security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/security.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 #define NUM_SEL_MNT_OPTS 5
  99
 100 extern struct security_operations *security_ops;
 101
 102 /* SECMARK reference count */
 103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 104
 105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 106 int selinux_enforcing;
 107
 108 static int __init enforcing_setup(char *str)
 109 {
 110         unsigned long enforcing;
 111         if (!strict_strtoul(str, 0, &enforcing))
 112                 selinux_enforcing = enforcing ? 1 : 0;
 113         return 1;
 114 }
 115 __setup("enforcing=", enforcing_setup);
 116 #endif
 117
 118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 120
 121 static int __init selinux_enabled_setup(char *str)
 122 {
 123         unsigned long enabled;
 124         if (!strict_strtoul(str, 0, &enabled))
 125                 selinux_enabled = enabled ? 1 : 0;
 126         return 1;
 127 }
 128 __setup("selinux=", selinux_enabled_setup);
 129 #else
 130 int selinux_enabled = 1;
 131 #endif
 132
 133 static struct kmem_cache *sel_inode_cache;
 134
 135 /**
 136  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 137  *
 138  * Description:
 139  * This function checks the SECMARK reference counter to see if any SECMARK
 140  * targets are currently configured, if the reference counter is greater than
 141  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 142  * enabled, false (0) if SECMARK is disabled.
 143  *
 144  */
 145 static int selinux_secmark_enabled(void)
 146 {
 147         return (atomic_read(&selinux_secmark_refcount) > 0);
 148 }
 149
 150 /*
 151  * initialise the security for the init task
 152  */
 153 static void cred_init_security(void)
 154 {
 155         struct cred *cred = (struct cred *) current->real_cred;
 156         struct task_security_struct *tsec;
 157
 158         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 159         if (!tsec)
 160                 panic("SELinux:  Failed to initialize initial task.\n");
 161
 162         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 163         cred->security = tsec;
 164 }
 165
 166 /*
 167  * get the security ID of a set of credentials
 168  */
 169 static inline u32 cred_sid(const struct cred *cred)
 170 {
 171         const struct task_security_struct *tsec;
 172
 173         tsec = cred->security;
 174         return tsec->sid;
 175 }
 176
 177 /*
 178  * get the objective security ID of a task
 179  */
 180 static inline u32 task_sid(const struct task_struct *task)
 181 {
 182         u32 sid;
 183
 184         rcu_read_lock();
 185         sid = cred_sid(__task_cred(task));
 186         rcu_read_unlock();
 187         return sid;
 188 }
 189
 190 /*
 191  * get the subjective security ID of the current task
 192  */
 193 static inline u32 current_sid(void)
 194 {
 195         const struct task_security_struct *tsec = current_security();
 196
 197         return tsec->sid;
 198 }
 199
 200 /* Allocate and free functions for each kind of security blob. */
 201
 202 static int inode_alloc_security(struct inode *inode)
 203 {
 204         struct inode_security_struct *isec;
 205         u32 sid = current_sid();
 206
 207         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 208         if (!isec)
 209                 return -ENOMEM;
 210
 211         mutex_init(&isec->lock);
 212         INIT_LIST_HEAD(&isec->list);
 213         isec->inode = inode;
 214         isec->sid = SECINITSID_UNLABELED;
 215         isec->sclass = SECCLASS_FILE;
 216         isec->task_sid = sid;
 217         inode->i_security = isec;
 218
 219         return 0;
 220 }
 221
 222 static void inode_free_security(struct inode *inode)
 223 {
 224         struct inode_security_struct *isec = inode->i_security;
 225         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 226
 227         spin_lock(&sbsec->isec_lock);
 228         if (!list_empty(&isec->list))
 229                 list_del_init(&isec->list);
 230         spin_unlock(&sbsec->isec_lock);
 231
 232         inode->i_security = NULL;
 233         kmem_cache_free(sel_inode_cache, isec);
 234 }
 235
 236 static int file_alloc_security(struct file *file)
 237 {
 238         struct file_security_struct *fsec;
 239         u32 sid = current_sid();
 240
 241         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 242         if (!fsec)
 243                 return -ENOMEM;
 244
 245         fsec->sid = sid;
 246         fsec->fown_sid = sid;
 247         file->f_security = fsec;
 248
 249         return 0;
 250 }
 251
 252 static void file_free_security(struct file *file)
 253 {
 254         struct file_security_struct *fsec = file->f_security;
 255         file->f_security = NULL;
 256         kfree(fsec);
 257 }
 258
 259 static int superblock_alloc_security(struct super_block *sb)
 260 {
 261         struct superblock_security_struct *sbsec;
 262
 263         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 264         if (!sbsec)
 265                 return -ENOMEM;
 266
 267         mutex_init(&sbsec->lock);
 268         INIT_LIST_HEAD(&sbsec->isec_head);
 269         spin_lock_init(&sbsec->isec_lock);
 270         sbsec->sb = sb;
 271         sbsec->sid = SECINITSID_UNLABELED;
 272         sbsec->def_sid = SECINITSID_FILE;
 273         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 274         sb->s_security = sbsec;
 275
 276         return 0;
 277 }
 278
 279 static void superblock_free_security(struct super_block *sb)
 280 {
 281         struct superblock_security_struct *sbsec = sb->s_security;
 282         sb->s_security = NULL;
 283         kfree(sbsec);
 284 }
 285
 286 /* The file system's label must be initialized prior to use. */
 287
 288 static const char *labeling_behaviors[7] = {
 289         "uses xattr",
 290         "uses transition SIDs",
 291         "uses task SIDs",
 292         "uses genfs_contexts",
 293         "not configured for labeling",
 294         "uses mountpoint labeling",
 295         "uses native labeling",
 296 };
 297
 298 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 299
 300 static inline int inode_doinit(struct inode *inode)
 301 {
 302         return inode_doinit_with_dentry(inode, NULL);
 303 }
 304
 305 enum {
 306         Opt_error = -1,
 307         Opt_context = 1,
 308         Opt_fscontext = 2,
 309         Opt_defcontext = 3,
 310         Opt_rootcontext = 4,
 311         Opt_labelsupport = 5,
 312 };
 313
 314 static const match_table_t tokens = {
 315         {Opt_context, CONTEXT_STR "%s"},
 316         {Opt_fscontext, FSCONTEXT_STR "%s"},
 317         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 318         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 319         {Opt_labelsupport, LABELSUPP_STR},
 320         {Opt_error, NULL},
 321 };
 322
 323 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 324
 325 static int may_context_mount_sb_relabel(u32 sid,
 326                         struct superblock_security_struct *sbsec,
 327                         const struct cred *cred)
 328 {
 329         const struct task_security_struct *tsec = cred->security;
 330         int rc;
 331
 332         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 333                           FILESYSTEM__RELABELFROM, NULL);
 334         if (rc)
 335                 return rc;
 336
 337         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 338                           FILESYSTEM__RELABELTO, NULL);
 339         return rc;
 340 }
 341
 342 static int may_context_mount_inode_relabel(u32 sid,
 343                         struct superblock_security_struct *sbsec,
 344                         const struct cred *cred)
 345 {
 346         const struct task_security_struct *tsec = cred->security;
 347         int rc;
 348         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 349                           FILESYSTEM__RELABELFROM, NULL);
 350         if (rc)
 351                 return rc;
 352
 353         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 354                           FILESYSTEM__ASSOCIATE, NULL);
 355         return rc;
 356 }
 357
 358 static int sb_finish_set_opts(struct super_block *sb)
 359 {
 360         struct superblock_security_struct *sbsec = sb->s_security;
 361         struct dentry *root = sb->s_root;
 362         struct inode *root_inode = root->d_inode;
 363         int rc = 0;
 364
 365         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 366                 /* Make sure that the xattr handler exists and that no
 367                    error other than -ENODATA is returned by getxattr on
 368                    the root directory.  -ENODATA is ok, as this may be
 369                    the first boot of the SELinux kernel before we have
 370                    assigned xattr values to the filesystem. */
 371                 if (!root_inode->i_op->getxattr) {
 372                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 373                                "xattr support\n", sb->s_id, sb->s_type->name);
 374                         rc = -EOPNOTSUPP;
 375                         goto out;
 376                 }
 377                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 378                 if (rc < 0 && rc != -ENODATA) {
 379                         if (rc == -EOPNOTSUPP)
 380                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 381                                        "%s) has no security xattr handler\n",
 382                                        sb->s_id, sb->s_type->name);
 383                         else
 384                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 385                                        "%s) getxattr errno %d\n", sb->s_id,
 386                                        sb->s_type->name, -rc);
 387                         goto out;
 388                 }
 389         }
 390
 391         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 392
 393         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 394                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 395                        sb->s_id, sb->s_type->name);
 396         else
 397                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 398                        sb->s_id, sb->s_type->name,
 399                        labeling_behaviors[sbsec->behavior-1]);
 400
 401         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 402             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 403             sbsec->behavior == SECURITY_FS_USE_NONE ||
 404             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 405                 sbsec->flags &= ~SE_SBLABELSUPP;
 406
 407         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 408         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 409                 sbsec->flags |= SE_SBLABELSUPP;
 410
 411         /* Initialize the root inode. */
 412         rc = inode_doinit_with_dentry(root_inode, root);
 413
 414         /* Initialize any other inodes associated with the superblock, e.g.
