security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 246
 247 /*
 248  * Try reloading inode security labels that have been marked as invalid.  The
 249  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 250  * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
 251  * invalid.  The @opt_dentry parameter should be set to a dentry of the inode;
 252  * when no dentry is available, set it to NULL instead.
 253  */
 254 static int __inode_security_revalidate(struct inode *inode,
 255                                        struct dentry *opt_dentry,
 256                                        bool may_sleep)
 257 {
 258         struct inode_security_struct *isec = inode->i_security;
 259
 260         might_sleep_if(may_sleep);
 261
 262         if (isec->initialized != LABEL_INITIALIZED) {
 263                 if (!may_sleep)
 264                         return -ECHILD;
 265
 266                 /*
 267                  * Try reloading the inode security label.  This will fail if
 268                  * @opt_dentry is NULL and no dentry for this inode can be
 269                  * found; in that case, continue using the old label.
 270                  */
 271                 inode_doinit_with_dentry(inode, opt_dentry);
 272         }
 273         return 0;
 274 }
 275
 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 277 {
 278         return inode->i_security;
 279 }
 280
 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 282 {
 283         int error;
 284
 285         error = __inode_security_revalidate(inode, NULL, !rcu);
 286         if (error)
 287                 return ERR_PTR(error);
 288         return inode->i_security;
 289 }
 290
 291 /*
 292  * Get the security label of an inode.
 293  */
 294 static struct inode_security_struct *inode_security(struct inode *inode)
 295 {
 296         __inode_security_revalidate(inode, NULL, true);
 297         return inode->i_security;
 298 }
 299
 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 301 {
 302         struct inode *inode = d_backing_inode(dentry);
 303
 304         return inode->i_security;
 305 }
 306
 307 /*
 308  * Get the security label of a dentry's backing inode.
 309  */
 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 311 {
 312         struct inode *inode = d_backing_inode(dentry);
 313
 314         __inode_security_revalidate(inode, dentry, true);
 315         return inode->i_security;
 316 }
 317
 318 static void inode_free_rcu(struct rcu_head *head)
 319 {
 320         struct inode_security_struct *isec;
 321
 322         isec = container_of(head, struct inode_security_struct, rcu);
 323         kmem_cache_free(sel_inode_cache, isec);
 324 }
 325
 326 static void inode_free_security(struct inode *inode)
 327 {
 328         struct inode_security_struct *isec = inode->i_security;
 329         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 330
 331         /*
 332          * As not all inode security structures are in a list, we check for
 333          * empty list outside of the lock to make sure that we won't waste
 334          * time taking a lock doing nothing.
 335          *
 336          * The list_del_init() function can be safely called more than once.
 337          * It should not be possible for this function to be called with
 338          * concurrent list_add(), but for better safety against future changes
 339          * in the code, we use list_empty_careful() here.
 340          */
 341         if (!list_empty_careful(&isec->list)) {
 342                 spin_lock(&sbsec->isec_lock);
 343                 list_del_init(&isec->list);
 344                 spin_unlock(&sbsec->isec_lock);
 345         }
 346
 347         /*
 348          * The inode may still be referenced in a path walk and
 349          * a call to selinux_inode_permission() can be made
 350          * after inode_free_security() is called. Ideally, the VFS
 351          * wouldn't do this, but fixing that is a much harder
 352          * job. For now, simply free the i_security via RCU, and
 353          * leave the current inode->i_security pointer intact.
 354          * The inode will be freed after the RCU grace period too.
 355          */
 356         call_rcu(&isec->rcu, inode_free_rcu);
 357 }
 358
 359 static int file_alloc_security(struct file *file)
 360 {
 361         struct file_security_struct *fsec;
 362         u32 sid = current_sid();
 363
 364         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 365         if (!fsec)
 366                 return -ENOMEM;
 367
 368         fsec->sid = sid;
 369         fsec->fown_sid = sid;
 370         file->f_security = fsec;
 371
 372         return 0;
 373 }
 374
 375 static void file_free_security(struct file *file)
 376 {
 377         struct file_security_struct *fsec = file->f_security;
 378         file->f_security = NULL;
 379         kmem_cache_free(file_security_cache, fsec);
 380 }
 381
 382 static int superblock_alloc_security(struct super_block *sb)
 383 {
 384         struct superblock_security_struct *sbsec;
 385
 386         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 387         if (!sbsec)
 388                 return -ENOMEM;
 389
 390         mutex_init(&sbsec->lock);
 391         INIT_LIST_HEAD(&sbsec->isec_head);
 392         spin_lock_init(&sbsec->isec_lock);
 393         sbsec->sb = sb;
 394         sbsec->sid = SECINITSID_UNLABELED;
 395         sbsec->def_sid = SECINITSID_FILE;
 396         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 397         sb->s_security = sbsec;
 398
 399         return 0;
 400 }
 401
 402 static void superblock_free_security(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         sb->s_security = NULL;
 406         kfree(sbsec);
 407 }
 408
 409 /* The file system's label must be initialized prior to use. */
 410
 411 static const char *labeling_behaviors[7] = {
 412         "uses xattr",
 413         "uses transition SIDs",
 414         "uses task SIDs",
 415         "uses genfs_contexts",
 416         "not configured for labeling",
 417         "uses mountpoint labeling",
 418         "uses native labeling",
 419 };
 420
 421 static inline int inode_doinit(struct inode *inode)
 422 {
 423         return inode_doinit_with_dentry(inode, NULL);
 424 }
 425
 426 enum {
 427         Opt_error = -1,
 428         Opt_context = 1,
 429         Opt_fscontext = 2,
 430         Opt_defcontext = 3,
 431         Opt_rootcontext = 4,
 432         Opt_labelsupport = 5,
 433         Opt_nextmntopt = 6,
 434 };
 435
 436 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 437
 438 static const match_table_t tokens = {
 439         {Opt_context, CONTEXT_STR "%s"},
 440         {Opt_fscontext, FSCONTEXT_STR "%s"},
 441         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 442         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 443         {Opt_labelsupport, LABELSUPP_STR},
 444         {Opt_error, NULL},
 445 };
 446
 447 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 448
 449 static int may_context_mount_sb_relabel(u32 sid,
 450                         struct superblock_security_struct *sbsec,
 451                         const struct cred *cred)
 452 {
 453         const struct task_security_struct *tsec = cred->security;
 454         int rc;
 455
 456         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                           FILESYSTEM__RELABELFROM, NULL);
 458         if (rc)
 459                 return rc;
 460
 461         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                           FILESYSTEM__RELABELTO, NULL);
 463         return rc;
 464 }
 465
 466 static int may_context_mount_inode_relabel(u32 sid,
 467                         struct superblock_security_struct *sbsec,
 468                         const struct cred *cred)
 469 {
 470         const struct task_security_struct *tsec = cred->security;
 471         int rc;
 472         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 473                           FILESYSTEM__RELABELFROM, NULL);
 474         if (rc)
 475                 return rc;
 476
 477         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                           FILESYSTEM__ASSOCIATE, NULL);
 479         return rc;
 480 }
 481
 482 static int selinux_is_sblabel_mnt(struct super_block *sb)
 483 {
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485
 486         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 487                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 488                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 489                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 490                 /* Special handling. Genfs but also in-core setxattr handler */
 491                 !strcmp(sb->s_type->name, "sysfs") ||
 492                 !strcmp(sb->s_type->name, "pstore") ||
 493                 !strcmp(sb->s_type->name, "debugfs") ||
 494                 !strcmp(sb->s_type->name, "rootfs");
 495 }
 496
 497 static int sb_finish_set_opts(struct super_block *sb)
 498 {
 499         struct superblock_security_struct *sbsec = sb->s_security;
 500         struct dentry *root = sb->s_root;
 501         struct inode *root_inode = d_backing_inode(root);
 502         int rc = 0;
 503
 504         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 505                 /* Make sure that the xattr handler exists and that no
 506                    error other than -ENODATA is returned by getxattr on
 507                    the root directory.  -ENODATA is ok, as this may be
 508                    the first boot of the SELinux kernel before we have
 509                    assigned xattr values to the filesystem. */
 510                 if (!root_inode->i_op->getxattr) {
 511                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 512                                "xattr support\n", sb->s_id, sb->s_type->name);
 513                         rc = -EOPNOTSUPP;
 514                         goto out;
 515                 }
 516                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 517                 if (rc < 0 && rc != -ENODATA) {
 518                         if (rc == -EOPNOTSUPP)
 519                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 520                                        "%s) has no security xattr handler\n",
 521                                        sb->s_id, sb->s_type->name);
 522                         else
 523                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 524                                        "%s) getxattr errno %d\n", sb->s_id,
 525                                        sb->s_type->name, -rc);
 526                         goto out;
 527                 }
 528         }
 529
 530         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 531                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 532                        sb->s_id, sb->s_type->name);
 533
 534         sbsec->flags |= SE_SBINITIALIZED;
 535         if (selinux_is_sblabel_mnt(sb))
 536                 sbsec->flags |= SBLABEL_MNT;
 537
 538         /* Initialize the root inode. */
 539         rc = inode_doinit_with_dentry(root_inode, root);
 540
 541         /* Initialize any other inodes associated with the superblock, e.g.
 542            inodes created prior to initial policy load or inodes created
 543            during get_sb by a pseudo filesystem that directly
 544            populates itself. */
 545         spin_lock(&sbsec->isec_lock);
 546 next_inode:
 547         if (!list_empty(&sbsec->isec_head)) {
 548                 struct inode_security_struct *isec =
 549                                 list_entry(sbsec->isec_head.next,
 550                                            struct inode_security_struct, list);
 551                 struct inode *inode = isec->inode;
 552                 list_del_init(&isec->list);
 553                 spin_unlock(&sbsec->isec_lock);
 554                 inode = igrab(inode);
 555                 if (inode) {
 556                         if (!IS_PRIVATE(inode))
 557                                 inode_doinit(inode);
 558                         iput(inode);
 559                 }
 560                 spin_lock(&sbsec->isec_lock);
 561                 goto next_inode;
 562         }
 563         spin_unlock(&sbsec->isec_lock);
 564 out:
 565         return rc;
 566 }
 567
 568 /*
 569  * This function should allow an FS to ask what it's mount security
 570  * options were so it can use those later for submounts, displaying
 571  * mount options, or whatever.
 572  */
 573 static int selinux_get_mnt_opts(const struct super_block *sb,
 574                                 struct security_mnt_opts *opts)
 575 {
 576         int rc = 0, i;
 577         struct superblock_security_struct *sbsec = sb->s_security;
 578         char *context = NULL;
 579         u32 len;
 580         char tmp;
 581
 582         security_init_mnt_opts(opts);
 583
 584         if (!(sbsec->flags & SE_SBINITIALIZED))
 585                 return -EINVAL;
 586
 587         if (!ss_initialized)
 588                 return -EINVAL;
 589
 590         /* make sure we always check enough bits to cover the mask */
 591         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 592
 593         tmp = sbsec->flags & SE_MNTMASK;
 594         /* count the number of mount options for this sb */
 595         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 596                 if (tmp & 0x01)
 597                         opts->num_mnt_opts++;
 598                 tmp >>= 1;
 599         }
 600         /* Check if the Label support flag is set */
 601         if (sbsec->flags & SBLABEL_MNT)
 602                 opts->num_mnt_opts++;
 603
 604         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 605         if (!opts->mnt_opts) {
 606                 rc = -ENOMEM;
 607                 goto out_free;
 608         }
 609
 610         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 611         if (!opts->mnt_opts_flags) {
 612                 rc = -ENOMEM;
 613                 goto out_free;
 614         }
 615
 616         i = 0;
 617         if (sbsec->flags & FSCONTEXT_MNT) {
 618                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 619                 if (rc)
 620                         goto out_free;
 621                 opts->mnt_opts[i] = context;
 622                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 623         }
 624         if (sbsec->flags & CONTEXT_MNT) {
 625                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 626                 if (rc)
 627                         goto out_free;
 628                 opts->mnt_opts[i] = context;
 629                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 630         }
 631         if (sbsec->flags & DEFCONTEXT_MNT) {
 632                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 633                 if (rc)
 634                         goto out_free;
 635                 opts->mnt_opts[i] = context;
 636                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 637         }
 638         if (sbsec->flags & ROOTCONTEXT_MNT) {
 639                 struct dentry *root = sbsec->sb->s_root;
 640                 struct inode_security_struct *isec = backing_inode_security(root);
 641
 642                 rc = security_sid_to_context(isec->sid, &context, &len);
 643                 if (rc)
 644                         goto out_free;
 645                 opts->mnt_opts[i] = context;
 646                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 647         }
 648         if (sbsec->flags & SBLABEL_MNT) {
 649                 opts->mnt_opts[i] = NULL;
 650                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 651         }
 652
 653         BUG_ON(i != opts->num_mnt_opts);
 654
 655         return 0;
 656
 657 out_free:
 658         security_free_mnt_opts(opts);
 659         return rc;
 660 }
 661
 662 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 663                       u32 old_sid, u32 new_sid)
 664 {
 665         char mnt_flags = sbsec->flags & SE_MNTMASK;
 666
 667         /* check if the old mount command had the same options */
 668         if (sbsec->flags & SE_SBINITIALIZED)
 669                 if (!(sbsec->flags & flag) ||
 670                     (old_sid != new_sid))
 671                         return 1;
 672
 673         /* check if we were passed the same options twice,
 674          * aka someone passed context=a,context=b
 675          */
 676         if (!(sbsec->flags & SE_SBINITIALIZED))
 677                 if (mnt_flags & flag)
 678                         return 1;
 679         return 0;
 680 }
 681
 682 /*
 683  * Allow filesystems with binary mount data to explicitly set mount point
 684  * labeling information.
 685  */
 686 static int selinux_set_mnt_opts(struct super_block *sb,
 687                                 struct security_mnt_opts *opts,
 688                                 unsigned long kern_flags,
 689                                 unsigned long *set_kern_flags)
 690 {
 691         const struct cred *cred = current_cred();
 692         int rc = 0, i;
 693         struct superblock_security_struct *sbsec = sb->s_security;
 694         const char *name = sb->s_type->name;
 695         struct dentry *root = sbsec->sb->s_root;
 696         struct inode_security_struct *root_isec;
 697         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 698         u32 defcontext_sid = 0;
 699         char **mount_options = opts->mnt_opts;
 700         int *flags = opts->mnt_opts_flags;
 701         int num_opts = opts->num_mnt_opts;
 702
 703         mutex_lock(&sbsec->lock);
 704
 705         if (!ss_initialized) {
 706                 if (!num_opts) {
 707                         /* Defer initialization until selinux_complete_init,
 708                            after the initial policy is loaded and the security
 709                            server is ready to handle calls. */
 710                         goto out;
 711                 }
 712                 rc = -EINVAL;
 713                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 714                         "before the security server is initialized\n");
 715                 goto out;
 716         }
 717         if (kern_flags && !set_kern_flags) {
 718                 /* Specifying internal flags without providing a place to
 719                  * place the results is not allowed */
 720                 rc = -EINVAL;
 721                 goto out;
 722         }
 723
 724         /*
 725          * Binary mount data FS will come through this function twice.  Once
 726          * from an explicit call and once from the generic calls from the vfs.
 727          * Since the generic VFS calls will not contain any security mount data
 728          * we need to skip the double mount verification.
 729          *
 730          * This does open a hole in which we will not notice if the first
 731          * mount using this sb set explict options and a second mount using
 732          * this sb does not set any security options.  (The first options
 733          * will be used for both mounts)
 734          */
 735         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 736             && (num_opts == 0))
 737                 goto out;
 738
 739         root_isec = backing_inode_security_novalidate(root);
 740
 741         /*
 742          * parse the mount options, check if they are valid sids.
 743          * also check if someone is trying to mount the same sb more
 744          * than once with different security options.
 745          */
 746         for (i = 0; i < num_opts; i++) {
 747                 u32 sid;
 748
 749                 if (flags[i] == SBLABEL_MNT)
 750                         continue;
 751                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 752                 if (rc) {
 753                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 754                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 755                                mount_options[i], sb->s_id, name, rc);
 756                         goto out;
 757                 }
 758                 switch (flags[i]) {
 759                 case FSCONTEXT_MNT:
 760                         fscontext_sid = sid;
 761
 762                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 763                                         fscontext_sid))
 764                                 goto out_double_mount;
 765
 766                         sbsec->flags |= FSCONTEXT_MNT;
 767                         break;
 768                 case CONTEXT_MNT:
 769                         context_sid = sid;
 770
 771                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 772                                         context_sid))
 773                                 goto out_double_mount;
 774
 775                         sbsec->flags |= CONTEXT_MNT;
 776                         break;
 777                 case ROOTCONTEXT_MNT:
 778                         rootcontext_sid = sid;
 779
 780                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 781                                         rootcontext_sid))
 782                                 goto out_double_mount;
 783
 784                         sbsec->flags |= ROOTCONTEXT_MNT;
 785
 786                         break;
 787                 case DEFCONTEXT_MNT:
 788                         defcontext_sid = sid;
 789
 790                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 791                                         defcontext_sid))
 792                                 goto out_double_mount;
 793
 794                         sbsec->flags |= DEFCONTEXT_MNT;
 795
 796                         break;
 797                 default:
 798                         rc = -EINVAL;
 799                         goto out;
 800                 }
 801         }
 802
 803         if (sbsec->flags & SE_SBINITIALIZED) {
 804                 /* previously mounted with options, but not on this attempt? */
 805                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 806                         goto out_double_mount;
 807                 rc = 0;
 808                 goto out;
 809         }
 810
 811         if (strcmp(sb->s_type->name, "proc") == 0)
 812                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 813
 814         if (!strcmp(sb->s_type->name, "debugfs") ||
 815             !strcmp(sb->s_type->name, "sysfs") ||
 816             !strcmp(sb->s_type->name, "pstore"))
 817                 sbsec->flags |= SE_SBGENFS;
 818
 819         if (!sbsec->behavior) {
 820                 /*
 821                  * Determine the labeling behavior to use for this
 822                  * filesystem type.
 823                  */
 824                 rc = security_fs_use(sb);
 825                 if (rc) {
 826                         printk(KERN_WARNING
 827                                 "%s: security_fs_use(%s) returned %d\n",
 828                                         __func__, sb->s_type->name, rc);
 829                         goto out;
 830                 }
 831         }
 832         /* sets the context of the superblock for the fs being mounted. */
 833         if (fscontext_sid) {
 834                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 835                 if (rc)
 836                         goto out;
 837
 838                 sbsec->sid = fscontext_sid;
 839         }
 840
 841         /*
 842          * Switch to using mount point labeling behavior.
 843          * sets the label used on all file below the mountpoint, and will set
 844          * the superblock context if not already set.
