security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 /*
 246  * Get the security label of an inode.
 247  */
 248 static struct inode_security_struct *inode_security(struct inode *inode)
 249 {
 250         return inode->i_security;
 251 }
 252
 253 /*
 254  * Get the security label of a dentry's backing inode.
 255  */
 256 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 257 {
 258         struct inode *inode = d_backing_inode(dentry);
 259
 260         return inode->i_security;
 261 }
 262
 263 static void inode_free_rcu(struct rcu_head *head)
 264 {
 265         struct inode_security_struct *isec;
 266
 267         isec = container_of(head, struct inode_security_struct, rcu);
 268         kmem_cache_free(sel_inode_cache, isec);
 269 }
 270
 271 static void inode_free_security(struct inode *inode)
 272 {
 273         struct inode_security_struct *isec = inode->i_security;
 274         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 275
 276         /*
 277          * As not all inode security structures are in a list, we check for
 278          * empty list outside of the lock to make sure that we won't waste
 279          * time taking a lock doing nothing.
 280          *
 281          * The list_del_init() function can be safely called more than once.
 282          * It should not be possible for this function to be called with
 283          * concurrent list_add(), but for better safety against future changes
 284          * in the code, we use list_empty_careful() here.
 285          */
 286         if (!list_empty_careful(&isec->list)) {
 287                 spin_lock(&sbsec->isec_lock);
 288                 list_del_init(&isec->list);
 289                 spin_unlock(&sbsec->isec_lock);
 290         }
 291
 292         /*
 293          * The inode may still be referenced in a path walk and
 294          * a call to selinux_inode_permission() can be made
 295          * after inode_free_security() is called. Ideally, the VFS
 296          * wouldn't do this, but fixing that is a much harder
 297          * job. For now, simply free the i_security via RCU, and
 298          * leave the current inode->i_security pointer intact.
 299          * The inode will be freed after the RCU grace period too.
 300          */
 301         call_rcu(&isec->rcu, inode_free_rcu);
 302 }
 303
 304 static int file_alloc_security(struct file *file)
 305 {
 306         struct file_security_struct *fsec;
 307         u32 sid = current_sid();
 308
 309         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 310         if (!fsec)
 311                 return -ENOMEM;
 312
 313         fsec->sid = sid;
 314         fsec->fown_sid = sid;
 315         file->f_security = fsec;
 316
 317         return 0;
 318 }
 319
 320 static void file_free_security(struct file *file)
 321 {
 322         struct file_security_struct *fsec = file->f_security;
 323         file->f_security = NULL;
 324         kmem_cache_free(file_security_cache, fsec);
 325 }
 326
 327 static int superblock_alloc_security(struct super_block *sb)
 328 {
 329         struct superblock_security_struct *sbsec;
 330
 331         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 332         if (!sbsec)
 333                 return -ENOMEM;
 334
 335         mutex_init(&sbsec->lock);
 336         INIT_LIST_HEAD(&sbsec->isec_head);
 337         spin_lock_init(&sbsec->isec_lock);
 338         sbsec->sb = sb;
 339         sbsec->sid = SECINITSID_UNLABELED;
 340         sbsec->def_sid = SECINITSID_FILE;
 341         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 342         sb->s_security = sbsec;
 343
 344         return 0;
 345 }
 346
 347 static void superblock_free_security(struct super_block *sb)
 348 {
 349         struct superblock_security_struct *sbsec = sb->s_security;
 350         sb->s_security = NULL;
 351         kfree(sbsec);
 352 }
 353
 354 /* The file system's label must be initialized prior to use. */
 355
 356 static const char *labeling_behaviors[7] = {
 357         "uses xattr",
 358         "uses transition SIDs",
 359         "uses task SIDs",
 360         "uses genfs_contexts",
 361         "not configured for labeling",
 362         "uses mountpoint labeling",
 363         "uses native labeling",
 364 };
 365
 366 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 367
 368 static inline int inode_doinit(struct inode *inode)
 369 {
 370         return inode_doinit_with_dentry(inode, NULL);
 371 }
 372
 373 enum {
 374         Opt_error = -1,
 375         Opt_context = 1,
 376         Opt_fscontext = 2,
 377         Opt_defcontext = 3,
 378         Opt_rootcontext = 4,
 379         Opt_labelsupport = 5,
 380         Opt_nextmntopt = 6,
 381 };
 382
 383 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 384
 385 static const match_table_t tokens = {
 386         {Opt_context, CONTEXT_STR "%s"},
 387         {Opt_fscontext, FSCONTEXT_STR "%s"},
 388         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 389         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 390         {Opt_labelsupport, LABELSUPP_STR},
 391         {Opt_error, NULL},
 392 };
 393
 394 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 395
 396 static int may_context_mount_sb_relabel(u32 sid,
 397                         struct superblock_security_struct *sbsec,
 398                         const struct cred *cred)
 399 {
 400         const struct task_security_struct *tsec = cred->security;
 401         int rc;
 402
 403         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 404                           FILESYSTEM__RELABELFROM, NULL);
 405         if (rc)
 406                 return rc;
 407
 408         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 409                           FILESYSTEM__RELABELTO, NULL);
 410         return rc;
 411 }
 412
 413 static int may_context_mount_inode_relabel(u32 sid,
 414                         struct superblock_security_struct *sbsec,
 415                         const struct cred *cred)
 416 {
 417         const struct task_security_struct *tsec = cred->security;
 418         int rc;
 419         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 420                           FILESYSTEM__RELABELFROM, NULL);
 421         if (rc)
 422                 return rc;
 423
 424         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 425                           FILESYSTEM__ASSOCIATE, NULL);
 426         return rc;
 427 }
 428
 429 static int selinux_is_sblabel_mnt(struct super_block *sb)
 430 {
 431         struct superblock_security_struct *sbsec = sb->s_security;
 432
 433         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 434                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 435                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 436                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 437                 /* Special handling. Genfs but also in-core setxattr handler */
 438                 !strcmp(sb->s_type->name, "sysfs") ||
 439                 !strcmp(sb->s_type->name, "pstore") ||
 440                 !strcmp(sb->s_type->name, "debugfs") ||
 441                 !strcmp(sb->s_type->name, "rootfs");
 442 }
 443
 444 static int sb_finish_set_opts(struct super_block *sb)
 445 {
 446         struct superblock_security_struct *sbsec = sb->s_security;
 447         struct dentry *root = sb->s_root;
 448         struct inode *root_inode = d_backing_inode(root);
 449         int rc = 0;
 450
 451         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 452                 /* Make sure that the xattr handler exists and that no
 453                    error other than -ENODATA is returned by getxattr on
 454                    the root directory.  -ENODATA is ok, as this may be
 455                    the first boot of the SELinux kernel before we have
 456                    assigned xattr values to the filesystem. */
 457                 if (!root_inode->i_op->getxattr) {
 458                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 459                                "xattr support\n", sb->s_id, sb->s_type->name);
 460                         rc = -EOPNOTSUPP;
 461                         goto out;
 462                 }
 463                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 464                 if (rc < 0 && rc != -ENODATA) {
 465                         if (rc == -EOPNOTSUPP)
 466                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 467                                        "%s) has no security xattr handler\n",
 468                                        sb->s_id, sb->s_type->name);
 469                         else
 470                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 471                                        "%s) getxattr errno %d\n", sb->s_id,
 472                                        sb->s_type->name, -rc);
 473                         goto out;
 474                 }
 475         }
 476
 477         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 478                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 479                        sb->s_id, sb->s_type->name);
 480
 481         sbsec->flags |= SE_SBINITIALIZED;
 482         if (selinux_is_sblabel_mnt(sb))
 483                 sbsec->flags |= SBLABEL_MNT;
 484
 485         /* Initialize the root inode. */
 486         rc = inode_doinit_with_dentry(root_inode, root);
 487
 488         /* Initialize any other inodes associated with the superblock, e.g.
 489            inodes created prior to initial policy load or inodes created
 490            during get_sb by a pseudo filesystem that directly
 491            populates itself. */
 492         spin_lock(&sbsec->isec_lock);
 493 next_inode:
 494         if (!list_empty(&sbsec->isec_head)) {
 495                 struct inode_security_struct *isec =
 496                                 list_entry(sbsec->isec_head.next,
 497                                            struct inode_security_struct, list);
 498                 struct inode *inode = isec->inode;
 499                 list_del_init(&isec->list);
 500                 spin_unlock(&sbsec->isec_lock);
 501                 inode = igrab(inode);
 502                 if (inode) {
 503                         if (!IS_PRIVATE(inode))
 504                                 inode_doinit(inode);
 505                         iput(inode);
 506                 }
 507                 spin_lock(&sbsec->isec_lock);
 508                 goto next_inode;
 509         }
 510         spin_unlock(&sbsec->isec_lock);
 511 out:
 512         return rc;
 513 }
 514
 515 /*
 516  * This function should allow an FS to ask what it's mount security
 517  * options were so it can use those later for submounts, displaying
 518  * mount options, or whatever.
 519  */
 520 static int selinux_get_mnt_opts(const struct super_block *sb,
 521                                 struct security_mnt_opts *opts)
 522 {
 523         int rc = 0, i;
 524         struct superblock_security_struct *sbsec = sb->s_security;
 525         char *context = NULL;
 526         u32 len;
 527         char tmp;
 528
 529         security_init_mnt_opts(opts);
 530
 531         if (!(sbsec->flags & SE_SBINITIALIZED))
 532                 return -EINVAL;
 533
 534         if (!ss_initialized)
 535                 return -EINVAL;
 536
 537         /* make sure we always check enough bits to cover the mask */
 538         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 539
 540         tmp = sbsec->flags & SE_MNTMASK;
 541         /* count the number of mount options for this sb */
 542         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 543                 if (tmp & 0x01)
 544                         opts->num_mnt_opts++;
 545                 tmp >>= 1;
 546         }
 547         /* Check if the Label support flag is set */
 548         if (sbsec->flags & SBLABEL_MNT)
 549                 opts->num_mnt_opts++;
 550
 551         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 552         if (!opts->mnt_opts) {
 553                 rc = -ENOMEM;
 554                 goto out_free;
 555         }
 556
 557         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 558         if (!opts->mnt_opts_flags) {
 559                 rc = -ENOMEM;
 560                 goto out_free;
 561         }
 562
 563         i = 0;
 564         if (sbsec->flags & FSCONTEXT_MNT) {
 565                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 566                 if (rc)
 567                         goto out_free;
 568                 opts->mnt_opts[i] = context;
 569                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 570         }
 571         if (sbsec->flags & CONTEXT_MNT) {
 572                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 573                 if (rc)
 574                         goto out_free;
 575                 opts->mnt_opts[i] = context;
 576                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 577         }
 578         if (sbsec->flags & DEFCONTEXT_MNT) {
 579                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 580                 if (rc)
 581                         goto out_free;
 582                 opts->mnt_opts[i] = context;
 583                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 584         }
 585         if (sbsec->flags & ROOTCONTEXT_MNT) {
 586                 struct dentry *root = sbsec->sb->s_root;
 587                 struct inode_security_struct *isec = backing_inode_security(root);
 588
 589                 rc = security_sid_to_context(isec->sid, &context, &len);
 590                 if (rc)
 591                         goto out_free;
 592                 opts->mnt_opts[i] = context;
 593                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 594         }
 595         if (sbsec->flags & SBLABEL_MNT) {
 596                 opts->mnt_opts[i] = NULL;
 597                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 598         }
 599
 600         BUG_ON(i != opts->num_mnt_opts);
 601
 602         return 0;
 603
 604 out_free:
 605         security_free_mnt_opts(opts);
 606         return rc;
 607 }
 608
 609 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 610                       u32 old_sid, u32 new_sid)
 611 {
 612         char mnt_flags = sbsec->flags & SE_MNTMASK;
 613
 614         /* check if the old mount command had the same options */
 615         if (sbsec->flags & SE_SBINITIALIZED)
 616                 if (!(sbsec->flags & flag) ||
 617                     (old_sid != new_sid))
 618                         return 1;
 619
 620         /* check if we were passed the same options twice,
 621          * aka someone passed context=a,context=b
 622          */
 623         if (!(sbsec->flags & SE_SBINITIALIZED))
 624                 if (mnt_flags & flag)
 625                         return 1;
 626         return 0;
 627 }
 628
 629 /*
 630  * Allow filesystems with binary mount data to explicitly set mount point
 631  * labeling information.
 632  */
 633 static int selinux_set_mnt_opts(struct super_block *sb,
 634                                 struct security_mnt_opts *opts,
 635                                 unsigned long kern_flags,
 636                                 unsigned long *set_kern_flags)
 637 {
 638         const struct cred *cred = current_cred();
 639         int rc = 0, i;
 640         struct superblock_security_struct *sbsec = sb->s_security;
 641         const char *name = sb->s_type->name;
 642         struct dentry *root = sbsec->sb->s_root;
 643         struct inode_security_struct *root_isec = backing_inode_security(root);
 644         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 645         u32 defcontext_sid = 0;
 646         char **mount_options = opts->mnt_opts;
 647         int *flags = opts->mnt_opts_flags;
 648         int num_opts = opts->num_mnt_opts;
 649
 650         mutex_lock(&sbsec->lock);
 651
 652         if (!ss_initialized) {
 653                 if (!num_opts) {
 654                         /* Defer initialization until selinux_complete_init,
 655                            after the initial policy is loaded and the security
 656                            server is ready to handle calls. */
 657                         goto out;
 658                 }
 659                 rc = -EINVAL;
 660                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 661                         "before the security server is initialized\n");
 662                 goto out;
 663         }
 664         if (kern_flags && !set_kern_flags) {
 665                 /* Specifying internal flags without providing a place to
 666                  * place the results is not allowed */
 667                 rc = -EINVAL;
 668                 goto out;
 669         }
 670
 671         /*
 672          * Binary mount data FS will come through this function twice.  Once
 673          * from an explicit call and once from the generic calls from the vfs.
 674          * Since the generic VFS calls will not contain any security mount data
 675          * we need to skip the double mount verification.
 676          *
 677          * This does open a hole in which we will not notice if the first
 678          * mount using this sb set explict options and a second mount using
 679          * this sb does not set any security options.  (The first options
 680          * will be used for both mounts)
 681          */
 682         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 683             && (num_opts == 0))
 684                 goto out;
 685
 686         /*
 687          * parse the mount options, check if they are valid sids.
 688          * also check if someone is trying to mount the same sb more
 689          * than once with different security options.
 690          */
 691         for (i = 0; i < num_opts; i++) {
 692                 u32 sid;
 693
 694                 if (flags[i] == SBLABEL_MNT)
 695                         continue;
 696                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 697                 if (rc) {
 698                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 699                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 700                                mount_options[i], sb->s_id, name, rc);
 701                         goto out;
 702                 }
 703                 switch (flags[i]) {
 704                 case FSCONTEXT_MNT:
 705                         fscontext_sid = sid;
 706
 707                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 708                                         fscontext_sid))
 709                                 goto out_double_mount;
 710
 711                         sbsec->flags |= FSCONTEXT_MNT;
 712                         break;
 713                 case CONTEXT_MNT:
 714                         context_sid = sid;
 715
 716                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 717                                         context_sid))
 718                                 goto out_double_mount;
 719
 720                         sbsec->flags |= CONTEXT_MNT;
 721                         break;
 722                 case ROOTCONTEXT_MNT:
 723                         rootcontext_sid = sid;
 724
 725                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 726                                         rootcontext_sid))
 727                                 goto out_double_mount;
 728
 729                         sbsec->flags |= ROOTCONTEXT_MNT;
 730
 731                         break;
 732                 case DEFCONTEXT_MNT:
 733                         defcontext_sid = sid;
 734
 735                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 736                                         defcontext_sid))
 737                                 goto out_double_mount;
 738
 739                         sbsec->flags |= DEFCONTEXT_MNT;
 740
 741                         break;
 742                 default:
 743                         rc = -EINVAL;
 744                         goto out;
 745                 }
 746         }
 747
 748         if (sbsec->flags & SE_SBINITIALIZED) {
 749                 /* previously mounted with options, but not on this attempt? */
 750                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 751                         goto out_double_mount;
 752                 rc = 0;
 753                 goto out;
 754         }
 755
 756         if (strcmp(sb->s_type->name, "proc") == 0)
 757                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 758
 759         if (!strcmp(sb->s_type->name, "debugfs") ||
 760             !strcmp(sb->s_type->name, "sysfs") ||
 761             !strcmp(sb->s_type->name, "pstore"))
 762                 sbsec->flags |= SE_SBGENFS;
 763
 764         if (!sbsec->behavior) {
 765                 /*
 766                  * Determine the labeling behavior to use for this
 767                  * filesystem type.
 768                  */
 769                 rc = security_fs_use(sb);
 770                 if (rc) {
 771                         printk(KERN_WARNING
 772                                 "%s: security_fs_use(%s) returned %d\n",
 773                                         __func__, sb->s_type->name, rc);
 774                         goto out;
 775                 }
 776         }
 777         /* sets the context of the superblock for the fs being mounted. */
 778         if (fscontext_sid) {
 779                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 780                 if (rc)
 781                         goto out;
 782
 783                 sbsec->sid = fscontext_sid;
 784         }
 785
 786         /*
 787          * Switch to using mount point labeling behavior.
 788          * sets the label used on all file below the mountpoint, and will set
 789          * the superblock context if not already set.