 415            inodes created prior to initial policy load or inodes created
 416            during get_sb by a pseudo filesystem that directly
 417            populates itself. */
 418         spin_lock(&sbsec->isec_lock);
 419 next_inode:
 420         if (!list_empty(&sbsec->isec_head)) {
 421                 struct inode_security_struct *isec =
 422                                 list_entry(sbsec->isec_head.next,
 423                                            struct inode_security_struct, list);
 424                 struct inode *inode = isec->inode;
 425                 spin_unlock(&sbsec->isec_lock);
 426                 inode = igrab(inode);
 427                 if (inode) {
 428                         if (!IS_PRIVATE(inode))
 429                                 inode_doinit(inode);
 430                         iput(inode);
 431                 }
 432                 spin_lock(&sbsec->isec_lock);
 433                 list_del_init(&isec->list);
 434                 goto next_inode;
 435         }
 436         spin_unlock(&sbsec->isec_lock);
 437 out:
 438         return rc;
 439 }
 440
 441 /*
 442  * This function should allow an FS to ask what it's mount security
 443  * options were so it can use those later for submounts, displaying
 444  * mount options, or whatever.
 445  */
 446 static int selinux_get_mnt_opts(const struct super_block *sb,
 447                                 struct security_mnt_opts *opts)
 448 {
 449         int rc = 0, i;
 450         struct superblock_security_struct *sbsec = sb->s_security;
 451         char *context = NULL;
 452         u32 len;
 453         char tmp;
 454
 455         security_init_mnt_opts(opts);
 456
 457         if (!(sbsec->flags & SE_SBINITIALIZED))
 458                 return -EINVAL;
 459
 460         if (!ss_initialized)
 461                 return -EINVAL;
 462
 463         tmp = sbsec->flags & SE_MNTMASK;
 464         /* count the number of mount options for this sb */
 465         for (i = 0; i < 8; i++) {
 466                 if (tmp & 0x01)
 467                         opts->num_mnt_opts++;
 468                 tmp >>= 1;
 469         }
 470         /* Check if the Label support flag is set */
 471         if (sbsec->flags & SE_SBLABELSUPP)
 472                 opts->num_mnt_opts++;
 473
 474         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 475         if (!opts->mnt_opts) {
 476                 rc = -ENOMEM;
 477                 goto out_free;
 478         }
 479
 480         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 481         if (!opts->mnt_opts_flags) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         i = 0;
 487         if (sbsec->flags & FSCONTEXT_MNT) {
 488                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 489                 if (rc)
 490                         goto out_free;
 491                 opts->mnt_opts[i] = context;
 492                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 493         }
 494         if (sbsec->flags & CONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 500         }
 501         if (sbsec->flags & DEFCONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 507         }
 508         if (sbsec->flags & ROOTCONTEXT_MNT) {
 509                 struct inode *root = sbsec->sb->s_root->d_inode;
 510                 struct inode_security_struct *isec = root->i_security;
 511
 512                 rc = security_sid_to_context(isec->sid, &context, &len);
 513                 if (rc)
 514                         goto out_free;
 515                 opts->mnt_opts[i] = context;
 516                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 517         }
 518         if (sbsec->flags & SE_SBLABELSUPP) {
 519                 opts->mnt_opts[i] = NULL;
 520                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 521         }
 522
 523         BUG_ON(i != opts->num_mnt_opts);
 524
 525         return 0;
 526
 527 out_free:
 528         security_free_mnt_opts(opts);
 529         return rc;
 530 }
 531
 532 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 533                       u32 old_sid, u32 new_sid)
 534 {
 535         char mnt_flags = sbsec->flags & SE_MNTMASK;
 536
 537         /* check if the old mount command had the same options */
 538         if (sbsec->flags & SE_SBINITIALIZED)
 539                 if (!(sbsec->flags & flag) ||
 540                     (old_sid != new_sid))
 541                         return 1;
 542
 543         /* check if we were passed the same options twice,
 544          * aka someone passed context=a,context=b
 545          */
 546         if (!(sbsec->flags & SE_SBINITIALIZED))
 547                 if (mnt_flags & flag)
 548                         return 1;
 549         return 0;
 550 }
 551
 552 /*
 553  * Allow filesystems with binary mount data to explicitly set mount point
 554  * labeling information.
 555  */
 556 static int selinux_set_mnt_opts(struct super_block *sb,
 557                                 struct security_mnt_opts *opts,
 558                                 unsigned long kern_flags,
 559                                 unsigned long *set_kern_flags)
 560 {
 561         const struct cred *cred = current_cred();
 562         int rc = 0, i;
 563         struct superblock_security_struct *sbsec = sb->s_security;
 564         const char *name = sb->s_type->name;
 565         struct inode *inode = sbsec->sb->s_root->d_inode;
 566         struct inode_security_struct *root_isec = inode->i_security;
 567         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 568         u32 defcontext_sid = 0;
 569         char **mount_options = opts->mnt_opts;
 570         int *flags = opts->mnt_opts_flags;
 571         int num_opts = opts->num_mnt_opts;
 572
 573         mutex_lock(&sbsec->lock);
 574
 575         if (!ss_initialized) {
 576                 if (!num_opts) {
 577                         /* Defer initialization until selinux_complete_init,
 578                            after the initial policy is loaded and the security
 579                            server is ready to handle calls. */
 580                         goto out;
 581                 }
 582                 rc = -EINVAL;
 583                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 584                         "before the security server is initialized\n");
 585                 goto out;
 586         }
 587         if (kern_flags && !set_kern_flags) {
 588                 /* Specifying internal flags without providing a place to
 589                  * place the results is not allowed */
 590                 rc = -EINVAL;
 591                 goto out;
 592         }
 593
 594         /*
 595          * Binary mount data FS will come through this function twice.  Once
 596          * from an explicit call and once from the generic calls from the vfs.
 597          * Since the generic VFS calls will not contain any security mount data
 598          * we need to skip the double mount verification.
 599          *
 600          * This does open a hole in which we will not notice if the first
 601          * mount using this sb set explict options and a second mount using
 602          * this sb does not set any security options.  (The first options
 603          * will be used for both mounts)
 604          */
 605         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 606             && (num_opts == 0))
 607                 goto out;
 608
 609         /*
 610          * parse the mount options, check if they are valid sids.
 611          * also check if someone is trying to mount the same sb more
 612          * than once with different security options.
 613          */
 614         for (i = 0; i < num_opts; i++) {
 615                 u32 sid;
 616
 617                 if (flags[i] == SE_SBLABELSUPP)
 618                         continue;
 619                 rc = security_context_to_sid(mount_options[i],
 620                                              strlen(mount_options[i]), &sid);
 621                 if (rc) {
 622                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 623                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 624                                mount_options[i], sb->s_id, name, rc);
 625                         goto out;
 626                 }
 627                 switch (flags[i]) {
 628                 case FSCONTEXT_MNT:
 629                         fscontext_sid = sid;
 630
 631                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 632                                         fscontext_sid))
 633                                 goto out_double_mount;
 634
 635                         sbsec->flags |= FSCONTEXT_MNT;
 636                         break;
 637                 case CONTEXT_MNT:
 638                         context_sid = sid;
 639
 640                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 641                                         context_sid))
 642                                 goto out_double_mount;
 643
 644                         sbsec->flags |= CONTEXT_MNT;
 645                         break;
 646                 case ROOTCONTEXT_MNT:
 647                         rootcontext_sid = sid;
 648
 649                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 650                                         rootcontext_sid))
 651                                 goto out_double_mount;
 652
 653                         sbsec->flags |= ROOTCONTEXT_MNT;
 654
 655                         break;
 656                 case DEFCONTEXT_MNT:
 657                         defcontext_sid = sid;
 658
 659                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 660                                         defcontext_sid))
 661                                 goto out_double_mount;
 662
 663                         sbsec->flags |= DEFCONTEXT_MNT;
 664
 665                         break;
 666                 default:
 667                         rc = -EINVAL;
 668                         goto out;
 669                 }
 670         }
 671
 672         if (sbsec->flags & SE_SBINITIALIZED) {
 673                 /* previously mounted with options, but not on this attempt? */
 674                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 675                         goto out_double_mount;
 676                 rc = 0;
 677                 goto out;
 678         }
 679
 680         if (strcmp(sb->s_type->name, "proc") == 0)
 681                 sbsec->flags |= SE_SBPROC;
 682
 683         if (!sbsec->behavior) {
 684                 /*
 685                  * Determine the labeling behavior to use for this
 686                  * filesystem type.
