbsec->sid = SECINITSID_UNLABELED;
 393         sbsec->def_sid = SECINITSID_FILE;
 394         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 395         sb->s_security = sbsec;
 396
 397         return 0;
 398 }
 399
 400 static void superblock_free_security(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403         sb->s_security = NULL;
 404         kfree(sbsec);
 405 }
 406
 407 /* The file system's label must be initialized prior to use. */
 408
 409 static const char *labeling_behaviors[7] = {
 410         "uses xattr",
 411         "uses transition SIDs",
 412         "uses task SIDs",
 413         "uses genfs_contexts",
 414         "not configured for labeling",
 415         "uses mountpoint labeling",
 416         "uses native labeling",
 417 };
 418
 419 static inline int inode_doinit(struct inode *inode)
 420 {
 421         return inode_doinit_with_dentry(inode, NULL);
 422 }
 423
 424 enum {
 425         Opt_error = -1,
 426         Opt_context = 1,
 427         Opt_fscontext = 2,
 428         Opt_defcontext = 3,
 429         Opt_rootcontext = 4,
 430         Opt_labelsupport = 5,
 431         Opt_nextmntopt = 6,
 432 };
 433
 434 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 435
 436 static const match_table_t tokens = {
 437         {Opt_context, CONTEXT_STR "%s"},
 438         {Opt_fscontext, FSCONTEXT_STR "%s"},
 439         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 440         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 441         {Opt_labelsupport, LABELSUPP_STR},
 442         {Opt_error, NULL},
 443 };
 444
 445 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 446
 447 static int may_context_mount_sb_relabel(u32 sid,
 448                         struct superblock_security_struct *sbsec,
 449                         const struct cred *cred)
 450 {
 451         const struct task_security_struct *tsec = cred->security;
 452         int rc;
 453
 454         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 455                           FILESYSTEM__RELABELFROM, NULL);
 456         if (rc)
 457                 return rc;
 458
 459         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 460                           FILESYSTEM__RELABELTO, NULL);
 461         return rc;
 462 }
 463
 464 static int may_context_mount_inode_relabel(u32 sid,
 465                         struct superblock_security_struct *sbsec,
 466                         const struct cred *cred)
 467 {
 468         const struct task_security_struct *tsec = cred->security;
 469         int rc;
 470         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 471                           FILESYSTEM__RELABELFROM, NULL);
 472         if (rc)
 473                 return rc;
 474
 475         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 476                           FILESYSTEM__ASSOCIATE, NULL);
 477         return rc;
 478 }
 479
 480 static int selinux_is_sblabel_mnt(struct super_block *sb)
 481 {
 482         struct superblock_security_struct *sbsec = sb->s_security;
 483
 484         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 485                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 486                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 487                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 488                 /* Special handling. Genfs but also in-core setxattr handler */
 489                 !strcmp(sb->s_type->name, "sysfs") ||
 490                 !strcmp(sb->s_type->name, "pstore") ||
 491                 !strcmp(sb->s_type->name, "debugfs") ||
 492                 !strcmp(sb->s_type->name, "rootfs");
 493 }
 494
 495 static int sb_finish_set_opts(struct super_block *sb)
 496 {
 497         struct superblock_security_struct *sbsec = sb->s_security;
 498         struct dentry *root = sb->s_root;
 499         struct inode *root_inode = d_backing_inode(root);
 500         int rc = 0;
 501
 502         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 503                 /* Make sure that the xattr handler exists and that no
 504                    error other than -ENODATA is returned by getxattr on
 505                    the root directory.  -ENODATA is ok, as this may be
 506                    the first boot of the SELinux kernel before we have
 507                    assigned xattr values to the filesystem. */
 508                 if (!root_inode->i_op->getxattr) {
 509                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 510                                "xattr support\n", sb->s_id, sb->s_type->name);
 511                         rc = -EOPNOTSUPP;
 512                         goto out;
 513                 }
 514                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 515                 if (rc < 0 && rc != -ENODATA) {
 516                         if (rc == -EOPNOTSUPP)
 517                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 518                                        "%s) has no security xattr handler\n",
 519                                        sb->s_id, sb->s_type->name);
 520                         else
 521                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 522                                        "%s) getxattr errno %d\n", sb->s_id,
 523                                        sb->s_type->name, -rc);
 524                         goto out;
 525                 }
 526         }
 527
 528         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 529                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 530                        sb->s_id, sb->s_type->name);
 531
 532         sbsec->flags |= SE_SBINITIALIZED;
 533         if (selinux_is_sblabel_mnt(sb))
 534                 sbsec->flags |= SBLABEL_MNT;
 535
 536         /* Initialize the root inode. */
 537         rc = inode_doinit_with_dentry(root_inode, root);
 538
 539         /* Initialize any other inodes associated with the superblock, e.g.
 540            inodes created prior to initial policy load or inodes created
 541            during get_sb by a pseudo filesystem that directly
 542            populates itself. */
 543         spin_lock(&sbsec->isec_lock);
 544 next_inode:
 545         if (!list_empty(&sbsec->isec_head)) {
 546                 struct inode_security_struct *isec =
 547                                 list_entry(sbsec->isec_head.next,
 548                                            struct inode_security_struct, list);
 549                 struct inode *inode = isec->inode;
 550                 list_del_init(&isec->list);
 551                 spin_unlock(&sbsec->isec_lock);
 552                 inode = igrab(inode);
 553                 if (inode) {
 554                         if (!IS_PRIVATE(inode))
 555                                 inode_doinit(inode);
 556                         iput(inode);
 557                 }
 558                 spin_lock(&sbsec->isec_lock);
 559                 goto next_inode;
 560         }
 561         spin_unlock(&sbsec->isec_lock);
 562 out:
 563         return rc;
 564 }
 565
 566 /*
 567  * This function should allow an FS to ask what it's mount security
 568  * options were so it can use those later for submounts, displaying
 569  * mount options, or whatever.
 570  */
 571 static int selinux_get_mnt_opts(const struct super_block *sb,
 572                                 struct security_mnt_opts *opts)
 573 {
 574         int rc = 0, i;
 575         struct superblock_security_struct *sbsec = sb->s_security;
 576         char *context = NULL;
 577         u32 len;
 578         char tmp;
 579
 580         security_init_mnt_opts(opts);
 581
 582         if (!(sbsec->flags & SE_SBINITIALIZED))
 583                 return -EINVAL;
 584
 585         if (!ss_initialized)
 586                 return -EINVAL;
 587
 588         /* make sure we always check enough bits to cover the mask */
 589         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 590
 591         tmp = sbsec->flags & SE_MNTMASK;
 592         /* count the number of mount options for this sb */
 593         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 594                 if (tmp & 0x01)
 595                         opts->num_mnt_opts++;
 596                 tmp >>= 1;
 597         }
 598         /* Check if the Label support flag is set */
 599         if (sbsec->flags & SBLABEL_MNT)
 600                 opts->num_mnt_opts++;
 601
 602         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 603         if (!opts->mnt_opts) {
 604                 rc = -ENOMEM;
 605                 goto out_free;
 606         }
 607
 608         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 609         if (!opts->mnt_opts_flags) {
 610                 rc = -ENOMEM;
 611                 goto out_free;
 612         }
 613
 614         i = 0;
 615         if (sbsec->flags & FSCONTEXT_MNT) {
 616                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 617                 if (rc)
 618                         goto out_free;
 619                 opts->mnt_opts[i] = context;
 620                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 621         }
 622         if (sbsec->flags & CONTEXT_MNT) {
 623                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 624                 if (rc)
 625                         goto out_free;
 626                 opts->mnt_opts[i] = context;
 627                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 628         }
 629         if (sbsec->flags & DEFCONTEXT_MNT) {
 630                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 631                 if (rc)
 632                         goto out_free;
 633                 opts->mnt_opts[i] = context;
 634                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 635         }
 636         if (sbsec->flags & ROOTCONTEXT_MNT) {
 637                 struct dentry *root = sbsec->sb->s_root;
 638                 struct inode_security_struct *isec = backing_inode_security(root);
 639
 640                 rc = security_sid_to_context(isec->sid, &context, &len);
 641                 if (rc)
 642                         goto out_free;
 643                 opts->mnt_opts[i] = context;
 644                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 645         }
 646         if (sbsec->flags & SBLABEL_MNT) {
 647                 opts->mnt_opts[i] = NULL;
 648                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 649         }
 650
 651         BUG_ON(i != opts->num_mnt_opts);
 652
 653         return 0;
 654
 655 out_free:
 656         security_free_mnt_opts(opts);
 657         return rc;
 658 }
 659
 660 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 661                       u32 old_sid, u32 new_sid)
 662 {
 663         char mnt_flags = sbsec->flags & SE_MNTMASK;
 664
 665         /* check if the old mount command had the same options */
 666         if (sbsec->flags & SE_SBINITIALIZED)
 667                 if (!(sbsec->flags & flag) ||
 668                     (old_sid != new_sid))
 669                         return 1;
 670
 671         /* check if we were passed the same options twice,
 672          * aka someone passed context=a,context=b
 673          */
 674         if (!(sbsec->flags & SE_SBINITIALIZED))
 675                 if (mnt_flags & flag)
 676                         return 1;
 677         return 0;
 678 }
 679
 680 /*
 681  * Allow filesystems with binary mount data to explicitly set mount point
 682  * labeling information.
 683  */
 684 static int selinux_set_mnt_opts(struct super_block *sb,
 685                                 struct security_mnt_opts *opts,
 686                                 unsigned long kern_flags,
 687                                 unsigned long *set_kern_flags)
 688 {
 689         const struct cred *cred = current_cred();
 690         int rc = 0, i;
 691         struct superblock_security_struct *sbsec = sb->s_security;
 692         const char *name = sb->s_type->name;
 693         struct dentry *root = sbsec->sb->s_root;
 694         struct inode_security_struct *root_isec = backing_inode_security(root);
 695         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 696         u32 defcontext_sid = 0;
 697         char **mount_options = opts->mnt_opts;
 698         int *flags = opts->mnt_opts_flags;
 699         int num_opts = opts->num_mnt_opts;
 700
 701         mutex_lock(&sbsec->lock);
 702
 703         if (!ss_initialized) {
 704                 if (!num_opts) {
 705                         /* Defer initialization until selinux_complete_init,
 706                            after the initial policy is loaded and the security
 707                            server is ready to handle calls. */
 708                         goto out;
 709                 }
 710                 rc = -EINVAL;
 711                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 712                         "before the security server is initialized\n");
 713                 goto out;
 714         }
 715         if (kern_flags && !set_kern_flags) {
 716                 /* Specifying internal flags without providing a place to
 717                  * place the results is not allowed */
 718                 rc = -EINVAL;
 719                 goto out;
 720         }
 721
 722         /*
 723          * Binary mount data FS will come through this function twice.  Once
 724          * from an explicit call and once from the generic calls from the vfs.
 725          * Since the generic VFS calls will not contain any security mount data
 726          * we need to skip the double mount verification.
 727          *
 728          * This does open a hole in which we will not notice if the first
 729          * mount using this sb set explict options and a second mount using
 730          * this sb does not set any security options.  (The first options
 731          * will be used for both mounts)
 732          */
 733         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 734             && (num_opts == 0))
 735                 goto out;
 736
 737         /*
 738          * parse the mount options, check if they are valid sids.
 739          * also check if someone is trying to mount the same sb more
 740          * than once with different security options.
 741          */
 742         for (i = 0; i < num_opts; i++) {
 743                 u32 sid;
 744
 745                 if (flags[i] == SBLABEL_MNT)
 746                         continue;
 747                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 748                 if (rc) {
 749                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 750                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 751                                mount_options[i], sb->s_id, name, rc);
 752                         goto out;
 753                 }
 754                 switch (flags[i]) {
 755                 case FSCONTEXT_MNT:
 756                         fscontext_sid = sid;
 757
 758                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 759                                         fscontext_sid))
 760                                 goto out_double_mount;
 761
 762                         sbsec->flags |= FSCONTEXT_MNT;
 763                         break;
 764                 case CONTEXT_MNT:
 765                         context_sid = sid;
 766
 767                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 768                                         context_sid))
 769                                 goto out_double_mount;
 770
 771                         sbsec->flags |= CONTEXT_MNT;
 772                         break;
 773                 case ROOTCONTEXT_MNT:
 774                         rootcontext_sid = sid;
 775
 776                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 777                                         rootcontext_sid))
 778                                 goto out_double_mount;
 779
 780                         sbsec->flags |= ROOTCONTEXT_MNT;
 781
 782                         break;
 783                 case DEFCONTEXT_MNT:
 784                         defcontext_sid = sid;
 785
 786                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 787                                         defcontext_sid))
 788                                 goto out_double_mount;
 789
 790                         sbsec->flags |= DEFCONTEXT_MNT;
 791
 792                         break;
 793                 default:
 794                         rc = -EINVAL;
 795                         goto out;
 796                 }
 797         }
 798
 799         if (sbsec->flags & SE_SBINITIALIZED) {
 800                 /* previously mounted with options, but not on this attempt? */
 801                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 802                         goto out_double_mount;
 803                 rc = 0;
 804                 goto out;
 805         }
 806
 807         if (strcmp(sb->s_type->name, "proc") == 0)
 808                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 809
 810         if (!strcmp(sb->s_type->name, "debugfs") ||
 811             !strcmp(sb->s_type->name, "sysfs") ||
 812             !strcmp(sb->s_type->name, "pstore"))
 813                 sbsec->flags |= SE_SBGENFS;
 814
 815         if (!sbsec->behavior) {
 816                 /*
 817                  * Determine the labeling behavior to use for this
 818                  * filesystem type.
 819                  */
 820                 rc = security_fs_use(sb);
 821                 if (rc) {
 822                         printk(KERN_WARNING
 823                                 "%s: security_fs_use(%s) returned %d\n",
 824                                         __func__, sb->s_type->name, rc);
 825                         goto out;
 826                 }
 827         }
 828         /* sets the context of the superblock for the fs being mounted. */
 829         if (fscontext_sid) {
 830                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 831                 if (rc)
 832                         goto out;
 833
 834                 sbsec->sid = fscontext_sid;
 835         }
 836
 837         /*
 838          * Switch to using mount point labeling behavior.
 839          * sets the label used on all file below the mountpoint, and will set
 840          * the superblock context if not already set.
 841          */
 842         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 843                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 844                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 845         }
 846
 847         if (context_sid) {
 848                 if (!fscontext_sid) {
 849                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 850                                                           cred);
 851                         if (rc)
 852                                 goto out;
 853                         sbsec->sid = context_sid;
 854                 } else {
 855                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 856                                                              cred);
 857                         if (rc)
 858                                 goto out;
 859                 }
 860                 if (!rootcontext_sid)
 861                         rootcontext_sid = context_sid;
 862
 863                 sbsec->mntpoint_sid = context_sid;
 864                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 865         }
 866
 867         if (rootcontext_sid) {
 868                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 869                                                      cred);
 870                 if (rc)
 871                         goto out;
 872
 873                 root_isec->sid = rootcontext_sid;
 874                 root_isec->initialized = LABEL_INITIALIZED;
 875         }
 876
 877         if (defcontext_sid) {
 878                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 879                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 880                         rc = -EINVAL;
 881                         printk(KERN_WARNING "SELinux: defcontext option is "
 882                                "invalid for this filesystem type\n");
 883                         goto out;
 884                 }
 885
 886                 if (defcontext_sid != sbsec->def_sid) {
 887                         rc = may_context_mount_inode_relabel(defcontext_sid,
 888                                                              sbsec, cred);
 889                         if (rc)
 890                                 goto out;
 891                 }
 892
 893                 sbsec->def_sid = defcontext_sid;
 894         }
 895
 896         rc = sb_finish_set_opts(sb);
 897 out:
 898         mutex_unlock(&sbsec->lock);
 899         return rc;
 900 out_double_mount:
 901         rc = -EINVAL;
 902         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 903                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 904         goto out;
 905 }
 906
 907 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 908                                     const struct super_block *newsb)
 909 {
 910         struct superblock_security_struct *old = oldsb->s_security;
 911         struct superblock_security_struct *new = newsb->s_security;
 912         char oldflags = old->flags & SE_MNTMASK;
 913         char newflags = new->flags & SE_MNTMASK;
 914
 915         if (oldflags != newflags)
 916                 goto mismatch;
 917         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 918                 goto mismatch;
 919         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 920                 goto mismatch;
 921         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 922                 goto mismatch;
 923         if (oldflags & ROOTCONTEXT_MNT) {
 924                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 925                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 926                 if (oldroot->sid != newroot->sid)
 927                         goto mismatch;
 928         }
 929         return 0;
 930 mismatch:
 931         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 932                             "different security settings for (dev %s, "
 933                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 934         return -EBUSY;
 935 }
 936
 937 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 938                                         struct super_block *newsb)
 939 {
 940         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 941         struct superblock_security_struct *newsbsec = newsb->s_security;
 942
 943         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 944         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 945         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 946
 947         /*
 948          * if the parent was able to be mounted it clearly had no special lsm
 949          * mount options.  thus we can safely deal with this superblock later
 950          */
 951         if (!ss_initialized)
 952                 return 0;
 953
 954         /* how can we clone if the old one wasn't set up?? */
 955         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 956
 957         /* if fs is reusing a sb, make sure that the contexts match */
 958         if (newsbsec->flags & SE_SBINITIALIZED)
 959                 return selinux_cmp_sb_context(oldsb, newsb);
 960
 961         mutex_lock(&newsbsec->lock);
 962
 963         newsbsec->flags = oldsbsec->flags;
 964
 965         newsbsec->sid = oldsbsec->sid;
 966         newsbsec->def_sid = oldsbsec->def_sid;
 967         newsbsec->behavior = oldsbsec->behavior;
 968
 969         if (set_context) {
 970                 u32 sid = oldsbsec->mntpoint_sid;
 971
 972                 if (!set_fscontext)
 973                         newsbsec->sid = sid;
 974                 if (!set_rootcontext) {
 975                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 976                         newisec->sid = sid;
 977                 }
 978                 newsbsec->mntpoint_sid = sid;
 979         }
 980         if (set_rootcontext) {
 981                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 982                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 983
 984                 newisec->sid = oldisec->sid;
 985         }
 986
 987         sb_finish_set_opts(newsb);
 988         mutex_unlock(&newsbsec->lock);
 989         return 0;
 990 }
 991
 992 static int selinux_parse_opts_str(char *options,
 993                                   struct security_mnt_opts *opts)
 994 {
 995         char *p;
 996         char *context = NULL, *defcontext = NULL;
 997         char *fscontext = NULL, *rootcontext = NULL;
 998         int rc, num_mnt_opts = 0;
 999
1000         opts->num_mnt_opts = 0;
1001
1002         /* Standard string-based options. */
1003         while ((p = strsep(&options, "|")) != NULL) {
1004                 int token;
1005                 substring_t args[MAX_OPT_ARGS];
1006
1007                 if (!*p)
1008                         continue;
1009
1010                 token = match_token(p, tokens, args);
1011
1012                 switch (token) {
1013                 case Opt_context:
1014                         if (context || defcontext) {
1015                                 rc = -EINVAL;
1016                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1017                                 goto out_err;
1018                         }
1019                         context = match_strdup(&args[0]);
1020                         if (!context) {
1021                                 rc = -ENOMEM;
1022                                 goto out_err;
1023                         }
1024                         break;
1025
1026                 case Opt_fscontext:
1027                         if (fscontext) {
1028                                 rc = -EINVAL;
1029                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1030                                 goto out_err;
1031                         }
1032                         fscontext = match_strdup(&args[0]);
1033                         if (!fscontext) {
1034                                 rc = -ENOMEM;
1035                                 goto out_err;
1036                         }
1037                         break;
1038
1039                 case Opt_rootcontext:
1040                         if (rootcontext) {
1041                                 rc = -EINVAL;
1042                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1043                                 goto out_err;
1044                         }
1045                         rootcontext = match_strdup(&args[0]);
1046                         if (!rootcontext) {
1047                                 rc = -ENOMEM;
1048                                 goto out_err;
1049                         }
1050                         break;
1051
1052                 case Opt_defcontext:
1053                         if (context || defcontext) {
1054                                 rc = -EINVAL;
1055                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1056                                 goto out_err;
1057                         }
1058                         defcontext = match_strdup(&args[0]);
1059                         if (!defcontext) {