 790          */
 791         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 792                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 793                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 794         }
 795
 796         if (context_sid) {
 797                 if (!fscontext_sid) {
 798                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 799                                                           cred);
 800                         if (rc)
 801                                 goto out;
 802                         sbsec->sid = context_sid;
 803                 } else {
 804                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 805                                                              cred);
 806                         if (rc)
 807                                 goto out;
 808                 }
 809                 if (!rootcontext_sid)
 810                         rootcontext_sid = context_sid;
 811
 812                 sbsec->mntpoint_sid = context_sid;
 813                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 814         }
 815
 816         if (rootcontext_sid) {
 817                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 818                                                      cred);
 819                 if (rc)
 820                         goto out;
 821
 822                 root_isec->sid = rootcontext_sid;
 823                 root_isec->initialized = LABEL_INITIALIZED;
 824         }
 825
 826         if (defcontext_sid) {
 827                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 828                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 829                         rc = -EINVAL;
 830                         printk(KERN_WARNING "SELinux: defcontext option is "
 831                                "invalid for this filesystem type\n");
 832                         goto out;
 833                 }
 834
 835                 if (defcontext_sid != sbsec->def_sid) {
 836                         rc = may_context_mount_inode_relabel(defcontext_sid,
 837                                                              sbsec, cred);
 838                         if (rc)
 839                                 goto out;
 840                 }
 841
 842                 sbsec->def_sid = defcontext_sid;
 843         }
 844
 845         rc = sb_finish_set_opts(sb);
 846 out:
 847         mutex_unlock(&sbsec->lock);
 848         return rc;
 849 out_double_mount:
 850         rc = -EINVAL;
 851         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 852                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 853         goto out;
 854 }
 855
 856 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 857                                     const struct super_block *newsb)
 858 {
 859         struct superblock_security_struct *old = oldsb->s_security;
 860         struct superblock_security_struct *new = newsb->s_security;
 861         char oldflags = old->flags & SE_MNTMASK;
 862         char newflags = new->flags & SE_MNTMASK;
 863
 864         if (oldflags != newflags)
 865                 goto mismatch;
 866         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 867                 goto mismatch;
 868         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 869                 goto mismatch;
 870         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 871                 goto mismatch;
 872         if (oldflags & ROOTCONTEXT_MNT) {
 873                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 874                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 875                 if (oldroot->sid != newroot->sid)
 876                         goto mismatch;
 877         }
 878         return 0;
 879 mismatch:
 880         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 881                             "different security settings for (dev %s, "
 882                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 883         return -EBUSY;
 884 }
 885
 886 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 887                                         struct super_block *newsb)
 888 {
 889         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 890         struct superblock_security_struct *newsbsec = newsb->s_security;
 891
 892         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 893         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 894         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 895
 896         /*
 897          * if the parent was able to be mounted it clearly had no special lsm
 898          * mount options.  thus we can safely deal with this superblock later
 899          */
 900         if (!ss_initialized)
 901                 return 0;
 902
 903         /* how can we clone if the old one wasn't set up?? */
 904         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 905
 906         /* if fs is reusing a sb, make sure that the contexts match */
 907         if (newsbsec->flags & SE_SBINITIALIZED)
 908                 return selinux_cmp_sb_context(oldsb, newsb);
 909
 910         mutex_lock(&newsbsec->lock);
 911
 912         newsbsec->flags = oldsbsec->flags;
 913
 914         newsbsec->sid = oldsbsec->sid;
 915         newsbsec->def_sid = oldsbsec->def_sid;
 916         newsbsec->behavior = oldsbsec->behavior;
 917
 918         if (set_context) {
 919                 u32 sid = oldsbsec->mntpoint_sid;
 920
 921                 if (!set_fscontext)
 922                         newsbsec->sid = sid;
 923                 if (!set_rootcontext) {
 924                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 925                         newisec->sid = sid;
 926                 }
 927                 newsbsec->mntpoint_sid = sid;
 928         }
 929         if (set_rootcontext) {
 930                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 931                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 932
 933                 newisec->sid = oldisec->sid;
 934         }
 935
 936         sb_finish_set_opts(newsb);
 937         mutex_unlock(&newsbsec->lock);
 938         return 0;
 939 }
 940
 941 static int selinux_parse_opts_str(char *options,
 942                                   struct security_mnt_opts *opts)
 943 {
 944         char *p;
 945         char *context = NULL, *defcontext = NULL;
 946         char *fscontext = NULL, *rootcontext = NULL;
 947         int rc, num_mnt_opts = 0;
 948
 949         opts->num_mnt_opts = 0;
 950
 951         /* Standard string-based options. */
 952         while ((p = strsep(&options, "|")) != NULL) {
 953                 int token;
 954                 substring_t args[MAX_OPT_ARGS];
 955
 956                 if (!*p)
 957                         continue;
 958
 959                 token = match_token(p, tokens, args);
 960
 961                 switch (token) {
 962                 case Opt_context:
 963                         if (context || defcontext) {
 964                                 rc = -EINVAL;
 965                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 966                                 goto out_err;
 967                         }
 968                         context = match_strdup(&args[0]);
 969                         if (!context) {
 970                                 rc = -ENOMEM;
 971                                 goto out_err;
 972                         }
 973                         break;
 974
 975                 case Opt_fscontext:
 976                         if (fscontext) {
 977                                 rc = -EINVAL;
 978                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 979                                 goto out_err;
 980                         }
 981                         fscontext = match_strdup(&args[0]);
 982                         if (!fscontext) {
 983                                 rc = -ENOMEM;
 984                                 goto out_err;
 985                         }
 986                         break;
 987
 988                 case Opt_rootcontext:
 989                         if (rootcontext) {
 990                                 rc = -EINVAL;
 991                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 992                                 goto out_err;
 993                         }
 994                         rootcontext = match_strdup(&args[0]);
 995                         if (!rootcontext) {
 996                                 rc = -ENOMEM;
 997                                 goto out_err;
 998                         }
 999                         break;
1000
1001                 case Opt_defcontext:
1002                         if (context || defcontext) {
1003                                 rc = -EINVAL;
1004                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1005                                 goto out_err;
1006                         }
1007                         defcontext = match_strdup(&args[0]);
1008                         if (!defcontext) {
1009                                 rc = -ENOMEM;
1010                                 goto out_err;
1011                         }
1012                         break;
1013                 case Opt_labelsupport:
1014                         break;
1015                 default:
1016                         rc = -EINVAL;
1017                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1018                         goto out_err;
1019
1020                 }
1021         }
1022
1023         rc = -ENOMEM;
1024         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1025         if (!opts->mnt_opts)
1026                 goto out_err;
1027
1028         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1029         if (!opts->mnt_opts_flags) {
1030                 kfree(opts->mnt_opts);
1031                 goto out_err;
1032         }
1033
1034         if (fscontext) {
1035                 opts->mnt_opts[num_mnt_opts] = fscontext;
1036                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1037         }
1038         if (context) {
1039                 opts->mnt_opts[num_mnt_opts] = context;
1040                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1041         }
1042         if (rootcontext) {
1043                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1044                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1045         }
1046         if (defcontext) {
1047                 opts->mnt_opts[num_mnt_opts] = defcontext;
1048                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1049         }
1050
1051         opts->num_mnt_opts = num_mnt_opts;
1052         return 0;
1053
1054 out_err:
1055         kfree(context);
1056         kfree(defcontext);
1057         kfree(fscontext);
1058         kfree(rootcontext);
1059         return rc;
1060 }
1061 /*
1062  * string mount options parsing and call set the sbsec
1063  */
1064 static int superblock_doinit(struct super_block *sb, void *data)
1065 {
1066         int rc = 0;
1067         char *options = data;
1068         struct security_mnt_opts opts;
1069
1070         security_init_mnt_opts(&opts);
1071
1072         if (!data)
1073                 goto out;
1074
1075         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1076
1077         rc = selinux_parse_opts_str(options, &opts);
1078         if (rc)
1079                 goto out_err;
1080
1081 out:
1082         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1083
1084 out_err:
1085         security_free_mnt_opts(&opts);
1086         return rc;
1087 }
1088
1089 static void selinux_write_opts(struct seq_file *m,
1090                                struct security_mnt_opts *opts)
1091 {
1092         int i;
1093         char *prefix;
1094
1095         for (i = 0; i < opts->num_mnt_opts; i++) {
1096                 char *has_comma;
1097
1098                 if (opts->mnt_opts[i])
1099                         has_comma = strchr(opts->mnt_opts[i], ',');
1100                 else
1101                         has_comma = NULL;
1102
1103                 switch (opts->mnt_opts_flags[i]) {
1104                 case CONTEXT_MNT:
1105                         prefix = CONTEXT_STR;
1106                         break;
1107                 case FSCONTEXT_MNT:
1108                         prefix = FSCONTEXT_STR;
1109                         break;
1110                 case ROOTCONTEXT_MNT:
1111                         prefix = ROOTCONTEXT_STR;
1112                         break;
1113                 case DEFCONTEXT_MNT:
1114                         prefix = DEFCONTEXT_STR;
1115                         break;
1116                 case SBLABEL_MNT:
1117                         seq_putc(m, ',');
1118                         seq_puts(m, LABELSUPP_STR);
1119                         continue;
1120                 default:
1121                         BUG();
1122                         return;
1123                 };
1124                 /* we need a comma before each option */
1125                 seq_putc(m, ',');
1126                 seq_puts(m, prefix);
1127                 if (has_comma)
1128                         seq_putc(m, '\"');
1129                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1130                 if (has_comma)
1131                         seq_putc(m, '\"');
1132         }
1133 }
1134
1135 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1136 {
1137         struct security_mnt_opts opts;
1138         int rc;
1139
1140         rc = selinux_get_mnt_opts(sb, &opts);
1141         if (rc) {
1142                 /* before policy load we may get EINVAL, don't show anything */
1143                 if (rc == -EINVAL)
1144                         rc = 0;
1145                 return rc;
1146         }
1147
1148         selinux_write_opts(m, &opts);
1149
1150         security_free_mnt_opts(&opts);
1151
1152         return rc;
1153 }
1154
1155 static inline u16 inode_mode_to_security_class(umode_t mode)
1156 {
1157         switch (mode & S_IFMT) {
1158         case S_IFSOCK:
1159                 return SECCLASS_SOCK_FILE;
1160         case S_IFLNK:
1161                 return SECCLASS_LNK_FILE;
1162         case S_IFREG:
1163                 return SECCLASS_FILE;
1164         case S_IFBLK:
1165                 return SECCLASS_BLK_FILE;
1166         case S_IFDIR:
1167                 return SECCLASS_DIR;
1168         case S_IFCHR:
1169                 return SECCLASS_CHR_FILE;
1170         case S_IFIFO:
1171                 return SECCLASS_FIFO_FILE;
1172
1173         }
1174
1175         return SECCLASS_FILE;
1176 }
1177
1178 static inline int default_protocol_stream(int protocol)
1179 {
1180         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1181 }
1182
1183 static inline int default_protocol_dgram(int protocol)
1184 {
1185         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1186 }
1187
1188 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1189 {
1190         switch (family) {
1191         case PF_UNIX:
1192                 switch (type) {
1193                 case SOCK_STREAM:
1194                 case SOCK_SEQPACKET:
1195                         return SECCLASS_UNIX_STREAM_SOCKET;
1196                 case SOCK_DGRAM:
1197                         return SECCLASS_UNIX_DGRAM_SOCKET;
1198                 }
1199                 break;
1200         case PF_INET:
1201         case PF_INET6:
1202                 switch (type) {
1203                 case SOCK_STREAM:
1204                         if (default_protocol_stream(protocol))
1205                                 return SECCLASS_TCP_SOCKET;
1206                         else
1207                                 return SECCLASS_RAWIP_SOCKET;
1208                 case SOCK_DGRAM:
1209                         if (default_protocol_dgram(protocol))
1210                                 return SECCLASS_UDP_SOCKET;
1211                         else
1212                                 return SECCLASS_RAWIP_SOCKET;
1213                 case SOCK_DCCP:
1214                         return SECCLASS_DCCP_SOCKET;
1215                 default:
1216                         return SECCLASS_RAWIP_SOCKET;
1217                 }
1218                 break;
1219         case PF_NETLINK:
1220                 switch (protocol) {
1221                 case NETLINK_ROUTE:
1222                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1223                 case NETLINK_SOCK_DIAG:
1224                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1225                 case NETLINK_NFLOG:
1226                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1227                 case NETLINK_XFRM:
1228                         return SECCLASS_NETLINK_XFRM_SOCKET;
1229                 case NETLINK_SELINUX:
1230                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1231                 case NETLINK_ISCSI:
1232                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1233                 case NETLINK_AUDIT:
1234                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1235                 case NETLINK_FIB_LOOKUP:
1236                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1237                 case NETLINK_CONNECTOR:
1238                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1239                 case NETLINK_NETFILTER:
1240                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1241                 case NETLINK_DNRTMSG:
1242                         return SECCLASS_NETLINK_DNRT_SOCKET;
1243                 case NETLINK_KOBJECT_UEVENT:
1244                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1245                 case NETLINK_GENERIC:
1246                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1247                 case NETLINK_SCSITRANSPORT:
1248                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1249                 case NETLINK_RDMA:
1250                         return SECCLASS_NETLINK_RDMA_SOCKET;
1251                 case NETLINK_CRYPTO:
1252                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1253                 default:
1254                         return SECCLASS_NETLINK_SOCKET;
1255                 }
1256         case PF_PACKET:
1257                 return SECCLASS_PACKET_SOCKET;
1258         case PF_KEY:
1259                 return SECCLASS_KEY_SOCKET;
1260         case PF_APPLETALK:
1261                 return SECCLASS_APPLETALK_SOCKET;
1262         }
1263
1264         return SECCLASS_SOCKET;
1265 }
1266
1267 static int selinux_genfs_get_sid(struct dentry *dentry,
1268                                  u16 tclass,
1269                                  u16 flags,
1270                                  u32 *sid)
1271 {
1272         int rc;
1273         struct super_block *sb = dentry->d_inode->i_sb;
1274         char *buffer, *path;
1275
1276         buffer = (char *)__get_free_page(GFP_KERNEL);
1277         if (!buffer)
1278                 return -ENOMEM;
1279
1280         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1281         if (IS_ERR(path))
1282                 rc = PTR_ERR(path);
1283         else {
1284                 if (flags & SE_SBPROC) {
1285                         /* each process gets a /proc/PID/ entry. Strip off the
1286                          * PID part to get a valid selinux labeling.
1287                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1288                         while (path[1] >= '0' && path[1] <= '9') {
1289                                 path[1] = '/';
1290                                 path++;
1291                         }
1292                 }
1293                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1294         }
1295         free_page((unsigned long)buffer);
1296         return rc;
1297 }
1298
1299 /* The inode's security attributes must be initialized before first use. */
1300 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1301 {
1302         struct superblock_security_struct *sbsec = NULL;
1303         struct inode_security_struct *isec = inode->i_security;
1304         u32 sid;
1305         struct dentry *dentry;
1306 #define INITCONTEXTLEN 255
1307         char *context = NULL;
1308         unsigned len = 0;
1309         int rc = 0;
1310
1311         if (isec->initialized == LABEL_INITIALIZED)
1312                 goto out;
1313
1314         mutex_lock(&isec->lock);
1315         if (isec->initialized == LABEL_INITIALIZED)
1316                 goto out_unlock;
1317
1318         sbsec = inode->i_sb->s_security;
1319         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1320                 /* Defer initialization until selinux_complete_init,
1321                    after the initial policy is loaded and the security
1322                    server is ready to handle calls. */
1323                 spin_lock(&sbsec->isec_lock);
1324                 if (list_empty(&isec->list))
1325                         list_add(&isec->list, &sbsec->isec_head);
1326                 spin_unlock(&sbsec->isec_lock);
1327                 goto out_unlock;
1328         }
1329
1330         switch (sbsec->behavior) {
1331         case SECURITY_FS_USE_NATIVE:
1332                 break;
1333         case SECURITY_FS_USE_XATTR:
1334                 if (!inode->i_op->getxattr) {
1335                         isec->sid = sbsec->def_sid;
1336                         break;
1337                 }
1338
1339                 /* Need a dentry, since the xattr API requires one.
1340                    Life would be simpler if we could just pass the inode. */
1341                 if (opt_dentry) {
1342                         /* Called from d_instantiate or d_splice_alias. */
1343                         dentry = dget(opt_dentry);
1344                 } else {
1345                         /* Called from selinux_complete_init, try to find a dentry. */
1346                         dentry = d_find_alias(inode);
1347                 }
1348                 if (!dentry) {
1349                         /*
1350                          * this is can be hit on boot when a file is accessed
1351                          * before the policy is loaded.  When we load policy we
1352                          * may find inodes that have no dentry on the
1353                          * sbsec->isec_head list.  No reason to complain as these
1354                          * will get fixed up the next time we go through
1355                          * inode_doinit with a dentry, before these inodes could
1356                          * be used again by userspace.
1357                          */
1358                         goto out_unlock;
1359                 }
1360
1361                 len = INITCONTEXTLEN;
1362                 context = kmalloc(len+1, GFP_NOFS);
1363                 if (!context) {
1364                         rc = -ENOMEM;
1365                         dput(dentry);
1366                         goto out_unlock;
1367                 }
1368                 context[len] = '\0';
1369                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1370                                            context, len);
1371                 if (rc == -ERANGE) {
1372                         kfree(context);
1373
1374                         /* Need a larger buffer.  Query for the right size. */
1375                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1376                                                    NULL, 0);
1377                         if (rc < 0) {
1378                                 dput(dentry);
1379                                 goto out_unlock;
1380                         }
1381                         len = rc;
1382                         context = kmalloc(len+1, GFP_NOFS);
1383                         if (!context) {
1384                                 rc = -ENOMEM;
1385                                 dput(dentry);
1386                                 goto out_unlock;
1387                         }
1388                         context[len] = '\0';
1389                         rc = inode->i_op->getxattr(dentry,
1390                                                    XATTR_NAME_SELINUX,
1391                                                    context, len);
1392                 }
1393                 dput(dentry);
1394                 if (rc < 0) {
1395                         if (rc != -ENODATA) {
1396                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1397                                        "%d for dev=%s ino=%ld\n", __func__,
1398                                        -rc, inode->i_sb->s_id, inode->i_ino);
1399                                 kfree(context);
1400                                 goto out_unlock;
1401                         }
1402                         /* Map ENODATA to the default file SID */
1403                         sid = sbsec->def_sid;
1404                         rc = 0;
1405                 } else {
1406                         rc = security_context_to_sid_default(context, rc, &sid,
1407                                                              sbsec->def_sid,
1408                                                              GFP_NOFS);
1409                         if (rc) {
1410                                 char *dev = inode->i_sb->s_id;
1411                                 unsigned long ino = inode->i_ino;
1412
1413                                 if (rc == -EINVAL) {
1414                                         if (printk_ratelimit())
1415                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1416                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1417                                                         "filesystem in question.\n", ino, dev, context);
1418                                 } else {
1419                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1420                                                "returned %d for dev=%s ino=%ld\n",
1421                                                __func__, context, -rc, dev, ino);
1422                                 }
1423                                 kfree(context);
1424                                 /* Leave with the unlabeled SID */
1425                                 rc = 0;
1426                                 break;
1427                         }
1428                 }
1429                 kfree(context);
1430                 isec->sid = sid;
1431                 break;
1432         case SECURITY_FS_USE_TASK:
1433                 isec->sid = isec->task_sid;
1434                 break;
1435         case SECURITY_FS_USE_TRANS:
1436                 /* Default to the fs SID. */
1437                 isec->sid = sbsec->sid;
1438
1439                 /* Try to obtain a transition SID. */
1440                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1442                                              isec->sclass, NULL, &sid);
1443                 if (rc)
1444                         goto out_unlock;
1445                 isec->sid = sid;
1446                 break;
1447         case SECURITY_FS_USE_MNTPOINT:
1448                 isec->sid = sbsec->mntpoint_sid;
1449                 break;
1450         default:
1451                 /* Default to the fs superblock SID. */
1452                 isec->sid = sbsec->sid;
1453
1454                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1455                         /* We must have a dentry to determine the label on
1456                          * procfs inodes */
1457                         if (opt_dentry)
1458                                 /* Called from d_instantiate or
1459                                  * d_splice_alias. */
1460                                 dentry = dget(opt_dentry);
1461                         else
1462                                 /* Called from selinux_complete_init, try to
1463                                  * find a dentry. */
1464                                 dentry = d_find_alias(inode);
1465                         /*
1466                          * This can be hit on boot when a file is accessed
1467                          * before the policy is loaded.  When we load policy we
1468                          * may find inodes that have no dentry on the
1469                          * sbsec->isec_head list.  No reason to complain as
1470                          * these will get fixed up the next time we go through
1471                          * inode_doinit() with a dentry, before these inodes
1472                          * could be used again by userspace.
1473                          */
1474                         if (!dentry)
1475                                 goto out_unlock;
1476                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1477                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1478                                                    sbsec->flags, &sid);
1479                         dput(dentry);
1480                         if (rc)
1481                                 goto out_unlock;
1482                         isec->sid = sid;
1483                 }
1484                 break;
1485         }
1486
1487         isec->initialized = LABEL_INITIALIZED;
1488
1489 out_unlock:
1490         mutex_unlock(&isec->lock);
1491 out:
1492         if (isec->sclass == SECCLASS_FILE)
1493                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1494         return rc;
1495 }
1496
1497 /* Convert a Linux signal to an access vector. */
1498 static inline u32 signal_to_av(int sig)
1499 {
1500         u32 perm = 0;
1501
1502         switch (sig) {
1503         case SIGCHLD:
1504                 /* Commonly granted from child to parent. */
1505                 perm = PROCESS__SIGCHLD;
1506                 break;
1507         case SIGKILL:
1508                 /* Cannot be caught or ignored */
1509                 perm = PROCESS__SIGKILL;
1510                 break;
1511         case SIGSTOP:
1512                 /* Cannot be caught or ignored */
1513                 perm = PROCESS__SIGSTOP;
1514                 break;
1515         default:
1516                 /* All other signals. */
1517                 perm = PROCESS__SIGNAL;
1518                 break;
1519         }
1520
1521         return perm;
1522 }
1523
1524 /*
1525  * Check permission between a pair of credentials
1526  * fork check, ptrace check, etc.
1527  */
1528 static int cred_has_perm(const struct cred *actor,
1529                          const struct cred *target,
1530                          u32 perms)
1531 {
1532         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1533
1534         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1535 }
1536
1537 /*
1538  * Check permission between a pair of tasks, e.g. signal checks,
1539  * fork check, ptrace check, etc.
1540  * tsk1 is the actor and tsk2 is the target
1541  * - this uses the default subjective creds of tsk1
1542  */
1543 static int task_has_perm(const struct task_struct *tsk1,
1544                          const struct task_struct *tsk2,
1545                          u32 perms)
1546 {
1547         const struct task_security_struct *__tsec1, *__tsec2;
1548         u32 sid1, sid2;
1549
1550         rcu_read_lock();
1551         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1552         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1553         rcu_read_unlock();
1554         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1555 }
1556
1557 /*
1558  * Check permission between current and another task, e.g. signal checks,
1559  * fork check, ptrace check, etc.
1560  * current is the actor and tsk2 is the target
1561  * - this uses current's subjective creds
1562  */
1563 static int current_has_perm(const struct task_struct *tsk,
1564                             u32 perms)
1565 {
1566         u32 sid, tsid;
1567
1568         sid = current_sid();
1569         tsid = task_sid(tsk);
1570         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1571 }
1572
1573 #if CAP_LAST_CAP > 63
1574 #error Fix SELinux to handle capabilities > 63.
1575 #endif
1576
1577 /* Check whether a task is allowed to use a capability. */
1578 static int cred_has_capability(const struct cred *cred,
1579                                int cap, int audit)
1580 {
1581         struct common_audit_data ad;
1582         struct av_decision avd;
1583         u16 sclass;
1584         u32 sid = cred_sid(cred);
1585         u32 av = CAP_TO_MASK(cap);
1586         int rc;
1587
1588         ad.type = LSM_AUDIT_DATA_CAP;
1589         ad.u.cap = cap;
1590
1591         switch (CAP_TO_INDEX(cap)) {
1592         case 0:
1593                 sclass = SECCLASS_CAPABILITY;
1594                 break;
1595         case 1:
1596                 sclass = SECCLASS_CAPABILITY2;
1597                 break;
1598         default:
1599                 printk(KERN_ERR
1600                        "SELinux:  out of range capability %d\n", cap);
1601                 BUG();
1602                 return -EINVAL;
1603         }
1604
1605         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1606         if (audit == SECURITY_CAP_AUDIT) {
1607                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1608                 if (rc2)
1609                         return rc2;
1610         }
1611         return rc;
1612 }
1613
1614 /* Check whether a task is allowed to use a system operation. */
1615 static int task_has_system(struct task_struct *tsk,
1616                            u32 perms)
1617 {
1618         u32 sid = task_sid(tsk);
1619
1620         return avc_has_perm(sid, SECINITSID_KERNEL,
1621                             SECCLASS_SYSTEM, perms, NULL);
1622 }
1623
1624 /* Check whether a task has a particular permission to an inode.