 687                  */
 688                 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
 689                                         "proc" : sb->s_type->name,
 690                                         &sbsec->behavior, &sbsec->sid);
 691                 if (rc) {
 692                         printk(KERN_WARNING
 693                                 "%s: security_fs_use(%s) returned %d\n",
 694                                         __func__, sb->s_type->name, rc);
 695                         goto out;
 696                 }
 697         }
 698         /* sets the context of the superblock for the fs being mounted. */
 699         if (fscontext_sid) {
 700                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 701                 if (rc)
 702                         goto out;
 703
 704                 sbsec->sid = fscontext_sid;
 705         }
 706
 707         /*
 708          * Switch to using mount point labeling behavior.
 709          * sets the label used on all file below the mountpoint, and will set
 710          * the superblock context if not already set.
 711          */
 712         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 713                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 714                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 715         }
 716
 717         if (context_sid) {
 718                 if (!fscontext_sid) {
 719                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 720                                                           cred);
 721                         if (rc)
 722                                 goto out;
 723                         sbsec->sid = context_sid;
 724                 } else {
 725                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 726                                                              cred);
 727                         if (rc)
 728                                 goto out;
 729                 }
 730                 if (!rootcontext_sid)
 731                         rootcontext_sid = context_sid;
 732
 733                 sbsec->mntpoint_sid = context_sid;
 734                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 735         }
 736
 737         if (rootcontext_sid) {
 738                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 739                                                      cred);
 740                 if (rc)
 741                         goto out;
 742
 743                 root_isec->sid = rootcontext_sid;
 744                 root_isec->initialized = 1;
 745         }
 746
 747         if (defcontext_sid) {
 748                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 749                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 750                         rc = -EINVAL;
 751                         printk(KERN_WARNING "SELinux: defcontext option is "
 752                                "invalid for this filesystem type\n");
 753                         goto out;
 754                 }
 755
 756                 if (defcontext_sid != sbsec->def_sid) {
 757                         rc = may_context_mount_inode_relabel(defcontext_sid,
 758                                                              sbsec, cred);
 759                         if (rc)
 760                                 goto out;
 761                 }
 762
 763                 sbsec->def_sid = defcontext_sid;
 764         }
 765
 766         rc = sb_finish_set_opts(sb);
 767 out:
 768         mutex_unlock(&sbsec->lock);
 769         return rc;
 770 out_double_mount:
 771         rc = -EINVAL;
 772         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 773                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 774         goto out;
 775 }
 776
 777 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 778                                     const struct super_block *newsb)
 779 {
 780         struct superblock_security_struct *old = oldsb->s_security;
 781         struct superblock_security_struct *new = newsb->s_security;
 782         char oldflags = old->flags & SE_MNTMASK;
 783         char newflags = new->flags & SE_MNTMASK;
 784
 785         if (oldflags != newflags)
 786                 goto mismatch;
 787         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 788                 goto mismatch;
 789         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 790                 goto mismatch;
 791         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 792                 goto mismatch;
 793         if (oldflags & ROOTCONTEXT_MNT) {
 794                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 795                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 796                 if (oldroot->sid != newroot->sid)
 797                         goto mismatch;
 798         }
 799         return 0;
 800 mismatch:
 801         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 802                             "different security settings for (dev %s, "
 803                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 804         return -EBUSY;
 805 }
 806
 807 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 808                                         struct super_block *newsb)
 809 {
 810         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 811         struct superblock_security_struct *newsbsec = newsb->s_security;
 812
 813         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 814         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 815         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 816
 817         /*
 818          * if the parent was able to be mounted it clearly had no special lsm
 819          * mount options.  thus we can safely deal with this superblock later
 820          */
 821         if (!ss_initialized)
 822                 return 0;
 823
 824         /* how can we clone if the old one wasn't set up?? */
 825         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 826
 827         /* if fs is reusing a sb, make sure that the contexts match */
 828         if (newsbsec->flags & SE_SBINITIALIZED)
 829                 return selinux_cmp_sb_context(oldsb, newsb);
 830
 831         mutex_lock(&newsbsec->lock);
 832
 833         newsbsec->flags = oldsbsec->flags;
 834
 835         newsbsec->sid = oldsbsec->sid;
 836         newsbsec->def_sid = oldsbsec->def_sid;
 837         newsbsec->behavior = oldsbsec->behavior;
 838
 839         if (set_context) {
 840                 u32 sid = oldsbsec->mntpoint_sid;
 841
 842                 if (!set_fscontext)
 843                         newsbsec->sid = sid;
 844                 if (!set_rootcontext) {
 845                         struct inode *newinode = newsb->s_root->d_inode;
 846                         struct inode_security_struct *newisec = newinode->i_security;
 847                         newisec->sid = sid;
 848                 }
 849                 newsbsec->mntpoint_sid = sid;
 850         }
 851         if (set_rootcontext) {
 852                 const struct inode *oldinode = oldsb->s_root->d_inode;
 853                 const struct inode_security_struct *oldisec = oldinode->i_security;
 854                 struct inode *newinode = newsb->s_root->d_inode;
 855                 struct inode_security_struct *newisec = newinode->i_security;
 856
 857                 newisec->sid = oldisec->sid;
 858         }
 859
 860         sb_finish_set_opts(newsb);
 861         mutex_unlock(&newsbsec->lock);
 862         return 0;
 863 }
 864
 865 static int selinux_parse_opts_str(char *options,
 866                                   struct security_mnt_opts *opts)
 867 {
 868         char *p;
 869         char *context = NULL, *defcontext = NULL;
 870         char *fscontext = NULL, *rootcontext = NULL;
 871         int rc, num_mnt_opts = 0;
 872
 873         opts->num_mnt_opts = 0;
 874
 875         /* Standard string-based options. */
 876         while ((p = strsep(&options, "|")) != NULL) {
 877                 int token;
 878                 substring_t args[MAX_OPT_ARGS];
 879
 880                 if (!*p)
 881                         continue;
 882
 883                 token = match_token(p, tokens, args);
 884
 885                 switch (token) {
 886                 case Opt_context:
 887                         if (context || defcontext) {
 888                                 rc = -EINVAL;
 889                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 890                                 goto out_err;
 891                         }
 892                         context = match_strdup(&args[0]);
 893                         if (!context) {
 894                                 rc = -ENOMEM;
 895                                 goto out_err;
 896                         }
 897                         break;
 898
 899                 case Opt_fscontext:
 900                         if (fscontext) {
 901                                 rc = -EINVAL;
 902                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 903                                 goto out_err;
 904                         }
 905                         fscontext = match_strdup(&args[0]);
 906                         if (!fscontext) {
 907                                 rc = -ENOMEM;
 908                                 goto out_err;
 909                         }
 910                         break;
 911
 912                 case Opt_rootcontext:
 913                         if (rootcontext) {
 914                                 rc = -EINVAL;
 915                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 916                                 goto out_err;
 917                         }
 918                         rootcontext = match_strdup(&args[0]);
 919                         if (!rootcontext) {
 920                                 rc = -ENOMEM;
 921                                 goto out_err;
 922                         }
 923                         break;
 924
 925                 case Opt_defcontext:
 926                         if (context || defcontext) {
 927                                 rc = -EINVAL;
 928                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 929                                 goto out_err;
 930                         }
 931                         defcontext = match_strdup(&args[0]);
 932                         if (!defcontext) {
 933                                 rc = -ENOMEM;
 934                                 goto out_err;
 935                         }
 936                         break;
 937                 case Opt_labelsupport:
 938                         break;
 939                 default:
 940                         rc = -EINVAL;
 941                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 942                         goto out_err;
 943
 944                 }
 945         }
 946
 947         rc = -ENOMEM;
 948         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 949         if (!opts->mnt_opts)
 950                 goto out_err;
 951
 952         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 953         if (!opts->mnt_opts_flags) {
 954                 kfree(opts->mnt_opts);
 955                 goto out_err;
 956         }
 957
 958         if (fscontext) {
 959                 opts->mnt_opts[num_mnt_opts] = fscontext;
