security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define SB_TYPE_FMT "%s%s%s"
  98 #define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
  99 #define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
 100
 101 extern struct security_operations *security_ops;
 102
 103 /* SECMARK reference count */
 104 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 105
 106 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 107 int selinux_enforcing;
 108
 109 static int __init enforcing_setup(char *str)
 110 {
 111         unsigned long enforcing;
 112         if (!strict_strtoul(str, 0, &enforcing))
 113                 selinux_enforcing = enforcing ? 1 : 0;
 114         return 1;
 115 }
 116 __setup("enforcing=", enforcing_setup);
 117 #endif
 118
 119 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 120 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 121
 122 static int __init selinux_enabled_setup(char *str)
 123 {
 124         unsigned long enabled;
 125         if (!strict_strtoul(str, 0, &enabled))
 126                 selinux_enabled = enabled ? 1 : 0;
 127         return 1;
 128 }
 129 __setup("selinux=", selinux_enabled_setup);
 130 #else
 131 int selinux_enabled = 1;
 132 #endif
 133
 134 static struct kmem_cache *sel_inode_cache;
 135
 136 /**
 137  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 138  *
 139  * Description:
 140  * This function checks the SECMARK reference counter to see if any SECMARK
 141  * targets are currently configured, if the reference counter is greater than
 142  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 143  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 144  * policy capability is enabled, SECMARK is always considered enabled.
 145  *
 146  */
 147 static int selinux_secmark_enabled(void)
 148 {
 149         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 150 }
 151
 152 /**
 153  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 154  *
 155  * Description:
 156  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 157  * (1) if any are enabled or false (0) if neither are enabled.  If the
 158  * always_check_network policy capability is enabled, peer labeling
 159  * is always considered enabled.
 160  *
 161  */
 162 static int selinux_peerlbl_enabled(void)
 163 {
 164         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 165 }
 166
 167 /*
 168  * initialise the security for the init task
 169  */
 170 static void cred_init_security(void)
 171 {
 172         struct cred *cred = (struct cred *) current->real_cred;
 173         struct task_security_struct *tsec;
 174
 175         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 176         if (!tsec)
 177                 panic("SELinux:  Failed to initialize initial task.\n");
 178
 179         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 180         cred->security = tsec;
 181 }
 182
 183 /*
 184  * get the security ID of a set of credentials
 185  */
 186 static inline u32 cred_sid(const struct cred *cred)
 187 {
 188         const struct task_security_struct *tsec;
 189
 190         tsec = cred->security;
 191         return tsec->sid;
 192 }
 193
 194 /*
 195  * get the objective security ID of a task
 196  */
 197 static inline u32 task_sid(const struct task_struct *task)
 198 {
 199         u32 sid;
 200
 201         rcu_read_lock();
 202         sid = cred_sid(__task_cred(task));
 203         rcu_read_unlock();
 204         return sid;
 205 }
 206
 207 /*
 208  * get the subjective security ID of the current task
 209  */
 210 static inline u32 current_sid(void)
 211 {
 212         const struct task_security_struct *tsec = current_security();
 213
 214         return tsec->sid;
 215 }
 216
 217 /* Allocate and free functions for each kind of security blob. */
 218
 219 static int inode_alloc_security(struct inode *inode)
 220 {
 221         struct inode_security_struct *isec;
 222         u32 sid = current_sid();
 223
 224         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 225         if (!isec)
 226                 return -ENOMEM;
 227
 228         mutex_init(&isec->lock);
 229         INIT_LIST_HEAD(&isec->list);
 230         isec->inode = inode;
 231         isec->sid = SECINITSID_UNLABELED;
 232         isec->sclass = SECCLASS_FILE;
 233         isec->task_sid = sid;
 234         inode->i_security = isec;
 235
 236         return 0;
 237 }
 238
 239 static void inode_free_security(struct inode *inode)
 240 {
 241         struct inode_security_struct *isec = inode->i_security;
 242         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 243
 244         spin_lock(&sbsec->isec_lock);
 245         if (!list_empty(&isec->list))
 246                 list_del_init(&isec->list);
 247         spin_unlock(&sbsec->isec_lock);
 248
 249         inode->i_security = NULL;
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static int file_alloc_security(struct file *file)
 254 {
 255         struct file_security_struct *fsec;
 256         u32 sid = current_sid();
 257
 258         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 259         if (!fsec)
 260                 return -ENOMEM;
 261
 262         fsec->sid = sid;
 263         fsec->fown_sid = sid;
 264         file->f_security = fsec;
 265
 266         return 0;
 267 }
 268
 269 static void file_free_security(struct file *file)
 270 {
 271         struct file_security_struct *fsec = file->f_security;
 272         file->f_security = NULL;
 273         kfree(fsec);
 274 }
 275
 276 static int superblock_alloc_security(struct super_block *sb)
 277 {
 278         struct superblock_security_struct *sbsec;
 279
 280         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 281         if (!sbsec)
 282                 return -ENOMEM;
 283
 284         mutex_init(&sbsec->lock);
 285         INIT_LIST_HEAD(&sbsec->isec_head);
 286         spin_lock_init(&sbsec->isec_lock);
 287         sbsec->sb = sb;
 288         sbsec->sid = SECINITSID_UNLABELED;
 289         sbsec->def_sid = SECINITSID_FILE;
 290         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 291         sb->s_security = sbsec;
 292
 293         return 0;
 294 }
 295
 296 static void superblock_free_security(struct super_block *sb)
 297 {
 298         struct superblock_security_struct *sbsec = sb->s_security;
 299         sb->s_security = NULL;
 300         kfree(sbsec);
 301 }
 302
 303 /* The file system's label must be initialized prior to use. */
 304
 305 static const char *labeling_behaviors[6] = {
 306         "uses xattr",
 307         "uses transition SIDs",
 308         "uses task SIDs",
 309         "uses genfs_contexts",
 310         "not configured for labeling",
 311         "uses mountpoint labeling",
 312 };
 313
 314 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 315
 316 static inline int inode_doinit(struct inode *inode)
 317 {
 318         return inode_doinit_with_dentry(inode, NULL);
 319 }
 320
 321 enum {
 322         Opt_error = -1,
 323         Opt_context = 1,
 324         Opt_fscontext = 2,
 325         Opt_defcontext = 3,
 326         Opt_rootcontext = 4,
 327         Opt_labelsupport = 5,
 328         Opt_nextmntopt = 6,
 329 };
 330
 331 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 332
 333 static const match_table_t tokens = {
 334         {Opt_context, CONTEXT_STR "%s"},
 335         {Opt_fscontext, FSCONTEXT_STR "%s"},
 336         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 337         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 338         {Opt_labelsupport, LABELSUPP_STR},
 339         {Opt_error, NULL},
 340 };
 341
 342 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 343
 344 static int may_context_mount_sb_relabel(u32 sid,
 345                         struct superblock_security_struct *sbsec,
 346                         const struct cred *cred)
 347 {
 348         const struct task_security_struct *tsec = cred->security;
 349         int rc;
 350
 351         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 352                           FILESYSTEM__RELABELFROM, NULL);
 353         if (rc)
 354                 return rc;
 355
 356         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELTO, NULL);
 358         return rc;
 359 }
 360
 361 static int may_context_mount_inode_relabel(u32 sid,
 362                         struct superblock_security_struct *sbsec,
 363                         const struct cred *cred)
 364 {
 365         const struct task_security_struct *tsec = cred->security;
 366         int rc;
 367         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 368                           FILESYSTEM__RELABELFROM, NULL);
 369         if (rc)
 370                 return rc;
 371
 372         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 373                           FILESYSTEM__ASSOCIATE, NULL);
 374         return rc;
 375 }
 376
 377 static int selinux_is_sblabel_mnt(struct super_block *sb)
 378 {
 379         struct superblock_security_struct *sbsec = sb->s_security;
 380
 381         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 382             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 383             sbsec->behavior == SECURITY_FS_USE_TASK)
 384                 return 1;
 385
 386         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 387         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 388                 return 1;
 389
 390         /*
 391          * Special handling for rootfs. Is genfs but supports
 392          * setting SELinux context on in-core inodes.
 393          */
 394         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 395                 return 1;
 396
 397         return 0;
 398 }
 399
 400 static int sb_finish_set_opts(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403         struct dentry *root = sb->s_root;
 404         struct inode *root_inode = root->d_inode;
 405         int rc = 0;
 406
 407         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 408                 /* Make sure that the xattr handler exists and that no
 409                    error other than -ENODATA is returned by getxattr on
 410                    the root directory.  -ENODATA is ok, as this may be
 411                    the first boot of the SELinux kernel before we have
 412                    assigned xattr values to the filesystem. */
 413                 if (!root_inode->i_op->getxattr) {
 414                         printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
 415                                "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
 416                         rc = -EOPNOTSUPP;
 417                         goto out;
 418                 }
 419                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 420                 if (rc < 0 && rc != -ENODATA) {
 421                         if (rc == -EOPNOTSUPP)
 422                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 423                                        SB_TYPE_FMT") has no security xattr handler\n",
 424                                        sb->s_id, SB_TYPE_ARGS(sb));
 425                         else
 426                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 427                                        SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
 428                                        SB_TYPE_ARGS(sb), -rc);
 429                         goto out;
 430                 }
 431         }
 432
 433         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 434                 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
 435                        sb->s_id, SB_TYPE_ARGS(sb));
 436         else
 437                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
 438                        sb->s_id, SB_TYPE_ARGS(sb),
 439                        labeling_behaviors[sbsec->behavior-1]);
 440
 441         sbsec->flags |= SE_SBINITIALIZED;
 442         if (selinux_is_sblabel_mnt(sb))
 443                 sbsec->flags |= SBLABEL_MNT;
 444
 445         /* Initialize the root inode. */
 446         rc = inode_doinit_with_dentry(root_inode, root);
 447
 448         /* Initialize any other inodes associated with the superblock, e.g.
 449            inodes created prior to initial policy load or inodes created
 450            during get_sb by a pseudo filesystem that directly
 451            populates itself. */
 452         spin_lock(&sbsec->isec_lock);
 453 next_inode:
 454         if (!list_empty(&sbsec->isec_head)) {
 455                 struct inode_security_struct *isec =
 456                                 list_entry(sbsec->isec_head.next,
 457                                            struct inode_security_struct, list);
 458                 struct inode *inode = isec->inode;
 459                 spin_unlock(&sbsec->isec_lock);
 460                 inode = igrab(inode);
 461                 if (inode) {
 462                         if (!IS_PRIVATE(inode))
 463                                 inode_doinit(inode);
 464                         iput(inode);
 465                 }
 466                 spin_lock(&sbsec->isec_lock);
 467                 list_del_init(&isec->list);
 468                 goto next_inode;
 469         }
 470         spin_unlock(&sbsec->isec_lock);
 471 out:
 472         return rc;
 473 }
 474
 475 /*
 476  * This function should allow an FS to ask what it's mount security
 477  * options were so it can use those later for submounts, displaying
 478  * mount options, or whatever.
 479  */
 480 static int selinux_get_mnt_opts(const struct super_block *sb,
 481                                 struct security_mnt_opts *opts)
 482 {
 483         int rc = 0, i;
 484         struct superblock_security_struct *sbsec = sb->s_security;
 485         char *context = NULL;
 486         u32 len;
 487         char tmp;
 488
 489         security_init_mnt_opts(opts);
 490
 491         if (!(sbsec->flags & SE_SBINITIALIZED))
 492                 return -EINVAL;
 493
 494         if (!ss_initialized)
 495                 return -EINVAL;
 496
 497         /* make sure we always check enough bits to cover the mask */
 498         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 499
 500         tmp = sbsec->flags & SE_MNTMASK;
 501         /* count the number of mount options for this sb */
 502         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 503                 if (tmp & 0x01)
 504                         opts->num_mnt_opts++;
 505                 tmp >>= 1;
 506         }
 507
 508         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 509         if (!opts->mnt_opts) {
 510                 rc = -ENOMEM;
 511                 goto out_free;
 512         }
 513
 514         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 515         if (!opts->mnt_opts_flags) {
 516                 rc = -ENOMEM;
 517                 goto out_free;
 518         }
 519
 520         i = 0;
 521         if (sbsec->flags & FSCONTEXT_MNT) {
 522                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 523                 if (rc)
 524                         goto out_free;
 525                 opts->mnt_opts[i] = context;
 526                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 527         }
 528         if (sbsec->flags & CONTEXT_MNT) {
 529                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 530                 if (rc)
 531                         goto out_free;
 532                 opts->mnt_opts[i] = context;
 533                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 534         }
 535         if (sbsec->flags & DEFCONTEXT_MNT) {
 536                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 537                 if (rc)
 538                         goto out_free;
 539                 opts->mnt_opts[i] = context;
 540                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 541         }
 542         if (sbsec->flags & ROOTCONTEXT_MNT) {
 543                 struct inode *root = sbsec->sb->s_root->d_inode;
 544                 struct inode_security_struct *isec = root->i_security;
 545
 546                 rc = security_sid_to_context(isec->sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 551         }
 552         if (sbsec->flags & SBLABEL_MNT) {
 553                 opts->mnt_opts[i] = NULL;
 554                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 555         }
 556
 557         BUG_ON(i != opts->num_mnt_opts);
 558
 559         return 0;
 560
 561 out_free:
 562         security_free_mnt_opts(opts);
 563         return rc;
 564 }
 565
 566 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 567                       u32 old_sid, u32 new_sid)
 568 {
 569         char mnt_flags = sbsec->flags & SE_MNTMASK;
 570
 571         /* check if the old mount command had the same options */
 572         if (sbsec->flags & SE_SBINITIALIZED)
 573                 if (!(sbsec->flags & flag) ||
 574                     (old_sid != new_sid))
 575                         return 1;
 576
 577         /* check if we were passed the same options twice,
 578          * aka someone passed context=a,context=b
 579          */
 580         if (!(sbsec->flags & SE_SBINITIALIZED))
 581                 if (mnt_flags & flag)
 582                         return 1;
 583         return 0;
 584 }
 585
 586 /*
 587  * Allow filesystems with binary mount data to explicitly set mount point
 588  * labeling information.
 589  */
 590 static int selinux_set_mnt_opts(struct super_block *sb,
 591                                 struct security_mnt_opts *opts)
 592 {
 593         const struct cred *cred = current_cred();
 594         int rc = 0, i;
 595         struct superblock_security_struct *sbsec = sb->s_security;
 596         struct inode *inode = sbsec->sb->s_root->d_inode;
 597         struct inode_security_struct *root_isec = inode->i_security;
 598         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 599         u32 defcontext_sid = 0;
 600         char **mount_options = opts->mnt_opts;
 601         int *flags = opts->mnt_opts_flags;
 602         int num_opts = opts->num_mnt_opts;
 603
 604         mutex_lock(&sbsec->lock);
 605
 606         if (!ss_initialized) {
 607                 if (!num_opts) {
 608                         /* Defer initialization until selinux_complete_init,
 609                            after the initial policy is loaded and the security
 610                            server is ready to handle calls. */
 611                         goto out;
 612                 }
 613                 rc = -EINVAL;
 614                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 615                         "before the security server is initialized\n");
 616                 goto out;
 617         }
 618
 619         /*
 620          * Binary mount data FS will come through this function twice.  Once
 621          * from an explicit call and once from the generic calls from the vfs.
 622          * Since the generic VFS calls will not contain any security mount data
 623          * we need to skip the double mount verification.
 624          *
 625          * This does open a hole in which we will not notice if the first
 626          * mount using this sb set explict options and a second mount using
 627          * this sb does not set any security options.  (The first options
 628          * will be used for both mounts)
 629          */
 630         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 631             && (num_opts == 0))
 632                 goto out;
 633
 634         /*
 635          * parse the mount options, check if they are valid sids.
 636          * also check if someone is trying to mount the same sb more
 637          * than once with different security options.
 638          */
 639         for (i = 0; i < num_opts; i++) {
 640                 u32 sid;
 641
 642                 if (flags[i] == SBLABEL_MNT)
 643                         continue;
 644                 rc = security_context_to_sid(mount_options[i],
 645                                              strlen(mount_options[i]), &sid);
 646                 if (rc) {
 647                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 648                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
 649                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
 650                         goto out;
 651                 }
 652                 switch (flags[i]) {
 653                 case FSCONTEXT_MNT:
 654                         fscontext_sid = sid;
 655
 656                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 657                                         fscontext_sid))
 658                                 goto out_double_mount;
 659
 660                         sbsec->flags |= FSCONTEXT_MNT;
 661                         break;
 662                 case CONTEXT_MNT:
 663                         context_sid = sid;
 664
 665                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 666                                         context_sid))
 667                                 goto out_double_mount;
 668
 669                         sbsec->flags |= CONTEXT_MNT;
 670                         break;
 671                 case ROOTCONTEXT_MNT:
 672                         rootcontext_sid = sid;
 673
 674                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 675                                         rootcontext_sid))
 676                                 goto out_double_mount;
 677
 678                         sbsec->flags |= ROOTCONTEXT_MNT;
 679
 680                         break;
 681                 case DEFCONTEXT_MNT:
 682                         defcontext_sid = sid;
 683
 684                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 685                                         defcontext_sid))
 686                                 goto out_double_mount;
 687
 688                         sbsec->flags |= DEFCONTEXT_MNT;
 689
 690                         break;
 691                 default:
 692                         rc = -EINVAL;
 693                         goto out;
 694                 }
 695         }
 696
 697         if (sbsec->flags & SE_SBINITIALIZED) {
 698                 /* previously mounted with options, but not on this attempt? */
 699                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 700                         goto out_double_mount;
 701                 rc = 0;
 702                 goto out;
 703         }
 704
 705         if (strcmp(sb->s_type->name, "proc") == 0)
 706                 sbsec->flags |= SE_SBPROC;
 707
 708         /* Determine the labeling behavior to use for this filesystem type. */
 709         rc = security_fs_use(sb);
 710         if (rc) {
 711                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 712                        __func__, sb->s_type->name, rc);
 713                 goto out;
 714         }
 715
 716         /* sets the context of the superblock for the fs being mounted. */
 717         if (fscontext_sid) {
 718                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 719                 if (rc)
 720                         goto out;
 721
 722                 sbsec->sid = fscontext_sid;
 723         }
 724
 725         /*
 726          * Switch to using mount point labeling behavior.
 727          * sets the label used on all file below the mountpoint, and will set
 728          * the superblock context if not already set.