1625    The 'adp' parameter is optional and allows other audit
1626    data to be passed (e.g. the dentry). */
1627 static int inode_has_perm(const struct cred *cred,
1628                           struct inode *inode,
1629                           u32 perms,
1630                           struct common_audit_data *adp)
1631 {
1632         struct inode_security_struct *isec;
1633         u32 sid;
1634
1635         validate_creds(cred);
1636
1637         if (unlikely(IS_PRIVATE(inode)))
1638                 return 0;
1639
1640         sid = cred_sid(cred);
1641         isec = inode->i_security;
1642
1643         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1644 }
1645
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647    the dentry to help the auditing code to more easily generate the
1648    pathname if needed. */
1649 static inline int dentry_has_perm(const struct cred *cred,
1650                                   struct dentry *dentry,
1651                                   u32 av)
1652 {
1653         struct inode *inode = d_backing_inode(dentry);
1654         struct common_audit_data ad;
1655
1656         ad.type = LSM_AUDIT_DATA_DENTRY;
1657         ad.u.dentry = dentry;
1658         return inode_has_perm(cred, inode, av, &ad);
1659 }
1660
1661 /* Same as inode_has_perm, but pass explicit audit data containing
1662    the path to help the auditing code to more easily generate the
1663    pathname if needed. */
1664 static inline int path_has_perm(const struct cred *cred,
1665                                 const struct path *path,
1666                                 u32 av)
1667 {
1668         struct inode *inode = d_backing_inode(path->dentry);
1669         struct common_audit_data ad;
1670
1671         ad.type = LSM_AUDIT_DATA_PATH;
1672         ad.u.path = *path;
1673         return inode_has_perm(cred, inode, av, &ad);
1674 }
1675
1676 /* Same as path_has_perm, but uses the inode from the file struct. */
1677 static inline int file_path_has_perm(const struct cred *cred,
1678                                      struct file *file,
1679                                      u32 av)
1680 {
1681         struct common_audit_data ad;
1682
1683         ad.type = LSM_AUDIT_DATA_PATH;
1684         ad.u.path = file->f_path;
1685         return inode_has_perm(cred, file_inode(file), av, &ad);
1686 }
1687
1688 /* Check whether a task can use an open file descriptor to
1689    access an inode in a given way.  Check access to the
1690    descriptor itself, and then use dentry_has_perm to
1691    check a particular permission to the file.
1692    Access to the descriptor is implicitly granted if it
1693    has the same SID as the process.  If av is zero, then
1694    access to the file is not checked, e.g. for cases
1695    where only the descriptor is affected like seek. */
1696 static int file_has_perm(const struct cred *cred,
1697                          struct file *file,
1698                          u32 av)
1699 {
1700         struct file_security_struct *fsec = file->f_security;
1701         struct inode *inode = file_inode(file);
1702         struct common_audit_data ad;
1703         u32 sid = cred_sid(cred);
1704         int rc;
1705
1706         ad.type = LSM_AUDIT_DATA_PATH;
1707         ad.u.path = file->f_path;
1708
1709         if (sid != fsec->sid) {
1710                 rc = avc_has_perm(sid, fsec->sid,
1711                                   SECCLASS_FD,
1712                                   FD__USE,
1713                                   &ad);
1714                 if (rc)
1715                         goto out;
1716         }
1717
1718         /* av is zero if only checking access to the descriptor. */
1719         rc = 0;
1720         if (av)
1721                 rc = inode_has_perm(cred, inode, av, &ad);
1722
1723 out:
1724         return rc;
1725 }
1726
1727 /*
1728  * Determine the label for an inode that might be unioned.
1729  */
1730 static int selinux_determine_inode_label(struct inode *dir,
1731                                          const struct qstr *name,
1732                                          u16 tclass,
1733                                          u32 *_new_isid)
1734 {
1735         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1736         const struct inode_security_struct *dsec = inode_security(dir);
1737         const struct task_security_struct *tsec = current_security();
1738
1739         if ((sbsec->flags & SE_SBINITIALIZED) &&
1740             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1741                 *_new_isid = sbsec->mntpoint_sid;
1742         } else if ((sbsec->flags & SBLABEL_MNT) &&
1743                    tsec->create_sid) {
1744                 *_new_isid = tsec->create_sid;
1745         } else {
1746                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1747                                                name, _new_isid);
1748         }
1749
1750         return 0;
1751 }
1752
1753 /* Check whether a task can create a file. */
1754 static int may_create(struct inode *dir,
1755                       struct dentry *dentry,
1756                       u16 tclass)
1757 {
1758         const struct task_security_struct *tsec = current_security();
1759         struct inode_security_struct *dsec;
1760         struct superblock_security_struct *sbsec;
1761         u32 sid, newsid;
1762         struct common_audit_data ad;
1763         int rc;
1764
1765         dsec = inode_security(dir);
1766         sbsec = dir->i_sb->s_security;
1767
1768         sid = tsec->sid;
1769
1770         ad.type = LSM_AUDIT_DATA_DENTRY;
1771         ad.u.dentry = dentry;
1772
1773         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1774                           DIR__ADD_NAME | DIR__SEARCH,
1775                           &ad);
1776         if (rc)
1777                 return rc;
1778
1779         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1780                                            &newsid);
1781         if (rc)
1782                 return rc;
1783
1784         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1785         if (rc)
1786                 return rc;
1787
1788         return avc_has_perm(newsid, sbsec->sid,
1789                             SECCLASS_FILESYSTEM,
1790                             FILESYSTEM__ASSOCIATE, &ad);
1791 }
1792
1793 /* Check whether a task can create a key. */
1794 static int may_create_key(u32 ksid,
1795                           struct task_struct *ctx)
1796 {
1797         u32 sid = task_sid(ctx);
1798
1799         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1800 }
1801
1802 #define MAY_LINK        0
1803 #define MAY_UNLINK      1
1804 #define MAY_RMDIR       2
1805
1806 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1807 static int may_link(struct inode *dir,
1808                     struct dentry *dentry,
1809                     int kind)
1810
1811 {
1812         struct inode_security_struct *dsec, *isec;
1813         struct common_audit_data ad;
1814         u32 sid = current_sid();
1815         u32 av;
1816         int rc;
1817
1818         dsec = inode_security(dir);
1819         isec = backing_inode_security(dentry);
1820
1821         ad.type = LSM_AUDIT_DATA_DENTRY;
1822         ad.u.dentry = dentry;
1823
1824         av = DIR__SEARCH;
1825         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1826         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1827         if (rc)
1828                 return rc;
1829
1830         switch (kind) {
1831         case MAY_LINK:
1832                 av = FILE__LINK;
1833                 break;
1834         case MAY_UNLINK:
1835                 av = FILE__UNLINK;
1836                 break;
1837         case MAY_RMDIR:
1838                 av = DIR__RMDIR;
1839                 break;
1840         default:
1841                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1842                         __func__, kind);
1843                 return 0;
1844         }
1845
1846         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1847         return rc;
1848 }
1849
1850 static inline int may_rename(struct inode *old_dir,
1851                              struct dentry *old_dentry,
1852                              struct inode *new_dir,
1853                              struct dentry *new_dentry)
1854 {
1855         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1856         struct common_audit_data ad;
1857         u32 sid = current_sid();
1858         u32 av;
1859         int old_is_dir, new_is_dir;
1860         int rc;
1861
1862         old_dsec = inode_security(old_dir);
1863         old_isec = backing_inode_security(old_dentry);
1864         old_is_dir = d_is_dir(old_dentry);
1865         new_dsec = inode_security(new_dir);
1866
1867         ad.type = LSM_AUDIT_DATA_DENTRY;
1868
1869         ad.u.dentry = old_dentry;
1870         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1871                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1872         if (rc)
1873                 return rc;
1874         rc = avc_has_perm(sid, old_isec->sid,
1875                           old_isec->sclass, FILE__RENAME, &ad);
1876         if (rc)
1877                 return rc;
1878         if (old_is_dir && new_dir != old_dir) {
1879                 rc = avc_has_perm(sid, old_isec->sid,
1880                                   old_isec->sclass, DIR__REPARENT, &ad);
1881                 if (rc)
1882                         return rc;
1883         }
1884
1885         ad.u.dentry = new_dentry;
1886         av = DIR__ADD_NAME | DIR__SEARCH;
1887         if (d_is_positive(new_dentry))
1888                 av |= DIR__REMOVE_NAME;
1889         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1890         if (rc)
1891                 return rc;
1892         if (d_is_positive(new_dentry)) {
1893                 new_isec = backing_inode_security(new_dentry);
1894                 new_is_dir = d_is_dir(new_dentry);
1895                 rc = avc_has_perm(sid, new_isec->sid,
1896                                   new_isec->sclass,
1897                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1898                 if (rc)
1899                         return rc;
1900         }
1901
1902         return 0;
1903 }
1904
1905 /* Check whether a task can perform a filesystem operation. */
1906 static int superblock_has_perm(const struct cred *cred,
1907                                struct super_block *sb,
1908                                u32 perms,
1909                                struct common_audit_data *ad)
1910 {
1911         struct superblock_security_struct *sbsec;
1912         u32 sid = cred_sid(cred);
1913
1914         sbsec = sb->s_security;
1915         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1916 }
1917
1918 /* Convert a Linux mode and permission mask to an access vector. */
1919 static inline u32 file_mask_to_av(int mode, int mask)
1920 {
1921         u32 av = 0;
1922
1923         if (!S_ISDIR(mode)) {
1924                 if (mask & MAY_EXEC)
1925                         av |= FILE__EXECUTE;
1926                 if (mask & MAY_READ)
1927                         av |= FILE__READ;
1928
1929                 if (mask & MAY_APPEND)
1930                         av |= FILE__APPEND;
1931                 else if (mask & MAY_WRITE)
1932                         av |= FILE__WRITE;
1933
1934         } else {
1935                 if (mask & MAY_EXEC)
1936                         av |= DIR__SEARCH;
1937                 if (mask & MAY_WRITE)
1938                         av |= DIR__WRITE;
1939                 if (mask & MAY_READ)
1940                         av |= DIR__READ;
1941         }
1942
1943         return av;
1944 }
1945
1946 /* Convert a Linux file to an access vector. */
1947 static inline u32 file_to_av(struct file *file)
1948 {
1949         u32 av = 0;
1950
1951         if (file->f_mode & FMODE_READ)
1952                 av |= FILE__READ;
1953         if (file->f_mode & FMODE_WRITE) {
1954                 if (file->f_flags & O_APPEND)
1955                         av |= FILE__APPEND;
1956                 else
1957                         av |= FILE__WRITE;
1958         }
1959         if (!av) {
1960                 /*
1961                  * Special file opened with flags 3 for ioctl-only use.
1962                  */
1963                 av = FILE__IOCTL;
1964         }
1965
1966         return av;
1967 }
1968
1969 /*
1970  * Convert a file to an access vector and include the correct open
1971  * open permission.
1972  */
1973 static inline u32 open_file_to_av(struct file *file)
1974 {
1975         u32 av = file_to_av(file);
1976
1977         if (selinux_policycap_openperm)
1978                 av |= FILE__OPEN;
1979
1980         return av;
1981 }
1982
1983 /* Hook functions begin here. */
1984
1985 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1986 {
1987         u32 mysid = current_sid();
1988         u32 mgrsid = task_sid(mgr);
1989
1990         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1991                             BINDER__SET_CONTEXT_MGR, NULL);
1992 }
1993
1994 static int selinux_binder_transaction(struct task_struct *from,
1995                                       struct task_struct *to)
1996 {
1997         u32 mysid = current_sid();
1998         u32 fromsid = task_sid(from);
1999         u32 tosid = task_sid(to);
2000         int rc;
2001
2002         if (mysid != fromsid) {
2003                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2004                                   BINDER__IMPERSONATE, NULL);
2005                 if (rc)
2006                         return rc;
2007         }
2008
2009         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2010                             NULL);
2011 }
2012
2013 static int selinux_binder_transfer_binder(struct task_struct *from,
2014                                           struct task_struct *to)
2015 {
2016         u32 fromsid = task_sid(from);
2017         u32 tosid = task_sid(to);
2018
2019         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2020                             NULL);
2021 }
2022
2023 static int selinux_binder_transfer_file(struct task_struct *from,
2024                                         struct task_struct *to,
2025                                         struct file *file)
2026 {
2027         u32 sid = task_sid(to);
2028         struct file_security_struct *fsec = file->f_security;
2029         struct dentry *dentry = file->f_path.dentry;
2030         struct inode_security_struct *isec = backing_inode_security(dentry);
2031         struct common_audit_data ad;
2032         int rc;
2033
2034         ad.type = LSM_AUDIT_DATA_PATH;
2035         ad.u.path = file->f_path;
2036
2037         if (sid != fsec->sid) {
2038                 rc = avc_has_perm(sid, fsec->sid,
2039                                   SECCLASS_FD,
2040                                   FD__USE,
2041                                   &ad);
2042                 if (rc)
2043                         return rc;
2044         }
2045
2046         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2047                 return 0;
2048
2049         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2050                             &ad);
2051 }
2052
2053 static int selinux_ptrace_access_check(struct task_struct *child,
2054                                      unsigned int mode)
2055 {
2056         if (mode & PTRACE_MODE_READ) {
2057                 u32 sid = current_sid();
2058                 u32 csid = task_sid(child);
2059                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2060         }
2061
2062         return current_has_perm(child, PROCESS__PTRACE);
2063 }
2064
2065 static int selinux_ptrace_traceme(struct task_struct *parent)
2066 {
2067         return task_has_perm(parent, current, PROCESS__PTRACE);
2068 }
2069
2070 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2071                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2072 {
2073         return current_has_perm(target, PROCESS__GETCAP);
2074 }
2075
2076 static int selinux_capset(struct cred *new, const struct cred *old,
2077                           const kernel_cap_t *effective,
2078                           const kernel_cap_t *inheritable,
2079                           const kernel_cap_t *permitted)
2080 {
2081         return cred_has_perm(old, new, PROCESS__SETCAP);
2082 }
2083
2084 /*
2085  * (This comment used to live with the selinux_task_setuid hook,
2086  * which was removed).
2087  *
2088  * Since setuid only affects the current process, and since the SELinux
2089  * controls are not based on the Linux identity attributes, SELinux does not
2090  * need to control this operation.  However, SELinux does control the use of
2091  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2092  */
2093
2094 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2095                            int cap, int audit)
2096 {
2097         return cred_has_capability(cred, cap, audit);
2098 }
2099
2100 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2101 {
2102         const struct cred *cred = current_cred();
2103         int rc = 0;
2104
2105         if (!sb)
2106                 return 0;
2107
2108         switch (cmds) {
2109         case Q_SYNC:
2110         case Q_QUOTAON:
2111         case Q_QUOTAOFF:
2112         case Q_SETINFO:
2113         case Q_SETQUOTA:
2114                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2115                 break;
2116         case Q_GETFMT:
2117         case Q_GETINFO:
2118         case Q_GETQUOTA:
2119                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2120                 break;
2121         default:
2122                 rc = 0;  /* let the kernel handle invalid cmds */
2123                 break;
2124         }
2125         return rc;
2126 }
2127
2128 static int selinux_quota_on(struct dentry *dentry)
2129 {
2130         const struct cred *cred = current_cred();
2131
2132         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2133 }
2134
2135 static int selinux_syslog(int type)
2136 {
2137         int rc;
2138
2139         switch (type) {
2140         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2141         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2142                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2143                 break;
2144         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2145         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2146         /* Set level of messages printed to console */
2147         case SYSLOG_ACTION_CONSOLE_LEVEL:
2148                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2149                 break;
2150         case SYSLOG_ACTION_CLOSE:       /* Close log */
2151         case SYSLOG_ACTION_OPEN:        /* Open log */
2152         case SYSLOG_ACTION_READ:        /* Read from log */
2153         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2154         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2155         default:
2156                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2157                 break;
2158         }
2159         return rc;
2160 }
2161
2162 /*
2163  * Check that a process has enough memory to allocate a new virtual
2164  * mapping. 0 means there is enough memory for the allocation to
2165  * succeed and -ENOMEM implies there is not.
2166  *
2167  * Do not audit the selinux permission check, as this is applied to all
2168  * processes that allocate mappings.
2169  */
2170 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2171 {
2172         int rc, cap_sys_admin = 0;
2173
2174         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2175                                         SECURITY_CAP_NOAUDIT);
2176         if (rc == 0)
2177                 cap_sys_admin = 1;
2178
2179         return cap_sys_admin;
2180 }
2181
2182 /* binprm security operations */
2183
2184 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2185                             const struct task_security_struct *old_tsec,
2186                             const struct task_security_struct *new_tsec)
2187 {
2188         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2189         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2190         int rc;
2191
2192         if (!nnp && !nosuid)
2193                 return 0; /* neither NNP nor nosuid */
2194
2195         if (new_tsec->sid == old_tsec->sid)
2196                 return 0; /* No change in credentials */
2197
2198         /*
2199          * The only transitions we permit under NNP or nosuid
2200          * are transitions to bounded SIDs, i.e. SIDs that are
2201          * guaranteed to only be allowed a subset of the permissions
2202          * of the current SID.
2203          */
2204         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2205         if (rc) {
2206                 /*
2207                  * On failure, preserve the errno values for NNP vs nosuid.
2208                  * NNP:  Operation not permitted for caller.
2209                  * nosuid:  Permission denied to file.
2210                  */
2211                 if (nnp)
2212                         return -EPERM;
2213                 else
2214                         return -EACCES;
2215         }
2216         return 0;
2217 }
2218
2219 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2220 {
2221         const struct task_security_struct *old_tsec;
2222         struct task_security_struct *new_tsec;
2223         struct inode_security_struct *isec;
2224         struct common_audit_data ad;
2225         struct inode *inode = file_inode(bprm->file);
2226         int rc;
2227
2228         /* SELinux context only depends on initial program or script and not
2229          * the script interpreter */
2230         if (bprm->cred_prepared)
2231                 return 0;
2232
2233         old_tsec = current_security();
2234         new_tsec = bprm->cred->security;
2235         isec = inode_security(inode);
2236
2237         /* Default to the current task SID. */
2238         new_tsec->sid = old_tsec->sid;
2239         new_tsec->osid = old_tsec->sid;
2240
2241         /* Reset fs, key, and sock SIDs on execve. */
2242         new_tsec->create_sid = 0;
2243         new_tsec->keycreate_sid = 0;
2244         new_tsec->sockcreate_sid = 0;
2245
2246         if (old_tsec->exec_sid) {
2247                 new_tsec->sid = old_tsec->exec_sid;
2248                 /* Reset exec SID on execve. */
2249                 new_tsec->exec_sid = 0;
2250
2251                 /* Fail on NNP or nosuid if not an allowed transition. */
2252                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253                 if (rc)
2254                         return rc;
2255         } else {
2256                 /* Check for a default transition on this program. */
2257                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2258                                              SECCLASS_PROCESS, NULL,
2259                                              &new_tsec->sid);
2260                 if (rc)
2261                         return rc;
2262
2263                 /*
2264                  * Fallback to old SID on NNP or nosuid if not an allowed
2265                  * transition.
2266                  */
2267                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2268                 if (rc)
2269                         new_tsec->sid = old_tsec->sid;
2270         }
2271
2272         ad.type = LSM_AUDIT_DATA_PATH;
2273         ad.u.path = bprm->file->f_path;
2274
2275         if (new_tsec->sid == old_tsec->sid) {
2276                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2277                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2278                 if (rc)
2279                         return rc;
2280         } else {
2281                 /* Check permissions for the transition. */
2282                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2283                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2284                 if (rc)
2285                         return rc;
2286
2287                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2288                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2289                 if (rc)
2290                         return rc;
2291
2292                 /* Check for shared state */
2293                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2294                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2295                                           SECCLASS_PROCESS, PROCESS__SHARE,
2296                                           NULL);
2297                         if (rc)
2298                                 return -EPERM;
2299                 }
2300
2301                 /* Make sure that anyone attempting to ptrace over a task that
2302                  * changes its SID has the appropriate permit */
2303                 if (bprm->unsafe &
2304                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2305                         struct task_struct *tracer;
2306                         struct task_security_struct *sec;
2307                         u32 ptsid = 0;
2308
2309                         rcu_read_lock();
2310                         tracer = ptrace_parent(current);
2311                         if (likely(tracer != NULL)) {
2312                                 sec = __task_cred(tracer)->security;
2313                                 ptsid = sec->sid;
2314                         }
2315                         rcu_read_unlock();
2316
2317                         if (ptsid != 0) {
2318                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2319                                                   SECCLASS_PROCESS,
2320                                                   PROCESS__PTRACE, NULL);
2321                                 if (rc)
2322                                         return -EPERM;
2323                         }
2324                 }
2325
2326                 /* Clear any possibly unsafe personality bits on exec: */
2327                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2328         }
2329
2330         return 0;
2331 }
2332
2333 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2334 {
2335         const struct task_security_struct *tsec = current_security();
2336         u32 sid, osid;
2337         int atsecure = 0;
2338
2339         sid = tsec->sid;
2340         osid = tsec->osid;
2341
2342         if (osid != sid) {
2343                 /* Enable secure mode for SIDs transitions unless
2344                    the noatsecure permission is granted between
2345                    the two SIDs, i.e. ahp returns 0. */
2346                 atsecure = avc_has_perm(osid, sid,
2347                                         SECCLASS_PROCESS,
2348                                         PROCESS__NOATSECURE, NULL);
2349         }
2350
2351         return !!atsecure;
2352 }
2353
2354 static int match_file(const void *p, struct file *file, unsigned fd)
2355 {
2356         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2357 }
2358
2359 /* Derived from fs/exec.c:flush_old_files. */
2360 static inline void flush_unauthorized_files(const struct cred *cred,
2361                                             struct files_struct *files)
2362 {
2363         struct file *file, *devnull = NULL;
2364         struct tty_struct *tty;
2365         int drop_tty = 0;
2366         unsigned n;
2367
2368         tty = get_current_tty();
2369         if (tty) {
2370                 spin_lock(&tty_files_lock);
2371                 if (!list_empty(&tty->tty_files)) {
2372                         struct tty_file_private *file_priv;
2373
2374                         /* Revalidate access to controlling tty.