 960                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 961         }
 962         if (context) {
 963                 opts->mnt_opts[num_mnt_opts] = context;
 964                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 965         }
 966         if (rootcontext) {
 967                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 968                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 969         }
 970         if (defcontext) {
 971                 opts->mnt_opts[num_mnt_opts] = defcontext;
 972                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 973         }
 974
 975         opts->num_mnt_opts = num_mnt_opts;
 976         return 0;
 977
 978 out_err:
 979         kfree(context);
 980         kfree(defcontext);
 981         kfree(fscontext);
 982         kfree(rootcontext);
 983         return rc;
 984 }
 985 /*
 986  * string mount options parsing and call set the sbsec
 987  */
 988 static int superblock_doinit(struct super_block *sb, void *data)
 989 {
 990         int rc = 0;
 991         char *options = data;
 992         struct security_mnt_opts opts;
 993
 994         security_init_mnt_opts(&opts);
 995
 996         if (!data)
 997                 goto out;
 998
 999         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001         rc = selinux_parse_opts_str(options, &opts);
1002         if (rc)
1003                 goto out_err;
1004
1005 out:
1006         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1007
1008 out_err:
1009         security_free_mnt_opts(&opts);
1010         return rc;
1011 }
1012
1013 static void selinux_write_opts(struct seq_file *m,
1014                                struct security_mnt_opts *opts)
1015 {
1016         int i;
1017         char *prefix;
1018
1019         for (i = 0; i < opts->num_mnt_opts; i++) {
1020                 char *has_comma;
1021
1022                 if (opts->mnt_opts[i])
1023                         has_comma = strchr(opts->mnt_opts[i], ',');
1024                 else
1025                         has_comma = NULL;
1026
1027                 switch (opts->mnt_opts_flags[i]) {
1028                 case CONTEXT_MNT:
1029                         prefix = CONTEXT_STR;
1030                         break;
1031                 case FSCONTEXT_MNT:
1032                         prefix = FSCONTEXT_STR;
1033                         break;
1034                 case ROOTCONTEXT_MNT:
1035                         prefix = ROOTCONTEXT_STR;
1036                         break;
1037                 case DEFCONTEXT_MNT:
1038                         prefix = DEFCONTEXT_STR;
1039                         break;
1040                 case SE_SBLABELSUPP:
1041                         seq_putc(m, ',');
1042                         seq_puts(m, LABELSUPP_STR);
1043                         continue;
1044                 default:
1045                         BUG();
1046                         return;
1047                 };
1048                 /* we need a comma before each option */
1049                 seq_putc(m, ',');
1050                 seq_puts(m, prefix);
1051                 if (has_comma)
1052                         seq_putc(m, '\"');
1053                 seq_puts(m, opts->mnt_opts[i]);
1054                 if (has_comma)
1055                         seq_putc(m, '\"');
1056         }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061         struct security_mnt_opts opts;
1062         int rc;
1063
1064         rc = selinux_get_mnt_opts(sb, &opts);
1065         if (rc) {
1066                 /* before policy load we may get EINVAL, don't show anything */
1067                 if (rc == -EINVAL)
1068                         rc = 0;
1069                 return rc;
1070         }
1071
1072         selinux_write_opts(m, &opts);
1073
1074         security_free_mnt_opts(&opts);
1075
1076         return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081         switch (mode & S_IFMT) {
1082         case S_IFSOCK:
1083                 return SECCLASS_SOCK_FILE;
1084         case S_IFLNK:
1085                 return SECCLASS_LNK_FILE;
1086         case S_IFREG:
1087                 return SECCLASS_FILE;
1088         case S_IFBLK:
1089                 return SECCLASS_BLK_FILE;
1090         case S_IFDIR:
1091                 return SECCLASS_DIR;
1092         case S_IFCHR:
1093                 return SECCLASS_CHR_FILE;
1094         case S_IFIFO:
1095                 return SECCLASS_FIFO_FILE;
1096
1097         }
1098
1099         return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114         switch (family) {
1115         case PF_UNIX:
1116                 switch (type) {
1117                 case SOCK_STREAM:
1118                 case SOCK_SEQPACKET:
1119                         return SECCLASS_UNIX_STREAM_SOCKET;
1120                 case SOCK_DGRAM:
1121                         return SECCLASS_UNIX_DGRAM_SOCKET;
1122                 }
1123                 break;
1124         case PF_INET:
1125         case PF_INET6:
1126                 switch (type) {
1127                 case SOCK_STREAM:
1128                         if (default_protocol_stream(protocol))
1129                                 return SECCLASS_TCP_SOCKET;
1130                         else
1131                                 return SECCLASS_RAWIP_SOCKET;
1132                 case SOCK_DGRAM:
1133                         if (default_protocol_dgram(protocol))
1134                                 return SECCLASS_UDP_SOCKET;
1135                         else
1136                                 return SECCLASS_RAWIP_SOCKET;
1137                 case SOCK_DCCP:
1138                         return SECCLASS_DCCP_SOCKET;
1139                 default:
1140                         return SECCLASS_RAWIP_SOCKET;
1141                 }
1142                 break;
1143         case PF_NETLINK:
1144                 switch (protocol) {
1145                 case NETLINK_ROUTE:
1146                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1147                 case NETLINK_FIREWALL:
1148                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149                 case NETLINK_SOCK_DIAG:
1150                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151                 case NETLINK_NFLOG:
1152                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1153                 case NETLINK_XFRM:
1154                         return SECCLASS_NETLINK_XFRM_SOCKET;
1155                 case NETLINK_SELINUX:
1156                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1157                 case NETLINK_AUDIT:
1158                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1159                 case NETLINK_IP6_FW:
1160                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1161                 case NETLINK_DNRTMSG:
1162                         return SECCLASS_NETLINK_DNRT_SOCKET;
1163                 case NETLINK_KOBJECT_UEVENT:
1164                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165                 default:
1166                         return SECCLASS_NETLINK_SOCKET;
1167                 }
1168         case PF_PACKET:
1169                 return SECCLASS_PACKET_SOCKET;
1170         case PF_KEY:
1171                 return SECCLASS_KEY_SOCKET;
1172         case PF_APPLETALK:
1173                 return SECCLASS_APPLETALK_SOCKET;
1174         }
1175
1176         return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct dentry *dentry,
1181                                 u16 tclass,
1182                                 u32 *sid)
1183 {
1184         int rc;
1185         char *buffer, *path;
1186
1187         buffer = (char *)__get_free_page(GFP_KERNEL);
1188         if (!buffer)
1189                 return -ENOMEM;
1190
1191         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192         if (IS_ERR(path))
1193                 rc = PTR_ERR(path);
1194         else {
1195                 /* each process gets a /proc/PID/ entry. Strip off the
1196                  * PID part to get a valid selinux labeling.
1197                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198                 while (path[1] >= '0' && path[1] <= '9') {
1199                         path[1] = '/';
1200                         path++;
1201                 }
1202                 rc = security_genfs_sid("proc", path, tclass, sid);
1203         }
1204         free_page((unsigned long)buffer);
1205         return rc;
1206 }
1207 #else
1208 static int selinux_proc_get_sid(struct dentry *dentry,
1209                                 u16 tclass,
1210                                 u32 *sid)
1211 {
1212         return -EINVAL;
1213 }
1214 #endif
1215
1216 /* The inode's security attributes must be initialized before first use. */
1217 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218 {
1219         struct superblock_security_struct *sbsec = NULL;
1220         struct inode_security_struct *isec = inode->i_security;
1221         u32 sid;
1222         struct dentry *dentry;
1223 #define INITCONTEXTLEN 255
1224         char *context = NULL;
1225         unsigned len = 0;
1226         int rc = 0;
1227
1228         if (isec->initialized)
1229                 goto out;
1230
1231         mutex_lock(&isec->lock);
1232         if (isec->initialized)
1233                 goto out_unlock;
1234
1235         sbsec = inode->i_sb->s_security;
1236         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1237                 /* Defer initialization until selinux_complete_init,
1238                    after the initial policy is loaded and the security
1239                    server is ready to handle calls. */
1240                 spin_lock(&sbsec->isec_lock);
1241                 if (list_empty(&isec->list))
1242                         list_add(&isec->list, &sbsec->isec_head);
1243                 spin_unlock(&sbsec->isec_lock);
1244                 goto out_unlock;
1245         }
1246
1247         switch (sbsec->behavior) {
1248         case SECURITY_FS_USE_NATIVE:
1249                 break;
1250         case SECURITY_FS_USE_XATTR:
1251                 if (!inode->i_op->getxattr) {
1252                         isec->sid = sbsec->def_sid;
1253                         break;
1254                 }
1255
1256                 /* Need a dentry, since the xattr API requires one.
1257                    Life would be simpler if we could just pass the inode. */
1258                 if (opt_dentry) {
1259                         /* Called from d_instantiate or d_splice_alias. */
1260                         dentry = dget(opt_dentry);
1261                 } else {
1262                         /* Called from selinux_complete_init, try to find a dentry. */
1263                         dentry = d_find_alias(inode);
1264                 }
1265                 if (!dentry) {
1266                         /*
1267                          * this is can be hit on boot when a file is accessed
1268                          * before the policy is loaded.  When we load policy we
1269                          * may find inodes that have no dentry on the
1270                          * sbsec->isec_head list.  No reason to complain as these
1271                          * will get fixed up the next time we go through
1272                          * inode_doinit with a dentry, before these inodes could
1273                          * be used again by userspace.