 729          */
 730         if (context_sid) {
 731                 if (!fscontext_sid) {
 732                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 733                                                           cred);
 734                         if (rc)
 735                                 goto out;
 736                         sbsec->sid = context_sid;
 737                 } else {
 738                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 739                                                              cred);
 740                         if (rc)
 741                                 goto out;
 742                 }
 743                 if (!rootcontext_sid)
 744                         rootcontext_sid = context_sid;
 745
 746                 sbsec->mntpoint_sid = context_sid;
 747                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 748         }
 749
 750         if (rootcontext_sid) {
 751                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 752                                                      cred);
 753                 if (rc)
 754                         goto out;
 755
 756                 root_isec->sid = rootcontext_sid;
 757                 root_isec->initialized = 1;
 758         }
 759
 760         if (defcontext_sid) {
 761                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 762                         rc = -EINVAL;
 763                         printk(KERN_WARNING "SELinux: defcontext option is "
 764                                "invalid for this filesystem type\n");
 765                         goto out;
 766                 }
 767
 768                 if (defcontext_sid != sbsec->def_sid) {
 769                         rc = may_context_mount_inode_relabel(defcontext_sid,
 770                                                              sbsec, cred);
 771                         if (rc)
 772                                 goto out;
 773                 }
 774
 775                 sbsec->def_sid = defcontext_sid;
 776         }
 777
 778         rc = sb_finish_set_opts(sb);
 779 out:
 780         mutex_unlock(&sbsec->lock);
 781         return rc;
 782 out_double_mount:
 783         rc = -EINVAL;
 784         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 785                "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
 786                SB_TYPE_ARGS(sb));
 787         goto out;
 788 }
 789
 790 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 791                                     const struct super_block *newsb)
 792 {
 793         struct superblock_security_struct *old = oldsb->s_security;
 794         struct superblock_security_struct *new = newsb->s_security;
 795         char oldflags = old->flags & SE_MNTMASK;
 796         char newflags = new->flags & SE_MNTMASK;
 797
 798         if (oldflags != newflags)
 799                 goto mismatch;
 800         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 801                 goto mismatch;
 802         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 803                 goto mismatch;
 804         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 805                 goto mismatch;
 806         if (oldflags & ROOTCONTEXT_MNT) {
 807                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 808                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 809                 if (oldroot->sid != newroot->sid)
 810                         goto mismatch;
 811         }
 812         return 0;
 813 mismatch:
 814         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 815                             "different security settings for (dev %s, "
 816                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 817         return -EBUSY;
 818 }
 819
 820 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 821                                         struct super_block *newsb)
 822 {
 823         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 824         struct superblock_security_struct *newsbsec = newsb->s_security;
 825
 826         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 827         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 828         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 829
 830         /*
 831          * if the parent was able to be mounted it clearly had no special lsm
 832          * mount options.  thus we can safely deal with this superblock later
 833          */
 834         if (!ss_initialized)
 835                 return 0;
 836
 837         /* how can we clone if the old one wasn't set up?? */
 838         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 839
 840         /* if fs is reusing a sb, make sure that the contexts match */
 841         if (newsbsec->flags & SE_SBINITIALIZED)
 842                 return selinux_cmp_sb_context(oldsb, newsb);
 843
 844         mutex_lock(&newsbsec->lock);
 845
 846         newsbsec->flags = oldsbsec->flags;
 847
 848         newsbsec->sid = oldsbsec->sid;
 849         newsbsec->def_sid = oldsbsec->def_sid;
 850         newsbsec->behavior = oldsbsec->behavior;
 851
 852         if (set_context) {
 853                 u32 sid = oldsbsec->mntpoint_sid;
 854
 855                 if (!set_fscontext)
 856                         newsbsec->sid = sid;
 857                 if (!set_rootcontext) {
 858                         struct inode *newinode = newsb->s_root->d_inode;
 859                         struct inode_security_struct *newisec = newinode->i_security;
 860                         newisec->sid = sid;
 861                 }
 862                 newsbsec->mntpoint_sid = sid;
 863         }
 864         if (set_rootcontext) {
 865                 const struct inode *oldinode = oldsb->s_root->d_inode;
 866                 const struct inode_security_struct *oldisec = oldinode->i_security;
 867                 struct inode *newinode = newsb->s_root->d_inode;
 868                 struct inode_security_struct *newisec = newinode->i_security;
 869
 870                 newisec->sid = oldisec->sid;
 871         }
 872
 873         sb_finish_set_opts(newsb);
 874         mutex_unlock(&newsbsec->lock);
 875         return 0;
 876 }
 877
 878 static int selinux_parse_opts_str(char *options,
 879                                   struct security_mnt_opts *opts)
 880 {
 881         char *p;
 882         char *context = NULL, *defcontext = NULL;
 883         char *fscontext = NULL, *rootcontext = NULL;
 884         int rc, num_mnt_opts = 0;
 885
 886         opts->num_mnt_opts = 0;
 887
 888         /* Standard string-based options. */
 889         while ((p = strsep(&options, "|")) != NULL) {
 890                 int token;
 891                 substring_t args[MAX_OPT_ARGS];
 892
 893                 if (!*p)
 894                         continue;
 895
 896                 token = match_token(p, tokens, args);
 897
 898                 switch (token) {
 899                 case Opt_context:
 900                         if (context || defcontext) {
 901                                 rc = -EINVAL;
 902                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 903                                 goto out_err;
 904                         }
 905                         context = match_strdup(&args[0]);
 906                         if (!context) {
 907                                 rc = -ENOMEM;
 908                                 goto out_err;
 909                         }
 910                         break;
 911
 912                 case Opt_fscontext:
 913                         if (fscontext) {
 914                                 rc = -EINVAL;
 915                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 916                                 goto out_err;
 917                         }
 918                         fscontext = match_strdup(&args[0]);
 919                         if (!fscontext) {
 920                                 rc = -ENOMEM;
 921                                 goto out_err;
 922                         }
 923                         break;
 924
 925                 case Opt_rootcontext:
 926                         if (rootcontext) {
 927                                 rc = -EINVAL;
 928                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 929                                 goto out_err;
 930                         }
 931                         rootcontext = match_strdup(&args[0]);
 932                         if (!rootcontext) {
 933                                 rc = -ENOMEM;
 934                                 goto out_err;
 935                         }
 936                         break;
 937
 938                 case Opt_defcontext:
 939                         if (context || defcontext) {
 940                                 rc = -EINVAL;
 941                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 942                                 goto out_err;
 943                         }
 944                         defcontext = match_strdup(&args[0]);
 945                         if (!defcontext) {
 946                                 rc = -ENOMEM;
 947                                 goto out_err;
 948                         }
 949                         break;
 950                 case Opt_labelsupport:
 951                         break;
 952                 default:
 953                         rc = -EINVAL;
 954                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 955                         goto out_err;
 956
 957                 }
 958         }
 959
 960         rc = -ENOMEM;
 961         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 962         if (!opts->mnt_opts)
 963                 goto out_err;
 964
 965         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 966         if (!opts->mnt_opts_flags) {
 967                 kfree(opts->mnt_opts);
 968                 goto out_err;
 969         }
 970
 971         if (fscontext) {
 972                 opts->mnt_opts[num_mnt_opts] = fscontext;
 973                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 974         }
 975         if (context) {
 976                 opts->mnt_opts[num_mnt_opts] = context;
 977                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 978         }
 979         if (rootcontext) {
 980                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 981                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 982         }
 983         if (defcontext) {
 984                 opts->mnt_opts[num_mnt_opts] = defcontext;
 985                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 986         }
 987
 988         opts->num_mnt_opts = num_mnt_opts;
 989         return 0;
 990
 991 out_err:
 992         kfree(context);
 993         kfree(defcontext);
 994         kfree(fscontext);
 995         kfree(rootcontext);
 996         return rc;
 997 }
 998 /*
 999  * string mount options parsing and call set the sbsec
1000  */
1001 static int superblock_doinit(struct super_block *sb, void *data)
1002 {
1003         int rc = 0;
1004         char *options = data;
1005         struct security_mnt_opts opts;
1006
1007         security_init_mnt_opts(&opts);
1008
1009         if (!data)
1010                 goto out;
1011
1012         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1013
1014         rc = selinux_parse_opts_str(options, &opts);
1015         if (rc)
1016                 goto out_err;
1017
1018 out:
1019         rc = selinux_set_mnt_opts(sb, &opts);
1020
1021 out_err:
1022         security_free_mnt_opts(&opts);
1023         return rc;
1024 }
1025
1026 static void selinux_write_opts(struct seq_file *m,
1027                                struct security_mnt_opts *opts)
1028 {
1029         int i;
1030         char *prefix;
1031
1032         for (i = 0; i < opts->num_mnt_opts; i++) {
1033                 char *has_comma;
1034
1035                 if (opts->mnt_opts[i])
1036                         has_comma = strchr(opts->mnt_opts[i], ',');
1037                 else
1038                         has_comma = NULL;
1039
1040                 switch (opts->mnt_opts_flags[i]) {
1041                 case CONTEXT_MNT:
1042                         prefix = CONTEXT_STR;
1043                         break;
1044                 case FSCONTEXT_MNT:
1045                         prefix = FSCONTEXT_STR;
1046                         break;
1047                 case ROOTCONTEXT_MNT:
1048                         prefix = ROOTCONTEXT_STR;
1049                         break;
1050                 case DEFCONTEXT_MNT:
1051                         prefix = DEFCONTEXT_STR;
1052                         break;
1053                 case SBLABEL_MNT:
1054                         seq_putc(m, ',');
1055                         seq_puts(m, LABELSUPP_STR);
1056                         continue;
1057                 default:
1058                         BUG();
1059                         return;
1060                 };
1061                 /* we need a comma before each option */
1062                 seq_putc(m, ',');
1063                 seq_puts(m, prefix);
1064                 if (has_comma)
1065                         seq_putc(m, '\"');
1066                 seq_puts(m, opts->mnt_opts[i]);
1067                 if (has_comma)
1068                         seq_putc(m, '\"');
1069         }
1070 }
1071
1072 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1073 {
1074         struct security_mnt_opts opts;
1075         int rc;
1076
1077         rc = selinux_get_mnt_opts(sb, &opts);
1078         if (rc) {
1079                 /* before policy load we may get EINVAL, don't show anything */
1080                 if (rc == -EINVAL)
1081                         rc = 0;
1082                 return rc;
1083         }
1084
1085         selinux_write_opts(m, &opts);
1086
1087         security_free_mnt_opts(&opts);
1088
1089         return rc;
1090 }
1091
1092 static inline u16 inode_mode_to_security_class(umode_t mode)
1093 {
1094         switch (mode & S_IFMT) {
1095         case S_IFSOCK:
1096                 return SECCLASS_SOCK_FILE;
1097         case S_IFLNK:
1098                 return SECCLASS_LNK_FILE;
1099         case S_IFREG:
1100                 return SECCLASS_FILE;
1101         case S_IFBLK:
1102                 return SECCLASS_BLK_FILE;
1103         case S_IFDIR:
1104                 return SECCLASS_DIR;
1105         case S_IFCHR:
1106                 return SECCLASS_CHR_FILE;
1107         case S_IFIFO:
1108                 return SECCLASS_FIFO_FILE;
1109
1110         }
1111
1112         return SECCLASS_FILE;
1113 }
1114
1115 static inline int default_protocol_stream(int protocol)
1116 {
1117         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1118 }
1119
1120 static inline int default_protocol_dgram(int protocol)
1121 {
1122         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1123 }
1124
1125 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1126 {
1127         switch (family) {
1128         case PF_UNIX:
1129                 switch (type) {
1130                 case SOCK_STREAM:
1131                 case SOCK_SEQPACKET:
1132                         return SECCLASS_UNIX_STREAM_SOCKET;
1133                 case SOCK_DGRAM:
1134                         return SECCLASS_UNIX_DGRAM_SOCKET;
1135                 }
1136                 break;
1137         case PF_INET:
1138         case PF_INET6:
1139                 switch (type) {
1140                 case SOCK_STREAM:
1141                         if (default_protocol_stream(protocol))
1142                                 return SECCLASS_TCP_SOCKET;
1143                         else
1144                                 return SECCLASS_RAWIP_SOCKET;
1145                 case SOCK_DGRAM:
1146                         if (default_protocol_dgram(protocol))
1147                                 return SECCLASS_UDP_SOCKET;
1148                         else
1149                                 return SECCLASS_RAWIP_SOCKET;
1150                 case SOCK_DCCP:
1151                         return SECCLASS_DCCP_SOCKET;
1152                 default:
1153                         return SECCLASS_RAWIP_SOCKET;
1154                 }
1155                 break;
1156         case PF_NETLINK:
1157                 switch (protocol) {
1158                 case NETLINK_ROUTE:
1159                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1160                 case NETLINK_FIREWALL:
1161                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1162                 case NETLINK_SOCK_DIAG:
1163                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1164                 case NETLINK_NFLOG:
1165                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1166                 case NETLINK_XFRM:
1167                         return SECCLASS_NETLINK_XFRM_SOCKET;
1168                 case NETLINK_SELINUX:
1169                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1170                 case NETLINK_AUDIT:
1171                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1172                 case NETLINK_IP6_FW:
1173                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1174                 case NETLINK_DNRTMSG:
1175                         return SECCLASS_NETLINK_DNRT_SOCKET;
1176                 case NETLINK_KOBJECT_UEVENT:
1177                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1178                 default:
1179                         return SECCLASS_NETLINK_SOCKET;
1180                 }
1181         case PF_PACKET:
1182                 return SECCLASS_PACKET_SOCKET;
1183         case PF_KEY:
1184                 return SECCLASS_KEY_SOCKET;
1185         case PF_APPLETALK:
1186                 return SECCLASS_APPLETALK_SOCKET;
1187         }
1188
1189         return SECCLASS_SOCKET;
1190 }
1191
1192 #ifdef CONFIG_PROC_FS
1193 static int selinux_proc_get_sid(struct dentry *dentry,
1194                                 u16 tclass,
1195                                 u32 *sid)
1196 {
1197         int rc;
1198         char *buffer, *path;
1199
1200         buffer = (char *)__get_free_page(GFP_KERNEL);
1201         if (!buffer)
1202                 return -ENOMEM;
1203
1204         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1205         if (IS_ERR(path))
1206                 rc = PTR_ERR(path);
1207         else {
1208                 /* each process gets a /proc/PID/ entry. Strip off the
1209                  * PID part to get a valid selinux labeling.
1210                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1211                 while (path[1] >= '0' && path[1] <= '9') {
1212                         path[1] = '/';
1213                         path++;
1214                 }
1215                 rc = security_genfs_sid("proc", path, tclass, sid);
1216         }
1217         free_page((unsigned long)buffer);
1218         return rc;
1219 }
1220 #else
1221 static int selinux_proc_get_sid(struct dentry *dentry,
1222                                 u16 tclass,
1223                                 u32 *sid)
1224 {
1225         return -EINVAL;
1226 }
1227 #endif
1228
1229 /* The inode's security attributes must be initialized before first use. */
1230 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1231 {
1232         struct superblock_security_struct *sbsec = NULL;
1233         struct inode_security_struct *isec = inode->i_security;
1234         u32 sid;
1235         struct dentry *dentry;
1236 #define INITCONTEXTLEN 255
1237         char *context = NULL;
1238         unsigned len = 0;
1239         int rc = 0;
1240
1241         if (isec->initialized)
1242                 goto out;
1243
1244         mutex_lock(&isec->lock);
1245         if (isec->initialized)
1246                 goto out_unlock;
1247
1248         sbsec = inode->i_sb->s_security;
1249         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1250                 /* Defer initialization until selinux_complete_init,
1251                    after the initial policy is loaded and the security
1252                    server is ready to handle calls. */
1253                 spin_lock(&sbsec->isec_lock);
1254                 if (list_empty(&isec->list))
1255                         list_add(&isec->list, &sbsec->isec_head);
1256                 spin_unlock(&sbsec->isec_lock);
1257                 goto out_unlock;
1258         }
1259
1260         switch (sbsec->behavior) {
1261         case SECURITY_FS_USE_XATTR:
1262                 if (!inode->i_op->getxattr) {
1263                         isec->sid = sbsec->def_sid;
1264                         break;
1265                 }
1266
1267                 /* Need a dentry, since the xattr API requires one.
1268                    Life would be simpler if we could just pass the inode. */
1269                 if (opt_dentry) {
1270                         /* Called from d_instantiate or d_splice_alias. */
1271                         dentry = dget(opt_dentry);
1272                 } else {
1273                         /* Called from selinux_complete_init, try to find a dentry. */
1274                         dentry = d_find_alias(inode);
1275                 }
1276                 if (!dentry) {
1277                         /*
1278                          * this is can be hit on boot when a file is accessed
1279                          * before the policy is loaded.  When we load policy we
1280                          * may find inodes that have no dentry on the
1281                          * sbsec->isec_head list.  No reason to complain as these
1282                          * will get fixed up the next time we go through
1283                          * inode_doinit with a dentry, before these inodes could
1284                          * be used again by userspace.
1285                          */
1286                         goto out_unlock;
1287                 }
1288
1289                 len = INITCONTEXTLEN;
1290                 context = kmalloc(len+1, GFP_NOFS);
1291                 if (!context) {
1292                         rc = -ENOMEM;
1293                         dput(dentry);
1294                         goto out_unlock;
1295                 }
1296                 context[len] = '\0';
1297                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1298                                            context, len);
1299                 if (rc == -ERANGE) {
1300                         kfree(context);
1301
1302                         /* Need a larger buffer.  Query for the right size. */
1303                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1304                                                    NULL, 0);
1305                         if (rc < 0) {
1306                                 dput(dentry);
1307                                 goto out_unlock;
1308                         }
1309                         len = rc;
1310                         context = kmalloc(len+1, GFP_NOFS);
1311                         if (!context) {
1312                                 rc = -ENOMEM;
1313                                 dput(dentry);
1314                                 goto out_unlock;
1315                         }
1316                         context[len] = '\0';
1317                         rc = inode->i_op->getxattr(dentry,
1318                                                    XATTR_NAME_SELINUX,
1319                                                    context, len);
1320                 }
1321                 dput(dentry);
1322                 if (rc < 0) {
1323                         if (rc != -ENODATA) {
1324                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1325                                        "%d for dev=%s ino=%ld\n", __func__,
1326                                        -rc, inode->i_sb->s_id, inode->i_ino);
1327                                 kfree(context);
1328                                 goto out_unlock;
1329                         }
1330                         /* Map ENODATA to the default file SID */
1331                         sid = sbsec->def_sid;
1332                         rc = 0;
1333                 } else {
1334                         rc = security_context_to_sid_default(context, rc, &sid,
1335                                                              sbsec->def_sid,
1336                                                              GFP_NOFS);
1337                         if (rc) {
1338                                 char *dev = inode->i_sb->s_id;
1339                                 unsigned long ino = inode->i_ino;
1340
1341                                 if (rc == -EINVAL) {
1342                                         if (printk_ratelimit())
1343                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1344                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1345                                                         "filesystem in question.\n", ino, dev, context);
1346                                 } else {
1347                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1348                                                "returned %d for dev=%s ino=%ld\n",
1349                                                __func__, context, -rc, dev, ino);
1350                                 }
1351                                 kfree(context);
1352                                 /* Leave with the unlabeled SID */
1353                                 rc = 0;
1354                                 break;
1355                         }
1356                 }
1357                 kfree(context);
1358                 isec->sid = sid;
1359                 break;
1360         case SECURITY_FS_USE_TASK:
1361                 isec->sid = isec->task_sid;
1362                 break;
1363         case SECURITY_FS_USE_TRANS:
1364                 /* Default to the fs SID. */
1365                 isec->sid = sbsec->sid;
1366
1367                 /* Try to obtain a transition SID. */
1368                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1369                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1370                                              isec->sclass, NULL, &sid);
1371                 if (rc)
1372                         goto out_unlock;
1373                 isec->sid = sid;
1374                 break;
1375         case SECURITY_FS_USE_MNTPOINT:
1376                 isec->sid = sbsec->mntpoint_sid;
1377                 break;
1378         default:
1379                 /* Default to the fs superblock SID. */
1380                 isec->sid = sbsec->sid;
1381
1382                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1383                         if (opt_dentry) {
1384                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1385                                 rc = selinux_proc_get_sid(opt_dentry,
1386                                                           isec->sclass,
1387                                                           &sid);
1388                                 if (rc)
1389                                         goto out_unlock;
1390                                 isec->sid = sid;
1391                         }
1392                 }
1393                 break;
1394         }
1395
1396         isec->initialized = 1;
1397
1398 out_unlock:
1399         mutex_unlock(&isec->lock);
1400 out:
1401         if (isec->sclass == SECCLASS_FILE)
1402                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1403         return rc;
1404 }
1405
1406 /* Convert a Linux signal to an access vector. */
1407 static inline u32 signal_to_av(int sig)
1408 {
1409         u32 perm = 0;
1410
1411         switch (sig) {
1412         case SIGCHLD:
1413                 /* Commonly granted from child to parent. */
1414                 perm = PROCESS__SIGCHLD;
1415                 break;
1416         case SIGKILL:
1417                 /* Cannot be caught or ignored */
1418                 perm = PROCESS__SIGKILL;
1419                 break;
1420         case SIGSTOP:
1421                 /* Cannot be caught or ignored */
1422                 perm = PROCESS__SIGSTOP;
1423                 break;
1424         default:
1425                 /* All other signals. */
1426                 perm = PROCESS__SIGNAL;
1427                 break;
1428         }
1429
1430         return perm;
1431 }
1432
1433 /*
1434  * Check permission between a pair of credentials
1435  * fork check, ptrace check, etc.
1436  */
1437 static int cred_has_perm(const struct cred *actor,
1438                          const struct cred *target,
1439                          u32 perms)
1440 {
1441         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1442
1443         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1444 }
1445
1446 /*
1447  * Check permission between a pair of tasks, e.g. signal checks,
1448  * fork check, ptrace check, etc.
1449  * tsk1 is the actor and tsk2 is the target
1450  * - this uses the default subjective creds of tsk1
1451  */
1452 static int task_has_perm(const struct task_struct *tsk1,
1453                          const struct task_struct *tsk2,
1454                          u32 perms)
1455 {
1456         const struct task_security_struct *__tsec1, *__tsec2;
1457         u32 sid1, sid2;
1458
1459         rcu_read_lock();
1460         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1461         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1462         rcu_read_unlock();
1463         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1464 }
1465
1466 /*
1467  * Check permission between current and another task, e.g. signal checks,
1468  * fork check, ptrace check, etc.
1469  * current is the actor and tsk2 is the target
1470  * - this uses current's subjective creds
1471  */
1472 static int current_has_perm(const struct task_struct *tsk,
1473                             u32 perms)
1474 {
1475         u32 sid, tsid;
1476
1477         sid = current_sid();
1478         tsid = task_sid(tsk);
1479         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1480 }
1481
1482 #if CAP_LAST_CAP > 63
1483 #error Fix SELinux to handle capabilities > 63.
1484 #endif
1485
1486 /* Check whether a task is allowed to use a capability. */
1487 static int cred_has_capability(const struct cred *cred,
1488                                int cap, int audit)
1489 {
1490         struct common_audit_data ad;
1491         struct av_decision avd;
1492         u16 sclass;
1493         u32 sid = cred_sid(cred);
1494         u32 av = CAP_TO_MASK(cap);
1495         int rc;
1496
1497         ad.type = LSM_AUDIT_DATA_CAP;
1498         ad.u.cap = cap;
1499
1500         switch (CAP_TO_INDEX(cap)) {
1501         case 0:
1502                 sclass = SECCLASS_CAPABILITY;
1503                 break;
1504         case 1:
1505                 sclass = SECCLASS_CAPABILITY2;
1506                 break;
1507         default:
1508                 printk(KERN_ERR
1509                        "SELinux:  out of range capability %d\n", cap);
1510                 BUG();
1511                 return -EINVAL;
1512         }
1513
1514         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1515         if (audit == SECURITY_CAP_AUDIT) {
1516                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1517                 if (rc2)
1518                         return rc2;
1519         }
1520         return rc;
1521 }
1522
1523 /* Check whether a task is allowed to use a system operation. */
1524 static int task_has_system(struct task_struct *tsk,
1525                            u32 perms)
1526 {
1527         u32 sid = task_sid(tsk);
1528
1529         return avc_has_perm(sid, SECINITSID_KERNEL,
1530                             SECCLASS_SYSTEM, perms, NULL);
1531 }
1532
1533 /* Check whether a task has a particular permission to an inode.