2375                            Use file_path_has_perm on the tty path directly
2376                            rather than using file_has_perm, as this particular
2377                            open file may belong to another process and we are
2378                            only interested in the inode-based check here. */
2379                         file_priv = list_first_entry(&tty->tty_files,
2380                                                 struct tty_file_private, list);
2381                         file = file_priv->file;
2382                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2383                                 drop_tty = 1;
2384                 }
2385                 spin_unlock(&tty_files_lock);
2386                 tty_kref_put(tty);
2387         }
2388         /* Reset controlling tty. */
2389         if (drop_tty)
2390                 no_tty();
2391
2392         /* Revalidate access to inherited open files. */
2393         n = iterate_fd(files, 0, match_file, cred);
2394         if (!n) /* none found? */
2395                 return;
2396
2397         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2398         if (IS_ERR(devnull))
2399                 devnull = NULL;
2400         /* replace all the matching ones with this */
2401         do {
2402                 replace_fd(n - 1, devnull, 0);
2403         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2404         if (devnull)
2405                 fput(devnull);
2406 }
2407
2408 /*
2409  * Prepare a process for imminent new credential changes due to exec
2410  */
2411 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2412 {
2413         struct task_security_struct *new_tsec;
2414         struct rlimit *rlim, *initrlim;
2415         int rc, i;
2416
2417         new_tsec = bprm->cred->security;
2418         if (new_tsec->sid == new_tsec->osid)
2419                 return;
2420
2421         /* Close files for which the new task SID is not authorized. */
2422         flush_unauthorized_files(bprm->cred, current->files);
2423
2424         /* Always clear parent death signal on SID transitions. */
2425         current->pdeath_signal = 0;
2426
2427         /* Check whether the new SID can inherit resource limits from the old
2428          * SID.  If not, reset all soft limits to the lower of the current
2429          * task's hard limit and the init task's soft limit.
2430          *
2431          * Note that the setting of hard limits (even to lower them) can be
2432          * controlled by the setrlimit check.  The inclusion of the init task's
2433          * soft limit into the computation is to avoid resetting soft limits
2434          * higher than the default soft limit for cases where the default is
2435          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2436          */
2437         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2438                           PROCESS__RLIMITINH, NULL);
2439         if (rc) {
2440                 /* protect against do_prlimit() */
2441                 task_lock(current);
2442                 for (i = 0; i < RLIM_NLIMITS; i++) {
2443                         rlim = current->signal->rlim + i;
2444                         initrlim = init_task.signal->rlim + i;
2445                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2446                 }
2447                 task_unlock(current);
2448                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2449         }
2450 }
2451
2452 /*
2453  * Clean up the process immediately after the installation of new credentials
2454  * due to exec
2455  */
2456 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2457 {
2458         const struct task_security_struct *tsec = current_security();
2459         struct itimerval itimer;
2460         u32 osid, sid;
2461         int rc, i;
2462
2463         osid = tsec->osid;
2464         sid = tsec->sid;
2465
2466         if (sid == osid)
2467                 return;
2468
2469         /* Check whether the new SID can inherit signal state from the old SID.
2470          * If not, clear itimers to avoid subsequent signal generation and
2471          * flush and unblock signals.
2472          *
2473          * This must occur _after_ the task SID has been updated so that any
2474          * kill done after the flush will be checked against the new SID.
2475          */
2476         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2477         if (rc) {
2478                 memset(&itimer, 0, sizeof itimer);
2479                 for (i = 0; i < 3; i++)
2480                         do_setitimer(i, &itimer, NULL);
2481                 spin_lock_irq(&current->sighand->siglock);
2482                 if (!fatal_signal_pending(current)) {
2483                         flush_sigqueue(&current->pending);
2484                         flush_sigqueue(&current->signal->shared_pending);
2485                         flush_signal_handlers(current, 1);
2486                         sigemptyset(&current->blocked);
2487                         recalc_sigpending();
2488                 }
2489                 spin_unlock_irq(&current->sighand->siglock);
2490         }
2491
2492         /* Wake up the parent if it is waiting so that it can recheck
2493          * wait permission to the new task SID. */
2494         read_lock(&tasklist_lock);
2495         __wake_up_parent(current, current->real_parent);
2496         read_unlock(&tasklist_lock);
2497 }
2498
2499 /* superblock security operations */
2500
2501 static int selinux_sb_alloc_security(struct super_block *sb)
2502 {
2503         return superblock_alloc_security(sb);
2504 }
2505
2506 static void selinux_sb_free_security(struct super_block *sb)
2507 {
2508         superblock_free_security(sb);
2509 }
2510
2511 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2512 {
2513         if (plen > olen)
2514                 return 0;
2515
2516         return !memcmp(prefix, option, plen);
2517 }
2518
2519 static inline int selinux_option(char *option, int len)
2520 {
2521         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2522                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2523                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2524                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2525                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2526 }
2527
2528 static inline void take_option(char **to, char *from, int *first, int len)
2529 {
2530         if (!*first) {
2531                 **to = ',';
2532                 *to += 1;
2533         } else
2534                 *first = 0;
2535         memcpy(*to, from, len);
2536         *to += len;
2537 }
2538
2539 static inline void take_selinux_option(char **to, char *from, int *first,
2540                                        int len)
2541 {
2542         int current_size = 0;
2543
2544         if (!*first) {
2545                 **to = '|';
2546                 *to += 1;
2547         } else
2548                 *first = 0;
2549
2550         while (current_size < len) {
2551                 if (*from != '"') {
2552                         **to = *from;
2553                         *to += 1;
2554                 }
2555                 from += 1;
2556                 current_size += 1;
2557         }
2558 }
2559
2560 static int selinux_sb_copy_data(char *orig, char *copy)
2561 {
2562         int fnosec, fsec, rc = 0;
2563         char *in_save, *in_curr, *in_end;
2564         char *sec_curr, *nosec_save, *nosec;
2565         int open_quote = 0;
2566
2567         in_curr = orig;
2568         sec_curr = copy;
2569
2570         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2571         if (!nosec) {
2572                 rc = -ENOMEM;
2573                 goto out;
2574         }
2575
2576         nosec_save = nosec;
2577         fnosec = fsec = 1;
2578         in_save = in_end = orig;
2579
2580         do {
2581                 if (*in_end == '"')
2582                         open_quote = !open_quote;
2583                 if ((*in_end == ',' && open_quote == 0) ||
2584                                 *in_end == '\0') {
2585                         int len = in_end - in_curr;
2586
2587                         if (selinux_option(in_curr, len))
2588                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2589                         else
2590                                 take_option(&nosec, in_curr, &fnosec, len);
2591
2592                         in_curr = in_end + 1;
2593                 }
2594         } while (*in_end++);
2595
2596         strcpy(in_save, nosec_save);
2597         free_page((unsigned long)nosec_save);
2598 out:
2599         return rc;
2600 }
2601
2602 static int selinux_sb_remount(struct super_block *sb, void *data)
2603 {
2604         int rc, i, *flags;
2605         struct security_mnt_opts opts;
2606         char *secdata, **mount_options;
2607         struct superblock_security_struct *sbsec = sb->s_security;
2608
2609         if (!(sbsec->flags & SE_SBINITIALIZED))
2610                 return 0;
2611
2612         if (!data)
2613                 return 0;
2614
2615         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2616                 return 0;
2617
2618         security_init_mnt_opts(&opts);
2619         secdata = alloc_secdata();
2620         if (!secdata)
2621                 return -ENOMEM;
2622         rc = selinux_sb_copy_data(data, secdata);
2623         if (rc)
2624                 goto out_free_secdata;
2625
2626         rc = selinux_parse_opts_str(secdata, &opts);
2627         if (rc)
2628                 goto out_free_secdata;
2629
2630         mount_options = opts.mnt_opts;
2631         flags = opts.mnt_opts_flags;
2632
2633         for (i = 0; i < opts.num_mnt_opts; i++) {
2634                 u32 sid;
2635
2636                 if (flags[i] == SBLABEL_MNT)
2637                         continue;
2638                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2639                 if (rc) {
2640                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2641                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2642                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2643                         goto out_free_opts;
2644                 }
2645                 rc = -EINVAL;
2646                 switch (flags[i]) {
2647                 case FSCONTEXT_MNT:
2648                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2649                                 goto out_bad_option;
2650                         break;
2651                 case CONTEXT_MNT:
2652                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2653                                 goto out_bad_option;
2654                         break;
2655                 case ROOTCONTEXT_MNT: {
2656                         struct inode_security_struct *root_isec;
2657                         root_isec = backing_inode_security(sb->s_root);
2658
2659                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2660                                 goto out_bad_option;
2661                         break;
2662                 }
2663                 case DEFCONTEXT_MNT:
2664                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2665                                 goto out_bad_option;
2666                         break;
2667                 default:
2668                         goto out_free_opts;
2669                 }
2670         }
2671
2672         rc = 0;
2673 out_free_opts:
2674         security_free_mnt_opts(&opts);
2675 out_free_secdata:
2676         free_secdata(secdata);
2677         return rc;
2678 out_bad_option:
2679         printk(KERN_WARNING "SELinux: unable to change security options "
2680                "during remount (dev %s, type=%s)\n", sb->s_id,
2681                sb->s_type->name);
2682         goto out_free_opts;
2683 }
2684
2685 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2686 {
2687         const struct cred *cred = current_cred();
2688         struct common_audit_data ad;
2689         int rc;
2690
2691         rc = superblock_doinit(sb, data);
2692         if (rc)
2693                 return rc;
2694
2695         /* Allow all mounts performed by the kernel */
2696         if (flags & MS_KERNMOUNT)
2697                 return 0;
2698
2699         ad.type = LSM_AUDIT_DATA_DENTRY;
2700         ad.u.dentry = sb->s_root;
2701         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2702 }
2703
2704 static int selinux_sb_statfs(struct dentry *dentry)
2705 {
2706         const struct cred *cred = current_cred();
2707         struct common_audit_data ad;
2708
2709         ad.type = LSM_AUDIT_DATA_DENTRY;
2710         ad.u.dentry = dentry->d_sb->s_root;
2711         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2712 }
2713
2714 static int selinux_mount(const char *dev_name,
2715                          struct path *path,
2716                          const char *type,
2717                          unsigned long flags,
2718                          void *data)
2719 {
2720         const struct cred *cred = current_cred();
2721
2722         if (flags & MS_REMOUNT)
2723                 return superblock_has_perm(cred, path->dentry->d_sb,
2724                                            FILESYSTEM__REMOUNT, NULL);
2725         else
2726                 return path_has_perm(cred, path, FILE__MOUNTON);
2727 }
2728
2729 static int selinux_umount(struct vfsmount *mnt, int flags)
2730 {
2731         const struct cred *cred = current_cred();
2732
2733         return superblock_has_perm(cred, mnt->mnt_sb,
2734                                    FILESYSTEM__UNMOUNT, NULL);
2735 }
2736
2737 /* inode security operations */
2738
2739 static int selinux_inode_alloc_security(struct inode *inode)
2740 {
2741         return inode_alloc_security(inode);
2742 }
2743
2744 static void selinux_inode_free_security(struct inode *inode)
2745 {
2746         inode_free_security(inode);
2747 }
2748
2749 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2750                                         struct qstr *name, void **ctx,
2751                                         u32 *ctxlen)
2752 {
2753         u32 newsid;
2754         int rc;
2755
2756         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2757                                            inode_mode_to_security_class(mode),
2758                                            &newsid);
2759         if (rc)
2760                 return rc;
2761
2762         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2763 }
2764
2765 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2766                                        const struct qstr *qstr,
2767                                        const char **name,
2768                                        void **value, size_t *len)
2769 {
2770         const struct task_security_struct *tsec = current_security();
2771         struct superblock_security_struct *sbsec;
2772         u32 sid, newsid, clen;
2773         int rc;
2774         char *context;
2775
2776         sbsec = dir->i_sb->s_security;
2777
2778         sid = tsec->sid;
2779         newsid = tsec->create_sid;
2780
2781         rc = selinux_determine_inode_label(
2782                 dir, qstr,
2783                 inode_mode_to_security_class(inode->i_mode),
2784                 &newsid);
2785         if (rc)
2786                 return rc;
2787
2788         /* Possibly defer initialization to selinux_complete_init. */
2789         if (sbsec->flags & SE_SBINITIALIZED) {
2790                 struct inode_security_struct *isec = inode->i_security;
2791                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2792                 isec->sid = newsid;
2793                 isec->initialized = LABEL_INITIALIZED;
2794         }
2795
2796         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2797                 return -EOPNOTSUPP;
2798
2799         if (name)
2800                 *name = XATTR_SELINUX_SUFFIX;
2801
2802         if (value && len) {
2803                 rc = security_sid_to_context_force(newsid, &context, &clen);
2804                 if (rc)
2805                         return rc;
2806                 *value = context;
2807                 *len = clen;
2808         }
2809
2810         return 0;
2811 }
2812
2813 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2814 {
2815         return may_create(dir, dentry, SECCLASS_FILE);
2816 }
2817
2818 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2819 {
2820         return may_link(dir, old_dentry, MAY_LINK);
2821 }
2822
2823 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2824 {
2825         return may_link(dir, dentry, MAY_UNLINK);
2826 }
2827
2828 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2829 {
2830         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2831 }
2832
2833 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2834 {
2835         return may_create(dir, dentry, SECCLASS_DIR);
2836 }
2837
2838 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2839 {
2840         return may_link(dir, dentry, MAY_RMDIR);
2841 }
2842
2843 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2844 {
2845         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2846 }
2847
2848 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2849                                 struct inode *new_inode, struct dentry *new_dentry)
2850 {
2851         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2852 }
2853
2854 static int selinux_inode_readlink(struct dentry *dentry)
2855 {
2856         const struct cred *cred = current_cred();
2857
2858         return dentry_has_perm(cred, dentry, FILE__READ);
2859 }
2860
2861 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2862                                      bool rcu)
2863 {
2864         const struct cred *cred = current_cred();
2865         struct common_audit_data ad;
2866         struct inode_security_struct *isec;
2867         u32 sid;
2868
2869         validate_creds(cred);
2870
2871         ad.type = LSM_AUDIT_DATA_DENTRY;
2872         ad.u.dentry = dentry;
2873         sid = cred_sid(cred);
2874         isec = inode_security(inode);
2875
2876         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2877                                   rcu ? MAY_NOT_BLOCK : 0);
2878 }
2879
2880 static noinline int audit_inode_permission(struct inode *inode,
2881                                            u32 perms, u32 audited, u32 denied,
2882                                            int result,
2883                                            unsigned flags)
2884 {
2885         struct common_audit_data ad;
2886         struct inode_security_struct *isec = inode->i_security;
2887         int rc;
2888
2889         ad.type = LSM_AUDIT_DATA_INODE;
2890         ad.u.inode = inode;
2891
2892         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2893                             audited, denied, result, &ad, flags);
2894         if (rc)
2895                 return rc;
2896         return 0;
2897 }
2898
2899 static int selinux_inode_permission(struct inode *inode, int mask)
2900 {
2901         const struct cred *cred = current_cred();
2902         u32 perms;
2903         bool from_access;
2904         unsigned flags = mask & MAY_NOT_BLOCK;
2905         struct inode_security_struct *isec;
2906         u32 sid;
2907         struct av_decision avd;
2908         int rc, rc2;
2909         u32 audited, denied;
2910
2911         from_access = mask & MAY_ACCESS;
2912         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2913
2914         /* No permission to check.  Existence test. */
2915         if (!mask)
2916                 return 0;
2917
2918         validate_creds(cred);
2919
2920         if (unlikely(IS_PRIVATE(inode)))
2921                 return 0;
2922
2923         perms = file_mask_to_av(inode->i_mode, mask);
2924
2925         sid = cred_sid(cred);
2926         isec = inode_security(inode);
2927
2928         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2929         audited = avc_audit_required(perms, &avd, rc,
2930                                      from_access ? FILE__AUDIT_ACCESS : 0,
2931                                      &denied);
2932         if (likely(!audited))
2933                 return rc;
2934
2935         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2936         if (rc2)
2937                 return rc2;
2938         return rc;
2939 }
2940
2941 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2942 {
2943         const struct cred *cred = current_cred();
2944         unsigned int ia_valid = iattr->ia_valid;
2945         __u32 av = FILE__WRITE;
2946
2947         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2948         if (ia_valid & ATTR_FORCE) {
2949                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2950                               ATTR_FORCE);
2951                 if (!ia_valid)
2952                         return 0;
2953         }
2954
2955         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2956                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2957                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2958
2959         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2960                         && !(ia_valid & ATTR_FILE))
2961                 av |= FILE__OPEN;
2962
2963         return dentry_has_perm(cred, dentry, av);
2964 }
2965
2966 static int selinux_inode_getattr(const struct path *path)
2967 {
2968         return path_has_perm(current_cred(), path, FILE__GETATTR);
2969 }
2970
2971 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2972 {
2973         const struct cred *cred = current_cred();
2974
2975         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2976                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2977                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2978                         if (!capable(CAP_SETFCAP))
2979                                 return -EPERM;
2980                 } else if (!capable(CAP_SYS_ADMIN)) {
2981                         /* A different attribute in the security namespace.
2982                            Restrict to administrator. */
2983                         return -EPERM;
2984                 }
2985         }
2986
2987         /* Not an attribute we recognize, so just check the
2988            ordinary setattr permission. */
2989         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2990 }
2991
2992 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2993                                   const void *value, size_t size, int flags)
2994 {
2995         struct inode *inode = d_backing_inode(dentry);
2996         struct inode_security_struct *isec = backing_inode_security(dentry);
2997         struct superblock_security_struct *sbsec;
2998         struct common_audit_data ad;
2999         u32 newsid, sid = current_sid();
3000         int rc = 0;
3001
3002         if (strcmp(name, XATTR_NAME_SELINUX))
3003                 return selinux_inode_setotherxattr(dentry, name);
3004
3005         sbsec = inode->i_sb->s_security;
3006         if (!(sbsec->flags & SBLABEL_MNT))
3007                 return -EOPNOTSUPP;
3008
3009         if (!inode_owner_or_capable(inode))
3010                 return -EPERM;
3011
3012         ad.type = LSM_AUDIT_DATA_DENTRY;
3013         ad.u.dentry = dentry;
3014
3015         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3016                           FILE__RELABELFROM, &ad);
3017         if (rc)
3018                 return rc;
3019
3020         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3021         if (rc == -EINVAL) {
3022                 if (!capable(CAP_MAC_ADMIN)) {
3023                         struct audit_buffer *ab;
3024                         size_t audit_size;
3025                         const char *str;
3026
3027                         /* We strip a nul only if it is at the end, otherwise the
3028                          * context contains a nul and we should audit that */
3029                         if (value) {
3030                                 str = value;
3031                                 if (str[size - 1] == '\0')
3032                                         audit_size = size - 1;
3033                                 else
3034                                         audit_size = size;
3035                         } else {
3036                                 str = "";
3037                                 audit_size = 0;
3038                         }
3039                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3040                         audit_log_format(ab, "op=setxattr invalid_context=");
3041                         audit_log_n_untrustedstring(ab, value, audit_size);
3042                         audit_log_end(ab);
3043
3044                         return rc;
3045                 }
3046                 rc = security_context_to_sid_force(value, size, &newsid);
3047         }
3048         if (rc)
3049                 return rc;
3050
3051         rc = avc_has_perm(sid, newsid, isec->sclass,
3052                           FILE__RELABELTO, &ad);
3053         if (rc)
3054                 return rc;
3055
3056         rc = security_validate_transition(isec->sid, newsid, sid,
3057                                           isec->sclass);
3058         if (rc)
3059                 return rc;
3060
3061         return avc_has_perm(newsid,
3062                             sbsec->sid,
3063                             SECCLASS_FILESYSTEM,
3064                             FILESYSTEM__ASSOCIATE,
3065                             &ad);
3066 }
3067
3068 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3069                                         const void *value, size_t size,
3070                                         int flags)
3071 {
3072         struct inode *inode = d_backing_inode(dentry);
3073         struct inode_security_struct *isec = backing_inode_security(dentry);
3074         u32 newsid;
3075         int rc;
3076
3077         if (strcmp(name, XATTR_NAME_SELINUX)) {
3078                 /* Not an attribute we recognize, so nothing to do. */
3079                 return;
3080         }
3081
3082         rc = security_context_to_sid_force(value, size, &newsid);
3083         if (rc) {
3084                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3085                        "for (%s, %lu), rc=%d\n",
3086                        inode->i_sb->s_id, inode->i_ino, -rc);
3087                 return;
3088         }
3089
3090         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3091         isec->sid = newsid;
3092         isec->initialized = LABEL_INITIALIZED;
3093
3094         return;
3095 }
3096
3097 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3098 {
3099         const struct cred *cred = current_cred();
3100
3101         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3102 }
3103
3104 static int selinux_inode_listxattr(struct dentry *dentry)
3105 {
3106         const struct cred *cred = current_cred();
3107
3108         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3109 }
3110
3111 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3112 {
3113         if (strcmp(name, XATTR_NAME_SELINUX))
3114                 return selinux_inode_setotherxattr(dentry, name);
3115
3116         /* No one is allowed to remove a SELinux security label.