1274                          */
1275                         goto out_unlock;
1276                 }
1277
1278                 len = INITCONTEXTLEN;
1279                 context = kmalloc(len+1, GFP_NOFS);
1280                 if (!context) {
1281                         rc = -ENOMEM;
1282                         dput(dentry);
1283                         goto out_unlock;
1284                 }
1285                 context[len] = '\0';
1286                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287                                            context, len);
1288                 if (rc == -ERANGE) {
1289                         kfree(context);
1290
1291                         /* Need a larger buffer.  Query for the right size. */
1292                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293                                                    NULL, 0);
1294                         if (rc < 0) {
1295                                 dput(dentry);
1296                                 goto out_unlock;
1297                         }
1298                         len = rc;
1299                         context = kmalloc(len+1, GFP_NOFS);
1300                         if (!context) {
1301                                 rc = -ENOMEM;
1302                                 dput(dentry);
1303                                 goto out_unlock;
1304                         }
1305                         context[len] = '\0';
1306                         rc = inode->i_op->getxattr(dentry,
1307                                                    XATTR_NAME_SELINUX,
1308                                                    context, len);
1309                 }
1310                 dput(dentry);
1311                 if (rc < 0) {
1312                         if (rc != -ENODATA) {
1313                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1314                                        "%d for dev=%s ino=%ld\n", __func__,
1315                                        -rc, inode->i_sb->s_id, inode->i_ino);
1316                                 kfree(context);
1317                                 goto out_unlock;
1318                         }
1319                         /* Map ENODATA to the default file SID */
1320                         sid = sbsec->def_sid;
1321                         rc = 0;
1322                 } else {
1323                         rc = security_context_to_sid_default(context, rc, &sid,
1324                                                              sbsec->def_sid,
1325                                                              GFP_NOFS);
1326                         if (rc) {
1327                                 char *dev = inode->i_sb->s_id;
1328                                 unsigned long ino = inode->i_ino;
1329
1330                                 if (rc == -EINVAL) {
1331                                         if (printk_ratelimit())
1332                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1334                                                         "filesystem in question.\n", ino, dev, context);
1335                                 } else {
1336                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1337                                                "returned %d for dev=%s ino=%ld\n",
1338                                                __func__, context, -rc, dev, ino);
1339                                 }
1340                                 kfree(context);
1341                                 /* Leave with the unlabeled SID */
1342                                 rc = 0;
1343                                 break;
1344                         }
1345                 }
1346                 kfree(context);
1347                 isec->sid = sid;
1348                 break;
1349         case SECURITY_FS_USE_TASK:
1350                 isec->sid = isec->task_sid;
1351                 break;
1352         case SECURITY_FS_USE_TRANS:
1353                 /* Default to the fs SID. */
1354                 isec->sid = sbsec->sid;
1355
1356                 /* Try to obtain a transition SID. */
1357                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359                                              isec->sclass, NULL, &sid);
1360                 if (rc)
1361                         goto out_unlock;
1362                 isec->sid = sid;
1363                 break;
1364         case SECURITY_FS_USE_MNTPOINT:
1365                 isec->sid = sbsec->mntpoint_sid;
1366                 break;
1367         default:
1368                 /* Default to the fs superblock SID. */
1369                 isec->sid = sbsec->sid;
1370
1371                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1372                         if (opt_dentry) {
1373                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1374                                 rc = selinux_proc_get_sid(opt_dentry,
1375                                                           isec->sclass,
1376                                                           &sid);
1377                                 if (rc)
1378                                         goto out_unlock;
1379                                 isec->sid = sid;
1380                         }
1381                 }
1382                 break;
1383         }
1384
1385         isec->initialized = 1;
1386
1387 out_unlock:
1388         mutex_unlock(&isec->lock);
1389 out:
1390         if (isec->sclass == SECCLASS_FILE)
1391                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1392         return rc;
1393 }
1394
1395 /* Convert a Linux signal to an access vector. */
1396 static inline u32 signal_to_av(int sig)
1397 {
1398         u32 perm = 0;
1399
1400         switch (sig) {
1401         case SIGCHLD:
1402                 /* Commonly granted from child to parent. */
1403                 perm = PROCESS__SIGCHLD;
1404                 break;
1405         case SIGKILL:
1406                 /* Cannot be caught or ignored */
1407                 perm = PROCESS__SIGKILL;
1408                 break;
1409         case SIGSTOP:
1410                 /* Cannot be caught or ignored */
1411                 perm = PROCESS__SIGSTOP;
1412                 break;
1413         default:
1414                 /* All other signals. */
1415                 perm = PROCESS__SIGNAL;
1416                 break;
1417         }
1418
1419         return perm;
1420 }
1421
1422 /*
1423  * Check permission between a pair of credentials
1424  * fork check, ptrace check, etc.
1425  */
1426 static int cred_has_perm(const struct cred *actor,
1427                          const struct cred *target,
1428                          u32 perms)
1429 {
1430         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433 }
1434
1435 /*
1436  * Check permission between a pair of tasks, e.g. signal checks,
1437  * fork check, ptrace check, etc.
1438  * tsk1 is the actor and tsk2 is the target
1439  * - this uses the default subjective creds of tsk1
1440  */
1441 static int task_has_perm(const struct task_struct *tsk1,
1442                          const struct task_struct *tsk2,
1443                          u32 perms)
1444 {
1445         const struct task_security_struct *__tsec1, *__tsec2;
1446         u32 sid1, sid2;
1447
1448         rcu_read_lock();
1449         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1450         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1451         rcu_read_unlock();
1452         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 /*
1456  * Check permission between current and another task, e.g. signal checks,
1457  * fork check, ptrace check, etc.
1458  * current is the actor and tsk2 is the target
1459  * - this uses current's subjective creds
1460  */
1461 static int current_has_perm(const struct task_struct *tsk,
1462                             u32 perms)
1463 {
1464         u32 sid, tsid;
1465
1466         sid = current_sid();
1467         tsid = task_sid(tsk);
1468         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469 }
1470
1471 #if CAP_LAST_CAP > 63
1472 #error Fix SELinux to handle capabilities > 63.
1473 #endif
1474
1475 /* Check whether a task is allowed to use a capability. */
1476 static int cred_has_capability(const struct cred *cred,
1477                                int cap, int audit)
1478 {
1479         struct common_audit_data ad;
1480         struct av_decision avd;
1481         u16 sclass;
1482         u32 sid = cred_sid(cred);
1483         u32 av = CAP_TO_MASK(cap);
1484         int rc;
1485
1486         ad.type = LSM_AUDIT_DATA_CAP;
1487         ad.u.cap = cap;
1488
1489         switch (CAP_TO_INDEX(cap)) {
1490         case 0:
1491                 sclass = SECCLASS_CAPABILITY;
1492                 break;
1493         case 1:
1494                 sclass = SECCLASS_CAPABILITY2;
1495                 break;
1496         default:
1497                 printk(KERN_ERR
1498                        "SELinux:  out of range capability %d\n", cap);
1499                 BUG();
1500                 return -EINVAL;
1501         }
1502
1503         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1504         if (audit == SECURITY_CAP_AUDIT) {
1505                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1506                 if (rc2)
1507                         return rc2;
1508         }
1509         return rc;
1510 }
1511
1512 /* Check whether a task is allowed to use a system operation. */
1513 static int task_has_system(struct task_struct *tsk,
1514                            u32 perms)
1515 {
1516         u32 sid = task_sid(tsk);
1517
1518         return avc_has_perm(sid, SECINITSID_KERNEL,
1519                             SECCLASS_SYSTEM, perms, NULL);
1520 }
1521
1522 /* Check whether a task has a particular permission to an inode.
1523    The 'adp' parameter is optional and allows other audit
1524    data to be passed (e.g. the dentry). */
1525 static int inode_has_perm(const struct cred *cred,
1526                           struct inode *inode,
1527                           u32 perms,
1528                           struct common_audit_data *adp)
1529 {
1530         struct inode_security_struct *isec;
1531         u32 sid;
1532
1533         validate_creds(cred);
1534
1535         if (unlikely(IS_PRIVATE(inode)))
1536                 return 0;
1537
1538         sid = cred_sid(cred);
1539         isec = inode->i_security;
1540
1541         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1542 }
1543
1544 /* Same as inode_has_perm, but pass explicit audit data containing
1545    the dentry to help the auditing code to more easily generate the
1546    pathname if needed. */
1547 static inline int dentry_has_perm(const struct cred *cred,
1548                                   struct dentry *dentry,
1549                                   u32 av)
1550 {
1551         struct inode *inode = dentry->d_inode;
1552         struct common_audit_data ad;
1553
1554         ad.type = LSM_AUDIT_DATA_DENTRY;
1555         ad.u.dentry = dentry;
1556         return inode_has_perm(cred, inode, av, &ad);
1557 }
1558
1559 /* Same as inode_has_perm, but pass explicit audit data containing
1560    the path to help the auditing code to more easily generate the
1561    pathname if needed. */
1562 static inline int path_has_perm(const struct cred *cred,
1563                                 struct path *path,
1564                                 u32 av)
1565 {
1566         struct inode *inode = path->dentry->d_inode;
1567         struct common_audit_data ad;
1568
1569         ad.type = LSM_AUDIT_DATA_PATH;
1570         ad.u.path = *path;
1571         return inode_has_perm(cred, inode, av, &ad);
1572 }
1573
1574 /* Same as path_has_perm, but uses the inode from the file struct. */
1575 static inline int file_path_has_perm(const struct cred *cred,
1576                                      struct file *file,
1577                                      u32 av)
1578 {
1579         struct common_audit_data ad;
1580
1581         ad.type = LSM_AUDIT_DATA_PATH;
1582         ad.u.path = file->f_path;
1583         return inode_has_perm(cred, file_inode(file), av, &ad);
1584 }
1585
1586 /* Check whether a task can use an open file descriptor to
1587    access an inode in a given way.  Check access to the
1588    descriptor itself, and then use dentry_has_perm to
1589    check a particular permission to the file.