1534    The 'adp' parameter is optional and allows other audit
1535    data to be passed (e.g. the dentry). */
1536 static int inode_has_perm(const struct cred *cred,
1537                           struct inode *inode,
1538                           u32 perms,
1539                           struct common_audit_data *adp,
1540                           unsigned flags)
1541 {
1542         struct inode_security_struct *isec;
1543         u32 sid;
1544
1545         validate_creds(cred);
1546
1547         if (unlikely(IS_PRIVATE(inode)))
1548                 return 0;
1549
1550         sid = cred_sid(cred);
1551         isec = inode->i_security;
1552
1553         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1554 }
1555
1556 /* Same as inode_has_perm, but pass explicit audit data containing
1557    the dentry to help the auditing code to more easily generate the
1558    pathname if needed. */
1559 static inline int dentry_has_perm(const struct cred *cred,
1560                                   struct dentry *dentry,
1561                                   u32 av)
1562 {
1563         struct inode *inode = dentry->d_inode;
1564         struct common_audit_data ad;
1565
1566         ad.type = LSM_AUDIT_DATA_DENTRY;
1567         ad.u.dentry = dentry;
1568         return inode_has_perm(cred, inode, av, &ad, 0);
1569 }
1570
1571 /* Same as inode_has_perm, but pass explicit audit data containing
1572    the path to help the auditing code to more easily generate the
1573    pathname if needed. */
1574 static inline int path_has_perm(const struct cred *cred,
1575                                 struct path *path,
1576                                 u32 av)
1577 {
1578         struct inode *inode = path->dentry->d_inode;
1579         struct common_audit_data ad;
1580
1581         ad.type = LSM_AUDIT_DATA_PATH;
1582         ad.u.path = *path;
1583         return inode_has_perm(cred, inode, av, &ad, 0);
1584 }
1585
1586 /* Check whether a task can use an open file descriptor to
1587    access an inode in a given way.  Check access to the
1588    descriptor itself, and then use dentry_has_perm to
1589    check a particular permission to the file.
1590    Access to the descriptor is implicitly granted if it
1591    has the same SID as the process.  If av is zero, then
1592    access to the file is not checked, e.g. for cases
1593    where only the descriptor is affected like seek. */
1594 static int file_has_perm(const struct cred *cred,
1595                          struct file *file,
1596                          u32 av)
1597 {
1598         struct file_security_struct *fsec = file->f_security;
1599         struct inode *inode = file_inode(file);
1600         struct common_audit_data ad;
1601         u32 sid = cred_sid(cred);
1602         int rc;
1603
1604         ad.type = LSM_AUDIT_DATA_PATH;
1605         ad.u.path = file->f_path;
1606
1607         if (sid != fsec->sid) {
1608                 rc = avc_has_perm(sid, fsec->sid,
1609                                   SECCLASS_FD,
1610                                   FD__USE,
1611                                   &ad);
1612                 if (rc)
1613                         goto out;
1614         }
1615
1616         /* av is zero if only checking access to the descriptor. */
1617         rc = 0;
1618         if (av)
1619                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1620
1621 out:
1622         return rc;
1623 }
1624
1625 /* Check whether a task can create a file. */
1626 static int may_create(struct inode *dir,
1627                       struct dentry *dentry,
1628                       u16 tclass)
1629 {
1630         const struct task_security_struct *tsec = current_security();
1631         struct inode_security_struct *dsec;
1632         struct superblock_security_struct *sbsec;
1633         u32 sid, newsid;
1634         struct common_audit_data ad;
1635         int rc;
1636
1637         dsec = dir->i_security;
1638         sbsec = dir->i_sb->s_security;
1639
1640         sid = tsec->sid;
1641         newsid = tsec->create_sid;
1642
1643         ad.type = LSM_AUDIT_DATA_DENTRY;
1644         ad.u.dentry = dentry;
1645
1646         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1647                           DIR__ADD_NAME | DIR__SEARCH,
1648                           &ad);
1649         if (rc)
1650                 return rc;
1651
1652         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1653                 rc = security_transition_sid(sid, dsec->sid, tclass,
1654                                              &dentry->d_name, &newsid);
1655                 if (rc)
1656                         return rc;
1657         }
1658
1659         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1660         if (rc)
1661                 return rc;
1662
1663         return avc_has_perm(newsid, sbsec->sid,
1664                             SECCLASS_FILESYSTEM,
1665                             FILESYSTEM__ASSOCIATE, &ad);
1666 }
1667
1668 /* Check whether a task can create a key. */
1669 static int may_create_key(u32 ksid,
1670                           struct task_struct *ctx)
1671 {
1672         u32 sid = task_sid(ctx);
1673
1674         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1675 }
1676
1677 #define MAY_LINK        0
1678 #define MAY_UNLINK      1
1679 #define MAY_RMDIR       2
1680
1681 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1682 static int may_link(struct inode *dir,
1683                     struct dentry *dentry,
1684                     int kind)
1685
1686 {
1687         struct inode_security_struct *dsec, *isec;
1688         struct common_audit_data ad;
1689         u32 sid = current_sid();
1690         u32 av;
1691         int rc;
1692
1693         dsec = dir->i_security;
1694         isec = dentry->d_inode->i_security;
1695
1696         ad.type = LSM_AUDIT_DATA_DENTRY;
1697         ad.u.dentry = dentry;
1698
1699         av = DIR__SEARCH;
1700         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1701         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1702         if (rc)
1703                 return rc;
1704
1705         switch (kind) {
1706         case MAY_LINK:
1707                 av = FILE__LINK;
1708                 break;
1709         case MAY_UNLINK:
1710                 av = FILE__UNLINK;
1711                 break;
1712         case MAY_RMDIR:
1713                 av = DIR__RMDIR;
1714                 break;
1715         default:
1716                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1717                         __func__, kind);
1718                 return 0;
1719         }
1720
1721         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1722         return rc;
1723 }
1724
1725 static inline int may_rename(struct inode *old_dir,
1726                              struct dentry *old_dentry,
1727                              struct inode *new_dir,
1728                              struct dentry *new_dentry)
1729 {
1730         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1731         struct common_audit_data ad;
1732         u32 sid = current_sid();
1733         u32 av;
1734         int old_is_dir, new_is_dir;
1735         int rc;
1736
1737         old_dsec = old_dir->i_security;
1738         old_isec = old_dentry->d_inode->i_security;
1739         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1740         new_dsec = new_dir->i_security;
1741
1742         ad.type = LSM_AUDIT_DATA_DENTRY;
1743
1744         ad.u.dentry = old_dentry;
1745         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1746                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1747         if (rc)
1748                 return rc;
1749         rc = avc_has_perm(sid, old_isec->sid,
1750                           old_isec->sclass, FILE__RENAME, &ad);
1751         if (rc)
1752                 return rc;
1753         if (old_is_dir && new_dir != old_dir) {
1754                 rc = avc_has_perm(sid, old_isec->sid,
1755                                   old_isec->sclass, DIR__REPARENT, &ad);
1756                 if (rc)
1757                         return rc;
1758         }
1759
1760         ad.u.dentry = new_dentry;
1761         av = DIR__ADD_NAME | DIR__SEARCH;
1762         if (new_dentry->d_inode)
1763                 av |= DIR__REMOVE_NAME;
1764         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1765         if (rc)
1766                 return rc;
1767         if (new_dentry->d_inode) {
1768                 new_isec = new_dentry->d_inode->i_security;
1769                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1770                 rc = avc_has_perm(sid, new_isec->sid,
1771                                   new_isec->sclass,
1772                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1773                 if (rc)
1774                         return rc;
1775         }
1776
1777         return 0;
1778 }
1779
1780 /* Check whether a task can perform a filesystem operation. */
1781 static int superblock_has_perm(const struct cred *cred,
1782                                struct super_block *sb,
1783                                u32 perms,
1784                                struct common_audit_data *ad)
1785 {
1786         struct superblock_security_struct *sbsec;
1787         u32 sid = cred_sid(cred);
1788
1789         sbsec = sb->s_security;
1790         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1791 }
1792
1793 /* Convert a Linux mode and permission mask to an access vector. */
1794 static inline u32 file_mask_to_av(int mode, int mask)
1795 {
1796         u32 av = 0;
1797
1798         if (!S_ISDIR(mode)) {
1799                 if (mask & MAY_EXEC)
1800                         av |= FILE__EXECUTE;
1801                 if (mask & MAY_READ)
1802                         av |= FILE__READ;
1803
1804                 if (mask & MAY_APPEND)
1805                         av |= FILE__APPEND;
1806                 else if (mask & MAY_WRITE)
1807                         av |= FILE__WRITE;
1808
1809         } else {
1810                 if (mask & MAY_EXEC)
1811                         av |= DIR__SEARCH;
1812                 if (mask & MAY_WRITE)
1813                         av |= DIR__WRITE;
1814                 if (mask & MAY_READ)
1815                         av |= DIR__READ;
1816         }
1817
1818         return av;
1819 }
1820
1821 /* Convert a Linux file to an access vector. */
1822 static inline u32 file_to_av(struct file *file)
1823 {
1824         u32 av = 0;
1825
1826         if (file->f_mode & FMODE_READ)
1827                 av |= FILE__READ;
1828         if (file->f_mode & FMODE_WRITE) {
1829                 if (file->f_flags & O_APPEND)
1830                         av |= FILE__APPEND;
1831                 else
1832                         av |= FILE__WRITE;
1833         }
1834         if (!av) {
1835                 /*
1836                  * Special file opened with flags 3 for ioctl-only use.
1837                  */
1838                 av = FILE__IOCTL;
1839         }
1840
1841         return av;
1842 }
1843
1844 /*
1845  * Convert a file to an access vector and include the correct open
1846  * open permission.
1847  */
1848 static inline u32 open_file_to_av(struct file *file)
1849 {
1850         u32 av = file_to_av(file);
1851
1852         if (selinux_policycap_openperm)
1853                 av |= FILE__OPEN;
1854
1855         return av;
1856 }
1857
1858 /* Hook functions begin here. */
1859
1860 static int selinux_ptrace_access_check(struct task_struct *child,
1861                                      unsigned int mode)
1862 {
1863         int rc;
1864
1865         rc = cap_ptrace_access_check(child, mode);
1866         if (rc)
1867                 return rc;
1868
1869         if (mode & PTRACE_MODE_READ) {
1870                 u32 sid = current_sid();
1871                 u32 csid = task_sid(child);
1872                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1873         }
1874
1875         return current_has_perm(child, PROCESS__PTRACE);
1876 }
1877
1878 static int selinux_ptrace_traceme(struct task_struct *parent)
1879 {
1880         int rc;
1881
1882         rc = cap_ptrace_traceme(parent);
1883         if (rc)
1884                 return rc;
1885
1886         return task_has_perm(parent, current, PROCESS__PTRACE);
1887 }
1888
1889 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1890                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1891 {
1892         int error;
1893
1894         error = current_has_perm(target, PROCESS__GETCAP);
1895         if (error)
1896                 return error;
1897
1898         return cap_capget(target, effective, inheritable, permitted);
1899 }
1900
1901 static int selinux_capset(struct cred *new, const struct cred *old,
1902                           const kernel_cap_t *effective,
1903                           const kernel_cap_t *inheritable,
1904                           const kernel_cap_t *permitted)
1905 {
1906         int error;
1907
1908         error = cap_capset(new, old,
1909                                       effective, inheritable, permitted);
1910         if (error)
1911                 return error;
1912
1913         return cred_has_perm(old, new, PROCESS__SETCAP);
1914 }
1915
1916 /*
1917  * (This comment used to live with the selinux_task_setuid hook,
1918  * which was removed).
1919  *
1920  * Since setuid only affects the current process, and since the SELinux
1921  * controls are not based on the Linux identity attributes, SELinux does not
1922  * need to control this operation.  However, SELinux does control the use of
1923  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1924  */
1925
1926 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1927                            int cap, int audit)
1928 {
1929         int rc;
1930
1931         rc = cap_capable(cred, ns, cap, audit);
1932         if (rc)
1933                 return rc;
1934
1935         return cred_has_capability(cred, cap, audit);
1936 }
1937
1938 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1939 {
1940         const struct cred *cred = current_cred();
1941         int rc = 0;
1942
1943         if (!sb)
1944                 return 0;
1945
1946         switch (cmds) {
1947         case Q_SYNC:
1948         case Q_QUOTAON:
1949         case Q_QUOTAOFF:
1950         case Q_SETINFO:
1951         case Q_SETQUOTA:
1952                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1953                 break;
1954         case Q_GETFMT:
1955         case Q_GETINFO:
1956         case Q_GETQUOTA:
1957                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1958                 break;
1959         default:
1960                 rc = 0;  /* let the kernel handle invalid cmds */
1961                 break;
1962         }
1963         return rc;
1964 }
1965
1966 static int selinux_quota_on(struct dentry *dentry)
1967 {
1968         const struct cred *cred = current_cred();
1969
1970         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1971 }
1972
1973 static int selinux_syslog(int type)
1974 {
1975         int rc;
1976
1977         switch (type) {
1978         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1979         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1980                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1981                 break;
1982         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1983         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1984         /* Set level of messages printed to console */
1985         case SYSLOG_ACTION_CONSOLE_LEVEL:
1986                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1987                 break;
1988         case SYSLOG_ACTION_CLOSE:       /* Close log */
1989         case SYSLOG_ACTION_OPEN:        /* Open log */
1990         case SYSLOG_ACTION_READ:        /* Read from log */
1991         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1992         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1993         default:
1994                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1995                 break;
1996         }
1997         return rc;
1998 }
1999
2000 /*
2001  * Check that a process has enough memory to allocate a new virtual
2002  * mapping. 0 means there is enough memory for the allocation to
2003  * succeed and -ENOMEM implies there is not.
2004  *
2005  * Do not audit the selinux permission check, as this is applied to all
2006  * processes that allocate mappings.
2007  */
2008 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2009 {
2010         int rc, cap_sys_admin = 0;
2011
2012         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2013                              SECURITY_CAP_NOAUDIT);
2014         if (rc == 0)
2015                 cap_sys_admin = 1;
2016
2017         return __vm_enough_memory(mm, pages, cap_sys_admin);
2018 }
2019
2020 /* binprm security operations */
2021
2022 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2023 {
2024         const struct task_security_struct *old_tsec;
2025         struct task_security_struct *new_tsec;
2026         struct inode_security_struct *isec;
2027         struct common_audit_data ad;
2028         struct inode *inode = file_inode(bprm->file);
2029         int rc;
2030
2031         rc = cap_bprm_set_creds(bprm);
2032         if (rc)
2033                 return rc;
2034
2035         /* SELinux context only depends on initial program or script and not
2036          * the script interpreter */
2037         if (bprm->cred_prepared)
2038                 return 0;
2039
2040         old_tsec = current_security();
2041         new_tsec = bprm->cred->security;
2042         isec = inode->i_security;
2043
2044         /* Default to the current task SID. */
2045         new_tsec->sid = old_tsec->sid;
2046         new_tsec->osid = old_tsec->sid;
2047
2048         /* Reset fs, key, and sock SIDs on execve. */
2049         new_tsec->create_sid = 0;
2050         new_tsec->keycreate_sid = 0;
2051         new_tsec->sockcreate_sid = 0;
2052
2053         if (old_tsec->exec_sid) {
2054                 new_tsec->sid = old_tsec->exec_sid;
2055                 /* Reset exec SID on execve. */
2056                 new_tsec->exec_sid = 0;
2057
2058                 /*
2059                  * Minimize confusion: if no_new_privs and a transition is
2060                  * explicitly requested, then fail the exec.
2061                  */
2062                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2063                         return -EPERM;
2064         } else {
2065                 /* Check for a default transition on this program. */
2066                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2067                                              SECCLASS_PROCESS, NULL,
2068                                              &new_tsec->sid);
2069                 if (rc)
2070                         return rc;
2071         }
2072
2073         ad.type = LSM_AUDIT_DATA_PATH;
2074         ad.u.path = bprm->file->f_path;
2075
2076         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2077             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2078                 new_tsec->sid = old_tsec->sid;
2079
2080         if (new_tsec->sid == old_tsec->sid) {
2081                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2082                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2083                 if (rc)
2084                         return rc;
2085         } else {
2086                 /* Check permissions for the transition. */
2087                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2088                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2089                 if (rc)
2090                         return rc;
2091
2092                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2093                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2094                 if (rc)
2095                         return rc;
2096
2097                 /* Check for shared state */
2098                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2099                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2100                                           SECCLASS_PROCESS, PROCESS__SHARE,
2101                                           NULL);
2102                         if (rc)
2103                                 return -EPERM;
2104                 }
2105
2106                 /* Make sure that anyone attempting to ptrace over a task that
2107                  * changes its SID has the appropriate permit */
2108                 if (bprm->unsafe &
2109                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2110                         struct task_struct *tracer;
2111                         struct task_security_struct *sec;
2112                         u32 ptsid = 0;
2113
2114                         rcu_read_lock();
2115                         tracer = ptrace_parent(current);
2116                         if (likely(tracer != NULL)) {
2117                                 sec = __task_cred(tracer)->security;
2118                                 ptsid = sec->sid;
2119                         }
2120                         rcu_read_unlock();
2121
2122                         if (ptsid != 0) {
2123                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2124                                                   SECCLASS_PROCESS,
2125                                                   PROCESS__PTRACE, NULL);
2126                                 if (rc)
2127                                         return -EPERM;
2128                         }
2129                 }
2130
2131                 /* Clear any possibly unsafe personality bits on exec: */
2132                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2133         }
2134
2135         return 0;
2136 }
2137
2138 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2139 {
2140         const struct task_security_struct *tsec = current_security();
2141         u32 sid, osid;
2142         int atsecure = 0;
2143
2144         sid = tsec->sid;
2145         osid = tsec->osid;
2146
2147         if (osid != sid) {
2148                 /* Enable secure mode for SIDs transitions unless
2149                    the noatsecure permission is granted between
2150                    the two SIDs, i.e. ahp returns 0. */
2151                 atsecure = avc_has_perm(osid, sid,
2152                                         SECCLASS_PROCESS,
2153                                         PROCESS__NOATSECURE, NULL);
2154         }
2155
2156         return (atsecure || cap_bprm_secureexec(bprm));
2157 }
2158
2159 static int match_file(const void *p, struct file *file, unsigned fd)
2160 {
2161         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2162 }
2163
2164 /* Derived from fs/exec.c:flush_old_files. */
2165 static inline void flush_unauthorized_files(const struct cred *cred,
2166                                             struct files_struct *files)
2167 {
2168         struct file *file, *devnull = NULL;
2169         struct tty_struct *tty;
2170         int drop_tty = 0;
2171         unsigned n;
2172
2173         tty = get_current_tty();
2174         if (tty) {
2175                 spin_lock(&tty_files_lock);
2176                 if (!list_empty(&tty->tty_files)) {
2177                         struct tty_file_private *file_priv;
2178
2179                         /* Revalidate access to controlling tty.
2180                            Use path_has_perm on the tty path directly rather
2181                            than using file_has_perm, as this particular open
2182                            file may belong to another process and we are only
2183                            interested in the inode-based check here. */
2184                         file_priv = list_first_entry(&tty->tty_files,
2185                                                 struct tty_file_private, list);
2186                         file = file_priv->file;
2187                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2188                                 drop_tty = 1;
2189                 }
2190                 spin_unlock(&tty_files_lock);
2191                 tty_kref_put(tty);
2192         }
2193         /* Reset controlling tty. */
2194         if (drop_tty)
2195                 no_tty();
2196
2197         /* Revalidate access to inherited open files. */
2198         n = iterate_fd(files, 0, match_file, cred);
2199         if (!n) /* none found? */
2200                 return;
2201
2202         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2203         if (IS_ERR(devnull))
2204                 devnull = NULL;
2205         /* replace all the matching ones with this */
2206         do {
2207                 replace_fd(n - 1, devnull, 0);
2208         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2209         if (devnull)
2210                 fput(devnull);
2211 }
2212
2213 /*
2214  * Prepare a process for imminent new credential changes due to exec
2215  */
2216 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2217 {
2218         struct task_security_struct *new_tsec;
2219         struct rlimit *rlim, *initrlim;
2220         int rc, i;
2221
2222         new_tsec = bprm->cred->security;
2223         if (new_tsec->sid == new_tsec->osid)
2224                 return;
2225
2226         /* Close files for which the new task SID is not authorized. */
2227         flush_unauthorized_files(bprm->cred, current->files);
2228
2229         /* Always clear parent death signal on SID transitions. */
2230         current->pdeath_signal = 0;
2231
2232         /* Check whether the new SID can inherit resource limits from the old
2233          * SID.  If not, reset all soft limits to the lower of the current
2234          * task's hard limit and the init task's soft limit.