3117            You can change the label, but all data must be labeled. */
3118         return -EACCES;
3119 }
3120
3121 /*
3122  * Copy the inode security context value to the user.
3123  *
3124  * Permission check is handled by selinux_inode_getxattr hook.
3125  */
3126 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3127 {
3128         u32 size;
3129         int error;
3130         char *context = NULL;
3131         struct inode_security_struct *isec = inode_security(inode);
3132
3133         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3134                 return -EOPNOTSUPP;
3135
3136         /*
3137          * If the caller has CAP_MAC_ADMIN, then get the raw context
3138          * value even if it is not defined by current policy; otherwise,
3139          * use the in-core value under current policy.
3140          * Use the non-auditing forms of the permission checks since
3141          * getxattr may be called by unprivileged processes commonly
3142          * and lack of permission just means that we fall back to the
3143          * in-core context value, not a denial.
3144          */
3145         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3146                             SECURITY_CAP_NOAUDIT);
3147         if (!error)
3148                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3149                                             SECURITY_CAP_NOAUDIT);
3150         if (!error)
3151                 error = security_sid_to_context_force(isec->sid, &context,
3152                                                       &size);
3153         else
3154                 error = security_sid_to_context(isec->sid, &context, &size);
3155         if (error)
3156                 return error;
3157         error = size;
3158         if (alloc) {
3159                 *buffer = context;
3160                 goto out_nofree;
3161         }
3162         kfree(context);
3163 out_nofree:
3164         return error;
3165 }
3166
3167 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3168                                      const void *value, size_t size, int flags)
3169 {
3170         struct inode_security_struct *isec = inode_security(inode);
3171         u32 newsid;
3172         int rc;
3173
3174         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3175                 return -EOPNOTSUPP;
3176
3177         if (!value || !size)
3178                 return -EACCES;
3179
3180         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3181         if (rc)
3182                 return rc;
3183
3184         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3185         isec->sid = newsid;
3186         isec->initialized = LABEL_INITIALIZED;
3187         return 0;
3188 }
3189
3190 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3191 {
3192         const int len = sizeof(XATTR_NAME_SELINUX);
3193         if (buffer && len <= buffer_size)
3194                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3195         return len;
3196 }
3197
3198 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3199 {
3200         struct inode_security_struct *isec = inode_security(inode);
3201         *secid = isec->sid;
3202 }
3203
3204 /* file security operations */
3205
3206 static int selinux_revalidate_file_permission(struct file *file, int mask)
3207 {
3208         const struct cred *cred = current_cred();
3209         struct inode *inode = file_inode(file);
3210
3211         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3212         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3213                 mask |= MAY_APPEND;
3214
3215         return file_has_perm(cred, file,
3216                              file_mask_to_av(inode->i_mode, mask));
3217 }
3218
3219 static int selinux_file_permission(struct file *file, int mask)
3220 {
3221         struct inode *inode = file_inode(file);
3222         struct file_security_struct *fsec = file->f_security;
3223         struct inode_security_struct *isec = inode_security(inode);
3224         u32 sid = current_sid();
3225
3226         if (!mask)
3227                 /* No permission to check.  Existence test. */
3228                 return 0;
3229
3230         if (sid == fsec->sid && fsec->isid == isec->sid &&
3231             fsec->pseqno == avc_policy_seqno())
3232                 /* No change since file_open check. */
3233                 return 0;
3234
3235         return selinux_revalidate_file_permission(file, mask);
3236 }
3237
3238 static int selinux_file_alloc_security(struct file *file)
3239 {
3240         return file_alloc_security(file);
3241 }
3242
3243 static void selinux_file_free_security(struct file *file)
3244 {
3245         file_free_security(file);
3246 }
3247
3248 /*
3249  * Check whether a task has the ioctl permission and cmd
3250  * operation to an inode.
3251  */
3252 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3253                 u32 requested, u16 cmd)
3254 {
3255         struct common_audit_data ad;
3256         struct file_security_struct *fsec = file->f_security;
3257         struct inode *inode = file_inode(file);
3258         struct inode_security_struct *isec = inode_security(inode);
3259         struct lsm_ioctlop_audit ioctl;
3260         u32 ssid = cred_sid(cred);
3261         int rc;
3262         u8 driver = cmd >> 8;
3263         u8 xperm = cmd & 0xff;
3264
3265         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3266         ad.u.op = &ioctl;
3267         ad.u.op->cmd = cmd;
3268         ad.u.op->path = file->f_path;
3269
3270         if (ssid != fsec->sid) {
3271                 rc = avc_has_perm(ssid, fsec->sid,
3272                                 SECCLASS_FD,
3273                                 FD__USE,
3274                                 &ad);
3275                 if (rc)
3276                         goto out;
3277         }
3278
3279         if (unlikely(IS_PRIVATE(inode)))
3280                 return 0;
3281
3282         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3283                         requested, driver, xperm, &ad);
3284 out:
3285         return rc;
3286 }
3287
3288 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3289                               unsigned long arg)
3290 {
3291         const struct cred *cred = current_cred();
3292         int error = 0;
3293
3294         switch (cmd) {
3295         case FIONREAD:
3296         /* fall through */
3297         case FIBMAP:
3298         /* fall through */
3299         case FIGETBSZ:
3300         /* fall through */
3301         case FS_IOC_GETFLAGS:
3302         /* fall through */
3303         case FS_IOC_GETVERSION:
3304                 error = file_has_perm(cred, file, FILE__GETATTR);
3305                 break;
3306
3307         case FS_IOC_SETFLAGS:
3308         /* fall through */
3309         case FS_IOC_SETVERSION:
3310                 error = file_has_perm(cred, file, FILE__SETATTR);
3311                 break;
3312
3313         /* sys_ioctl() checks */
3314         case FIONBIO:
3315         /* fall through */
3316         case FIOASYNC:
3317                 error = file_has_perm(cred, file, 0);
3318                 break;
3319
3320         case KDSKBENT:
3321         case KDSKBSENT:
3322                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3323                                             SECURITY_CAP_AUDIT);
3324                 break;
3325
3326         /* default case assumes that the command will go
3327          * to the file's ioctl() function.
3328          */
3329         default:
3330                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3331         }
3332         return error;
3333 }
3334
3335 static int default_noexec;
3336
3337 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3338 {
3339         const struct cred *cred = current_cred();
3340         int rc = 0;
3341
3342         if (default_noexec &&
3343             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3344                                    (!shared && (prot & PROT_WRITE)))) {
3345                 /*
3346                  * We are making executable an anonymous mapping or a
3347                  * private file mapping that will also be writable.
3348                  * This has an additional check.
3349                  */
3350                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3351                 if (rc)
3352                         goto error;
3353         }
3354
3355         if (file) {
3356                 /* read access is always possible with a mapping */
3357                 u32 av = FILE__READ;
3358
3359                 /* write access only matters if the mapping is shared */
3360                 if (shared && (prot & PROT_WRITE))
3361                         av |= FILE__WRITE;
3362
3363                 if (prot & PROT_EXEC)
3364                         av |= FILE__EXECUTE;
3365
3366                 return file_has_perm(cred, file, av);
3367         }
3368
3369 error:
3370         return rc;
3371 }
3372
3373 static int selinux_mmap_addr(unsigned long addr)
3374 {
3375         int rc = 0;
3376
3377         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3378                 u32 sid = current_sid();
3379                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3380                                   MEMPROTECT__MMAP_ZERO, NULL);
3381         }
3382
3383         return rc;
3384 }
3385
3386 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3387                              unsigned long prot, unsigned long flags)
3388 {
3389         if (selinux_checkreqprot)
3390                 prot = reqprot;
3391
3392         return file_map_prot_check(file, prot,
3393                                    (flags & MAP_TYPE) == MAP_SHARED);
3394 }
3395
3396 static int selinux_file_mprotect(struct vm_area_struct *vma,
3397                                  unsigned long reqprot,
3398                                  unsigned long prot)
3399 {
3400         const struct cred *cred = current_cred();
3401
3402         if (selinux_checkreqprot)
3403                 prot = reqprot;
3404
3405         if (default_noexec &&
3406             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3407                 int rc = 0;
3408                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3409                     vma->vm_end <= vma->vm_mm->brk) {
3410                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3411                 } else if (!vma->vm_file &&
3412                            vma->vm_start <= vma->vm_mm->start_stack &&
3413                            vma->vm_end >= vma->vm_mm->start_stack) {
3414                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3415                 } else if (vma->vm_file && vma->anon_vma) {
3416                         /*
3417                          * We are making executable a file mapping that has
3418                          * had some COW done. Since pages might have been
3419                          * written, check ability to execute the possibly
3420                          * modified content.  This typically should only
3421                          * occur for text relocations.
3422                          */
3423                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3424                 }
3425                 if (rc)
3426                         return rc;
3427         }
3428
3429         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3430 }
3431
3432 static int selinux_file_lock(struct file *file, unsigned int cmd)
3433 {
3434         const struct cred *cred = current_cred();
3435
3436         return file_has_perm(cred, file, FILE__LOCK);
3437 }
3438
3439 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3440                               unsigned long arg)
3441 {
3442         const struct cred *cred = current_cred();
3443         int err = 0;
3444
3445         switch (cmd) {
3446         case F_SETFL:
3447                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3448                         err = file_has_perm(cred, file, FILE__WRITE);
3449                         break;
3450                 }
3451                 /* fall through */
3452         case F_SETOWN:
3453         case F_SETSIG:
3454         case F_GETFL:
3455         case F_GETOWN:
3456         case F_GETSIG:
3457         case F_GETOWNER_UIDS:
3458                 /* Just check FD__USE permission */
3459                 err = file_has_perm(cred, file, 0);
3460                 break;
3461         case F_GETLK:
3462         case F_SETLK:
3463         case F_SETLKW:
3464         case F_OFD_GETLK:
3465         case F_OFD_SETLK:
3466         case F_OFD_SETLKW:
3467 #if BITS_PER_LONG == 32
3468         case F_GETLK64:
3469         case F_SETLK64:
3470         case F_SETLKW64:
3471 #endif
3472                 err = file_has_perm(cred, file, FILE__LOCK);
3473                 break;
3474         }
3475
3476         return err;
3477 }
3478
3479 static void selinux_file_set_fowner(struct file *file)
3480 {
3481         struct file_security_struct *fsec;
3482
3483         fsec = file->f_security;
3484         fsec->fown_sid = current_sid();
3485 }
3486
3487 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3488                                        struct fown_struct *fown, int signum)
3489 {
3490         struct file *file;
3491         u32 sid = task_sid(tsk);
3492         u32 perm;
3493         struct file_security_struct *fsec;
3494
3495         /* struct fown_struct is never outside the context of a struct file */
3496         file = container_of(fown, struct file, f_owner);
3497
3498         fsec = file->f_security;
3499
3500         if (!signum)
3501                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3502         else
3503                 perm = signal_to_av(signum);
3504
3505         return avc_has_perm(fsec->fown_sid, sid,
3506                             SECCLASS_PROCESS, perm, NULL);
3507 }
3508
3509 static int selinux_file_receive(struct file *file)
3510 {
3511         const struct cred *cred = current_cred();
3512
3513         return file_has_perm(cred, file, file_to_av(file));
3514 }
3515
3516 static int selinux_file_open(struct file *file, const struct cred *cred)
3517 {
3518         struct file_security_struct *fsec;
3519         struct inode_security_struct *isec;
3520
3521         fsec = file->f_security;
3522         isec = inode_security(file_inode(file));
3523         /*
3524          * Save inode label and policy sequence number
3525          * at open-time so that selinux_file_permission
3526          * can determine whether revalidation is necessary.
3527          * Task label is already saved in the file security
3528          * struct as its SID.
3529          */
3530         fsec->isid = isec->sid;
3531         fsec->pseqno = avc_policy_seqno();
3532         /*
3533          * Since the inode label or policy seqno may have changed
3534          * between the selinux_inode_permission check and the saving
3535          * of state above, recheck that access is still permitted.
3536          * Otherwise, access might never be revalidated against the
3537          * new inode label or new policy.
3538          * This check is not redundant - do not remove.
3539          */
3540         return file_path_has_perm(cred, file, open_file_to_av(file));
3541 }
3542
3543 /* task security operations */
3544
3545 static int selinux_task_create(unsigned long clone_flags)
3546 {
3547         return current_has_perm(current, PROCESS__FORK);
3548 }
3549
3550 /*
3551  * allocate the SELinux part of blank credentials
3552  */
3553 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3554 {
3555         struct task_security_struct *tsec;
3556
3557         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3558         if (!tsec)
3559                 return -ENOMEM;
3560
3561         cred->security = tsec;
3562         return 0;
3563 }
3564
3565 /*
3566  * detach and free the LSM part of a set of credentials
3567  */
3568 static void selinux_cred_free(struct cred *cred)
3569 {
3570         struct task_security_struct *tsec = cred->security;
3571
3572         /*
3573          * cred->security == NULL if security_cred_alloc_blank() or
3574          * security_prepare_creds() returned an error.
3575          */
3576         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3577         cred->security = (void *) 0x7UL;
3578         kfree(tsec);
3579 }
3580
3581 /*
3582  * prepare a new set of credentials for modification
3583  */
3584 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3585                                 gfp_t gfp)
3586 {
3587         const struct task_security_struct *old_tsec;
3588         struct task_security_struct *tsec;
3589
3590         old_tsec = old->security;
3591
3592         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3593         if (!tsec)
3594                 return -ENOMEM;
3595
3596         new->security = tsec;
3597         return 0;
3598 }
3599
3600 /*
3601  * transfer the SELinux data to a blank set of creds
3602  */
3603 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3604 {
3605         const struct task_security_struct *old_tsec = old->security;
3606         struct task_security_struct *tsec = new->security;
3607
3608         *tsec = *old_tsec;
3609 }
3610
3611 /*
3612  * set the security data for a kernel service
3613  * - all the creation contexts are set to unlabelled
3614  */
3615 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3616 {
3617         struct task_security_struct *tsec = new->security;
3618         u32 sid = current_sid();
3619         int ret;
3620
3621         ret = avc_has_perm(sid, secid,
3622                            SECCLASS_KERNEL_SERVICE,
3623                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3624                            NULL);
3625         if (ret == 0) {
3626                 tsec->sid = secid;
3627                 tsec->create_sid = 0;
3628                 tsec->keycreate_sid = 0;
3629                 tsec->sockcreate_sid = 0;
3630         }
3631         return ret;
3632 }
3633
3634 /*
3635  * set the file creation context in a security record to the same as the
3636  * objective context of the specified inode
3637  */
3638 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3639 {
3640         struct inode_security_struct *isec = inode_security(inode);
3641         struct task_security_struct *tsec = new->security;
3642         u32 sid = current_sid();
3643         int ret;
3644
3645         ret = avc_has_perm(sid, isec->sid,
3646                            SECCLASS_KERNEL_SERVICE,
3647                            KERNEL_SERVICE__CREATE_FILES_AS,
3648                            NULL);
3649
3650         if (ret == 0)
3651                 tsec->create_sid = isec->sid;
3652         return ret;
3653 }
3654
3655 static int selinux_kernel_module_request(char *kmod_name)
3656 {
3657         u32 sid;
3658         struct common_audit_data ad;
3659
3660         sid = task_sid(current);
3661
3662         ad.type = LSM_AUDIT_DATA_KMOD;
3663         ad.u.kmod_name = kmod_name;
3664
3665         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3666                             SYSTEM__MODULE_REQUEST, &ad);
3667 }
3668
3669 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3670 {
3671         return current_has_perm(p, PROCESS__SETPGID);
3672 }
3673
3674 static int selinux_task_getpgid(struct task_struct *p)
3675 {
3676         return current_has_perm(p, PROCESS__GETPGID);
3677 }
3678
3679 static int selinux_task_getsid(struct task_struct *p)
3680 {
3681         return current_has_perm(p, PROCESS__GETSESSION);
3682 }
3683
3684 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3685 {
3686         *secid = task_sid(p);
3687 }
3688
3689 static int selinux_task_setnice(struct task_struct *p, int nice)
3690 {
3691         return current_has_perm(p, PROCESS__SETSCHED);
3692 }
3693
3694 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3695 {
3696         return current_has_perm(p, PROCESS__SETSCHED);
3697 }
3698
3699 static int selinux_task_getioprio(struct task_struct *p)
3700 {
3701         return current_has_perm(p, PROCESS__GETSCHED);
3702 }
3703
3704 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3705                 struct rlimit *new_rlim)
3706 {
3707         struct rlimit *old_rlim = p->signal->rlim + resource;
3708
3709         /* Control the ability to change the hard limit (whether
3710            lowering or raising it), so that the hard limit can
3711            later be used as a safe reset point for the soft limit
3712            upon context transitions.  See selinux_bprm_committing_creds. */
3713         if (old_rlim->rlim_max != new_rlim->rlim_max)
3714                 return current_has_perm(p, PROCESS__SETRLIMIT);
3715
3716         return 0;
3717 }
3718
3719 static int selinux_task_setscheduler(struct task_struct *p)
3720 {
3721         return current_has_perm(p, PROCESS__SETSCHED);
3722 }
3723
3724 static int selinux_task_getscheduler(struct task_struct *p)
3725 {
3726         return current_has_perm(p, PROCESS__GETSCHED);
3727 }
3728
3729 static int selinux_task_movememory(struct task_struct *p)
3730 {
3731         return current_has_perm(p, PROCESS__SETSCHED);
3732 }
3733
3734 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3735                                 int sig, u32 secid)
3736 {
3737         u32 perm;
3738         int rc;
3739
3740         if (!sig)
3741                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3742         else
3743                 perm = signal_to_av(sig);
3744         if (secid)
3745                 rc = avc_has_perm(secid, task_sid(p),
3746                                   SECCLASS_PROCESS, perm, NULL);
3747         else
3748                 rc = current_has_perm(p, perm);
3749         return rc;
3750 }
3751
3752 static int selinux_task_wait(struct task_struct *p)
3753 {
3754         return task_has_perm(p, current, PROCESS__SIGCHLD);
3755 }
3756
3757 static void selinux_task_to_inode(struct task_struct *p,
3758                                   struct inode *inode)
3759 {
3760         struct inode_security_struct *isec = inode->i_security;
3761         u32 sid = task_sid(p);
3762
3763         isec->sid = sid;
3764         isec->initialized = LABEL_INITIALIZED;
3765 }
3766
3767 /* Returns error only if unable to parse addresses */
3768 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3769                         struct common_audit_data *ad, u8 *proto)
3770 {
3771         int offset, ihlen, ret = -EINVAL;
3772         struct iphdr _iph, *ih;
3773
3774         offset = skb_network_offset(skb);
3775         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3776         if (ih == NULL)
3777                 goto out;
3778
3779         ihlen = ih->ihl * 4;
3780         if (ihlen < sizeof(_iph))
3781                 goto out;
3782
3783         ad->u.net->v4info.saddr = ih->saddr;
3784         ad->u.net->v4info.daddr = ih->daddr;
3785         ret = 0;
3786
3787         if (proto)
3788                 *proto = ih->protocol;
3789
3790         switch (ih->protocol) {
3791         case IPPROTO_TCP: {
3792                 struct tcphdr _tcph, *th;
3793
3794                 if (ntohs(ih->frag_off) & IP_OFFSET)
3795                         break;
3796
3797                 offset += ihlen;
3798                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3799                 if (th == NULL)
3800                         break;
3801
3802                 ad->u.net->sport = th->source;
3803                 ad->u.net->dport = th->dest;
3804                 break;
3805         }
3806
3807         case IPPROTO_UDP: {
3808                 struct udphdr _udph, *uh;
3809
3810                 if (ntohs(ih->frag_off) & IP_OFFSET)
3811                         break;
3812
3813                 offset += ihlen;
3814                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3815                 if (uh == NULL)
3816                         break;
3817
3818                 ad->u.net->sport = uh->source;
3819                 ad->u.net->dport = uh->dest;
3820                 break;
3821         }
3822
3823         case IPPROTO_DCCP: {
3824                 struct dccp_hdr _dccph, *dh;
3825
3826                 if (ntohs(ih->frag_off) & IP_OFFSET)
3827                         break;
3828
3829                 offset += ihlen;
3830                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3831                 if (dh == NULL)
3832                         break;
3833
3834                 ad->u.net->sport = dh->dccph_sport;
3835                 ad->u.net->dport = dh->dccph_dport;
3836                 break;
3837         }
3838
3839         default:
3840                 break;
3841         }
3842 out:
3843         return ret;
3844 }
3845
3846 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3847
3848 /* Returns error only if unable to parse addresses */
3849 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3850                         struct common_audit_data *ad, u8 *proto)
3851 {
3852         u8 nexthdr;
3853         int ret = -EINVAL, offset;
3854         struct ipv6hdr _ipv6h, *ip6;
3855         __be16 frag_off;
3856
3857         offset = skb_network_offset(skb);
3858         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3859         if (ip6 == NULL)
3860                 goto out;
3861
3862         ad->u.net->v6info.saddr = ip6->saddr;
3863         ad->u.net->v6info.daddr = ip6->daddr;
3864         ret = 0;
3865
3866         nexthdr = ip6->nexthdr;
3867         offset += sizeof(_ipv6h);
3868         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3869         if (offset < 0)
3870                 goto out;
3871
3872         if (proto)
3873                 *proto = nexthdr;
3874
3875         switch (nexthdr) {
3876         case IPPROTO_TCP: {
3877                 struct tcphdr _tcph, *th;
3878
3879                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3880                 if (th == NULL)
3881                         break;
3882
3883                 ad->u.net->sport = th->source;
3884                 ad->u.net->dport = th->dest;
3885                 break;
3886         }
3887
3888         case IPPROTO_UDP: {
3889                 struct udphdr _udph, *uh;
3890
3891                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3892                 if (uh == NULL)
3893                         break;
3894
3895                 ad->u.net->sport = uh->source;
3896                 ad->u.net->dport = uh->dest;
3897                 break;
3898         }
3899
3900         case IPPROTO_DCCP: {
3901                 struct dccp_hdr _dccph, *dh;
3902
3903                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3904                 if (dh == NULL)
3905                         break;
3906
3907                 ad->u.net->sport = dh->dccph_sport;
3908                 ad->u.net->dport = dh->dccph_dport;
3909                 break;
3910         }
3911
3912         /* includes fragments */
3913         default:
3914                 break;
3915         }
3916 out:
3917         return ret;
3918 }
3919
3920 #endif /* IPV6 */
3921
3922 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3923                              char **_addrp, int src, u8 *proto)
3924 {
3925         char *addrp;
3926         int ret;
3927
3928         switch (ad->u.net->family) {
3929         case PF_INET:
3930                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3931                 if (ret)
3932                         goto parse_error;
3933                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3934                                        &ad->u.net->v4info.daddr);
3935                 goto okay;
3936
3937 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3938         case PF_INET6:
3939                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3940                 if (ret)
3941                         goto parse_error;
3942                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3943                                        &ad->u.net->v6info.daddr);
3944                 goto okay;
3945 #endif  /* IPV6 */
3946         default:
3947                 addrp = NULL;
3948                 goto okay;
3949         }
3950
3951 parse_error:
3952         printk(KERN_WARNING
3953                "SELinux: failure in selinux_parse_skb(),"
3954                " unable to parse packet\n");
3955         return ret;
3956
3957 okay:
3958         if (_addrp)
3959                 *_addrp = addrp;
3960         return 0;
3961 }
3962
3963 /**
3964  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3965  * @skb: the packet
3966  * @family: protocol family
3967  * @sid: the packet's peer label SID
3968  *
3969  * Description:
3970  * Check the various different forms of network peer labeling and determine
3971  * the peer label/SID for the packet; most of the magic actually occurs in
3972  * the security server function security_net_peersid_cmp().  The function
3973  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3974  * or -EACCES if @sid is invalid due to inconsistencies with the different
3975  * peer labels.