1590    Access to the descriptor is implicitly granted if it
1591    has the same SID as the process.  If av is zero, then
1592    access to the file is not checked, e.g. for cases
1593    where only the descriptor is affected like seek. */
1594 static int file_has_perm(const struct cred *cred,
1595                          struct file *file,
1596                          u32 av)
1597 {
1598         struct file_security_struct *fsec = file->f_security;
1599         struct inode *inode = file_inode(file);
1600         struct common_audit_data ad;
1601         u32 sid = cred_sid(cred);
1602         int rc;
1603
1604         ad.type = LSM_AUDIT_DATA_PATH;
1605         ad.u.path = file->f_path;
1606
1607         if (sid != fsec->sid) {
1608                 rc = avc_has_perm(sid, fsec->sid,
1609                                   SECCLASS_FD,
1610                                   FD__USE,
1611                                   &ad);
1612                 if (rc)
1613                         goto out;
1614         }
1615
1616         /* av is zero if only checking access to the descriptor. */
1617         rc = 0;
1618         if (av)
1619                 rc = inode_has_perm(cred, inode, av, &ad);
1620
1621 out:
1622         return rc;
1623 }
1624
1625 /* Check whether a task can create a file. */
1626 static int may_create(struct inode *dir,
1627                       struct dentry *dentry,
1628                       u16 tclass)
1629 {
1630         const struct task_security_struct *tsec = current_security();
1631         struct inode_security_struct *dsec;
1632         struct superblock_security_struct *sbsec;
1633         u32 sid, newsid;
1634         struct common_audit_data ad;
1635         int rc;
1636
1637         dsec = dir->i_security;
1638         sbsec = dir->i_sb->s_security;
1639
1640         sid = tsec->sid;
1641         newsid = tsec->create_sid;
1642
1643         ad.type = LSM_AUDIT_DATA_DENTRY;
1644         ad.u.dentry = dentry;
1645
1646         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1647                           DIR__ADD_NAME | DIR__SEARCH,
1648                           &ad);
1649         if (rc)
1650                 return rc;
1651
1652         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1653                 rc = security_transition_sid(sid, dsec->sid, tclass,
1654                                              &dentry->d_name, &newsid);
1655                 if (rc)
1656                         return rc;
1657         }
1658
1659         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1660         if (rc)
1661                 return rc;
1662
1663         return avc_has_perm(newsid, sbsec->sid,
1664                             SECCLASS_FILESYSTEM,
1665                             FILESYSTEM__ASSOCIATE, &ad);
1666 }
1667
1668 /* Check whether a task can create a key. */
1669 static int may_create_key(u32 ksid,
1670                           struct task_struct *ctx)
1671 {
1672         u32 sid = task_sid(ctx);
1673
1674         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1675 }
1676
1677 #define MAY_LINK        0
1678 #define MAY_UNLINK      1
1679 #define MAY_RMDIR       2
1680
1681 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1682 static int may_link(struct inode *dir,
1683                     struct dentry *dentry,
1684                     int kind)
1685
1686 {
1687         struct inode_security_struct *dsec, *isec;
1688         struct common_audit_data ad;
1689         u32 sid = current_sid();
1690         u32 av;
1691         int rc;
1692
1693         dsec = dir->i_security;
1694         isec = dentry->d_inode->i_security;
1695
1696         ad.type = LSM_AUDIT_DATA_DENTRY;
1697         ad.u.dentry = dentry;
1698
1699         av = DIR__SEARCH;
1700         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1701         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1702         if (rc)
1703                 return rc;
1704
1705         switch (kind) {
1706         case MAY_LINK:
1707                 av = FILE__LINK;
1708                 break;
1709         case MAY_UNLINK:
1710                 av = FILE__UNLINK;
1711                 break;
1712         case MAY_RMDIR:
1713                 av = DIR__RMDIR;
1714                 break;
1715         default:
1716                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1717                         __func__, kind);
1718                 return 0;
1719         }
1720
1721         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1722         return rc;
1723 }
1724
1725 static inline int may_rename(struct inode *old_dir,
1726                              struct dentry *old_dentry,
1727                              struct inode *new_dir,
1728                              struct dentry *new_dentry)
1729 {
1730         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1731         struct common_audit_data ad;
1732         u32 sid = current_sid();
1733         u32 av;
1734         int old_is_dir, new_is_dir;
1735         int rc;
1736
1737         old_dsec = old_dir->i_security;
1738         old_isec = old_dentry->d_inode->i_security;
1739         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1740         new_dsec = new_dir->i_security;
1741
1742         ad.type = LSM_AUDIT_DATA_DENTRY;
1743
1744         ad.u.dentry = old_dentry;
1745         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1746                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1747         if (rc)
1748                 return rc;
1749         rc = avc_has_perm(sid, old_isec->sid,
1750                           old_isec->sclass, FILE__RENAME, &ad);
1751         if (rc)
1752                 return rc;
1753         if (old_is_dir && new_dir != old_dir) {
1754                 rc = avc_has_perm(sid, old_isec->sid,
1755                                   old_isec->sclass, DIR__REPARENT, &ad);
1756                 if (rc)
1757                         return rc;
1758         }
1759
1760         ad.u.dentry = new_dentry;
1761         av = DIR__ADD_NAME | DIR__SEARCH;
1762         if (new_dentry->d_inode)
1763                 av |= DIR__REMOVE_NAME;
1764         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1765         if (rc)
1766                 return rc;
1767         if (new_dentry->d_inode) {
1768                 new_isec = new_dentry->d_inode->i_security;
1769                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1770                 rc = avc_has_perm(sid, new_isec->sid,
1771                                   new_isec->sclass,
1772                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1773                 if (rc)
1774                         return rc;
1775         }
1776
1777         return 0;
1778 }
1779
1780 /* Check whether a task can perform a filesystem operation. */
1781 static int superblock_has_perm(const struct cred *cred,
1782                                struct super_block *sb,
1783                                u32 perms,
1784                                struct common_audit_data *ad)
1785 {
1786         struct superblock_security_struct *sbsec;
1787         u32 sid = cred_sid(cred);
1788
1789         sbsec = sb->s_security;
1790         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1791 }
1792
1793 /* Convert a Linux mode and permission mask to an access vector. */
1794 static inline u32 file_mask_to_av(int mode, int mask)
1795 {
1796         u32 av = 0;
1797
1798         if (!S_ISDIR(mode)) {
1799                 if (mask & MAY_EXEC)
1800                         av |= FILE__EXECUTE;
1801                 if (mask & MAY_READ)
1802                         av |= FILE__READ;
1803
1804                 if (mask & MAY_APPEND)
1805                         av |= FILE__APPEND;
1806                 else if (mask & MAY_WRITE)
1807                         av |= FILE__WRITE;
1808
1809         } else {
1810                 if (mask & MAY_EXEC)
1811                         av |= DIR__SEARCH;
1812                 if (mask & MAY_WRITE)
1813                         av |= DIR__WRITE;
1814                 if (mask & MAY_READ)
1815                         av |= DIR__READ;
1816         }
1817
1818         return av;
1819 }
1820
1821 /* Convert a Linux file to an access vector. */
1822 static inline u32 file_to_av(struct file *file)
1823 {
1824         u32 av = 0;
1825
1826         if (file->f_mode & FMODE_READ)
1827                 av |= FILE__READ;
1828         if (file->f_mode & FMODE_WRITE) {
1829                 if (file->f_flags & O_APPEND)
1830                         av |= FILE__APPEND;
1831                 else
1832                         av |= FILE__WRITE;
1833         }
1834         if (!av) {
1835                 /*
1836                  * Special file opened with flags 3 for ioctl-only use.
1837                  */
1838                 av = FILE__IOCTL;
1839         }
1840
1841         return av;
1842 }
1843
1844 /*
1845  * Convert a file to an access vector and include the correct open
1846  * open permission.