 845          */
 846         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 847                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 848                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 849         }
 850
 851         if (context_sid) {
 852                 if (!fscontext_sid) {
 853                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 854                                                           cred);
 855                         if (rc)
 856                                 goto out;
 857                         sbsec->sid = context_sid;
 858                 } else {
 859                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 860                                                              cred);
 861                         if (rc)
 862                                 goto out;
 863                 }
 864                 if (!rootcontext_sid)
 865                         rootcontext_sid = context_sid;
 866
 867                 sbsec->mntpoint_sid = context_sid;
 868                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 869         }
 870
 871         if (rootcontext_sid) {
 872                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 873                                                      cred);
 874                 if (rc)
 875                         goto out;
 876
 877                 root_isec->sid = rootcontext_sid;
 878                 root_isec->initialized = LABEL_INITIALIZED;
 879         }
 880
 881         if (defcontext_sid) {
 882                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 883                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 884                         rc = -EINVAL;
 885                         printk(KERN_WARNING "SELinux: defcontext option is "
 886                                "invalid for this filesystem type\n");
 887                         goto out;
 888                 }
 889
 890                 if (defcontext_sid != sbsec->def_sid) {
 891                         rc = may_context_mount_inode_relabel(defcontext_sid,
 892                                                              sbsec, cred);
 893                         if (rc)
 894                                 goto out;
 895                 }
 896
 897                 sbsec->def_sid = defcontext_sid;
 898         }
 899
 900         rc = sb_finish_set_opts(sb);
 901 out:
 902         mutex_unlock(&sbsec->lock);
 903         return rc;
 904 out_double_mount:
 905         rc = -EINVAL;
 906         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 907                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 908         goto out;
 909 }
 910
 911 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 912                                     const struct super_block *newsb)
 913 {
 914         struct superblock_security_struct *old = oldsb->s_security;
 915         struct superblock_security_struct *new = newsb->s_security;
 916         char oldflags = old->flags & SE_MNTMASK;
 917         char newflags = new->flags & SE_MNTMASK;
 918
 919         if (oldflags != newflags)
 920                 goto mismatch;
 921         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 922                 goto mismatch;
 923         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 924                 goto mismatch;
 925         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 926                 goto mismatch;
 927         if (oldflags & ROOTCONTEXT_MNT) {
 928                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 929                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 930                 if (oldroot->sid != newroot->sid)
 931                         goto mismatch;
 932         }
 933         return 0;
 934 mismatch:
 935         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 936                             "different security settings for (dev %s, "
 937                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 938         return -EBUSY;
 939 }
 940
 941 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 942                                         struct super_block *newsb)
 943 {
 944         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 945         struct superblock_security_struct *newsbsec = newsb->s_security;
 946
 947         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 948         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 949         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 950
 951         /*
 952          * if the parent was able to be mounted it clearly had no special lsm
 953          * mount options.  thus we can safely deal with this superblock later
 954          */
 955         if (!ss_initialized)
 956                 return 0;
 957
 958         /* how can we clone if the old one wasn't set up?? */
 959         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 960
 961         /* if fs is reusing a sb, make sure that the contexts match */
 962         if (newsbsec->flags & SE_SBINITIALIZED)
 963                 return selinux_cmp_sb_context(oldsb, newsb);
 964
 965         mutex_lock(&newsbsec->lock);
 966
 967         newsbsec->flags = oldsbsec->flags;
 968
 969         newsbsec->sid = oldsbsec->sid;
 970         newsbsec->def_sid = oldsbsec->def_sid;
 971         newsbsec->behavior = oldsbsec->behavior;
 972
 973         if (set_context) {
 974                 u32 sid = oldsbsec->mntpoint_sid;
 975
 976                 if (!set_fscontext)
 977                         newsbsec->sid = sid;
 978                 if (!set_rootcontext) {
 979                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 980                         newisec->sid = sid;
 981                 }
 982                 newsbsec->mntpoint_sid = sid;
 983         }
 984         if (set_rootcontext) {
 985                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 986                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 987
 988                 newisec->sid = oldisec->sid;
 989         }
 990
 991         sb_finish_set_opts(newsb);
 992         mutex_unlock(&newsbsec->lock);
 993         return 0;
 994 }
 995
 996 static int selinux_parse_opts_str(char *options,
 997                                   struct security_mnt_opts *opts)
 998 {
 999         char *p;
1000         char *context = NULL, *defcontext = NULL;
1001         char *fscontext = NULL, *rootcontext = NULL;
1002         int rc, num_mnt_opts = 0;
1003
1004         opts->num_mnt_opts = 0;
1005
1006         /* Standard string-based options. */
1007         while ((p = strsep(&options, "|")) != NULL) {
1008                 int token;
1009                 substring_t args[MAX_OPT_ARGS];
1010
1011                 if (!*p)
1012                         continue;
1013
1014                 token = match_token(p, tokens, args);
1015
1016                 switch (token) {
1017                 case Opt_context:
1018                         if (context || defcontext) {
1019                                 rc = -EINVAL;
1020                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1021                                 goto out_err;
1022                         }
1023                         context = match_strdup(&args[0]);
1024                         if (!context) {
1025                                 rc = -ENOMEM;
1026                                 goto out_err;
1027                         }
1028                         break;
1029
1030                 case Opt_fscontext:
1031                         if (fscontext) {
1032                                 rc = -EINVAL;
1033                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1034                                 goto out_err;
1035                         }
1036                         fscontext = match_strdup(&args[0]);
1037                         if (!fscontext) {
1038                                 rc = -ENOMEM;
1039                                 goto out_err;
1040                         }
1041                         break;
1042
1043                 case Opt_rootcontext:
1044                         if (rootcontext) {
1045                                 rc = -EINVAL;
1046                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1047                                 goto out_err;
1048                         }
1049                         rootcontext = match_strdup(&args[0]);
1050                         if (!rootcontext) {
1051                                 rc = -ENOMEM;
1052                                 goto out_err;
1053                         }
1054                         break;
1055
1056                 case Opt_defcontext:
1057                         if (context || defcontext) {
1058                                 rc = -EINVAL;
1059                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1060                                 goto out_err;
1061                         }
1062                         defcontext = match_strdup(&args[0]);
1063                         if (!defcontext) {
1064                                 rc = -ENOMEM;
1065                                 goto out_err;
1066                         }
1067                         break;
1068                 case Opt_labelsupport:
1069                         break;
1070                 default:
1071                         rc = -EINVAL;
1072                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1073                         goto out_err;
1074
1075                 }
1076         }
1077
1078         rc = -ENOMEM;
1079         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1080         if (!opts->mnt_opts)
1081                 goto out_err;
1082
1083         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1084         if (!opts->mnt_opts_flags) {
1085                 kfree(opts->mnt_opts);
1086                 goto out_err;
1087         }
1088
1089         if (fscontext) {
1090                 opts->mnt_opts[num_mnt_opts] = fscontext;
1091                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1092         }
1093         if (context) {
1094                 opts->mnt_opts[num_mnt_opts] = context;
1095                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1096         }
1097         if (rootcontext) {
1098                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1099                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1100         }
1101         if (defcontext) {
1102                 opts->mnt_opts[num_mnt_opts] = defcontext;
1103                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1104         }
1105
1106         opts->num_mnt_opts = num_mnt_opts;
1107         return 0;
1108
1109 out_err:
1110         kfree(context);
1111         kfree(defcontext);
1112         kfree(fscontext);
1113         kfree(rootcontext);
1114         return rc;
1115 }
1116 /*
1117  * string mount options parsing and call set the sbsec
1118  */
1119 static int superblock_doinit(struct super_block *sb, void *data)
1120 {
1121         int rc = 0;
1122         char *options = data;
1123         struct security_mnt_opts opts;
1124
1125         security_init_mnt_opts(&opts);
1126
1127         if (!data)
1128                 goto out;
1129
1130         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1131
1132         rc = selinux_parse_opts_str(options, &opts);
1133         if (rc)
1134                 goto out_err;
1135
1136 out:
1137         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1138
1139 out_err:
1140         security_free_mnt_opts(&opts);
1141         return rc;
1142 }
1143
1144 static void selinux_write_opts(struct seq_file *m,
1145                                struct security_mnt_opts *opts)
1146 {
1147         int i;
1148         char *prefix;
1149
1150         for (i = 0; i < opts->num_mnt_opts; i++) {
1151                 char *has_comma;
1152
1153                 if (opts->mnt_opts[i])
1154                         has_comma = strchr(opts->mnt_opts[i], ',');
1155                 else
1156                         has_comma = NULL;
1157
1158                 switch (opts->mnt_opts_flags[i]) {
1159                 case CONTEXT_MNT:
1160                         prefix = CONTEXT_STR;
1161                         break;
1162                 case FSCONTEXT_MNT:
1163                         prefix = FSCONTEXT_STR;
1164                         break;
1165                 case ROOTCONTEXT_MNT:
1166                         prefix = ROOTCONTEXT_STR;
1167                         break;
1168                 case DEFCONTEXT_MNT:
1169                         prefix = DEFCONTEXT_STR;
1170                         break;
1171                 case SBLABEL_MNT:
1172                         seq_putc(m, ',');
1173                         seq_puts(m, LABELSUPP_STR);
1174                         continue;
1175                 default:
1176                         BUG();
1177                         return;
1178                 };
1179                 /* we need a comma before each option */
1180                 seq_putc(m, ',');
1181                 seq_puts(m, prefix);
1182                 if (has_comma)
1183                         seq_putc(m, '\"');
1184                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1185                 if (has_comma)
1186                         seq_putc(m, '\"');
1187         }
1188 }
1189
1190 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1191 {
1192         struct security_mnt_opts opts;
1193         int rc;
1194
1195         rc = selinux_get_mnt_opts(sb, &opts);
1196         if (rc) {
1197                 /* before policy load we may get EINVAL, don't show anything */
1198                 if (rc == -EINVAL)
1199                         rc = 0;
1200                 return rc;
1201         }
1202
1203         selinux_write_opts(m, &opts);
1204
1205         security_free_mnt_opts(&opts);
1206
1207         return rc;
1208 }
1209
1210 static inline u16 inode_mode_to_security_class(umode_t mode)
1211 {
1212         switch (mode & S_IFMT) {
1213         case S_IFSOCK:
1214                 return SECCLASS_SOCK_FILE;
1215         case S_IFLNK:
1216                 return SECCLASS_LNK_FILE;
1217         case S_IFREG:
1218                 return SECCLASS_FILE;
1219         case S_IFBLK:
1220                 return SECCLASS_BLK_FILE;
1221         case S_IFDIR:
1222                 return SECCLASS_DIR;
1223         case S_IFCHR:
1224                 return SECCLASS_CHR_FILE;
1225         case S_IFIFO:
1226                 return SECCLASS_FIFO_FILE;
1227
1228         }
1229
1230         return SECCLASS_FILE;
1231 }
1232
1233 static inline int default_protocol_stream(int protocol)
1234 {
1235         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1236 }
1237
1238 static inline int default_protocol_dgram(int protocol)
1239 {
1240         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1241 }
1242
1243 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1244 {
1245         switch (family) {
1246         case PF_UNIX:
1247                 switch (type) {
1248                 case SOCK_STREAM:
1249                 case SOCK_SEQPACKET:
1250                         return SECCLASS_UNIX_STREAM_SOCKET;
1251                 case SOCK_DGRAM:
1252                         return SECCLASS_UNIX_DGRAM_SOCKET;
1253                 }
1254                 break;
1255         case PF_INET:
1256         case PF_INET6:
1257                 switch (type) {
1258                 case SOCK_STREAM:
1259                         if (default_protocol_stream(protocol))
1260                                 return SECCLASS_TCP_SOCKET;
1261                         else
1262                                 return SECCLASS_RAWIP_SOCKET;
1263                 case SOCK_DGRAM:
1264                         if (default_protocol_dgram(protocol))
1265                                 return SECCLASS_UDP_SOCKET;
1266                         else
1267                                 return SECCLASS_RAWIP_SOCKET;
1268                 case SOCK_DCCP:
1269                         return SECCLASS_DCCP_SOCKET;
1270                 default:
1271                         return SECCLASS_RAWIP_SOCKET;
1272                 }
1273                 break;
1274         case PF_NETLINK:
1275                 switch (protocol) {
1276                 case NETLINK_ROUTE:
1277                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1278                 case NETLINK_SOCK_DIAG:
1279                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1280                 case NETLINK_NFLOG:
1281                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1282                 case NETLINK_XFRM:
1283                         return SECCLASS_NETLINK_XFRM_SOCKET;
1284                 case NETLINK_SELINUX:
1285                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1286                 case NETLINK_ISCSI:
1287                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1288                 case NETLINK_AUDIT:
1289                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1290                 case NETLINK_FIB_LOOKUP:
1291                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1292                 case NETLINK_CONNECTOR:
1293                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1294                 case NETLINK_NETFILTER:
1295                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1296                 case NETLINK_DNRTMSG:
1297                         return SECCLASS_NETLINK_DNRT_SOCKET;
1298                 case NETLINK_KOBJECT_UEVENT:
1299                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1300                 case NETLINK_GENERIC:
1301                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1302                 case NETLINK_SCSITRANSPORT:
1303                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1304                 case NETLINK_RDMA:
1305                         return SECCLASS_NETLINK_RDMA_SOCKET;
1306                 case NETLINK_CRYPTO:
1307                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1308                 default:
1309                         return SECCLASS_NETLINK_SOCKET;
1310                 }
1311         case PF_PACKET:
1312                 return SECCLASS_PACKET_SOCKET;
1313         case PF_KEY:
1314                 return SECCLASS_KEY_SOCKET;
1315         case PF_APPLETALK:
1316                 return SECCLASS_APPLETALK_SOCKET;
1317         }
1318
1319         return SECCLASS_SOCKET;
1320 }
1321
1322 static int selinux_genfs_get_sid(struct dentry *dentry,
1323                                  u16 tclass,
1324                                  u16 flags,
1325                                  u32 *sid)
1326 {
1327         int rc;
1328         struct super_block *sb = dentry->d_inode->i_sb;
1329         char *buffer, *path;
1330
1331         buffer = (char *)__get_free_page(GFP_KERNEL);
1332         if (!buffer)
1333                 return -ENOMEM;
1334
1335         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1336         if (IS_ERR(path))
1337                 rc = PTR_ERR(path);
1338         else {
1339                 if (flags & SE_SBPROC) {
1340                         /* each process gets a /proc/PID/ entry. Strip off the
1341                          * PID part to get a valid selinux labeling.
1342                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1343                         while (path[1] >= '0' && path[1] <= '9') {
1344                                 path[1] = '/';
1345                                 path++;
1346                         }
1347                 }
1348                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1349         }
1350         free_page((unsigned long)buffer);
1351         return rc;
1352 }
1353
1354 /* The inode's security attributes must be initialized before first use. */
1355 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1356 {
1357         struct superblock_security_struct *sbsec = NULL;
1358         struct inode_security_struct *isec = inode->i_security;
1359         u32 sid;
1360         struct dentry *dentry;
1361 #define INITCONTEXTLEN 255
1362         char *context = NULL;
1363         unsigned len = 0;
1364         int rc = 0;
1365
1366         if (isec->initialized == LABEL_INITIALIZED)
1367                 goto out;
1368
1369         mutex_lock(&isec->lock);
1370         if (isec->initialized == LABEL_INITIALIZED)
1371                 goto out_unlock;
1372
1373         sbsec = inode->i_sb->s_security;
1374         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1375                 /* Defer initialization until selinux_complete_init,
1376                    after the initial policy is loaded and the security
1377                    server is ready to handle calls. */
1378                 spin_lock(&sbsec->isec_lock);
1379                 if (list_empty(&isec->list))
1380                         list_add(&isec->list, &sbsec->isec_head);
1381                 spin_unlock(&sbsec->isec_lock);
1382                 goto out_unlock;
1383         }
1384
1385         switch (sbsec->behavior) {
1386         case SECURITY_FS_USE_NATIVE:
1387                 break;
1388         case SECURITY_FS_USE_XATTR:
1389                 if (!inode->i_op->getxattr) {
1390                         isec->sid = sbsec->def_sid;
1391                         break;
1392                 }
1393
1394                 /* Need a dentry, since the xattr API requires one.
1395                    Life would be simpler if we could just pass the inode. */
1396                 if (opt_dentry) {
1397                         /* Called from d_instantiate or d_splice_alias. */
1398                         dentry = dget(opt_dentry);
1399                 } else {
1400                         /* Called from selinux_complete_init, try to find a dentry. */
1401                         dentry = d_find_alias(inode);
1402                 }
1403                 if (!dentry) {
1404                         /*
1405                          * this is can be hit on boot when a file is accessed
1406                          * before the policy is loaded.  When we load policy we
1407                          * may find inodes that have no dentry on the
1408                          * sbsec->isec_head list.  No reason to complain as these
1409                          * will get fixed up the next time we go through
1410                          * inode_doinit with a dentry, before these inodes could
1411                          * be used again by userspace.
1412                          */
1413                         goto out_unlock;
1414                 }
1415
1416                 len = INITCONTEXTLEN;
1417                 context = kmalloc(len+1, GFP_NOFS);
1418                 if (!context) {
1419                         rc = -ENOMEM;
1420                         dput(dentry);
1421                         goto out_unlock;
1422                 }
1423                 context[len] = '\0';
1424                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1425                                            context, len);
1426                 if (rc == -ERANGE) {
1427                         kfree(context);
1428
1429                         /* Need a larger buffer.  Query for the right size. */
1430                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1431                                                    NULL, 0);
1432                         if (rc < 0) {
1433                                 dput(dentry);
1434                                 goto out_unlock;
1435                         }
1436                         len = rc;
1437                         context = kmalloc(len+1, GFP_NOFS);
1438                         if (!context) {
1439                                 rc = -ENOMEM;
1440                                 dput(dentry);
1441                                 goto out_unlock;
1442                         }
1443                         context[len] = '\0';
1444                         rc = inode->i_op->getxattr(dentry,
1445                                                    XATTR_NAME_SELINUX,
1446                                                    context, len);
1447                 }
1448                 dput(dentry);
1449                 if (rc < 0) {
1450                         if (rc != -ENODATA) {
1451                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1452                                        "%d for dev=%s ino=%ld\n", __func__,
1453                                        -rc, inode->i_sb->s_id, inode->i_ino);
1454                                 kfree(context);
1455                                 goto out_unlock;
1456                         }
1457                         /* Map ENODATA to the default file SID */
1458                         sid = sbsec->def_sid;
1459                         rc = 0;
1460                 } else {
1461                         rc = security_context_to_sid_default(context, rc, &sid,
1462                                                              sbsec->def_sid,
1463                                                              GFP_NOFS);
1464                         if (rc) {
1465                                 char *dev = inode->i_sb->s_id;
1466                                 unsigned long ino = inode->i_ino;
1467
1468                                 if (rc == -EINVAL) {
1469                                         if (printk_ratelimit())
1470                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1471                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1472                                                         "filesystem in question.\n", ino, dev, context);
1473                                 } else {
1474                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1475                                                "returned %d for dev=%s ino=%ld\n",
1476                                                __func__, context, -rc, dev, ino);
1477                                 }
1478                                 kfree(context);
1479                                 /* Leave with the unlabeled SID */
1480                                 rc = 0;
1481                                 break;
1482                         }
1483                 }
1484                 kfree(context);
1485                 isec->sid = sid;
1486                 break;
1487         case SECURITY_FS_USE_TASK:
1488                 isec->sid = isec->task_sid;
1489                 break;
1490         case SECURITY_FS_USE_TRANS:
1491                 /* Default to the fs SID. */
1492                 isec->sid = sbsec->sid;
1493
1494                 /* Try to obtain a transition SID. */
1495                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1496                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1497                                              isec->sclass, NULL, &sid);
1498                 if (rc)
1499                         goto out_unlock;
1500                 isec->sid = sid;
1501                 break;
1502         case SECURITY_FS_USE_MNTPOINT:
1503                 isec->sid = sbsec->mntpoint_sid;
1504                 break;
1505         default:
1506                 /* Default to the fs superblock SID. */
1507                 isec->sid = sbsec->sid;
1508
1509                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1510                         /* We must have a dentry to determine the label on
1511                          * procfs inodes */
1512                         if (opt_dentry)
1513                                 /* Called from d_instantiate or
1514                                  * d_splice_alias. */
1515                                 dentry = dget(opt_dentry);
1516                         else
1517                                 /* Called from selinux_complete_init, try to
1518                                  * find a dentry. */
1519                                 dentry = d_find_alias(inode);
1520                         /*
1521                          * This can be hit on boot when a file is accessed
1522                          * before the policy is loaded.  When we load policy we
1523                          * may find inodes that have no dentry on the
1524                          * sbsec->isec_head list.  No reason to complain as
1525                          * these will get fixed up the next time we go through
1526                          * inode_doinit() with a dentry, before these inodes
1527                          * could be used again by userspace.
1528                          */
1529                         if (!dentry)
1530                                 goto out_unlock;
1531                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1532                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1533                                                    sbsec->flags, &sid);
1534                         dput(dentry);
1535                         if (rc)
1536                                 goto out_unlock;
1537                         isec->sid = sid;
1538                 }
1539                 break;
1540         }
1541
1542         isec->initialized = LABEL_INITIALIZED;
1543
1544 out_unlock:
1545         mutex_unlock(&isec->lock);
1546 out:
1547         if (isec->sclass == SECCLASS_FILE)
1548                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1549         return rc;
1550 }
1551
1552 /* Convert a Linux signal to an access vector. */
1553 static inline u32 signal_to_av(int sig)
1554 {
1555         u32 perm = 0;
1556
1557         switch (sig) {
1558         case SIGCHLD:
1559                 /* Commonly granted from child to parent. */
1560                 perm = PROCESS__SIGCHLD;
1561                 break;
1562         case SIGKILL:
1563                 /* Cannot be caught or ignored */
1564                 perm = PROCESS__SIGKILL;
1565                 break;
1566         case SIGSTOP:
1567                 /* Cannot be caught or ignored */
1568                 perm = PROCESS__SIGSTOP;
1569                 break;
1570         default:
1571                 /* All other signals. */
1572                 perm = PROCESS__SIGNAL;
1573                 break;
1574         }
1575
1576         return perm;
1577 }
1578
1579 /*
1580  * Check permission between a pair of credentials
1581  * fork check, ptrace check, etc.
1582  */
1583 static int cred_has_perm(const struct cred *actor,
1584                          const struct cred *target,
1585                          u32 perms)
1586 {
1587         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1588
1589         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1590 }
1591
1592 /*
1593  * Check permission between a pair of tasks, e.g. signal checks,
1594  * fork check, ptrace check, etc.
1595  * tsk1 is the actor and tsk2 is the target
1596  * - this uses the default subjective creds of tsk1
1597  */
1598 static int task_has_perm(const struct task_struct *tsk1,
1599                          const struct task_struct *tsk2,
1600                          u32 perms)
1601 {
1602         const struct task_security_struct *__tsec1, *__tsec2;
1603         u32 sid1, sid2;
1604
1605         rcu_read_lock();
1606         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1607         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1608         rcu_read_unlock();
1609         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1610 }
1611
1612 /*
1613  * Check permission between current and another task, e.g. signal checks,
1614  * fork check, ptrace check, etc.
1615  * current is the actor and tsk2 is the target
1616  * - this uses current's subjective creds
1617  */
1618 static int current_has_perm(const struct task_struct *tsk,
1619                             u32 perms)
1620 {
1621         u32 sid, tsid;
1622
1623         sid = current_sid();
1624         tsid = task_sid(tsk);
1625         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1626 }
1627
1628 #if CAP_LAST_CAP > 63
1629 #error Fix SELinux to handle capabilities > 63.
1630 #endif
1631
1632 /* Check whether a task is allowed to use a capability. */
1633 static int cred_has_capability(const struct cred *cred,
1634                                int cap, int audit)
1635 {
1636         struct common_audit_data ad;
1637         struct av_decision avd;
1638         u16 sclass;
1639         u32 sid = cred_sid(cred);
1640         u32 av = CAP_TO_MASK(cap);
1641         int rc;
1642
1643         ad.type = LSM_AUDIT_DATA_CAP;
1644         ad.u.cap = cap;
1645
1646         switch (CAP_TO_INDEX(cap)) {
1647         case 0:
1648                 sclass = SECCLASS_CAPABILITY;
1649                 break;
1650         case 1:
1651                 sclass = SECCLASS_CAPABILITY2;
1652                 break;
1653         default:
1654                 printk(KERN_ERR
1655                        "SELinux:  out of range capability %d\n", cap);
1656                 BUG();
1657                 return -EINVAL;
1658         }
1659
1660         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1661         if (audit == SECURITY_CAP_AUDIT) {
1662                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1663                 if (rc2)
1664                         return rc2;
1665         }
1666         return rc;
1667 }
1668
1669 /* Check whether a task is allowed to use a system operation. */
1670 static int task_has_system(struct task_struct *tsk,
1671                            u32 perms)
1672 {
1673         u32 sid = task_sid(tsk);
1674
1675         return avc_has_perm(sid, SECINITSID_KERNEL,
1676                             SECCLASS_SYSTEM, perms, NULL);
1677 }
1678
1679 /* Check whether a task has a particular permission to an inode.