2235          *
2236          * Note that the setting of hard limits (even to lower them) can be
2237          * controlled by the setrlimit check.  The inclusion of the init task's
2238          * soft limit into the computation is to avoid resetting soft limits
2239          * higher than the default soft limit for cases where the default is
2240          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2241          */
2242         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2243                           PROCESS__RLIMITINH, NULL);
2244         if (rc) {
2245                 /* protect against do_prlimit() */
2246                 task_lock(current);
2247                 for (i = 0; i < RLIM_NLIMITS; i++) {
2248                         rlim = current->signal->rlim + i;
2249                         initrlim = init_task.signal->rlim + i;
2250                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2251                 }
2252                 task_unlock(current);
2253                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2254         }
2255 }
2256
2257 /*
2258  * Clean up the process immediately after the installation of new credentials
2259  * due to exec
2260  */
2261 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2262 {
2263         const struct task_security_struct *tsec = current_security();
2264         struct itimerval itimer;
2265         u32 osid, sid;
2266         int rc, i;
2267
2268         osid = tsec->osid;
2269         sid = tsec->sid;
2270
2271         if (sid == osid)
2272                 return;
2273
2274         /* Check whether the new SID can inherit signal state from the old SID.
2275          * If not, clear itimers to avoid subsequent signal generation and
2276          * flush and unblock signals.
2277          *
2278          * This must occur _after_ the task SID has been updated so that any
2279          * kill done after the flush will be checked against the new SID.
2280          */
2281         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2282         if (rc) {
2283                 memset(&itimer, 0, sizeof itimer);
2284                 for (i = 0; i < 3; i++)
2285                         do_setitimer(i, &itimer, NULL);
2286                 spin_lock_irq(&current->sighand->siglock);
2287                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2288                         __flush_signals(current);
2289                         flush_signal_handlers(current, 1);
2290                         sigemptyset(&current->blocked);
2291                 }
2292                 spin_unlock_irq(&current->sighand->siglock);
2293         }
2294
2295         /* Wake up the parent if it is waiting so that it can recheck
2296          * wait permission to the new task SID. */
2297         read_lock(&tasklist_lock);
2298         __wake_up_parent(current, current->real_parent);
2299         read_unlock(&tasklist_lock);
2300 }
2301
2302 /* superblock security operations */
2303
2304 static int selinux_sb_alloc_security(struct super_block *sb)
2305 {
2306         return superblock_alloc_security(sb);
2307 }
2308
2309 static void selinux_sb_free_security(struct super_block *sb)
2310 {
2311         superblock_free_security(sb);
2312 }
2313
2314 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2315 {
2316         if (plen > olen)
2317                 return 0;
2318
2319         return !memcmp(prefix, option, plen);
2320 }
2321
2322 static inline int selinux_option(char *option, int len)
2323 {
2324         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2325                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2326                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2327                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2328                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2329 }
2330
2331 static inline void take_option(char **to, char *from, int *first, int len)
2332 {
2333         if (!*first) {
2334                 **to = ',';
2335                 *to += 1;
2336         } else
2337                 *first = 0;
2338         memcpy(*to, from, len);
2339         *to += len;
2340 }
2341
2342 static inline void take_selinux_option(char **to, char *from, int *first,
2343                                        int len)
2344 {
2345         int current_size = 0;
2346
2347         if (!*first) {
2348                 **to = '|';
2349                 *to += 1;
2350         } else
2351                 *first = 0;
2352
2353         while (current_size < len) {
2354                 if (*from != '"') {
2355                         **to = *from;
2356                         *to += 1;
2357                 }
2358                 from += 1;
2359                 current_size += 1;
2360         }
2361 }
2362
2363 static int selinux_sb_copy_data(char *orig, char *copy)
2364 {
2365         int fnosec, fsec, rc = 0;
2366         char *in_save, *in_curr, *in_end;
2367         char *sec_curr, *nosec_save, *nosec;
2368         int open_quote = 0;
2369
2370         in_curr = orig;
2371         sec_curr = copy;
2372
2373         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2374         if (!nosec) {
2375                 rc = -ENOMEM;
2376                 goto out;
2377         }
2378
2379         nosec_save = nosec;
2380         fnosec = fsec = 1;
2381         in_save = in_end = orig;
2382
2383         do {
2384                 if (*in_end == '"')
2385                         open_quote = !open_quote;
2386                 if ((*in_end == ',' && open_quote == 0) ||
2387                                 *in_end == '\0') {
2388                         int len = in_end - in_curr;
2389
2390                         if (selinux_option(in_curr, len))
2391                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2392                         else
2393                                 take_option(&nosec, in_curr, &fnosec, len);
2394
2395                         in_curr = in_end + 1;
2396                 }
2397         } while (*in_end++);
2398
2399         strcpy(in_save, nosec_save);
2400         free_page((unsigned long)nosec_save);
2401 out:
2402         return rc;
2403 }
2404
2405 static int selinux_sb_remount(struct super_block *sb, void *data)
2406 {
2407         int rc, i, *flags;
2408         struct security_mnt_opts opts;
2409         char *secdata, **mount_options;
2410         struct superblock_security_struct *sbsec = sb->s_security;
2411
2412         if (!(sbsec->flags & SE_SBINITIALIZED))
2413                 return 0;
2414
2415         if (!data)
2416                 return 0;
2417
2418         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2419                 return 0;
2420
2421         security_init_mnt_opts(&opts);
2422         secdata = alloc_secdata();
2423         if (!secdata)
2424                 return -ENOMEM;
2425         rc = selinux_sb_copy_data(data, secdata);
2426         if (rc)
2427                 goto out_free_secdata;
2428
2429         rc = selinux_parse_opts_str(secdata, &opts);
2430         if (rc)
2431                 goto out_free_secdata;
2432
2433         mount_options = opts.mnt_opts;
2434         flags = opts.mnt_opts_flags;
2435
2436         for (i = 0; i < opts.num_mnt_opts; i++) {
2437                 u32 sid;
2438                 size_t len;
2439
2440                 if (flags[i] == SBLABEL_MNT)
2441                         continue;
2442                 len = strlen(mount_options[i]);
2443                 rc = security_context_to_sid(mount_options[i], len, &sid);
2444                 if (rc) {
2445                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2446                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2447                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
2448                         goto out_free_opts;
2449                 }
2450                 rc = -EINVAL;
2451                 switch (flags[i]) {
2452                 case FSCONTEXT_MNT:
2453                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2454                                 goto out_bad_option;
2455                         break;
2456                 case CONTEXT_MNT:
2457                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2458                                 goto out_bad_option;
2459                         break;
2460                 case ROOTCONTEXT_MNT: {
2461                         struct inode_security_struct *root_isec;
2462                         root_isec = sb->s_root->d_inode->i_security;
2463
2464                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2465                                 goto out_bad_option;
2466                         break;
2467                 }
2468                 case DEFCONTEXT_MNT:
2469                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2470                                 goto out_bad_option;
2471                         break;
2472                 default:
2473                         goto out_free_opts;
2474                 }
2475         }
2476
2477         rc = 0;
2478 out_free_opts:
2479         security_free_mnt_opts(&opts);
2480 out_free_secdata:
2481         free_secdata(secdata);
2482         return rc;
2483 out_bad_option:
2484         printk(KERN_WARNING "SELinux: unable to change security options "
2485                "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2486                SB_TYPE_ARGS(sb));
2487         goto out_free_opts;
2488 }
2489
2490 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2491 {
2492         const struct cred *cred = current_cred();
2493         struct common_audit_data ad;
2494         int rc;
2495
2496         rc = superblock_doinit(sb, data);
2497         if (rc)
2498                 return rc;
2499
2500         /* Allow all mounts performed by the kernel */
2501         if (flags & MS_KERNMOUNT)
2502                 return 0;
2503
2504         ad.type = LSM_AUDIT_DATA_DENTRY;
2505         ad.u.dentry = sb->s_root;
2506         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2507 }
2508
2509 static int selinux_sb_statfs(struct dentry *dentry)
2510 {
2511         const struct cred *cred = current_cred();
2512         struct common_audit_data ad;
2513
2514         ad.type = LSM_AUDIT_DATA_DENTRY;
2515         ad.u.dentry = dentry->d_sb->s_root;
2516         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2517 }
2518
2519 static int selinux_mount(const char *dev_name,
2520                          struct path *path,
2521                          const char *type,
2522                          unsigned long flags,
2523                          void *data)
2524 {
2525         const struct cred *cred = current_cred();
2526
2527         if (flags & MS_REMOUNT)
2528                 return superblock_has_perm(cred, path->dentry->d_sb,
2529                                            FILESYSTEM__REMOUNT, NULL);
2530         else
2531                 return path_has_perm(cred, path, FILE__MOUNTON);
2532 }
2533
2534 static int selinux_umount(struct vfsmount *mnt, int flags)
2535 {
2536         const struct cred *cred = current_cred();
2537
2538         return superblock_has_perm(cred, mnt->mnt_sb,
2539                                    FILESYSTEM__UNMOUNT, NULL);
2540 }
2541
2542 /* inode security operations */
2543
2544 static int selinux_inode_alloc_security(struct inode *inode)
2545 {
2546         return inode_alloc_security(inode);
2547 }
2548
2549 static void selinux_inode_free_security(struct inode *inode)
2550 {
2551         inode_free_security(inode);
2552 }
2553
2554 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2555                                        const struct qstr *qstr, char **name,
2556                                        void **value, size_t *len)
2557 {
2558         const struct task_security_struct *tsec = current_security();
2559         struct inode_security_struct *dsec;
2560         struct superblock_security_struct *sbsec;
2561         u32 sid, newsid, clen;
2562         int rc;
2563         char *namep = NULL, *context;
2564
2565         dsec = dir->i_security;
2566         sbsec = dir->i_sb->s_security;
2567
2568         sid = tsec->sid;
2569         newsid = tsec->create_sid;
2570
2571         if ((sbsec->flags & SE_SBINITIALIZED) &&
2572             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2573                 newsid = sbsec->mntpoint_sid;
2574         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2575                 rc = security_transition_sid(sid, dsec->sid,
2576                                              inode_mode_to_security_class(inode->i_mode),
2577                                              qstr, &newsid);
2578                 if (rc) {
2579                         printk(KERN_WARNING "%s:  "
2580                                "security_transition_sid failed, rc=%d (dev=%s "
2581                                "ino=%ld)\n",
2582                                __func__,
2583                                -rc, inode->i_sb->s_id, inode->i_ino);
2584                         return rc;
2585                 }
2586         }
2587
2588         /* Possibly defer initialization to selinux_complete_init. */
2589         if (sbsec->flags & SE_SBINITIALIZED) {
2590                 struct inode_security_struct *isec = inode->i_security;
2591                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2592                 isec->sid = newsid;
2593                 isec->initialized = 1;
2594         }
2595
2596         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2597                 return -EOPNOTSUPP;
2598
2599         if (name) {
2600                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2601                 if (!namep)
2602                         return -ENOMEM;
2603                 *name = namep;
2604         }
2605
2606         if (value && len) {
2607                 rc = security_sid_to_context_force(newsid, &context, &clen);
2608                 if (rc) {
2609                         kfree(namep);
2610                         return rc;
2611                 }
2612                 *value = context;
2613                 *len = clen;
2614         }
2615
2616         return 0;
2617 }
2618
2619 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2620 {
2621         return may_create(dir, dentry, SECCLASS_FILE);
2622 }
2623
2624 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2625 {
2626         return may_link(dir, old_dentry, MAY_LINK);
2627 }
2628
2629 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2630 {
2631         return may_link(dir, dentry, MAY_UNLINK);
2632 }
2633
2634 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2635 {
2636         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2637 }
2638
2639 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2640 {
2641         return may_create(dir, dentry, SECCLASS_DIR);
2642 }
2643
2644 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2645 {
2646         return may_link(dir, dentry, MAY_RMDIR);
2647 }
2648
2649 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2650 {
2651         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2652 }
2653
2654 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2655                                 struct inode *new_inode, struct dentry *new_dentry)
2656 {
2657         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2658 }
2659
2660 static int selinux_inode_readlink(struct dentry *dentry)
2661 {
2662         const struct cred *cred = current_cred();
2663
2664         return dentry_has_perm(cred, dentry, FILE__READ);
2665 }
2666
2667 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2668 {
2669         const struct cred *cred = current_cred();
2670
2671         return dentry_has_perm(cred, dentry, FILE__READ);
2672 }
2673
2674 static noinline int audit_inode_permission(struct inode *inode,
2675                                            u32 perms, u32 audited, u32 denied,
2676                                            unsigned flags)
2677 {
2678         struct common_audit_data ad;
2679         struct inode_security_struct *isec = inode->i_security;
2680         int rc;
2681
2682         ad.type = LSM_AUDIT_DATA_INODE;
2683         ad.u.inode = inode;
2684
2685         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2686                             audited, denied, &ad, flags);
2687         if (rc)
2688                 return rc;
2689         return 0;
2690 }
2691
2692 static int selinux_inode_permission(struct inode *inode, int mask)
2693 {
2694         const struct cred *cred = current_cred();
2695         u32 perms;
2696         bool from_access;
2697         unsigned flags = mask & MAY_NOT_BLOCK;
2698         struct inode_security_struct *isec;
2699         u32 sid;
2700         struct av_decision avd;
2701         int rc, rc2;
2702         u32 audited, denied;
2703
2704         from_access = mask & MAY_ACCESS;
2705         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2706
2707         /* No permission to check.  Existence test. */
2708         if (!mask)
2709                 return 0;
2710
2711         validate_creds(cred);
2712
2713         if (unlikely(IS_PRIVATE(inode)))
2714                 return 0;
2715
2716         perms = file_mask_to_av(inode->i_mode, mask);
2717
2718         sid = cred_sid(cred);
2719         isec = inode->i_security;
2720
2721         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2722         audited = avc_audit_required(perms, &avd, rc,
2723                                      from_access ? FILE__AUDIT_ACCESS : 0,
2724                                      &denied);
2725         if (likely(!audited))
2726                 return rc;
2727
2728         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2729         if (rc2)
2730                 return rc2;
2731         return rc;
2732 }
2733
2734 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2735 {
2736         const struct cred *cred = current_cred();
2737         unsigned int ia_valid = iattr->ia_valid;
2738         __u32 av = FILE__WRITE;
2739
2740         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2741         if (ia_valid & ATTR_FORCE) {
2742                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2743                               ATTR_FORCE);
2744                 if (!ia_valid)
2745                         return 0;
2746         }
2747
2748         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2749                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2750                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2751
2752         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2753                 av |= FILE__OPEN;
2754
2755         return dentry_has_perm(cred, dentry, av);
2756 }
2757
2758 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2759 {
2760         const struct cred *cred = current_cred();
2761         struct path path;
2762
2763         path.dentry = dentry;
2764         path.mnt = mnt;
2765
2766         return path_has_perm(cred, &path, FILE__GETATTR);
2767 }
2768
2769 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2770 {
2771         const struct cred *cred = current_cred();
2772
2773         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2774                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2775                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2776                         if (!capable(CAP_SETFCAP))
2777                                 return -EPERM;
2778                 } else if (!capable(CAP_SYS_ADMIN)) {
2779                         /* A different attribute in the security namespace.
2780                            Restrict to administrator. */
2781                         return -EPERM;
2782                 }
2783         }
2784
2785         /* Not an attribute we recognize, so just check the
2786            ordinary setattr permission. */
2787         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2788 }
2789
2790 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2791                                   const void *value, size_t size, int flags)
2792 {
2793         struct inode *inode = dentry->d_inode;
2794         struct inode_security_struct *isec = inode->i_security;
2795         struct superblock_security_struct *sbsec;
2796         struct common_audit_data ad;
2797         u32 newsid, sid = current_sid();
2798         int rc = 0;
2799
2800         if (strcmp(name, XATTR_NAME_SELINUX))
2801                 return selinux_inode_setotherxattr(dentry, name);
2802
2803         sbsec = inode->i_sb->s_security;
2804         if (!(sbsec->flags & SBLABEL_MNT))
2805                 return -EOPNOTSUPP;
2806
2807         if (!inode_owner_or_capable(inode))
2808                 return -EPERM;
2809
2810         ad.type = LSM_AUDIT_DATA_DENTRY;
2811         ad.u.dentry = dentry;
2812
2813         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2814                           FILE__RELABELFROM, &ad);
2815         if (rc)
2816                 return rc;
2817
2818         rc = security_context_to_sid(value, size, &newsid);
2819         if (rc == -EINVAL) {
2820                 if (!capable(CAP_MAC_ADMIN)) {
2821                         struct audit_buffer *ab;
2822                         size_t audit_size;
2823                         const char *str;
2824
2825                         /* We strip a nul only if it is at the end, otherwise the
2826                          * context contains a nul and we should audit that */
2827                         if (value) {
2828                                 str = value;
2829                                 if (str[size - 1] == '\0')
2830                                         audit_size = size - 1;
2831                                 else
2832                                         audit_size = size;
2833                         } else {
2834                                 str = "";
2835                                 audit_size = 0;
2836                         }
2837                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2838                         audit_log_format(ab, "op=setxattr invalid_context=");
2839                         audit_log_n_untrustedstring(ab, value, audit_size);
2840                         audit_log_end(ab);
2841
2842                         return rc;
2843                 }
2844                 rc = security_context_to_sid_force(value, size, &newsid);
2845         }
2846         if (rc)
2847                 return rc;
2848
2849         rc = avc_has_perm(sid, newsid, isec->sclass,
2850                           FILE__RELABELTO, &ad);
2851         if (rc)
2852                 return rc;
2853
2854         rc = security_validate_transition(isec->sid, newsid, sid,
2855                                           isec->sclass);
2856         if (rc)
2857                 return rc;
2858
2859         return avc_has_perm(newsid,
2860                             sbsec->sid,
2861                             SECCLASS_FILESYSTEM,
2862                             FILESYSTEM__ASSOCIATE,
2863                             &ad);
2864 }
2865
2866 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2867                                         const void *value, size_t size,
2868                                         int flags)
2869 {
2870         struct inode *inode = dentry->d_inode;
2871         struct inode_security_struct *isec = inode->i_security;
2872         u32 newsid;
2873         int rc;
2874
2875         if (strcmp(name, XATTR_NAME_SELINUX)) {
2876                 /* Not an attribute we recognize, so nothing to do. */
2877                 return;
2878         }
2879
2880         rc = security_context_to_sid_force(value, size, &newsid);
2881         if (rc) {
2882                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2883                        "for (%s, %lu), rc=%d\n",
2884                        inode->i_sb->s_id, inode->i_ino, -rc);
2885                 return;
2886         }
2887
2888         isec->sid = newsid;
2889         return;
2890 }
2891
2892 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2893 {
2894         const struct cred *cred = current_cred();
2895
2896         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2897 }
2898
2899 static int selinux_inode_listxattr(struct dentry *dentry)
2900 {
2901         const struct cred *cred = current_cred();
2902
2903         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2904 }
2905
2906 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2907 {
2908         if (strcmp(name, XATTR_NAME_SELINUX))
2909                 return selinux_inode_setotherxattr(dentry, name);
2910
2911         /* No one is allowed to remove a SELinux security label.
2912            You can change the label, but all data must be labeled. */
2913         return -EACCES;
2914 }
2915
2916 /*
2917  * Copy the inode security context value to the user.
2918  *
2919  * Permission check is handled by selinux_inode_getxattr hook.
2920  */
2921 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2922 {
2923         u32 size;
2924         int error;
2925         char *context = NULL;
2926         struct inode_security_struct *isec = inode->i_security;
2927
2928         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2929                 return -EOPNOTSUPP;
2930
2931         /*
2932          * If the caller has CAP_MAC_ADMIN, then get the raw context
2933          * value even if it is not defined by current policy; otherwise,
2934          * use the in-core value under current policy.
2935          * Use the non-auditing forms of the permission checks since
2936          * getxattr may be called by unprivileged processes commonly
2937          * and lack of permission just means that we fall back to the
2938          * in-core context value, not a denial.
2939          */
2940         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2941                                 SECURITY_CAP_NOAUDIT);
2942         if (!error)
2943                 error = security_sid_to_context_force(isec->sid, &context,
2944                                                       &size);
2945         else
2946                 error = security_sid_to_context(isec->sid, &context, &size);
2947         if (error)
2948                 return error;
2949         error = size;
2950         if (alloc) {
2951                 *buffer = context;
2952                 goto out_nofree;
2953         }
2954         kfree(context);
2955 out_nofree:
2956         return error;
2957 }
2958
2959 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2960                                      const void *value, size_t size, int flags)
2961 {
2962         struct inode_security_struct *isec = inode->i_security;
2963         u32 newsid;
2964         int rc;
2965
2966         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2967                 return -EOPNOTSUPP;
2968
2969         if (!value || !size)
2970                 return -EACCES;
2971
2972         rc = security_context_to_sid((void *)value, size, &newsid);
2973         if (rc)
2974                 return rc;
2975
2976         isec->sid = newsid;
2977         isec->initialized = 1;
2978         return 0;
2979 }
2980
2981 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2982 {
2983         const int len = sizeof(XATTR_NAME_SELINUX);
2984         if (buffer && len <= buffer_size)
2985                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2986         return len;
2987 }
2988
2989 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2990 {
2991         struct inode_security_struct *isec = inode->i_security;
2992         *secid = isec->sid;
2993 }
2994
2995 /* file security operations */
2996
2997 static int selinux_revalidate_file_permission(struct file *file, int mask)
2998 {
2999         const struct cred *cred = current_cred();
3000         struct inode *inode = file_inode(file);
3001
3002         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3003         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3004                 mask |= MAY_APPEND;
3005
3006         return file_has_perm(cred, file,
3007                              file_mask_to_av(inode->i_mode, mask));
3008 }
3009
3010 static int selinux_file_permission(struct file *file, int mask)
3011 {
3012         struct inode *inode = file_inode(file);
3013         struct file_security_struct *fsec = file->f_security;
3014         struct inode_security_struct *isec = inode->i_security;
3015         u32 sid = current_sid();
3016
3017         if (!mask)
3018                 /* No permission to check.  Existence test. */
3019                 return 0;
3020
3021         if (sid == fsec->sid && fsec->isid == isec->sid &&
3022             fsec->pseqno == avc_policy_seqno())
3023                 /* No change since file_open check. */
3024                 return 0;
3025
3026         return selinux_revalidate_file_permission(file, mask);
3027 }
3028
3029 static int selinux_file_alloc_security(struct file *file)
3030 {
3031         return file_alloc_security(file);
3032 }
3033
3034 static void selinux_file_free_security(struct file *file)
3035 {
3036         file_free_security(file);
3037 }
3038
3039 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3040                               unsigned long arg)
3041 {
3042         const struct cred *cred = current_cred();
3043         int error = 0;
3044
3045         switch (cmd) {
3046         case FIONREAD:
3047         /* fall through */
3048         case FIBMAP:
3049         /* fall through */
3050         case FIGETBSZ:
3051         /* fall through */
3052         case FS_IOC_GETFLAGS:
3053         /* fall through */
3054         case FS_IOC_GETVERSION:
3055                 error = file_has_perm(cred, file, FILE__GETATTR);
3056                 break;
3057
3058         case FS_IOC_SETFLAGS:
3059         /* fall through */
3060         case FS_IOC_SETVERSION:
3061                 error = file_has_perm(cred, file, FILE__SETATTR);
3062                 break;
3063
3064         /* sys_ioctl() checks */
3065         case FIONBIO:
3066         /* fall through */
3067         case FIOASYNC:
3068                 error = file_has_perm(cred, file, 0);
3069                 break;
3070
3071         case KDSKBENT:
3072         case KDSKBSENT:
3073                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3074                                             SECURITY_CAP_AUDIT);
3075                 break;
3076
3077         /* default case assumes that the command will go
3078          * to the file's ioctl() function.