1847  */
1848 static inline u32 open_file_to_av(struct file *file)
1849 {
1850         u32 av = file_to_av(file);
1851
1852         if (selinux_policycap_openperm)
1853                 av |= FILE__OPEN;
1854
1855         return av;
1856 }
1857
1858 /* Hook functions begin here. */
1859
1860 static int selinux_ptrace_access_check(struct task_struct *child,
1861                                      unsigned int mode)
1862 {
1863         int rc;
1864
1865         rc = cap_ptrace_access_check(child, mode);
1866         if (rc)
1867                 return rc;
1868
1869         if (mode & PTRACE_MODE_READ) {
1870                 u32 sid = current_sid();
1871                 u32 csid = task_sid(child);
1872                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1873         }
1874
1875         return current_has_perm(child, PROCESS__PTRACE);
1876 }
1877
1878 static int selinux_ptrace_traceme(struct task_struct *parent)
1879 {
1880         int rc;
1881
1882         rc = cap_ptrace_traceme(parent);
1883         if (rc)
1884                 return rc;
1885
1886         return task_has_perm(parent, current, PROCESS__PTRACE);
1887 }
1888
1889 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1890                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1891 {
1892         int error;
1893
1894         error = current_has_perm(target, PROCESS__GETCAP);
1895         if (error)
1896                 return error;
1897
1898         return cap_capget(target, effective, inheritable, permitted);
1899 }
1900
1901 static int selinux_capset(struct cred *new, const struct cred *old,
1902                           const kernel_cap_t *effective,
1903                           const kernel_cap_t *inheritable,
1904                           const kernel_cap_t *permitted)
1905 {
1906         int error;
1907
1908         error = cap_capset(new, old,
1909                                       effective, inheritable, permitted);
1910         if (error)
1911                 return error;
1912
1913         return cred_has_perm(old, new, PROCESS__SETCAP);
1914 }
1915
1916 /*
1917  * (This comment used to live with the selinux_task_setuid hook,
1918  * which was removed).
1919  *
1920  * Since setuid only affects the current process, and since the SELinux
1921  * controls are not based on the Linux identity attributes, SELinux does not
1922  * need to control this operation.  However, SELinux does control the use of
1923  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1924  */
1925
1926 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1927                            int cap, int audit)
1928 {
1929         int rc;
1930
1931         rc = cap_capable(cred, ns, cap, audit);
1932         if (rc)
1933                 return rc;
1934
1935         return cred_has_capability(cred, cap, audit);
1936 }
1937
1938 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1939 {
1940         const struct cred *cred = current_cred();
1941         int rc = 0;
1942
1943         if (!sb)
1944                 return 0;
1945
1946         switch (cmds) {
1947         case Q_SYNC:
1948         case Q_QUOTAON:
1949         case Q_QUOTAOFF:
1950         case Q_SETINFO:
1951         case Q_SETQUOTA:
1952                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1953                 break;
1954         case Q_GETFMT:
1955         case Q_GETINFO:
1956         case Q_GETQUOTA:
1957                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1958                 break;
1959         default:
1960                 rc = 0;  /* let the kernel handle invalid cmds */
1961                 break;
1962         }
1963         return rc;
1964 }
1965
1966 static int selinux_quota_on(struct dentry *dentry)
1967 {
1968         const struct cred *cred = current_cred();
1969
1970         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1971 }
1972
1973 static int selinux_syslog(int type)
1974 {
1975         int rc;
1976
1977         switch (type) {
1978         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1979         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1980                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1981                 break;
1982         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1983         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1984         /* Set level of messages printed to console */
1985         case SYSLOG_ACTION_CONSOLE_LEVEL:
1986                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1987                 break;
1988         case SYSLOG_ACTION_CLOSE:       /* Close log */
1989         case SYSLOG_ACTION_OPEN:        /* Open log */
1990         case SYSLOG_ACTION_READ:        /* Read from log */
1991         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1992         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1993         default:
1994                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1995                 break;
1996         }
1997         return rc;
1998 }
1999
2000 /*
2001  * Check that a process has enough memory to allocate a new virtual
2002  * mapping. 0 means there is enough memory for the allocation to
2003  * succeed and -ENOMEM implies there is not.
2004  *
2005  * Do not audit the selinux permission check, as this is applied to all
2006  * processes that allocate mappings.
2007  */
2008 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2009 {
2010         int rc, cap_sys_admin = 0;
2011
2012         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2013                              SECURITY_CAP_NOAUDIT);
2014         if (rc == 0)
2015                 cap_sys_admin = 1;
2016
2017         return __vm_enough_memory(mm, pages, cap_sys_admin);
2018 }
2019
2020 /* binprm security operations */
2021
2022 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2023 {
2024         const struct task_security_struct *old_tsec;
2025         struct task_security_struct *new_tsec;
2026         struct inode_security_struct *isec;
2027         struct common_audit_data ad;
2028         struct inode *inode = file_inode(bprm->file);
2029         int rc;
2030
2031         rc = cap_bprm_set_creds(bprm);
2032         if (rc)
2033                 return rc;
2034
2035         /* SELinux context only depends on initial program or script and not
2036          * the script interpreter */
2037         if (bprm->cred_prepared)
2038                 return 0;
2039
2040         old_tsec = current_security();
2041         new_tsec = bprm->cred->security;
2042         isec = inode->i_security;
2043
2044         /* Default to the current task SID. */
2045         new_tsec->sid = old_tsec->sid;
2046         new_tsec->osid = old_tsec->sid;
2047
2048         /* Reset fs, key, and sock SIDs on execve. */
2049         new_tsec->create_sid = 0;
2050         new_tsec->keycreate_sid = 0;
2051         new_tsec->sockcreate_sid = 0;
2052
2053         if (old_tsec->exec_sid) {
2054                 new_tsec->sid = old_tsec->exec_sid;
2055                 /* Reset exec SID on execve. */
2056                 new_tsec->exec_sid = 0;
2057
2058                 /*
2059                  * Minimize confusion: if no_new_privs and a transition is
2060                  * explicitly requested, then fail the exec.
2061                  */
2062                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2063                         return -EPERM;
2064         } else {
2065                 /* Check for a default transition on this program. */
2066                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2067                                              SECCLASS_PROCESS, NULL,
2068                                              &new_tsec->sid);
2069                 if (rc)
2070                         return rc;
2071         }
2072
2073         ad.type = LSM_AUDIT_DATA_PATH;
2074         ad.u.path = bprm->file->f_path;
2075
2076         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2077             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2078                 new_tsec->sid = old_tsec->sid;
2079
2080         if (new_tsec->sid == old_tsec->sid) {
2081                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2082                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2083                 if (rc)
2084                         return rc;
2085         } else {
2086                 /* Check permissions for the transition. */
2087                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2088                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2089                 if (rc)
2090                         return rc;
2091
2092                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2093                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2094                 if (rc)
2095                         return rc;
2096
2097                 /* Check for shared state */
2098                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2099                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2100                                           SECCLASS_PROCESS, PROCESS__SHARE,
2101                                           NULL);
2102                         if (rc)
2103                                 return -EPERM;
2104                 }
2105
2106                 /* Make sure that anyone attempting to ptrace over a task that
2107                  * changes its SID has the appropriate permit */
2108                 if (bprm->unsafe &
2109                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2110                         struct task_struct *tracer;
2111                         struct task_security_struct *sec;
2112                         u32 ptsid = 0;
2113
2114                         rcu_read_lock();
2115                         tracer = ptrace_parent(current);
2116                         if (likely(tracer != NULL)) {
2117                                 sec = __task_cred(tracer)->security;
2118                                 ptsid = sec->sid;
2119                         }
2120                         rcu_read_unlock();
2121
2122                         if (ptsid != 0) {
2123                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2124                                                   SECCLASS_PROCESS,
2125                                                   PROCESS__PTRACE, NULL);
2126                                 if (rc)
2127                                         return -EPERM;
2128                         }
2129                 }
2130
2131                 /* Clear any possibly unsafe personality bits on exec: */
2132                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2133         }
2134
2135         return 0;
2136 }
2137
2138 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2139 {
2140         const struct task_security_struct *tsec = current_security();
2141         u32 sid, osid;
2142         int atsecure = 0;
2143
2144         sid = tsec->sid;
2145         osid = tsec->osid;
2146
2147         if (osid != sid) {
2148                 /* Enable secure mode for SIDs transitions unless
2149                    the noatsecure permission is granted between
2150                    the two SIDs, i.e. ahp returns 0. */
2151                 atsecure = avc_has_perm(osid, sid,
2152                                         SECCLASS_PROCESS,
2153                                         PROCESS__NOATSECURE, NULL);
2154         }
2155
2156         return (atsecure || cap_bprm_secureexec(bprm));
2157 }
2158
2159 static int match_file(const void *p, struct file *file, unsigned fd)
2160 {
2161         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2162 }
2163
2164 /* Derived from fs/exec.c:flush_old_files. */
2165 static inline void flush_unauthorized_files(const struct cred *cred,
2166                                             struct files_struct *files)
2167 {
2168         struct file *file, *devnull = NULL;
2169         struct tty_struct *tty;
2170         int drop_tty = 0;
2171         unsigned n;
2172
2173         tty = get_current_tty();
2174         if (tty) {
2175                 spin_lock(&tty_files_lock);
2176                 if (!list_empty(&tty->tty_files)) {
2177                         struct tty_file_private *file_priv;
2178
2179                         /* Revalidate access to controlling tty.