3976  *
3977  */
3978 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3979 {
3980         int err;
3981         u32 xfrm_sid;
3982         u32 nlbl_sid;
3983         u32 nlbl_type;
3984
3985         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3986         if (unlikely(err))
3987                 return -EACCES;
3988         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3989         if (unlikely(err))
3990                 return -EACCES;
3991
3992         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3993         if (unlikely(err)) {
3994                 printk(KERN_WARNING
3995                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3996                        " unable to determine packet's peer label\n");
3997                 return -EACCES;
3998         }
3999
4000         return 0;
4001 }
4002
4003 /**
4004  * selinux_conn_sid - Determine the child socket label for a connection
4005  * @sk_sid: the parent socket's SID
4006  * @skb_sid: the packet's SID
4007  * @conn_sid: the resulting connection SID
4008  *
4009  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4010  * combined with the MLS information from @skb_sid in order to create
4011  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4012  * of @sk_sid.  Returns zero on success, negative values on failure.
4013  *
4014  */
4015 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4016 {
4017         int err = 0;
4018
4019         if (skb_sid != SECSID_NULL)
4020                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4021         else
4022                 *conn_sid = sk_sid;
4023
4024         return err;
4025 }
4026
4027 /* socket security operations */
4028
4029 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4030                                  u16 secclass, u32 *socksid)
4031 {
4032         if (tsec->sockcreate_sid > SECSID_NULL) {
4033                 *socksid = tsec->sockcreate_sid;
4034                 return 0;
4035         }
4036
4037         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4038                                        socksid);
4039 }
4040
4041 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4042 {
4043         struct sk_security_struct *sksec = sk->sk_security;
4044         struct common_audit_data ad;
4045         struct lsm_network_audit net = {0,};
4046         u32 tsid = task_sid(task);
4047
4048         if (sksec->sid == SECINITSID_KERNEL)
4049                 return 0;
4050
4051         ad.type = LSM_AUDIT_DATA_NET;
4052         ad.u.net = &net;
4053         ad.u.net->sk = sk;
4054
4055         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4056 }
4057
4058 static int selinux_socket_create(int family, int type,
4059                                  int protocol, int kern)
4060 {
4061         const struct task_security_struct *tsec = current_security();
4062         u32 newsid;
4063         u16 secclass;
4064         int rc;
4065
4066         if (kern)
4067                 return 0;
4068
4069         secclass = socket_type_to_security_class(family, type, protocol);
4070         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4071         if (rc)
4072                 return rc;
4073
4074         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4075 }
4076
4077 static int selinux_socket_post_create(struct socket *sock, int family,
4078                                       int type, int protocol, int kern)
4079 {
4080         const struct task_security_struct *tsec = current_security();
4081         struct inode_security_struct *isec = inode_security(SOCK_INODE(sock));
4082         struct sk_security_struct *sksec;
4083         int err = 0;
4084
4085         isec->sclass = socket_type_to_security_class(family, type, protocol);
4086
4087         if (kern)
4088                 isec->sid = SECINITSID_KERNEL;
4089         else {
4090                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4091                 if (err)
4092                         return err;
4093         }
4094
4095         isec->initialized = LABEL_INITIALIZED;
4096
4097         if (sock->sk) {
4098                 sksec = sock->sk->sk_security;
4099                 sksec->sid = isec->sid;
4100                 sksec->sclass = isec->sclass;
4101                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4102         }
4103
4104         return err;
4105 }
4106
4107 /* Range of port numbers used to automatically bind.
4108    Need to determine whether we should perform a name_bind
4109    permission check between the socket and the port number. */
4110
4111 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4112 {
4113         struct sock *sk = sock->sk;
4114         u16 family;
4115         int err;
4116
4117         err = sock_has_perm(current, sk, SOCKET__BIND);
4118         if (err)
4119                 goto out;
4120
4121         /*
4122          * If PF_INET or PF_INET6, check name_bind permission for the port.
4123          * Multiple address binding for SCTP is not supported yet: we just
4124          * check the first address now.
4125          */
4126         family = sk->sk_family;
4127         if (family == PF_INET || family == PF_INET6) {
4128                 char *addrp;
4129                 struct sk_security_struct *sksec = sk->sk_security;
4130                 struct common_audit_data ad;
4131                 struct lsm_network_audit net = {0,};
4132                 struct sockaddr_in *addr4 = NULL;
4133                 struct sockaddr_in6 *addr6 = NULL;
4134                 unsigned short snum;
4135                 u32 sid, node_perm;
4136
4137                 if (family == PF_INET) {
4138                         addr4 = (struct sockaddr_in *)address;
4139                         snum = ntohs(addr4->sin_port);
4140                         addrp = (char *)&addr4->sin_addr.s_addr;
4141                 } else {
4142                         addr6 = (struct sockaddr_in6 *)address;
4143                         snum = ntohs(addr6->sin6_port);
4144                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4145                 }
4146
4147                 if (snum) {
4148                         int low, high;
4149
4150                         inet_get_local_port_range(sock_net(sk), &low, &high);
4151
4152                         if (snum < max(PROT_SOCK, low) || snum > high) {
4153                                 err = sel_netport_sid(sk->sk_protocol,
4154                                                       snum, &sid);
4155                                 if (err)
4156                                         goto out;
4157                                 ad.type = LSM_AUDIT_DATA_NET;
4158                                 ad.u.net = &net;
4159                                 ad.u.net->sport = htons(snum);
4160                                 ad.u.net->family = family;
4161                                 err = avc_has_perm(sksec->sid, sid,
4162                                                    sksec->sclass,
4163                                                    SOCKET__NAME_BIND, &ad);
4164                                 if (err)
4165                                         goto out;
4166                         }
4167                 }
4168
4169                 switch (sksec->sclass) {
4170                 case SECCLASS_TCP_SOCKET:
4171                         node_perm = TCP_SOCKET__NODE_BIND;
4172                         break;
4173
4174                 case SECCLASS_UDP_SOCKET:
4175                         node_perm = UDP_SOCKET__NODE_BIND;
4176                         break;
4177
4178                 case SECCLASS_DCCP_SOCKET:
4179                         node_perm = DCCP_SOCKET__NODE_BIND;
4180                         break;
4181
4182                 default:
4183                         node_perm = RAWIP_SOCKET__NODE_BIND;
4184                         break;
4185                 }
4186
4187                 err = sel_netnode_sid(addrp, family, &sid);
4188                 if (err)
4189                         goto out;
4190
4191                 ad.type = LSM_AUDIT_DATA_NET;
4192                 ad.u.net = &net;
4193                 ad.u.net->sport = htons(snum);
4194                 ad.u.net->family = family;
4195
4196                 if (family == PF_INET)
4197                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4198                 else
4199                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4200
4201                 err = avc_has_perm(sksec->sid, sid,
4202                                    sksec->sclass, node_perm, &ad);
4203                 if (err)
4204                         goto out;
4205         }
4206 out:
4207         return err;
4208 }
4209
4210 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4211 {
4212         struct sock *sk = sock->sk;
4213         struct sk_security_struct *sksec = sk->sk_security;
4214         int err;
4215
4216         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4217         if (err)
4218                 return err;
4219
4220         /*
4221          * If a TCP or DCCP socket, check name_connect permission for the port.
4222          */
4223         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4224             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4225                 struct common_audit_data ad;
4226                 struct lsm_network_audit net = {0,};
4227                 struct sockaddr_in *addr4 = NULL;
4228                 struct sockaddr_in6 *addr6 = NULL;
4229                 unsigned short snum;
4230                 u32 sid, perm;
4231
4232                 if (sk->sk_family == PF_INET) {
4233                         addr4 = (struct sockaddr_in *)address;
4234                         if (addrlen < sizeof(struct sockaddr_in))
4235                                 return -EINVAL;
4236                         snum = ntohs(addr4->sin_port);
4237                 } else {
4238                         addr6 = (struct sockaddr_in6 *)address;
4239                         if (addrlen < SIN6_LEN_RFC2133)
4240                                 return -EINVAL;
4241                         snum = ntohs(addr6->sin6_port);
4242                 }
4243
4244                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4245                 if (err)
4246                         goto out;
4247
4248                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4249                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4250
4251                 ad.type = LSM_AUDIT_DATA_NET;
4252                 ad.u.net = &net;
4253                 ad.u.net->dport = htons(snum);
4254                 ad.u.net->family = sk->sk_family;
4255                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4256                 if (err)
4257                         goto out;
4258         }
4259
4260         err = selinux_netlbl_socket_connect(sk, address);
4261
4262 out:
4263         return err;
4264 }
4265
4266 static int selinux_socket_listen(struct socket *sock, int backlog)
4267 {
4268         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4269 }
4270
4271 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4272 {
4273         int err;
4274         struct inode_security_struct *isec;
4275         struct inode_security_struct *newisec;
4276
4277         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4278         if (err)
4279                 return err;
4280
4281         newisec = inode_security(SOCK_INODE(newsock));
4282
4283         isec = inode_security(SOCK_INODE(sock));
4284         newisec->sclass = isec->sclass;
4285         newisec->sid = isec->sid;
4286         newisec->initialized = LABEL_INITIALIZED;
4287
4288         return 0;
4289 }
4290
4291 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4292                                   int size)
4293 {
4294         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4295 }
4296
4297 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4298                                   int size, int flags)
4299 {
4300         return sock_has_perm(current, sock->sk, SOCKET__READ);
4301 }
4302
4303 static int selinux_socket_getsockname(struct socket *sock)
4304 {
4305         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4306 }
4307
4308 static int selinux_socket_getpeername(struct socket *sock)
4309 {
4310         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4311 }
4312
4313 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4314 {
4315         int err;
4316
4317         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4318         if (err)
4319                 return err;
4320
4321         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4322 }
4323
4324 static int selinux_socket_getsockopt(struct socket *sock, int level,
4325                                      int optname)
4326 {
4327         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4328 }
4329
4330 static int selinux_socket_shutdown(struct socket *sock, int how)
4331 {
4332         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4333 }
4334
4335 static int selinux_socket_unix_stream_connect(struct sock *sock,
4336                                               struct sock *other,
4337                                               struct sock *newsk)
4338 {
4339         struct sk_security_struct *sksec_sock = sock->sk_security;
4340         struct sk_security_struct *sksec_other = other->sk_security;
4341         struct sk_security_struct *sksec_new = newsk->sk_security;
4342         struct common_audit_data ad;
4343         struct lsm_network_audit net = {0,};
4344         int err;
4345
4346         ad.type = LSM_AUDIT_DATA_NET;
4347         ad.u.net = &net;
4348         ad.u.net->sk = other;
4349
4350         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4351                            sksec_other->sclass,
4352                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4353         if (err)
4354                 return err;
4355
4356         /* server child socket */
4357         sksec_new->peer_sid = sksec_sock->sid;
4358         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4359                                     &sksec_new->sid);
4360         if (err)
4361                 return err;
4362
4363         /* connecting socket */
4364         sksec_sock->peer_sid = sksec_new->sid;
4365
4366         return 0;
4367 }
4368
4369 static int selinux_socket_unix_may_send(struct socket *sock,
4370                                         struct socket *other)
4371 {
4372         struct sk_security_struct *ssec = sock->sk->sk_security;
4373         struct sk_security_struct *osec = other->sk->sk_security;
4374         struct common_audit_data ad;
4375         struct lsm_network_audit net = {0,};
4376
4377         ad.type = LSM_AUDIT_DATA_NET;
4378         ad.u.net = &net;
4379         ad.u.net->sk = other->sk;
4380
4381         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4382                             &ad);
4383 }
4384
4385 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4386                                     char *addrp, u16 family, u32 peer_sid,
4387                                     struct common_audit_data *ad)
4388 {
4389         int err;
4390         u32 if_sid;
4391         u32 node_sid;
4392
4393         err = sel_netif_sid(ns, ifindex, &if_sid);
4394         if (err)
4395                 return err;
4396         err = avc_has_perm(peer_sid, if_sid,
4397                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4398         if (err)
4399                 return err;
4400
4401         err = sel_netnode_sid(addrp, family, &node_sid);
4402         if (err)
4403                 return err;
4404         return avc_has_perm(peer_sid, node_sid,
4405                             SECCLASS_NODE, NODE__RECVFROM, ad);
4406 }
4407
4408 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4409                                        u16 family)
4410 {
4411         int err = 0;
4412         struct sk_security_struct *sksec = sk->sk_security;
4413         u32 sk_sid = sksec->sid;
4414         struct common_audit_data ad;
4415         struct lsm_network_audit net = {0,};
4416         char *addrp;
4417
4418         ad.type = LSM_AUDIT_DATA_NET;
4419         ad.u.net = &net;
4420         ad.u.net->netif = skb->skb_iif;
4421         ad.u.net->family = family;
4422         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4423         if (err)
4424                 return err;
4425
4426         if (selinux_secmark_enabled()) {
4427                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4428                                    PACKET__RECV, &ad);
4429                 if (err)
4430                         return err;
4431         }
4432
4433         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4434         if (err)
4435                 return err;
4436         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4437
4438         return err;
4439 }
4440
4441 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4442 {
4443         int err;
4444         struct sk_security_struct *sksec = sk->sk_security;
4445         u16 family = sk->sk_family;
4446         u32 sk_sid = sksec->sid;
4447         struct common_audit_data ad;
4448         struct lsm_network_audit net = {0,};
4449         char *addrp;
4450         u8 secmark_active;
4451         u8 peerlbl_active;
4452
4453         if (family != PF_INET && family != PF_INET6)
4454                 return 0;
4455
4456         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4457         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4458                 family = PF_INET;
4459
4460         /* If any sort of compatibility mode is enabled then handoff processing
4461          * to the selinux_sock_rcv_skb_compat() function to deal with the
4462          * special handling.  We do this in an attempt to keep this function
4463          * as fast and as clean as possible. */
4464         if (!selinux_policycap_netpeer)
4465                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4466
4467         secmark_active = selinux_secmark_enabled();
4468         peerlbl_active = selinux_peerlbl_enabled();
4469         if (!secmark_active && !peerlbl_active)
4470                 return 0;
4471
4472         ad.type = LSM_AUDIT_DATA_NET;
4473         ad.u.net = &net;
4474         ad.u.net->netif = skb->skb_iif;
4475         ad.u.net->family = family;
4476         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4477         if (err)
4478                 return err;
4479
4480         if (peerlbl_active) {
4481                 u32 peer_sid;
4482
4483                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4484                 if (err)
4485                         return err;
4486                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4487                                                addrp, family, peer_sid, &ad);
4488                 if (err) {
4489                         selinux_netlbl_err(skb, err, 0);
4490                         return err;
4491                 }
4492                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4493                                    PEER__RECV, &ad);
4494                 if (err) {
4495                         selinux_netlbl_err(skb, err, 0);
4496                         return err;
4497                 }
4498         }
4499
4500         if (secmark_active) {
4501                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4502                                    PACKET__RECV, &ad);
4503                 if (err)
4504                         return err;
4505         }
4506
4507         return err;
4508 }
4509
4510 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4511                                             int __user *optlen, unsigned len)
4512 {
4513         int err = 0;
4514         char *scontext;
4515         u32 scontext_len;
4516         struct sk_security_struct *sksec = sock->sk->sk_security;
4517         u32 peer_sid = SECSID_NULL;
4518
4519         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4520             sksec->sclass == SECCLASS_TCP_SOCKET)
4521                 peer_sid = sksec->peer_sid;
4522         if (peer_sid == SECSID_NULL)
4523                 return -ENOPROTOOPT;
4524
4525         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4526         if (err)
4527                 return err;
4528
4529         if (scontext_len > len) {
4530                 err = -ERANGE;
4531                 goto out_len;
4532         }
4533
4534         if (copy_to_user(optval, scontext, scontext_len))
4535                 err = -EFAULT;
4536
4537 out_len:
4538         if (put_user(scontext_len, optlen))
4539                 err = -EFAULT;
4540         kfree(scontext);
4541         return err;
4542 }
4543
4544 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4545 {
4546         u32 peer_secid = SECSID_NULL;
4547         u16 family;
4548
4549         if (skb && skb->protocol == htons(ETH_P_IP))
4550                 family = PF_INET;
4551         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4552                 family = PF_INET6;
4553         else if (sock)
4554                 family = sock->sk->sk_family;
4555         else
4556                 goto out;
4557
4558         if (sock && family == PF_UNIX)
4559                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4560         else if (skb)
4561                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4562
4563 out:
4564         *secid = peer_secid;
4565         if (peer_secid == SECSID_NULL)
4566                 return -EINVAL;
4567         return 0;
4568 }
4569
4570 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4571 {
4572         struct sk_security_struct *sksec;
4573
4574         sksec = kzalloc(sizeof(*sksec), priority);
4575         if (!sksec)
4576                 return -ENOMEM;
4577
4578         sksec->peer_sid = SECINITSID_UNLABELED;
4579         sksec->sid = SECINITSID_UNLABELED;
4580         sksec->sclass = SECCLASS_SOCKET;
4581         selinux_netlbl_sk_security_reset(sksec);
4582         sk->sk_security = sksec;
4583
4584         return 0;
4585 }
4586
4587 static void selinux_sk_free_security(struct sock *sk)
4588 {
4589         struct sk_security_struct *sksec = sk->sk_security;
4590
4591         sk->sk_security = NULL;
4592         selinux_netlbl_sk_security_free(sksec);
4593         kfree(sksec);
4594 }
4595
4596 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4597 {
4598         struct sk_security_struct *sksec = sk->sk_security;
4599         struct sk_security_struct *newsksec = newsk->sk_security;
4600
4601         newsksec->sid = sksec->sid;
4602         newsksec->peer_sid = sksec->peer_sid;
4603         newsksec->sclass = sksec->sclass;
4604
4605         selinux_netlbl_sk_security_reset(newsksec);
4606 }
4607
4608 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4609 {
4610         if (!sk)
4611                 *secid = SECINITSID_ANY_SOCKET;
4612         else {
4613                 struct sk_security_struct *sksec = sk->sk_security;
4614
4615                 *secid = sksec->sid;
4616         }
4617 }
4618
4619 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4620 {
4621         struct inode_security_struct *isec = inode_security(SOCK_INODE(parent));
4622         struct sk_security_struct *sksec = sk->sk_security;
4623
4624         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4625             sk->sk_family == PF_UNIX)
4626                 isec->sid = sksec->sid;
4627         sksec->sclass = isec->sclass;
4628 }
4629
4630 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4631                                      struct request_sock *req)
4632 {
4633         struct sk_security_struct *sksec = sk->sk_security;
4634         int err;
4635         u16 family = req->rsk_ops->family;
4636         u32 connsid;
4637         u32 peersid;
4638
4639         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4640         if (err)
4641                 return err;
4642         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4643         if (err)
4644                 return err;
4645         req->secid = connsid;
4646         req->peer_secid = peersid;
4647
4648         return selinux_netlbl_inet_conn_request(req, family);
4649 }
4650
4651 static void selinux_inet_csk_clone(struct sock *newsk,
4652                                    const struct request_sock *req)
4653 {
4654         struct sk_security_struct *newsksec = newsk->sk_security;
4655
4656         newsksec->sid = req->secid;
4657         newsksec->peer_sid = req->peer_secid;
4658         /* NOTE: Ideally, we should also get the isec->sid for the
4659            new socket in sync, but we don't have the isec available yet.