3079          */
3080         default:
3081                 error = file_has_perm(cred, file, FILE__IOCTL);
3082         }
3083         return error;
3084 }
3085
3086 static int default_noexec;
3087
3088 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3089 {
3090         const struct cred *cred = current_cred();
3091         int rc = 0;
3092
3093         if (default_noexec &&
3094             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3095                 /*
3096                  * We are making executable an anonymous mapping or a
3097                  * private file mapping that will also be writable.
3098                  * This has an additional check.
3099                  */
3100                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3101                 if (rc)
3102                         goto error;
3103         }
3104
3105         if (file) {
3106                 /* read access is always possible with a mapping */
3107                 u32 av = FILE__READ;
3108
3109                 /* write access only matters if the mapping is shared */
3110                 if (shared && (prot & PROT_WRITE))
3111                         av |= FILE__WRITE;
3112
3113                 if (prot & PROT_EXEC)
3114                         av |= FILE__EXECUTE;
3115
3116                 return file_has_perm(cred, file, av);
3117         }
3118
3119 error:
3120         return rc;
3121 }
3122
3123 static int selinux_mmap_addr(unsigned long addr)
3124 {
3125         int rc = 0;
3126         u32 sid = current_sid();
3127
3128         /*
3129          * notice that we are intentionally putting the SELinux check before
3130          * the secondary cap_file_mmap check.  This is such a likely attempt
3131          * at bad behaviour/exploit that we always want to get the AVC, even
3132          * if DAC would have also denied the operation.
3133          */
3134         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3135                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3136                                   MEMPROTECT__MMAP_ZERO, NULL);
3137                 if (rc)
3138                         return rc;
3139         }
3140
3141         /* do DAC check on address space usage */
3142         return cap_mmap_addr(addr);
3143 }
3144
3145 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3146                              unsigned long prot, unsigned long flags)
3147 {
3148         if (selinux_checkreqprot)
3149                 prot = reqprot;
3150
3151         return file_map_prot_check(file, prot,
3152                                    (flags & MAP_TYPE) == MAP_SHARED);
3153 }
3154
3155 static int selinux_file_mprotect(struct vm_area_struct *vma,
3156                                  unsigned long reqprot,
3157                                  unsigned long prot)
3158 {
3159         const struct cred *cred = current_cred();
3160
3161         if (selinux_checkreqprot)
3162                 prot = reqprot;
3163
3164         if (default_noexec &&
3165             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3166                 int rc = 0;
3167                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3168                     vma->vm_end <= vma->vm_mm->brk) {
3169                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3170                 } else if (!vma->vm_file &&
3171                            vma->vm_start <= vma->vm_mm->start_stack &&
3172                            vma->vm_end >= vma->vm_mm->start_stack) {
3173                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3174                 } else if (vma->vm_file && vma->anon_vma) {
3175                         /*
3176                          * We are making executable a file mapping that has
3177                          * had some COW done. Since pages might have been
3178                          * written, check ability to execute the possibly
3179                          * modified content.  This typically should only
3180                          * occur for text relocations.
3181                          */
3182                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3183                 }
3184                 if (rc)
3185                         return rc;
3186         }
3187
3188         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3189 }
3190
3191 static int selinux_file_lock(struct file *file, unsigned int cmd)
3192 {
3193         const struct cred *cred = current_cred();
3194
3195         return file_has_perm(cred, file, FILE__LOCK);
3196 }
3197
3198 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3199                               unsigned long arg)
3200 {
3201         const struct cred *cred = current_cred();
3202         int err = 0;
3203
3204         switch (cmd) {
3205         case F_SETFL:
3206                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3207                         err = file_has_perm(cred, file, FILE__WRITE);
3208                         break;
3209                 }
3210                 /* fall through */
3211         case F_SETOWN:
3212         case F_SETSIG:
3213         case F_GETFL:
3214         case F_GETOWN:
3215         case F_GETSIG:
3216         case F_GETOWNER_UIDS:
3217                 /* Just check FD__USE permission */
3218                 err = file_has_perm(cred, file, 0);
3219                 break;
3220         case F_GETLK:
3221         case F_SETLK:
3222         case F_SETLKW:
3223 #if BITS_PER_LONG == 32
3224         case F_GETLK64:
3225         case F_SETLK64:
3226         case F_SETLKW64:
3227 #endif
3228                 err = file_has_perm(cred, file, FILE__LOCK);
3229                 break;
3230         }
3231
3232         return err;
3233 }
3234
3235 static int selinux_file_set_fowner(struct file *file)
3236 {
3237         struct file_security_struct *fsec;
3238
3239         fsec = file->f_security;
3240         fsec->fown_sid = current_sid();
3241
3242         return 0;
3243 }
3244
3245 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3246                                        struct fown_struct *fown, int signum)
3247 {
3248         struct file *file;
3249         u32 sid = task_sid(tsk);
3250         u32 perm;
3251         struct file_security_struct *fsec;
3252
3253         /* struct fown_struct is never outside the context of a struct file */
3254         file = container_of(fown, struct file, f_owner);
3255
3256         fsec = file->f_security;
3257
3258         if (!signum)
3259                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3260         else
3261                 perm = signal_to_av(signum);
3262
3263         return avc_has_perm(fsec->fown_sid, sid,
3264                             SECCLASS_PROCESS, perm, NULL);
3265 }
3266
3267 static int selinux_file_receive(struct file *file)
3268 {
3269         const struct cred *cred = current_cred();
3270
3271         return file_has_perm(cred, file, file_to_av(file));
3272 }
3273
3274 static int selinux_file_open(struct file *file, const struct cred *cred)
3275 {
3276         struct file_security_struct *fsec;
3277         struct inode_security_struct *isec;
3278
3279         fsec = file->f_security;
3280         isec = file_inode(file)->i_security;
3281         /*
3282          * Save inode label and policy sequence number
3283          * at open-time so that selinux_file_permission
3284          * can determine whether revalidation is necessary.
3285          * Task label is already saved in the file security
3286          * struct as its SID.
3287          */
3288         fsec->isid = isec->sid;
3289         fsec->pseqno = avc_policy_seqno();
3290         /*
3291          * Since the inode label or policy seqno may have changed
3292          * between the selinux_inode_permission check and the saving
3293          * of state above, recheck that access is still permitted.
3294          * Otherwise, access might never be revalidated against the
3295          * new inode label or new policy.
3296          * This check is not redundant - do not remove.
3297          */
3298         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3299 }
3300
3301 /* task security operations */
3302
3303 static int selinux_task_create(unsigned long clone_flags)
3304 {
3305         return current_has_perm(current, PROCESS__FORK);
3306 }
3307
3308 /*
3309  * allocate the SELinux part of blank credentials
3310  */
3311 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3312 {
3313         struct task_security_struct *tsec;
3314
3315         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3316         if (!tsec)
3317                 return -ENOMEM;
3318
3319         cred->security = tsec;
3320         return 0;
3321 }
3322
3323 /*
3324  * detach and free the LSM part of a set of credentials
3325  */
3326 static void selinux_cred_free(struct cred *cred)
3327 {
3328         struct task_security_struct *tsec = cred->security;
3329
3330         /*
3331          * cred->security == NULL if security_cred_alloc_blank() or
3332          * security_prepare_creds() returned an error.
3333          */
3334         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3335         cred->security = (void *) 0x7UL;
3336         kfree(tsec);
3337 }
3338
3339 /*
3340  * prepare a new set of credentials for modification
3341  */
3342 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3343                                 gfp_t gfp)
3344 {
3345         const struct task_security_struct *old_tsec;
3346         struct task_security_struct *tsec;
3347
3348         old_tsec = old->security;
3349
3350         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3351         if (!tsec)
3352                 return -ENOMEM;
3353
3354         new->security = tsec;
3355         return 0;
3356 }
3357
3358 /*
3359  * transfer the SELinux data to a blank set of creds
3360  */
3361 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3362 {
3363         const struct task_security_struct *old_tsec = old->security;
3364         struct task_security_struct *tsec = new->security;
3365
3366         *tsec = *old_tsec;
3367 }
3368
3369 /*
3370  * set the security data for a kernel service
3371  * - all the creation contexts are set to unlabelled
3372  */
3373 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3374 {
3375         struct task_security_struct *tsec = new->security;
3376         u32 sid = current_sid();
3377         int ret;
3378
3379         ret = avc_has_perm(sid, secid,
3380                            SECCLASS_KERNEL_SERVICE,
3381                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3382                            NULL);
3383         if (ret == 0) {
3384                 tsec->sid = secid;
3385                 tsec->create_sid = 0;
3386                 tsec->keycreate_sid = 0;
3387                 tsec->sockcreate_sid = 0;
3388         }
3389         return ret;
3390 }
3391
3392 /*
3393  * set the file creation context in a security record to the same as the
3394  * objective context of the specified inode
3395  */
3396 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3397 {
3398         struct inode_security_struct *isec = inode->i_security;
3399         struct task_security_struct *tsec = new->security;
3400         u32 sid = current_sid();
3401         int ret;
3402
3403         ret = avc_has_perm(sid, isec->sid,
3404                            SECCLASS_KERNEL_SERVICE,
3405                            KERNEL_SERVICE__CREATE_FILES_AS,
3406                            NULL);
3407
3408         if (ret == 0)
3409                 tsec->create_sid = isec->sid;
3410         return ret;
3411 }
3412
3413 static int selinux_kernel_module_request(char *kmod_name)
3414 {
3415         u32 sid;
3416         struct common_audit_data ad;
3417
3418         sid = task_sid(current);
3419
3420         ad.type = LSM_AUDIT_DATA_KMOD;
3421         ad.u.kmod_name = kmod_name;
3422
3423         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3424                             SYSTEM__MODULE_REQUEST, &ad);
3425 }
3426
3427 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3428 {
3429         return current_has_perm(p, PROCESS__SETPGID);
3430 }
3431
3432 static int selinux_task_getpgid(struct task_struct *p)
3433 {
3434         return current_has_perm(p, PROCESS__GETPGID);
3435 }
3436
3437 static int selinux_task_getsid(struct task_struct *p)
3438 {
3439         return current_has_perm(p, PROCESS__GETSESSION);
3440 }
3441
3442 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3443 {
3444         *secid = task_sid(p);
3445 }
3446
3447 static int selinux_task_setnice(struct task_struct *p, int nice)
3448 {
3449         int rc;
3450
3451         rc = cap_task_setnice(p, nice);
3452         if (rc)
3453                 return rc;
3454
3455         return current_has_perm(p, PROCESS__SETSCHED);
3456 }
3457
3458 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3459 {
3460         int rc;
3461
3462         rc = cap_task_setioprio(p, ioprio);
3463         if (rc)
3464                 return rc;
3465
3466         return current_has_perm(p, PROCESS__SETSCHED);
3467 }
3468
3469 static int selinux_task_getioprio(struct task_struct *p)
3470 {
3471         return current_has_perm(p, PROCESS__GETSCHED);
3472 }
3473
3474 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3475                 struct rlimit *new_rlim)
3476 {
3477         struct rlimit *old_rlim = p->signal->rlim + resource;
3478
3479         /* Control the ability to change the hard limit (whether
3480            lowering or raising it), so that the hard limit can
3481            later be used as a safe reset point for the soft limit
3482            upon context transitions.  See selinux_bprm_committing_creds. */
3483         if (old_rlim->rlim_max != new_rlim->rlim_max)
3484                 return current_has_perm(p, PROCESS__SETRLIMIT);
3485
3486         return 0;
3487 }
3488
3489 static int selinux_task_setscheduler(struct task_struct *p)
3490 {
3491         int rc;
3492
3493         rc = cap_task_setscheduler(p);
3494         if (rc)
3495                 return rc;
3496
3497         return current_has_perm(p, PROCESS__SETSCHED);
3498 }
3499
3500 static int selinux_task_getscheduler(struct task_struct *p)
3501 {
3502         return current_has_perm(p, PROCESS__GETSCHED);
3503 }
3504
3505 static int selinux_task_movememory(struct task_struct *p)
3506 {
3507         return current_has_perm(p, PROCESS__SETSCHED);
3508 }
3509
3510 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3511                                 int sig, u32 secid)
3512 {
3513         u32 perm;
3514         int rc;
3515
3516         if (!sig)
3517                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3518         else
3519                 perm = signal_to_av(sig);
3520         if (secid)
3521                 rc = avc_has_perm(secid, task_sid(p),
3522                                   SECCLASS_PROCESS, perm, NULL);
3523         else
3524                 rc = current_has_perm(p, perm);
3525         return rc;
3526 }
3527
3528 static int selinux_task_wait(struct task_struct *p)
3529 {
3530         return task_has_perm(p, current, PROCESS__SIGCHLD);
3531 }
3532
3533 static void selinux_task_to_inode(struct task_struct *p,
3534                                   struct inode *inode)
3535 {
3536         struct inode_security_struct *isec = inode->i_security;
3537         u32 sid = task_sid(p);
3538
3539         isec->sid = sid;
3540         isec->initialized = 1;
3541 }
3542
3543 /* Returns error only if unable to parse addresses */
3544 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3545                         struct common_audit_data *ad, u8 *proto)
3546 {
3547         int offset, ihlen, ret = -EINVAL;
3548         struct iphdr _iph, *ih;
3549
3550         offset = skb_network_offset(skb);
3551         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3552         if (ih == NULL)
3553                 goto out;
3554
3555         ihlen = ih->ihl * 4;
3556         if (ihlen < sizeof(_iph))
3557                 goto out;
3558
3559         ad->u.net->v4info.saddr = ih->saddr;
3560         ad->u.net->v4info.daddr = ih->daddr;
3561         ret = 0;
3562
3563         if (proto)
3564                 *proto = ih->protocol;
3565
3566         switch (ih->protocol) {
3567         case IPPROTO_TCP: {
3568                 struct tcphdr _tcph, *th;
3569
3570                 if (ntohs(ih->frag_off) & IP_OFFSET)
3571                         break;
3572
3573                 offset += ihlen;
3574                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3575                 if (th == NULL)
3576                         break;
3577
3578                 ad->u.net->sport = th->source;
3579                 ad->u.net->dport = th->dest;
3580                 break;
3581         }
3582
3583         case IPPROTO_UDP: {
3584                 struct udphdr _udph, *uh;
3585
3586                 if (ntohs(ih->frag_off) & IP_OFFSET)
3587                         break;
3588
3589                 offset += ihlen;
3590                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3591                 if (uh == NULL)
3592                         break;
3593
3594                 ad->u.net->sport = uh->source;
3595                 ad->u.net->dport = uh->dest;
3596                 break;
3597         }
3598
3599         case IPPROTO_DCCP: {
3600                 struct dccp_hdr _dccph, *dh;
3601
3602                 if (ntohs(ih->frag_off) & IP_OFFSET)
3603                         break;
3604
3605                 offset += ihlen;
3606                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3607                 if (dh == NULL)
3608                         break;
3609
3610                 ad->u.net->sport = dh->dccph_sport;
3611                 ad->u.net->dport = dh->dccph_dport;
3612                 break;
3613         }
3614
3615         default:
3616                 break;
3617         }
3618 out:
3619         return ret;
3620 }
3621
3622 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3623
3624 /* Returns error only if unable to parse addresses */
3625 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3626                         struct common_audit_data *ad, u8 *proto)
3627 {
3628         u8 nexthdr;
3629         int ret = -EINVAL, offset;
3630         struct ipv6hdr _ipv6h, *ip6;
3631         __be16 frag_off;
3632
3633         offset = skb_network_offset(skb);
3634         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3635         if (ip6 == NULL)
3636                 goto out;
3637
3638         ad->u.net->v6info.saddr = ip6->saddr;
3639         ad->u.net->v6info.daddr = ip6->daddr;
3640         ret = 0;
3641
3642         nexthdr = ip6->nexthdr;
3643         offset += sizeof(_ipv6h);
3644         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3645         if (offset < 0)
3646                 goto out;
3647
3648         if (proto)
3649                 *proto = nexthdr;
3650
3651         switch (nexthdr) {
3652         case IPPROTO_TCP: {
3653                 struct tcphdr _tcph, *th;
3654
3655                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3656                 if (th == NULL)
3657                         break;
3658
3659                 ad->u.net->sport = th->source;
3660                 ad->u.net->dport = th->dest;
3661                 break;
3662         }
3663
3664         case IPPROTO_UDP: {
3665                 struct udphdr _udph, *uh;
3666
3667                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3668                 if (uh == NULL)
3669                         break;
3670
3671                 ad->u.net->sport = uh->source;
3672                 ad->u.net->dport = uh->dest;
3673                 break;
3674         }
3675
3676         case IPPROTO_DCCP: {
3677                 struct dccp_hdr _dccph, *dh;
3678
3679                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3680                 if (dh == NULL)
3681                         break;
3682
3683                 ad->u.net->sport = dh->dccph_sport;
3684                 ad->u.net->dport = dh->dccph_dport;
3685                 break;
3686         }
3687
3688         /* includes fragments */
3689         default:
3690                 break;
3691         }
3692 out:
3693         return ret;
3694 }
3695
3696 #endif /* IPV6 */
3697
3698 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3699                              char **_addrp, int src, u8 *proto)
3700 {
3701         char *addrp;
3702         int ret;
3703
3704         switch (ad->u.net->family) {
3705         case PF_INET:
3706                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3707                 if (ret)
3708                         goto parse_error;
3709                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3710                                        &ad->u.net->v4info.daddr);
3711                 goto okay;
3712
3713 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3714         case PF_INET6:
3715                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3716                 if (ret)
3717                         goto parse_error;
3718                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3719                                        &ad->u.net->v6info.daddr);
3720                 goto okay;
3721 #endif  /* IPV6 */
3722         default:
3723                 addrp = NULL;
3724                 goto okay;
3725         }
3726
3727 parse_error:
3728         printk(KERN_WARNING
3729                "SELinux: failure in selinux_parse_skb(),"
3730                " unable to parse packet\n");
3731         return ret;
3732
3733 okay:
3734         if (_addrp)
3735                 *_addrp = addrp;
3736         return 0;
3737 }
3738
3739 /**
3740  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3741  * @skb: the packet
3742  * @family: protocol family
3743  * @sid: the packet's peer label SID
3744  *
3745  * Description:
3746  * Check the various different forms of network peer labeling and determine
3747  * the peer label/SID for the packet; most of the magic actually occurs in
3748  * the security server function security_net_peersid_cmp().  The function
3749  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3750  * or -EACCES if @sid is invalid due to inconsistencies with the different
3751  * peer labels.