1680    The 'adp' parameter is optional and allows other audit
1681    data to be passed (e.g. the dentry). */
1682 static int inode_has_perm(const struct cred *cred,
1683                           struct inode *inode,
1684                           u32 perms,
1685                           struct common_audit_data *adp)
1686 {
1687         struct inode_security_struct *isec;
1688         u32 sid;
1689
1690         validate_creds(cred);
1691
1692         if (unlikely(IS_PRIVATE(inode)))
1693                 return 0;
1694
1695         sid = cred_sid(cred);
1696         isec = inode->i_security;
1697
1698         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1699 }
1700
1701 /* Same as inode_has_perm, but pass explicit audit data containing
1702    the dentry to help the auditing code to more easily generate the
1703    pathname if needed. */
1704 static inline int dentry_has_perm(const struct cred *cred,
1705                                   struct dentry *dentry,
1706                                   u32 av)
1707 {
1708         struct inode *inode = d_backing_inode(dentry);
1709         struct common_audit_data ad;
1710
1711         ad.type = LSM_AUDIT_DATA_DENTRY;
1712         ad.u.dentry = dentry;
1713         __inode_security_revalidate(inode, dentry, true);
1714         return inode_has_perm(cred, inode, av, &ad);
1715 }
1716
1717 /* Same as inode_has_perm, but pass explicit audit data containing
1718    the path to help the auditing code to more easily generate the
1719    pathname if needed. */
1720 static inline int path_has_perm(const struct cred *cred,
1721                                 const struct path *path,
1722                                 u32 av)
1723 {
1724         struct inode *inode = d_backing_inode(path->dentry);
1725         struct common_audit_data ad;
1726
1727         ad.type = LSM_AUDIT_DATA_PATH;
1728         ad.u.path = *path;
1729         __inode_security_revalidate(inode, path->dentry, true);
1730         return inode_has_perm(cred, inode, av, &ad);
1731 }
1732
1733 /* Same as path_has_perm, but uses the inode from the file struct. */
1734 static inline int file_path_has_perm(const struct cred *cred,
1735                                      struct file *file,
1736                                      u32 av)
1737 {
1738         struct common_audit_data ad;
1739
1740         ad.type = LSM_AUDIT_DATA_PATH;
1741         ad.u.path = file->f_path;
1742         return inode_has_perm(cred, file_inode(file), av, &ad);
1743 }
1744
1745 /* Check whether a task can use an open file descriptor to
1746    access an inode in a given way.  Check access to the
1747    descriptor itself, and then use dentry_has_perm to
1748    check a particular permission to the file.
1749    Access to the descriptor is implicitly granted if it
1750    has the same SID as the process.  If av is zero, then
1751    access to the file is not checked, e.g. for cases
1752    where only the descriptor is affected like seek. */
1753 static int file_has_perm(const struct cred *cred,
1754                          struct file *file,
1755                          u32 av)
1756 {
1757         struct file_security_struct *fsec = file->f_security;
1758         struct inode *inode = file_inode(file);
1759         struct common_audit_data ad;
1760         u32 sid = cred_sid(cred);
1761         int rc;
1762
1763         ad.type = LSM_AUDIT_DATA_PATH;
1764         ad.u.path = file->f_path;
1765
1766         if (sid != fsec->sid) {
1767                 rc = avc_has_perm(sid, fsec->sid,
1768                                   SECCLASS_FD,
1769                                   FD__USE,
1770                                   &ad);
1771                 if (rc)
1772                         goto out;
1773         }
1774
1775         /* av is zero if only checking access to the descriptor. */
1776         rc = 0;
1777         if (av)
1778                 rc = inode_has_perm(cred, inode, av, &ad);
1779
1780 out:
1781         return rc;
1782 }
1783
1784 /*
1785  * Determine the label for an inode that might be unioned.
1786  */
1787 static int selinux_determine_inode_label(struct inode *dir,
1788                                          const struct qstr *name,
1789                                          u16 tclass,
1790                                          u32 *_new_isid)
1791 {
1792         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1793         const struct inode_security_struct *dsec = inode_security(dir);
1794         const struct task_security_struct *tsec = current_security();
1795
1796         if ((sbsec->flags & SE_SBINITIALIZED) &&
1797             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1798                 *_new_isid = sbsec->mntpoint_sid;
1799         } else if ((sbsec->flags & SBLABEL_MNT) &&
1800                    tsec->create_sid) {
1801                 *_new_isid = tsec->create_sid;
1802         } else {
1803                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1804                                                name, _new_isid);
1805         }
1806
1807         return 0;
1808 }
1809
1810 /* Check whether a task can create a file. */
1811 static int may_create(struct inode *dir,
1812                       struct dentry *dentry,
1813                       u16 tclass)
1814 {
1815         const struct task_security_struct *tsec = current_security();
1816         struct inode_security_struct *dsec;
1817         struct superblock_security_struct *sbsec;
1818         u32 sid, newsid;
1819         struct common_audit_data ad;
1820         int rc;
1821
1822         dsec = inode_security(dir);
1823         sbsec = dir->i_sb->s_security;
1824
1825         sid = tsec->sid;
1826
1827         ad.type = LSM_AUDIT_DATA_DENTRY;
1828         ad.u.dentry = dentry;
1829
1830         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1831                           DIR__ADD_NAME | DIR__SEARCH,
1832                           &ad);
1833         if (rc)
1834                 return rc;
1835
1836         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1837                                            &newsid);
1838         if (rc)
1839                 return rc;
1840
1841         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1842         if (rc)
1843                 return rc;
1844
1845         return avc_has_perm(newsid, sbsec->sid,
1846                             SECCLASS_FILESYSTEM,
1847                             FILESYSTEM__ASSOCIATE, &ad);
1848 }
1849
1850 /* Check whether a task can create a key. */
1851 static int may_create_key(u32 ksid,
1852                           struct task_struct *ctx)
1853 {
1854         u32 sid = task_sid(ctx);
1855
1856         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1857 }
1858
1859 #define MAY_LINK        0
1860 #define MAY_UNLINK      1
1861 #define MAY_RMDIR       2
1862
1863 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1864 static int may_link(struct inode *dir,
1865                     struct dentry *dentry,
1866                     int kind)
1867
1868 {
1869         struct inode_security_struct *dsec, *isec;
1870         struct common_audit_data ad;
1871         u32 sid = current_sid();
1872         u32 av;
1873         int rc;
1874
1875         dsec = inode_security(dir);
1876         isec = backing_inode_security(dentry);
1877
1878         ad.type = LSM_AUDIT_DATA_DENTRY;
1879         ad.u.dentry = dentry;
1880
1881         av = DIR__SEARCH;
1882         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1883         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1884         if (rc)
1885                 return rc;
1886
1887         switch (kind) {
1888         case MAY_LINK:
1889                 av = FILE__LINK;
1890                 break;
1891         case MAY_UNLINK:
1892                 av = FILE__UNLINK;
1893                 break;
1894         case MAY_RMDIR:
1895                 av = DIR__RMDIR;
1896                 break;
1897         default:
1898                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1899                         __func__, kind);
1900                 return 0;
1901         }
1902
1903         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1904         return rc;
1905 }
1906
1907 static inline int may_rename(struct inode *old_dir,
1908                              struct dentry *old_dentry,
1909                              struct inode *new_dir,
1910                              struct dentry *new_dentry)
1911 {
1912         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1913         struct common_audit_data ad;
1914         u32 sid = current_sid();
1915         u32 av;
1916         int old_is_dir, new_is_dir;
1917         int rc;
1918
1919         old_dsec = inode_security(old_dir);
1920         old_isec = backing_inode_security(old_dentry);
1921         old_is_dir = d_is_dir(old_dentry);
1922         new_dsec = inode_security(new_dir);
1923
1924         ad.type = LSM_AUDIT_DATA_DENTRY;
1925
1926         ad.u.dentry = old_dentry;
1927         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1928                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1929         if (rc)
1930                 return rc;
1931         rc = avc_has_perm(sid, old_isec->sid,
1932                           old_isec->sclass, FILE__RENAME, &ad);
1933         if (rc)
1934                 return rc;
1935         if (old_is_dir && new_dir != old_dir) {
1936                 rc = avc_has_perm(sid, old_isec->sid,
1937                                   old_isec->sclass, DIR__REPARENT, &ad);
1938                 if (rc)
1939                         return rc;
1940         }
1941
1942         ad.u.dentry = new_dentry;
1943         av = DIR__ADD_NAME | DIR__SEARCH;
1944         if (d_is_positive(new_dentry))
1945                 av |= DIR__REMOVE_NAME;
1946         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1947         if (rc)
1948                 return rc;
1949         if (d_is_positive(new_dentry)) {
1950                 new_isec = backing_inode_security(new_dentry);
1951                 new_is_dir = d_is_dir(new_dentry);
1952                 rc = avc_has_perm(sid, new_isec->sid,
1953                                   new_isec->sclass,
1954                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1955                 if (rc)
1956                         return rc;
1957         }
1958
1959         return 0;
1960 }
1961
1962 /* Check whether a task can perform a filesystem operation. */
1963 static int superblock_has_perm(const struct cred *cred,
1964                                struct super_block *sb,
1965                                u32 perms,
1966                                struct common_audit_data *ad)
1967 {
1968         struct superblock_security_struct *sbsec;
1969         u32 sid = cred_sid(cred);
1970
1971         sbsec = sb->s_security;
1972         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1973 }
1974
1975 /* Convert a Linux mode and permission mask to an access vector. */
1976 static inline u32 file_mask_to_av(int mode, int mask)
1977 {
1978         u32 av = 0;
1979
1980         if (!S_ISDIR(mode)) {
1981                 if (mask & MAY_EXEC)
1982                         av |= FILE__EXECUTE;
1983                 if (mask & MAY_READ)
1984                         av |= FILE__READ;
1985
1986                 if (mask & MAY_APPEND)
1987                         av |= FILE__APPEND;
1988                 else if (mask & MAY_WRITE)
1989                         av |= FILE__WRITE;
1990
1991         } else {
1992                 if (mask & MAY_EXEC)
1993                         av |= DIR__SEARCH;
1994                 if (mask & MAY_WRITE)
1995                         av |= DIR__WRITE;
1996                 if (mask & MAY_READ)
1997                         av |= DIR__READ;
1998         }
1999
2000         return av;
2001 }
2002
2003 /* Convert a Linux file to an access vector. */
2004 static inline u32 file_to_av(struct file *file)
2005 {
2006         u32 av = 0;
2007
2008         if (file->f_mode & FMODE_READ)
2009                 av |= FILE__READ;
2010         if (file->f_mode & FMODE_WRITE) {
2011                 if (file->f_flags & O_APPEND)
2012                         av |= FILE__APPEND;
2013                 else
2014                         av |= FILE__WRITE;
2015         }
2016         if (!av) {
2017                 /*
2018                  * Special file opened with flags 3 for ioctl-only use.
2019                  */
2020                 av = FILE__IOCTL;
2021         }
2022
2023         return av;
2024 }
2025
2026 /*
2027  * Convert a file to an access vector and include the correct open
2028  * open permission.
2029  */
2030 static inline u32 open_file_to_av(struct file *file)
2031 {
2032         u32 av = file_to_av(file);
2033
2034         if (selinux_policycap_openperm)
2035                 av |= FILE__OPEN;
2036
2037         return av;
2038 }
2039
2040 /* Hook functions begin here. */
2041
2042 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2043 {
2044         u32 mysid = current_sid();
2045         u32 mgrsid = task_sid(mgr);
2046
2047         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2048                             BINDER__SET_CONTEXT_MGR, NULL);
2049 }
2050
2051 static int selinux_binder_transaction(struct task_struct *from,
2052                                       struct task_struct *to)
2053 {
2054         u32 mysid = current_sid();
2055         u32 fromsid = task_sid(from);
2056         u32 tosid = task_sid(to);
2057         int rc;
2058
2059         if (mysid != fromsid) {
2060                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2061                                   BINDER__IMPERSONATE, NULL);
2062                 if (rc)
2063                         return rc;
2064         }
2065
2066         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2067                             NULL);
2068 }
2069
2070 static int selinux_binder_transfer_binder(struct task_struct *from,
2071                                           struct task_struct *to)
2072 {
2073         u32 fromsid = task_sid(from);
2074         u32 tosid = task_sid(to);
2075
2076         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2077                             NULL);
2078 }
2079
2080 static int selinux_binder_transfer_file(struct task_struct *from,
2081                                         struct task_struct *to,
2082                                         struct file *file)
2083 {
2084         u32 sid = task_sid(to);
2085         struct file_security_struct *fsec = file->f_security;
2086         struct dentry *dentry = file->f_path.dentry;
2087         struct inode_security_struct *isec = backing_inode_security(dentry);
2088         struct common_audit_data ad;
2089         int rc;
2090
2091         ad.type = LSM_AUDIT_DATA_PATH;
2092         ad.u.path = file->f_path;
2093
2094         if (sid != fsec->sid) {
2095                 rc = avc_has_perm(sid, fsec->sid,
2096                                   SECCLASS_FD,
2097                                   FD__USE,
2098                                   &ad);
2099                 if (rc)
2100                         return rc;
2101         }
2102
2103         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2104                 return 0;
2105
2106         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2107                             &ad);
2108 }
2109
2110 static int selinux_ptrace_access_check(struct task_struct *child,
2111                                      unsigned int mode)
2112 {
2113         if (mode & PTRACE_MODE_READ) {
2114                 u32 sid = current_sid();
2115                 u32 csid = task_sid(child);
2116                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2117         }
2118
2119         return current_has_perm(child, PROCESS__PTRACE);
2120 }
2121
2122 static int selinux_ptrace_traceme(struct task_struct *parent)
2123 {
2124         return task_has_perm(parent, current, PROCESS__PTRACE);
2125 }
2126
2127 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2128                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2129 {
2130         return current_has_perm(target, PROCESS__GETCAP);
2131 }
2132
2133 static int selinux_capset(struct cred *new, const struct cred *old,
2134                           const kernel_cap_t *effective,
2135                           const kernel_cap_t *inheritable,
2136                           const kernel_cap_t *permitted)
2137 {
2138         return cred_has_perm(old, new, PROCESS__SETCAP);
2139 }
2140
2141 /*
2142  * (This comment used to live with the selinux_task_setuid hook,
2143  * which was removed).
2144  *
2145  * Since setuid only affects the current process, and since the SELinux
2146  * controls are not based on the Linux identity attributes, SELinux does not
2147  * need to control this operation.  However, SELinux does control the use of
2148  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2149  */
2150
2151 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2152                            int cap, int audit)
2153 {
2154         return cred_has_capability(cred, cap, audit);
2155 }
2156
2157 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2158 {
2159         const struct cred *cred = current_cred();
2160         int rc = 0;
2161
2162         if (!sb)
2163                 return 0;
2164
2165         switch (cmds) {
2166         case Q_SYNC:
2167         case Q_QUOTAON:
2168         case Q_QUOTAOFF:
2169         case Q_SETINFO:
2170         case Q_SETQUOTA:
2171                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2172                 break;
2173         case Q_GETFMT:
2174         case Q_GETINFO:
2175         case Q_GETQUOTA:
2176                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2177                 break;
2178         default:
2179                 rc = 0;  /* let the kernel handle invalid cmds */
2180                 break;
2181         }
2182         return rc;
2183 }
2184
2185 static int selinux_quota_on(struct dentry *dentry)
2186 {
2187         const struct cred *cred = current_cred();
2188
2189         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2190 }
2191
2192 static int selinux_syslog(int type)
2193 {
2194         int rc;
2195
2196         switch (type) {
2197         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2198         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2199                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2200                 break;
2201         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2202         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2203         /* Set level of messages printed to console */
2204         case SYSLOG_ACTION_CONSOLE_LEVEL:
2205                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2206                 break;
2207         case SYSLOG_ACTION_CLOSE:       /* Close log */
2208         case SYSLOG_ACTION_OPEN:        /* Open log */
2209         case SYSLOG_ACTION_READ:        /* Read from log */
2210         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2211         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2212         default:
2213                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2214                 break;
2215         }
2216         return rc;
2217 }
2218
2219 /*
2220  * Check that a process has enough memory to allocate a new virtual
2221  * mapping. 0 means there is enough memory for the allocation to
2222  * succeed and -ENOMEM implies there is not.
2223  *
2224  * Do not audit the selinux permission check, as this is applied to all
2225  * processes that allocate mappings.
2226  */
2227 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2228 {
2229         int rc, cap_sys_admin = 0;
2230
2231         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2232                                         SECURITY_CAP_NOAUDIT);
2233         if (rc == 0)
2234                 cap_sys_admin = 1;
2235
2236         return cap_sys_admin;
2237 }
2238
2239 /* binprm security operations */
2240
2241 static u32 ptrace_parent_sid(struct task_struct *task)
2242 {
2243         u32 sid = 0;
2244         struct task_struct *tracer;
2245
2246         rcu_read_lock();
2247         tracer = ptrace_parent(task);
2248         if (tracer)
2249                 sid = task_sid(tracer);
2250         rcu_read_unlock();
2251
2252         return sid;
2253 }
2254
2255 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2256                             const struct task_security_struct *old_tsec,
2257                             const struct task_security_struct *new_tsec)
2258 {
2259         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2260         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2261         int rc;
2262
2263         if (!nnp && !nosuid)
2264                 return 0; /* neither NNP nor nosuid */
2265
2266         if (new_tsec->sid == old_tsec->sid)
2267                 return 0; /* No change in credentials */
2268
2269         /*
2270          * The only transitions we permit under NNP or nosuid
2271          * are transitions to bounded SIDs, i.e. SIDs that are
2272          * guaranteed to only be allowed a subset of the permissions
2273          * of the current SID.
2274          */
2275         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2276         if (rc) {
2277                 /*
2278                  * On failure, preserve the errno values for NNP vs nosuid.
2279                  * NNP:  Operation not permitted for caller.
2280                  * nosuid:  Permission denied to file.
2281                  */
2282                 if (nnp)
2283                         return -EPERM;
2284                 else
2285                         return -EACCES;
2286         }
2287         return 0;
2288 }
2289
2290 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2291 {
2292         const struct task_security_struct *old_tsec;
2293         struct task_security_struct *new_tsec;
2294         struct inode_security_struct *isec;
2295         struct common_audit_data ad;
2296         struct inode *inode = file_inode(bprm->file);
2297         int rc;
2298
2299         /* SELinux context only depends on initial program or script and not
2300          * the script interpreter */
2301         if (bprm->cred_prepared)
2302                 return 0;
2303
2304         old_tsec = current_security();
2305         new_tsec = bprm->cred->security;
2306         isec = inode_security(inode);
2307
2308         /* Default to the current task SID. */
2309         new_tsec->sid = old_tsec->sid;
2310         new_tsec->osid = old_tsec->sid;
2311
2312         /* Reset fs, key, and sock SIDs on execve. */
2313         new_tsec->create_sid = 0;
2314         new_tsec->keycreate_sid = 0;
2315         new_tsec->sockcreate_sid = 0;
2316
2317         if (old_tsec->exec_sid) {
2318                 new_tsec->sid = old_tsec->exec_sid;
2319                 /* Reset exec SID on execve. */
2320                 new_tsec->exec_sid = 0;
2321
2322                 /* Fail on NNP or nosuid if not an allowed transition. */
2323                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2324                 if (rc)
2325                         return rc;
2326         } else {
2327                 /* Check for a default transition on this program. */
2328                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2329                                              SECCLASS_PROCESS, NULL,
2330                                              &new_tsec->sid);
2331                 if (rc)
2332                         return rc;
2333
2334                 /*
2335                  * Fallback to old SID on NNP or nosuid if not an allowed
2336                  * transition.
2337                  */
2338                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2339                 if (rc)
2340                         new_tsec->sid = old_tsec->sid;
2341         }
2342
2343         ad.type = LSM_AUDIT_DATA_PATH;
2344         ad.u.path = bprm->file->f_path;
2345
2346         if (new_tsec->sid == old_tsec->sid) {
2347                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2348                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2349                 if (rc)
2350                         return rc;
2351         } else {
2352                 /* Check permissions for the transition. */
2353                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2354                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2355                 if (rc)
2356                         return rc;
2357
2358                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2359                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2360                 if (rc)
2361                         return rc;
2362
2363                 /* Check for shared state */
2364                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2365                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2366                                           SECCLASS_PROCESS, PROCESS__SHARE,
2367                                           NULL);
2368                         if (rc)
2369                                 return -EPERM;
2370                 }
2371
2372                 /* Make sure that anyone attempting to ptrace over a task that
2373                  * changes its SID has the appropriate permit */
2374                 if (bprm->unsafe &
2375                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2376                         u32 ptsid = ptrace_parent_sid(current);
2377                         if (ptsid != 0) {
2378                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2379                                                   SECCLASS_PROCESS,
2380                                                   PROCESS__PTRACE, NULL);
2381                                 if (rc)
2382                                         return -EPERM;
2383                         }
2384                 }
2385
2386                 /* Clear any possibly unsafe personality bits on exec: */
2387                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2388         }
2389
2390         return 0;
2391 }
2392
2393 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2394 {
2395         const struct task_security_struct *tsec = current_security();
2396         u32 sid, osid;
2397         int atsecure = 0;
2398
2399         sid = tsec->sid;
2400         osid = tsec->osid;
2401
2402         if (osid != sid) {
2403                 /* Enable secure mode for SIDs transitions unless
2404                    the noatsecure permission is granted between
2405                    the two SIDs, i.e. ahp returns 0. */
2406                 atsecure = avc_has_perm(osid, sid,
2407                                         SECCLASS_PROCESS,
2408                                         PROCESS__NOATSECURE, NULL);
2409         }
2410
2411         return !!atsecure;
2412 }
2413
2414 static int match_file(const void *p, struct file *file, unsigned fd)
2415 {
2416         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2417 }
2418
2419 /* Derived from fs/exec.c:flush_old_files. */
2420 static inline void flush_unauthorized_files(const struct cred *cred,
2421                                             struct files_struct *files)
2422 {
2423         struct file *file, *devnull = NULL;
2424         struct tty_struct *tty;
2425         int drop_tty = 0;
2426         unsigned n;
2427
2428         tty = get_current_tty();
2429         if (tty) {
2430                 spin_lock(&tty->files_lock);
2431                 if (!list_empty(&tty->tty_files)) {
2432                         struct tty_file_private *file_priv;
2433
2434                         /* Revalidate access to controlling tty.