1060                                 rc = -ENOMEM;
1061                                 goto out_err;
1062                         }
1063                         break;
1064                 case Opt_labelsupport:
1065                         break;
1066                 default:
1067                         rc = -EINVAL;
1068                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1069                         goto out_err;
1070
1071                 }
1072         }
1073
1074         rc = -ENOMEM;
1075         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1076         if (!opts->mnt_opts)
1077                 goto out_err;
1078
1079         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1080         if (!opts->mnt_opts_flags) {
1081                 kfree(opts->mnt_opts);
1082                 goto out_err;
1083         }
1084
1085         if (fscontext) {
1086                 opts->mnt_opts[num_mnt_opts] = fscontext;
1087                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1088         }
1089         if (context) {
1090                 opts->mnt_opts[num_mnt_opts] = context;
1091                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1092         }
1093         if (rootcontext) {
1094                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1095                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1096         }
1097         if (defcontext) {
1098                 opts->mnt_opts[num_mnt_opts] = defcontext;
1099                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1100         }
1101
1102         opts->num_mnt_opts = num_mnt_opts;
1103         return 0;
1104
1105 out_err:
1106         kfree(context);
1107         kfree(defcontext);
1108         kfree(fscontext);
1109         kfree(rootcontext);
1110         return rc;
1111 }
1112 /*
1113  * string mount options parsing and call set the sbsec
1114  */
1115 static int superblock_doinit(struct super_block *sb, void *data)
1116 {
1117         int rc = 0;
1118         char *options = data;
1119         struct security_mnt_opts opts;
1120
1121         security_init_mnt_opts(&opts);
1122
1123         if (!data)
1124                 goto out;
1125
1126         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1127
1128         rc = selinux_parse_opts_str(options, &opts);
1129         if (rc)
1130                 goto out_err;
1131
1132 out:
1133         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1134
1135 out_err:
1136         security_free_mnt_opts(&opts);
1137         return rc;
1138 }
1139
1140 static void selinux_write_opts(struct seq_file *m,
1141                                struct security_mnt_opts *opts)
1142 {
1143         int i;
1144         char *prefix;
1145
1146         for (i = 0; i < opts->num_mnt_opts; i++) {
1147                 char *has_comma;
1148
1149                 if (opts->mnt_opts[i])
1150                         has_comma = strchr(opts->mnt_opts[i], ',');
1151                 else
1152                         has_comma = NULL;
1153
1154                 switch (opts->mnt_opts_flags[i]) {
1155                 case CONTEXT_MNT:
1156                         prefix = CONTEXT_STR;
1157                         break;
1158                 case FSCONTEXT_MNT:
1159                         prefix = FSCONTEXT_STR;
1160                         break;
1161                 case ROOTCONTEXT_MNT:
1162                         prefix = ROOTCONTEXT_STR;
1163                         break;
1164                 case DEFCONTEXT_MNT:
1165                         prefix = DEFCONTEXT_STR;
1166                         break;
1167                 case SBLABEL_MNT:
1168                         seq_putc(m, ',');
1169                         seq_puts(m, LABELSUPP_STR);
1170                         continue;
1171                 default:
1172                         BUG();
1173                         return;
1174                 };
1175                 /* we need a comma before each option */
1176                 seq_putc(m, ',');
1177                 seq_puts(m, prefix);
1178                 if (has_comma)
1179                         seq_putc(m, '\"');
1180                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1181                 if (has_comma)
1182                         seq_putc(m, '\"');
1183         }
1184 }
1185
1186 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1187 {
1188         struct security_mnt_opts opts;
1189         int rc;
1190
1191         rc = selinux_get_mnt_opts(sb, &opts);
1192         if (rc) {
1193                 /* before policy load we may get EINVAL, don't show anything */
1194                 if (rc == -EINVAL)
1195                         rc = 0;
1196                 return rc;
1197         }
1198
1199         selinux_write_opts(m, &opts);
1200
1201         security_free_mnt_opts(&opts);
1202
1203         return rc;
1204 }
1205
1206 static inline u16 inode_mode_to_security_class(umode_t mode)
1207 {
1208         switch (mode & S_IFMT) {
1209         case S_IFSOCK:
1210                 return SECCLASS_SOCK_FILE;
1211         case S_IFLNK:
1212                 return SECCLASS_LNK_FILE;
1213         case S_IFREG:
1214                 return SECCLASS_FILE;
1215         case S_IFBLK:
1216                 return SECCLASS_BLK_FILE;
1217         case S_IFDIR:
1218                 return SECCLASS_DIR;
1219         case S_IFCHR:
1220                 return SECCLASS_CHR_FILE;
1221         case S_IFIFO:
1222                 return SECCLASS_FIFO_FILE;
1223
1224         }
1225
1226         return SECCLASS_FILE;
1227 }
1228
1229 static inline int default_protocol_stream(int protocol)
1230 {
1231         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1232 }
1233
1234 static inline int default_protocol_dgram(int protocol)
1235 {
1236         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1237 }
1238
1239 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1240 {
1241         switch (family) {
1242         case PF_UNIX:
1243                 switch (type) {
1244                 case SOCK_STREAM:
1245                 case SOCK_SEQPACKET:
1246                         return SECCLASS_UNIX_STREAM_SOCKET;
1247                 case SOCK_DGRAM:
1248                         return SECCLASS_UNIX_DGRAM_SOCKET;
1249                 }
1250                 break;
1251         case PF_INET:
1252         case PF_INET6:
1253                 switch (type) {
1254                 case SOCK_STREAM:
1255                         if (default_protocol_stream(protocol))
1256                                 return SECCLASS_TCP_SOCKET;
1257                         else
1258                                 return SECCLASS_RAWIP_SOCKET;
1259                 case SOCK_DGRAM:
1260                         if (default_protocol_dgram(protocol))
1261                                 return SECCLASS_UDP_SOCKET;
1262                         else
1263                                 return SECCLASS_RAWIP_SOCKET;
1264                 case SOCK_DCCP:
1265                         return SECCLASS_DCCP_SOCKET;
1266                 default:
1267                         return SECCLASS_RAWIP_SOCKET;
1268                 }
1269                 break;
1270         case PF_NETLINK:
1271                 switch (protocol) {
1272                 case NETLINK_ROUTE:
1273                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1274                 case NETLINK_SOCK_DIAG:
1275                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1276                 case NETLINK_NFLOG:
1277                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1278                 case NETLINK_XFRM:
1279                         return SECCLASS_NETLINK_XFRM_SOCKET;
1280                 case NETLINK_SELINUX:
1281                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1282                 case NETLINK_ISCSI:
1283                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1284                 case NETLINK_AUDIT:
1285                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1286                 case NETLINK_FIB_LOOKUP:
1287                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1288                 case NETLINK_CONNECTOR:
1289                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1290                 case NETLINK_NETFILTER:
1291                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1292                 case NETLINK_DNRTMSG:
1293                         return SECCLASS_NETLINK_DNRT_SOCKET;
1294                 case NETLINK_KOBJECT_UEVENT:
1295                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1296                 case NETLINK_GENERIC:
1297                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1298                 case NETLINK_SCSITRANSPORT:
1299                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1300                 case NETLINK_RDMA:
1301                         return SECCLASS_NETLINK_RDMA_SOCKET;
1302                 case NETLINK_CRYPTO:
1303                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1304                 default:
1305                         return SECCLASS_NETLINK_SOCKET;
1306                 }
1307         case PF_PACKET:
1308                 return SECCLASS_PACKET_SOCKET;
1309         case PF_KEY:
1310                 return SECCLASS_KEY_SOCKET;
1311         case PF_APPLETALK:
1312                 return SECCLASS_APPLETALK_SOCKET;
1313         }
1314
1315         return SECCLASS_SOCKET;
1316 }
1317
1318 static int selinux_genfs_get_sid(struct dentry *dentry,
1319                                  u16 tclass,
1320                                  u16 flags,
1321                                  u32 *sid)
1322 {
1323         int rc;
1324         struct super_block *sb = dentry->d_inode->i_sb;
1325         char *buffer, *path;
1326
1327         buffer = (char *)__get_free_page(GFP_KERNEL);
1328         if (!buffer)
1329                 return -ENOMEM;
1330
1331         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1332         if (IS_ERR(path))
1333                 rc = PTR_ERR(path);
1334         else {
1335                 if (flags & SE_SBPROC) {
1336                         /* each process gets a /proc/PID/ entry. Strip off the
1337                          * PID part to get a valid selinux labeling.
1338                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1339                         while (path[1] >= '0' && path[1] <= '9') {
1340                                 path[1] = '/';
1341                                 path++;
1342                         }
1343                 }
1344                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1345         }
1346         free_page((unsigned long)buffer);
1347         return rc;
1348 }
1349
1350 /* The inode's security attributes must be initialized before first use. */
1351 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1352 {
1353         struct superblock_security_struct *sbsec = NULL;
1354         struct inode_security_struct *isec = inode->i_security;
1355         u32 sid;
1356         struct dentry *dentry;
1357 #define INITCONTEXTLEN 255
1358         char *context = NULL;
1359         unsigned len = 0;
1360         int rc = 0;
1361
1362         if (isec->initialized == LABEL_INITIALIZED)
1363                 goto out;
1364
1365         mutex_lock(&isec->lock);
1366         if (isec->initialized == LABEL_INITIALIZED)
1367                 goto out_unlock;
1368
1369         sbsec = inode->i_sb->s_security;
1370         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1371                 /* Defer initialization until selinux_complete_init,
1372                    after the initial policy is loaded and the security
1373                    server is ready to handle calls. */
1374                 spin_lock(&sbsec->isec_lock);
1375                 if (list_empty(&isec->list))
1376                         list_add(&isec->list, &sbsec->isec_head);
1377                 spin_unlock(&sbsec->isec_lock);
1378                 goto out_unlock;
1379         }
1380
1381         switch (sbsec->behavior) {
1382         case SECURITY_FS_USE_NATIVE:
1383                 break;
1384         case SECURITY_FS_USE_XATTR:
1385                 if (!inode->i_op->getxattr) {
1386                         isec->sid = sbsec->def_sid;
1387                         break;
1388                 }
1389
1390                 /* Need a dentry, since the xattr API requires one.
1391                    Life would be simpler if we could just pass the inode. */
1392                 if (opt_dentry) {
1393                         /* Called from d_instantiate or d_splice_alias. */
1394                         dentry = dget(opt_dentry);
1395                 } else {
1396                         /* Called from selinux_complete_init, try to find a dentry. */
1397                         dentry = d_find_alias(inode);
1398                 }
1399                 if (!dentry) {
1400                         /*
1401                          * this is can be hit on boot when a file is accessed
1402                          * before the policy is loaded.  When we load policy we
1403                          * may find inodes that have no dentry on the
1404                          * sbsec->isec_head list.  No reason to complain as these
1405                          * will get fixed up the next time we go through
1406                          * inode_doinit with a dentry, before these inodes could
1407                          * be used again by userspace.
1408                          */
1409                         goto out_unlock;
1410                 }
1411
1412                 len = INITCONTEXTLEN;
1413                 context = kmalloc(len+1, GFP_NOFS);
1414                 if (!context) {
1415                         rc = -ENOMEM;
1416                         dput(dentry);
1417                         goto out_unlock;
1418                 }
1419                 context[len] = '\0';
1420                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1421                                            context, len);
1422                 if (rc == -ERANGE) {
1423                         kfree(context);
1424
1425                         /* Need a larger buffer.  Query for the right size. */
1426                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1427                                                    NULL, 0);
1428                         if (rc < 0) {
1429                                 dput(dentry);
1430                                 goto out_unlock;
1431                         }
1432                         len = rc;
1433                         context = kmalloc(len+1, GFP_NOFS);
1434                         if (!context) {
1435                                 rc = -ENOMEM;
1436                                 dput(dentry);
1437                                 goto out_unlock;
1438                         }
1439                         context[len] = '\0';
1440                         rc = inode->i_op->getxattr(dentry,
1441                                                    XATTR_NAME_SELINUX,
1442                                                    context, len);
1443                 }
1444                 dput(dentry);
1445                 if (rc < 0) {
1446                         if (rc != -ENODATA) {
1447                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1448                                        "%d for dev=%s ino=%ld\n", __func__,
1449                                        -rc, inode->i_sb->s_id, inode->i_ino);
1450                                 kfree(context);
1451                                 goto out_unlock;
1452                         }
1453                         /* Map ENODATA to the default file SID */
1454                         sid = sbsec->def_sid;
1455                         rc = 0;
1456                 } else {
1457                         rc = security_context_to_sid_default(context, rc, &sid,
1458                                                              sbsec->def_sid,
1459                                                              GFP_NOFS);
1460                         if (rc) {
1461                                 char *dev = inode->i_sb->s_id;
1462                                 unsigned long ino = inode->i_ino;
1463
1464                                 if (rc == -EINVAL) {
1465                                         if (printk_ratelimit())
1466                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1467                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1468                                                         "filesystem in question.\n", ino, dev, context);
1469                                 } else {
1470                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1471                                                "returned %d for dev=%s ino=%ld\n",
1472                                                __func__, context, -rc, dev, ino);
1473                                 }
1474                                 kfree(context);
1475                                 /* Leave with the unlabeled SID */
1476                                 rc = 0;
1477                                 break;
1478                         }
1479                 }
1480                 kfree(context);
1481                 isec->sid = sid;
1482                 break;
1483         case SECURITY_FS_USE_TASK:
1484                 isec->sid = isec->task_sid;
1485                 break;
1486         case SECURITY_FS_USE_TRANS:
1487                 /* Default to the fs SID. */
1488                 isec->sid = sbsec->sid;
1489
1490                 /* Try to obtain a transition SID. */
1491                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1492                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1493                                              isec->sclass, NULL, &sid);
1494                 if (rc)
1495                         goto out_unlock;
1496                 isec->sid = sid;
1497                 break;
1498         case SECURITY_FS_USE_MNTPOINT:
1499                 isec->sid = sbsec->mntpoint_sid;
1500                 break;
1501         default:
1502                 /* Default to the fs superblock SID. */
1503                 isec->sid = sbsec->sid;
1504
1505                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1506                         /* We must have a dentry to determine the label on
1507                          * procfs inodes */
1508                         if (opt_dentry)
1509                                 /* Called from d_instantiate or
1510                                  * d_splice_alias. */
1511                                 dentry = dget(opt_dentry);
1512                         else
1513                                 /* Called from selinux_complete_init, try to
1514                                  * find a dentry. */
1515                                 dentry = d_find_alias(inode);
1516                         /*
1517                          * This can be hit on boot when a file is accessed
1518                          * before the policy is loaded.  When we load policy we
1519                          * may find inodes that have no dentry on the
1520                          * sbsec->isec_head list.  No reason to complain as
1521                          * these will get fixed up the next time we go through
1522                          * inode_doinit() with a dentry, before these inodes
1523                          * could be used again by userspace.
1524                          */
1525                         if (!dentry)
1526                                 goto out_unlock;
1527                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1528                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1529                                                    sbsec->flags, &sid);
1530                         dput(dentry);
1531                         if (rc)
1532                                 goto out_unlock;
1533                         isec->sid = sid;
1534                 }
1535                 break;
1536         }
1537
1538         isec->initialized = LABEL_INITIALIZED;
1539
1540 out_unlock:
1541         mutex_unlock(&isec->lock);
1542 out:
1543         if (isec->sclass == SECCLASS_FILE)
1544                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1545         return rc;
1546 }
1547
1548 /* Convert a Linux signal to an access vector. */
1549 static inline u32 signal_to_av(int sig)
1550 {
1551         u32 perm = 0;
1552
1553         switch (sig) {
1554         case SIGCHLD:
1555                 /* Commonly granted from child to parent. */
1556                 perm = PROCESS__SIGCHLD;
1557                 break;
1558         case SIGKILL:
1559                 /* Cannot be caught or ignored */
1560                 perm = PROCESS__SIGKILL;
1561                 break;
1562         case SIGSTOP:
1563                 /* Cannot be caught or ignored */
1564                 perm = PROCESS__SIGSTOP;
1565                 break;
1566         default:
1567                 /* All other signals. */
1568                 perm = PROCESS__SIGNAL;
1569                 break;
1570         }
1571
1572         return perm;
1573 }
1574
1575 /*
1576  * Check permission between a pair of credentials
1577  * fork check, ptrace check, etc.
1578  */
1579 static int cred_has_perm(const struct cred *actor,
1580                          const struct cred *target,
1581                          u32 perms)
1582 {
1583         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1584
1585         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1586 }
1587
1588 /*
1589  * Check permission between a pair of tasks, e.g. signal checks,
1590  * fork check, ptrace check, etc.
1591  * tsk1 is the actor and tsk2 is the target
1592  * - this uses the default subjective creds of tsk1
1593  */
1594 static int task_has_perm(const struct task_struct *tsk1,
1595                          const struct task_struct *tsk2,
1596                          u32 perms)
1597 {
1598         const struct task_security_struct *__tsec1, *__tsec2;
1599         u32 sid1, sid2;
1600
1601         rcu_read_lock();
1602         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1603         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1604         rcu_read_unlock();
1605         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1606 }
1607
1608 /*
1609  * Check permission between current and another task, e.g. signal checks,
1610  * fork check, ptrace check, etc.
1611  * current is the actor and tsk2 is the target
1612  * - this uses current's subjective creds
1613  */
1614 static int current_has_perm(const struct task_struct *tsk,
1615                             u32 perms)
1616 {
1617         u32 sid, tsid;
1618
1619         sid = current_sid();
1620         tsid = task_sid(tsk);
1621         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1622 }
1623
1624 #if CAP_LAST_CAP > 63
1625 #error Fix SELinux to handle capabilities > 63.
1626 #endif
1627
1628 /* Check whether a task is allowed to use a capability. */
1629 static int cred_has_capability(const struct cred *cred,
1630                                int cap, int audit)
1631 {
1632         struct common_audit_data ad;
1633         struct av_decision avd;
1634         u16 sclass;
1635         u32 sid = cred_sid(cred);
1636         u32 av = CAP_TO_MASK(cap);
1637         int rc;
1638
1639         ad.type = LSM_AUDIT_DATA_CAP;
1640         ad.u.cap = cap;
1641
1642         switch (CAP_TO_INDEX(cap)) {
1643         case 0:
1644                 sclass = SECCLASS_CAPABILITY;
1645                 break;
1646         case 1:
1647                 sclass = SECCLASS_CAPABILITY2;
1648                 break;
1649         default:
1650                 printk(KERN_ERR
1651                        "SELinux:  out of range capability %d\n", cap);
1652                 BUG();
1653                 return -EINVAL;
1654         }
1655
1656         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1657         if (audit == SECURITY_CAP_AUDIT) {
1658                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1659                 if (rc2)
1660                         return rc2;
1661         }
1662         return rc;
1663 }
1664
1665 /* Check whether a task is allowed to use a system operation. */
1666 static int task_has_system(struct task_struct *tsk,
1667                            u32 perms)
1668 {
1669         u32 sid = task_sid(tsk);
1670
1671         return avc_has_perm(sid, SECINITSID_KERNEL,
1672                             SECCLASS_SYSTEM, perms, NULL);
1673 }
1674
1675 /* Check whether a task has a particular permission to an inode.
1676    The 'adp' parameter is optional and allows other audit
1677    data to be passed (e.g. the dentry). */
1678 static int inode_has_perm(const struct cred *cred,
1679                           struct inode *inode,
1680                           u32 perms,
1681                           struct common_audit_data *adp)
1682 {
1683         struct inode_security_struct *isec;
1684         u32 sid;
1685
1686         validate_creds(cred);
1687
1688         if (unlikely(IS_PRIVATE(inode)))
1689                 return 0;
1690
1691         sid = cred_sid(cred);
1692         isec = inode->i_security;
1693
1694         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1695 }
1696
1697 /* Same as inode_has_perm, but pass explicit audit data containing
1698    the dentry to help the auditing code to more easily generate the
1699    pathname if needed. */
1700 static inline int dentry_has_perm(const struct cred *cred,
1701                                   struct dentry *dentry,
1702                                   u32 av)
1703 {
1704         struct inode *inode = d_backing_inode(dentry);
1705         struct common_audit_data ad;
1706
1707         ad.type = LSM_AUDIT_DATA_DENTRY;
1708         ad.u.dentry = dentry;
1709         __inode_security_revalidate(inode, dentry, true);
1710         return inode_has_perm(cred, inode, av, &ad);
1711 }
1712
1713 /* Same as inode_has_perm, but pass explicit audit data containing
1714    the path to help the auditing code to more easily generate the
1715    pathname if needed. */
1716 static inline int path_has_perm(const struct cred *cred,
1717                                 const struct path *path,
1718                                 u32 av)
1719 {
1720         struct inode *inode = d_backing_inode(path->dentry);
1721         struct common_audit_data ad;
1722
1723         ad.type = LSM_AUDIT_DATA_PATH;
1724         ad.u.path = *path;
1725         __inode_security_revalidate(inode, path->dentry, true);
1726         return inode_has_perm(cred, inode, av, &ad);
1727 }
1728
1729 /* Same as path_has_perm, but uses the inode from the file struct. */
1730 static inline int file_path_has_perm(const struct cred *cred,
1731                                      struct file *file,
1732                                      u32 av)
1733 {
1734         struct common_audit_data ad;
1735
1736         ad.type = LSM_AUDIT_DATA_PATH;
1737         ad.u.path = file->f_path;
1738         return inode_has_perm(cred, file_inode(file), av, &ad);
1739 }
1740
1741 /* Check whether a task can use an open file descriptor to
1742    access an inode in a given way.  Check access to the
1743    descriptor itself, and then use dentry_has_perm to
1744    check a particular permission to the file.