4660            So we will wait until sock_graft to do it, by which
4661            time it will have been created and available. */
4662
4663         /* We don't need to take any sort of lock here as we are the only
4664          * thread with access to newsksec */
4665         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4666 }
4667
4668 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4669 {
4670         u16 family = sk->sk_family;
4671         struct sk_security_struct *sksec = sk->sk_security;
4672
4673         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4674         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4675                 family = PF_INET;
4676
4677         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4678 }
4679
4680 static int selinux_secmark_relabel_packet(u32 sid)
4681 {
4682         const struct task_security_struct *__tsec;
4683         u32 tsid;
4684
4685         __tsec = current_security();
4686         tsid = __tsec->sid;
4687
4688         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4689 }
4690
4691 static void selinux_secmark_refcount_inc(void)
4692 {
4693         atomic_inc(&selinux_secmark_refcount);
4694 }
4695
4696 static void selinux_secmark_refcount_dec(void)
4697 {
4698         atomic_dec(&selinux_secmark_refcount);
4699 }
4700
4701 static void selinux_req_classify_flow(const struct request_sock *req,
4702                                       struct flowi *fl)
4703 {
4704         fl->flowi_secid = req->secid;
4705 }
4706
4707 static int selinux_tun_dev_alloc_security(void **security)
4708 {
4709         struct tun_security_struct *tunsec;
4710
4711         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4712         if (!tunsec)
4713                 return -ENOMEM;
4714         tunsec->sid = current_sid();
4715
4716         *security = tunsec;
4717         return 0;
4718 }
4719
4720 static void selinux_tun_dev_free_security(void *security)
4721 {
4722         kfree(security);
4723 }
4724
4725 static int selinux_tun_dev_create(void)
4726 {
4727         u32 sid = current_sid();
4728
4729         /* we aren't taking into account the "sockcreate" SID since the socket
4730          * that is being created here is not a socket in the traditional sense,
4731          * instead it is a private sock, accessible only to the kernel, and
4732          * representing a wide range of network traffic spanning multiple
4733          * connections unlike traditional sockets - check the TUN driver to
4734          * get a better understanding of why this socket is special */
4735
4736         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4737                             NULL);
4738 }
4739
4740 static int selinux_tun_dev_attach_queue(void *security)
4741 {
4742         struct tun_security_struct *tunsec = security;
4743
4744         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4745                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4746 }
4747
4748 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4749 {
4750         struct tun_security_struct *tunsec = security;
4751         struct sk_security_struct *sksec = sk->sk_security;
4752
4753         /* we don't currently perform any NetLabel based labeling here and it
4754          * isn't clear that we would want to do so anyway; while we could apply
4755          * labeling without the support of the TUN user the resulting labeled
4756          * traffic from the other end of the connection would almost certainly
4757          * cause confusion to the TUN user that had no idea network labeling
4758          * protocols were being used */
4759
4760         sksec->sid = tunsec->sid;
4761         sksec->sclass = SECCLASS_TUN_SOCKET;
4762
4763         return 0;
4764 }
4765
4766 static int selinux_tun_dev_open(void *security)
4767 {
4768         struct tun_security_struct *tunsec = security;
4769         u32 sid = current_sid();
4770         int err;
4771
4772         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4773                            TUN_SOCKET__RELABELFROM, NULL);
4774         if (err)
4775                 return err;
4776         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4777                            TUN_SOCKET__RELABELTO, NULL);
4778         if (err)
4779                 return err;
4780         tunsec->sid = sid;
4781
4782         return 0;
4783 }
4784
4785 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4786 {
4787         int err = 0;
4788         u32 perm;
4789         struct nlmsghdr *nlh;
4790         struct sk_security_struct *sksec = sk->sk_security;
4791
4792         if (skb->len < NLMSG_HDRLEN) {
4793                 err = -EINVAL;
4794                 goto out;
4795         }
4796         nlh = nlmsg_hdr(skb);
4797
4798         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4799         if (err) {
4800                 if (err == -EINVAL) {
4801                         printk(KERN_WARNING
4802                                "SELinux: unrecognized netlink message:"
4803                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4804                                sk->sk_protocol, nlh->nlmsg_type,
4805                                secclass_map[sksec->sclass - 1].name);
4806                         if (!selinux_enforcing || security_get_allow_unknown())
4807                                 err = 0;
4808                 }
4809
4810                 /* Ignore */
4811                 if (err == -ENOENT)
4812                         err = 0;
4813                 goto out;
4814         }
4815
4816         err = sock_has_perm(current, sk, perm);
4817 out:
4818         return err;
4819 }
4820
4821 #ifdef CONFIG_NETFILTER
4822
4823 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4824                                        const struct net_device *indev,
4825                                        u16 family)
4826 {
4827         int err;
4828         char *addrp;
4829         u32 peer_sid;
4830         struct common_audit_data ad;
4831         struct lsm_network_audit net = {0,};
4832         u8 secmark_active;
4833         u8 netlbl_active;
4834         u8 peerlbl_active;
4835
4836         if (!selinux_policycap_netpeer)
4837                 return NF_ACCEPT;
4838
4839         secmark_active = selinux_secmark_enabled();
4840         netlbl_active = netlbl_enabled();
4841         peerlbl_active = selinux_peerlbl_enabled();
4842         if (!secmark_active && !peerlbl_active)
4843                 return NF_ACCEPT;
4844
4845         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4846                 return NF_DROP;
4847
4848         ad.type = LSM_AUDIT_DATA_NET;
4849         ad.u.net = &net;
4850         ad.u.net->netif = indev->ifindex;
4851         ad.u.net->family = family;
4852         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4853                 return NF_DROP;
4854
4855         if (peerlbl_active) {
4856                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4857                                                addrp, family, peer_sid, &ad);
4858                 if (err) {
4859                         selinux_netlbl_err(skb, err, 1);
4860                         return NF_DROP;
4861                 }
4862         }
4863
4864         if (secmark_active)
4865                 if (avc_has_perm(peer_sid, skb->secmark,
4866                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4867                         return NF_DROP;
4868
4869         if (netlbl_active)
4870                 /* we do this in the FORWARD path and not the POST_ROUTING
4871                  * path because we want to make sure we apply the necessary
4872                  * labeling before IPsec is applied so we can leverage AH
4873                  * protection */
4874                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4875                         return NF_DROP;
4876
4877         return NF_ACCEPT;
4878 }
4879
4880 static unsigned int selinux_ipv4_forward(void *priv,
4881                                          struct sk_buff *skb,
4882                                          const struct nf_hook_state *state)
4883 {
4884         return selinux_ip_forward(skb, state->in, PF_INET);
4885 }
4886
4887 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4888 static unsigned int selinux_ipv6_forward(void *priv,
4889                                          struct sk_buff *skb,
4890                                          const struct nf_hook_state *state)
4891 {
4892         return selinux_ip_forward(skb, state->in, PF_INET6);
4893 }
4894 #endif  /* IPV6 */
4895
4896 static unsigned int selinux_ip_output(struct sk_buff *skb,
4897                                       u16 family)
4898 {
4899         struct sock *sk;
4900         u32 sid;
4901
4902         if (!netlbl_enabled())
4903                 return NF_ACCEPT;
4904
4905         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4906          * because we want to make sure we apply the necessary labeling
4907          * before IPsec is applied so we can leverage AH protection */
4908         sk = skb->sk;
4909         if (sk) {
4910                 struct sk_security_struct *sksec;
4911
4912                 if (sk_listener(sk))
4913                         /* if the socket is the listening state then this
4914                          * packet is a SYN-ACK packet which means it needs to
4915                          * be labeled based on the connection/request_sock and
4916                          * not the parent socket.  unfortunately, we can't
4917                          * lookup the request_sock yet as it isn't queued on
4918                          * the parent socket until after the SYN-ACK is sent.
4919                          * the "solution" is to simply pass the packet as-is
4920                          * as any IP option based labeling should be copied
4921                          * from the initial connection request (in the IP
4922                          * layer).  it is far from ideal, but until we get a
4923                          * security label in the packet itself this is the
4924                          * best we can do. */
4925                         return NF_ACCEPT;
4926
4927                 /* standard practice, label using the parent socket */
4928                 sksec = sk->sk_security;
4929                 sid = sksec->sid;
4930         } else
4931                 sid = SECINITSID_KERNEL;
4932         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4933                 return NF_DROP;
4934
4935         return NF_ACCEPT;
4936 }
4937
4938 static unsigned int selinux_ipv4_output(void *priv,
4939                                         struct sk_buff *skb,
4940                                         const struct nf_hook_state *state)
4941 {
4942         return selinux_ip_output(skb, PF_INET);
4943 }
4944
4945 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4946                                                 int ifindex,
4947                                                 u16 family)
4948 {
4949         struct sock *sk = skb_to_full_sk(skb);
4950         struct sk_security_struct *sksec;
4951         struct common_audit_data ad;
4952         struct lsm_network_audit net = {0,};
4953         char *addrp;
4954         u8 proto;
4955
4956         if (sk == NULL)
4957                 return NF_ACCEPT;
4958         sksec = sk->sk_security;
4959
4960         ad.type = LSM_AUDIT_DATA_NET;
4961         ad.u.net = &net;
4962         ad.u.net->netif = ifindex;
4963         ad.u.net->family = family;
4964         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4965                 return NF_DROP;
4966
4967         if (selinux_secmark_enabled())
4968                 if (avc_has_perm(sksec->sid, skb->secmark,
4969                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4970                         return NF_DROP_ERR(-ECONNREFUSED);
4971
4972         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4973                 return NF_DROP_ERR(-ECONNREFUSED);
4974
4975         return NF_ACCEPT;
4976 }
4977
4978 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4979                                          const struct net_device *outdev,
4980                                          u16 family)
4981 {
4982         u32 secmark_perm;
4983         u32 peer_sid;
4984         int ifindex = outdev->ifindex;
4985         struct sock *sk;
4986         struct common_audit_data ad;
4987         struct lsm_network_audit net = {0,};
4988         char *addrp;
4989         u8 secmark_active;
4990         u8 peerlbl_active;
4991
4992         /* If any sort of compatibility mode is enabled then handoff processing
4993          * to the selinux_ip_postroute_compat() function to deal with the
4994          * special handling.  We do this in an attempt to keep this function
4995          * as fast and as clean as possible. */
4996         if (!selinux_policycap_netpeer)
4997                 return selinux_ip_postroute_compat(skb, ifindex, family);
4998
4999         secmark_active = selinux_secmark_enabled();
5000         peerlbl_active = selinux_peerlbl_enabled();
5001         if (!secmark_active && !peerlbl_active)
5002                 return NF_ACCEPT;
5003
5004         sk = skb_to_full_sk(skb);
5005
5006 #ifdef CONFIG_XFRM
5007         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5008          * packet transformation so allow the packet to pass without any checks
5009          * since we'll have another chance to perform access control checks
5010          * when the packet is on it's final way out.
5011          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5012          *       is NULL, in this case go ahead and apply access control.
5013          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5014          *       TCP listening state we cannot wait until the XFRM processing
5015          *       is done as we will miss out on the SA label if we do;
5016          *       unfortunately, this means more work, but it is only once per
5017          *       connection. */
5018         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5019             !(sk && sk_listener(sk)))
5020                 return NF_ACCEPT;
5021 #endif
5022
5023         if (sk == NULL) {
5024                 /* Without an associated socket the packet is either coming
5025                  * from the kernel or it is being forwarded; check the packet
5026                  * to determine which and if the packet is being forwarded
5027                  * query the packet directly to determine the security label. */
5028                 if (skb->skb_iif) {
5029                         secmark_perm = PACKET__FORWARD_OUT;
5030                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5031                                 return NF_DROP;
5032                 } else {
5033                         secmark_perm = PACKET__SEND;
5034                         peer_sid = SECINITSID_KERNEL;
5035                 }
5036         } else if (sk_listener(sk)) {
5037                 /* Locally generated packet but the associated socket is in the
5038                  * listening state which means this is a SYN-ACK packet.  In
5039                  * this particular case the correct security label is assigned
5040                  * to the connection/request_sock but unfortunately we can't
5041                  * query the request_sock as it isn't queued on the parent
5042                  * socket until after the SYN-ACK packet is sent; the only
5043                  * viable choice is to regenerate the label like we do in
5044                  * selinux_inet_conn_request().  See also selinux_ip_output()
5045                  * for similar problems. */
5046                 u32 skb_sid;
5047                 struct sk_security_struct *sksec;
5048
5049                 sksec = sk->sk_security;
5050                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5051                         return NF_DROP;
5052                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5053                  * and the packet has been through at least one XFRM
5054                  * transformation then we must be dealing with the "final"
5055                  * form of labeled IPsec packet; since we've already applied
5056                  * all of our access controls on this packet we can safely
5057                  * pass the packet. */
5058                 if (skb_sid == SECSID_NULL) {
5059                         switch (family) {
5060                         case PF_INET:
5061                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5062                                         return NF_ACCEPT;
5063                                 break;
5064                         case PF_INET6:
5065                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5066                                         return NF_ACCEPT;
5067                                 break;
5068                         default:
5069                                 return NF_DROP_ERR(-ECONNREFUSED);
5070                         }
5071                 }
5072                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5073                         return NF_DROP;
5074                 secmark_perm = PACKET__SEND;
5075         } else {
5076                 /* Locally generated packet, fetch the security label from the
5077                  * associated socket. */
5078                 struct sk_security_struct *sksec = sk->sk_security;
5079                 peer_sid = sksec->sid;
5080                 secmark_perm = PACKET__SEND;
5081         }
5082
5083         ad.type = LSM_AUDIT_DATA_NET;
5084         ad.u.net = &net;
5085         ad.u.net->netif = ifindex;
5086         ad.u.net->family = family;
5087         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5088                 return NF_DROP;
5089
5090         if (secmark_active)
5091                 if (avc_has_perm(peer_sid, skb->secmark,
5092                                  SECCLASS_PACKET, secmark_perm, &ad))
5093                         return NF_DROP_ERR(-ECONNREFUSED);
5094
5095         if (peerlbl_active) {
5096                 u32 if_sid;
5097                 u32 node_sid;
5098
5099                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5100                         return NF_DROP;
5101                 if (avc_has_perm(peer_sid, if_sid,
5102                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5103                         return NF_DROP_ERR(-ECONNREFUSED);
5104
5105                 if (sel_netnode_sid(addrp, family, &node_sid))
5106                         return NF_DROP;
5107                 if (avc_has_perm(peer_sid, node_sid,
5108                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5109                         return NF_DROP_ERR(-ECONNREFUSED);
5110         }
5111
5112         return NF_ACCEPT;
5113 }
5114
5115 static unsigned int selinux_ipv4_postroute(void *priv,
5116                                            struct sk_buff *skb,
5117                                            const struct nf_hook_state *state)
5118 {
5119         return selinux_ip_postroute(skb, state->out, PF_INET);
5120 }
5121
5122 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5123 static unsigned int selinux_ipv6_postroute(void *priv,
5124                                            struct sk_buff *skb,
5125                                            const struct nf_hook_state *state)
5126 {
5127         return selinux_ip_postroute(skb, state->out, PF_INET6);
5128 }
5129 #endif  /* IPV6 */
5130
5131 #endif  /* CONFIG_NETFILTER */
5132
5133 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5134 {
5135         return selinux_nlmsg_perm(sk, skb);
5136 }
5137
5138 static int ipc_alloc_security(struct task_struct *task,
5139                               struct kern_ipc_perm *perm,
5140                               u16 sclass)
5141 {
5142         struct ipc_security_struct *isec;
5143         u32 sid;
5144
5145         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5146         if (!isec)
5147                 return -ENOMEM;
5148
5149         sid = task_sid(task);
5150         isec->sclass = sclass;
5151         isec->sid = sid;
5152         perm->security = isec;
5153
5154         return 0;
5155 }
5156
5157 static void ipc_free_security(struct kern_ipc_perm *perm)
5158 {
5159         struct ipc_security_struct *isec = perm->security;
5160         perm->security = NULL;
5161         kfree(isec);
5162 }
5163
5164 static int msg_msg_alloc_security(struct msg_msg *msg)
5165 {
5166         struct msg_security_struct *msec;
5167
5168         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5169         if (!msec)
5170                 return -ENOMEM;
5171
5172         msec->sid = SECINITSID_UNLABELED;
5173         msg->security = msec;
5174
5175         return 0;
5176 }
5177
5178 static void msg_msg_free_security(struct msg_msg *msg)
5179 {
5180         struct msg_security_struct *msec = msg->security;
5181
5182         msg->security = NULL;
5183         kfree(msec);
5184 }
5185
5186 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5187                         u32 perms)
5188 {
5189         struct ipc_security_struct *isec;
5190         struct common_audit_data ad;
5191         u32 sid = current_sid();
5192
5193         isec = ipc_perms->security;
5194
5195         ad.type = LSM_AUDIT_DATA_IPC;
5196         ad.u.ipc_id = ipc_perms->key;
5197
5198         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5199 }
5200
5201 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5202 {
5203         return msg_msg_alloc_security(msg);
5204 }
5205
5206 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5207 {
5208         msg_msg_free_security(msg);
5209 }
5210
5211 /* message queue security operations */
5212 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5213 {
5214         struct ipc_security_struct *isec;
5215         struct common_audit_data ad;
5216         u32 sid = current_sid();
5217         int rc;
5218
5219         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5220         if (rc)
5221                 return rc;
5222
5223         isec = msq->q_perm.security;
5224
5225         ad.type = LSM_AUDIT_DATA_IPC;
5226         ad.u.ipc_id = msq->q_perm.key;
5227
5228         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5229                           MSGQ__CREATE, &ad);
5230         if (rc) {
5231                 ipc_free_security(&msq->q_perm);
5232                 return rc;
5233         }
5234         return 0;
5235 }
5236
5237 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5238 {
5239         ipc_free_security(&msq->q_perm);
5240 }
5241
5242 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5243 {
5244         struct ipc_security_struct *isec;
5245         struct common_audit_data ad;
5246         u32 sid = current_sid();
5247
5248         isec = msq->q_perm.security;
5249
5250         ad.type = LSM_AUDIT_DATA_IPC;
5251         ad.u.ipc_id = msq->q_perm.key;
5252
5253         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5254                             MSGQ__ASSOCIATE, &ad);
5255 }
5256
5257 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5258 {
5259         int err;
5260         int perms;
5261
5262         switch (cmd) {
5263         case IPC_INFO:
5264         case MSG_INFO:
5265                 /* No specific object, just general system-wide information. */
5266                 return task_has_system(current, SYSTEM__IPC_INFO);
5267         case IPC_STAT:
5268         case MSG_STAT:
5269                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5270                 break;
5271         case IPC_SET:
5272                 perms = MSGQ__SETATTR;
5273                 break;
5274         case IPC_RMID:
5275                 perms = MSGQ__DESTROY;
5276                 break;
5277         default:
5278                 return 0;
5279         }
5280
5281         err = ipc_has_perm(&msq->q_perm, perms);
5282         return err;
5283 }
5284
5285 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5286 {
5287         struct ipc_security_struct *isec;
5288         struct msg_security_struct *msec;
5289         struct common_audit_data ad;
5290         u32 sid = current_sid();
5291         int rc;
5292
5293         isec = msq->q_perm.security;
5294         msec = msg->security;
5295
5296         /*
5297          * First time through, need to assign label to the message
5298          */
5299         if (msec->sid == SECINITSID_UNLABELED) {
5300                 /*
5301                  * Compute new sid based on current process and
5302                  * message queue this message will be stored in
5303                  */
5304                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5305                                              NULL, &msec->sid);
5306                 if (rc)
5307                         return rc;
5308         }
5309
5310         ad.type = LSM_AUDIT_DATA_IPC;
5311         ad.u.ipc_id = msq->q_perm.key;
5312
5313         /* Can this process write to the queue? */
5314         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5315                           MSGQ__WRITE, &ad);
5316         if (!rc)
5317                 /* Can this process send the message */
5318                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5319                                   MSG__SEND, &ad);
5320         if (!rc)
5321                 /* Can the message be put in the queue? */
5322                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5323                                   MSGQ__ENQUEUE, &ad);
5324
5325         return rc;
5326 }
5327
5328 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5329                                     struct task_struct *target,
5330                                     long type, int mode)
5331 {
5332         struct ipc_security_struct *isec;
5333         struct msg_security_struct *msec;
5334         struct common_audit_data ad;
5335         u32 sid = task_sid(target);
5336         int rc;
5337
5338         isec = msq->q_perm.security;
5339         msec = msg->security;
5340
5341         ad.type = LSM_AUDIT_DATA_IPC;
5342         ad.u.ipc_id = msq->q_perm.key;
5343
5344         rc = avc_has_perm(sid, isec->sid,
5345                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5346         if (!rc)
5347                 rc = avc_has_perm(sid, msec->sid,
5348                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5349         return rc;
5350 }
5351
5352 /* Shared Memory security operations */
5353 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5354 {
5355         struct ipc_security_struct *isec;
5356         struct common_audit_data ad;
5357         u32 sid = current_sid();
5358         int rc;
5359
5360         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5361         if (rc)
5362                 return rc;
5363
5364         isec = shp->shm_perm.security;
5365
5366         ad.type = LSM_AUDIT_DATA_IPC;
5367         ad.u.ipc_id = shp->shm_perm.key;
5368
5369         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5370                           SHM__CREATE, &ad);
5371         if (rc) {
5372                 ipc_free_security(&shp->shm_perm);
5373                 return rc;
5374         }
5375         return 0;
5376 }
5377
5378 static void selinux_shm_free_security(struct shmid_kernel *shp)
5379 {
5380         ipc_free_security(&shp->shm_perm);
5381 }
5382
5383 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5384 {
5385         struct ipc_security_struct *isec;
5386         struct common_audit_data ad;
5387         u32 sid = current_sid();
5388
5389         isec = shp->shm_perm.security;
5390
5391         ad.type = LSM_AUDIT_DATA_IPC;
5392         ad.u.ipc_id = shp->shm_perm.key;
5393
5394         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5395                             SHM__ASSOCIATE, &ad);
5396 }
5397
5398 /* Note, at this point, shp is locked down */
5399 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5400 {
5401         int perms;
5402         int err;
5403
5404         switch (cmd) {
5405         case IPC_INFO:
5406         case SHM_INFO:
5407                 /* No specific object, just general system-wide information. */
5408                 return task_has_system(current, SYSTEM__IPC_INFO);
5409         case IPC_STAT:
5410         case SHM_STAT:
5411                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5412                 break;
5413         case IPC_SET:
5414                 perms = SHM__SETATTR;
5415                 break;
5416         case SHM_LOCK:
5417         case SHM_UNLOCK:
5418                 perms = SHM__LOCK;
5419                 break;
5420         case IPC_RMID:
5421                 perms = SHM__DESTROY;
5422                 break;
5423         default:
5424                 return 0;
5425         }
5426
5427         err = ipc_has_perm(&shp->shm_perm, perms);
5428         return err;
5429 }
5430
5431 static int selinux_shm_shmat(struct shmid_kernel *shp,
5432                              char __user *shmaddr, int shmflg)
5433 {
5434         u32 perms;
5435
5436         if (shmflg & SHM_RDONLY)
5437                 perms = SHM__READ;
5438         else
5439                 perms = SHM__READ | SHM__WRITE;
5440
5441         return ipc_has_perm(&shp->shm_perm, perms);
5442 }
5443
5444 /* Semaphore security operations */
5445 static int selinux_sem_alloc_security(struct sem_array *sma)
5446 {
5447         struct ipc_security_struct *isec;
5448         struct common_audit_data ad;
5449         u32 sid = current_sid();
5450         int rc;
5451
5452         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5453         if (rc)
5454                 return rc;
5455
5456         isec = sma->sem_perm.security;
5457
5458         ad.type = LSM_AUDIT_DATA_IPC;
5459         ad.u.ipc_id = sma->sem_perm.key;
5460
5461         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5462                           SEM__CREATE, &ad);
5463         if (rc) {
5464                 ipc_free_security(&sma->sem_perm);
5465                 return rc;
5466         }
5467         return 0;
5468 }
5469
5470 static void selinux_sem_free_security(struct sem_array *sma)
5471 {
5472         ipc_free_security(&sma->sem_perm);
5473 }
5474
5475 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5476 {
5477         struct ipc_security_struct *isec;
5478         struct common_audit_data ad;
5479         u32 sid = current_sid();
5480
5481         isec = sma->sem_perm.security;
5482
5483         ad.type = LSM_AUDIT_DATA_IPC;
5484         ad.u.ipc_id = sma->sem_perm.key;
5485
5486         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5487                             SEM__ASSOCIATE, &ad);
5488 }
5489
5490 /* Note, at this point, sma is locked down */
5491 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5492 {
5493         int err;
5494         u32 perms;
5495