2435                            Use file_path_has_perm on the tty path directly
2436                            rather than using file_has_perm, as this particular
2437                            open file may belong to another process and we are
2438                            only interested in the inode-based check here. */
2439                         file_priv = list_first_entry(&tty->tty_files,
2440                                                 struct tty_file_private, list);
2441                         file = file_priv->file;
2442                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2443                                 drop_tty = 1;
2444                 }
2445                 spin_unlock(&tty->files_lock);
2446                 tty_kref_put(tty);
2447         }
2448         /* Reset controlling tty. */
2449         if (drop_tty)
2450                 no_tty();
2451
2452         /* Revalidate access to inherited open files. */
2453         n = iterate_fd(files, 0, match_file, cred);
2454         if (!n) /* none found? */
2455                 return;
2456
2457         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2458         if (IS_ERR(devnull))
2459                 devnull = NULL;
2460         /* replace all the matching ones with this */
2461         do {
2462                 replace_fd(n - 1, devnull, 0);
2463         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2464         if (devnull)
2465                 fput(devnull);
2466 }
2467
2468 /*
2469  * Prepare a process for imminent new credential changes due to exec
2470  */
2471 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2472 {
2473         struct task_security_struct *new_tsec;
2474         struct rlimit *rlim, *initrlim;
2475         int rc, i;
2476
2477         new_tsec = bprm->cred->security;
2478         if (new_tsec->sid == new_tsec->osid)
2479                 return;
2480
2481         /* Close files for which the new task SID is not authorized. */
2482         flush_unauthorized_files(bprm->cred, current->files);
2483
2484         /* Always clear parent death signal on SID transitions. */
2485         current->pdeath_signal = 0;
2486
2487         /* Check whether the new SID can inherit resource limits from the old
2488          * SID.  If not, reset all soft limits to the lower of the current
2489          * task's hard limit and the init task's soft limit.
2490          *
2491          * Note that the setting of hard limits (even to lower them) can be
2492          * controlled by the setrlimit check.  The inclusion of the init task's
2493          * soft limit into the computation is to avoid resetting soft limits
2494          * higher than the default soft limit for cases where the default is
2495          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2496          */
2497         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2498                           PROCESS__RLIMITINH, NULL);
2499         if (rc) {
2500                 /* protect against do_prlimit() */
2501                 task_lock(current);
2502                 for (i = 0; i < RLIM_NLIMITS; i++) {
2503                         rlim = current->signal->rlim + i;
2504                         initrlim = init_task.signal->rlim + i;
2505                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2506                 }
2507                 task_unlock(current);
2508                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2509         }
2510 }
2511
2512 /*
2513  * Clean up the process immediately after the installation of new credentials
2514  * due to exec
2515  */
2516 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2517 {
2518         const struct task_security_struct *tsec = current_security();
2519         struct itimerval itimer;
2520         u32 osid, sid;
2521         int rc, i;
2522
2523         osid = tsec->osid;
2524         sid = tsec->sid;
2525
2526         if (sid == osid)
2527                 return;
2528
2529         /* Check whether the new SID can inherit signal state from the old SID.
2530          * If not, clear itimers to avoid subsequent signal generation and
2531          * flush and unblock signals.
2532          *
2533          * This must occur _after_ the task SID has been updated so that any
2534          * kill done after the flush will be checked against the new SID.
2535          */
2536         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2537         if (rc) {
2538                 memset(&itimer, 0, sizeof itimer);
2539                 for (i = 0; i < 3; i++)
2540                         do_setitimer(i, &itimer, NULL);
2541                 spin_lock_irq(&current->sighand->siglock);
2542                 if (!fatal_signal_pending(current)) {
2543                         flush_sigqueue(&current->pending);
2544                         flush_sigqueue(&current->signal->shared_pending);
2545                         flush_signal_handlers(current, 1);
2546                         sigemptyset(&current->blocked);
2547                         recalc_sigpending();
2548                 }
2549                 spin_unlock_irq(&current->sighand->siglock);
2550         }
2551
2552         /* Wake up the parent if it is waiting so that it can recheck
2553          * wait permission to the new task SID. */
2554         read_lock(&tasklist_lock);
2555         __wake_up_parent(current, current->real_parent);
2556         read_unlock(&tasklist_lock);
2557 }
2558
2559 /* superblock security operations */
2560
2561 static int selinux_sb_alloc_security(struct super_block *sb)
2562 {
2563         return superblock_alloc_security(sb);
2564 }
2565
2566 static void selinux_sb_free_security(struct super_block *sb)
2567 {
2568         superblock_free_security(sb);
2569 }
2570
2571 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2572 {
2573         if (plen > olen)
2574                 return 0;
2575
2576         return !memcmp(prefix, option, plen);
2577 }
2578
2579 static inline int selinux_option(char *option, int len)
2580 {
2581         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2582                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2583                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2584                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2585                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2586 }
2587
2588 static inline void take_option(char **to, char *from, int *first, int len)
2589 {
2590         if (!*first) {
2591                 **to = ',';
2592                 *to += 1;
2593         } else
2594                 *first = 0;
2595         memcpy(*to, from, len);
2596         *to += len;
2597 }
2598
2599 static inline void take_selinux_option(char **to, char *from, int *first,
2600                                        int len)
2601 {
2602         int current_size = 0;
2603
2604         if (!*first) {
2605                 **to = '|';
2606                 *to += 1;
2607         } else
2608                 *first = 0;
2609
2610         while (current_size < len) {
2611                 if (*from != '"') {
2612                         **to = *from;
2613                         *to += 1;
2614                 }
2615                 from += 1;
2616                 current_size += 1;
2617         }
2618 }
2619
2620 static int selinux_sb_copy_data(char *orig, char *copy)
2621 {
2622         int fnosec, fsec, rc = 0;
2623         char *in_save, *in_curr, *in_end;
2624         char *sec_curr, *nosec_save, *nosec;
2625         int open_quote = 0;
2626
2627         in_curr = orig;
2628         sec_curr = copy;
2629
2630         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2631         if (!nosec) {
2632                 rc = -ENOMEM;
2633                 goto out;
2634         }
2635
2636         nosec_save = nosec;
2637         fnosec = fsec = 1;
2638         in_save = in_end = orig;
2639
2640         do {
2641                 if (*in_end == '"')
2642                         open_quote = !open_quote;
2643                 if ((*in_end == ',' && open_quote == 0) ||
2644                                 *in_end == '\0') {
2645                         int len = in_end - in_curr;
2646
2647                         if (selinux_option(in_curr, len))
2648                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2649                         else
2650                                 take_option(&nosec, in_curr, &fnosec, len);
2651
2652                         in_curr = in_end + 1;
2653                 }
2654         } while (*in_end++);
2655
2656         strcpy(in_save, nosec_save);
2657         free_page((unsigned long)nosec_save);
2658 out:
2659         return rc;
2660 }
2661
2662 static int selinux_sb_remount(struct super_block *sb, void *data)
2663 {
2664         int rc, i, *flags;
2665         struct security_mnt_opts opts;
2666         char *secdata, **mount_options;
2667         struct superblock_security_struct *sbsec = sb->s_security;
2668
2669         if (!(sbsec->flags & SE_SBINITIALIZED))
2670                 return 0;
2671
2672         if (!data)
2673                 return 0;
2674
2675         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2676                 return 0;
2677
2678         security_init_mnt_opts(&opts);
2679         secdata = alloc_secdata();
2680         if (!secdata)
2681                 return -ENOMEM;
2682         rc = selinux_sb_copy_data(data, secdata);
2683         if (rc)
2684                 goto out_free_secdata;
2685
2686         rc = selinux_parse_opts_str(secdata, &opts);
2687         if (rc)
2688                 goto out_free_secdata;
2689
2690         mount_options = opts.mnt_opts;
2691         flags = opts.mnt_opts_flags;
2692
2693         for (i = 0; i < opts.num_mnt_opts; i++) {
2694                 u32 sid;
2695
2696                 if (flags[i] == SBLABEL_MNT)
2697                         continue;
2698                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2699                 if (rc) {
2700                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2701                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2702                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2703                         goto out_free_opts;
2704                 }
2705                 rc = -EINVAL;
2706                 switch (flags[i]) {
2707                 case FSCONTEXT_MNT:
2708                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2709                                 goto out_bad_option;
2710                         break;
2711                 case CONTEXT_MNT:
2712                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2713                                 goto out_bad_option;
2714                         break;
2715                 case ROOTCONTEXT_MNT: {
2716                         struct inode_security_struct *root_isec;
2717                         root_isec = backing_inode_security(sb->s_root);
2718
2719                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2720                                 goto out_bad_option;
2721                         break;
2722                 }
2723                 case DEFCONTEXT_MNT:
2724                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2725                                 goto out_bad_option;
2726                         break;
2727                 default:
2728                         goto out_free_opts;
2729                 }
2730         }
2731
2732         rc = 0;
2733 out_free_opts:
2734         security_free_mnt_opts(&opts);
2735 out_free_secdata:
2736         free_secdata(secdata);
2737         return rc;
2738 out_bad_option:
2739         printk(KERN_WARNING "SELinux: unable to change security options "
2740                "during remount (dev %s, type=%s)\n", sb->s_id,
2741                sb->s_type->name);
2742         goto out_free_opts;
2743 }
2744
2745 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2746 {
2747         const struct cred *cred = current_cred();
2748         struct common_audit_data ad;
2749         int rc;
2750
2751         rc = superblock_doinit(sb, data);
2752         if (rc)
2753                 return rc;
2754
2755         /* Allow all mounts performed by the kernel */
2756         if (flags & MS_KERNMOUNT)
2757                 return 0;
2758
2759         ad.type = LSM_AUDIT_DATA_DENTRY;
2760         ad.u.dentry = sb->s_root;
2761         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2762 }
2763
2764 static int selinux_sb_statfs(struct dentry *dentry)
2765 {
2766         const struct cred *cred = current_cred();
2767         struct common_audit_data ad;
2768
2769         ad.type = LSM_AUDIT_DATA_DENTRY;
2770         ad.u.dentry = dentry->d_sb->s_root;
2771         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2772 }
2773
2774 static int selinux_mount(const char *dev_name,
2775                          struct path *path,
2776                          const char *type,
2777                          unsigned long flags,
2778                          void *data)
2779 {
2780         const struct cred *cred = current_cred();
2781
2782         if (flags & MS_REMOUNT)
2783                 return superblock_has_perm(cred, path->dentry->d_sb,
2784                                            FILESYSTEM__REMOUNT, NULL);
2785         else
2786                 return path_has_perm(cred, path, FILE__MOUNTON);
2787 }
2788
2789 static int selinux_umount(struct vfsmount *mnt, int flags)
2790 {
2791         const struct cred *cred = current_cred();
2792
2793         return superblock_has_perm(cred, mnt->mnt_sb,
2794                                    FILESYSTEM__UNMOUNT, NULL);
2795 }
2796
2797 /* inode security operations */
2798
2799 static int selinux_inode_alloc_security(struct inode *inode)
2800 {
2801         return inode_alloc_security(inode);
2802 }
2803
2804 static void selinux_inode_free_security(struct inode *inode)
2805 {
2806         inode_free_security(inode);
2807 }
2808
2809 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2810                                         struct qstr *name, void **ctx,
2811                                         u32 *ctxlen)
2812 {
2813         u32 newsid;
2814         int rc;
2815
2816         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2817                                            inode_mode_to_security_class(mode),
2818                                            &newsid);
2819         if (rc)
2820                 return rc;
2821
2822         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2823 }
2824
2825 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2826                                        const struct qstr *qstr,
2827                                        const char **name,
2828                                        void **value, size_t *len)
2829 {
2830         const struct task_security_struct *tsec = current_security();
2831         struct superblock_security_struct *sbsec;
2832         u32 sid, newsid, clen;
2833         int rc;
2834         char *context;
2835
2836         sbsec = dir->i_sb->s_security;
2837
2838         sid = tsec->sid;
2839         newsid = tsec->create_sid;
2840
2841         rc = selinux_determine_inode_label(
2842                 dir, qstr,
2843                 inode_mode_to_security_class(inode->i_mode),
2844                 &newsid);
2845         if (rc)
2846                 return rc;
2847
2848         /* Possibly defer initialization to selinux_complete_init. */
2849         if (sbsec->flags & SE_SBINITIALIZED) {
2850                 struct inode_security_struct *isec = inode->i_security;
2851                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2852                 isec->sid = newsid;
2853                 isec->initialized = LABEL_INITIALIZED;
2854         }
2855
2856         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2857                 return -EOPNOTSUPP;
2858
2859         if (name)
2860                 *name = XATTR_SELINUX_SUFFIX;
2861
2862         if (value && len) {
2863                 rc = security_sid_to_context_force(newsid, &context, &clen);
2864                 if (rc)
2865                         return rc;
2866                 *value = context;
2867                 *len = clen;
2868         }
2869
2870         return 0;
2871 }
2872
2873 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2874 {
2875         return may_create(dir, dentry, SECCLASS_FILE);
2876 }
2877
2878 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2879 {
2880         return may_link(dir, old_dentry, MAY_LINK);
2881 }
2882
2883 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2884 {
2885         return may_link(dir, dentry, MAY_UNLINK);
2886 }
2887
2888 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2889 {
2890         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2891 }
2892
2893 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2894 {
2895         return may_create(dir, dentry, SECCLASS_DIR);
2896 }
2897
2898 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2899 {
2900         return may_link(dir, dentry, MAY_RMDIR);
2901 }
2902
2903 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2904 {
2905         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2906 }
2907
2908 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2909                                 struct inode *new_inode, struct dentry *new_dentry)
2910 {
2911         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2912 }
2913
2914 static int selinux_inode_readlink(struct dentry *dentry)
2915 {
2916         const struct cred *cred = current_cred();
2917
2918         return dentry_has_perm(cred, dentry, FILE__READ);
2919 }
2920
2921 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2922                                      bool rcu)
2923 {
2924         const struct cred *cred = current_cred();
2925         struct common_audit_data ad;
2926         struct inode_security_struct *isec;
2927         u32 sid;
2928
2929         validate_creds(cred);
2930
2931         ad.type = LSM_AUDIT_DATA_DENTRY;
2932         ad.u.dentry = dentry;
2933         sid = cred_sid(cred);
2934         isec = inode_security_rcu(inode, rcu);
2935         if (IS_ERR(isec))
2936                 return PTR_ERR(isec);
2937
2938         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2939                                   rcu ? MAY_NOT_BLOCK : 0);
2940 }
2941
2942 static noinline int audit_inode_permission(struct inode *inode,
2943                                            u32 perms, u32 audited, u32 denied,
2944                                            int result,
2945                                            unsigned flags)
2946 {
2947         struct common_audit_data ad;
2948         struct inode_security_struct *isec = inode->i_security;
2949         int rc;
2950
2951         ad.type = LSM_AUDIT_DATA_INODE;
2952         ad.u.inode = inode;
2953
2954         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2955                             audited, denied, result, &ad, flags);
2956         if (rc)
2957                 return rc;
2958         return 0;
2959 }
2960
2961 static int selinux_inode_permission(struct inode *inode, int mask)
2962 {
2963         const struct cred *cred = current_cred();
2964         u32 perms;
2965         bool from_access;
2966         unsigned flags = mask & MAY_NOT_BLOCK;
2967         struct inode_security_struct *isec;
2968         u32 sid;
2969         struct av_decision avd;
2970         int rc, rc2;
2971         u32 audited, denied;
2972
2973         from_access = mask & MAY_ACCESS;
2974         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2975
2976         /* No permission to check.  Existence test. */
2977         if (!mask)
2978                 return 0;
2979
2980         validate_creds(cred);
2981
2982         if (unlikely(IS_PRIVATE(inode)))
2983                 return 0;
2984
2985         perms = file_mask_to_av(inode->i_mode, mask);
2986
2987         sid = cred_sid(cred);
2988         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
2989         if (IS_ERR(isec))
2990                 return PTR_ERR(isec);
2991
2992         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2993         audited = avc_audit_required(perms, &avd, rc,
2994                                      from_access ? FILE__AUDIT_ACCESS : 0,
2995                                      &denied);
2996         if (likely(!audited))
2997                 return rc;
2998
2999         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3000         if (rc2)
3001                 return rc2;
3002         return rc;
3003 }
3004
3005 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3006 {
3007         const struct cred *cred = current_cred();
3008         unsigned int ia_valid = iattr->ia_valid;
3009         __u32 av = FILE__WRITE;
3010
3011         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3012         if (ia_valid & ATTR_FORCE) {
3013                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3014                               ATTR_FORCE);
3015                 if (!ia_valid)
3016                         return 0;
3017         }
3018
3019         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3020                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3021                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3022
3023         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3024                         && !(ia_valid & ATTR_FILE))
3025                 av |= FILE__OPEN;
3026
3027         return dentry_has_perm(cred, dentry, av);
3028 }
3029
3030 static int selinux_inode_getattr(const struct path *path)
3031 {
3032         return path_has_perm(current_cred(), path, FILE__GETATTR);
3033 }
3034
3035 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3036 {
3037         const struct cred *cred = current_cred();
3038
3039         if (!strncmp(name, XATTR_SECURITY_PREFIX,
3040                      sizeof XATTR_SECURITY_PREFIX - 1)) {
3041                 if (!strcmp(name, XATTR_NAME_CAPS)) {
3042                         if (!capable(CAP_SETFCAP))
3043                                 return -EPERM;
3044                 } else if (!capable(CAP_SYS_ADMIN)) {
3045                         /* A different attribute in the security namespace.
3046                            Restrict to administrator. */
3047                         return -EPERM;
3048                 }
3049         }
3050
3051         /* Not an attribute we recognize, so just check the
3052            ordinary setattr permission. */
3053         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3054 }
3055
3056 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3057                                   const void *value, size_t size, int flags)
3058 {
3059         struct inode *inode = d_backing_inode(dentry);
3060         struct inode_security_struct *isec = backing_inode_security(dentry);
3061         struct superblock_security_struct *sbsec;
3062         struct common_audit_data ad;
3063         u32 newsid, sid = current_sid();
3064         int rc = 0;
3065
3066         if (strcmp(name, XATTR_NAME_SELINUX))
3067                 return selinux_inode_setotherxattr(dentry, name);
3068
3069         sbsec = inode->i_sb->s_security;
3070         if (!(sbsec->flags & SBLABEL_MNT))
3071                 return -EOPNOTSUPP;
3072
3073         if (!inode_owner_or_capable(inode))
3074                 return -EPERM;
3075
3076         ad.type = LSM_AUDIT_DATA_DENTRY;
3077         ad.u.dentry = dentry;
3078
3079         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3080                           FILE__RELABELFROM, &ad);
3081         if (rc)
3082                 return rc;
3083
3084         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3085         if (rc == -EINVAL) {
3086                 if (!capable(CAP_MAC_ADMIN)) {
3087                         struct audit_buffer *ab;
3088                         size_t audit_size;
3089                         const char *str;
3090
3091                         /* We strip a nul only if it is at the end, otherwise the
3092                          * context contains a nul and we should audit that */
3093                         if (value) {
3094                                 str = value;
3095                                 if (str[size - 1] == '\0')
3096                                         audit_size = size - 1;
3097                                 else
3098                                         audit_size = size;
3099                         } else {
3100                                 str = "";
3101                                 audit_size = 0;
3102                         }
3103                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3104                         audit_log_format(ab, "op=setxattr invalid_context=");
3105                         audit_log_n_untrustedstring(ab, value, audit_size);
3106                         audit_log_end(ab);
3107
3108                         return rc;
3109                 }
3110                 rc = security_context_to_sid_force(value, size, &newsid);
3111         }
3112         if (rc)
3113                 return rc;
3114
3115         rc = avc_has_perm(sid, newsid, isec->sclass,
3116                           FILE__RELABELTO, &ad);
3117         if (rc)
3118                 return rc;
3119
3120         rc = security_validate_transition(isec->sid, newsid, sid,
3121                                           isec->sclass);
3122         if (rc)
3123                 return rc;
3124
3125         return avc_has_perm(newsid,
3126                             sbsec->sid,
3127                             SECCLASS_FILESYSTEM,
3128                             FILESYSTEM__ASSOCIATE,
3129                             &ad);
3130 }
3131
3132 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3133                                         const void *value, size_t size,
3134                                         int flags)
3135 {
3136         struct inode *inode = d_backing_inode(dentry);
3137         struct inode_security_struct *isec = backing_inode_security(dentry);
3138         u32 newsid;
3139         int rc;
3140
3141         if (strcmp(name, XATTR_NAME_SELINUX)) {
3142                 /* Not an attribute we recognize, so nothing to do. */
3143                 return;
3144         }
3145
3146         rc = security_context_to_sid_force(value, size, &newsid);
3147         if (rc) {
3148                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3149                        "for (%s, %lu), rc=%d\n",
3150                        inode->i_sb->s_id, inode->i_ino, -rc);
3151                 return;
3152         }
3153
3154         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3155         isec->sid = newsid;
3156         isec->initialized = LABEL_INITIALIZED;
3157
3158         return;
3159 }
3160
3161 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3162 {
3163         const struct cred *cred = current_cred();
3164
3165         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3166 }
3167
3168 static int selinux_inode_listxattr(struct dentry *dentry)
3169 {
3170         const struct cred *cred = current_cred();
3171
3172         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3173 }
3174
3175 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3176 {
3177         if (strcmp(name, XATTR_NAME_SELINUX))
3178                 return selinux_inode_setotherxattr(dentry, name);
3179
3180         /* No one is allowed to remove a SELinux security label.