1745    Access to the descriptor is implicitly granted if it
1746    has the same SID as the process.  If av is zero, then
1747    access to the file is not checked, e.g. for cases
1748    where only the descriptor is affected like seek. */
1749 static int file_has_perm(const struct cred *cred,
1750                          struct file *file,
1751                          u32 av)
1752 {
1753         struct file_security_struct *fsec = file->f_security;
1754         struct inode *inode = file_inode(file);
1755         struct common_audit_data ad;
1756         u32 sid = cred_sid(cred);
1757         int rc;
1758
1759         ad.type = LSM_AUDIT_DATA_PATH;
1760         ad.u.path = file->f_path;
1761
1762         if (sid != fsec->sid) {
1763                 rc = avc_has_perm(sid, fsec->sid,
1764                                   SECCLASS_FD,
1765                                   FD__USE,
1766                                   &ad);
1767                 if (rc)
1768                         goto out;
1769         }
1770
1771         /* av is zero if only checking access to the descriptor. */
1772         rc = 0;
1773         if (av)
1774                 rc = inode_has_perm(cred, inode, av, &ad);
1775
1776 out:
1777         return rc;
1778 }
1779
1780 /*
1781  * Determine the label for an inode that might be unioned.
1782  */
1783 static int selinux_determine_inode_label(struct inode *dir,
1784                                          const struct qstr *name,
1785                                          u16 tclass,
1786                                          u32 *_new_isid)
1787 {
1788         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1789         const struct inode_security_struct *dsec = inode_security(dir);
1790         const struct task_security_struct *tsec = current_security();
1791
1792         if ((sbsec->flags & SE_SBINITIALIZED) &&
1793             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1794                 *_new_isid = sbsec->mntpoint_sid;
1795         } else if ((sbsec->flags & SBLABEL_MNT) &&
1796                    tsec->create_sid) {
1797                 *_new_isid = tsec->create_sid;
1798         } else {
1799                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1800                                                name, _new_isid);
1801         }
1802
1803         return 0;
1804 }
1805
1806 /* Check whether a task can create a file. */
1807 static int may_create(struct inode *dir,
1808                       struct dentry *dentry,
1809                       u16 tclass)
1810 {
1811         const struct task_security_struct *tsec = current_security();
1812         struct inode_security_struct *dsec;
1813         struct superblock_security_struct *sbsec;
1814         u32 sid, newsid;
1815         struct common_audit_data ad;
1816         int rc;
1817
1818         dsec = inode_security(dir);
1819         sbsec = dir->i_sb->s_security;
1820
1821         sid = tsec->sid;
1822
1823         ad.type = LSM_AUDIT_DATA_DENTRY;
1824         ad.u.dentry = dentry;
1825
1826         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1827                           DIR__ADD_NAME | DIR__SEARCH,
1828                           &ad);
1829         if (rc)
1830                 return rc;
1831
1832         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1833                                            &newsid);
1834         if (rc)
1835                 return rc;
1836
1837         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1838         if (rc)
1839                 return rc;
1840
1841         return avc_has_perm(newsid, sbsec->sid,
1842                             SECCLASS_FILESYSTEM,
1843                             FILESYSTEM__ASSOCIATE, &ad);
1844 }
1845
1846 /* Check whether a task can create a key. */
1847 static int may_create_key(u32 ksid,
1848                           struct task_struct *ctx)
1849 {
1850         u32 sid = task_sid(ctx);
1851
1852         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1853 }
1854
1855 #define MAY_LINK        0
1856 #define MAY_UNLINK      1
1857 #define MAY_RMDIR       2
1858
1859 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1860 static int may_link(struct inode *dir,
1861                     struct dentry *dentry,
1862                     int kind)
1863
1864 {
1865         struct inode_security_struct *dsec, *isec;
1866         struct common_audit_data ad;
1867         u32 sid = current_sid();
1868         u32 av;
1869         int rc;
1870
1871         dsec = inode_security(dir);
1872         isec = backing_inode_security(dentry);
1873
1874         ad.type = LSM_AUDIT_DATA_DENTRY;
1875         ad.u.dentry = dentry;
1876
1877         av = DIR__SEARCH;
1878         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1879         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1880         if (rc)
1881                 return rc;
1882
1883         switch (kind) {
1884         case MAY_LINK:
1885                 av = FILE__LINK;
1886                 break;
1887         case MAY_UNLINK:
1888                 av = FILE__UNLINK;
1889                 break;
1890         case MAY_RMDIR:
1891                 av = DIR__RMDIR;
1892                 break;
1893         default:
1894                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1895                         __func__, kind);
1896                 return 0;
1897         }
1898
1899         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1900         return rc;
1901 }
1902
1903 static inline int may_rename(struct inode *old_dir,
1904                              struct dentry *old_dentry,
1905                              struct inode *new_dir,
1906                              struct dentry *new_dentry)
1907 {
1908         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1909         struct common_audit_data ad;
1910         u32 sid = current_sid();
1911         u32 av;
1912         int old_is_dir, new_is_dir;
1913         int rc;
1914
1915         old_dsec = inode_security(old_dir);
1916         old_isec = backing_inode_security(old_dentry);
1917         old_is_dir = d_is_dir(old_dentry);
1918         new_dsec = inode_security(new_dir);
1919
1920         ad.type = LSM_AUDIT_DATA_DENTRY;
1921
1922         ad.u.dentry = old_dentry;
1923         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1924                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1925         if (rc)
1926                 return rc;
1927         rc = avc_has_perm(sid, old_isec->sid,
1928                           old_isec->sclass, FILE__RENAME, &ad);
1929         if (rc)
1930                 return rc;
1931         if (old_is_dir && new_dir != old_dir) {
1932                 rc = avc_has_perm(sid, old_isec->sid,
1933                                   old_isec->sclass, DIR__REPARENT, &ad);
1934                 if (rc)
1935                         return rc;
1936         }
1937
1938         ad.u.dentry = new_dentry;
1939         av = DIR__ADD_NAME | DIR__SEARCH;
1940         if (d_is_positive(new_dentry))
1941                 av |= DIR__REMOVE_NAME;
1942         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1943         if (rc)
1944                 return rc;
1945         if (d_is_positive(new_dentry)) {
1946                 new_isec = backing_inode_security(new_dentry);
1947                 new_is_dir = d_is_dir(new_dentry);
1948                 rc = avc_has_perm(sid, new_isec->sid,
1949                                   new_isec->sclass,
1950                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1951                 if (rc)
1952                         return rc;
1953         }
1954
1955         return 0;
1956 }
1957
1958 /* Check whether a task can perform a filesystem operation. */
1959 static int superblock_has_perm(const struct cred *cred,
1960                                struct super_block *sb,
1961                                u32 perms,
1962                                struct common_audit_data *ad)
1963 {
1964         struct superblock_security_struct *sbsec;
1965         u32 sid = cred_sid(cred);
1966
1967         sbsec = sb->s_security;
1968         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1969 }
1970
1971 /* Convert a Linux mode and permission mask to an access vector. */
1972 static inline u32 file_mask_to_av(int mode, int mask)
1973 {
1974         u32 av = 0;
1975
1976         if (!S_ISDIR(mode)) {
1977                 if (mask & MAY_EXEC)
1978                         av |= FILE__EXECUTE;
1979                 if (mask & MAY_READ)
1980                         av |= FILE__READ;
1981
1982                 if (mask & MAY_APPEND)
1983                         av |= FILE__APPEND;
1984                 else if (mask & MAY_WRITE)
1985                         av |= FILE__WRITE;
1986
1987         } else {
1988                 if (mask & MAY_EXEC)
1989                         av |= DIR__SEARCH;
1990                 if (mask & MAY_WRITE)
1991                         av |= DIR__WRITE;
1992                 if (mask & MAY_READ)
1993                         av |= DIR__READ;
1994         }
1995
1996         return av;
1997 }
1998
1999 /* Convert a Linux file to an access vector. */
2000 static inline u32 file_to_av(struct file *file)
2001 {
2002         u32 av = 0;
2003
2004         if (file->f_mode & FMODE_READ)
2005                 av |= FILE__READ;
2006         if (file->f_mode & FMODE_WRITE) {
2007                 if (file->f_flags & O_APPEND)
2008                         av |= FILE__APPEND;
2009                 else
2010                         av |= FILE__WRITE;
2011         }
2012         if (!av) {
2013                 /*
2014                  * Special file opened with flags 3 for ioctl-only use.
2015                  */
2016                 av = FILE__IOCTL;
2017         }
2018
2019         return av;
2020 }
2021
2022 /*
2023  * Convert a file to an access vector and include the correct open
2024  * open permission.
2025  */
2026 static inline u32 open_file_to_av(struct file *file)
2027 {
2028         u32 av = file_to_av(file);
2029
2030         if (selinux_policycap_openperm)
2031                 av |= FILE__OPEN;
2032
2033         return av;
2034 }
2035
2036 /* Hook functions begin here. */
2037
2038 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2039 {
2040         u32 mysid = current_sid();
2041         u32 mgrsid = task_sid(mgr);
2042
2043         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2044                             BINDER__SET_CONTEXT_MGR, NULL);
2045 }
2046
2047 static int selinux_binder_transaction(struct task_struct *from,
2048                                       struct task_struct *to)
2049 {
2050         u32 mysid = current_sid();
2051         u32 fromsid = task_sid(from);
2052         u32 tosid = task_sid(to);
2053         int rc;
2054
2055         if (mysid != fromsid) {
2056                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2057                                   BINDER__IMPERSONATE, NULL);
2058                 if (rc)
2059                         return rc;
2060         }
2061
2062         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2063                             NULL);
2064 }
2065
2066 static int selinux_binder_transfer_binder(struct task_struct *from,
2067                                           struct task_struct *to)
2068 {
2069         u32 fromsid = task_sid(from);
2070         u32 tosid = task_sid(to);
2071
2072         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2073                             NULL);
2074 }
2075
2076 static int selinux_binder_transfer_file(struct task_struct *from,
2077                                         struct task_struct *to,
2078                                         struct file *file)
2079 {
2080         u32 sid = task_sid(to);
2081         struct file_security_struct *fsec = file->f_security;
2082         struct dentry *dentry = file->f_path.dentry;
2083         struct inode_security_struct *isec = backing_inode_security(dentry);
2084         struct common_audit_data ad;
2085         int rc;
2086
2087         ad.type = LSM_AUDIT_DATA_PATH;
2088         ad.u.path = file->f_path;
2089
2090         if (sid != fsec->sid) {
2091                 rc = avc_has_perm(sid, fsec->sid,
2092                                   SECCLASS_FD,
2093                                   FD__USE,
2094                                   &ad);
2095                 if (rc)
2096                         return rc;
2097         }
2098
2099         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2100                 return 0;
2101
2102         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2103                             &ad);
2104 }
2105
2106 static int selinux_ptrace_access_check(struct task_struct *child,
2107                                      unsigned int mode)
2108 {
2109         if (mode & PTRACE_MODE_READ) {
2110                 u32 sid = current_sid();
2111                 u32 csid = task_sid(child);
2112                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2113         }
2114
2115         return current_has_perm(child, PROCESS__PTRACE);
2116 }
2117
2118 static int selinux_ptrace_traceme(struct task_struct *parent)
2119 {
2120         return task_has_perm(parent, current, PROCESS__PTRACE);
2121 }
2122
2123 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2124                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2125 {
2126         return current_has_perm(target, PROCESS__GETCAP);
2127 }
2128
2129 static int selinux_capset(struct cred *new, const struct cred *old,
2130                           const kernel_cap_t *effective,
2131                           const kernel_cap_t *inheritable,
2132                           const kernel_cap_t *permitted)
2133 {
2134         return cred_has_perm(old, new, PROCESS__SETCAP);
2135 }
2136
2137 /*
2138  * (This comment used to live with the selinux_task_setuid hook,
2139  * which was removed).
2140  *
2141  * Since setuid only affects the current process, and since the SELinux
2142  * controls are not based on the Linux identity attributes, SELinux does not
2143  * need to control this operation.  However, SELinux does control the use of
2144  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2145  */
2146
2147 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2148                            int cap, int audit)
2149 {
2150         return cred_has_capability(cred, cap, audit);
2151 }
2152
2153 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2154 {
2155         const struct cred *cred = current_cred();
2156         int rc = 0;
2157
2158         if (!sb)
2159                 return 0;
2160
2161         switch (cmds) {
2162         case Q_SYNC:
2163         case Q_QUOTAON:
2164         case Q_QUOTAOFF:
2165         case Q_SETINFO:
2166         case Q_SETQUOTA:
2167                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2168                 break;
2169         case Q_GETFMT:
2170         case Q_GETINFO:
2171         case Q_GETQUOTA:
2172                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2173                 break;
2174         default:
2175                 rc = 0;  /* let the kernel handle invalid cmds */
2176                 break;
2177         }
2178         return rc;
2179 }
2180
2181 static int selinux_quota_on(struct dentry *dentry)
2182 {
2183         const struct cred *cred = current_cred();
2184
2185         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2186 }
2187
2188 static int selinux_syslog(int type)
2189 {
2190         int rc;
2191
2192         switch (type) {
2193         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2194         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2195                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2196                 break;
2197         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2198         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2199         /* Set level of messages printed to console */
2200         case SYSLOG_ACTION_CONSOLE_LEVEL:
2201                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2202                 break;
2203         case SYSLOG_ACTION_CLOSE:       /* Close log */
2204         case SYSLOG_ACTION_OPEN:        /* Open log */
2205         case SYSLOG_ACTION_READ:        /* Read from log */
2206         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2207         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2208         default:
2209                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2210                 break;
2211         }
2212         return rc;
2213 }
2214
2215 /*
2216  * Check that a process has enough memory to allocate a new virtual
2217  * mapping. 0 means there is enough memory for the allocation to
2218  * succeed and -ENOMEM implies there is not.
2219  *
2220  * Do not audit the selinux permission check, as this is applied to all
2221  * processes that allocate mappings.
2222  */
2223 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2224 {
2225         int rc, cap_sys_admin = 0;
2226
2227         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2228                                         SECURITY_CAP_NOAUDIT);
2229         if (rc == 0)
2230                 cap_sys_admin = 1;
2231
2232         return cap_sys_admin;
2233 }
2234
2235 /* binprm security operations */
2236
2237 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2238                             const struct task_security_struct *old_tsec,
2239                             const struct task_security_struct *new_tsec)
2240 {
2241         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2242         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2243         int rc;
2244
2245         if (!nnp && !nosuid)
2246                 return 0; /* neither NNP nor nosuid */
2247
2248         if (new_tsec->sid == old_tsec->sid)
2249                 return 0; /* No change in credentials */
2250
2251         /*
2252          * The only transitions we permit under NNP or nosuid
2253          * are transitions to bounded SIDs, i.e. SIDs that are
2254          * guaranteed to only be allowed a subset of the permissions
2255          * of the current SID.
2256          */
2257         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2258         if (rc) {
2259                 /*
2260                  * On failure, preserve the errno values for NNP vs nosuid.
2261                  * NNP:  Operation not permitted for caller.
2262                  * nosuid:  Permission denied to file.
2263                  */
2264                 if (nnp)
2265                         return -EPERM;
2266                 else
2267                         return -EACCES;
2268         }
2269         return 0;
2270 }
2271
2272 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2273 {
2274         const struct task_security_struct *old_tsec;
2275         struct task_security_struct *new_tsec;
2276         struct inode_security_struct *isec;
2277         struct common_audit_data ad;
2278         struct inode *inode = file_inode(bprm->file);
2279         int rc;
2280
2281         /* SELinux context only depends on initial program or script and not
2282          * the script interpreter */
2283         if (bprm->cred_prepared)
2284                 return 0;
2285
2286         old_tsec = current_security();
2287         new_tsec = bprm->cred->security;
2288         isec = inode_security(inode);
2289
2290         /* Default to the current task SID. */
2291         new_tsec->sid = old_tsec->sid;
2292         new_tsec->osid = old_tsec->sid;
2293
2294         /* Reset fs, key, and sock SIDs on execve. */
2295         new_tsec->create_sid = 0;
2296         new_tsec->keycreate_sid = 0;
2297         new_tsec->sockcreate_sid = 0;
2298
2299         if (old_tsec->exec_sid) {
2300                 new_tsec->sid = old_tsec->exec_sid;
2301                 /* Reset exec SID on execve. */
2302                 new_tsec->exec_sid = 0;
2303
2304                 /* Fail on NNP or nosuid if not an allowed transition. */
2305                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2306                 if (rc)
2307                         return rc;
2308         } else {
2309                 /* Check for a default transition on this program. */
2310                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2311                                              SECCLASS_PROCESS, NULL,
2312                                              &new_tsec->sid);
2313                 if (rc)
2314                         return rc;
2315
2316                 /*
2317                  * Fallback to old SID on NNP or nosuid if not an allowed
2318                  * transition.
2319                  */
2320                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2321                 if (rc)
2322                         new_tsec->sid = old_tsec->sid;
2323         }
2324
2325         ad.type = LSM_AUDIT_DATA_PATH;
2326         ad.u.path = bprm->file->f_path;
2327
2328         if (new_tsec->sid == old_tsec->sid) {
2329                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2330                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2331                 if (rc)
2332                         return rc;
2333         } else {
2334                 /* Check permissions for the transition. */
2335                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2336                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2337                 if (rc)
2338                         return rc;
2339
2340                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2341                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2342                 if (rc)
2343                         return rc;
2344
2345                 /* Check for shared state */
2346                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2347                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2348                                           SECCLASS_PROCESS, PROCESS__SHARE,
2349                                           NULL);
2350                         if (rc)
2351                                 return -EPERM;
2352                 }
2353
2354                 /* Make sure that anyone attempting to ptrace over a task that
2355                  * changes its SID has the appropriate permit */
2356                 if (bprm->unsafe &
2357                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2358                         struct task_struct *tracer;
2359                         struct task_security_struct *sec;
2360                         u32 ptsid = 0;
2361
2362                         rcu_read_lock();
2363                         tracer = ptrace_parent(current);
2364                         if (likely(tracer != NULL)) {
2365                                 sec = __task_cred(tracer)->security;
2366                                 ptsid = sec->sid;
2367                         }
2368                         rcu_read_unlock();
2369
2370                         if (ptsid != 0) {
2371                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2372                                                   SECCLASS_PROCESS,
2373                                                   PROCESS__PTRACE, NULL);
2374                                 if (rc)
2375                                         return -EPERM;
2376                         }
2377                 }
2378
2379                 /* Clear any possibly unsafe personality bits on exec: */
2380                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2381         }
2382
2383         return 0;
2384 }
2385
2386 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2387 {
2388         const struct task_security_struct *tsec = current_security();
2389         u32 sid, osid;
2390         int atsecure = 0;
2391
2392         sid = tsec->sid;
2393         osid = tsec->osid;
2394
2395         if (osid != sid) {
2396                 /* Enable secure mode for SIDs transitions unless
2397                    the noatsecure permission is granted between
2398                    the two SIDs, i.e. ahp returns 0. */
2399                 atsecure = avc_has_perm(osid, sid,
2400                                         SECCLASS_PROCESS,
2401                                         PROCESS__NOATSECURE, NULL);
2402         }
2403
2404         return !!atsecure;
2405 }
2406
2407 static int match_file(const void *p, struct file *file, unsigned fd)
2408 {
2409         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2410 }
2411
2412 /* Derived from fs/exec.c:flush_old_files. */
2413 static inline void flush_unauthorized_files(const struct cred *cred,
2414                                             struct files_struct *files)
2415 {
2416         struct file *file, *devnull = NULL;
2417         struct tty_struct *tty;
2418         int drop_tty = 0;
2419         unsigned n;
2420
2421         tty = get_current_tty();
2422         if (tty) {
2423                 spin_lock(&tty_files_lock);
2424                 if (!list_empty(&tty->tty_files)) {
2425                         struct tty_file_private *file_priv;
2426
2427                         /* Revalidate access to controlling tty.
2428                            Use file_path_has_perm on the tty path directly
2429                            rather than using file_has_perm, as this particular
2430                            open file may belong to another process and we are
2431                            only interested in the inode-based check here. */
2432                         file_priv = list_first_entry(&tty->tty_files,
2433                                                 struct tty_file_private, list);
2434                         file = file_priv->file;
2435                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2436                                 drop_tty = 1;
2437                 }
2438                 spin_unlock(&tty_files_lock);
2439                 tty_kref_put(tty);
2440         }
2441         /* Reset controlling tty. */
2442         if (drop_tty)
2443                 no_tty();
2444
2445         /* Revalidate access to inherited open files. */
2446         n = iterate_fd(files, 0, match_file, cred);
2447         if (!n) /* none found? */
2448                 return;
2449
2450         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2451         if (IS_ERR(devnull))
2452                 devnull = NULL;
2453         /* replace all the matching ones with this */
2454         do {
2455                 replace_fd(n - 1, devnull, 0);
2456         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2457         if (devnull)
2458                 fput(devnull);
2459 }
2460
2461 /*
2462  * Prepare a process for imminent new credential changes due to exec
2463  */
2464 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2465 {
2466         struct task_security_struct *new_tsec;
2467         struct rlimit *rlim, *initrlim;
2468         int rc, i;
2469
2470         new_tsec = bprm->cred->security;
2471         if (new_tsec->sid == new_tsec->osid)
2472                 return;
2473
2474         /* Close files for which the new task SID is not authorized. */
2475         flush_unauthorized_files(bprm->cred, current->files);
2476
2477         /* Always clear parent death signal on SID transitions. */
2478         current->pdeath_signal = 0;
2479
2480         /* Check whether the new SID can inherit resource limits from the old
2481          * SID.  If not, reset all soft limits to the lower of the current
2482          * task's hard limit and the init task's soft limit.