3752  *
3753  */
3754 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3755 {
3756         int err;
3757         u32 xfrm_sid;
3758         u32 nlbl_sid;
3759         u32 nlbl_type;
3760
3761         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3762         if (unlikely(err))
3763                 return -EACCES;
3764         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3765         if (unlikely(err))
3766                 return -EACCES;
3767
3768         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3769         if (unlikely(err)) {
3770                 printk(KERN_WARNING
3771                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3772                        " unable to determine packet's peer label\n");
3773                 return -EACCES;
3774         }
3775
3776         return 0;
3777 }
3778
3779 /* socket security operations */
3780
3781 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3782                                  u16 secclass, u32 *socksid)
3783 {
3784         if (tsec->sockcreate_sid > SECSID_NULL) {
3785                 *socksid = tsec->sockcreate_sid;
3786                 return 0;
3787         }
3788
3789         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3790                                        socksid);
3791 }
3792
3793 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3794 {
3795         struct sk_security_struct *sksec = sk->sk_security;
3796         struct common_audit_data ad;
3797         struct lsm_network_audit net = {0,};
3798         u32 tsid = task_sid(task);
3799
3800         if (sksec->sid == SECINITSID_KERNEL)
3801                 return 0;
3802
3803         ad.type = LSM_AUDIT_DATA_NET;
3804         ad.u.net = &net;
3805         ad.u.net->sk = sk;
3806
3807         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3808 }
3809
3810 static int selinux_socket_create(int family, int type,
3811                                  int protocol, int kern)
3812 {
3813         const struct task_security_struct *tsec = current_security();
3814         u32 newsid;
3815         u16 secclass;
3816         int rc;
3817
3818         if (kern)
3819                 return 0;
3820
3821         secclass = socket_type_to_security_class(family, type, protocol);
3822         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3823         if (rc)
3824                 return rc;
3825
3826         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3827 }
3828
3829 static int selinux_socket_post_create(struct socket *sock, int family,
3830                                       int type, int protocol, int kern)
3831 {
3832         const struct task_security_struct *tsec = current_security();
3833         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3834         struct sk_security_struct *sksec;
3835         int err = 0;
3836
3837         isec->sclass = socket_type_to_security_class(family, type, protocol);
3838
3839         if (kern)
3840                 isec->sid = SECINITSID_KERNEL;
3841         else {
3842                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3843                 if (err)
3844                         return err;
3845         }
3846
3847         isec->initialized = 1;
3848
3849         if (sock->sk) {
3850                 sksec = sock->sk->sk_security;
3851                 sksec->sid = isec->sid;
3852                 sksec->sclass = isec->sclass;
3853                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3854         }
3855
3856         return err;
3857 }
3858
3859 /* Range of port numbers used to automatically bind.
3860    Need to determine whether we should perform a name_bind
3861    permission check between the socket and the port number. */
3862
3863 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3864 {
3865         struct sock *sk = sock->sk;
3866         u16 family;
3867         int err;
3868
3869         err = sock_has_perm(current, sk, SOCKET__BIND);
3870         if (err)
3871                 goto out;
3872
3873         /*
3874          * If PF_INET or PF_INET6, check name_bind permission for the port.
3875          * Multiple address binding for SCTP is not supported yet: we just
3876          * check the first address now.
3877          */
3878         family = sk->sk_family;
3879         if (family == PF_INET || family == PF_INET6) {
3880                 char *addrp;
3881                 struct sk_security_struct *sksec = sk->sk_security;
3882                 struct common_audit_data ad;
3883                 struct lsm_network_audit net = {0,};
3884                 struct sockaddr_in *addr4 = NULL;
3885                 struct sockaddr_in6 *addr6 = NULL;
3886                 unsigned short snum;
3887                 u32 sid, node_perm;
3888
3889                 if (family == PF_INET) {
3890                         addr4 = (struct sockaddr_in *)address;
3891                         snum = ntohs(addr4->sin_port);
3892                         addrp = (char *)&addr4->sin_addr.s_addr;
3893                 } else {
3894                         addr6 = (struct sockaddr_in6 *)address;
3895                         snum = ntohs(addr6->sin6_port);
3896                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3897                 }
3898
3899                 if (snum) {
3900                         int low, high;
3901
3902                         inet_get_local_port_range(&low, &high);
3903
3904                         if (snum < max(PROT_SOCK, low) || snum > high) {
3905                                 err = sel_netport_sid(sk->sk_protocol,
3906                                                       snum, &sid);
3907                                 if (err)
3908                                         goto out;
3909                                 ad.type = LSM_AUDIT_DATA_NET;
3910                                 ad.u.net = &net;
3911                                 ad.u.net->sport = htons(snum);
3912                                 ad.u.net->family = family;
3913                                 err = avc_has_perm(sksec->sid, sid,
3914                                                    sksec->sclass,
3915                                                    SOCKET__NAME_BIND, &ad);
3916                                 if (err)
3917                                         goto out;
3918                         }
3919                 }
3920
3921                 switch (sksec->sclass) {
3922                 case SECCLASS_TCP_SOCKET:
3923                         node_perm = TCP_SOCKET__NODE_BIND;
3924                         break;
3925
3926                 case SECCLASS_UDP_SOCKET:
3927                         node_perm = UDP_SOCKET__NODE_BIND;
3928                         break;
3929
3930                 case SECCLASS_DCCP_SOCKET:
3931                         node_perm = DCCP_SOCKET__NODE_BIND;
3932                         break;
3933
3934                 default:
3935                         node_perm = RAWIP_SOCKET__NODE_BIND;
3936                         break;
3937                 }
3938
3939                 err = sel_netnode_sid(addrp, family, &sid);
3940                 if (err)
3941                         goto out;
3942
3943                 ad.type = LSM_AUDIT_DATA_NET;
3944                 ad.u.net = &net;
3945                 ad.u.net->sport = htons(snum);
3946                 ad.u.net->family = family;
3947
3948                 if (family == PF_INET)
3949                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3950                 else
3951                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3952
3953                 err = avc_has_perm(sksec->sid, sid,
3954                                    sksec->sclass, node_perm, &ad);
3955                 if (err)
3956                         goto out;
3957         }
3958 out:
3959         return err;
3960 }
3961
3962 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3963 {
3964         struct sock *sk = sock->sk;
3965         struct sk_security_struct *sksec = sk->sk_security;
3966         int err;
3967
3968         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3969         if (err)
3970                 return err;
3971
3972         /*
3973          * If a TCP or DCCP socket, check name_connect permission for the port.
3974          */
3975         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3976             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3977                 struct common_audit_data ad;
3978                 struct lsm_network_audit net = {0,};
3979                 struct sockaddr_in *addr4 = NULL;
3980                 struct sockaddr_in6 *addr6 = NULL;
3981                 unsigned short snum;
3982                 u32 sid, perm;
3983
3984                 if (sk->sk_family == PF_INET) {
3985                         addr4 = (struct sockaddr_in *)address;
3986                         if (addrlen < sizeof(struct sockaddr_in))
3987                                 return -EINVAL;
3988                         snum = ntohs(addr4->sin_port);
3989                 } else {
3990                         addr6 = (struct sockaddr_in6 *)address;
3991                         if (addrlen < SIN6_LEN_RFC2133)
3992                                 return -EINVAL;
3993                         snum = ntohs(addr6->sin6_port);
3994                 }
3995
3996                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3997                 if (err)
3998                         goto out;
3999
4000                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4001                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4002
4003                 ad.type = LSM_AUDIT_DATA_NET;
4004                 ad.u.net = &net;
4005                 ad.u.net->dport = htons(snum);
4006                 ad.u.net->family = sk->sk_family;
4007                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4008                 if (err)
4009                         goto out;
4010         }
4011
4012         err = selinux_netlbl_socket_connect(sk, address);
4013
4014 out:
4015         return err;
4016 }
4017
4018 static int selinux_socket_listen(struct socket *sock, int backlog)
4019 {
4020         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4021 }
4022
4023 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4024 {
4025         int err;
4026         struct inode_security_struct *isec;
4027         struct inode_security_struct *newisec;
4028
4029         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4030         if (err)
4031                 return err;
4032
4033         newisec = SOCK_INODE(newsock)->i_security;
4034
4035         isec = SOCK_INODE(sock)->i_security;
4036         newisec->sclass = isec->sclass;
4037         newisec->sid = isec->sid;
4038         newisec->initialized = 1;
4039
4040         return 0;
4041 }
4042
4043 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4044                                   int size)
4045 {
4046         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4047 }
4048
4049 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4050                                   int size, int flags)
4051 {
4052         return sock_has_perm(current, sock->sk, SOCKET__READ);
4053 }
4054
4055 static int selinux_socket_getsockname(struct socket *sock)
4056 {
4057         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4058 }
4059
4060 static int selinux_socket_getpeername(struct socket *sock)
4061 {
4062         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4063 }
4064
4065 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4066 {
4067         int err;
4068
4069         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4070         if (err)
4071                 return err;
4072
4073         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4074 }
4075
4076 static int selinux_socket_getsockopt(struct socket *sock, int level,
4077                                      int optname)
4078 {
4079         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4080 }
4081
4082 static int selinux_socket_shutdown(struct socket *sock, int how)
4083 {
4084         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4085 }
4086
4087 static int selinux_socket_unix_stream_connect(struct sock *sock,
4088                                               struct sock *other,
4089                                               struct sock *newsk)
4090 {
4091         struct sk_security_struct *sksec_sock = sock->sk_security;
4092         struct sk_security_struct *sksec_other = other->sk_security;
4093         struct sk_security_struct *sksec_new = newsk->sk_security;
4094         struct common_audit_data ad;
4095         struct lsm_network_audit net = {0,};
4096         int err;
4097
4098         ad.type = LSM_AUDIT_DATA_NET;
4099         ad.u.net = &net;
4100         ad.u.net->sk = other;
4101
4102         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4103                            sksec_other->sclass,
4104                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4105         if (err)
4106                 return err;
4107
4108         /* server child socket */
4109         sksec_new->peer_sid = sksec_sock->sid;
4110         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4111                                     &sksec_new->sid);
4112         if (err)
4113                 return err;
4114
4115         /* connecting socket */
4116         sksec_sock->peer_sid = sksec_new->sid;
4117
4118         return 0;
4119 }
4120
4121 static int selinux_socket_unix_may_send(struct socket *sock,
4122                                         struct socket *other)
4123 {
4124         struct sk_security_struct *ssec = sock->sk->sk_security;
4125         struct sk_security_struct *osec = other->sk->sk_security;
4126         struct common_audit_data ad;
4127         struct lsm_network_audit net = {0,};
4128
4129         ad.type = LSM_AUDIT_DATA_NET;
4130         ad.u.net = &net;
4131         ad.u.net->sk = other->sk;
4132
4133         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4134                             &ad);
4135 }
4136
4137 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4138                                     u32 peer_sid,
4139                                     struct common_audit_data *ad)
4140 {
4141         int err;
4142         u32 if_sid;
4143         u32 node_sid;
4144
4145         err = sel_netif_sid(ifindex, &if_sid);
4146         if (err)
4147                 return err;
4148         err = avc_has_perm(peer_sid, if_sid,
4149                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4150         if (err)
4151                 return err;
4152
4153         err = sel_netnode_sid(addrp, family, &node_sid);
4154         if (err)
4155                 return err;
4156         return avc_has_perm(peer_sid, node_sid,
4157                             SECCLASS_NODE, NODE__RECVFROM, ad);
4158 }
4159
4160 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4161                                        u16 family)
4162 {
4163         int err = 0;
4164         struct sk_security_struct *sksec = sk->sk_security;
4165         u32 sk_sid = sksec->sid;
4166         struct common_audit_data ad;
4167         struct lsm_network_audit net = {0,};
4168         char *addrp;
4169
4170         ad.type = LSM_AUDIT_DATA_NET;
4171         ad.u.net = &net;
4172         ad.u.net->netif = skb->skb_iif;
4173         ad.u.net->family = family;
4174         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4175         if (err)
4176                 return err;
4177
4178         if (selinux_secmark_enabled()) {
4179                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4180                                    PACKET__RECV, &ad);
4181                 if (err)
4182                         return err;
4183         }
4184
4185         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4186         if (err)
4187                 return err;
4188         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4189
4190         return err;
4191 }
4192
4193 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4194 {
4195         int err;
4196         struct sk_security_struct *sksec = sk->sk_security;
4197         u16 family = sk->sk_family;
4198         u32 sk_sid = sksec->sid;
4199         struct common_audit_data ad;
4200         struct lsm_network_audit net = {0,};
4201         char *addrp;
4202         u8 secmark_active;
4203         u8 peerlbl_active;
4204
4205         if (family != PF_INET && family != PF_INET6)
4206                 return 0;
4207
4208         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4209         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4210                 family = PF_INET;
4211
4212         /* If any sort of compatibility mode is enabled then handoff processing
4213          * to the selinux_sock_rcv_skb_compat() function to deal with the
4214          * special handling.  We do this in an attempt to keep this function
4215          * as fast and as clean as possible. */
4216         if (!selinux_policycap_netpeer)
4217                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4218
4219         secmark_active = selinux_secmark_enabled();
4220         peerlbl_active = selinux_peerlbl_enabled();
4221         if (!secmark_active && !peerlbl_active)
4222                 return 0;
4223
4224         ad.type = LSM_AUDIT_DATA_NET;
4225         ad.u.net = &net;
4226         ad.u.net->netif = skb->skb_iif;
4227         ad.u.net->family = family;
4228         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4229         if (err)
4230                 return err;
4231
4232         if (peerlbl_active) {
4233                 u32 peer_sid;
4234
4235                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4236                 if (err)
4237                         return err;
4238                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4239                                                peer_sid, &ad);
4240                 if (err) {
4241                         selinux_netlbl_err(skb, err, 0);
4242                         return err;
4243                 }
4244                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4245                                    PEER__RECV, &ad);
4246                 if (err)
4247                         selinux_netlbl_err(skb, err, 0);
4248         }
4249
4250         if (secmark_active) {
4251                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4252                                    PACKET__RECV, &ad);
4253                 if (err)
4254                         return err;
4255         }
4256
4257         return err;
4258 }
4259
4260 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4261                                             int __user *optlen, unsigned len)
4262 {
4263         int err = 0;
4264         char *scontext;
4265         u32 scontext_len;
4266         struct sk_security_struct *sksec = sock->sk->sk_security;
4267         u32 peer_sid = SECSID_NULL;
4268
4269         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4270             sksec->sclass == SECCLASS_TCP_SOCKET)
4271                 peer_sid = sksec->peer_sid;
4272         if (peer_sid == SECSID_NULL)
4273                 return -ENOPROTOOPT;
4274
4275         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4276         if (err)
4277                 return err;
4278
4279         if (scontext_len > len) {
4280                 err = -ERANGE;
4281                 goto out_len;
4282         }
4283
4284         if (copy_to_user(optval, scontext, scontext_len))
4285                 err = -EFAULT;
4286
4287 out_len:
4288         if (put_user(scontext_len, optlen))
4289                 err = -EFAULT;
4290         kfree(scontext);
4291         return err;
4292 }
4293
4294 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4295 {
4296         u32 peer_secid = SECSID_NULL;
4297         u16 family;
4298
4299         if (skb && skb->protocol == htons(ETH_P_IP))
4300                 family = PF_INET;
4301         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4302                 family = PF_INET6;
4303         else if (sock)
4304                 family = sock->sk->sk_family;
4305         else
4306                 goto out;
4307
4308         if (sock && family == PF_UNIX)
4309                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4310         else if (skb)
4311                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4312
4313 out:
4314         *secid = peer_secid;
4315         if (peer_secid == SECSID_NULL)
4316                 return -EINVAL;
4317         return 0;
4318 }
4319
4320 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4321 {
4322         struct sk_security_struct *sksec;
4323
4324         sksec = kzalloc(sizeof(*sksec), priority);
4325         if (!sksec)
4326                 return -ENOMEM;
4327
4328         sksec->peer_sid = SECINITSID_UNLABELED;
4329         sksec->sid = SECINITSID_UNLABELED;
4330         selinux_netlbl_sk_security_reset(sksec);
4331         sk->sk_security = sksec;
4332
4333         return 0;
4334 }
4335
4336 static void selinux_sk_free_security(struct sock *sk)
4337 {
4338         struct sk_security_struct *sksec = sk->sk_security;
4339
4340         sk->sk_security = NULL;
4341         selinux_netlbl_sk_security_free(sksec);
4342         kfree(sksec);
4343 }
4344
4345 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4346 {
4347         struct sk_security_struct *sksec = sk->sk_security;
4348         struct sk_security_struct *newsksec = newsk->sk_security;
4349
4350         newsksec->sid = sksec->sid;
4351         newsksec->peer_sid = sksec->peer_sid;
4352         newsksec->sclass = sksec->sclass;
4353
4354         selinux_netlbl_sk_security_reset(newsksec);
4355 }
4356
4357 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4358 {
4359         if (!sk)
4360                 *secid = SECINITSID_ANY_SOCKET;
4361         else {
4362                 struct sk_security_struct *sksec = sk->sk_security;
4363
4364                 *secid = sksec->sid;
4365         }
4366 }
4367
4368 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4369 {
4370         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4371         struct sk_security_struct *sksec = sk->sk_security;
4372
4373         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4374             sk->sk_family == PF_UNIX)
4375                 isec->sid = sksec->sid;
4376         sksec->sclass = isec->sclass;
4377 }
4378
4379 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4380                                      struct request_sock *req)
4381 {
4382         struct sk_security_struct *sksec = sk->sk_security;
4383         int err;
4384         u16 family = sk->sk_family;
4385         u32 newsid;
4386         u32 peersid;
4387
4388         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4389         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4390                 family = PF_INET;
4391
4392         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4393         if (err)
4394                 return err;
4395         if (peersid == SECSID_NULL) {
4396                 req->secid = sksec->sid;
4397                 req->peer_secid = SECSID_NULL;
4398         } else {
4399                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4400                 if (err)
4401                         return err;
4402                 req->secid = newsid;
4403                 req->peer_secid = peersid;
4404         }
4405
4406         return selinux_netlbl_inet_conn_request(req, family);
4407 }
4408
4409 static void selinux_inet_csk_clone(struct sock *newsk,
4410                                    const struct request_sock *req)
4411 {
4412         struct sk_security_struct *newsksec = newsk->sk_security;
4413
4414         newsksec->sid = req->secid;
4415         newsksec->peer_sid = req->peer_secid;
4416         /* NOTE: Ideally, we should also get the isec->sid for the
4417            new socket in sync, but we don't have the isec available yet.