3181            You can change the label, but all data must be labeled. */
3182         return -EACCES;
3183 }
3184
3185 /*
3186  * Copy the inode security context value to the user.
3187  *
3188  * Permission check is handled by selinux_inode_getxattr hook.
3189  */
3190 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3191 {
3192         u32 size;
3193         int error;
3194         char *context = NULL;
3195         struct inode_security_struct *isec = inode_security(inode);
3196
3197         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3198                 return -EOPNOTSUPP;
3199
3200         /*
3201          * If the caller has CAP_MAC_ADMIN, then get the raw context
3202          * value even if it is not defined by current policy; otherwise,
3203          * use the in-core value under current policy.
3204          * Use the non-auditing forms of the permission checks since
3205          * getxattr may be called by unprivileged processes commonly
3206          * and lack of permission just means that we fall back to the
3207          * in-core context value, not a denial.
3208          */
3209         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3210                             SECURITY_CAP_NOAUDIT);
3211         if (!error)
3212                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3213                                             SECURITY_CAP_NOAUDIT);
3214         if (!error)
3215                 error = security_sid_to_context_force(isec->sid, &context,
3216                                                       &size);
3217         else
3218                 error = security_sid_to_context(isec->sid, &context, &size);
3219         if (error)
3220                 return error;
3221         error = size;
3222         if (alloc) {
3223                 *buffer = context;
3224                 goto out_nofree;
3225         }
3226         kfree(context);
3227 out_nofree:
3228         return error;
3229 }
3230
3231 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3232                                      const void *value, size_t size, int flags)
3233 {
3234         struct inode_security_struct *isec = inode_security_novalidate(inode);
3235         u32 newsid;
3236         int rc;
3237
3238         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3239                 return -EOPNOTSUPP;
3240
3241         if (!value || !size)
3242                 return -EACCES;
3243
3244         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3245         if (rc)
3246                 return rc;
3247
3248         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3249         isec->sid = newsid;
3250         isec->initialized = LABEL_INITIALIZED;
3251         return 0;
3252 }
3253
3254 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3255 {
3256         const int len = sizeof(XATTR_NAME_SELINUX);
3257         if (buffer && len <= buffer_size)
3258                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3259         return len;
3260 }
3261
3262 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3263 {
3264         struct inode_security_struct *isec = inode_security_novalidate(inode);
3265         *secid = isec->sid;
3266 }
3267
3268 /* file security operations */
3269
3270 static int selinux_revalidate_file_permission(struct file *file, int mask)
3271 {
3272         const struct cred *cred = current_cred();
3273         struct inode *inode = file_inode(file);
3274
3275         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3276         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3277                 mask |= MAY_APPEND;
3278
3279         return file_has_perm(cred, file,
3280                              file_mask_to_av(inode->i_mode, mask));
3281 }
3282
3283 static int selinux_file_permission(struct file *file, int mask)
3284 {
3285         struct inode *inode = file_inode(file);
3286         struct file_security_struct *fsec = file->f_security;
3287         struct inode_security_struct *isec;
3288         u32 sid = current_sid();
3289
3290         if (!mask)
3291                 /* No permission to check.  Existence test. */
3292                 return 0;
3293
3294         isec = inode_security(inode);
3295         if (sid == fsec->sid && fsec->isid == isec->sid &&
3296             fsec->pseqno == avc_policy_seqno())
3297                 /* No change since file_open check. */
3298                 return 0;
3299
3300         return selinux_revalidate_file_permission(file, mask);
3301 }
3302
3303 static int selinux_file_alloc_security(struct file *file)
3304 {
3305         return file_alloc_security(file);
3306 }
3307
3308 static void selinux_file_free_security(struct file *file)
3309 {
3310         file_free_security(file);
3311 }
3312
3313 /*
3314  * Check whether a task has the ioctl permission and cmd
3315  * operation to an inode.
3316  */
3317 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3318                 u32 requested, u16 cmd)
3319 {
3320         struct common_audit_data ad;
3321         struct file_security_struct *fsec = file->f_security;
3322         struct inode *inode = file_inode(file);
3323         struct inode_security_struct *isec = inode_security(inode);
3324         struct lsm_ioctlop_audit ioctl;
3325         u32 ssid = cred_sid(cred);
3326         int rc;
3327         u8 driver = cmd >> 8;
3328         u8 xperm = cmd & 0xff;
3329
3330         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3331         ad.u.op = &ioctl;
3332         ad.u.op->cmd = cmd;
3333         ad.u.op->path = file->f_path;
3334
3335         if (ssid != fsec->sid) {
3336                 rc = avc_has_perm(ssid, fsec->sid,
3337                                 SECCLASS_FD,
3338                                 FD__USE,
3339                                 &ad);
3340                 if (rc)
3341                         goto out;
3342         }
3343
3344         if (unlikely(IS_PRIVATE(inode)))
3345                 return 0;
3346
3347         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3348                         requested, driver, xperm, &ad);
3349 out:
3350         return rc;
3351 }
3352
3353 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3354                               unsigned long arg)
3355 {
3356         const struct cred *cred = current_cred();
3357         int error = 0;
3358
3359         switch (cmd) {
3360         case FIONREAD:
3361         /* fall through */
3362         case FIBMAP:
3363         /* fall through */
3364         case FIGETBSZ:
3365         /* fall through */
3366         case FS_IOC_GETFLAGS:
3367         /* fall through */
3368         case FS_IOC_GETVERSION:
3369                 error = file_has_perm(cred, file, FILE__GETATTR);
3370                 break;
3371
3372         case FS_IOC_SETFLAGS:
3373         /* fall through */
3374         case FS_IOC_SETVERSION:
3375                 error = file_has_perm(cred, file, FILE__SETATTR);
3376                 break;
3377
3378         /* sys_ioctl() checks */
3379         case FIONBIO:
3380         /* fall through */
3381         case FIOASYNC:
3382                 error = file_has_perm(cred, file, 0);
3383                 break;
3384
3385         case KDSKBENT:
3386         case KDSKBSENT:
3387                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3388                                             SECURITY_CAP_AUDIT);
3389                 break;
3390
3391         /* default case assumes that the command will go
3392          * to the file's ioctl() function.
3393          */
3394         default:
3395                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3396         }
3397         return error;
3398 }
3399
3400 static int default_noexec;
3401
3402 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3403 {
3404         const struct cred *cred = current_cred();
3405         int rc = 0;
3406
3407         if (default_noexec &&
3408             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3409                                    (!shared && (prot & PROT_WRITE)))) {
3410                 /*
3411                  * We are making executable an anonymous mapping or a
3412                  * private file mapping that will also be writable.
3413                  * This has an additional check.
3414                  */
3415                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3416                 if (rc)
3417                         goto error;
3418         }
3419
3420         if (file) {
3421                 /* read access is always possible with a mapping */
3422                 u32 av = FILE__READ;
3423
3424                 /* write access only matters if the mapping is shared */
3425                 if (shared && (prot & PROT_WRITE))
3426                         av |= FILE__WRITE;
3427
3428                 if (prot & PROT_EXEC)
3429                         av |= FILE__EXECUTE;
3430
3431                 return file_has_perm(cred, file, av);
3432         }
3433
3434 error:
3435         return rc;
3436 }
3437
3438 static int selinux_mmap_addr(unsigned long addr)
3439 {
3440         int rc = 0;
3441
3442         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3443                 u32 sid = current_sid();
3444                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3445                                   MEMPROTECT__MMAP_ZERO, NULL);
3446         }
3447
3448         return rc;
3449 }
3450
3451 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3452                              unsigned long prot, unsigned long flags)
3453 {
3454         if (selinux_checkreqprot)
3455                 prot = reqprot;
3456
3457         return file_map_prot_check(file, prot,
3458                                    (flags & MAP_TYPE) == MAP_SHARED);
3459 }
3460
3461 static int selinux_file_mprotect(struct vm_area_struct *vma,
3462                                  unsigned long reqprot,
3463                                  unsigned long prot)
3464 {
3465         const struct cred *cred = current_cred();
3466
3467         if (selinux_checkreqprot)
3468                 prot = reqprot;
3469
3470         if (default_noexec &&
3471             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3472                 int rc = 0;
3473                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3474                     vma->vm_end <= vma->vm_mm->brk) {
3475                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3476                 } else if (!vma->vm_file &&
3477                            vma->vm_start <= vma->vm_mm->start_stack &&
3478                            vma->vm_end >= vma->vm_mm->start_stack) {
3479                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3480                 } else if (vma->vm_file && vma->anon_vma) {
3481                         /*
3482                          * We are making executable a file mapping that has
3483                          * had some COW done. Since pages might have been
3484                          * written, check ability to execute the possibly
3485                          * modified content.  This typically should only
3486                          * occur for text relocations.
3487                          */
3488                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3489                 }
3490                 if (rc)
3491                         return rc;
3492         }
3493
3494         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3495 }
3496
3497 static int selinux_file_lock(struct file *file, unsigned int cmd)
3498 {
3499         const struct cred *cred = current_cred();
3500
3501         return file_has_perm(cred, file, FILE__LOCK);
3502 }
3503
3504 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3505                               unsigned long arg)
3506 {
3507         const struct cred *cred = current_cred();
3508         int err = 0;
3509
3510         switch (cmd) {
3511         case F_SETFL:
3512                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3513                         err = file_has_perm(cred, file, FILE__WRITE);
3514                         break;
3515                 }
3516                 /* fall through */
3517         case F_SETOWN:
3518         case F_SETSIG:
3519         case F_GETFL:
3520         case F_GETOWN:
3521         case F_GETSIG:
3522         case F_GETOWNER_UIDS:
3523                 /* Just check FD__USE permission */
3524                 err = file_has_perm(cred, file, 0);
3525                 break;
3526         case F_GETLK:
3527         case F_SETLK:
3528         case F_SETLKW:
3529         case F_OFD_GETLK:
3530         case F_OFD_SETLK:
3531         case F_OFD_SETLKW:
3532 #if BITS_PER_LONG == 32
3533         case F_GETLK64:
3534         case F_SETLK64:
3535         case F_SETLKW64:
3536 #endif
3537                 err = file_has_perm(cred, file, FILE__LOCK);
3538                 break;
3539         }
3540
3541         return err;
3542 }
3543
3544 static void selinux_file_set_fowner(struct file *file)
3545 {
3546         struct file_security_struct *fsec;
3547
3548         fsec = file->f_security;
3549         fsec->fown_sid = current_sid();
3550 }
3551
3552 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3553                                        struct fown_struct *fown, int signum)
3554 {
3555         struct file *file;
3556         u32 sid = task_sid(tsk);
3557         u32 perm;
3558         struct file_security_struct *fsec;
3559
3560         /* struct fown_struct is never outside the context of a struct file */
3561         file = container_of(fown, struct file, f_owner);
3562
3563         fsec = file->f_security;
3564
3565         if (!signum)
3566                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3567         else
3568                 perm = signal_to_av(signum);
3569
3570         return avc_has_perm(fsec->fown_sid, sid,
3571                             SECCLASS_PROCESS, perm, NULL);
3572 }
3573
3574 static int selinux_file_receive(struct file *file)
3575 {
3576         const struct cred *cred = current_cred();
3577
3578         return file_has_perm(cred, file, file_to_av(file));
3579 }
3580
3581 static int selinux_file_open(struct file *file, const struct cred *cred)
3582 {
3583         struct file_security_struct *fsec;
3584         struct inode_security_struct *isec;
3585
3586         fsec = file->f_security;
3587         isec = inode_security(file_inode(file));
3588         /*
3589          * Save inode label and policy sequence number
3590          * at open-time so that selinux_file_permission
3591          * can determine whether revalidation is necessary.
3592          * Task label is already saved in the file security
3593          * struct as its SID.
3594          */
3595         fsec->isid = isec->sid;
3596         fsec->pseqno = avc_policy_seqno();
3597         /*
3598          * Since the inode label or policy seqno may have changed
3599          * between the selinux_inode_permission check and the saving
3600          * of state above, recheck that access is still permitted.
3601          * Otherwise, access might never be revalidated against the
3602          * new inode label or new policy.
3603          * This check is not redundant - do not remove.
3604          */
3605         return file_path_has_perm(cred, file, open_file_to_av(file));
3606 }
3607
3608 /* task security operations */
3609
3610 static int selinux_task_create(unsigned long clone_flags)
3611 {
3612         return current_has_perm(current, PROCESS__FORK);
3613 }
3614
3615 /*
3616  * allocate the SELinux part of blank credentials
3617  */
3618 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3619 {
3620         struct task_security_struct *tsec;
3621
3622         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3623         if (!tsec)
3624                 return -ENOMEM;
3625
3626         cred->security = tsec;
3627         return 0;
3628 }
3629
3630 /*
3631  * detach and free the LSM part of a set of credentials
3632  */
3633 static void selinux_cred_free(struct cred *cred)
3634 {
3635         struct task_security_struct *tsec = cred->security;
3636
3637         /*
3638          * cred->security == NULL if security_cred_alloc_blank() or
3639          * security_prepare_creds() returned an error.
3640          */
3641         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3642         cred->security = (void *) 0x7UL;
3643         kfree(tsec);
3644 }
3645
3646 /*
3647  * prepare a new set of credentials for modification
3648  */
3649 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3650                                 gfp_t gfp)
3651 {
3652         const struct task_security_struct *old_tsec;
3653         struct task_security_struct *tsec;
3654
3655         old_tsec = old->security;
3656
3657         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3658         if (!tsec)
3659                 return -ENOMEM;
3660
3661         new->security = tsec;
3662         return 0;
3663 }
3664
3665 /*
3666  * transfer the SELinux data to a blank set of creds
3667  */
3668 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3669 {
3670         const struct task_security_struct *old_tsec = old->security;
3671         struct task_security_struct *tsec = new->security;
3672
3673         *tsec = *old_tsec;
3674 }
3675
3676 /*
3677  * set the security data for a kernel service
3678  * - all the creation contexts are set to unlabelled
3679  */
3680 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3681 {
3682         struct task_security_struct *tsec = new->security;
3683         u32 sid = current_sid();
3684         int ret;
3685
3686         ret = avc_has_perm(sid, secid,
3687                            SECCLASS_KERNEL_SERVICE,
3688                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3689                            NULL);
3690         if (ret == 0) {
3691                 tsec->sid = secid;
3692                 tsec->create_sid = 0;
3693                 tsec->keycreate_sid = 0;
3694                 tsec->sockcreate_sid = 0;
3695         }
3696         return ret;
3697 }
3698
3699 /*
3700  * set the file creation context in a security record to the same as the
3701  * objective context of the specified inode
3702  */
3703 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3704 {
3705         struct inode_security_struct *isec = inode_security(inode);
3706         struct task_security_struct *tsec = new->security;
3707         u32 sid = current_sid();
3708         int ret;
3709
3710         ret = avc_has_perm(sid, isec->sid,
3711                            SECCLASS_KERNEL_SERVICE,
3712                            KERNEL_SERVICE__CREATE_FILES_AS,
3713                            NULL);
3714
3715         if (ret == 0)
3716                 tsec->create_sid = isec->sid;
3717         return ret;
3718 }
3719
3720 static int selinux_kernel_module_request(char *kmod_name)
3721 {
3722         u32 sid;
3723         struct common_audit_data ad;
3724
3725         sid = task_sid(current);
3726
3727         ad.type = LSM_AUDIT_DATA_KMOD;
3728         ad.u.kmod_name = kmod_name;
3729
3730         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3731                             SYSTEM__MODULE_REQUEST, &ad);
3732 }
3733
3734 static int selinux_kernel_module_from_file(struct file *file)
3735 {
3736         struct common_audit_data ad;
3737         struct inode_security_struct *isec;
3738         struct file_security_struct *fsec;
3739         u32 sid = current_sid();
3740         int rc;
3741
3742         /* init_module */
3743         if (file == NULL)
3744                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3745                                         SYSTEM__MODULE_LOAD, NULL);
3746
3747         /* finit_module */
3748         ad.type = LSM_AUDIT_DATA_PATH;
3749         ad.u.path = file->f_path;
3750
3751         isec = inode_security(file_inode(file));
3752         fsec = file->f_security;
3753
3754         if (sid != fsec->sid) {
3755                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3756                 if (rc)
3757                         return rc;
3758         }
3759
3760         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3761                                 SYSTEM__MODULE_LOAD, &ad);
3762 }
3763
3764 static int selinux_kernel_read_file(struct file *file,
3765                                     enum kernel_read_file_id id)
3766 {
3767         int rc = 0;
3768
3769         switch (id) {
3770         case READING_MODULE:
3771                 rc = selinux_kernel_module_from_file(file);
3772                 break;
3773         default:
3774                 break;
3775         }
3776
3777         return rc;
3778 }
3779
3780 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3781 {
3782         return current_has_perm(p, PROCESS__SETPGID);
3783 }
3784
3785 static int selinux_task_getpgid(struct task_struct *p)
3786 {
3787         return current_has_perm(p, PROCESS__GETPGID);
3788 }
3789
3790 static int selinux_task_getsid(struct task_struct *p)
3791 {
3792         return current_has_perm(p, PROCESS__GETSESSION);
3793 }
3794
3795 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3796 {
3797         *secid = task_sid(p);
3798 }
3799
3800 static int selinux_task_setnice(struct task_struct *p, int nice)
3801 {
3802         return current_has_perm(p, PROCESS__SETSCHED);
3803 }
3804
3805 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3806 {
3807         return current_has_perm(p, PROCESS__SETSCHED);
3808 }
3809
3810 static int selinux_task_getioprio(struct task_struct *p)
3811 {
3812         return current_has_perm(p, PROCESS__GETSCHED);
3813 }
3814
3815 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3816                 struct rlimit *new_rlim)
3817 {
3818         struct rlimit *old_rlim = p->signal->rlim + resource;
3819
3820         /* Control the ability to change the hard limit (whether
3821            lowering or raising it), so that the hard limit can
3822            later be used as a safe reset point for the soft limit
3823            upon context transitions.  See selinux_bprm_committing_creds. */
3824         if (old_rlim->rlim_max != new_rlim->rlim_max)
3825                 return current_has_perm(p, PROCESS__SETRLIMIT);
3826
3827         return 0;
3828 }
3829
3830 static int selinux_task_setscheduler(struct task_struct *p)
3831 {
3832         return current_has_perm(p, PROCESS__SETSCHED);
3833 }
3834
3835 static int selinux_task_getscheduler(struct task_struct *p)
3836 {
3837         return current_has_perm(p, PROCESS__GETSCHED);
3838 }
3839
3840 static int selinux_task_movememory(struct task_struct *p)
3841 {
3842         return current_has_perm(p, PROCESS__SETSCHED);
3843 }
3844
3845 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3846                                 int sig, u32 secid)
3847 {
3848         u32 perm;
3849         int rc;
3850
3851         if (!sig)
3852                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3853         else
3854                 perm = signal_to_av(sig);
3855         if (secid)
3856                 rc = avc_has_perm(secid, task_sid(p),
3857                                   SECCLASS_PROCESS, perm, NULL);
3858         else
3859                 rc = current_has_perm(p, perm);
3860         return rc;
3861 }
3862
3863 static int selinux_task_wait(struct task_struct *p)
3864 {
3865         return task_has_perm(p, current, PROCESS__SIGCHLD);
3866 }
3867
3868 static void selinux_task_to_inode(struct task_struct *p,
3869                                   struct inode *inode)
3870 {
3871         struct inode_security_struct *isec = inode->i_security;
3872         u32 sid = task_sid(p);
3873
3874         isec->sid = sid;
3875         isec->initialized = LABEL_INITIALIZED;
3876 }
3877
3878 /* Returns error only if unable to parse addresses */
3879 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3880                         struct common_audit_data *ad, u8 *proto)
3881 {
3882         int offset, ihlen, ret = -EINVAL;
3883         struct iphdr _iph, *ih;
3884
3885         offset = skb_network_offset(skb);
3886         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3887         if (ih == NULL)
3888                 goto out;
3889
3890         ihlen = ih->ihl * 4;
3891         if (ihlen < sizeof(_iph))
3892                 goto out;
3893
3894         ad->u.net->v4info.saddr = ih->saddr;
3895         ad->u.net->v4info.daddr = ih->daddr;
3896         ret = 0;
3897
3898         if (proto)
3899                 *proto = ih->protocol;
3900
3901         switch (ih->protocol) {
3902         case IPPROTO_TCP: {
3903                 struct tcphdr _tcph, *th;
3904
3905                 if (ntohs(ih->frag_off) & IP_OFFSET)
3906                         break;
3907
3908                 offset += ihlen;
3909                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3910                 if (th == NULL)
3911                         break;
3912
3913                 ad->u.net->sport = th->source;
3914                 ad->u.net->dport = th->dest;
3915                 break;
3916         }
3917
3918         case IPPROTO_UDP: {
3919                 struct udphdr _udph, *uh;
3920
3921                 if (ntohs(ih->frag_off) & IP_OFFSET)
3922                         break;
3923
3924                 offset += ihlen;
3925                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3926                 if (uh == NULL)
3927                         break;
3928
3929                 ad->u.net->sport = uh->source;
3930                 ad->u.net->dport = uh->dest;
3931                 break;
3932         }
3933
3934         case IPPROTO_DCCP: {
3935                 struct dccp_hdr _dccph, *dh;
3936
3937                 if (ntohs(ih->frag_off) & IP_OFFSET)
3938                         break;
3939
3940                 offset += ihlen;
3941                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3942                 if (dh == NULL)
3943                         break;
3944
3945                 ad->u.net->sport = dh->dccph_sport;
3946                 ad->u.net->dport = dh->dccph_dport;
3947                 break;
3948         }
3949
3950         default:
3951                 break;
3952         }
3953 out:
3954         return ret;
3955 }
3956
3957 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3958
3959 /* Returns error only if unable to parse addresses */
3960 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3961                         struct common_audit_data *ad, u8 *proto)
3962 {
3963         u8 nexthdr;
3964         int ret = -EINVAL, offset;
3965         struct ipv6hdr _ipv6h, *ip6;
3966         __be16 frag_off;
3967
3968         offset = skb_network_offset(skb);
3969         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3970         if (ip6 == NULL)
3971                 goto out;
3972
3973         ad->u.net->v6info.saddr = ip6->saddr;
3974         ad->u.net->v6info.daddr = ip6->daddr;
3975         ret = 0;
3976
3977         nexthdr = ip6->nexthdr;
3978         offset += sizeof(_ipv6h);
3979         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3980         if (offset < 0)
3981                 goto out;
3982
3983         if (proto)
3984                 *proto = nexthdr;
3985
3986         switch (nexthdr) {
3987         case IPPROTO_TCP: {
3988                 struct tcphdr _tcph, *th;
3989
3990                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3991                 if (th == NULL)
3992                         break;
3993
3994                 ad->u.net->sport = th->source;
3995                 ad->u.net->dport = th->dest;
3996                 break;
3997         }
3998
3999         case IPPROTO_UDP: {
4000                 struct udphdr _udph, *uh;
4001
4002                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4003                 if (uh == NULL)
4004                         break;
4005
4006                 ad->u.net->sport = uh->source;
4007                 ad->u.net->dport = uh->dest;
4008                 break;
4009         }
4010
4011         case IPPROTO_DCCP: {
4012                 struct dccp_hdr _dccph, *dh;
4013
4014                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4015                 if (dh == NULL)
4016                         break;
4017
4018                 ad->u.net->sport = dh->dccph_sport;
4019                 ad->u.net->dport = dh->dccph_dport;
4020                 break;
4021         }
4022
4023         /* includes fragments */
4024         default:
4025                 break;
4026         }
4027 out:
4028         return ret;
4029 }
4030
4031 #endif /* IPV6 */
4032
4033 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4034                              char **_addrp, int src, u8 *proto)
4035 {
4036         char *addrp;
4037         int ret;
4038
4039         switch (ad->u.net->family) {
4040         case PF_INET:
4041                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4042                 if (ret)
4043                         goto parse_error;
4044                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4045                                        &ad->u.net->v4info.daddr);
4046                 goto okay;
4047
4048 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4049         case PF_INET6:
4050                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4051                 if (ret)
4052                         goto parse_error;
4053                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4054                                        &ad->u.net->v6info.daddr);
4055                 goto okay;
4056 #endif  /* IPV6 */
4057         default:
4058                 addrp = NULL;
4059                 goto okay;
4060         }
4061
4062 parse_error:
4063         printk(KERN_WARNING
4064                "SELinux: failure in selinux_parse_skb(),"
4065                " unable to parse packet\n");
4066         return ret;
4067
4068 okay:
4069         if (_addrp)
4070                 *_addrp = addrp;
4071         return 0;
4072 }
4073
4074 /**
4075  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4076  * @skb: the packet
4077  * @family: protocol family
4078  * @sid: the packet's peer label SID
4079  *
4080  * Description:
4081  * Check the various different forms of network peer labeling and determine
4082  * the peer label/SID for the packet; most of the magic actually occurs in
4083  * the security server function security_net_peersid_cmp().  The function
4084  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4085  * or -EACCES if @sid is invalid due to inconsistencies with the different
4086  * peer labels.