2483          *
2484          * Note that the setting of hard limits (even to lower them) can be
2485          * controlled by the setrlimit check.  The inclusion of the init task's
2486          * soft limit into the computation is to avoid resetting soft limits
2487          * higher than the default soft limit for cases where the default is
2488          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2489          */
2490         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2491                           PROCESS__RLIMITINH, NULL);
2492         if (rc) {
2493                 /* protect against do_prlimit() */
2494                 task_lock(current);
2495                 for (i = 0; i < RLIM_NLIMITS; i++) {
2496                         rlim = current->signal->rlim + i;
2497                         initrlim = init_task.signal->rlim + i;
2498                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2499                 }
2500                 task_unlock(current);
2501                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2502         }
2503 }
2504
2505 /*
2506  * Clean up the process immediately after the installation of new credentials
2507  * due to exec
2508  */
2509 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2510 {
2511         const struct task_security_struct *tsec = current_security();
2512         struct itimerval itimer;
2513         u32 osid, sid;
2514         int rc, i;
2515
2516         osid = tsec->osid;
2517         sid = tsec->sid;
2518
2519         if (sid == osid)
2520                 return;
2521
2522         /* Check whether the new SID can inherit signal state from the old SID.
2523          * If not, clear itimers to avoid subsequent signal generation and
2524          * flush and unblock signals.
2525          *
2526          * This must occur _after_ the task SID has been updated so that any
2527          * kill done after the flush will be checked against the new SID.
2528          */
2529         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2530         if (rc) {
2531                 memset(&itimer, 0, sizeof itimer);
2532                 for (i = 0; i < 3; i++)
2533                         do_setitimer(i, &itimer, NULL);
2534                 spin_lock_irq(&current->sighand->siglock);
2535                 if (!fatal_signal_pending(current)) {
2536                         flush_sigqueue(&current->pending);
2537                         flush_sigqueue(&current->signal->shared_pending);
2538                         flush_signal_handlers(current, 1);
2539                         sigemptyset(&current->blocked);
2540                         recalc_sigpending();
2541                 }
2542                 spin_unlock_irq(&current->sighand->siglock);
2543         }
2544
2545         /* Wake up the parent if it is waiting so that it can recheck
2546          * wait permission to the new task SID. */
2547         read_lock(&tasklist_lock);
2548         __wake_up_parent(current, current->real_parent);
2549         read_unlock(&tasklist_lock);
2550 }
2551
2552 /* superblock security operations */
2553
2554 static int selinux_sb_alloc_security(struct super_block *sb)
2555 {
2556         return superblock_alloc_security(sb);
2557 }
2558
2559 static void selinux_sb_free_security(struct super_block *sb)
2560 {
2561         superblock_free_security(sb);
2562 }
2563
2564 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2565 {
2566         if (plen > olen)
2567                 return 0;
2568
2569         return !memcmp(prefix, option, plen);
2570 }
2571
2572 static inline int selinux_option(char *option, int len)
2573 {
2574         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2575                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2576                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2577                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2578                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2579 }
2580
2581 static inline void take_option(char **to, char *from, int *first, int len)
2582 {
2583         if (!*first) {
2584                 **to = ',';
2585                 *to += 1;
2586         } else
2587                 *first = 0;
2588         memcpy(*to, from, len);
2589         *to += len;
2590 }
2591
2592 static inline void take_selinux_option(char **to, char *from, int *first,
2593                                        int len)
2594 {
2595         int current_size = 0;
2596
2597         if (!*first) {
2598                 **to = '|';
2599                 *to += 1;
2600         } else
2601                 *first = 0;
2602
2603         while (current_size < len) {
2604                 if (*from != '"') {
2605                         **to = *from;
2606                         *to += 1;
2607                 }
2608                 from += 1;
2609                 current_size += 1;
2610         }
2611 }
2612
2613 static int selinux_sb_copy_data(char *orig, char *copy)
2614 {
2615         int fnosec, fsec, rc = 0;
2616         char *in_save, *in_curr, *in_end;
2617         char *sec_curr, *nosec_save, *nosec;
2618         int open_quote = 0;
2619
2620         in_curr = orig;
2621         sec_curr = copy;
2622
2623         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2624         if (!nosec) {
2625                 rc = -ENOMEM;
2626                 goto out;
2627         }
2628
2629         nosec_save = nosec;
2630         fnosec = fsec = 1;
2631         in_save = in_end = orig;
2632
2633         do {
2634                 if (*in_end == '"')
2635                         open_quote = !open_quote;
2636                 if ((*in_end == ',' && open_quote == 0) ||
2637                                 *in_end == '\0') {
2638                         int len = in_end - in_curr;
2639
2640                         if (selinux_option(in_curr, len))
2641                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2642                         else
2643                                 take_option(&nosec, in_curr, &fnosec, len);
2644
2645                         in_curr = in_end + 1;
2646                 }
2647         } while (*in_end++);
2648
2649         strcpy(in_save, nosec_save);
2650         free_page((unsigned long)nosec_save);
2651 out:
2652         return rc;
2653 }
2654
2655 static int selinux_sb_remount(struct super_block *sb, void *data)
2656 {
2657         int rc, i, *flags;
2658         struct security_mnt_opts opts;
2659         char *secdata, **mount_options;
2660         struct superblock_security_struct *sbsec = sb->s_security;
2661
2662         if (!(sbsec->flags & SE_SBINITIALIZED))
2663                 return 0;
2664
2665         if (!data)
2666                 return 0;
2667
2668         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2669                 return 0;
2670
2671         security_init_mnt_opts(&opts);
2672         secdata = alloc_secdata();
2673         if (!secdata)
2674                 return -ENOMEM;
2675         rc = selinux_sb_copy_data(data, secdata);
2676         if (rc)
2677                 goto out_free_secdata;
2678
2679         rc = selinux_parse_opts_str(secdata, &opts);
2680         if (rc)
2681                 goto out_free_secdata;
2682
2683         mount_options = opts.mnt_opts;
2684         flags = opts.mnt_opts_flags;
2685
2686         for (i = 0; i < opts.num_mnt_opts; i++) {
2687                 u32 sid;
2688
2689                 if (flags[i] == SBLABEL_MNT)
2690                         continue;
2691                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2692                 if (rc) {
2693                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2694                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2695                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2696                         goto out_free_opts;
2697                 }
2698                 rc = -EINVAL;
2699                 switch (flags[i]) {
2700                 case FSCONTEXT_MNT:
2701                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2702                                 goto out_bad_option;
2703                         break;
2704                 case CONTEXT_MNT:
2705                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2706                                 goto out_bad_option;
2707                         break;
2708                 case ROOTCONTEXT_MNT: {
2709                         struct inode_security_struct *root_isec;
2710                         root_isec = backing_inode_security(sb->s_root);
2711
2712                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2713                                 goto out_bad_option;
2714                         break;
2715                 }
2716                 case DEFCONTEXT_MNT:
2717                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2718                                 goto out_bad_option;
2719                         break;
2720                 default:
2721                         goto out_free_opts;
2722                 }
2723         }
2724
2725         rc = 0;
2726 out_free_opts:
2727         security_free_mnt_opts(&opts);
2728 out_free_secdata:
2729         free_secdata(secdata);
2730         return rc;
2731 out_bad_option:
2732         printk(KERN_WARNING "SELinux: unable to change security options "
2733                "during remount (dev %s, type=%s)\n", sb->s_id,
2734                sb->s_type->name);
2735         goto out_free_opts;
2736 }
2737
2738 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2739 {
2740         const struct cred *cred = current_cred();
2741         struct common_audit_data ad;
2742         int rc;
2743
2744         rc = superblock_doinit(sb, data);
2745         if (rc)
2746                 return rc;
2747
2748         /* Allow all mounts performed by the kernel */
2749         if (flags & MS_KERNMOUNT)
2750                 return 0;
2751
2752         ad.type = LSM_AUDIT_DATA_DENTRY;
2753         ad.u.dentry = sb->s_root;
2754         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2755 }
2756
2757 static int selinux_sb_statfs(struct dentry *dentry)
2758 {
2759         const struct cred *cred = current_cred();
2760         struct common_audit_data ad;
2761
2762         ad.type = LSM_AUDIT_DATA_DENTRY;
2763         ad.u.dentry = dentry->d_sb->s_root;
2764         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2765 }
2766
2767 static int selinux_mount(const char *dev_name,
2768                          struct path *path,
2769                          const char *type,
2770                          unsigned long flags,
2771                          void *data)
2772 {
2773         const struct cred *cred = current_cred();
2774
2775         if (flags & MS_REMOUNT)
2776                 return superblock_has_perm(cred, path->dentry->d_sb,
2777                                            FILESYSTEM__REMOUNT, NULL);
2778         else
2779                 return path_has_perm(cred, path, FILE__MOUNTON);
2780 }
2781
2782 static int selinux_umount(struct vfsmount *mnt, int flags)
2783 {
2784         const struct cred *cred = current_cred();
2785
2786         return superblock_has_perm(cred, mnt->mnt_sb,
2787                                    FILESYSTEM__UNMOUNT, NULL);
2788 }
2789
2790 /* inode security operations */
2791
2792 static int selinux_inode_alloc_security(struct inode *inode)
2793 {
2794         return inode_alloc_security(inode);
2795 }
2796
2797 static void selinux_inode_free_security(struct inode *inode)
2798 {
2799         inode_free_security(inode);
2800 }
2801
2802 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2803                                         struct qstr *name, void **ctx,
2804                                         u32 *ctxlen)
2805 {
2806         u32 newsid;
2807         int rc;
2808
2809         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2810                                            inode_mode_to_security_class(mode),
2811                                            &newsid);
2812         if (rc)
2813                 return rc;
2814
2815         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2816 }
2817
2818 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2819                                        const struct qstr *qstr,
2820                                        const char **name,
2821                                        void **value, size_t *len)
2822 {
2823         const struct task_security_struct *tsec = current_security();
2824         struct superblock_security_struct *sbsec;
2825         u32 sid, newsid, clen;
2826         int rc;
2827         char *context;
2828
2829         sbsec = dir->i_sb->s_security;
2830
2831         sid = tsec->sid;
2832         newsid = tsec->create_sid;
2833
2834         rc = selinux_determine_inode_label(
2835                 dir, qstr,
2836                 inode_mode_to_security_class(inode->i_mode),
2837                 &newsid);
2838         if (rc)
2839                 return rc;
2840
2841         /* Possibly defer initialization to selinux_complete_init. */
2842         if (sbsec->flags & SE_SBINITIALIZED) {
2843                 struct inode_security_struct *isec = inode->i_security;
2844                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2845                 isec->sid = newsid;
2846                 isec->initialized = LABEL_INITIALIZED;
2847         }
2848
2849         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2850                 return -EOPNOTSUPP;
2851
2852         if (name)
2853                 *name = XATTR_SELINUX_SUFFIX;
2854
2855         if (value && len) {
2856                 rc = security_sid_to_context_force(newsid, &context, &clen);
2857                 if (rc)
2858                         return rc;
2859                 *value = context;
2860                 *len = clen;
2861         }
2862
2863         return 0;
2864 }
2865
2866 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2867 {
2868         return may_create(dir, dentry, SECCLASS_FILE);
2869 }
2870
2871 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2872 {
2873         return may_link(dir, old_dentry, MAY_LINK);
2874 }
2875
2876 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2877 {
2878         return may_link(dir, dentry, MAY_UNLINK);
2879 }
2880
2881 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2882 {
2883         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2884 }
2885
2886 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2887 {
2888         return may_create(dir, dentry, SECCLASS_DIR);
2889 }
2890
2891 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2892 {
2893         return may_link(dir, dentry, MAY_RMDIR);
2894 }
2895
2896 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2897 {
2898         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2899 }
2900
2901 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2902                                 struct inode *new_inode, struct dentry *new_dentry)
2903 {
2904         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2905 }
2906
2907 static int selinux_inode_readlink(struct dentry *dentry)
2908 {
2909         const struct cred *cred = current_cred();
2910
2911         return dentry_has_perm(cred, dentry, FILE__READ);
2912 }
2913
2914 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2915                                      bool rcu)
2916 {
2917         const struct cred *cred = current_cred();
2918         struct common_audit_data ad;
2919         struct inode_security_struct *isec;
2920         u32 sid;
2921
2922         validate_creds(cred);
2923
2924         ad.type = LSM_AUDIT_DATA_DENTRY;
2925         ad.u.dentry = dentry;
2926         sid = cred_sid(cred);
2927         isec = inode_security_rcu(inode, rcu);
2928         if (IS_ERR(isec))
2929                 return PTR_ERR(isec);
2930
2931         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2932                                   rcu ? MAY_NOT_BLOCK : 0);
2933 }
2934
2935 static noinline int audit_inode_permission(struct inode *inode,
2936                                            u32 perms, u32 audited, u32 denied,
2937                                            int result,
2938                                            unsigned flags)
2939 {
2940         struct common_audit_data ad;
2941         struct inode_security_struct *isec = inode->i_security;
2942         int rc;
2943
2944         ad.type = LSM_AUDIT_DATA_INODE;
2945         ad.u.inode = inode;
2946
2947         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2948                             audited, denied, result, &ad, flags);
2949         if (rc)
2950                 return rc;
2951         return 0;
2952 }
2953
2954 static int selinux_inode_permission(struct inode *inode, int mask)
2955 {
2956         const struct cred *cred = current_cred();
2957         u32 perms;
2958         bool from_access;
2959         unsigned flags = mask & MAY_NOT_BLOCK;
2960         struct inode_security_struct *isec;
2961         u32 sid;
2962         struct av_decision avd;
2963         int rc, rc2;
2964         u32 audited, denied;
2965
2966         from_access = mask & MAY_ACCESS;
2967         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2968
2969         /* No permission to check.  Existence test. */
2970         if (!mask)
2971                 return 0;
2972
2973         validate_creds(cred);
2974
2975         if (unlikely(IS_PRIVATE(inode)))
2976                 return 0;
2977
2978         perms = file_mask_to_av(inode->i_mode, mask);
2979
2980         sid = cred_sid(cred);
2981         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
2982         if (IS_ERR(isec))
2983                 return PTR_ERR(isec);
2984
2985         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2986         audited = avc_audit_required(perms, &avd, rc,
2987                                      from_access ? FILE__AUDIT_ACCESS : 0,
2988                                      &denied);
2989         if (likely(!audited))
2990                 return rc;
2991
2992         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2993         if (rc2)
2994                 return rc2;
2995         return rc;
2996 }
2997
2998 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2999 {
3000         const struct cred *cred = current_cred();
3001         unsigned int ia_valid = iattr->ia_valid;
3002         __u32 av = FILE__WRITE;
3003
3004         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3005         if (ia_valid & ATTR_FORCE) {
3006                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3007                               ATTR_FORCE);
3008                 if (!ia_valid)
3009                         return 0;
3010         }
3011
3012         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3013                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3014                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3015
3016         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3017                         && !(ia_valid & ATTR_FILE))
3018                 av |= FILE__OPEN;
3019
3020         return dentry_has_perm(cred, dentry, av);
3021 }
3022
3023 static int selinux_inode_getattr(const struct path *path)
3024 {
3025         return path_has_perm(current_cred(), path, FILE__GETATTR);
3026 }
3027
3028 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3029 {
3030         const struct cred *cred = current_cred();
3031
3032         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3033                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3034                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3035                         if (!capable(CAP_SETFCAP))
3036                                 return -EPERM;
3037                 } else if (!capable(CAP_SYS_ADMIN)) {
3038                         /* A different attribute in the security namespace.
3039                            Restrict to administrator. */
3040                         return -EPERM;
3041                 }
3042         }
3043
3044         /* Not an attribute we recognize, so just check the
3045            ordinary setattr permission. */
3046         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3047 }
3048
3049 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3050                                   const void *value, size_t size, int flags)
3051 {
3052         struct inode *inode = d_backing_inode(dentry);
3053         struct inode_security_struct *isec = backing_inode_security(dentry);
3054         struct superblock_security_struct *sbsec;
3055         struct common_audit_data ad;
3056         u32 newsid, sid = current_sid();
3057         int rc = 0;
3058
3059         if (strcmp(name, XATTR_NAME_SELINUX))
3060                 return selinux_inode_setotherxattr(dentry, name);
3061
3062         sbsec = inode->i_sb->s_security;
3063         if (!(sbsec->flags & SBLABEL_MNT))
3064                 return -EOPNOTSUPP;
3065
3066         if (!inode_owner_or_capable(inode))
3067                 return -EPERM;
3068
3069         ad.type = LSM_AUDIT_DATA_DENTRY;
3070         ad.u.dentry = dentry;
3071
3072         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3073                           FILE__RELABELFROM, &ad);
3074         if (rc)
3075                 return rc;
3076
3077         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3078         if (rc == -EINVAL) {
3079                 if (!capable(CAP_MAC_ADMIN)) {
3080                         struct audit_buffer *ab;
3081                         size_t audit_size;
3082                         const char *str;
3083
3084                         /* We strip a nul only if it is at the end, otherwise the
3085                          * context contains a nul and we should audit that */
3086                         if (value) {
3087                                 str = value;
3088                                 if (str[size - 1] == '\0')
3089                                         audit_size = size - 1;
3090                                 else
3091                                         audit_size = size;
3092                         } else {
3093                                 str = "";
3094                                 audit_size = 0;
3095                         }
3096                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3097                         audit_log_format(ab, "op=setxattr invalid_context=");
3098                         audit_log_n_untrustedstring(ab, value, audit_size);
3099                         audit_log_end(ab);
3100
3101                         return rc;
3102                 }
3103                 rc = security_context_to_sid_force(value, size, &newsid);
3104         }
3105         if (rc)
3106                 return rc;
3107
3108         rc = avc_has_perm(sid, newsid, isec->sclass,
3109                           FILE__RELABELTO, &ad);
3110         if (rc)
3111                 return rc;
3112
3113         rc = security_validate_transition(isec->sid, newsid, sid,
3114                                           isec->sclass);
3115         if (rc)
3116                 return rc;
3117
3118         return avc_has_perm(newsid,
3119                             sbsec->sid,
3120                             SECCLASS_FILESYSTEM,
3121                             FILESYSTEM__ASSOCIATE,
3122                             &ad);
3123 }
3124
3125 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3126                                         const void *value, size_t size,
3127                                         int flags)
3128 {
3129         struct inode *inode = d_backing_inode(dentry);
3130         struct inode_security_struct *isec = backing_inode_security(dentry);
3131         u32 newsid;
3132         int rc;
3133
3134         if (strcmp(name, XATTR_NAME_SELINUX)) {
3135                 /* Not an attribute we recognize, so nothing to do. */
3136                 return;
3137         }
3138
3139         rc = security_context_to_sid_force(value, size, &newsid);
3140         if (rc) {
3141                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3142                        "for (%s, %lu), rc=%d\n",
3143                        inode->i_sb->s_id, inode->i_ino, -rc);
3144                 return;
3145         }
3146
3147         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3148         isec->sid = newsid;
3149         isec->initialized = LABEL_INITIALIZED;
3150
3151         return;
3152 }
3153
3154 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3155 {
3156         const struct cred *cred = current_cred();
3157
3158         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3159 }
3160
3161 static int selinux_inode_listxattr(struct dentry *dentry)
3162 {
3163         const struct cred *cred = current_cred();
3164
3165         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3166 }
3167
3168 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3169 {
3170         if (strcmp(name, XATTR_NAME_SELINUX))
3171                 return selinux_inode_setotherxattr(dentry, name);
3172
3173         /* No one is allowed to remove a SELinux security label.
3174            You can change the label, but all data must be labeled. */
3175         return -EACCES;
3176 }
3177
3178 /*
3179  * Copy the inode security context value to the user.
3180  *
3181  * Permission check is handled by selinux_inode_getxattr hook.
3182  */
3183 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3184 {
3185         u32 size;
3186         int error;
3187         char *context = NULL;
3188         struct inode_security_struct *isec = inode_security(inode);
3189
3190         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3191                 return -EOPNOTSUPP;
3192
3193         /*
3194          * If the caller has CAP_MAC_ADMIN, then get the raw context
3195          * value even if it is not defined by current policy; otherwise,
3196          * use the in-core value under current policy.
3197          * Use the non-auditing forms of the permission checks since
3198          * getxattr may be called by unprivileged processes commonly
3199          * and lack of permission just means that we fall back to the
3200          * in-core context value, not a denial.