4418            So we will wait until sock_graft to do it, by which
4419            time it will have been created and available. */
4420
4421         /* We don't need to take any sort of lock here as we are the only
4422          * thread with access to newsksec */
4423         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4424 }
4425
4426 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4427 {
4428         u16 family = sk->sk_family;
4429         struct sk_security_struct *sksec = sk->sk_security;
4430
4431         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4432         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4433                 family = PF_INET;
4434
4435         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4436 }
4437
4438 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4439 {
4440         skb_set_owner_w(skb, sk);
4441 }
4442
4443 static int selinux_secmark_relabel_packet(u32 sid)
4444 {
4445         const struct task_security_struct *__tsec;
4446         u32 tsid;
4447
4448         __tsec = current_security();
4449         tsid = __tsec->sid;
4450
4451         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4452 }
4453
4454 static void selinux_secmark_refcount_inc(void)
4455 {
4456         atomic_inc(&selinux_secmark_refcount);
4457 }
4458
4459 static void selinux_secmark_refcount_dec(void)
4460 {
4461         atomic_dec(&selinux_secmark_refcount);
4462 }
4463
4464 static void selinux_req_classify_flow(const struct request_sock *req,
4465                                       struct flowi *fl)
4466 {
4467         fl->flowi_secid = req->secid;
4468 }
4469
4470 static int selinux_tun_dev_alloc_security(void **security)
4471 {
4472         struct tun_security_struct *tunsec;
4473
4474         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4475         if (!tunsec)
4476                 return -ENOMEM;
4477         tunsec->sid = current_sid();
4478
4479         *security = tunsec;
4480         return 0;
4481 }
4482
4483 static void selinux_tun_dev_free_security(void *security)
4484 {
4485         kfree(security);
4486 }
4487
4488 static int selinux_tun_dev_create(void)
4489 {
4490         u32 sid = current_sid();
4491
4492         /* we aren't taking into account the "sockcreate" SID since the socket
4493          * that is being created here is not a socket in the traditional sense,
4494          * instead it is a private sock, accessible only to the kernel, and
4495          * representing a wide range of network traffic spanning multiple
4496          * connections unlike traditional sockets - check the TUN driver to
4497          * get a better understanding of why this socket is special */
4498
4499         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4500                             NULL);
4501 }
4502
4503 static int selinux_tun_dev_attach_queue(void *security)
4504 {
4505         struct tun_security_struct *tunsec = security;
4506
4507         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4508                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4509 }
4510
4511 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4512 {
4513         struct tun_security_struct *tunsec = security;
4514         struct sk_security_struct *sksec = sk->sk_security;
4515
4516         /* we don't currently perform any NetLabel based labeling here and it
4517          * isn't clear that we would want to do so anyway; while we could apply
4518          * labeling without the support of the TUN user the resulting labeled
4519          * traffic from the other end of the connection would almost certainly
4520          * cause confusion to the TUN user that had no idea network labeling
4521          * protocols were being used */
4522
4523         sksec->sid = tunsec->sid;
4524         sksec->sclass = SECCLASS_TUN_SOCKET;
4525
4526         return 0;
4527 }
4528
4529 static int selinux_tun_dev_open(void *security)
4530 {
4531         struct tun_security_struct *tunsec = security;
4532         u32 sid = current_sid();
4533         int err;
4534
4535         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4536                            TUN_SOCKET__RELABELFROM, NULL);
4537         if (err)
4538                 return err;
4539         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4540                            TUN_SOCKET__RELABELTO, NULL);
4541         if (err)
4542                 return err;
4543         tunsec->sid = sid;
4544
4545         return 0;
4546 }
4547
4548 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4549 {
4550         int err = 0;
4551         u32 perm;
4552         struct nlmsghdr *nlh;
4553         struct sk_security_struct *sksec = sk->sk_security;
4554
4555         if (skb->len < NLMSG_HDRLEN) {
4556                 err = -EINVAL;
4557                 goto out;
4558         }
4559         nlh = nlmsg_hdr(skb);
4560
4561         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4562         if (err) {
4563                 if (err == -EINVAL) {
4564                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4565                                   "SELinux:  unrecognized netlink message"
4566                                   " type=%hu for sclass=%hu\n",
4567                                   nlh->nlmsg_type, sksec->sclass);
4568                         if (!selinux_enforcing || security_get_allow_unknown())
4569                                 err = 0;
4570                 }
4571
4572                 /* Ignore */
4573                 if (err == -ENOENT)
4574                         err = 0;
4575                 goto out;
4576         }
4577
4578         err = sock_has_perm(current, sk, perm);
4579 out:
4580         return err;
4581 }
4582
4583 #ifdef CONFIG_NETFILTER
4584
4585 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4586                                        u16 family)
4587 {
4588         int err;
4589         char *addrp;
4590         u32 peer_sid;
4591         struct common_audit_data ad;
4592         struct lsm_network_audit net = {0,};
4593         u8 secmark_active;
4594         u8 netlbl_active;
4595         u8 peerlbl_active;
4596
4597         if (!selinux_policycap_netpeer)
4598                 return NF_ACCEPT;
4599
4600         secmark_active = selinux_secmark_enabled();
4601         netlbl_active = netlbl_enabled();
4602         peerlbl_active = selinux_peerlbl_enabled();
4603         if (!secmark_active && !peerlbl_active)
4604                 return NF_ACCEPT;
4605
4606         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4607                 return NF_DROP;
4608
4609         ad.type = LSM_AUDIT_DATA_NET;
4610         ad.u.net = &net;
4611         ad.u.net->netif = ifindex;
4612         ad.u.net->family = family;
4613         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4614                 return NF_DROP;
4615
4616         if (peerlbl_active) {
4617                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4618                                                peer_sid, &ad);
4619                 if (err) {
4620                         selinux_netlbl_err(skb, err, 1);
4621                         return NF_DROP;
4622                 }
4623         }
4624
4625         if (secmark_active)
4626                 if (avc_has_perm(peer_sid, skb->secmark,
4627                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4628                         return NF_DROP;
4629
4630         if (netlbl_active)
4631                 /* we do this in the FORWARD path and not the POST_ROUTING
4632                  * path because we want to make sure we apply the necessary
4633                  * labeling before IPsec is applied so we can leverage AH
4634                  * protection */
4635                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4636                         return NF_DROP;
4637
4638         return NF_ACCEPT;
4639 }
4640
4641 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4642                                          struct sk_buff *skb,
4643                                          const struct net_device *in,
4644                                          const struct net_device *out,
4645                                          int (*okfn)(struct sk_buff *))
4646 {
4647         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4648 }
4649
4650 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4651 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4652                                          struct sk_buff *skb,
4653                                          const struct net_device *in,
4654                                          const struct net_device *out,
4655                                          int (*okfn)(struct sk_buff *))
4656 {
4657         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4658 }
4659 #endif  /* IPV6 */
4660
4661 static unsigned int selinux_ip_output(struct sk_buff *skb,
4662                                       u16 family)
4663 {
4664         u32 sid;
4665
4666         if (!netlbl_enabled())
4667                 return NF_ACCEPT;
4668
4669         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4670          * because we want to make sure we apply the necessary labeling
4671          * before IPsec is applied so we can leverage AH protection */
4672         if (skb->sk) {
4673                 struct sk_security_struct *sksec = skb->sk->sk_security;
4674                 sid = sksec->sid;
4675         } else
4676                 sid = SECINITSID_KERNEL;
4677         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4678                 return NF_DROP;
4679
4680         return NF_ACCEPT;
4681 }
4682
4683 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4684                                         struct sk_buff *skb,
4685                                         const struct net_device *in,
4686                                         const struct net_device *out,
4687                                         int (*okfn)(struct sk_buff *))
4688 {
4689         return selinux_ip_output(skb, PF_INET);
4690 }
4691
4692 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4693                                                 int ifindex,
4694                                                 u16 family)
4695 {
4696         struct sock *sk = skb->sk;
4697         struct sk_security_struct *sksec;
4698         struct common_audit_data ad;
4699         struct lsm_network_audit net = {0,};
4700         char *addrp;
4701         u8 proto;
4702
4703         if (sk == NULL)
4704                 return NF_ACCEPT;
4705         sksec = sk->sk_security;
4706
4707         ad.type = LSM_AUDIT_DATA_NET;
4708         ad.u.net = &net;
4709         ad.u.net->netif = ifindex;
4710         ad.u.net->family = family;
4711         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4712                 return NF_DROP;
4713
4714         if (selinux_secmark_enabled())
4715                 if (avc_has_perm(sksec->sid, skb->secmark,
4716                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4717                         return NF_DROP_ERR(-ECONNREFUSED);
4718
4719         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4720                 return NF_DROP_ERR(-ECONNREFUSED);
4721
4722         return NF_ACCEPT;
4723 }
4724
4725 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4726                                          u16 family)
4727 {
4728         u32 secmark_perm;
4729         u32 peer_sid;
4730         struct sock *sk;
4731         struct common_audit_data ad;
4732         struct lsm_network_audit net = {0,};
4733         char *addrp;
4734         u8 secmark_active;
4735         u8 peerlbl_active;
4736
4737         /* If any sort of compatibility mode is enabled then handoff processing
4738          * to the selinux_ip_postroute_compat() function to deal with the
4739          * special handling.  We do this in an attempt to keep this function
4740          * as fast and as clean as possible. */
4741         if (!selinux_policycap_netpeer)
4742                 return selinux_ip_postroute_compat(skb, ifindex, family);
4743 #ifdef CONFIG_XFRM
4744         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4745          * packet transformation so allow the packet to pass without any checks
4746          * since we'll have another chance to perform access control checks
4747          * when the packet is on it's final way out.
4748          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4749          *       is NULL, in this case go ahead and apply access control. */
4750         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4751                 return NF_ACCEPT;
4752 #endif
4753         secmark_active = selinux_secmark_enabled();
4754         peerlbl_active = selinux_peerlbl_enabled();
4755         if (!secmark_active && !peerlbl_active)
4756                 return NF_ACCEPT;
4757
4758         /* if the packet is being forwarded then get the peer label from the
4759          * packet itself; otherwise check to see if it is from a local
4760          * application or the kernel, if from an application get the peer label
4761          * from the sending socket, otherwise use the kernel's sid */
4762         sk = skb->sk;
4763         if (sk == NULL) {
4764                 if (skb->skb_iif) {
4765                         secmark_perm = PACKET__FORWARD_OUT;
4766                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4767                                 return NF_DROP;
4768                 } else {
4769                         secmark_perm = PACKET__SEND;
4770                         peer_sid = SECINITSID_KERNEL;
4771                 }
4772         } else {
4773                 struct sk_security_struct *sksec = sk->sk_security;
4774                 peer_sid = sksec->sid;
4775                 secmark_perm = PACKET__SEND;
4776         }
4777
4778         ad.type = LSM_AUDIT_DATA_NET;
4779         ad.u.net = &net;
4780         ad.u.net->netif = ifindex;
4781         ad.u.net->family = family;
4782         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4783                 return NF_DROP;
4784
4785         if (secmark_active)
4786                 if (avc_has_perm(peer_sid, skb->secmark,
4787                                  SECCLASS_PACKET, secmark_perm, &ad))
4788                         return NF_DROP_ERR(-ECONNREFUSED);
4789
4790         if (peerlbl_active) {
4791                 u32 if_sid;
4792                 u32 node_sid;
4793
4794                 if (sel_netif_sid(ifindex, &if_sid))
4795                         return NF_DROP;
4796                 if (avc_has_perm(peer_sid, if_sid,
4797                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4798                         return NF_DROP_ERR(-ECONNREFUSED);
4799
4800                 if (sel_netnode_sid(addrp, family, &node_sid))
4801                         return NF_DROP;
4802                 if (avc_has_perm(peer_sid, node_sid,
4803                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4804                         return NF_DROP_ERR(-ECONNREFUSED);
4805         }
4806
4807         return NF_ACCEPT;
4808 }
4809
4810 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4811                                            struct sk_buff *skb,
4812                                            const struct net_device *in,
4813                                            const struct net_device *out,
4814                                            int (*okfn)(struct sk_buff *))
4815 {
4816         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4817 }
4818
4819 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4820 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4821                                            struct sk_buff *skb,
4822                                            const struct net_device *in,
4823                                            const struct net_device *out,
4824                                            int (*okfn)(struct sk_buff *))
4825 {
4826         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4827 }
4828 #endif  /* IPV6 */
4829
4830 #endif  /* CONFIG_NETFILTER */
4831
4832 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4833 {
4834         int err;
4835
4836         err = cap_netlink_send(sk, skb);
4837         if (err)
4838                 return err;
4839
4840         return selinux_nlmsg_perm(sk, skb);
4841 }
4842
4843 static int ipc_alloc_security(struct task_struct *task,
4844                               struct kern_ipc_perm *perm,
4845                               u16 sclass)
4846 {
4847         struct ipc_security_struct *isec;
4848         u32 sid;
4849
4850         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4851         if (!isec)
4852                 return -ENOMEM;
4853
4854         sid = task_sid(task);
4855         isec->sclass = sclass;
4856         isec->sid = sid;
4857         perm->security = isec;
4858
4859         return 0;
4860 }
4861
4862 static void ipc_free_security(struct kern_ipc_perm *perm)
4863 {
4864         struct ipc_security_struct *isec = perm->security;
4865         perm->security = NULL;
4866         kfree(isec);
4867 }
4868
4869 static int msg_msg_alloc_security(struct msg_msg *msg)
4870 {
4871         struct msg_security_struct *msec;
4872
4873         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4874         if (!msec)
4875                 return -ENOMEM;
4876
4877         msec->sid = SECINITSID_UNLABELED;
4878         msg->security = msec;
4879
4880         return 0;
4881 }
4882
4883 static void msg_msg_free_security(struct msg_msg *msg)
4884 {
4885         struct msg_security_struct *msec = msg->security;
4886
4887         msg->security = NULL;
4888         kfree(msec);
4889 }
4890
4891 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4892                         u32 perms)
4893 {
4894         struct ipc_security_struct *isec;
4895         struct common_audit_data ad;
4896         u32 sid = current_sid();
4897
4898         isec = ipc_perms->security;
4899
4900         ad.type = LSM_AUDIT_DATA_IPC;
4901         ad.u.ipc_id = ipc_perms->key;
4902
4903         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4904 }
4905
4906 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4907 {
4908         return msg_msg_alloc_security(msg);
4909 }
4910
4911 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4912 {
4913         msg_msg_free_security(msg);
4914 }
4915
4916 /* message queue security operations */
4917 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4918 {
4919         struct ipc_security_struct *isec;
4920         struct common_audit_data ad;
4921         u32 sid = current_sid();
4922         int rc;
4923
4924         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4925         if (rc)
4926                 return rc;
4927
4928         isec = msq->q_perm.security;
4929
4930         ad.type = LSM_AUDIT_DATA_IPC;
4931         ad.u.ipc_id = msq->q_perm.key;
4932
4933         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4934                           MSGQ__CREATE, &ad);
4935         if (rc) {
4936                 ipc_free_security(&msq->q_perm);
4937                 return rc;
4938         }
4939         return 0;
4940 }
4941
4942 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4943 {
4944         ipc_free_security(&msq->q_perm);
4945 }
4946
4947 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4948 {
4949         struct ipc_security_struct *isec;
4950         struct common_audit_data ad;
4951         u32 sid = current_sid();
4952
4953         isec = msq->q_perm.security;
4954
4955         ad.type = LSM_AUDIT_DATA_IPC;
4956         ad.u.ipc_id = msq->q_perm.key;
4957
4958         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4959                             MSGQ__ASSOCIATE, &ad);
4960 }
4961
4962 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4963 {
4964         int err;
4965         int perms;
4966
4967         switch (cmd) {
4968         case IPC_INFO:
4969         case MSG_INFO:
4970                 /* No specific object, just general system-wide information. */
4971                 return task_has_system(current, SYSTEM__IPC_INFO);
4972         case IPC_STAT:
4973         case MSG_STAT:
4974                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4975                 break;
4976         case IPC_SET:
4977                 perms = MSGQ__SETATTR;
4978                 break;
4979         case IPC_RMID:
4980                 perms = MSGQ__DESTROY;
4981                 break;
4982         default:
4983                 return 0;
4984         }
4985
4986         err = ipc_has_perm(&msq->q_perm, perms);
4987         return err;
4988 }
4989
4990 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4991 {
4992         struct ipc_security_struct *isec;
4993         struct msg_security_struct *msec;
4994         struct common_audit_data ad;
4995         u32 sid = current_sid();
4996         int rc;
4997
4998         isec = msq->q_perm.security;
4999         msec = msg->security;
5000
5001         /*
5002          * First time through, need to assign label to the message
5003          */
5004         if (msec->sid == SECINITSID_UNLABELED) {
5005                 /*
5006                  * Compute new sid based on current process and
5007                  * message queue this message will be stored in
5008                  */
5009                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5010                                              NULL, &msec->sid);
5011                 if (rc)
5012                         return rc;
5013         }
5014
5015         ad.type = LSM_AUDIT_DATA_IPC;
5016         ad.u.ipc_id = msq->q_perm.key;
5017
5018         /* Can this process write to the queue? */
5019         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5020                           MSGQ__WRITE, &ad);
5021         if (!rc)
5022                 /* Can this process send the message */
5023                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5024                                   MSG__SEND, &ad);
5025         if (!rc)
5026                 /* Can the message be put in the queue? */
5027                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5028                                   MSGQ__ENQUEUE, &ad);
5029
5030         return rc;
5031 }
5032
5033 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5034                                     struct task_struct *target,
5035                                     long type, int mode)
5036 {
5037         struct ipc_security_struct *isec;
5038         struct msg_security_struct *msec;
5039         struct common_audit_data ad;
5040         u32 sid = task_sid(target);
5041         int rc;
5042
5043         isec = msq->q_perm.security;
5044         msec = msg->security;
5045
5046         ad.type = LSM_AUDIT_DATA_IPC;
5047         ad.u.ipc_id = msq->q_perm.key;
5048
5049         rc = avc_has_perm(sid, isec->sid,
5050                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5051         if (!rc)
5052                 rc = avc_has_perm(sid, msec->sid,
5053                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5054         return rc;
5055 }
5056
5057 /* Shared Memory security operations */
5058 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5059 {
5060         struct ipc_security_struct *isec;
5061         struct common_audit_data ad;
5062         u32 sid = current_sid();
5063         int rc;
5064
5065         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5066         if (rc)
5067                 return rc;
5068
5069         isec = shp->shm_perm.security;
5070
5071         ad.type = LSM_AUDIT_DATA_IPC;
5072         ad.u.ipc_id = shp->shm_perm.key;
5073
5074         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5075                           SHM__CREATE, &ad);
5076         if (rc) {
5077                 ipc_free_security(&shp->shm_perm);
5078                 return rc;
5079         }
5080         return 0;
5081 }
5082
5083 static void selinux_shm_free_security(struct shmid_kernel *shp)
5084 {
5085         ipc_free_security(&shp->shm_perm);
5086 }
5087
5088 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5089 {
5090         struct ipc_security_struct *isec;
5091         struct common_audit_data ad;
5092         u32 sid = current_sid();
5093
5094         isec = shp->shm_perm.security;
5095
5096         ad.type = LSM_AUDIT_DATA_IPC;
5097         ad.u.ipc_id = shp->shm_perm.key;
5098
5099         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5100                             SHM__ASSOCIATE, &ad);
5101 }
5102
5103 /* Note, at this point, shp is locked down */
5104 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5105 {
5106         int perms;
5107         int err;
5108
5109         switch (cmd) {
5110         case IPC_INFO:
5111         case SHM_INFO:
5112                 /* No specific object, just general system-wide information. */
5113                 return task_has_system(current, SYSTEM__IPC_INFO);
5114         case IPC_STAT:
5115         case SHM_STAT:
5116                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5117                 break;
5118         case IPC_SET:
5119                 perms = SHM__SETATTR;
5120                 break;
5121         case SHM_LOCK:
5122         case SHM_UNLOCK:
5123                 perms = SHM__LOCK;
5124                 break;
5125         case IPC_RMID:
5126                 perms = SHM__DESTROY;
5127                 break;
5128         default:
5129                 return 0;
5130         }
5131
5132         err = ipc_has_perm(&shp->shm_perm, perms);
5133         return err;
5134 }
5135
5136 static int selinux_shm_shmat(struct shmid_kernel *shp,
5137                              char __user *shmaddr, int shmflg)
5138 {
5139         u32 perms;
5140
5141         if (shmflg & SHM_RDONLY)
5142                 perms = SHM__READ;
5143         else
5144                 perms = SHM__READ | SHM__WRITE;
5145
5146         return ipc_has_perm(&shp->shm_perm, perms);
5147 }
5148
5149 /* Semaphore security operations */
5150 static int selinux_sem_alloc_security(struct sem_array *sma)
5151 {
5152         struct ipc_security_struct *isec;
5153         struct common_audit_data ad;
5154         u32 sid = current_sid();
5155         int rc;
5156
5157         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5158         if (rc)
5159                 return rc;
5160
5161         isec = sma->sem_perm.security;
5162
5163         ad.type = LSM_AUDIT_DATA_IPC;
5164         ad.u.ipc_id = sma->sem_perm.key;
5165
5166         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5167                           SEM__CREATE, &ad);
5168         if (rc) {
5169                 ipc_free_security(&sma->sem_perm);
5170                 return rc;
5171         }
5172         return 0;
5173 }
5174
5175 static void selinux_sem_free_security(struct sem_array *sma)
5176 {
5177         ipc_free_security(&sma->sem_perm);
5178 }
5179
5180 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5181 {
5182         struct ipc_security_struct *isec;
5183         struct common_audit_data ad;
5184         u32 sid = current_sid();
5185
5186         isec = sma->sem_perm.security;
5187
5188         ad.type = LSM_AUDIT_DATA_IPC;
5189         ad.u.ipc_id = sma->sem_perm.key;
5190
5191         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5192                             SEM__ASSOCIATE, &ad);
5193 }
5194
5195 /* Note, at this point, sma is locked down */
5196 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5197 {
5198         int err;
5199         u32 perms;
5200
5201         switch (cmd) {
5202         case IPC_INFO:
5203         case SEM_INFO:
5204                 /* No specific object, just general system-wide information. */
5205                 return task_has_system(current, SYSTEM__IPC_INFO);
5206         case GETPID:
5207         case GETNCNT:
5208         case GETZCNT:
5209                 perms = SEM__GETATTR;
5210                 break;
5211         case GETVAL:
5212         case GETALL:
5213                 perms = SEM__READ;
5214                 break;
5215         case SETVAL:
5216         case SETALL:
5217                 perms = SEM__WRITE;
5218                 break;
5219         case IPC_RMID:
5220                 perms = SEM__DESTROY;
5221                 break;
5222         case IPC_SET:
5223                 perms = SEM__SETATTR;
5224                 break;
5225         case IPC_STAT:
5226         case SEM_STAT:
5227                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5228                 break;
5229         default:
5230                 return 0;
5231         }
5232
5233         err = ipc_has_perm(&sma->sem_perm, perms);
5234         return err;
5235 }
5236
5237 static int selinux_sem_semop(struct sem_array *sma,
5238                              struct sembuf *sops, unsigned nsops, int alter)
5239 {
5240         u32 perms;
5241
5242         if (alter)
5243                 perms = SEM__READ | SEM__WRITE;
5244         else
5245                 perms = SEM__READ;
5246
5247         return ipc_has_perm(&sma->sem_perm, perms);
5248 }
5249
5250 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5251 {
5252         u32 av = 0;
5253
5254         av = 0;
5255         if (flag & S_IRUGO)
5256                 av |= IPC__UNIX_READ;
5257         if (flag & S_IWUGO)
5258                 av |= IPC__UNIX_WRITE;
5259
5260         if (av == 0)
5261                 return 0;
5262
5263         return ipc_has_perm(ipcp, av);
5264 }
5265
5266 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5267 {
5268         struct ipc_security_struct *isec = ipcp->security;
5269         *secid = isec->sid;
5270 }
5271
5272 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5273 {
5274         if (inode)
5275                 inode_doinit_with_dentry(inode, dentry);
5276 }
5277
5278 static int selinux_getprocattr(struct task_struct *p,
5279                                char *name, char **value)
5280 {
5281         const struct task_security_struct *__tsec;
5282         u32 sid;
5283         int error;
5284         unsigned len;
5285
5286         if (current != p) {
5287                 error = current_has_perm(p, PROCESS__GETATTR);
5288                 if (error)
5289                         return error;
5290         }
5291
5292         rcu_read_lock();
5293         __tsec = __task_cred(p)->security;
5294
5295         if (!strcmp(name, "current"))
5296                 sid = __tsec->sid;
5297         else if (!strcmp(name, "prev"))
5298                 sid = __tsec->osid;
5299         else if (!strcmp(name, "exec"))
5300                 sid = __tsec->exec_sid;
5301         else if (!strcmp(name, "fscreate"))
5302                 sid = __tsec->create_sid;
5303         else if (!strcmp(name, "keycreate"))
5304                 sid = __tsec->keycreate_sid;
5305         else if (!strcmp(name, "sockcreate"))
5306                 sid = __tsec->sockcreate_sid;
5307         else
5308                 goto invalid;
5309         rcu_read_unlock();
5310
5311         if (!sid)
5312                 return 0;
5313
5314         error = security_sid_to_context(sid, value, &len);
5315         if (error)
5316                 return error;
5317         return len;
5318
5319 invalid:
5320         rcu_read_unlock();
5321         return -EINVAL;
5322 }
5323
5324 static int selinux_setprocattr(struct task_struct *p,
5325                                char *name, void *value, size_t size)
5326 {
5327         struct task_security_struct *tsec;
5328         struct task_struct *tracer;
5329         struct cred *new;
5330         u32 sid = 0, ptsid;
5331         int error;
5332         char *str = value;
5333
5334         if (current != p) {
5335                 /* SELinux only allows a process to change its own
5336                    security attributes. */
5337                 return -EACCES;
5338         }
5339
5340         /*
5341          * Basic control over ability to set these attributes at all.