4087  *
4088  */
4089 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4090 {
4091         int err;
4092         u32 xfrm_sid;
4093         u32 nlbl_sid;
4094         u32 nlbl_type;
4095
4096         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4097         if (unlikely(err))
4098                 return -EACCES;
4099         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4100         if (unlikely(err))
4101                 return -EACCES;
4102
4103         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4104         if (unlikely(err)) {
4105                 printk(KERN_WARNING
4106                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4107                        " unable to determine packet's peer label\n");
4108                 return -EACCES;
4109         }
4110
4111         return 0;
4112 }
4113
4114 /**
4115  * selinux_conn_sid - Determine the child socket label for a connection
4116  * @sk_sid: the parent socket's SID
4117  * @skb_sid: the packet's SID
4118  * @conn_sid: the resulting connection SID
4119  *
4120  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4121  * combined with the MLS information from @skb_sid in order to create
4122  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4123  * of @sk_sid.  Returns zero on success, negative values on failure.
4124  *
4125  */
4126 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4127 {
4128         int err = 0;
4129
4130         if (skb_sid != SECSID_NULL)
4131                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4132         else
4133                 *conn_sid = sk_sid;
4134
4135         return err;
4136 }
4137
4138 /* socket security operations */
4139
4140 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4141                                  u16 secclass, u32 *socksid)
4142 {
4143         if (tsec->sockcreate_sid > SECSID_NULL) {
4144                 *socksid = tsec->sockcreate_sid;
4145                 return 0;
4146         }
4147
4148         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4149                                        socksid);
4150 }
4151
4152 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4153 {
4154         struct sk_security_struct *sksec = sk->sk_security;
4155         struct common_audit_data ad;
4156         struct lsm_network_audit net = {0,};
4157         u32 tsid = task_sid(task);
4158
4159         if (sksec->sid == SECINITSID_KERNEL)
4160                 return 0;
4161
4162         ad.type = LSM_AUDIT_DATA_NET;
4163         ad.u.net = &net;
4164         ad.u.net->sk = sk;
4165
4166         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4167 }
4168
4169 static int selinux_socket_create(int family, int type,
4170                                  int protocol, int kern)
4171 {
4172         const struct task_security_struct *tsec = current_security();
4173         u32 newsid;
4174         u16 secclass;
4175         int rc;
4176
4177         if (kern)
4178                 return 0;
4179
4180         secclass = socket_type_to_security_class(family, type, protocol);
4181         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4182         if (rc)
4183                 return rc;
4184
4185         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4186 }
4187
4188 static int selinux_socket_post_create(struct socket *sock, int family,
4189                                       int type, int protocol, int kern)
4190 {
4191         const struct task_security_struct *tsec = current_security();
4192         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4193         struct sk_security_struct *sksec;
4194         int err = 0;
4195
4196         isec->sclass = socket_type_to_security_class(family, type, protocol);
4197
4198         if (kern)
4199                 isec->sid = SECINITSID_KERNEL;
4200         else {
4201                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4202                 if (err)
4203                         return err;
4204         }
4205
4206         isec->initialized = LABEL_INITIALIZED;
4207
4208         if (sock->sk) {
4209                 sksec = sock->sk->sk_security;
4210                 sksec->sid = isec->sid;
4211                 sksec->sclass = isec->sclass;
4212                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4213         }
4214
4215         return err;
4216 }
4217
4218 /* Range of port numbers used to automatically bind.
4219    Need to determine whether we should perform a name_bind
4220    permission check between the socket and the port number. */
4221
4222 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4223 {
4224         struct sock *sk = sock->sk;
4225         u16 family;
4226         int err;
4227
4228         err = sock_has_perm(current, sk, SOCKET__BIND);
4229         if (err)
4230                 goto out;
4231
4232         /*
4233          * If PF_INET or PF_INET6, check name_bind permission for the port.
4234          * Multiple address binding for SCTP is not supported yet: we just
4235          * check the first address now.
4236          */
4237         family = sk->sk_family;
4238         if (family == PF_INET || family == PF_INET6) {
4239                 char *addrp;
4240                 struct sk_security_struct *sksec = sk->sk_security;
4241                 struct common_audit_data ad;
4242                 struct lsm_network_audit net = {0,};
4243                 struct sockaddr_in *addr4 = NULL;
4244                 struct sockaddr_in6 *addr6 = NULL;
4245                 unsigned short snum;
4246                 u32 sid, node_perm;
4247
4248                 if (family == PF_INET) {
4249                         addr4 = (struct sockaddr_in *)address;
4250                         snum = ntohs(addr4->sin_port);
4251                         addrp = (char *)&addr4->sin_addr.s_addr;
4252                 } else {
4253                         addr6 = (struct sockaddr_in6 *)address;
4254                         snum = ntohs(addr6->sin6_port);
4255                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4256                 }
4257
4258                 if (snum) {
4259                         int low, high;
4260
4261                         inet_get_local_port_range(sock_net(sk), &low, &high);
4262
4263                         if (snum < max(PROT_SOCK, low) || snum > high) {
4264                                 err = sel_netport_sid(sk->sk_protocol,
4265                                                       snum, &sid);
4266                                 if (err)
4267                                         goto out;
4268                                 ad.type = LSM_AUDIT_DATA_NET;
4269                                 ad.u.net = &net;
4270                                 ad.u.net->sport = htons(snum);
4271                                 ad.u.net->family = family;
4272                                 err = avc_has_perm(sksec->sid, sid,
4273                                                    sksec->sclass,
4274                                                    SOCKET__NAME_BIND, &ad);
4275                                 if (err)
4276                                         goto out;
4277                         }
4278                 }
4279
4280                 switch (sksec->sclass) {
4281                 case SECCLASS_TCP_SOCKET:
4282                         node_perm = TCP_SOCKET__NODE_BIND;
4283                         break;
4284
4285                 case SECCLASS_UDP_SOCKET:
4286                         node_perm = UDP_SOCKET__NODE_BIND;
4287                         break;
4288
4289                 case SECCLASS_DCCP_SOCKET:
4290                         node_perm = DCCP_SOCKET__NODE_BIND;
4291                         break;
4292
4293                 default:
4294                         node_perm = RAWIP_SOCKET__NODE_BIND;
4295                         break;
4296                 }
4297
4298                 err = sel_netnode_sid(addrp, family, &sid);
4299                 if (err)
4300                         goto out;
4301
4302                 ad.type = LSM_AUDIT_DATA_NET;
4303                 ad.u.net = &net;
4304                 ad.u.net->sport = htons(snum);
4305                 ad.u.net->family = family;
4306
4307                 if (family == PF_INET)
4308                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4309                 else
4310                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4311
4312                 err = avc_has_perm(sksec->sid, sid,
4313                                    sksec->sclass, node_perm, &ad);
4314                 if (err)
4315                         goto out;
4316         }
4317 out:
4318         return err;
4319 }
4320
4321 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4322 {
4323         struct sock *sk = sock->sk;
4324         struct sk_security_struct *sksec = sk->sk_security;
4325         int err;
4326
4327         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4328         if (err)
4329                 return err;
4330
4331         /*
4332          * If a TCP or DCCP socket, check name_connect permission for the port.
4333          */
4334         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4335             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4336                 struct common_audit_data ad;
4337                 struct lsm_network_audit net = {0,};
4338                 struct sockaddr_in *addr4 = NULL;
4339                 struct sockaddr_in6 *addr6 = NULL;
4340                 unsigned short snum;
4341                 u32 sid, perm;
4342
4343                 if (sk->sk_family == PF_INET) {
4344                         addr4 = (struct sockaddr_in *)address;
4345                         if (addrlen < sizeof(struct sockaddr_in))
4346                                 return -EINVAL;
4347                         snum = ntohs(addr4->sin_port);
4348                 } else {
4349                         addr6 = (struct sockaddr_in6 *)address;
4350                         if (addrlen < SIN6_LEN_RFC2133)
4351                                 return -EINVAL;
4352                         snum = ntohs(addr6->sin6_port);
4353                 }
4354
4355                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4356                 if (err)
4357                         goto out;
4358
4359                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4360                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4361
4362                 ad.type = LSM_AUDIT_DATA_NET;
4363                 ad.u.net = &net;
4364                 ad.u.net->dport = htons(snum);
4365                 ad.u.net->family = sk->sk_family;
4366                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4367                 if (err)
4368                         goto out;
4369         }
4370
4371         err = selinux_netlbl_socket_connect(sk, address);
4372
4373 out:
4374         return err;
4375 }
4376
4377 static int selinux_socket_listen(struct socket *sock, int backlog)
4378 {
4379         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4380 }
4381
4382 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4383 {
4384         int err;
4385         struct inode_security_struct *isec;
4386         struct inode_security_struct *newisec;
4387
4388         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4389         if (err)
4390                 return err;
4391
4392         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4393
4394         isec = inode_security_novalidate(SOCK_INODE(sock));
4395         newisec->sclass = isec->sclass;
4396         newisec->sid = isec->sid;
4397         newisec->initialized = LABEL_INITIALIZED;
4398
4399         return 0;
4400 }
4401
4402 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4403                                   int size)
4404 {
4405         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4406 }
4407
4408 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4409                                   int size, int flags)
4410 {
4411         return sock_has_perm(current, sock->sk, SOCKET__READ);
4412 }
4413
4414 static int selinux_socket_getsockname(struct socket *sock)
4415 {
4416         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4417 }
4418
4419 static int selinux_socket_getpeername(struct socket *sock)
4420 {
4421         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4422 }
4423
4424 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4425 {
4426         int err;
4427
4428         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4429         if (err)
4430                 return err;
4431
4432         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4433 }
4434
4435 static int selinux_socket_getsockopt(struct socket *sock, int level,
4436                                      int optname)
4437 {
4438         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4439 }
4440
4441 static int selinux_socket_shutdown(struct socket *sock, int how)
4442 {
4443         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4444 }
4445
4446 static int selinux_socket_unix_stream_connect(struct sock *sock,
4447                                               struct sock *other,
4448                                               struct sock *newsk)
4449 {
4450         struct sk_security_struct *sksec_sock = sock->sk_security;
4451         struct sk_security_struct *sksec_other = other->sk_security;
4452         struct sk_security_struct *sksec_new = newsk->sk_security;
4453         struct common_audit_data ad;
4454         struct lsm_network_audit net = {0,};
4455         int err;
4456
4457         ad.type = LSM_AUDIT_DATA_NET;
4458         ad.u.net = &net;
4459         ad.u.net->sk = other;
4460
4461         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4462                            sksec_other->sclass,
4463                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4464         if (err)
4465                 return err;
4466
4467         /* server child socket */
4468         sksec_new->peer_sid = sksec_sock->sid;
4469         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4470                                     &sksec_new->sid);
4471         if (err)
4472                 return err;
4473
4474         /* connecting socket */
4475         sksec_sock->peer_sid = sksec_new->sid;
4476
4477         return 0;
4478 }
4479
4480 static int selinux_socket_unix_may_send(struct socket *sock,
4481                                         struct socket *other)
4482 {
4483         struct sk_security_struct *ssec = sock->sk->sk_security;
4484         struct sk_security_struct *osec = other->sk->sk_security;
4485         struct common_audit_data ad;
4486         struct lsm_network_audit net = {0,};
4487
4488         ad.type = LSM_AUDIT_DATA_NET;
4489         ad.u.net = &net;
4490         ad.u.net->sk = other->sk;
4491
4492         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4493                             &ad);
4494 }
4495
4496 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4497                                     char *addrp, u16 family, u32 peer_sid,
4498                                     struct common_audit_data *ad)
4499 {
4500         int err;
4501         u32 if_sid;
4502         u32 node_sid;
4503
4504         err = sel_netif_sid(ns, ifindex, &if_sid);
4505         if (err)
4506                 return err;
4507         err = avc_has_perm(peer_sid, if_sid,
4508                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4509         if (err)
4510                 return err;
4511
4512         err = sel_netnode_sid(addrp, family, &node_sid);
4513         if (err)
4514                 return err;
4515         return avc_has_perm(peer_sid, node_sid,
4516                             SECCLASS_NODE, NODE__RECVFROM, ad);
4517 }
4518
4519 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4520                                        u16 family)
4521 {
4522         int err = 0;
4523         struct sk_security_struct *sksec = sk->sk_security;
4524         u32 sk_sid = sksec->sid;
4525         struct common_audit_data ad;
4526         struct lsm_network_audit net = {0,};
4527         char *addrp;
4528
4529         ad.type = LSM_AUDIT_DATA_NET;
4530         ad.u.net = &net;
4531         ad.u.net->netif = skb->skb_iif;
4532         ad.u.net->family = family;
4533         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4534         if (err)
4535                 return err;
4536
4537         if (selinux_secmark_enabled()) {
4538                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4539                                    PACKET__RECV, &ad);
4540                 if (err)
4541                         return err;
4542         }
4543
4544         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4545         if (err)
4546                 return err;
4547         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4548
4549         return err;
4550 }
4551
4552 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4553 {
4554         int err;
4555         struct sk_security_struct *sksec = sk->sk_security;
4556         u16 family = sk->sk_family;
4557         u32 sk_sid = sksec->sid;
4558         struct common_audit_data ad;
4559         struct lsm_network_audit net = {0,};
4560         char *addrp;
4561         u8 secmark_active;
4562         u8 peerlbl_active;
4563
4564         if (family != PF_INET && family != PF_INET6)
4565                 return 0;
4566
4567         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4568         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4569                 family = PF_INET;
4570
4571         /* If any sort of compatibility mode is enabled then handoff processing
4572          * to the selinux_sock_rcv_skb_compat() function to deal with the
4573          * special handling.  We do this in an attempt to keep this function
4574          * as fast and as clean as possible. */
4575         if (!selinux_policycap_netpeer)
4576                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4577
4578         secmark_active = selinux_secmark_enabled();
4579         peerlbl_active = selinux_peerlbl_enabled();
4580         if (!secmark_active && !peerlbl_active)
4581                 return 0;
4582
4583         ad.type = LSM_AUDIT_DATA_NET;
4584         ad.u.net = &net;
4585         ad.u.net->netif = skb->skb_iif;
4586         ad.u.net->family = family;
4587         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4588         if (err)
4589                 return err;
4590
4591         if (peerlbl_active) {
4592                 u32 peer_sid;
4593
4594                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4595                 if (err)
4596                         return err;
4597                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4598                                                addrp, family, peer_sid, &ad);
4599                 if (err) {
4600                         selinux_netlbl_err(skb, err, 0);
4601                         return err;
4602                 }
4603                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4604                                    PEER__RECV, &ad);
4605                 if (err) {
4606                         selinux_netlbl_err(skb, err, 0);
4607                         return err;
4608                 }
4609         }
4610
4611         if (secmark_active) {
4612                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4613                                    PACKET__RECV, &ad);
4614                 if (err)
4615                         return err;
4616         }
4617
4618         return err;
4619 }
4620
4621 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4622                                             int __user *optlen, unsigned len)
4623 {
4624         int err = 0;
4625         char *scontext;
4626         u32 scontext_len;
4627         struct sk_security_struct *sksec = sock->sk->sk_security;
4628         u32 peer_sid = SECSID_NULL;
4629
4630         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4631             sksec->sclass == SECCLASS_TCP_SOCKET)
4632                 peer_sid = sksec->peer_sid;
4633         if (peer_sid == SECSID_NULL)
4634                 return -ENOPROTOOPT;
4635
4636         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4637         if (err)
4638                 return err;
4639
4640         if (scontext_len > len) {
4641                 err = -ERANGE;
4642                 goto out_len;
4643         }
4644
4645         if (copy_to_user(optval, scontext, scontext_len))
4646                 err = -EFAULT;
4647
4648 out_len:
4649         if (put_user(scontext_len, optlen))
4650                 err = -EFAULT;
4651         kfree(scontext);
4652         return err;
4653 }
4654
4655 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4656 {
4657         u32 peer_secid = SECSID_NULL;
4658         u16 family;
4659         struct inode_security_struct *isec;
4660
4661         if (skb && skb->protocol == htons(ETH_P_IP))
4662                 family = PF_INET;
4663         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4664                 family = PF_INET6;
4665         else if (sock)
4666                 family = sock->sk->sk_family;
4667         else
4668                 goto out;
4669
4670         if (sock && family == PF_UNIX) {
4671                 isec = inode_security_novalidate(SOCK_INODE(sock));
4672                 peer_secid = isec->sid;
4673         } else if (skb)
4674                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4675
4676 out:
4677         *secid = peer_secid;
4678         if (peer_secid == SECSID_NULL)
4679                 return -EINVAL;
4680         return 0;
4681 }
4682
4683 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4684 {
4685         struct sk_security_struct *sksec;
4686
4687         sksec = kzalloc(sizeof(*sksec), priority);
4688         if (!sksec)
4689                 return -ENOMEM;
4690
4691         sksec->peer_sid = SECINITSID_UNLABELED;
4692         sksec->sid = SECINITSID_UNLABELED;
4693         sksec->sclass = SECCLASS_SOCKET;
4694         selinux_netlbl_sk_security_reset(sksec);
4695         sk->sk_security = sksec;
4696
4697         return 0;
4698 }
4699
4700 static void selinux_sk_free_security(struct sock *sk)
4701 {
4702         struct sk_security_struct *sksec = sk->sk_security;
4703
4704         sk->sk_security = NULL;
4705         selinux_netlbl_sk_security_free(sksec);
4706         kfree(sksec);
4707 }
4708
4709 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4710 {
4711         struct sk_security_struct *sksec = sk->sk_security;
4712         struct sk_security_struct *newsksec = newsk->sk_security;
4713
4714         newsksec->sid = sksec->sid;
4715         newsksec->peer_sid = sksec->peer_sid;
4716         newsksec->sclass = sksec->sclass;
4717
4718         selinux_netlbl_sk_security_reset(newsksec);
4719 }
4720
4721 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4722 {
4723         if (!sk)
4724                 *secid = SECINITSID_ANY_SOCKET;
4725         else {
4726                 struct sk_security_struct *sksec = sk->sk_security;
4727
4728                 *secid = sksec->sid;
4729         }
4730 }
4731
4732 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4733 {
4734         struct inode_security_struct *isec =
4735                 inode_security_novalidate(SOCK_INODE(parent));
4736         struct sk_security_struct *sksec = sk->sk_security;
4737
4738         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4739             sk->sk_family == PF_UNIX)
4740                 isec->sid = sksec->sid;
4741         sksec->sclass = isec->sclass;
4742 }
4743
4744 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4745                                      struct request_sock *req)
4746 {
4747         struct sk_security_struct *sksec = sk->sk_security;
4748         int err;
4749         u16 family = req->rsk_ops->family;
4750         u32 connsid;
4751         u32 peersid;
4752
4753         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4754         if (err)
4755                 return err;
4756         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4757         if (err)
4758                 return err;
4759         req->secid = connsid;
4760         req->peer_secid = peersid;
4761
4762         return selinux_netlbl_inet_conn_request(req, family);
4763 }
4764
4765 static void selinux_inet_csk_clone(struct sock *newsk,
4766                                    const struct request_sock *req)
4767 {
4768         struct sk_security_struct *newsksec = newsk->sk_security;
4769
4770         newsksec->sid = req->secid;
4771         newsksec->peer_sid = req->peer_secid;
4772         /* NOTE: Ideally, we should also get the isec->sid for the
4773            new socket in sync, but we don't have the isec available yet.