3201          */
3202         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3203                             SECURITY_CAP_NOAUDIT);
3204         if (!error)
3205                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3206                                             SECURITY_CAP_NOAUDIT);
3207         if (!error)
3208                 error = security_sid_to_context_force(isec->sid, &context,
3209                                                       &size);
3210         else
3211                 error = security_sid_to_context(isec->sid, &context, &size);
3212         if (error)
3213                 return error;
3214         error = size;
3215         if (alloc) {
3216                 *buffer = context;
3217                 goto out_nofree;
3218         }
3219         kfree(context);
3220 out_nofree:
3221         return error;
3222 }
3223
3224 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3225                                      const void *value, size_t size, int flags)
3226 {
3227         struct inode_security_struct *isec = inode_security(inode);
3228         u32 newsid;
3229         int rc;
3230
3231         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3232                 return -EOPNOTSUPP;
3233
3234         if (!value || !size)
3235                 return -EACCES;
3236
3237         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3238         if (rc)
3239                 return rc;
3240
3241         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3242         isec->sid = newsid;
3243         isec->initialized = LABEL_INITIALIZED;
3244         return 0;
3245 }
3246
3247 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3248 {
3249         const int len = sizeof(XATTR_NAME_SELINUX);
3250         if (buffer && len <= buffer_size)
3251                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3252         return len;
3253 }
3254
3255 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3256 {
3257         struct inode_security_struct *isec = inode_security(inode);
3258         *secid = isec->sid;
3259 }
3260
3261 /* file security operations */
3262
3263 static int selinux_revalidate_file_permission(struct file *file, int mask)
3264 {
3265         const struct cred *cred = current_cred();
3266         struct inode *inode = file_inode(file);
3267
3268         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3269         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3270                 mask |= MAY_APPEND;
3271
3272         return file_has_perm(cred, file,
3273                              file_mask_to_av(inode->i_mode, mask));
3274 }
3275
3276 static int selinux_file_permission(struct file *file, int mask)
3277 {
3278         struct inode *inode = file_inode(file);
3279         struct file_security_struct *fsec = file->f_security;
3280         struct inode_security_struct *isec = inode_security(inode);
3281         u32 sid = current_sid();
3282
3283         if (!mask)
3284                 /* No permission to check.  Existence test. */
3285                 return 0;
3286
3287         if (sid == fsec->sid && fsec->isid == isec->sid &&
3288             fsec->pseqno == avc_policy_seqno())
3289                 /* No change since file_open check. */
3290                 return 0;
3291
3292         inode_security_revalidate(inode);
3293         return selinux_revalidate_file_permission(file, mask);
3294 }
3295
3296 static int selinux_file_alloc_security(struct file *file)
3297 {
3298         return file_alloc_security(file);
3299 }
3300
3301 static void selinux_file_free_security(struct file *file)
3302 {
3303         file_free_security(file);
3304 }
3305
3306 /*
3307  * Check whether a task has the ioctl permission and cmd
3308  * operation to an inode.
3309  */
3310 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3311                 u32 requested, u16 cmd)
3312 {
3313         struct common_audit_data ad;
3314         struct file_security_struct *fsec = file->f_security;
3315         struct inode *inode = file_inode(file);
3316         struct inode_security_struct *isec = inode_security(inode);
3317         struct lsm_ioctlop_audit ioctl;
3318         u32 ssid = cred_sid(cred);
3319         int rc;
3320         u8 driver = cmd >> 8;
3321         u8 xperm = cmd & 0xff;
3322
3323         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3324         ad.u.op = &ioctl;
3325         ad.u.op->cmd = cmd;
3326         ad.u.op->path = file->f_path;
3327
3328         if (ssid != fsec->sid) {
3329                 rc = avc_has_perm(ssid, fsec->sid,
3330                                 SECCLASS_FD,
3331                                 FD__USE,
3332                                 &ad);
3333                 if (rc)
3334                         goto out;
3335         }
3336
3337         if (unlikely(IS_PRIVATE(inode)))
3338                 return 0;
3339
3340         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3341                         requested, driver, xperm, &ad);
3342 out:
3343         return rc;
3344 }
3345
3346 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3347                               unsigned long arg)
3348 {
3349         const struct cred *cred = current_cred();
3350         int error = 0;
3351
3352         switch (cmd) {
3353         case FIONREAD:
3354         /* fall through */
3355         case FIBMAP:
3356         /* fall through */
3357         case FIGETBSZ:
3358         /* fall through */
3359         case FS_IOC_GETFLAGS:
3360         /* fall through */
3361         case FS_IOC_GETVERSION:
3362                 error = file_has_perm(cred, file, FILE__GETATTR);
3363                 break;
3364
3365         case FS_IOC_SETFLAGS:
3366         /* fall through */
3367         case FS_IOC_SETVERSION:
3368                 error = file_has_perm(cred, file, FILE__SETATTR);
3369                 break;
3370
3371         /* sys_ioctl() checks */
3372         case FIONBIO:
3373         /* fall through */
3374         case FIOASYNC:
3375                 error = file_has_perm(cred, file, 0);
3376                 break;
3377
3378         case KDSKBENT:
3379         case KDSKBSENT:
3380                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3381                                             SECURITY_CAP_AUDIT);
3382                 break;
3383
3384         /* default case assumes that the command will go
3385          * to the file's ioctl() function.
3386          */
3387         default:
3388                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3389         }
3390         return error;
3391 }
3392
3393 static int default_noexec;
3394
3395 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3396 {
3397         const struct cred *cred = current_cred();
3398         int rc = 0;
3399
3400         if (default_noexec &&
3401             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3402                                    (!shared && (prot & PROT_WRITE)))) {
3403                 /*
3404                  * We are making executable an anonymous mapping or a
3405                  * private file mapping that will also be writable.
3406                  * This has an additional check.
3407                  */
3408                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3409                 if (rc)
3410                         goto error;
3411         }
3412
3413         if (file) {
3414                 /* read access is always possible with a mapping */
3415                 u32 av = FILE__READ;
3416
3417                 /* write access only matters if the mapping is shared */
3418                 if (shared && (prot & PROT_WRITE))
3419                         av |= FILE__WRITE;
3420
3421                 if (prot & PROT_EXEC)
3422                         av |= FILE__EXECUTE;
3423
3424                 return file_has_perm(cred, file, av);
3425         }
3426
3427 error:
3428         return rc;
3429 }
3430
3431 static int selinux_mmap_addr(unsigned long addr)
3432 {
3433         int rc = 0;
3434
3435         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3436                 u32 sid = current_sid();
3437                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3438                                   MEMPROTECT__MMAP_ZERO, NULL);
3439         }
3440
3441         return rc;
3442 }
3443
3444 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3445                              unsigned long prot, unsigned long flags)
3446 {
3447         if (selinux_checkreqprot)
3448                 prot = reqprot;
3449
3450         return file_map_prot_check(file, prot,
3451                                    (flags & MAP_TYPE) == MAP_SHARED);
3452 }
3453
3454 static int selinux_file_mprotect(struct vm_area_struct *vma,
3455                                  unsigned long reqprot,
3456                                  unsigned long prot)
3457 {
3458         const struct cred *cred = current_cred();
3459
3460         if (selinux_checkreqprot)
3461                 prot = reqprot;
3462
3463         if (default_noexec &&
3464             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3465                 int rc = 0;
3466                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3467                     vma->vm_end <= vma->vm_mm->brk) {
3468                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3469                 } else if (!vma->vm_file &&
3470                            vma->vm_start <= vma->vm_mm->start_stack &&
3471                            vma->vm_end >= vma->vm_mm->start_stack) {
3472                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3473                 } else if (vma->vm_file && vma->anon_vma) {
3474                         /*
3475                          * We are making executable a file mapping that has
3476                          * had some COW done. Since pages might have been
3477                          * written, check ability to execute the possibly
3478                          * modified content.  This typically should only
3479                          * occur for text relocations.
3480                          */
3481                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3482                 }
3483                 if (rc)
3484                         return rc;
3485         }
3486
3487         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3488 }
3489
3490 static int selinux_file_lock(struct file *file, unsigned int cmd)
3491 {
3492         const struct cred *cred = current_cred();
3493
3494         return file_has_perm(cred, file, FILE__LOCK);
3495 }
3496
3497 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3498                               unsigned long arg)
3499 {
3500         const struct cred *cred = current_cred();
3501         int err = 0;
3502
3503         switch (cmd) {
3504         case F_SETFL:
3505                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3506                         err = file_has_perm(cred, file, FILE__WRITE);
3507                         break;
3508                 }
3509                 /* fall through */
3510         case F_SETOWN:
3511         case F_SETSIG:
3512         case F_GETFL:
3513         case F_GETOWN:
3514         case F_GETSIG:
3515         case F_GETOWNER_UIDS:
3516                 /* Just check FD__USE permission */
3517                 err = file_has_perm(cred, file, 0);
3518                 break;
3519         case F_GETLK:
3520         case F_SETLK:
3521         case F_SETLKW:
3522         case F_OFD_GETLK:
3523         case F_OFD_SETLK:
3524         case F_OFD_SETLKW:
3525 #if BITS_PER_LONG == 32
3526         case F_GETLK64:
3527         case F_SETLK64:
3528         case F_SETLKW64:
3529 #endif
3530                 err = file_has_perm(cred, file, FILE__LOCK);
3531                 break;
3532         }
3533
3534         return err;
3535 }
3536
3537 static void selinux_file_set_fowner(struct file *file)
3538 {
3539         struct file_security_struct *fsec;
3540
3541         fsec = file->f_security;
3542         fsec->fown_sid = current_sid();
3543 }
3544
3545 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3546                                        struct fown_struct *fown, int signum)
3547 {
3548         struct file *file;
3549         u32 sid = task_sid(tsk);
3550         u32 perm;
3551         struct file_security_struct *fsec;
3552
3553         /* struct fown_struct is never outside the context of a struct file */
3554         file = container_of(fown, struct file, f_owner);
3555
3556         fsec = file->f_security;
3557
3558         if (!signum)
3559                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3560         else
3561                 perm = signal_to_av(signum);
3562
3563         return avc_has_perm(fsec->fown_sid, sid,
3564                             SECCLASS_PROCESS, perm, NULL);
3565 }
3566
3567 static int selinux_file_receive(struct file *file)
3568 {
3569         const struct cred *cred = current_cred();
3570
3571         return file_has_perm(cred, file, file_to_av(file));
3572 }
3573
3574 static int selinux_file_open(struct file *file, const struct cred *cred)
3575 {
3576         struct file_security_struct *fsec;
3577         struct inode_security_struct *isec;
3578
3579         fsec = file->f_security;
3580         isec = inode_security(file_inode(file));
3581         /*
3582          * Save inode label and policy sequence number
3583          * at open-time so that selinux_file_permission
3584          * can determine whether revalidation is necessary.
3585          * Task label is already saved in the file security
3586          * struct as its SID.
3587          */
3588         fsec->isid = isec->sid;
3589         fsec->pseqno = avc_policy_seqno();
3590         /*
3591          * Since the inode label or policy seqno may have changed
3592          * between the selinux_inode_permission check and the saving
3593          * of state above, recheck that access is still permitted.
3594          * Otherwise, access might never be revalidated against the
3595          * new inode label or new policy.
3596          * This check is not redundant - do not remove.
3597          */
3598         inode_security_revalidate(file_inode(file));
3599         return file_path_has_perm(cred, file, open_file_to_av(file));
3600 }
3601
3602 /* task security operations */
3603
3604 static int selinux_task_create(unsigned long clone_flags)
3605 {
3606         return current_has_perm(current, PROCESS__FORK);
3607 }
3608
3609 /*
3610  * allocate the SELinux part of blank credentials
3611  */
3612 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3613 {
3614         struct task_security_struct *tsec;
3615
3616         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3617         if (!tsec)
3618                 return -ENOMEM;
3619
3620         cred->security = tsec;
3621         return 0;
3622 }
3623
3624 /*
3625  * detach and free the LSM part of a set of credentials
3626  */
3627 static void selinux_cred_free(struct cred *cred)
3628 {
3629         struct task_security_struct *tsec = cred->security;
3630
3631         /*
3632          * cred->security == NULL if security_cred_alloc_blank() or
3633          * security_prepare_creds() returned an error.
3634          */
3635         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3636         cred->security = (void *) 0x7UL;
3637         kfree(tsec);
3638 }
3639
3640 /*
3641  * prepare a new set of credentials for modification
3642  */
3643 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3644                                 gfp_t gfp)
3645 {
3646         const struct task_security_struct *old_tsec;
3647         struct task_security_struct *tsec;
3648
3649         old_tsec = old->security;
3650
3651         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3652         if (!tsec)
3653                 return -ENOMEM;
3654
3655         new->security = tsec;
3656         return 0;
3657 }
3658
3659 /*
3660  * transfer the SELinux data to a blank set of creds
3661  */
3662 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3663 {
3664         const struct task_security_struct *old_tsec = old->security;
3665         struct task_security_struct *tsec = new->security;
3666
3667         *tsec = *old_tsec;
3668 }
3669
3670 /*
3671  * set the security data for a kernel service
3672  * - all the creation contexts are set to unlabelled
3673  */
3674 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3675 {
3676         struct task_security_struct *tsec = new->security;
3677         u32 sid = current_sid();
3678         int ret;
3679
3680         ret = avc_has_perm(sid, secid,
3681                            SECCLASS_KERNEL_SERVICE,
3682                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3683                            NULL);
3684         if (ret == 0) {
3685                 tsec->sid = secid;
3686                 tsec->create_sid = 0;
3687                 tsec->keycreate_sid = 0;
3688                 tsec->sockcreate_sid = 0;
3689         }
3690         return ret;
3691 }
3692
3693 /*
3694  * set the file creation context in a security record to the same as the
3695  * objective context of the specified inode
3696  */
3697 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3698 {
3699         struct inode_security_struct *isec = inode_security(inode);
3700         struct task_security_struct *tsec = new->security;
3701         u32 sid = current_sid();
3702         int ret;
3703
3704         ret = avc_has_perm(sid, isec->sid,
3705                            SECCLASS_KERNEL_SERVICE,
3706                            KERNEL_SERVICE__CREATE_FILES_AS,
3707                            NULL);
3708
3709         if (ret == 0)
3710                 tsec->create_sid = isec->sid;
3711         return ret;
3712 }
3713
3714 static int selinux_kernel_module_request(char *kmod_name)
3715 {
3716         u32 sid;
3717         struct common_audit_data ad;
3718
3719         sid = task_sid(current);
3720
3721         ad.type = LSM_AUDIT_DATA_KMOD;
3722         ad.u.kmod_name = kmod_name;
3723
3724         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3725                             SYSTEM__MODULE_REQUEST, &ad);
3726 }
3727
3728 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3729 {
3730         return current_has_perm(p, PROCESS__SETPGID);
3731 }
3732
3733 static int selinux_task_getpgid(struct task_struct *p)
3734 {
3735         return current_has_perm(p, PROCESS__GETPGID);
3736 }
3737
3738 static int selinux_task_getsid(struct task_struct *p)
3739 {
3740         return current_has_perm(p, PROCESS__GETSESSION);
3741 }
3742
3743 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3744 {
3745         *secid = task_sid(p);
3746 }
3747
3748 static int selinux_task_setnice(struct task_struct *p, int nice)
3749 {
3750         return current_has_perm(p, PROCESS__SETSCHED);
3751 }
3752
3753 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3754 {
3755         return current_has_perm(p, PROCESS__SETSCHED);
3756 }
3757
3758 static int selinux_task_getioprio(struct task_struct *p)
3759 {
3760         return current_has_perm(p, PROCESS__GETSCHED);
3761 }
3762
3763 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3764                 struct rlimit *new_rlim)
3765 {
3766         struct rlimit *old_rlim = p->signal->rlim + resource;
3767
3768         /* Control the ability to change the hard limit (whether
3769            lowering or raising it), so that the hard limit can
3770            later be used as a safe reset point for the soft limit
3771            upon context transitions.  See selinux_bprm_committing_creds. */
3772         if (old_rlim->rlim_max != new_rlim->rlim_max)
3773                 return current_has_perm(p, PROCESS__SETRLIMIT);
3774
3775         return 0;
3776 }
3777
3778 static int selinux_task_setscheduler(struct task_struct *p)
3779 {
3780         return current_has_perm(p, PROCESS__SETSCHED);
3781 }
3782
3783 static int selinux_task_getscheduler(struct task_struct *p)
3784 {
3785         return current_has_perm(p, PROCESS__GETSCHED);
3786 }
3787
3788 static int selinux_task_movememory(struct task_struct *p)
3789 {
3790         return current_has_perm(p, PROCESS__SETSCHED);
3791 }
3792
3793 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3794                                 int sig, u32 secid)
3795 {
3796         u32 perm;
3797         int rc;
3798
3799         if (!sig)
3800                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3801         else
3802                 perm = signal_to_av(sig);
3803         if (secid)
3804                 rc = avc_has_perm(secid, task_sid(p),
3805                                   SECCLASS_PROCESS, perm, NULL);
3806         else
3807                 rc = current_has_perm(p, perm);
3808         return rc;
3809 }
3810
3811 static int selinux_task_wait(struct task_struct *p)
3812 {
3813         return task_has_perm(p, current, PROCESS__SIGCHLD);
3814 }
3815
3816 static void selinux_task_to_inode(struct task_struct *p,
3817                                   struct inode *inode)
3818 {
3819         struct inode_security_struct *isec = inode->i_security;
3820         u32 sid = task_sid(p);
3821
3822         isec->sid = sid;
3823         isec->initialized = LABEL_INITIALIZED;
3824 }
3825
3826 /* Returns error only if unable to parse addresses */
3827 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3828                         struct common_audit_data *ad, u8 *proto)
3829 {
3830         int offset, ihlen, ret = -EINVAL;
3831         struct iphdr _iph, *ih;
3832
3833         offset = skb_network_offset(skb);
3834         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3835         if (ih == NULL)
3836                 goto out;
3837
3838         ihlen = ih->ihl * 4;
3839         if (ihlen < sizeof(_iph))
3840                 goto out;
3841
3842         ad->u.net->v4info.saddr = ih->saddr;
3843         ad->u.net->v4info.daddr = ih->daddr;
3844         ret = 0;
3845
3846         if (proto)
3847                 *proto = ih->protocol;
3848
3849         switch (ih->protocol) {
3850         case IPPROTO_TCP: {
3851                 struct tcphdr _tcph, *th;
3852
3853                 if (ntohs(ih->frag_off) & IP_OFFSET)
3854                         break;
3855
3856                 offset += ihlen;
3857                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3858                 if (th == NULL)
3859                         break;
3860
3861                 ad->u.net->sport = th->source;
3862                 ad->u.net->dport = th->dest;
3863                 break;
3864         }
3865
3866         case IPPROTO_UDP: {
3867                 struct udphdr _udph, *uh;
3868
3869                 if (ntohs(ih->frag_off) & IP_OFFSET)
3870                         break;
3871
3872                 offset += ihlen;
3873                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3874                 if (uh == NULL)
3875                         break;
3876
3877                 ad->u.net->sport = uh->source;
3878                 ad->u.net->dport = uh->dest;
3879                 break;
3880         }
3881
3882         case IPPROTO_DCCP: {
3883                 struct dccp_hdr _dccph, *dh;
3884
3885                 if (ntohs(ih->frag_off) & IP_OFFSET)
3886                         break;
3887
3888                 offset += ihlen;
3889                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3890                 if (dh == NULL)
3891                         break;
3892
3893                 ad->u.net->sport = dh->dccph_sport;
3894                 ad->u.net->dport = dh->dccph_dport;
3895                 break;
3896         }
3897
3898         default:
3899                 break;
3900         }
3901 out:
3902         return ret;
3903 }
3904
3905 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3906
3907 /* Returns error only if unable to parse addresses */
3908 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3909                         struct common_audit_data *ad, u8 *proto)
3910 {
3911         u8 nexthdr;
3912         int ret = -EINVAL, offset;
3913         struct ipv6hdr _ipv6h, *ip6;
3914         __be16 frag_off;
3915
3916         offset = skb_network_offset(skb);
3917         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3918         if (ip6 == NULL)
3919                 goto out;
3920
3921         ad->u.net->v6info.saddr = ip6->saddr;
3922         ad->u.net->v6info.daddr = ip6->daddr;
3923         ret = 0;
3924
3925         nexthdr = ip6->nexthdr;
3926         offset += sizeof(_ipv6h);
3927         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3928         if (offset < 0)
3929                 goto out;
3930
3931         if (proto)
3932                 *proto = nexthdr;
3933
3934         switch (nexthdr) {
3935         case IPPROTO_TCP: {
3936                 struct tcphdr _tcph, *th;
3937
3938                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3939                 if (th == NULL)
3940                         break;
3941
3942                 ad->u.net->sport = th->source;
3943                 ad->u.net->dport = th->dest;
3944                 break;
3945         }
3946
3947         case IPPROTO_UDP: {
3948                 struct udphdr _udph, *uh;
3949
3950                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3951                 if (uh == NULL)
3952                         break;
3953
3954                 ad->u.net->sport = uh->source;
3955                 ad->u.net->dport = uh->dest;
3956                 break;
3957         }
3958
3959         case IPPROTO_DCCP: {
3960                 struct dccp_hdr _dccph, *dh;
3961
3962                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3963                 if (dh == NULL)
3964                         break;
3965
3966                 ad->u.net->sport = dh->dccph_sport;
3967                 ad->u.net->dport = dh->dccph_dport;
3968                 break;
3969         }
3970
3971         /* includes fragments */
3972         default:
3973                 break;
3974         }
3975 out:
3976         return ret;
3977 }
3978
3979 #endif /* IPV6 */
3980
3981 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3982                              char **_addrp, int src, u8 *proto)
3983 {
3984         char *addrp;
3985         int ret;
3986
3987         switch (ad->u.net->family) {
3988         case PF_INET:
3989                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3990                 if (ret)
3991                         goto parse_error;
3992                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3993                                        &ad->u.net->v4info.daddr);
3994                 goto okay;
3995
3996 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3997         case PF_INET6:
3998                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3999                 if (ret)
4000                         goto parse_error;
4001                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4002                                        &ad->u.net->v6info.daddr);
4003                 goto okay;
4004 #endif  /* IPV6 */
4005         default:
4006                 addrp = NULL;
4007                 goto okay;
4008         }
4009
4010 parse_error:
4011         printk(KERN_WARNING
4012                "SELinux: failure in selinux_parse_skb(),"
4013                " unable to parse packet\n");
4014         return ret;
4015
4016 okay:
4017         if (_addrp)
4018                 *_addrp = addrp;
4019         return 0;
4020 }
4021
4022 /**
4023  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4024  * @skb: the packet
4025  * @family: protocol family
4026  * @sid: the packet's peer label SID
4027  *
4028  * Description:
4029  * Check the various different forms of network peer labeling and determine
4030  * the peer label/SID for the packet; most of the magic actually occurs in
4031  * the security server function security_net_peersid_cmp().  The function
4032  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4033  * or -EACCES if @sid is invalid due to inconsistencies with the different
4034  * peer labels.