5496         switch (cmd) {
5497         case IPC_INFO:
5498         case SEM_INFO:
5499                 /* No specific object, just general system-wide information. */
5500                 return task_has_system(current, SYSTEM__IPC_INFO);
5501         case GETPID:
5502         case GETNCNT:
5503         case GETZCNT:
5504                 perms = SEM__GETATTR;
5505                 break;
5506         case GETVAL:
5507         case GETALL:
5508                 perms = SEM__READ;
5509                 break;
5510         case SETVAL:
5511         case SETALL:
5512                 perms = SEM__WRITE;
5513                 break;
5514         case IPC_RMID:
5515                 perms = SEM__DESTROY;
5516                 break;
5517         case IPC_SET:
5518                 perms = SEM__SETATTR;
5519                 break;
5520         case IPC_STAT:
5521         case SEM_STAT:
5522                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5523                 break;
5524         default:
5525                 return 0;
5526         }
5527
5528         err = ipc_has_perm(&sma->sem_perm, perms);
5529         return err;
5530 }
5531
5532 static int selinux_sem_semop(struct sem_array *sma,
5533                              struct sembuf *sops, unsigned nsops, int alter)
5534 {
5535         u32 perms;
5536
5537         if (alter)
5538                 perms = SEM__READ | SEM__WRITE;
5539         else
5540                 perms = SEM__READ;
5541
5542         return ipc_has_perm(&sma->sem_perm, perms);
5543 }
5544
5545 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5546 {
5547         u32 av = 0;
5548
5549         av = 0;
5550         if (flag & S_IRUGO)
5551                 av |= IPC__UNIX_READ;
5552         if (flag & S_IWUGO)
5553                 av |= IPC__UNIX_WRITE;
5554
5555         if (av == 0)
5556                 return 0;
5557
5558         return ipc_has_perm(ipcp, av);
5559 }
5560
5561 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5562 {
5563         struct ipc_security_struct *isec = ipcp->security;
5564         *secid = isec->sid;
5565 }
5566
5567 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5568 {
5569         if (inode)
5570                 inode_doinit_with_dentry(inode, dentry);
5571 }
5572
5573 static int selinux_getprocattr(struct task_struct *p,
5574                                char *name, char **value)
5575 {
5576         const struct task_security_struct *__tsec;
5577         u32 sid;
5578         int error;
5579         unsigned len;
5580
5581         if (current != p) {
5582                 error = current_has_perm(p, PROCESS__GETATTR);
5583                 if (error)
5584                         return error;
5585         }
5586
5587         rcu_read_lock();
5588         __tsec = __task_cred(p)->security;
5589
5590         if (!strcmp(name, "current"))
5591                 sid = __tsec->sid;
5592         else if (!strcmp(name, "prev"))
5593                 sid = __tsec->osid;
5594         else if (!strcmp(name, "exec"))
5595                 sid = __tsec->exec_sid;
5596         else if (!strcmp(name, "fscreate"))
5597                 sid = __tsec->create_sid;
5598         else if (!strcmp(name, "keycreate"))
5599                 sid = __tsec->keycreate_sid;
5600         else if (!strcmp(name, "sockcreate"))
5601                 sid = __tsec->sockcreate_sid;
5602         else
5603                 goto invalid;
5604         rcu_read_unlock();
5605
5606         if (!sid)
5607                 return 0;
5608
5609         error = security_sid_to_context(sid, value, &len);
5610         if (error)
5611                 return error;
5612         return len;
5613
5614 invalid:
5615         rcu_read_unlock();
5616         return -EINVAL;
5617 }
5618
5619 static int selinux_setprocattr(struct task_struct *p,
5620                                char *name, void *value, size_t size)
5621 {
5622         struct task_security_struct *tsec;
5623         struct task_struct *tracer;
5624         struct cred *new;
5625         u32 sid = 0, ptsid;
5626         int error;
5627         char *str = value;
5628
5629         if (current != p) {
5630                 /* SELinux only allows a process to change its own
5631                    security attributes. */
5632                 return -EACCES;
5633         }
5634
5635         /*
5636          * Basic control over ability to set these attributes at all.
5637          * current == p, but we'll pass them separately in case the
5638          * above restriction is ever removed.
5639          */
5640         if (!strcmp(name, "exec"))
5641                 error = current_has_perm(p, PROCESS__SETEXEC);
5642         else if (!strcmp(name, "fscreate"))
5643                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5644         else if (!strcmp(name, "keycreate"))
5645                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5646         else if (!strcmp(name, "sockcreate"))
5647                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5648         else if (!strcmp(name, "current"))
5649                 error = current_has_perm(p, PROCESS__SETCURRENT);
5650         else
5651                 error = -EINVAL;
5652         if (error)
5653                 return error;
5654
5655         /* Obtain a SID for the context, if one was specified. */
5656         if (size && str[1] && str[1] != '\n') {
5657                 if (str[size-1] == '\n') {
5658                         str[size-1] = 0;
5659                         size--;
5660                 }
5661                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5662                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5663                         if (!capable(CAP_MAC_ADMIN)) {
5664                                 struct audit_buffer *ab;
5665                                 size_t audit_size;
5666
5667                                 /* We strip a nul only if it is at the end, otherwise the
5668                                  * context contains a nul and we should audit that */
5669                                 if (str[size - 1] == '\0')
5670                                         audit_size = size - 1;
5671                                 else
5672                                         audit_size = size;
5673                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5674                                 audit_log_format(ab, "op=fscreate invalid_context=");
5675                                 audit_log_n_untrustedstring(ab, value, audit_size);
5676                                 audit_log_end(ab);
5677
5678                                 return error;
5679                         }
5680                         error = security_context_to_sid_force(value, size,
5681                                                               &sid);
5682                 }
5683                 if (error)
5684                         return error;
5685         }
5686
5687         new = prepare_creds();
5688         if (!new)
5689                 return -ENOMEM;
5690
5691         /* Permission checking based on the specified context is
5692            performed during the actual operation (execve,
5693            open/mkdir/...), when we know the full context of the
5694            operation.  See selinux_bprm_set_creds for the execve
5695            checks and may_create for the file creation checks. The
5696            operation will then fail if the context is not permitted. */
5697         tsec = new->security;
5698         if (!strcmp(name, "exec")) {
5699                 tsec->exec_sid = sid;
5700         } else if (!strcmp(name, "fscreate")) {
5701                 tsec->create_sid = sid;
5702         } else if (!strcmp(name, "keycreate")) {
5703                 error = may_create_key(sid, p);
5704                 if (error)
5705                         goto abort_change;
5706                 tsec->keycreate_sid = sid;
5707         } else if (!strcmp(name, "sockcreate")) {
5708                 tsec->sockcreate_sid = sid;
5709         } else if (!strcmp(name, "current")) {
5710                 error = -EINVAL;
5711                 if (sid == 0)
5712                         goto abort_change;
5713
5714                 /* Only allow single threaded processes to change context */
5715                 error = -EPERM;
5716                 if (!current_is_single_threaded()) {
5717                         error = security_bounded_transition(tsec->sid, sid);
5718                         if (error)
5719                                 goto abort_change;
5720                 }
5721
5722                 /* Check permissions for the transition. */
5723                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5724                                      PROCESS__DYNTRANSITION, NULL);
5725                 if (error)
5726                         goto abort_change;
5727
5728                 /* Check for ptracing, and update the task SID if ok.
5729                    Otherwise, leave SID unchanged and fail. */
5730                 ptsid = 0;
5731                 rcu_read_lock();
5732                 tracer = ptrace_parent(p);
5733                 if (tracer)
5734                         ptsid = task_sid(tracer);
5735                 rcu_read_unlock();
5736
5737                 if (tracer) {
5738                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5739                                              PROCESS__PTRACE, NULL);
5740                         if (error)
5741                                 goto abort_change;
5742                 }
5743
5744                 tsec->sid = sid;
5745         } else {
5746                 error = -EINVAL;
5747                 goto abort_change;
5748         }
5749
5750         commit_creds(new);
5751         return size;
5752
5753 abort_change:
5754         abort_creds(new);
5755         return error;
5756 }
5757
5758 static int selinux_ismaclabel(const char *name)
5759 {
5760         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5761 }
5762
5763 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5764 {
5765         return security_sid_to_context(secid, secdata, seclen);
5766 }
5767
5768 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5769 {
5770         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5771 }
5772
5773 static void selinux_release_secctx(char *secdata, u32 seclen)
5774 {
5775         kfree(secdata);
5776 }
5777
5778 static void selinux_inode_invalidate_secctx(struct inode *inode)
5779 {
5780         struct inode_security_struct *isec = inode->i_security;
5781
5782         mutex_lock(&isec->lock);
5783         isec->initialized = LABEL_INVALID;
5784         mutex_unlock(&isec->lock);
5785 }
5786
5787 /*
5788  *      called with inode->i_mutex locked
5789  */
5790 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5791 {
5792         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5793 }
5794
5795 /*
5796  *      called with inode->i_mutex locked
5797  */
5798 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5799 {
5800         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5801 }
5802
5803 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5804 {
5805         int len = 0;
5806         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5807                                                 ctx, true);
5808         if (len < 0)
5809                 return len;
5810         *ctxlen = len;
5811         return 0;
5812 }
5813 #ifdef CONFIG_KEYS
5814
5815 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5816                              unsigned long flags)
5817 {
5818         const struct task_security_struct *tsec;
5819         struct key_security_struct *ksec;
5820
5821         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5822         if (!ksec)
5823                 return -ENOMEM;
5824
5825         tsec = cred->security;
5826         if (tsec->keycreate_sid)
5827                 ksec->sid = tsec->keycreate_sid;
5828         else
5829                 ksec->sid = tsec->sid;
5830
5831         k->security = ksec;
5832         return 0;
5833 }
5834
5835 static void selinux_key_free(struct key *k)
5836 {
5837         struct key_security_struct *ksec = k->security;
5838
5839         k->security = NULL;
5840         kfree(ksec);
5841 }
5842
5843 static int selinux_key_permission(key_ref_t key_ref,
5844                                   const struct cred *cred,
5845                                   unsigned perm)
5846 {
5847         struct key *key;
5848         struct key_security_struct *ksec;
5849         u32 sid;
5850
5851         /* if no specific permissions are requested, we skip the
5852            permission check. No serious, additional covert channels
5853            appear to be created. */
5854         if (perm == 0)
5855                 return 0;
5856
5857         sid = cred_sid(cred);
5858
5859         key = key_ref_to_ptr(key_ref);
5860         ksec = key->security;
5861
5862         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5863 }
5864
5865 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5866 {
5867         struct key_security_struct *ksec = key->security;
5868         char *context = NULL;
5869         unsigned len;
5870         int rc;
5871
5872         rc = security_sid_to_context(ksec->sid, &context, &len);
5873         if (!rc)
5874                 rc = len;
5875         *_buffer = context;
5876         return rc;
5877 }
5878
5879 #endif
5880
5881 static struct security_hook_list selinux_hooks[] = {
5882         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5883         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5884         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5885         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5886
5887         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5888         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5889         LSM_HOOK_INIT(capget, selinux_capget),
5890         LSM_HOOK_INIT(capset, selinux_capset),
5891         LSM_HOOK_INIT(capable, selinux_capable),
5892         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5893         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5894         LSM_HOOK_INIT(syslog, selinux_syslog),
5895         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5896
5897         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5898
5899         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5900         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5901         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5902         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5903
5904         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5905         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5906         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5907         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5908         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5909         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5910         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5911         LSM_HOOK_INIT(sb_mount, selinux_mount),
5912         LSM_HOOK_INIT(sb_umount, selinux_umount),
5913         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5914         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5915         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5916
5917         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5918
5919         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5920         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5921         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5922         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5923         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5924         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5925         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5926         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5927         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5928         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5929         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5930         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5931         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5932         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5933         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5934         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5935         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5936         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5937         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5938         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5939         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5940         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5941         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5942         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5943         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5944
5945         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5946         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5947         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5948         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5949         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5950         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5951         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5952         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5953         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5954         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5955         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5956         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5957
5958         LSM_HOOK_INIT(file_open, selinux_file_open),
5959
5960         LSM_HOOK_INIT(task_create, selinux_task_create),
5961         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5962         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5963         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5964         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5965         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5966         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5967         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5968         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5969         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5970         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5971         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5972         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5973         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5974         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5975         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5976         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5977         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5978         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5979         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5980         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5981         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5982
5983         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5984         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5985
5986         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5987         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5988
5989         LSM_HOOK_INIT(msg_queue_alloc_security,
5990                         selinux_msg_queue_alloc_security),
5991         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5992         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5993         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5994         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5995         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5996
5997         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5998         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5999         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6000         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6001         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6002
6003         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6004         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6005         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6006         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6007         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6008
6009         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6010
6011         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6012         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6013
6014         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6015         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6016         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6017         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6018         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6019         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6020         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6021         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6022
6023         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6024         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6025
6026         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6027         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6028         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6029         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6030         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6031         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6032         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6033         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6034         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6035         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6036         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6037         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6038         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6039         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6040         LSM_HOOK_INIT(socket_getpeersec_stream,
6041                         selinux_socket_getpeersec_stream),
6042         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6043         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6044         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6045         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6046         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6047         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6048         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6049         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6050         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6051         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6052         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6053         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6054         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6055         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6056         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6057         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6058         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6059         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6060         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6061
6062 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6063         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6064         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6065         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6066         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6067         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6068         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6069                         selinux_xfrm_state_alloc_acquire),
6070         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6071         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6072         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6073         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6074                         selinux_xfrm_state_pol_flow_match),
6075         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6076 #endif
6077
6078 #ifdef CONFIG_KEYS
6079         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6080         LSM_HOOK_INIT(key_free, selinux_key_free),
6081         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6082         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6083 #endif
6084
6085 #ifdef CONFIG_AUDIT
6086         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6087         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6088         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6089         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6090 #endif
6091 };
6092
6093 static __init int selinux_init(void)
6094 {
6095         if (!security_module_enable("selinux")) {
6096                 selinux_enabled = 0;
6097                 return 0;
6098         }
6099
6100         if (!selinux_enabled) {
6101                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6102                 return 0;
6103         }
6104
6105         printk(KERN_INFO "SELinux:  Initializing.\n");
6106
6107         /* Set the security state for the initial task. */
6108         cred_init_security();
6109
6110         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6111
6112         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6113                                             sizeof(struct inode_security_struct),
6114                                             0, SLAB_PANIC, NULL);
6115         file_security_cache = kmem_cache_create("selinux_file_security",
6116                                             sizeof(struct file_security_struct),
6117                                             0, SLAB_PANIC, NULL);
6118         avc_init();
6119
6120         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6121
6122         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6123                 panic("SELinux: Unable to register AVC netcache callback\n");
6124
6125         if (selinux_enforcing)
6126                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6127         else
6128                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6129
6130         return 0;
6131 }
6132
6133 static void delayed_superblock_init(struct super_block *sb, void *unused)
6134 {
6135         superblock_doinit(sb, NULL);
6136 }
6137
6138 void selinux_complete_init(void)
6139 {
6140         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6141
6142         /* Set up any superblocks initialized prior to the policy load. */
6143         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6144         iterate_supers(delayed_superblock_init, NULL);
6145 }
6146
6147 /* SELinux requires early initialization in order to label
6148    all processes and objects when they are created. */
6149 security_initcall(selinux_init);
6150
6151 #if defined(CONFIG_NETFILTER)
6152
6153 static struct nf_hook_ops selinux_nf_ops[] = {
6154         {
6155                 .hook =         selinux_ipv4_postroute,
6156                 .pf =           NFPROTO_IPV4,
6157                 .hooknum =      NF_INET_POST_ROUTING,
6158                 .priority =     NF_IP_PRI_SELINUX_LAST,
6159         },
6160         {
6161                 .hook =         selinux_ipv4_forward,
6162                 .pf =           NFPROTO_IPV4,
6163                 .hooknum =      NF_INET_FORWARD,
6164                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6165         },
6166         {
6167                 .hook =         selinux_ipv4_output,
6168                 .pf =           NFPROTO_IPV4,
6169                 .hooknum =      NF_INET_LOCAL_OUT,
6170                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6171         },
6172 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6173         {
6174                 .hook =         selinux_ipv6_postroute,
6175                 .pf =           NFPROTO_IPV6,
6176                 .hooknum =      NF_INET_POST_ROUTING,
6177                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6178         },
6179         {
6180                 .hook =         selinux_ipv6_forward,
6181                 .pf =           NFPROTO_IPV6,
6182                 .hooknum =      NF_INET_FORWARD,
6183                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6184         },
6185 #endif  /* IPV6 */
6186 };
6187
6188 static int __init selinux_nf_ip_init(void)
6189 {
6190         int err;
6191
6192         if (!selinux_enabled)
6193                 return 0;
6194
6195         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6196
6197         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6198         if (err)
6199                 panic("SELinux: nf_register_hooks: error %d\n", err);
6200
6201         return 0;
6202 }
6203
6204 __initcall(selinux_nf_ip_init);
6205
6206 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6207 static void selinux_nf_ip_exit(void)
6208 {
6209         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6210
6211         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6212 }
6213 #endif
6214
6215 #else /* CONFIG_NETFILTER */
6216
6217 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6218 #define selinux_nf_ip_exit()
6219 #endif
6220
6221 #endif /* CONFIG_NETFILTER */
6222
6223 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6224 static int selinux_disabled;
6225
6226 int selinux_disable(void)
6227 {
6228         if (ss_initialized) {
6229                 /* Not permitted after initial policy load. */
6230                 return -EINVAL;
6231         }
6232
6233         if (selinux_disabled) {
6234                 /* Only do this once. */
6235                 return -EINVAL;
6236         }
6237
6238         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6239
6240         selinux_disabled = 1;
6241         selinux_enabled = 0;
6242
6243         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6244
6245         /* Try to destroy the avc node cache */
6246         avc_disable();
6247
6248         /* Unregister netfilter hooks. */
6249         selinux_nf_ip_exit();
6250
6251         /* Unregister selinuxfs. */
6252         exit_sel_fs();
6253
6254         return 0;
6255 }
6256 #endif