4774            So we will wait until sock_graft to do it, by which
4775            time it will have been created and available. */
4776
4777         /* We don't need to take any sort of lock here as we are the only
4778          * thread with access to newsksec */
4779         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4780 }
4781
4782 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4783 {
4784         u16 family = sk->sk_family;
4785         struct sk_security_struct *sksec = sk->sk_security;
4786
4787         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4788         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4789                 family = PF_INET;
4790
4791         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4792 }
4793
4794 static int selinux_secmark_relabel_packet(u32 sid)
4795 {
4796         const struct task_security_struct *__tsec;
4797         u32 tsid;
4798
4799         __tsec = current_security();
4800         tsid = __tsec->sid;
4801
4802         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4803 }
4804
4805 static void selinux_secmark_refcount_inc(void)
4806 {
4807         atomic_inc(&selinux_secmark_refcount);
4808 }
4809
4810 static void selinux_secmark_refcount_dec(void)
4811 {
4812         atomic_dec(&selinux_secmark_refcount);
4813 }
4814
4815 static void selinux_req_classify_flow(const struct request_sock *req,
4816                                       struct flowi *fl)
4817 {
4818         fl->flowi_secid = req->secid;
4819 }
4820
4821 static int selinux_tun_dev_alloc_security(void **security)
4822 {
4823         struct tun_security_struct *tunsec;
4824
4825         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4826         if (!tunsec)
4827                 return -ENOMEM;
4828         tunsec->sid = current_sid();
4829
4830         *security = tunsec;
4831         return 0;
4832 }
4833
4834 static void selinux_tun_dev_free_security(void *security)
4835 {
4836         kfree(security);
4837 }
4838
4839 static int selinux_tun_dev_create(void)
4840 {
4841         u32 sid = current_sid();
4842
4843         /* we aren't taking into account the "sockcreate" SID since the socket
4844          * that is being created here is not a socket in the traditional sense,
4845          * instead it is a private sock, accessible only to the kernel, and
4846          * representing a wide range of network traffic spanning multiple
4847          * connections unlike traditional sockets - check the TUN driver to
4848          * get a better understanding of why this socket is special */
4849
4850         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4851                             NULL);
4852 }
4853
4854 static int selinux_tun_dev_attach_queue(void *security)
4855 {
4856         struct tun_security_struct *tunsec = security;
4857
4858         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4859                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4860 }
4861
4862 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4863 {
4864         struct tun_security_struct *tunsec = security;
4865         struct sk_security_struct *sksec = sk->sk_security;
4866
4867         /* we don't currently perform any NetLabel based labeling here and it
4868          * isn't clear that we would want to do so anyway; while we could apply
4869          * labeling without the support of the TUN user the resulting labeled
4870          * traffic from the other end of the connection would almost certainly
4871          * cause confusion to the TUN user that had no idea network labeling
4872          * protocols were being used */
4873
4874         sksec->sid = tunsec->sid;
4875         sksec->sclass = SECCLASS_TUN_SOCKET;
4876
4877         return 0;
4878 }
4879
4880 static int selinux_tun_dev_open(void *security)
4881 {
4882         struct tun_security_struct *tunsec = security;
4883         u32 sid = current_sid();
4884         int err;
4885
4886         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4887                            TUN_SOCKET__RELABELFROM, NULL);
4888         if (err)
4889                 return err;
4890         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4891                            TUN_SOCKET__RELABELTO, NULL);
4892         if (err)
4893                 return err;
4894         tunsec->sid = sid;
4895
4896         return 0;
4897 }
4898
4899 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4900 {
4901         int err = 0;
4902         u32 perm;
4903         struct nlmsghdr *nlh;
4904         struct sk_security_struct *sksec = sk->sk_security;
4905
4906         if (skb->len < NLMSG_HDRLEN) {
4907                 err = -EINVAL;
4908                 goto out;
4909         }
4910         nlh = nlmsg_hdr(skb);
4911
4912         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4913         if (err) {
4914                 if (err == -EINVAL) {
4915                         pr_warn_ratelimited("SELinux: unrecognized netlink"
4916                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4917                                " pig=%d comm=%s\n",
4918                                sk->sk_protocol, nlh->nlmsg_type,
4919                                secclass_map[sksec->sclass - 1].name,
4920                                task_pid_nr(current), current->comm);
4921                         if (!selinux_enforcing || security_get_allow_unknown())
4922                                 err = 0;
4923                 }
4924
4925                 /* Ignore */
4926                 if (err == -ENOENT)
4927                         err = 0;
4928                 goto out;
4929         }
4930
4931         err = sock_has_perm(current, sk, perm);
4932 out:
4933         return err;
4934 }
4935
4936 #ifdef CONFIG_NETFILTER
4937
4938 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4939                                        const struct net_device *indev,
4940                                        u16 family)
4941 {
4942         int err;
4943         char *addrp;
4944         u32 peer_sid;
4945         struct common_audit_data ad;
4946         struct lsm_network_audit net = {0,};
4947         u8 secmark_active;
4948         u8 netlbl_active;
4949         u8 peerlbl_active;
4950
4951         if (!selinux_policycap_netpeer)
4952                 return NF_ACCEPT;
4953
4954         secmark_active = selinux_secmark_enabled();
4955         netlbl_active = netlbl_enabled();
4956         peerlbl_active = selinux_peerlbl_enabled();
4957         if (!secmark_active && !peerlbl_active)
4958                 return NF_ACCEPT;
4959
4960         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4961                 return NF_DROP;
4962
4963         ad.type = LSM_AUDIT_DATA_NET;
4964         ad.u.net = &net;
4965         ad.u.net->netif = indev->ifindex;
4966         ad.u.net->family = family;
4967         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4968                 return NF_DROP;
4969
4970         if (peerlbl_active) {
4971                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4972                                                addrp, family, peer_sid, &ad);
4973                 if (err) {
4974                         selinux_netlbl_err(skb, err, 1);
4975                         return NF_DROP;
4976                 }
4977         }
4978
4979         if (secmark_active)
4980                 if (avc_has_perm(peer_sid, skb->secmark,
4981                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4982                         return NF_DROP;
4983
4984         if (netlbl_active)
4985                 /* we do this in the FORWARD path and not the POST_ROUTING
4986                  * path because we want to make sure we apply the necessary
4987                  * labeling before IPsec is applied so we can leverage AH
4988                  * protection */
4989                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4990                         return NF_DROP;
4991
4992         return NF_ACCEPT;
4993 }
4994
4995 static unsigned int selinux_ipv4_forward(void *priv,
4996                                          struct sk_buff *skb,
4997                                          const struct nf_hook_state *state)
4998 {
4999         return selinux_ip_forward(skb, state->in, PF_INET);
5000 }
5001
5002 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5003 static unsigned int selinux_ipv6_forward(void *priv,
5004                                          struct sk_buff *skb,
5005                                          const struct nf_hook_state *state)
5006 {
5007         return selinux_ip_forward(skb, state->in, PF_INET6);
5008 }
5009 #endif  /* IPV6 */
5010
5011 static unsigned int selinux_ip_output(struct sk_buff *skb,
5012                                       u16 family)
5013 {
5014         struct sock *sk;
5015         u32 sid;
5016
5017         if (!netlbl_enabled())
5018                 return NF_ACCEPT;
5019
5020         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5021          * because we want to make sure we apply the necessary labeling
5022          * before IPsec is applied so we can leverage AH protection */
5023         sk = skb->sk;
5024         if (sk) {
5025                 struct sk_security_struct *sksec;
5026
5027                 if (sk_listener(sk))
5028                         /* if the socket is the listening state then this
5029                          * packet is a SYN-ACK packet which means it needs to
5030                          * be labeled based on the connection/request_sock and
5031                          * not the parent socket.  unfortunately, we can't
5032                          * lookup the request_sock yet as it isn't queued on
5033                          * the parent socket until after the SYN-ACK is sent.
5034                          * the "solution" is to simply pass the packet as-is
5035                          * as any IP option based labeling should be copied
5036                          * from the initial connection request (in the IP
5037                          * layer).  it is far from ideal, but until we get a
5038                          * security label in the packet itself this is the
5039                          * best we can do. */
5040                         return NF_ACCEPT;
5041
5042                 /* standard practice, label using the parent socket */
5043                 sksec = sk->sk_security;
5044                 sid = sksec->sid;
5045         } else
5046                 sid = SECINITSID_KERNEL;
5047         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5048                 return NF_DROP;
5049
5050         return NF_ACCEPT;
5051 }
5052
5053 static unsigned int selinux_ipv4_output(void *priv,
5054                                         struct sk_buff *skb,
5055                                         const struct nf_hook_state *state)
5056 {
5057         return selinux_ip_output(skb, PF_INET);
5058 }
5059
5060 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5061                                                 int ifindex,
5062                                                 u16 family)
5063 {
5064         struct sock *sk = skb_to_full_sk(skb);
5065         struct sk_security_struct *sksec;
5066         struct common_audit_data ad;
5067         struct lsm_network_audit net = {0,};
5068         char *addrp;
5069         u8 proto;
5070
5071         if (sk == NULL)
5072                 return NF_ACCEPT;
5073         sksec = sk->sk_security;
5074
5075         ad.type = LSM_AUDIT_DATA_NET;
5076         ad.u.net = &net;
5077         ad.u.net->netif = ifindex;
5078         ad.u.net->family = family;
5079         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5080                 return NF_DROP;
5081
5082         if (selinux_secmark_enabled())
5083                 if (avc_has_perm(sksec->sid, skb->secmark,
5084                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5085                         return NF_DROP_ERR(-ECONNREFUSED);
5086
5087         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5088                 return NF_DROP_ERR(-ECONNREFUSED);
5089
5090         return NF_ACCEPT;
5091 }
5092
5093 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5094                                          const struct net_device *outdev,
5095                                          u16 family)
5096 {
5097         u32 secmark_perm;
5098         u32 peer_sid;
5099         int ifindex = outdev->ifindex;
5100         struct sock *sk;
5101         struct common_audit_data ad;
5102         struct lsm_network_audit net = {0,};
5103         char *addrp;
5104         u8 secmark_active;
5105         u8 peerlbl_active;
5106
5107         /* If any sort of compatibility mode is enabled then handoff processing
5108          * to the selinux_ip_postroute_compat() function to deal with the
5109          * special handling.  We do this in an attempt to keep this function
5110          * as fast and as clean as possible. */
5111         if (!selinux_policycap_netpeer)
5112                 return selinux_ip_postroute_compat(skb, ifindex, family);
5113
5114         secmark_active = selinux_secmark_enabled();
5115         peerlbl_active = selinux_peerlbl_enabled();
5116         if (!secmark_active && !peerlbl_active)
5117                 return NF_ACCEPT;
5118
5119         sk = skb_to_full_sk(skb);
5120
5121 #ifdef CONFIG_XFRM
5122         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5123          * packet transformation so allow the packet to pass without any checks
5124          * since we'll have another chance to perform access control checks
5125          * when the packet is on it's final way out.
5126          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5127          *       is NULL, in this case go ahead and apply access control.
5128          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5129          *       TCP listening state we cannot wait until the XFRM processing
5130          *       is done as we will miss out on the SA label if we do;
5131          *       unfortunately, this means more work, but it is only once per
5132          *       connection. */
5133         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5134             !(sk && sk_listener(sk)))
5135                 return NF_ACCEPT;
5136 #endif
5137
5138         if (sk == NULL) {
5139                 /* Without an associated socket the packet is either coming
5140                  * from the kernel or it is being forwarded; check the packet
5141                  * to determine which and if the packet is being forwarded
5142                  * query the packet directly to determine the security label. */
5143                 if (skb->skb_iif) {
5144                         secmark_perm = PACKET__FORWARD_OUT;
5145                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5146                                 return NF_DROP;
5147                 } else {
5148                         secmark_perm = PACKET__SEND;
5149                         peer_sid = SECINITSID_KERNEL;
5150                 }
5151         } else if (sk_listener(sk)) {
5152                 /* Locally generated packet but the associated socket is in the
5153                  * listening state which means this is a SYN-ACK packet.  In
5154                  * this particular case the correct security label is assigned
5155                  * to the connection/request_sock but unfortunately we can't
5156                  * query the request_sock as it isn't queued on the parent
5157                  * socket until after the SYN-ACK packet is sent; the only
5158                  * viable choice is to regenerate the label like we do in
5159                  * selinux_inet_conn_request().  See also selinux_ip_output()
5160                  * for similar problems. */
5161                 u32 skb_sid;
5162                 struct sk_security_struct *sksec;
5163
5164                 sksec = sk->sk_security;
5165                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5166                         return NF_DROP;
5167                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5168                  * and the packet has been through at least one XFRM
5169                  * transformation then we must be dealing with the "final"
5170                  * form of labeled IPsec packet; since we've already applied
5171                  * all of our access controls on this packet we can safely
5172                  * pass the packet. */
5173                 if (skb_sid == SECSID_NULL) {
5174                         switch (family) {
5175                         case PF_INET:
5176                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5177                                         return NF_ACCEPT;
5178                                 break;
5179                         case PF_INET6:
5180                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5181                                         return NF_ACCEPT;
5182                                 break;
5183                         default:
5184                                 return NF_DROP_ERR(-ECONNREFUSED);
5185                         }
5186                 }
5187                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5188                         return NF_DROP;
5189                 secmark_perm = PACKET__SEND;
5190         } else {
5191                 /* Locally generated packet, fetch the security label from the
5192                  * associated socket. */
5193                 struct sk_security_struct *sksec = sk->sk_security;
5194                 peer_sid = sksec->sid;
5195                 secmark_perm = PACKET__SEND;
5196         }
5197
5198         ad.type = LSM_AUDIT_DATA_NET;
5199         ad.u.net = &net;
5200         ad.u.net->netif = ifindex;
5201         ad.u.net->family = family;
5202         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5203                 return NF_DROP;
5204
5205         if (secmark_active)
5206                 if (avc_has_perm(peer_sid, skb->secmark,
5207                                  SECCLASS_PACKET, secmark_perm, &ad))
5208                         return NF_DROP_ERR(-ECONNREFUSED);
5209
5210         if (peerlbl_active) {
5211                 u32 if_sid;
5212                 u32 node_sid;
5213
5214                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5215                         return NF_DROP;
5216                 if (avc_has_perm(peer_sid, if_sid,
5217                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5218                         return NF_DROP_ERR(-ECONNREFUSED);
5219
5220                 if (sel_netnode_sid(addrp, family, &node_sid))
5221                         return NF_DROP;
5222                 if (avc_has_perm(peer_sid, node_sid,
5223                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5224                         return NF_DROP_ERR(-ECONNREFUSED);
5225         }
5226
5227         return NF_ACCEPT;
5228 }
5229
5230 static unsigned int selinux_ipv4_postroute(void *priv,
5231                                            struct sk_buff *skb,
5232                                            const struct nf_hook_state *state)
5233 {
5234         return selinux_ip_postroute(skb, state->out, PF_INET);
5235 }
5236
5237 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5238 static unsigned int selinux_ipv6_postroute(void *priv,
5239                                            struct sk_buff *skb,
5240                                            const struct nf_hook_state *state)
5241 {
5242         return selinux_ip_postroute(skb, state->out, PF_INET6);
5243 }
5244 #endif  /* IPV6 */
5245
5246 #endif  /* CONFIG_NETFILTER */
5247
5248 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5249 {
5250         return selinux_nlmsg_perm(sk, skb);
5251 }
5252
5253 static int ipc_alloc_security(struct task_struct *task,
5254                               struct kern_ipc_perm *perm,
5255                               u16 sclass)
5256 {
5257         struct ipc_security_struct *isec;
5258         u32 sid;
5259
5260         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5261         if (!isec)
5262                 return -ENOMEM;
5263
5264         sid = task_sid(task);
5265         isec->sclass = sclass;
5266         isec->sid = sid;
5267         perm->security = isec;
5268
5269         return 0;
5270 }
5271
5272 static void ipc_free_security(struct kern_ipc_perm *perm)
5273 {
5274         struct ipc_security_struct *isec = perm->security;
5275         perm->security = NULL;
5276         kfree(isec);
5277 }
5278
5279 static int msg_msg_alloc_security(struct msg_msg *msg)
5280 {
5281         struct msg_security_struct *msec;
5282
5283         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5284         if (!msec)
5285                 return -ENOMEM;
5286
5287         msec->sid = SECINITSID_UNLABELED;
5288         msg->security = msec;
5289
5290         return 0;
5291 }
5292
5293 static void msg_msg_free_security(struct msg_msg *msg)
5294 {
5295         struct msg_security_struct *msec = msg->security;
5296
5297         msg->security = NULL;
5298         kfree(msec);
5299 }
5300
5301 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5302                         u32 perms)
5303 {
5304         struct ipc_security_struct *isec;
5305         struct common_audit_data ad;
5306         u32 sid = current_sid();
5307
5308         isec = ipc_perms->security;
5309
5310         ad.type = LSM_AUDIT_DATA_IPC;
5311         ad.u.ipc_id = ipc_perms->key;
5312
5313         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5314 }
5315
5316 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5317 {
5318         return msg_msg_alloc_security(msg);
5319 }
5320
5321 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5322 {
5323         msg_msg_free_security(msg);
5324 }
5325
5326 /* message queue security operations */
5327 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5328 {
5329         struct ipc_security_struct *isec;
5330         struct common_audit_data ad;
5331         u32 sid = current_sid();
5332         int rc;
5333
5334         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5335         if (rc)
5336                 return rc;
5337
5338         isec = msq->q_perm.security;
5339
5340         ad.type = LSM_AUDIT_DATA_IPC;
5341         ad.u.ipc_id = msq->q_perm.key;
5342
5343         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5344                           MSGQ__CREATE, &ad);
5345         if (rc) {
5346                 ipc_free_security(&msq->q_perm);
5347                 return rc;
5348         }
5349         return 0;
5350 }
5351
5352 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5353 {
5354         ipc_free_security(&msq->q_perm);
5355 }
5356
5357 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5358 {
5359         struct ipc_security_struct *isec;
5360         struct common_audit_data ad;
5361         u32 sid = current_sid();
5362
5363         isec = msq->q_perm.security;
5364
5365         ad.type = LSM_AUDIT_DATA_IPC;
5366         ad.u.ipc_id = msq->q_perm.key;
5367
5368         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5369                             MSGQ__ASSOCIATE, &ad);
5370 }
5371
5372 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5373 {
5374         int err;
5375         int perms;
5376
5377         switch (cmd) {
5378         case IPC_INFO:
5379         case MSG_INFO:
5380                 /* No specific object, just general system-wide information. */
5381                 return task_has_system(current, SYSTEM__IPC_INFO);
5382         case IPC_STAT:
5383         case MSG_STAT:
5384                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5385                 break;
5386         case IPC_SET:
5387                 perms = MSGQ__SETATTR;
5388                 break;
5389         case IPC_RMID:
5390                 perms = MSGQ__DESTROY;
5391                 break;
5392         default:
5393                 return 0;
5394         }
5395
5396         err = ipc_has_perm(&msq->q_perm, perms);
5397         return err;
5398 }
5399
5400 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5401 {
5402         struct ipc_security_struct *isec;
5403         struct msg_security_struct *msec;
5404         struct common_audit_data ad;
5405         u32 sid = current_sid();
5406         int rc;
5407
5408         isec = msq->q_perm.security;
5409         msec = msg->security;
5410
5411         /*
5412          * First time through, need to assign label to the message
5413          */
5414         if (msec->sid == SECINITSID_UNLABELED) {
5415                 /*
5416                  * Compute new sid based on current process and
5417                  * message queue this message will be stored in
5418                  */
5419                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5420                                              NULL, &msec->sid);
5421                 if (rc)
5422                         return rc;
5423         }
5424
5425         ad.type = LSM_AUDIT_DATA_IPC;
5426         ad.u.ipc_id = msq->q_perm.key;
5427
5428         /* Can this process write to the queue? */
5429         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5430                           MSGQ__WRITE, &ad);
5431         if (!rc)
5432                 /* Can this process send the message */
5433                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5434                                   MSG__SEND, &ad);
5435         if (!rc)
5436                 /* Can the message be put in the queue? */
5437                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5438                                   MSGQ__ENQUEUE, &ad);
5439
5440         return rc;
5441 }
5442
5443 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5444                                     struct task_struct *target,
5445                                     long type, int mode)
5446 {
5447         struct ipc_security_struct *isec;
5448         struct msg_security_struct *msec;
5449         struct common_audit_data ad;
5450         u32 sid = task_sid(target);
5451         int rc;
5452
5453         isec = msq->q_perm.security;
5454         msec = msg->security;
5455
5456         ad.type = LSM_AUDIT_DATA_IPC;
5457         ad.u.ipc_id = msq->q_perm.key;
5458
5459         rc = avc_has_perm(sid, isec->sid,
5460                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5461         if (!rc)
5462                 rc = avc_has_perm(sid, msec->sid,
5463                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5464         return rc;
5465 }
5466
5467 /* Shared Memory security operations */
5468 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5469 {
5470         struct ipc_security_struct *isec;
5471         struct common_audit_data ad;
5472         u32 sid = current_sid();
5473         int rc;
5474
5475         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5476         if (rc)
5477                 return rc;
5478
5479         isec = shp->shm_perm.security;
5480
5481         ad.type = LSM_AUDIT_DATA_IPC;
5482         ad.u.ipc_id = shp->shm_perm.key;
5483
5484         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5485                           SHM__CREATE, &ad);
5486         if (rc) {
5487                 ipc_free_security(&shp->shm_perm);
5488                 return rc;
5489         }
5490         return 0;
5491 }
5492
5493 static void selinux_shm_free_security(struct shmid_kernel *shp)
5494 {
5495         ipc_free_security(&shp->shm_perm);
5496 }
5497
5498 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5499 {
5500         struct ipc_security_struct *isec;
5501         struct common_audit_data ad;
5502         u32 sid = current_sid();
5503
5504         isec = shp->shm_perm.security;
5505
5506         ad.type = LSM_AUDIT_DATA_IPC;
5507         ad.u.ipc_id = shp->shm_perm.key;
5508
5509         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5510                             SHM__ASSOCIATE, &ad);
5511 }
5512
5513 /* Note, at this point, shp is locked down */
5514 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5515 {
5516         int perms;
5517         int err;
5518
5519         switch (cmd) {
5520         case IPC_INFO:
5521         case SHM_INFO:
5522                 /* No specific object, just general system-wide information. */
5523                 return task_has_system(current, SYSTEM__IPC_INFO);
5524         case IPC_STAT:
5525         case SHM_STAT:
5526                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5527                 break;
5528         case IPC_SET:
5529                 perms = SHM__SETATTR;
5530                 break;
5531         case SHM_LOCK:
5532         case SHM_UNLOCK:
5533                 perms = SHM__LOCK;
5534                 break;
5535         case IPC_RMID:
5536                 perms = SHM__DESTROY;
5537                 break;
5538         default:
5539                 return 0;
5540         }
5541
5542         err = ipc_has_perm(&shp->shm_perm, perms);
5543         return err;
5544 }
5545
5546 static int selinux_shm_shmat(struct shmid_kernel *shp,
5547                              char __user *shmaddr, int shmflg)
5548 {
5549         u32 perms;
5550
5551         if (shmflg & SHM_RDONLY)
5552                 perms = SHM__READ;
5553         else
5554                 perms = SHM__READ | SHM__WRITE;
5555
5556         return ipc_has_perm(&shp->shm_perm, perms);
5557 }
5558
5559 /* Semaphore security operations */
5560 static int selinux_sem_alloc_security(struct sem_array *sma)
5561 {
5562         struct ipc_security_struct *isec;
5563         struct common_audit_data ad;
5564         u32 sid = current_sid();
5565         int rc;
5566
5567         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5568         if (rc)
5569                 return rc;
5570
5571         isec = sma->sem_perm.security;
5572
5573         ad.type = LSM_AUDIT_DATA_IPC;
5574         ad.u.ipc_id = sma->sem_perm.key;
5575
5576         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5577                           SEM__CREATE, &ad);
5578         if (rc) {
5579                 ipc_free_security(&sma->sem_perm);
5580                 return rc;
5581         }
5582         return 0;
5583 }
5584
5585 static void selinux_sem_free_security(struct sem_array *sma)
5586 {
5587         ipc_free_security(&sma->sem_perm);
5588 }
5589
5590 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5591 {
5592         struct ipc_security_struct *isec;
5593         struct common_audit_data ad;
5594         u32 sid = current_sid();
5595
5596         isec = sma->sem_perm.security;
5597
5598         ad.type = LSM_AUDIT_DATA_IPC;
5599         ad.u.ipc_id = sma->sem_perm.key;
5600
5601         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5602                             SEM__ASSOCIATE, &ad);
5603 }
5604
5605 /* Note, at this point, sma is locked down */