4035  *
4036  */
4037 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4038 {
4039         int err;
4040         u32 xfrm_sid;
4041         u32 nlbl_sid;
4042         u32 nlbl_type;
4043
4044         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4045         if (unlikely(err))
4046                 return -EACCES;
4047         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4048         if (unlikely(err))
4049                 return -EACCES;
4050
4051         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4052         if (unlikely(err)) {
4053                 printk(KERN_WARNING
4054                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4055                        " unable to determine packet's peer label\n");
4056                 return -EACCES;
4057         }
4058
4059         return 0;
4060 }
4061
4062 /**
4063  * selinux_conn_sid - Determine the child socket label for a connection
4064  * @sk_sid: the parent socket's SID
4065  * @skb_sid: the packet's SID
4066  * @conn_sid: the resulting connection SID
4067  *
4068  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4069  * combined with the MLS information from @skb_sid in order to create
4070  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4071  * of @sk_sid.  Returns zero on success, negative values on failure.
4072  *
4073  */
4074 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4075 {
4076         int err = 0;
4077
4078         if (skb_sid != SECSID_NULL)
4079                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4080         else
4081                 *conn_sid = sk_sid;
4082
4083         return err;
4084 }
4085
4086 /* socket security operations */
4087
4088 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4089                                  u16 secclass, u32 *socksid)
4090 {
4091         if (tsec->sockcreate_sid > SECSID_NULL) {
4092                 *socksid = tsec->sockcreate_sid;
4093                 return 0;
4094         }
4095
4096         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4097                                        socksid);
4098 }
4099
4100 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4101 {
4102         struct sk_security_struct *sksec = sk->sk_security;
4103         struct common_audit_data ad;
4104         struct lsm_network_audit net = {0,};
4105         u32 tsid = task_sid(task);
4106
4107         if (sksec->sid == SECINITSID_KERNEL)
4108                 return 0;
4109
4110         ad.type = LSM_AUDIT_DATA_NET;
4111         ad.u.net = &net;
4112         ad.u.net->sk = sk;
4113
4114         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4115 }
4116
4117 static int selinux_socket_create(int family, int type,
4118                                  int protocol, int kern)
4119 {
4120         const struct task_security_struct *tsec = current_security();
4121         u32 newsid;
4122         u16 secclass;
4123         int rc;
4124
4125         if (kern)
4126                 return 0;
4127
4128         secclass = socket_type_to_security_class(family, type, protocol);
4129         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4130         if (rc)
4131                 return rc;
4132
4133         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4134 }
4135
4136 static int selinux_socket_post_create(struct socket *sock, int family,
4137                                       int type, int protocol, int kern)
4138 {
4139         const struct task_security_struct *tsec = current_security();
4140         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4141         struct sk_security_struct *sksec;
4142         int err = 0;
4143
4144         isec->sclass = socket_type_to_security_class(family, type, protocol);
4145
4146         if (kern)
4147                 isec->sid = SECINITSID_KERNEL;
4148         else {
4149                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4150                 if (err)
4151                         return err;
4152         }
4153
4154         isec->initialized = LABEL_INITIALIZED;
4155
4156         if (sock->sk) {
4157                 sksec = sock->sk->sk_security;
4158                 sksec->sid = isec->sid;
4159                 sksec->sclass = isec->sclass;
4160                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4161         }
4162
4163         return err;
4164 }
4165
4166 /* Range of port numbers used to automatically bind.
4167    Need to determine whether we should perform a name_bind
4168    permission check between the socket and the port number. */
4169
4170 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4171 {
4172         struct sock *sk = sock->sk;
4173         u16 family;
4174         int err;
4175
4176         err = sock_has_perm(current, sk, SOCKET__BIND);
4177         if (err)
4178                 goto out;
4179
4180         /*
4181          * If PF_INET or PF_INET6, check name_bind permission for the port.
4182          * Multiple address binding for SCTP is not supported yet: we just
4183          * check the first address now.
4184          */
4185         family = sk->sk_family;
4186         if (family == PF_INET || family == PF_INET6) {
4187                 char *addrp;
4188                 struct sk_security_struct *sksec = sk->sk_security;
4189                 struct common_audit_data ad;
4190                 struct lsm_network_audit net = {0,};
4191                 struct sockaddr_in *addr4 = NULL;
4192                 struct sockaddr_in6 *addr6 = NULL;
4193                 unsigned short snum;
4194                 u32 sid, node_perm;
4195
4196                 if (family == PF_INET) {
4197                         addr4 = (struct sockaddr_in *)address;
4198                         snum = ntohs(addr4->sin_port);
4199                         addrp = (char *)&addr4->sin_addr.s_addr;
4200                 } else {
4201                         addr6 = (struct sockaddr_in6 *)address;
4202                         snum = ntohs(addr6->sin6_port);
4203                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4204                 }
4205
4206                 if (snum) {
4207                         int low, high;
4208
4209                         inet_get_local_port_range(sock_net(sk), &low, &high);
4210
4211                         if (snum < max(PROT_SOCK, low) || snum > high) {
4212                                 err = sel_netport_sid(sk->sk_protocol,
4213                                                       snum, &sid);
4214                                 if (err)
4215                                         goto out;
4216                                 ad.type = LSM_AUDIT_DATA_NET;
4217                                 ad.u.net = &net;
4218                                 ad.u.net->sport = htons(snum);
4219                                 ad.u.net->family = family;
4220                                 err = avc_has_perm(sksec->sid, sid,
4221                                                    sksec->sclass,
4222                                                    SOCKET__NAME_BIND, &ad);
4223                                 if (err)
4224                                         goto out;
4225                         }
4226                 }
4227
4228                 switch (sksec->sclass) {
4229                 case SECCLASS_TCP_SOCKET:
4230                         node_perm = TCP_SOCKET__NODE_BIND;
4231                         break;
4232
4233                 case SECCLASS_UDP_SOCKET:
4234                         node_perm = UDP_SOCKET__NODE_BIND;
4235                         break;
4236
4237                 case SECCLASS_DCCP_SOCKET:
4238                         node_perm = DCCP_SOCKET__NODE_BIND;
4239                         break;
4240
4241                 default:
4242                         node_perm = RAWIP_SOCKET__NODE_BIND;
4243                         break;
4244                 }
4245
4246                 err = sel_netnode_sid(addrp, family, &sid);
4247                 if (err)
4248                         goto out;
4249
4250                 ad.type = LSM_AUDIT_DATA_NET;
4251                 ad.u.net = &net;
4252                 ad.u.net->sport = htons(snum);
4253                 ad.u.net->family = family;
4254
4255                 if (family == PF_INET)
4256                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4257                 else
4258                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4259
4260                 err = avc_has_perm(sksec->sid, sid,
4261                                    sksec->sclass, node_perm, &ad);
4262                 if (err)
4263                         goto out;
4264         }
4265 out:
4266         return err;
4267 }
4268
4269 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4270 {
4271         struct sock *sk = sock->sk;
4272         struct sk_security_struct *sksec = sk->sk_security;
4273         int err;
4274
4275         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4276         if (err)
4277                 return err;
4278
4279         /*
4280          * If a TCP or DCCP socket, check name_connect permission for the port.
4281          */
4282         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4283             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4284                 struct common_audit_data ad;
4285                 struct lsm_network_audit net = {0,};
4286                 struct sockaddr_in *addr4 = NULL;
4287                 struct sockaddr_in6 *addr6 = NULL;
4288                 unsigned short snum;
4289                 u32 sid, perm;
4290
4291                 if (sk->sk_family == PF_INET) {
4292                         addr4 = (struct sockaddr_in *)address;
4293                         if (addrlen < sizeof(struct sockaddr_in))
4294                                 return -EINVAL;
4295                         snum = ntohs(addr4->sin_port);
4296                 } else {
4297                         addr6 = (struct sockaddr_in6 *)address;
4298                         if (addrlen < SIN6_LEN_RFC2133)
4299                                 return -EINVAL;
4300                         snum = ntohs(addr6->sin6_port);
4301                 }
4302
4303                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4304                 if (err)
4305                         goto out;
4306
4307                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4308                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4309
4310                 ad.type = LSM_AUDIT_DATA_NET;
4311                 ad.u.net = &net;
4312                 ad.u.net->dport = htons(snum);
4313                 ad.u.net->family = sk->sk_family;
4314                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4315                 if (err)
4316                         goto out;
4317         }
4318
4319         err = selinux_netlbl_socket_connect(sk, address);
4320
4321 out:
4322         return err;
4323 }
4324
4325 static int selinux_socket_listen(struct socket *sock, int backlog)
4326 {
4327         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4328 }
4329
4330 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4331 {
4332         int err;
4333         struct inode_security_struct *isec;
4334         struct inode_security_struct *newisec;
4335
4336         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4337         if (err)
4338                 return err;
4339
4340         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4341
4342         isec = inode_security_novalidate(SOCK_INODE(sock));
4343         newisec->sclass = isec->sclass;
4344         newisec->sid = isec->sid;
4345         newisec->initialized = LABEL_INITIALIZED;
4346
4347         return 0;
4348 }
4349
4350 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4351                                   int size)
4352 {
4353         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4354 }
4355
4356 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4357                                   int size, int flags)
4358 {
4359         return sock_has_perm(current, sock->sk, SOCKET__READ);
4360 }
4361
4362 static int selinux_socket_getsockname(struct socket *sock)
4363 {
4364         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4365 }
4366
4367 static int selinux_socket_getpeername(struct socket *sock)
4368 {
4369         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4370 }
4371
4372 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4373 {
4374         int err;
4375
4376         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4377         if (err)
4378                 return err;
4379
4380         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4381 }
4382
4383 static int selinux_socket_getsockopt(struct socket *sock, int level,
4384                                      int optname)
4385 {
4386         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4387 }
4388
4389 static int selinux_socket_shutdown(struct socket *sock, int how)
4390 {
4391         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4392 }
4393
4394 static int selinux_socket_unix_stream_connect(struct sock *sock,
4395                                               struct sock *other,
4396                                               struct sock *newsk)
4397 {
4398         struct sk_security_struct *sksec_sock = sock->sk_security;
4399         struct sk_security_struct *sksec_other = other->sk_security;
4400         struct sk_security_struct *sksec_new = newsk->sk_security;
4401         struct common_audit_data ad;
4402         struct lsm_network_audit net = {0,};
4403         int err;
4404
4405         ad.type = LSM_AUDIT_DATA_NET;
4406         ad.u.net = &net;
4407         ad.u.net->sk = other;
4408
4409         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4410                            sksec_other->sclass,
4411                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4412         if (err)
4413                 return err;
4414
4415         /* server child socket */
4416         sksec_new->peer_sid = sksec_sock->sid;
4417         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4418                                     &sksec_new->sid);
4419         if (err)
4420                 return err;
4421
4422         /* connecting socket */
4423         sksec_sock->peer_sid = sksec_new->sid;
4424
4425         return 0;
4426 }
4427
4428 static int selinux_socket_unix_may_send(struct socket *sock,
4429                                         struct socket *other)
4430 {
4431         struct sk_security_struct *ssec = sock->sk->sk_security;
4432         struct sk_security_struct *osec = other->sk->sk_security;
4433         struct common_audit_data ad;
4434         struct lsm_network_audit net = {0,};
4435
4436         ad.type = LSM_AUDIT_DATA_NET;
4437         ad.u.net = &net;
4438         ad.u.net->sk = other->sk;
4439
4440         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4441                             &ad);
4442 }
4443
4444 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4445                                     char *addrp, u16 family, u32 peer_sid,
4446                                     struct common_audit_data *ad)
4447 {
4448         int err;
4449         u32 if_sid;
4450         u32 node_sid;
4451
4452         err = sel_netif_sid(ns, ifindex, &if_sid);
4453         if (err)
4454                 return err;
4455         err = avc_has_perm(peer_sid, if_sid,
4456                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4457         if (err)
4458                 return err;
4459
4460         err = sel_netnode_sid(addrp, family, &node_sid);
4461         if (err)
4462                 return err;
4463         return avc_has_perm(peer_sid, node_sid,
4464                             SECCLASS_NODE, NODE__RECVFROM, ad);
4465 }
4466
4467 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4468                                        u16 family)
4469 {
4470         int err = 0;
4471         struct sk_security_struct *sksec = sk->sk_security;
4472         u32 sk_sid = sksec->sid;
4473         struct common_audit_data ad;
4474         struct lsm_network_audit net = {0,};
4475         char *addrp;
4476
4477         ad.type = LSM_AUDIT_DATA_NET;
4478         ad.u.net = &net;
4479         ad.u.net->netif = skb->skb_iif;
4480         ad.u.net->family = family;
4481         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4482         if (err)
4483                 return err;
4484
4485         if (selinux_secmark_enabled()) {
4486                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4487                                    PACKET__RECV, &ad);
4488                 if (err)
4489                         return err;
4490         }
4491
4492         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4493         if (err)
4494                 return err;
4495         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4496
4497         return err;
4498 }
4499
4500 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4501 {
4502         int err;
4503         struct sk_security_struct *sksec = sk->sk_security;
4504         u16 family = sk->sk_family;
4505         u32 sk_sid = sksec->sid;
4506         struct common_audit_data ad;
4507         struct lsm_network_audit net = {0,};
4508         char *addrp;
4509         u8 secmark_active;
4510         u8 peerlbl_active;
4511
4512         if (family != PF_INET && family != PF_INET6)
4513                 return 0;
4514
4515         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4516         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4517                 family = PF_INET;
4518
4519         /* If any sort of compatibility mode is enabled then handoff processing
4520          * to the selinux_sock_rcv_skb_compat() function to deal with the
4521          * special handling.  We do this in an attempt to keep this function
4522          * as fast and as clean as possible. */
4523         if (!selinux_policycap_netpeer)
4524                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4525
4526         secmark_active = selinux_secmark_enabled();
4527         peerlbl_active = selinux_peerlbl_enabled();
4528         if (!secmark_active && !peerlbl_active)
4529                 return 0;
4530
4531         ad.type = LSM_AUDIT_DATA_NET;
4532         ad.u.net = &net;
4533         ad.u.net->netif = skb->skb_iif;
4534         ad.u.net->family = family;
4535         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4536         if (err)
4537                 return err;
4538
4539         if (peerlbl_active) {
4540                 u32 peer_sid;
4541
4542                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4543                 if (err)
4544                         return err;
4545                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4546                                                addrp, family, peer_sid, &ad);
4547                 if (err) {
4548                         selinux_netlbl_err(skb, err, 0);
4549                         return err;
4550                 }
4551                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4552                                    PEER__RECV, &ad);
4553                 if (err) {
4554                         selinux_netlbl_err(skb, err, 0);
4555                         return err;
4556                 }
4557         }
4558
4559         if (secmark_active) {
4560                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4561                                    PACKET__RECV, &ad);
4562                 if (err)
4563                         return err;
4564         }
4565
4566         return err;
4567 }
4568
4569 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4570                                             int __user *optlen, unsigned len)
4571 {
4572         int err = 0;
4573         char *scontext;
4574         u32 scontext_len;
4575         struct sk_security_struct *sksec = sock->sk->sk_security;
4576         u32 peer_sid = SECSID_NULL;
4577
4578         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4579             sksec->sclass == SECCLASS_TCP_SOCKET)
4580                 peer_sid = sksec->peer_sid;
4581         if (peer_sid == SECSID_NULL)
4582                 return -ENOPROTOOPT;
4583
4584         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4585         if (err)
4586                 return err;
4587
4588         if (scontext_len > len) {
4589                 err = -ERANGE;
4590                 goto out_len;
4591         }
4592
4593         if (copy_to_user(optval, scontext, scontext_len))
4594                 err = -EFAULT;
4595
4596 out_len:
4597         if (put_user(scontext_len, optlen))
4598                 err = -EFAULT;
4599         kfree(scontext);
4600         return err;
4601 }
4602
4603 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4604 {
4605         u32 peer_secid = SECSID_NULL;
4606         u16 family;
4607
4608         if (skb && skb->protocol == htons(ETH_P_IP))
4609                 family = PF_INET;
4610         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4611                 family = PF_INET6;
4612         else if (sock)
4613                 family = sock->sk->sk_family;
4614         else
4615                 goto out;
4616
4617         if (sock && family == PF_UNIX)
4618                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4619         else if (skb)
4620                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4621
4622 out:
4623         *secid = peer_secid;
4624         if (peer_secid == SECSID_NULL)
4625                 return -EINVAL;
4626         return 0;
4627 }
4628
4629 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4630 {
4631         struct sk_security_struct *sksec;
4632
4633         sksec = kzalloc(sizeof(*sksec), priority);
4634         if (!sksec)
4635                 return -ENOMEM;
4636
4637         sksec->peer_sid = SECINITSID_UNLABELED;
4638         sksec->sid = SECINITSID_UNLABELED;
4639         sksec->sclass = SECCLASS_SOCKET;
4640         selinux_netlbl_sk_security_reset(sksec);
4641         sk->sk_security = sksec;
4642
4643         return 0;
4644 }
4645
4646 static void selinux_sk_free_security(struct sock *sk)
4647 {
4648         struct sk_security_struct *sksec = sk->sk_security;
4649
4650         sk->sk_security = NULL;
4651         selinux_netlbl_sk_security_free(sksec);
4652         kfree(sksec);
4653 }
4654
4655 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4656 {
4657         struct sk_security_struct *sksec = sk->sk_security;
4658         struct sk_security_struct *newsksec = newsk->sk_security;
4659
4660         newsksec->sid = sksec->sid;
4661         newsksec->peer_sid = sksec->peer_sid;
4662         newsksec->sclass = sksec->sclass;
4663
4664         selinux_netlbl_sk_security_reset(newsksec);
4665 }
4666
4667 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4668 {
4669         if (!sk)
4670                 *secid = SECINITSID_ANY_SOCKET;
4671         else {
4672                 struct sk_security_struct *sksec = sk->sk_security;
4673
4674                 *secid = sksec->sid;
4675         }
4676 }
4677
4678 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4679 {
4680         struct inode_security_struct *isec =
4681                 inode_security_novalidate(SOCK_INODE(parent));
4682         struct sk_security_struct *sksec = sk->sk_security;
4683
4684         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4685             sk->sk_family == PF_UNIX)
4686                 isec->sid = sksec->sid;
4687         sksec->sclass = isec->sclass;
4688 }
4689
4690 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4691                                      struct request_sock *req)
4692 {
4693         struct sk_security_struct *sksec = sk->sk_security;
4694         int err;
4695         u16 family = req->rsk_ops->family;
4696         u32 connsid;
4697         u32 peersid;
4698
4699         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4700         if (err)
4701                 return err;
4702         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4703         if (err)
4704                 return err;
4705         req->secid = connsid;
4706         req->peer_secid = peersid;
4707
4708         return selinux_netlbl_inet_conn_request(req, family);
4709 }
4710
4711 static void selinux_inet_csk_clone(struct sock *newsk,
4712                                    const struct request_sock *req)
4713 {
4714         struct sk_security_struct *newsksec = newsk->sk_security;
4715
4716         newsksec->sid = req->secid;
4717         newsksec->peer_sid = req->peer_secid;
4718         /* NOTE: Ideally, we should also get the isec->sid for the
4719            new socket in sync, but we don't have the isec available yet.