5342          * current == p, but we'll pass them separately in case the
5343          * above restriction is ever removed.
5344          */
5345         if (!strcmp(name, "exec"))
5346                 error = current_has_perm(p, PROCESS__SETEXEC);
5347         else if (!strcmp(name, "fscreate"))
5348                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5349         else if (!strcmp(name, "keycreate"))
5350                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5351         else if (!strcmp(name, "sockcreate"))
5352                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5353         else if (!strcmp(name, "current"))
5354                 error = current_has_perm(p, PROCESS__SETCURRENT);
5355         else
5356                 error = -EINVAL;
5357         if (error)
5358                 return error;
5359
5360         /* Obtain a SID for the context, if one was specified. */
5361         if (size && str[1] && str[1] != '\n') {
5362                 if (str[size-1] == '\n') {
5363                         str[size-1] = 0;
5364                         size--;
5365                 }
5366                 error = security_context_to_sid(value, size, &sid);
5367                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5368                         if (!capable(CAP_MAC_ADMIN)) {
5369                                 struct audit_buffer *ab;
5370                                 size_t audit_size;
5371
5372                                 /* We strip a nul only if it is at the end, otherwise the
5373                                  * context contains a nul and we should audit that */
5374                                 if (str[size - 1] == '\0')
5375                                         audit_size = size - 1;
5376                                 else
5377                                         audit_size = size;
5378                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5379                                 audit_log_format(ab, "op=fscreate invalid_context=");
5380                                 audit_log_n_untrustedstring(ab, value, audit_size);
5381                                 audit_log_end(ab);
5382
5383                                 return error;
5384                         }
5385                         error = security_context_to_sid_force(value, size,
5386                                                               &sid);
5387                 }
5388                 if (error)
5389                         return error;
5390         }
5391
5392         new = prepare_creds();
5393         if (!new)
5394                 return -ENOMEM;
5395
5396         /* Permission checking based on the specified context is
5397            performed during the actual operation (execve,
5398            open/mkdir/...), when we know the full context of the
5399            operation.  See selinux_bprm_set_creds for the execve
5400            checks and may_create for the file creation checks. The
5401            operation will then fail if the context is not permitted. */
5402         tsec = new->security;
5403         if (!strcmp(name, "exec")) {
5404                 tsec->exec_sid = sid;
5405         } else if (!strcmp(name, "fscreate")) {
5406                 tsec->create_sid = sid;
5407         } else if (!strcmp(name, "keycreate")) {
5408                 error = may_create_key(sid, p);
5409                 if (error)
5410                         goto abort_change;
5411                 tsec->keycreate_sid = sid;
5412         } else if (!strcmp(name, "sockcreate")) {
5413                 tsec->sockcreate_sid = sid;
5414         } else if (!strcmp(name, "current")) {
5415                 error = -EINVAL;
5416                 if (sid == 0)
5417                         goto abort_change;
5418
5419                 /* Only allow single threaded processes to change context */
5420                 error = -EPERM;
5421                 if (!current_is_single_threaded()) {
5422                         error = security_bounded_transition(tsec->sid, sid);
5423                         if (error)
5424                                 goto abort_change;
5425                 }
5426
5427                 /* Check permissions for the transition. */
5428                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5429                                      PROCESS__DYNTRANSITION, NULL);
5430                 if (error)
5431                         goto abort_change;
5432
5433                 /* Check for ptracing, and update the task SID if ok.
5434                    Otherwise, leave SID unchanged and fail. */
5435                 ptsid = 0;
5436                 task_lock(p);
5437                 tracer = ptrace_parent(p);
5438                 if (tracer)
5439                         ptsid = task_sid(tracer);
5440                 task_unlock(p);
5441
5442                 if (tracer) {
5443                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5444                                              PROCESS__PTRACE, NULL);
5445                         if (error)
5446                                 goto abort_change;
5447                 }
5448
5449                 tsec->sid = sid;
5450         } else {
5451                 error = -EINVAL;
5452                 goto abort_change;
5453         }
5454
5455         commit_creds(new);
5456         return size;
5457
5458 abort_change:
5459         abort_creds(new);
5460         return error;
5461 }
5462
5463 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5464 {
5465         return security_sid_to_context(secid, secdata, seclen);
5466 }
5467
5468 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5469 {
5470         return security_context_to_sid(secdata, seclen, secid);
5471 }
5472
5473 static void selinux_release_secctx(char *secdata, u32 seclen)
5474 {
5475         kfree(secdata);
5476 }
5477
5478 /*
5479  *      called with inode->i_mutex locked
5480  */
5481 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5482 {
5483         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5484 }
5485
5486 /*
5487  *      called with inode->i_mutex locked
5488  */
5489 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5490 {
5491         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5492 }
5493
5494 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5495 {
5496         int len = 0;
5497         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5498                                                 ctx, true);
5499         if (len < 0)
5500                 return len;
5501         *ctxlen = len;
5502         return 0;
5503 }
5504 #ifdef CONFIG_KEYS
5505
5506 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5507                              unsigned long flags)
5508 {
5509         const struct task_security_struct *tsec;
5510         struct key_security_struct *ksec;
5511
5512         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5513         if (!ksec)
5514                 return -ENOMEM;
5515
5516         tsec = cred->security;
5517         if (tsec->keycreate_sid)
5518                 ksec->sid = tsec->keycreate_sid;
5519         else
5520                 ksec->sid = tsec->sid;
5521
5522         k->security = ksec;
5523         return 0;
5524 }
5525
5526 static void selinux_key_free(struct key *k)
5527 {
5528         struct key_security_struct *ksec = k->security;
5529
5530         k->security = NULL;
5531         kfree(ksec);
5532 }
5533
5534 static int selinux_key_permission(key_ref_t key_ref,
5535                                   const struct cred *cred,
5536                                   key_perm_t perm)
5537 {
5538         struct key *key;
5539         struct key_security_struct *ksec;
5540         u32 sid;
5541
5542         /* if no specific permissions are requested, we skip the
5543            permission check. No serious, additional covert channels
5544            appear to be created. */
5545         if (perm == 0)
5546                 return 0;
5547
5548         sid = cred_sid(cred);
5549
5550         key = key_ref_to_ptr(key_ref);
5551         ksec = key->security;
5552
5553         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5554 }
5555
5556 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5557 {
5558         struct key_security_struct *ksec = key->security;
5559         char *context = NULL;
5560         unsigned len;
5561         int rc;
5562
5563         rc = security_sid_to_context(ksec->sid, &context, &len);
5564         if (!rc)
5565                 rc = len;
5566         *_buffer = context;
5567         return rc;
5568 }
5569
5570 #endif
5571
5572 static struct security_operations selinux_ops = {
5573         .name =                         "selinux",
5574
5575         .ptrace_access_check =          selinux_ptrace_access_check,
5576         .ptrace_traceme =               selinux_ptrace_traceme,
5577         .capget =                       selinux_capget,
5578         .capset =                       selinux_capset,
5579         .capable =                      selinux_capable,
5580         .quotactl =                     selinux_quotactl,
5581         .quota_on =                     selinux_quota_on,
5582         .syslog =                       selinux_syslog,
5583         .vm_enough_memory =             selinux_vm_enough_memory,
5584
5585         .netlink_send =                 selinux_netlink_send,
5586
5587         .bprm_set_creds =               selinux_bprm_set_creds,
5588         .bprm_committing_creds =        selinux_bprm_committing_creds,
5589         .bprm_committed_creds =         selinux_bprm_committed_creds,
5590         .bprm_secureexec =              selinux_bprm_secureexec,
5591
5592         .sb_alloc_security =            selinux_sb_alloc_security,
5593         .sb_free_security =             selinux_sb_free_security,
5594         .sb_copy_data =                 selinux_sb_copy_data,
5595         .sb_remount =                   selinux_sb_remount,
5596         .sb_kern_mount =                selinux_sb_kern_mount,
5597         .sb_show_options =              selinux_sb_show_options,
5598         .sb_statfs =                    selinux_sb_statfs,
5599         .sb_mount =                     selinux_mount,
5600         .sb_umount =                    selinux_umount,
5601         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5602         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5603         .sb_parse_opts_str =            selinux_parse_opts_str,
5604
5605
5606         .inode_alloc_security =         selinux_inode_alloc_security,
5607         .inode_free_security =          selinux_inode_free_security,
5608         .inode_init_security =          selinux_inode_init_security,
5609         .inode_create =                 selinux_inode_create,
5610         .inode_link =                   selinux_inode_link,
5611         .inode_unlink =                 selinux_inode_unlink,
5612         .inode_symlink =                selinux_inode_symlink,
5613         .inode_mkdir =                  selinux_inode_mkdir,
5614         .inode_rmdir =                  selinux_inode_rmdir,
5615         .inode_mknod =                  selinux_inode_mknod,
5616         .inode_rename =                 selinux_inode_rename,
5617         .inode_readlink =               selinux_inode_readlink,
5618         .inode_follow_link =            selinux_inode_follow_link,
5619         .inode_permission =             selinux_inode_permission,
5620         .inode_setattr =                selinux_inode_setattr,
5621         .inode_getattr =                selinux_inode_getattr,
5622         .inode_setxattr =               selinux_inode_setxattr,
5623         .inode_post_setxattr =          selinux_inode_post_setxattr,
5624         .inode_getxattr =               selinux_inode_getxattr,
5625         .inode_listxattr =              selinux_inode_listxattr,
5626         .inode_removexattr =            selinux_inode_removexattr,
5627         .inode_getsecurity =            selinux_inode_getsecurity,
5628         .inode_setsecurity =            selinux_inode_setsecurity,
5629         .inode_listsecurity =           selinux_inode_listsecurity,
5630         .inode_getsecid =               selinux_inode_getsecid,
5631
5632         .file_permission =              selinux_file_permission,
5633         .file_alloc_security =          selinux_file_alloc_security,
5634         .file_free_security =           selinux_file_free_security,
5635         .file_ioctl =                   selinux_file_ioctl,
5636         .mmap_file =                    selinux_mmap_file,
5637         .mmap_addr =                    selinux_mmap_addr,
5638         .file_mprotect =                selinux_file_mprotect,
5639         .file_lock =                    selinux_file_lock,
5640         .file_fcntl =                   selinux_file_fcntl,
5641         .file_set_fowner =              selinux_file_set_fowner,
5642         .file_send_sigiotask =          selinux_file_send_sigiotask,
5643         .file_receive =                 selinux_file_receive,
5644
5645         .file_open =                    selinux_file_open,
5646
5647         .task_create =                  selinux_task_create,
5648         .cred_alloc_blank =             selinux_cred_alloc_blank,
5649         .cred_free =                    selinux_cred_free,
5650         .cred_prepare =                 selinux_cred_prepare,
5651         .cred_transfer =                selinux_cred_transfer,
5652         .kernel_act_as =                selinux_kernel_act_as,
5653         .kernel_create_files_as =       selinux_kernel_create_files_as,
5654         .kernel_module_request =        selinux_kernel_module_request,
5655         .task_setpgid =                 selinux_task_setpgid,
5656         .task_getpgid =                 selinux_task_getpgid,
5657         .task_getsid =                  selinux_task_getsid,
5658         .task_getsecid =                selinux_task_getsecid,
5659         .task_setnice =                 selinux_task_setnice,
5660         .task_setioprio =               selinux_task_setioprio,
5661         .task_getioprio =               selinux_task_getioprio,
5662         .task_setrlimit =               selinux_task_setrlimit,
5663         .task_setscheduler =            selinux_task_setscheduler,
5664         .task_getscheduler =            selinux_task_getscheduler,
5665         .task_movememory =              selinux_task_movememory,
5666         .task_kill =                    selinux_task_kill,
5667         .task_wait =                    selinux_task_wait,
5668         .task_to_inode =                selinux_task_to_inode,
5669
5670         .ipc_permission =               selinux_ipc_permission,
5671         .ipc_getsecid =                 selinux_ipc_getsecid,
5672
5673         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5674         .msg_msg_free_security =        selinux_msg_msg_free_security,
5675
5676         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5677         .msg_queue_free_security =      selinux_msg_queue_free_security,
5678         .msg_queue_associate =          selinux_msg_queue_associate,
5679         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5680         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5681         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5682
5683         .shm_alloc_security =           selinux_shm_alloc_security,
5684         .shm_free_security =            selinux_shm_free_security,
5685         .shm_associate =                selinux_shm_associate,
5686         .shm_shmctl =                   selinux_shm_shmctl,
5687         .shm_shmat =                    selinux_shm_shmat,
5688
5689         .sem_alloc_security =           selinux_sem_alloc_security,
5690         .sem_free_security =            selinux_sem_free_security,
5691         .sem_associate =                selinux_sem_associate,
5692         .sem_semctl =                   selinux_sem_semctl,
5693         .sem_semop =                    selinux_sem_semop,
5694
5695         .d_instantiate =                selinux_d_instantiate,
5696
5697         .getprocattr =                  selinux_getprocattr,
5698         .setprocattr =                  selinux_setprocattr,
5699
5700         .secid_to_secctx =              selinux_secid_to_secctx,
5701         .secctx_to_secid =              selinux_secctx_to_secid,
5702         .release_secctx =               selinux_release_secctx,
5703         .inode_notifysecctx =           selinux_inode_notifysecctx,
5704         .inode_setsecctx =              selinux_inode_setsecctx,
5705         .inode_getsecctx =              selinux_inode_getsecctx,
5706
5707         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5708         .unix_may_send =                selinux_socket_unix_may_send,
5709
5710         .socket_create =                selinux_socket_create,
5711         .socket_post_create =           selinux_socket_post_create,
5712         .socket_bind =                  selinux_socket_bind,
5713         .socket_connect =               selinux_socket_connect,
5714         .socket_listen =                selinux_socket_listen,
5715         .socket_accept =                selinux_socket_accept,
5716         .socket_sendmsg =               selinux_socket_sendmsg,
5717         .socket_recvmsg =               selinux_socket_recvmsg,
5718         .socket_getsockname =           selinux_socket_getsockname,
5719         .socket_getpeername =           selinux_socket_getpeername,
5720         .socket_getsockopt =            selinux_socket_getsockopt,
5721         .socket_setsockopt =            selinux_socket_setsockopt,
5722         .socket_shutdown =              selinux_socket_shutdown,
5723         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5724         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5725         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5726         .sk_alloc_security =            selinux_sk_alloc_security,
5727         .sk_free_security =             selinux_sk_free_security,
5728         .sk_clone_security =            selinux_sk_clone_security,
5729         .sk_getsecid =                  selinux_sk_getsecid,
5730         .sock_graft =                   selinux_sock_graft,
5731         .inet_conn_request =            selinux_inet_conn_request,
5732         .inet_csk_clone =               selinux_inet_csk_clone,
5733         .inet_conn_established =        selinux_inet_conn_established,
5734         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5735         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5736         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5737         .req_classify_flow =            selinux_req_classify_flow,
5738         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5739         .tun_dev_free_security =        selinux_tun_dev_free_security,
5740         .tun_dev_create =               selinux_tun_dev_create,
5741         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5742         .tun_dev_attach =               selinux_tun_dev_attach,
5743         .tun_dev_open =                 selinux_tun_dev_open,
5744         .skb_owned_by =                 selinux_skb_owned_by,
5745
5746 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5747         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5748         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5749         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5750         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5751         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5752         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5753         .xfrm_state_free_security =     selinux_xfrm_state_free,
5754         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5755         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5756         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5757         .xfrm_decode_session =          selinux_xfrm_decode_session,
5758 #endif
5759
5760 #ifdef CONFIG_KEYS
5761         .key_alloc =                    selinux_key_alloc,
5762         .key_free =                     selinux_key_free,
5763         .key_permission =               selinux_key_permission,
5764         .key_getsecurity =              selinux_key_getsecurity,
5765 #endif
5766
5767 #ifdef CONFIG_AUDIT
5768         .audit_rule_init =              selinux_audit_rule_init,
5769         .audit_rule_known =             selinux_audit_rule_known,
5770         .audit_rule_match =             selinux_audit_rule_match,
5771         .audit_rule_free =              selinux_audit_rule_free,
5772 #endif
5773 };
5774
5775 static __init int selinux_init(void)
5776 {
5777         if (!security_module_enable(&selinux_ops)) {
5778                 selinux_enabled = 0;
5779                 return 0;
5780         }
5781
5782         if (!selinux_enabled) {
5783                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5784                 return 0;
5785         }
5786
5787         printk(KERN_INFO "SELinux:  Initializing.\n");
5788
5789         /* Set the security state for the initial task. */
5790         cred_init_security();
5791
5792         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5793
5794         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5795                                             sizeof(struct inode_security_struct),
5796                                             0, SLAB_PANIC, NULL);
5797         avc_init();
5798
5799         if (register_security(&selinux_ops))
5800                 panic("SELinux: Unable to register with kernel.\n");
5801
5802         if (selinux_enforcing)
5803                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5804         else
5805                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5806
5807         return 0;
5808 }
5809
5810 static void delayed_superblock_init(struct super_block *sb, void *unused)
5811 {
5812         superblock_doinit(sb, NULL);
5813 }
5814
5815 void selinux_complete_init(void)
5816 {
5817         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5818
5819         /* Set up any superblocks initialized prior to the policy load. */
5820         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5821         iterate_supers(delayed_superblock_init, NULL);
5822 }
5823
5824 /* SELinux requires early initialization in order to label
5825    all processes and objects when they are created. */
5826 security_initcall(selinux_init);
5827
5828 #if defined(CONFIG_NETFILTER)
5829
5830 static struct nf_hook_ops selinux_ipv4_ops[] = {
5831         {
5832                 .hook =         selinux_ipv4_postroute,
5833                 .owner =        THIS_MODULE,
5834                 .pf =           NFPROTO_IPV4,
5835                 .hooknum =      NF_INET_POST_ROUTING,
5836                 .priority =     NF_IP_PRI_SELINUX_LAST,
5837         },
5838         {
5839                 .hook =         selinux_ipv4_forward,
5840                 .owner =        THIS_MODULE,
5841                 .pf =           NFPROTO_IPV4,
5842                 .hooknum =      NF_INET_FORWARD,
5843                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5844         },
5845         {
5846                 .hook =         selinux_ipv4_output,
5847                 .owner =        THIS_MODULE,
5848                 .pf =           NFPROTO_IPV4,
5849                 .hooknum =      NF_INET_LOCAL_OUT,
5850                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5851         }
5852 };
5853
5854 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5855
5856 static struct nf_hook_ops selinux_ipv6_ops[] = {
5857         {
5858                 .hook =         selinux_ipv6_postroute,
5859                 .owner =        THIS_MODULE,
5860                 .pf =           NFPROTO_IPV6,
5861                 .hooknum =      NF_INET_POST_ROUTING,
5862                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5863         },
5864         {
5865                 .hook =         selinux_ipv6_forward,
5866                 .owner =        THIS_MODULE,
5867                 .pf =           NFPROTO_IPV6,
5868                 .hooknum =      NF_INET_FORWARD,
5869                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5870         }
5871 };
5872
5873 #endif  /* IPV6 */
5874
5875 static int __init selinux_nf_ip_init(void)
5876 {
5877         int err = 0;
5878
5879         if (!selinux_enabled)
5880                 goto out;
5881
5882         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5883
5884         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5885         if (err)
5886                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5887
5888 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5889         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5890         if (err)
5891                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5892 #endif  /* IPV6 */
5893
5894 out:
5895         return err;
5896 }
5897
5898 __initcall(selinux_nf_ip_init);
5899
5900 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5901 static void selinux_nf_ip_exit(void)
5902 {
5903         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5904
5905         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5906 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5907         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5908 #endif  /* IPV6 */
5909 }
5910 #endif
5911
5912 #else /* CONFIG_NETFILTER */
5913
5914 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5915 #define selinux_nf_ip_exit()
5916 #endif
5917
5918 #endif /* CONFIG_NETFILTER */
5919
5920 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5921 static int selinux_disabled;
5922
5923 int selinux_disable(void)
5924 {
5925         if (ss_initialized) {
5926                 /* Not permitted after initial policy load. */
5927                 return -EINVAL;
5928         }
5929
5930         if (selinux_disabled) {
5931                 /* Only do this once. */
5932                 return -EINVAL;
5933         }
5934
5935         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5936
5937         selinux_disabled = 1;
5938         selinux_enabled = 0;
5939
5940         reset_security_ops();
5941
5942         /* Try to destroy the avc node cache */
5943         avc_disable();
5944
5945         /* Unregister netfilter hooks. */
5946         selinux_nf_ip_exit();
5947
5948         /* Unregister selinuxfs. */
5949         exit_sel_fs();
5950
5951         return 0;
5952 }
5953 #endif