5606 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5607 {
5608         int err;
5609         u32 perms;
5610
5611         switch (cmd) {
5612         case IPC_INFO:
5613         case SEM_INFO:
5614                 /* No specific object, just general system-wide information. */
5615                 return task_has_system(current, SYSTEM__IPC_INFO);
5616         case GETPID:
5617         case GETNCNT:
5618         case GETZCNT:
5619                 perms = SEM__GETATTR;
5620                 break;
5621         case GETVAL:
5622         case GETALL:
5623                 perms = SEM__READ;
5624                 break;
5625         case SETVAL:
5626         case SETALL:
5627                 perms = SEM__WRITE;
5628                 break;
5629         case IPC_RMID:
5630                 perms = SEM__DESTROY;
5631                 break;
5632         case IPC_SET:
5633                 perms = SEM__SETATTR;
5634                 break;
5635         case IPC_STAT:
5636         case SEM_STAT:
5637                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5638                 break;
5639         default:
5640                 return 0;
5641         }
5642
5643         err = ipc_has_perm(&sma->sem_perm, perms);
5644         return err;
5645 }
5646
5647 static int selinux_sem_semop(struct sem_array *sma,
5648                              struct sembuf *sops, unsigned nsops, int alter)
5649 {
5650         u32 perms;
5651
5652         if (alter)
5653                 perms = SEM__READ | SEM__WRITE;
5654         else
5655                 perms = SEM__READ;
5656
5657         return ipc_has_perm(&sma->sem_perm, perms);
5658 }
5659
5660 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5661 {
5662         u32 av = 0;
5663
5664         av = 0;
5665         if (flag & S_IRUGO)
5666                 av |= IPC__UNIX_READ;
5667         if (flag & S_IWUGO)
5668                 av |= IPC__UNIX_WRITE;
5669
5670         if (av == 0)
5671                 return 0;
5672
5673         return ipc_has_perm(ipcp, av);
5674 }
5675
5676 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5677 {
5678         struct ipc_security_struct *isec = ipcp->security;
5679         *secid = isec->sid;
5680 }
5681
5682 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5683 {
5684         if (inode)
5685                 inode_doinit_with_dentry(inode, dentry);
5686 }
5687
5688 static int selinux_getprocattr(struct task_struct *p,
5689                                char *name, char **value)
5690 {
5691         const struct task_security_struct *__tsec;
5692         u32 sid;
5693         int error;
5694         unsigned len;
5695
5696         if (current != p) {
5697                 error = current_has_perm(p, PROCESS__GETATTR);
5698                 if (error)
5699                         return error;
5700         }
5701
5702         rcu_read_lock();
5703         __tsec = __task_cred(p)->security;
5704
5705         if (!strcmp(name, "current"))
5706                 sid = __tsec->sid;
5707         else if (!strcmp(name, "prev"))
5708                 sid = __tsec->osid;
5709         else if (!strcmp(name, "exec"))
5710                 sid = __tsec->exec_sid;
5711         else if (!strcmp(name, "fscreate"))
5712                 sid = __tsec->create_sid;
5713         else if (!strcmp(name, "keycreate"))
5714                 sid = __tsec->keycreate_sid;
5715         else if (!strcmp(name, "sockcreate"))
5716                 sid = __tsec->sockcreate_sid;
5717         else
5718                 goto invalid;
5719         rcu_read_unlock();
5720
5721         if (!sid)
5722                 return 0;
5723
5724         error = security_sid_to_context(sid, value, &len);
5725         if (error)
5726                 return error;
5727         return len;
5728
5729 invalid:
5730         rcu_read_unlock();
5731         return -EINVAL;
5732 }
5733
5734 static int selinux_setprocattr(struct task_struct *p,
5735                                char *name, void *value, size_t size)
5736 {
5737         struct task_security_struct *tsec;
5738         struct cred *new;
5739         u32 sid = 0, ptsid;
5740         int error;
5741         char *str = value;
5742
5743         if (current != p) {
5744                 /* SELinux only allows a process to change its own
5745                    security attributes. */
5746                 return -EACCES;
5747         }
5748
5749         /*
5750          * Basic control over ability to set these attributes at all.
5751          * current == p, but we'll pass them separately in case the
5752          * above restriction is ever removed.
5753          */
5754         if (!strcmp(name, "exec"))
5755                 error = current_has_perm(p, PROCESS__SETEXEC);
5756         else if (!strcmp(name, "fscreate"))
5757                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5758         else if (!strcmp(name, "keycreate"))
5759                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5760         else if (!strcmp(name, "sockcreate"))
5761                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5762         else if (!strcmp(name, "current"))
5763                 error = current_has_perm(p, PROCESS__SETCURRENT);
5764         else
5765                 error = -EINVAL;
5766         if (error)
5767                 return error;
5768
5769         /* Obtain a SID for the context, if one was specified. */
5770         if (size && str[1] && str[1] != '\n') {
5771                 if (str[size-1] == '\n') {
5772                         str[size-1] = 0;
5773                         size--;
5774                 }
5775                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5776                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5777                         if (!capable(CAP_MAC_ADMIN)) {
5778                                 struct audit_buffer *ab;
5779                                 size_t audit_size;
5780
5781                                 /* We strip a nul only if it is at the end, otherwise the
5782                                  * context contains a nul and we should audit that */
5783                                 if (str[size - 1] == '\0')
5784                                         audit_size = size - 1;
5785                                 else
5786                                         audit_size = size;
5787                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5788                                 audit_log_format(ab, "op=fscreate invalid_context=");
5789                                 audit_log_n_untrustedstring(ab, value, audit_size);
5790                                 audit_log_end(ab);
5791
5792                                 return error;
5793                         }
5794                         error = security_context_to_sid_force(value, size,
5795                                                               &sid);
5796                 }
5797                 if (error)
5798                         return error;
5799         }
5800
5801         new = prepare_creds();
5802         if (!new)
5803                 return -ENOMEM;
5804
5805         /* Permission checking based on the specified context is
5806            performed during the actual operation (execve,
5807            open/mkdir/...), when we know the full context of the
5808            operation.  See selinux_bprm_set_creds for the execve
5809            checks and may_create for the file creation checks. The
5810            operation will then fail if the context is not permitted. */
5811         tsec = new->security;
5812         if (!strcmp(name, "exec")) {
5813                 tsec->exec_sid = sid;
5814         } else if (!strcmp(name, "fscreate")) {
5815                 tsec->create_sid = sid;
5816         } else if (!strcmp(name, "keycreate")) {
5817                 error = may_create_key(sid, p);
5818                 if (error)
5819                         goto abort_change;
5820                 tsec->keycreate_sid = sid;
5821         } else if (!strcmp(name, "sockcreate")) {
5822                 tsec->sockcreate_sid = sid;
5823         } else if (!strcmp(name, "current")) {
5824                 error = -EINVAL;
5825                 if (sid == 0)
5826                         goto abort_change;
5827
5828                 /* Only allow single threaded processes to change context */
5829                 error = -EPERM;
5830                 if (!current_is_single_threaded()) {
5831                         error = security_bounded_transition(tsec->sid, sid);
5832                         if (error)
5833                                 goto abort_change;
5834                 }
5835
5836                 /* Check permissions for the transition. */
5837                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5838                                      PROCESS__DYNTRANSITION, NULL);
5839                 if (error)
5840                         goto abort_change;
5841
5842                 /* Check for ptracing, and update the task SID if ok.
5843                    Otherwise, leave SID unchanged and fail. */
5844                 ptsid = ptrace_parent_sid(p);
5845                 if (ptsid != 0) {
5846                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5847                                              PROCESS__PTRACE, NULL);
5848                         if (error)
5849                                 goto abort_change;
5850                 }
5851
5852                 tsec->sid = sid;
5853         } else {
5854                 error = -EINVAL;
5855                 goto abort_change;
5856         }
5857
5858         commit_creds(new);
5859         return size;
5860
5861 abort_change:
5862         abort_creds(new);
5863         return error;
5864 }
5865
5866 static int selinux_ismaclabel(const char *name)
5867 {
5868         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5869 }
5870
5871 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5872 {
5873         return security_sid_to_context(secid, secdata, seclen);
5874 }
5875
5876 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5877 {
5878         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5879 }
5880
5881 static void selinux_release_secctx(char *secdata, u32 seclen)
5882 {
5883         kfree(secdata);
5884 }
5885
5886 static void selinux_inode_invalidate_secctx(struct inode *inode)
5887 {
5888         struct inode_security_struct *isec = inode->i_security;
5889
5890         mutex_lock(&isec->lock);
5891         isec->initialized = LABEL_INVALID;
5892         mutex_unlock(&isec->lock);
5893 }
5894
5895 /*
5896  *      called with inode->i_mutex locked
5897  */
5898 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5899 {
5900         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5901 }
5902
5903 /*
5904  *      called with inode->i_mutex locked
5905  */
5906 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5907 {
5908         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5909 }
5910
5911 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5912 {
5913         int len = 0;
5914         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5915                                                 ctx, true);
5916         if (len < 0)
5917                 return len;
5918         *ctxlen = len;
5919         return 0;
5920 }
5921 #ifdef CONFIG_KEYS
5922
5923 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5924                              unsigned long flags)
5925 {
5926         const struct task_security_struct *tsec;
5927         struct key_security_struct *ksec;
5928
5929         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5930         if (!ksec)
5931                 return -ENOMEM;
5932
5933         tsec = cred->security;
5934         if (tsec->keycreate_sid)
5935                 ksec->sid = tsec->keycreate_sid;
5936         else
5937                 ksec->sid = tsec->sid;
5938
5939         k->security = ksec;
5940         return 0;
5941 }
5942
5943 static void selinux_key_free(struct key *k)
5944 {
5945         struct key_security_struct *ksec = k->security;
5946
5947         k->security = NULL;
5948         kfree(ksec);
5949 }
5950
5951 static int selinux_key_permission(key_ref_t key_ref,
5952                                   const struct cred *cred,
5953                                   unsigned perm)
5954 {
5955         struct key *key;
5956         struct key_security_struct *ksec;
5957         u32 sid;
5958
5959         /* if no specific permissions are requested, we skip the
5960            permission check. No serious, additional covert channels
5961            appear to be created. */
5962         if (perm == 0)
5963                 return 0;
5964
5965         sid = cred_sid(cred);
5966
5967         key = key_ref_to_ptr(key_ref);
5968         ksec = key->security;
5969
5970         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5971 }
5972
5973 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5974 {
5975         struct key_security_struct *ksec = key->security;
5976         char *context = NULL;
5977         unsigned len;
5978         int rc;
5979
5980         rc = security_sid_to_context(ksec->sid, &context, &len);
5981         if (!rc)
5982                 rc = len;
5983         *_buffer = context;
5984         return rc;
5985 }
5986
5987 #endif
5988
5989 static struct security_hook_list selinux_hooks[] = {
5990         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5991         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5992         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5993         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5994
5995         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5996         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5997         LSM_HOOK_INIT(capget, selinux_capget),
5998         LSM_HOOK_INIT(capset, selinux_capset),
5999         LSM_HOOK_INIT(capable, selinux_capable),
6000         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6001         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6002         LSM_HOOK_INIT(syslog, selinux_syslog),
6003         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6004
6005         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6006
6007         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6008         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6009         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6010         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6011
6012         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6013         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6014         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6015         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6016         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6017         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6018         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6019         LSM_HOOK_INIT(sb_mount, selinux_mount),
6020         LSM_HOOK_INIT(sb_umount, selinux_umount),
6021         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6022         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6023         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6024
6025         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6026
6027         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6028         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6029         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6030         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6031         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6032         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6033         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6034         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6035         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6036         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6037         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6038         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6039         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6040         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6041         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6042         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6043         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6044         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6045         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6046         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6047         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6048         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6049         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6050         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6051         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6052
6053         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6054         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6055         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6056         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6057         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6058         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6059         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6060         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6061         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6062         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6063         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6064         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6065
6066         LSM_HOOK_INIT(file_open, selinux_file_open),
6067
6068         LSM_HOOK_INIT(task_create, selinux_task_create),
6069         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6070         LSM_HOOK_INIT(cred_free, selinux_cred_free),
6071         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6072         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6073         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6074         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6075         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6076         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6077         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6078         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6079         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6080         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6081         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6082         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6083         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6084         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6085         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6086         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6087         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6088         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6089         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6090         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6091
6092         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6093         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6094
6095         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6096         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6097
6098         LSM_HOOK_INIT(msg_queue_alloc_security,
6099                         selinux_msg_queue_alloc_security),
6100         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6101         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6102         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6103         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6104         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6105
6106         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6107         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6108         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6109         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6110         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6111
6112         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6113         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6114         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6115         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6116         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6117
6118         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6119
6120         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6121         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6122
6123         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6124         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6125         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6126         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6127         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6128         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6129         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6130         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6131
6132         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6133         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6134
6135         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6136         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6137         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6138         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6139         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6140         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6141         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6142         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6143         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6144         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6145         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6146         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6147         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6148         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6149         LSM_HOOK_INIT(socket_getpeersec_stream,
6150                         selinux_socket_getpeersec_stream),
6151         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6152         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6153         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6154         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6155         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6156         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6157         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6158         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6159         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6160         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6161         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6162         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6163         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6164         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6165         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6166         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6167         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6168         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6169         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6170
6171 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6172         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6173         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6174         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6175         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6176         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6177         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6178                         selinux_xfrm_state_alloc_acquire),
6179         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6180         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6181         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6182         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6183                         selinux_xfrm_state_pol_flow_match),
6184         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6185 #endif
6186
6187 #ifdef CONFIG_KEYS
6188         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6189         LSM_HOOK_INIT(key_free, selinux_key_free),
6190         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6191         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6192 #endif
6193
6194 #ifdef CONFIG_AUDIT
6195         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6196         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6197         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6198         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6199 #endif
6200 };
6201
6202 static __init int selinux_init(void)
6203 {
6204         if (!security_module_enable("selinux")) {
6205                 selinux_enabled = 0;
6206                 return 0;
6207         }
6208
6209         if (!selinux_enabled) {
6210                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6211                 return 0;
6212         }
6213
6214         printk(KERN_INFO "SELinux:  Initializing.\n");
6215
6216         /* Set the security state for the initial task. */
6217         cred_init_security();
6218
6219         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6220
6221         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6222                                             sizeof(struct inode_security_struct),
6223                                             0, SLAB_PANIC, NULL);
6224         file_security_cache = kmem_cache_create("selinux_file_security",
6225                                             sizeof(struct file_security_struct),
6226                                             0, SLAB_PANIC, NULL);
6227         avc_init();
6228
6229         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6230
6231         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6232                 panic("SELinux: Unable to register AVC netcache callback\n");
6233
6234         if (selinux_enforcing)
6235                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6236         else
6237                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6238
6239         return 0;
6240 }
6241
6242 static void delayed_superblock_init(struct super_block *sb, void *unused)
6243 {
6244         superblock_doinit(sb, NULL);
6245 }
6246
6247 void selinux_complete_init(void)
6248 {
6249         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6250
6251         /* Set up any superblocks initialized prior to the policy load. */
6252         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6253         iterate_supers(delayed_superblock_init, NULL);
6254 }
6255
6256 /* SELinux requires early initialization in order to label
6257    all processes and objects when they are created. */
6258 security_initcall(selinux_init);
6259
6260 #if defined(CONFIG_NETFILTER)
6261
6262 static struct nf_hook_ops selinux_nf_ops[] = {
6263         {
6264                 .hook =         selinux_ipv4_postroute,
6265                 .pf =           NFPROTO_IPV4,
6266                 .hooknum =      NF_INET_POST_ROUTING,
6267                 .priority =     NF_IP_PRI_SELINUX_LAST,
6268         },
6269         {
6270                 .hook =         selinux_ipv4_forward,
6271                 .pf =           NFPROTO_IPV4,
6272                 .hooknum =      NF_INET_FORWARD,
6273                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6274         },
6275         {
6276                 .hook =         selinux_ipv4_output,
6277                 .pf =           NFPROTO_IPV4,
6278                 .hooknum =      NF_INET_LOCAL_OUT,
6279                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6280         },
6281 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6282         {
6283                 .hook =         selinux_ipv6_postroute,
6284                 .pf =           NFPROTO_IPV6,
6285                 .hooknum =      NF_INET_POST_ROUTING,
6286                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6287         },
6288         {
6289                 .hook =         selinux_ipv6_forward,
6290                 .pf =           NFPROTO_IPV6,
6291                 .hooknum =      NF_INET_FORWARD,
6292                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6293         },
6294 #endif  /* IPV6 */
6295 };
6296
6297 static int __init selinux_nf_ip_init(void)
6298 {
6299         int err;
6300
6301         if (!selinux_enabled)
6302                 return 0;
6303
6304         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6305
6306         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6307         if (err)
6308                 panic("SELinux: nf_register_hooks: error %d\n", err);
6309
6310         return 0;
6311 }
6312
6313 __initcall(selinux_nf_ip_init);
6314
6315 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6316 static void selinux_nf_ip_exit(void)
6317 {
6318         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6319
6320         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6321 }
6322 #endif
6323
6324 #else /* CONFIG_NETFILTER */
6325
6326 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6327 #define selinux_nf_ip_exit()
6328 #endif
6329
6330 #endif /* CONFIG_NETFILTER */
6331
6332 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6333 static int selinux_disabled;
6334
6335 int selinux_disable(void)
6336 {
6337         if (ss_initialized) {
6338                 /* Not permitted after initial policy load. */
6339                 return -EINVAL;
6340         }
6341
6342         if (selinux_disabled) {
6343                 /* Only do this once. */
6344                 return -EINVAL;
6345         }
6346
6347         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6348
6349         selinux_disabled = 1;
6350         selinux_enabled = 0;
6351
6352         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6353
6354         /* Try to destroy the avc node cache */
6355         avc_disable();
6356
6357         /* Unregister netfilter hooks. */
6358         selinux_nf_ip_exit();
6359
6360         /* Unregister selinuxfs. */
6361         exit_sel_fs();
6362
6363         return 0;
6364 }
6365 #endif