4720            So we will wait until sock_graft to do it, by which
4721            time it will have been created and available. */
4722
4723         /* We don't need to take any sort of lock here as we are the only
4724          * thread with access to newsksec */
4725         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4726 }
4727
4728 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4729 {
4730         u16 family = sk->sk_family;
4731         struct sk_security_struct *sksec = sk->sk_security;
4732
4733         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4734         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4735                 family = PF_INET;
4736
4737         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4738 }
4739
4740 static int selinux_secmark_relabel_packet(u32 sid)
4741 {
4742         const struct task_security_struct *__tsec;
4743         u32 tsid;
4744
4745         __tsec = current_security();
4746         tsid = __tsec->sid;
4747
4748         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4749 }
4750
4751 static void selinux_secmark_refcount_inc(void)
4752 {
4753         atomic_inc(&selinux_secmark_refcount);
4754 }
4755
4756 static void selinux_secmark_refcount_dec(void)
4757 {
4758         atomic_dec(&selinux_secmark_refcount);
4759 }
4760
4761 static void selinux_req_classify_flow(const struct request_sock *req,
4762                                       struct flowi *fl)
4763 {
4764         fl->flowi_secid = req->secid;
4765 }
4766
4767 static int selinux_tun_dev_alloc_security(void **security)
4768 {
4769         struct tun_security_struct *tunsec;
4770
4771         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4772         if (!tunsec)
4773                 return -ENOMEM;
4774         tunsec->sid = current_sid();
4775
4776         *security = tunsec;
4777         return 0;
4778 }
4779
4780 static void selinux_tun_dev_free_security(void *security)
4781 {
4782         kfree(security);
4783 }
4784
4785 static int selinux_tun_dev_create(void)
4786 {
4787         u32 sid = current_sid();
4788
4789         /* we aren't taking into account the "sockcreate" SID since the socket
4790          * that is being created here is not a socket in the traditional sense,
4791          * instead it is a private sock, accessible only to the kernel, and
4792          * representing a wide range of network traffic spanning multiple
4793          * connections unlike traditional sockets - check the TUN driver to
4794          * get a better understanding of why this socket is special */
4795
4796         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4797                             NULL);
4798 }
4799
4800 static int selinux_tun_dev_attach_queue(void *security)
4801 {
4802         struct tun_security_struct *tunsec = security;
4803
4804         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4805                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4806 }
4807
4808 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4809 {
4810         struct tun_security_struct *tunsec = security;
4811         struct sk_security_struct *sksec = sk->sk_security;
4812
4813         /* we don't currently perform any NetLabel based labeling here and it
4814          * isn't clear that we would want to do so anyway; while we could apply
4815          * labeling without the support of the TUN user the resulting labeled
4816          * traffic from the other end of the connection would almost certainly
4817          * cause confusion to the TUN user that had no idea network labeling
4818          * protocols were being used */
4819
4820         sksec->sid = tunsec->sid;
4821         sksec->sclass = SECCLASS_TUN_SOCKET;
4822
4823         return 0;
4824 }
4825
4826 static int selinux_tun_dev_open(void *security)
4827 {
4828         struct tun_security_struct *tunsec = security;
4829         u32 sid = current_sid();
4830         int err;
4831
4832         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4833                            TUN_SOCKET__RELABELFROM, NULL);
4834         if (err)
4835                 return err;
4836         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4837                            TUN_SOCKET__RELABELTO, NULL);
4838         if (err)
4839                 return err;
4840         tunsec->sid = sid;
4841
4842         return 0;
4843 }
4844
4845 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4846 {
4847         int err = 0;
4848         u32 perm;
4849         struct nlmsghdr *nlh;
4850         struct sk_security_struct *sksec = sk->sk_security;
4851
4852         if (skb->len < NLMSG_HDRLEN) {
4853                 err = -EINVAL;
4854                 goto out;
4855         }
4856         nlh = nlmsg_hdr(skb);
4857
4858         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4859         if (err) {
4860                 if (err == -EINVAL) {
4861                         printk(KERN_WARNING
4862                                "SELinux: unrecognized netlink message:"
4863                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4864                                sk->sk_protocol, nlh->nlmsg_type,
4865                                secclass_map[sksec->sclass - 1].name);
4866                         if (!selinux_enforcing || security_get_allow_unknown())
4867                                 err = 0;
4868                 }
4869
4870                 /* Ignore */
4871                 if (err == -ENOENT)
4872                         err = 0;
4873                 goto out;
4874         }
4875
4876         err = sock_has_perm(current, sk, perm);
4877 out:
4878         return err;
4879 }
4880
4881 #ifdef CONFIG_NETFILTER
4882
4883 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4884                                        const struct net_device *indev,
4885                                        u16 family)
4886 {
4887         int err;
4888         char *addrp;
4889         u32 peer_sid;
4890         struct common_audit_data ad;
4891         struct lsm_network_audit net = {0,};
4892         u8 secmark_active;
4893         u8 netlbl_active;
4894         u8 peerlbl_active;
4895
4896         if (!selinux_policycap_netpeer)
4897                 return NF_ACCEPT;
4898
4899         secmark_active = selinux_secmark_enabled();
4900         netlbl_active = netlbl_enabled();
4901         peerlbl_active = selinux_peerlbl_enabled();
4902         if (!secmark_active && !peerlbl_active)
4903                 return NF_ACCEPT;
4904
4905         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4906                 return NF_DROP;
4907
4908         ad.type = LSM_AUDIT_DATA_NET;
4909         ad.u.net = &net;
4910         ad.u.net->netif = indev->ifindex;
4911         ad.u.net->family = family;
4912         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4913                 return NF_DROP;
4914
4915         if (peerlbl_active) {
4916                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4917                                                addrp, family, peer_sid, &ad);
4918                 if (err) {
4919                         selinux_netlbl_err(skb, err, 1);
4920                         return NF_DROP;
4921                 }
4922         }
4923
4924         if (secmark_active)
4925                 if (avc_has_perm(peer_sid, skb->secmark,
4926                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4927                         return NF_DROP;
4928
4929         if (netlbl_active)
4930                 /* we do this in the FORWARD path and not the POST_ROUTING
4931                  * path because we want to make sure we apply the necessary
4932                  * labeling before IPsec is applied so we can leverage AH
4933                  * protection */
4934                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4935                         return NF_DROP;
4936
4937         return NF_ACCEPT;
4938 }
4939
4940 static unsigned int selinux_ipv4_forward(void *priv,
4941                                          struct sk_buff *skb,
4942                                          const struct nf_hook_state *state)
4943 {
4944         return selinux_ip_forward(skb, state->in, PF_INET);
4945 }
4946
4947 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4948 static unsigned int selinux_ipv6_forward(void *priv,
4949                                          struct sk_buff *skb,
4950                                          const struct nf_hook_state *state)
4951 {
4952         return selinux_ip_forward(skb, state->in, PF_INET6);
4953 }
4954 #endif  /* IPV6 */
4955
4956 static unsigned int selinux_ip_output(struct sk_buff *skb,
4957                                       u16 family)
4958 {
4959         struct sock *sk;
4960         u32 sid;
4961
4962         if (!netlbl_enabled())
4963                 return NF_ACCEPT;
4964
4965         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4966          * because we want to make sure we apply the necessary labeling
4967          * before IPsec is applied so we can leverage AH protection */
4968         sk = skb->sk;
4969         if (sk) {
4970                 struct sk_security_struct *sksec;
4971
4972                 if (sk_listener(sk))
4973                         /* if the socket is the listening state then this
4974                          * packet is a SYN-ACK packet which means it needs to
4975                          * be labeled based on the connection/request_sock and
4976                          * not the parent socket.  unfortunately, we can't
4977                          * lookup the request_sock yet as it isn't queued on
4978                          * the parent socket until after the SYN-ACK is sent.
4979                          * the "solution" is to simply pass the packet as-is
4980                          * as any IP option based labeling should be copied
4981                          * from the initial connection request (in the IP
4982                          * layer).  it is far from ideal, but until we get a
4983                          * security label in the packet itself this is the
4984                          * best we can do. */
4985                         return NF_ACCEPT;
4986
4987                 /* standard practice, label using the parent socket */
4988                 sksec = sk->sk_security;
4989                 sid = sksec->sid;
4990         } else
4991                 sid = SECINITSID_KERNEL;
4992         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4993                 return NF_DROP;
4994
4995         return NF_ACCEPT;
4996 }
4997
4998 static unsigned int selinux_ipv4_output(void *priv,
4999                                         struct sk_buff *skb,
5000                                         const struct nf_hook_state *state)
5001 {
5002         return selinux_ip_output(skb, PF_INET);
5003 }
5004
5005 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5006                                                 int ifindex,
5007                                                 u16 family)
5008 {
5009         struct sock *sk = skb_to_full_sk(skb);
5010         struct sk_security_struct *sksec;
5011         struct common_audit_data ad;
5012         struct lsm_network_audit net = {0,};
5013         char *addrp;
5014         u8 proto;
5015
5016         if (sk == NULL)
5017                 return NF_ACCEPT;
5018         sksec = sk->sk_security;
5019
5020         ad.type = LSM_AUDIT_DATA_NET;
5021         ad.u.net = &net;
5022         ad.u.net->netif = ifindex;
5023         ad.u.net->family = family;
5024         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5025                 return NF_DROP;
5026
5027         if (selinux_secmark_enabled())
5028                 if (avc_has_perm(sksec->sid, skb->secmark,
5029                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5030                         return NF_DROP_ERR(-ECONNREFUSED);
5031
5032         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5033                 return NF_DROP_ERR(-ECONNREFUSED);
5034
5035         return NF_ACCEPT;
5036 }
5037
5038 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5039                                          const struct net_device *outdev,
5040                                          u16 family)
5041 {
5042         u32 secmark_perm;
5043         u32 peer_sid;
5044         int ifindex = outdev->ifindex;
5045         struct sock *sk;
5046         struct common_audit_data ad;
5047         struct lsm_network_audit net = {0,};
5048         char *addrp;
5049         u8 secmark_active;
5050         u8 peerlbl_active;
5051
5052         /* If any sort of compatibility mode is enabled then handoff processing
5053          * to the selinux_ip_postroute_compat() function to deal with the
5054          * special handling.  We do this in an attempt to keep this function
5055          * as fast and as clean as possible. */
5056         if (!selinux_policycap_netpeer)
5057                 return selinux_ip_postroute_compat(skb, ifindex, family);
5058
5059         secmark_active = selinux_secmark_enabled();
5060         peerlbl_active = selinux_peerlbl_enabled();
5061         if (!secmark_active && !peerlbl_active)
5062                 return NF_ACCEPT;
5063
5064         sk = skb_to_full_sk(skb);
5065
5066 #ifdef CONFIG_XFRM
5067         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5068          * packet transformation so allow the packet to pass without any checks
5069          * since we'll have another chance to perform access control checks
5070          * when the packet is on it's final way out.
5071          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5072          *       is NULL, in this case go ahead and apply access control.
5073          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5074          *       TCP listening state we cannot wait until the XFRM processing
5075          *       is done as we will miss out on the SA label if we do;
5076          *       unfortunately, this means more work, but it is only once per
5077          *       connection. */
5078         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5079             !(sk && sk_listener(sk)))
5080                 return NF_ACCEPT;
5081 #endif
5082
5083         if (sk == NULL) {
5084                 /* Without an associated socket the packet is either coming
5085                  * from the kernel or it is being forwarded; check the packet
5086                  * to determine which and if the packet is being forwarded
5087                  * query the packet directly to determine the security label. */
5088                 if (skb->skb_iif) {
5089                         secmark_perm = PACKET__FORWARD_OUT;
5090                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5091                                 return NF_DROP;
5092                 } else {
5093                         secmark_perm = PACKET__SEND;
5094                         peer_sid = SECINITSID_KERNEL;
5095                 }
5096         } else if (sk_listener(sk)) {
5097                 /* Locally generated packet but the associated socket is in the
5098                  * listening state which means this is a SYN-ACK packet.  In
5099                  * this particular case the correct security label is assigned
5100                  * to the connection/request_sock but unfortunately we can't
5101                  * query the request_sock as it isn't queued on the parent
5102                  * socket until after the SYN-ACK packet is sent; the only
5103                  * viable choice is to regenerate the label like we do in
5104                  * selinux_inet_conn_request().  See also selinux_ip_output()
5105                  * for similar problems. */
5106                 u32 skb_sid;
5107                 struct sk_security_struct *sksec;
5108
5109                 sksec = sk->sk_security;
5110                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5111                         return NF_DROP;
5112                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5113                  * and the packet has been through at least one XFRM
5114                  * transformation then we must be dealing with the "final"
5115                  * form of labeled IPsec packet; since we've already applied
5116                  * all of our access controls on this packet we can safely
5117                  * pass the packet. */
5118                 if (skb_sid == SECSID_NULL) {
5119                         switch (family) {
5120                         case PF_INET:
5121                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5122                                         return NF_ACCEPT;
5123                                 break;
5124                         case PF_INET6:
5125                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5126                                         return NF_ACCEPT;
5127                                 break;
5128                         default:
5129                                 return NF_DROP_ERR(-ECONNREFUSED);
5130                         }
5131                 }
5132                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5133                         return NF_DROP;
5134                 secmark_perm = PACKET__SEND;
5135         } else {
5136                 /* Locally generated packet, fetch the security label from the
5137                  * associated socket. */
5138                 struct sk_security_struct *sksec = sk->sk_security;
5139                 peer_sid = sksec->sid;
5140                 secmark_perm = PACKET__SEND;
5141         }
5142
5143         ad.type = LSM_AUDIT_DATA_NET;
5144         ad.u.net = &net;
5145         ad.u.net->netif = ifindex;
5146         ad.u.net->family = family;
5147         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5148                 return NF_DROP;
5149
5150         if (secmark_active)
5151                 if (avc_has_perm(peer_sid, skb->secmark,
5152                                  SECCLASS_PACKET, secmark_perm, &ad))
5153                         return NF_DROP_ERR(-ECONNREFUSED);
5154
5155         if (peerlbl_active) {
5156                 u32 if_sid;
5157                 u32 node_sid;
5158
5159                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5160                         return NF_DROP;
5161                 if (avc_has_perm(peer_sid, if_sid,
5162                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5163                         return NF_DROP_ERR(-ECONNREFUSED);
5164
5165                 if (sel_netnode_sid(addrp, family, &node_sid))
5166                         return NF_DROP;
5167                 if (avc_has_perm(peer_sid, node_sid,
5168                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5169                         return NF_DROP_ERR(-ECONNREFUSED);
5170         }
5171
5172         return NF_ACCEPT;
5173 }
5174
5175 static unsigned int selinux_ipv4_postroute(void *priv,
5176                                            struct sk_buff *skb,
5177                                            const struct nf_hook_state *state)
5178 {
5179         return selinux_ip_postroute(skb, state->out, PF_INET);
5180 }
5181
5182 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5183 static unsigned int selinux_ipv6_postroute(void *priv,
5184                                            struct sk_buff *skb,
5185                                            const struct nf_hook_state *state)
5186 {
5187         return selinux_ip_postroute(skb, state->out, PF_INET6);
5188 }
5189 #endif  /* IPV6 */
5190
5191 #endif  /* CONFIG_NETFILTER */
5192
5193 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5194 {
5195         return selinux_nlmsg_perm(sk, skb);
5196 }
5197
5198 static int ipc_alloc_security(struct task_struct *task,
5199                               struct kern_ipc_perm *perm,
5200                               u16 sclass)
5201 {
5202         struct ipc_security_struct *isec;
5203         u32 sid;
5204
5205         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5206         if (!isec)
5207                 return -ENOMEM;
5208
5209         sid = task_sid(task);
5210         isec->sclass = sclass;
5211         isec->sid = sid;
5212         perm->security = isec;
5213
5214         return 0;
5215 }
5216
5217 static void ipc_free_security(struct kern_ipc_perm *perm)
5218 {
5219         struct ipc_security_struct *isec = perm->security;
5220         perm->security = NULL;
5221         kfree(isec);
5222 }
5223
5224 static int msg_msg_alloc_security(struct msg_msg *msg)
5225 {
5226         struct msg_security_struct *msec;
5227
5228         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5229         if (!msec)
5230                 return -ENOMEM;
5231
5232         msec->sid = SECINITSID_UNLABELED;
5233         msg->security = msec;
5234
5235         return 0;
5236 }
5237
5238 static void msg_msg_free_security(struct msg_msg *msg)
5239 {
5240         struct msg_security_struct *msec = msg->security;
5241
5242         msg->security = NULL;
5243         kfree(msec);
5244 }
5245
5246 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5247                         u32 perms)
5248 {
5249         struct ipc_security_struct *isec;
5250         struct common_audit_data ad;
5251         u32 sid = current_sid();
5252
5253         isec = ipc_perms->security;
5254
5255         ad.type = LSM_AUDIT_DATA_IPC;
5256         ad.u.ipc_id = ipc_perms->key;
5257
5258         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5259 }
5260
5261 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5262 {
5263         return msg_msg_alloc_security(msg);
5264 }
5265
5266 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5267 {
5268         msg_msg_free_security(msg);
5269 }
5270
5271 /* message queue security operations */
5272 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5273 {
5274         struct ipc_security_struct *isec;
5275         struct common_audit_data ad;
5276         u32 sid = current_sid();
5277         int rc;
5278
5279         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5280         if (rc)
5281                 return rc;
5282
5283         isec = msq->q_perm.security;
5284
5285         ad.type = LSM_AUDIT_DATA_IPC;
5286         ad.u.ipc_id = msq->q_perm.key;
5287
5288         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5289                           MSGQ__CREATE, &ad);
5290         if (rc) {
5291                 ipc_free_security(&msq->q_perm);
5292                 return rc;
5293         }
5294         return 0;
5295 }
5296
5297 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5298 {
5299         ipc_free_security(&msq->q_perm);
5300 }
5301
5302 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5303 {
5304         struct ipc_security_struct *isec;
5305         struct common_audit_data ad;
5306         u32 sid = current_sid();
5307
5308         isec = msq->q_perm.security;
5309
5310         ad.type = LSM_AUDIT_DATA_IPC;
5311         ad.u.ipc_id = msq->q_perm.key;
5312
5313         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5314                             MSGQ__ASSOCIATE, &ad);
5315 }
5316
5317 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5318 {
5319         int err;
5320         int perms;
5321
5322         switch (cmd) {
5323         case IPC_INFO:
5324         case MSG_INFO:
5325                 /* No specific object, just general system-wide information. */
5326                 return task_has_system(current, SYSTEM__IPC_INFO);
5327         case IPC_STAT:
5328         case MSG_STAT:
5329                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5330                 break;
5331         case IPC_SET:
5332                 perms = MSGQ__SETATTR;
5333                 break;
5334         case IPC_RMID:
5335                 perms = MSGQ__DESTROY;
5336                 break;
5337         default:
5338                 return 0;
5339         }
5340
5341         err = ipc_has_perm(&msq->q_perm, perms);
5342         return err;
5343 }
5344
5345 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5346 {
5347         struct ipc_security_struct *isec;
5348         struct msg_security_struct *msec;
5349         struct common_audit_data ad;
5350         u32 sid = current_sid();
5351         int rc;
5352
5353         isec = msq->q_perm.security;
5354         msec = msg->security;
5355
5356         /*
5357          * First time through, need to assign label to the message
5358          */
5359         if (msec->sid == SECINITSID_UNLABELED) {
5360                 /*
5361                  * Compute new sid based on current process and
5362                  * message queue this message will be stored in
5363                  */
5364                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5365                                              NULL, &msec->sid);
5366                 if (rc)
5367                         return rc;
5368         }
5369
5370         ad.type = LSM_AUDIT_DATA_IPC;
5371         ad.u.ipc_id = msq->q_perm.key;
5372
5373         /* Can this process write to the queue? */
5374         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5375                           MSGQ__WRITE, &ad);
5376         if (!rc)
5377                 /* Can this process send the message */
5378                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5379                                   MSG__SEND, &ad);
5380         if (!rc)
5381                 /* Can the message be put in the queue? */
5382                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5383                                   MSGQ__ENQUEUE, &ad);
5384
5385         return rc;
5386 }
5387
5388 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5389                                     struct task_struct *target,
5390                                     long type, int mode)
5391 {
5392         struct ipc_security_struct *isec;
5393         struct msg_security_struct *msec;
5394         struct common_audit_data ad;
5395         u32 sid = task_sid(target);
5396         int rc;
5397
5398         isec = msq->q_perm.security;
5399         msec = msg->security;
5400
5401         ad.type = LSM_AUDIT_DATA_IPC;
5402         ad.u.ipc_id = msq->q_perm.key;
5403
5404         rc = avc_has_perm(sid, isec->sid,
5405                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5406         if (!rc)
5407                 rc = avc_has_perm(sid, msec->sid,
5408                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5409         return rc;
5410 }
5411
5412 /* Shared Memory security operations */
5413 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5414 {
5415         struct ipc_security_struct *isec;
5416         struct common_audit_data ad;
5417         u32 sid = current_sid();
5418         int rc;
5419
5420         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5421         if (rc)
5422                 return rc;
5423
5424         isec = shp->shm_perm.security;
5425
5426         ad.type = LSM_AUDIT_DATA_IPC;
5427         ad.u.ipc_id = shp->shm_perm.key;
5428
5429         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5430                           SHM__CREATE, &ad);
5431         if (rc) {
5432                 ipc_free_security(&shp->shm_perm);
5433                 return rc;
5434         }
5435         return 0;
5436 }
5437
5438 static void selinux_shm_free_security(struct shmid_kernel *shp)
5439 {
5440         ipc_free_security(&shp->shm_perm);
5441 }
5442
5443 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5444 {
5445         struct ipc_security_struct *isec;
5446         struct common_audit_data ad;
5447         u32 sid = current_sid();
5448
5449         isec = shp->shm_perm.security;
5450
5451         ad.type = LSM_AUDIT_DATA_IPC;
5452         ad.u.ipc_id = shp->shm_perm.key;
5453
5454         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5455                             SHM__ASSOCIATE, &ad);
5456 }
5457
5458 /* Note, at this point, shp is locked down */
5459 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5460 {
5461         int perms;
5462         int err;
5463
5464         switch (cmd) {
5465         case IPC_INFO:
5466         case SHM_INFO:
5467                 /* No specific object, just general system-wide information. */
5468                 return task_has_system(current, SYSTEM__IPC_INFO);
5469         case IPC_STAT:
5470         case SHM_STAT:
5471                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5472                 break;
5473         case IPC_SET:
5474                 perms = SHM__SETATTR;
5475                 break;
5476         case SHM_LOCK:
5477         case SHM_UNLOCK:
5478                 perms = SHM__LOCK;
5479                 break;
5480         case IPC_RMID:
5481                 perms = SHM__DESTROY;
5482                 break;
5483         default:
5484                 return 0;
5485         }
5486
5487         err = ipc_has_perm(&shp->shm_perm, perms);
5488         return err;
5489 }
5490
5491 static int selinux_shm_shmat(struct shmid_kernel *shp,
5492                              char __user *shmaddr, int shmflg)
5493 {
5494         u32 perms;
5495
5496         if (shmflg & SHM_RDONLY)
5497                 perms = SHM__READ;
5498         else
5499                 perms = SHM__READ | SHM__WRITE;
5500
5501         return ipc_has_perm(&shp->shm_perm, perms);
5502 }
5503
5504 /* Semaphore security operations */
5505 static int selinux_sem_alloc_security(struct sem_array *sma)
5506 {
5507         struct ipc_security_struct *isec;
5508         struct common_audit_data ad;
5509         u32 sid = current_sid();
5510         int rc;
5511
5512         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5513         if (rc)
5514                 return rc;
5515
5516         isec = sma->sem_perm.security;
5517
5518         ad.type = LSM_AUDIT_DATA_IPC;
5519         ad.u.ipc_id = sma->sem_perm.key;
5520
5521         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5522                           SEM__CREATE, &ad);
5523         if (rc) {
5524                 ipc_free_security(&sma->sem_perm);
5525                 return rc;
5526         }
5527         return 0;
5528 }
5529
5530 static void selinux_sem_free_security(struct sem_array *sma)
5531 {
5532         ipc_free_security(&sma->sem_perm);
5533 }
5534
5535 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5536 {
5537         struct ipc_security_struct *isec;
5538         struct common_audit_data ad;
5539         u32 sid = current_sid();
5540
5541         isec = sma->sem_perm.security;
5542
5543         ad.type = LSM_AUDIT_DATA_IPC;
5544         ad.u.ipc_id = sma->sem_perm.key;
5545
5546         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5547                             SEM__ASSOCIATE, &ad);
5548 }
5549
5550 /* Note, at this point, sma is locked down */
5551 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5552 {
5553         int err;
5554         u32 perms;
5555
5556         switch (cmd) {
5557         case IPC_INFO:
5558         case SEM_INFO:
5559                 /* No specific object, just general system-wide information. */
5560                 return task_has_system(current, SYSTEM__IPC_INFO);
5561         case GETPID:
5562         case GETNCNT:
5563         case GETZCNT:
5564                 perms = SEM__GETATTR;
5565                 break;
5566         case GETVAL:
5567         case GETALL:
5568                 perms = SEM__READ;
5569                 break;
5570         case SETVAL:
5571         case SETALL:
5572                 perms = SEM__WRITE;
5573                 break;
5574         case IPC_RMID:
5575                 perms = SEM__DESTROY;
5576                 break;
5577         case IPC_SET:
5578                 perms = SEM__SETATTR;
5579                 break;
5580         case IPC_STAT:
5581         case SEM_STAT:
5582                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5583                 break;
5584         default:
5585                 return 0;
5586         }
5587
5588         err = ipc_has_perm(&sma->sem_perm, perms);
5589         return err;
5590 }
5591
5592 static int selinux_sem_semop(struct sem_array *sma,
5593                              struct sembuf *sops, unsigned nsops, int alter)
5594 {
5595         u32 perms;
5596
5597         if (alter)
5598                 perms = SEM__READ | SEM__WRITE;
5599         else
5600                 perms = SEM__READ;
5601
5602         return ipc_has_perm(&sma->sem_perm, perms);
5603 }
5604
5605 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5606 {
5607         u32 av = 0;
5608
5609         av = 0;
5610         if (flag & S_IRUGO)
5611                 av |= IPC__UNIX_READ;
5612         if (flag & S_IWUGO)
5613                 av |= IPC__UNIX_WRITE;
5614
5615         if (av == 0)
5616                 return 0;
5617
5618         return ipc_has_perm(ipcp, av);
5619 }
5620
5621 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5622 {
5623         struct ipc_security_struct *isec = ipcp->security;
5624         *secid = isec->sid;
5625 }
5626
5627 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5628 {
5629         if (inode)
5630                 inode_doinit_with_dentry(inode, dentry);
5631 }
5632
5633 static int selinux_getprocattr(struct task_struct *p,
5634                                char *name, char **value)
5635 {
5636         const struct task_security_struct *__tsec;
5637         u32 sid;
5638         int error;
5639         unsigned len;
5640
5641         if (current != p) {
5642                 error = current_has_perm(p, PROCESS__GETATTR);
5643                 if (error)
5644                         return error;
5645         }
5646
5647         rcu_read_lock();
5648         __tsec = __task_cred(p)->security;
5649
5650         if (!strcmp(name, "current"))
5651                 sid = __tsec->sid;
5652         else if (!strcmp(name, "prev"))
5653                 sid = __tsec->osid;
5654         else if (!strcmp(name, "exec"))
5655                 sid = __tsec->exec_sid;
5656         else if (!strcmp(name, "fscreate"))
5657                 sid = __tsec->create_sid;
5658         else if (!strcmp(name, "keycreate"))
5659                 sid = __tsec->keycreate_sid;
5660         else if (!strcmp(name, "sockcreate"))
5661                 sid = __tsec->sockcreate_sid;
5662         else
5663                 goto invalid;
5664         rcu_read_unlock();
5665
5666         if (!sid)
5667                 return 0;
5668
5669         error = security_sid_to_context(sid, value, &len);
5670         if (error)
5671                 return error;
5672         return len;
5673
5674 invalid:
5675         rcu_read_unlock();
5676         return -EINVAL;
5677 }
5678
5679 static int selinux_setprocattr(struct task_struct *p,
5680                                char *name, void *value, size_t size)
5681 {
5682         struct task_security_struct *tsec;
5683         struct task_struct *tracer;
5684         struct cred *new;
5685         u32 sid = 0, ptsid;
5686         int error;
5687         char *str = value;
5688
5689         if (current != p) {
5690                 /* SELinux only allows a process to change its own
5691                    security attributes. */
5692                 return -EACCES;
5693         }
5694
5695         /*
5696          * Basic control over ability to set these attributes at all.
5697          * current == p, but we'll pass them separately in case the
5698          * above restriction is ever removed.
5699          */
5700         if (!strcmp(name, "exec"))
5701                 error = current_has_perm(p, PROCESS__SETEXEC);
5702         else if (!strcmp(name, "fscreate"))
5703                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5704         else if (!strcmp(name, "keycreate"))
5705                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5706         else if (!strcmp(name, "sockcreate"))
5707                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5708         else if (!strcmp(name, "current"))
5709                 error = current_has_perm(p, PROCESS__SETCURRENT);
5710         else
5711                 error = -EINVAL;
5712         if (error)
5713                 return error;
5714
5715         /* Obtain a SID for the context, if one was specified. */
5716         if (size && str[1] && str[1] != '\n') {
5717                 if (str[size-1] == '\n') {
5718                         str[size-1] = 0;
5719                         size--;
5720                 }
5721                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5722                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5723                         if (!capable(CAP_MAC_ADMIN)) {
5724                                 struct audit_buffer *ab;
5725                                 size_t audit_size;
5726
5727                                 /* We strip a nul only if it is at the end, otherwise the
5728                                  * context contains a nul and we should audit that */
5729                                 if (str[size - 1] == '\0')
5730                                         audit_size = size - 1;
5731                                 else
5732                                         audit_size = size;
5733                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5734                                 audit_log_format(ab, "op=fscreate invalid_context=");
5735                                 audit_log_n_untrustedstring(ab, value, audit_size);
5736                                 audit_log_end(ab);
5737
5738                                 return error;
5739                         }
5740                         error = security_context_to_sid_force(value, size,
5741                                                               &sid);
5742                 }
5743                 if (error)
5744                         return error;
5745         }
5746
5747         new = prepare_creds();
5748         if (!new)
5749                 return -ENOMEM;
5750
5751         /* Permission checking based on the specified context is
5752            performed during the actual operation (execve,
5753            open/mkdir/...), when we know the full context of the
5754            operation.  See selinux_bprm_set_creds for the execve
5755            checks and may_create for the file creation checks. The
5756            operation will then fail if the context is not permitted. */
5757         tsec = new->security;
5758         if (!strcmp(name, "exec")) {
5759                 tsec->exec_sid = sid;
5760         } else if (!strcmp(name, "fscreate")) {
5761                 tsec->create_sid = sid;
5762         } else if (!strcmp(name, "keycreate")) {
5763                 error = may_create_key(sid, p);
5764                 if (error)
5765                         goto abort_change;
5766                 tsec->keycreate_sid = sid;
5767         } else if (!strcmp(name, "sockcreate")) {
5768                 tsec->sockcreate_sid = sid;
5769         } else if (!strcmp(name, "current")) {
5770                 error = -EINVAL;
5771                 if (sid == 0)
5772                         goto abort_change;
5773
5774                 /* Only allow single threaded processes to change context */
5775                 error = -EPERM;
5776                 if (!current_is_single_threaded()) {
5777                         error = security_bounded_transition(tsec->sid, sid);
5778                         if (error)
5779                                 goto abort_change;
5780                 }
5781
5782                 /* Check permissions for the transition. */
5783                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5784                                      PROCESS__DYNTRANSITION, NULL);
5785                 if (error)
5786                         goto abort_change;
5787
5788                 /* Check for ptracing, and update the task SID if ok.
5789                    Otherwise, leave SID unchanged and fail. */
5790                 ptsid = 0;
5791                 rcu_read_lock();
5792                 tracer = ptrace_parent(p);
5793                 if (tracer)
5794                         ptsid = task_sid(tracer);
5795                 rcu_read_unlock();
5796
5797                 if (tracer) {
5798                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5799                                              PROCESS__PTRACE, NULL);
5800                         if (error)
5801                                 goto abort_change;
5802                 }
5803
5804                 tsec->sid = sid;
5805         } else {
5806                 error = -EINVAL;
5807                 goto abort_change;
5808         }
5809
5810         commit_creds(new);
5811         return size;
5812
5813 abort_change:
5814         abort_creds(new);
5815         return error;
5816 }
5817
5818 static int selinux_ismaclabel(const char *name)
5819 {
5820         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5821 }
5822
5823 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5824 {
5825         return security_sid_to_context(secid, secdata, seclen);
5826 }
5827
5828 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5829 {
5830         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5831 }
5832
5833 static void selinux_release_secctx(char *secdata, u32 seclen)
5834 {
5835         kfree(secdata);
5836 }
5837
5838 static void selinux_inode_invalidate_secctx(struct inode *inode)
5839 {
5840         struct inode_security_struct *isec = inode->i_security;
5841
5842         mutex_lock(&isec->lock);
5843         isec->initialized = LABEL_INVALID;
5844         mutex_unlock(&isec->lock);
5845 }
5846
5847 /*
5848  *      called with inode->i_mutex locked
5849  */
5850 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5851 {
5852         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5853 }
5854
5855 /*
5856  *      called with inode->i_mutex locked
5857  */
5858 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5859 {
5860         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5861 }
5862
5863 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5864 {
5865         int len = 0;
5866         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5867                                                 ctx, true);
5868         if (len < 0)
5869                 return len;
5870         *ctxlen = len;
5871         return 0;
5872 }
5873 #ifdef CONFIG_KEYS
5874
5875 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5876                              unsigned long flags)
5877 {
5878         const struct task_security_struct *tsec;
5879         struct key_security_struct *ksec;
5880
5881         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5882         if (!ksec)
5883                 return -ENOMEM;
5884
5885         tsec = cred->security;
5886         if (tsec->keycreate_sid)
5887                 ksec->sid = tsec->keycreate_sid;
5888         else
5889                 ksec->sid = tsec->sid;
5890
5891         k->security = ksec;
5892         return 0;
5893 }
5894
5895 static void selinux_key_free(struct key *k)
5896 {
5897         struct key_security_struct *ksec = k->security;
5898
5899         k->security = NULL;
5900         kfree(ksec);
5901 }
5902
5903 static int selinux_key_permission(key_ref_t key_ref,
5904                                   const struct cred *cred,
5905                                   unsigned perm)
5906 {
5907         struct key *key;
5908         struct key_security_struct *ksec;
5909         u32 sid;
5910
5911         /* if no specific permissions are requested, we skip the
5912            permission check. No serious, additional covert channels
5913            appear to be created. */
5914         if (perm == 0)
5915                 return 0;
5916
5917         sid = cred_sid(cred);
5918
5919         key = key_ref_to_ptr(key_ref);
5920         ksec = key->security;
5921
5922         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5923 }
5924
5925 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5926 {
5927         struct key_security_struct *ksec = key->security;
5928         char *context = NULL;
5929         unsigned len;
5930         int rc;
5931
5932         rc = security_sid_to_context(ksec->sid, &context, &len);
5933         if (!rc)
5934                 rc = len;
5935         *_buffer = context;
5936         return rc;
5937 }
5938
5939 #endif
5940
5941 static struct security_hook_list selinux_hooks[] = {
5942         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5943         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5944         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5945         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5946
5947         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5948         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5949         LSM_HOOK_INIT(capget, selinux_capget),
5950         LSM_HOOK_INIT(capset, selinux_capset),
5951         LSM_HOOK_INIT(capable, selinux_capable),
5952         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5953         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5954         LSM_HOOK_INIT(syslog, selinux_syslog),
5955         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5956
5957         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5958
5959         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5960         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5961         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5962         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5963
5964         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5965         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5966         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5967         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5968         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5969         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5970         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5971         LSM_HOOK_INIT(sb_mount, selinux_mount),
5972         LSM_HOOK_INIT(sb_umount, selinux_umount),
5973         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5974         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5975         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5976
5977         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5978
5979         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5980         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5981         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5982         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5983         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5984         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5985         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5986         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5987         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5988         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5989         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5990         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5991         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5992         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5993         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5994         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5995         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5996         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5997         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5998         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5999         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6000         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6001         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6002         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6003         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6004
6005         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6006         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6007         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6008         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6009         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6010         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6011         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6012         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6013         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6014         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6015         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6016         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6017
6018         LSM_HOOK_INIT(file_open, selinux_file_open),
6019
6020         LSM_HOOK_INIT(task_create, selinux_task_create),
6021         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6022         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6023         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6024         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6025         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6026         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6027         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6028         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6029         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6030         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6031         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6032         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6033         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6034         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6035         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6036         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6037         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6038         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6039         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6040         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6041         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6042
6043         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6044         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6045
6046         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6047         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6048
6049         LSM_HOOK_INIT(msg_queue_alloc_security,
6050                         selinux_msg_queue_alloc_security),
6051         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6052         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6053         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6054         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6055         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6056
6057         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6058         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6059         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6060         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6061         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6062
6063         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6064         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6065         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6066         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6067         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6068
6069         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6070
6071         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6072         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6073
6074         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6075         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6076         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6077         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6078         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6079         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6080         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6081         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6082
6083         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6084         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6085
6086         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6087         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6088         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6089         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6090         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6091         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6092         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6093         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6094         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6095         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6096         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6097         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6098         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6099         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6100         LSM_HOOK_INIT(socket_getpeersec_stream,
6101                         selinux_socket_getpeersec_stream),
6102         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6103         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6104         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6105         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6106         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6107         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6108         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6109         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6110         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6111         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6112         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6113         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6114         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6115         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6116         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6117         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6118         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6119         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6120         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6121
6122 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6123         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6124         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6125         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6126         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6127         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6128         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6129                         selinux_xfrm_state_alloc_acquire),
6130         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6131         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6132         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6133         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6134                         selinux_xfrm_state_pol_flow_match),
6135         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6136 #endif
6137
6138 #ifdef CONFIG_KEYS
6139         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6140         LSM_HOOK_INIT(key_free, selinux_key_free),
6141         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6142         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6143 #endif
6144
6145 #ifdef CONFIG_AUDIT
6146         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6147         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6148         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6149         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6150 #endif
6151 };
6152
6153 static __init int selinux_init(void)
6154 {
6155         if (!security_module_enable("selinux")) {
6156                 selinux_enabled = 0;
6157                 return 0;
6158         }
6159
6160         if (!selinux_enabled) {
6161                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6162                 return 0;
6163         }
6164
6165         printk(KERN_INFO "SELinux:  Initializing.\n");
6166
6167         /* Set the security state for the initial task. */
6168         cred_init_security();
6169
6170         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6171
6172         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6173                                             sizeof(struct inode_security_struct),
6174                                             0, SLAB_PANIC, NULL);
6175         file_security_cache = kmem_cache_create("selinux_file_security",
6176                                             sizeof(struct file_security_struct),
6177                                             0, SLAB_PANIC, NULL);
6178         avc_init();
6179
6180         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6181
6182         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6183                 panic("SELinux: Unable to register AVC netcache callback\n");
6184
6185         if (selinux_enforcing)
6186                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6187         else
6188                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6189
6190         return 0;
6191 }
6192
6193 static void delayed_superblock_init(struct super_block *sb, void *unused)
6194 {
6195         superblock_doinit(sb, NULL);
6196 }
6197
6198 void selinux_complete_init(void)
6199 {
6200         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6201
6202         /* Set up any superblocks initialized prior to the policy load. */
6203         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6204         iterate_supers(delayed_superblock_init, NULL);
6205 }
6206
6207 /* SELinux requires early initialization in order to label
6208    all processes and objects when they are created. */
6209 security_initcall(selinux_init);
6210
6211 #if defined(CONFIG_NETFILTER)
6212
6213 static struct nf_hook_ops selinux_nf_ops[] = {
6214         {
6215                 .hook =         selinux_ipv4_postroute,
6216                 .pf =           NFPROTO_IPV4,
6217                 .hooknum =      NF_INET_POST_ROUTING,
6218                 .priority =     NF_IP_PRI_SELINUX_LAST,
6219         },
6220         {
6221                 .hook =         selinux_ipv4_forward,
6222                 .pf =           NFPROTO_IPV4,
6223                 .hooknum =      NF_INET_FORWARD,
6224                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6225         },
6226         {
6227                 .hook =         selinux_ipv4_output,
6228                 .pf =           NFPROTO_IPV4,
6229                 .hooknum =      NF_INET_LOCAL_OUT,
6230                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6231         },
6232 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6233         {
6234                 .hook =         selinux_ipv6_postroute,
6235                 .pf =           NFPROTO_IPV6,
6236                 .hooknum =      NF_INET_POST_ROUTING,
6237                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6238         },
6239         {
6240                 .hook =         selinux_ipv6_forward,
6241                 .pf =           NFPROTO_IPV6,
6242                 .hooknum =      NF_INET_FORWARD,
6243                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6244         },
6245 #endif  /* IPV6 */
6246 };
6247
6248 static int __init selinux_nf_ip_init(void)
6249 {
6250         int err;
6251
6252         if (!selinux_enabled)
6253                 return 0;
6254
6255         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6256
6257         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6258         if (err)
6259                 panic("SELinux: nf_register_hooks: error %d\n", err);
6260
6261         return 0;
6262 }
6263
6264 __initcall(selinux_nf_ip_init);
6265
6266 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6267 static void selinux_nf_ip_exit(void)
6268 {
6269         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6270
6271         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6272 }
6273 #endif
6274
6275 #else /* CONFIG_NETFILTER */
6276
6277 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6278 #define selinux_nf_ip_exit()
6279 #endif
6280
6281 #endif /* CONFIG_NETFILTER */
6282
6283 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6284 static int selinux_disabled;
6285
6286 int selinux_disable(void)
6287 {
6288         if (ss_initialized) {
6289                 /* Not permitted after initial policy load. */
6290                 return -EINVAL;
6291         }
6292
6293         if (selinux_disabled) {
6294                 /* Only do this once. */
6295                 return -EINVAL;
6296         }
6297
6298         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6299
6300         selinux_disabled = 1;
6301         selinux_enabled = 0;
6302
6303         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6304
6305         /* Try to destroy the avc node cache */
6306         avc_disable();
6307
6308         /* Unregister netfilter hooks. */
6309         selinux_nf_ip_exit();
6310
6311         /* Unregister selinuxfs. */
6312         exit_sel_fs();
6313
6314         return 0;
6315 }
6316 #endif