2180                            Use file_path_has_perm on the tty path directly
2181                            rather than using file_has_perm, as this particular
2182                            open file may belong to another process and we are
2183                            only interested in the inode-based check here. */
2184                         file_priv = list_first_entry(&tty->tty_files,
2185                                                 struct tty_file_private, list);
2186                         file = file_priv->file;
2187                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2188                                 drop_tty = 1;
2189                 }
2190                 spin_unlock(&tty_files_lock);
2191                 tty_kref_put(tty);
2192         }
2193         /* Reset controlling tty. */
2194         if (drop_tty)
2195                 no_tty();
2196
2197         /* Revalidate access to inherited open files. */
2198         n = iterate_fd(files, 0, match_file, cred);
2199         if (!n) /* none found? */
2200                 return;
2201
2202         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2203         if (IS_ERR(devnull))
2204                 devnull = NULL;
2205         /* replace all the matching ones with this */
2206         do {
2207                 replace_fd(n - 1, devnull, 0);
2208         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2209         if (devnull)
2210                 fput(devnull);
2211 }
2212
2213 /*
2214  * Prepare a process for imminent new credential changes due to exec
2215  */
2216 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2217 {
2218         struct task_security_struct *new_tsec;
2219         struct rlimit *rlim, *initrlim;
2220         int rc, i;
2221
2222         new_tsec = bprm->cred->security;
2223         if (new_tsec->sid == new_tsec->osid)
2224                 return;
2225
2226         /* Close files for which the new task SID is not authorized. */
2227         flush_unauthorized_files(bprm->cred, current->files);
2228
2229         /* Always clear parent death signal on SID transitions. */
2230         current->pdeath_signal = 0;
2231
2232         /* Check whether the new SID can inherit resource limits from the old
2233          * SID.  If not, reset all soft limits to the lower of the current
2234          * task's hard limit and the init task's soft limit.
2235          *
2236          * Note that the setting of hard limits (even to lower them) can be
2237          * controlled by the setrlimit check.  The inclusion of the init task's
2238          * soft limit into the computation is to avoid resetting soft limits
2239          * higher than the default soft limit for cases where the default is
2240          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2241          */
2242         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2243                           PROCESS__RLIMITINH, NULL);
2244         if (rc) {
2245                 /* protect against do_prlimit() */
2246                 task_lock(current);
2247                 for (i = 0; i < RLIM_NLIMITS; i++) {
2248                         rlim = current->signal->rlim + i;
2249                         initrlim = init_task.signal->rlim + i;
2250                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2251                 }
2252                 task_unlock(current);
2253                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2254         }
2255 }
2256
2257 /*
2258  * Clean up the process immediately after the installation of new credentials
2259  * due to exec
2260  */
2261 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2262 {
2263         const struct task_security_struct *tsec = current_security();
2264         struct itimerval itimer;
2265         u32 osid, sid;
2266         int rc, i;
2267
2268         osid = tsec->osid;
2269         sid = tsec->sid;
2270
2271         if (sid == osid)
2272                 return;
2273
2274         /* Check whether the new SID can inherit signal state from the old SID.
2275          * If not, clear itimers to avoid subsequent signal generation and
2276          * flush and unblock signals.
2277          *
2278          * This must occur _after_ the task SID has been updated so that any
2279          * kill done after the flush will be checked against the new SID.
2280          */
2281         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2282         if (rc) {
2283                 memset(&itimer, 0, sizeof itimer);
2284                 for (i = 0; i < 3; i++)
2285                         do_setitimer(i, &itimer, NULL);
2286                 spin_lock_irq(&current->sighand->siglock);
2287                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2288                         __flush_signals(current);
2289                         flush_signal_handlers(current, 1);
2290                         sigemptyset(&current->blocked);
2291                 }
2292                 spin_unlock_irq(&current->sighand->siglock);
2293         }
2294
2295         /* Wake up the parent if it is waiting so that it can recheck
2296          * wait permission to the new task SID. */
2297         read_lock(&tasklist_lock);
2298         __wake_up_parent(current, current->real_parent);
2299         read_unlock(&tasklist_lock);
2300 }
2301
2302 /* superblock security operations */
2303
2304 static int selinux_sb_alloc_security(struct super_block *sb)
2305 {
2306         return superblock_alloc_security(sb);
2307 }
2308
2309 static void selinux_sb_free_security(struct super_block *sb)
2310 {
2311         superblock_free_security(sb);
2312 }
2313
2314 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2315 {
2316         if (plen > olen)
2317                 return 0;
2318
2319         return !memcmp(prefix, option, plen);
2320 }
2321
2322 static inline int selinux_option(char *option, int len)
2323 {
2324         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2325                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2326                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2327                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2328                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2329 }
2330
2331 static inline void take_option(char **to, char *from, int *first, int len)
2332 {
2333         if (!*first) {
2334                 **to = ',';
2335                 *to += 1;
2336         } else
2337                 *first = 0;
2338         memcpy(*to, from, len);
2339         *to += len;
2340 }
2341
2342 static inline void take_selinux_option(char **to, char *from, int *first,
2343                                        int len)
2344 {
2345         int current_size = 0;
2346
2347         if (!*first) {
2348                 **to = '|';
2349                 *to += 1;
2350         } else
2351                 *first = 0;
2352
2353         while (current_size < len) {
2354                 if (*from != '"') {
2355                         **to = *from;
2356                         *to += 1;
2357                 }
2358                 from += 1;
2359                 current_size += 1;
2360         }
2361 }
2362
2363 static int selinux_sb_copy_data(char *orig, char *copy)
2364 {
2365         int fnosec, fsec, rc = 0;
2366         char *in_save, *in_curr, *in_end;
2367         char *sec_curr, *nosec_save, *nosec;
2368         int open_quote = 0;
2369
2370         in_curr = orig;
2371         sec_curr = copy;
2372
2373         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2374         if (!nosec) {
2375                 rc = -ENOMEM;
2376                 goto out;
2377         }
2378
2379         nosec_save = nosec;
2380         fnosec = fsec = 1;
2381         in_save = in_end = orig;
2382
2383         do {
2384                 if (*in_end == '"')
2385                         open_quote = !open_quote;
2386                 if ((*in_end == ',' && open_quote == 0) ||
2387                                 *in_end == '\0') {
2388                         int len = in_end - in_curr;
2389
2390                         if (selinux_option(in_curr, len))
2391                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2392                         else
2393                                 take_option(&nosec, in_curr, &fnosec, len);
2394
2395                         in_curr = in_end + 1;
2396                 }
2397         } while (*in_end++);
2398
2399         strcpy(in_save, nosec_save);
2400         free_page((unsigned long)nosec_save);
2401 out:
2402         return rc;
2403 }
2404
2405 static int selinux_sb_remount(struct super_block *sb, void *data)
2406 {
2407         int rc, i, *flags;
2408         struct security_mnt_opts opts;
2409         char *secdata, **mount_options;
2410         struct superblock_security_struct *sbsec = sb->s_security;
2411
2412         if (!(sbsec->flags & SE_SBINITIALIZED))
2413                 return 0;
2414
2415         if (!data)
2416                 return 0;
2417
2418         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2419                 return 0;
2420
2421         security_init_mnt_opts(&opts);
2422         secdata = alloc_secdata();
2423         if (!secdata)
2424                 return -ENOMEM;
2425         rc = selinux_sb_copy_data(data, secdata);
2426         if (rc)
2427                 goto out_free_secdata;
2428
2429         rc = selinux_parse_opts_str(secdata, &opts);
2430         if (rc)
2431                 goto out_free_secdata;
2432
2433         mount_options = opts.mnt_opts;
2434         flags = opts.mnt_opts_flags;
2435
2436         for (i = 0; i < opts.num_mnt_opts; i++) {
2437                 u32 sid;
2438                 size_t len;
2439
2440                 if (flags[i] == SE_SBLABELSUPP)
2441                         continue;
2442                 len = strlen(mount_options[i]);
2443                 rc = security_context_to_sid(mount_options[i], len, &sid);
2444                 if (rc) {
2445                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2446                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2447                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2448                         goto out_free_opts;
2449                 }
2450                 rc = -EINVAL;
2451                 switch (flags[i]) {
2452                 case FSCONTEXT_MNT:
2453                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2454                                 goto out_bad_option;
2455                         break;
2456                 case CONTEXT_MNT:
2457                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2458                                 goto out_bad_option;
2459                         break;
2460                 case ROOTCONTEXT_MNT: {
2461                         struct inode_security_struct *root_isec;
2462                         root_isec = sb->s_root->d_inode->i_security;
2463
2464                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2465                                 goto out_bad_option;
2466                         break;
2467                 }
2468                 case DEFCONTEXT_MNT:
2469                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2470                                 goto out_bad_option;
2471                         break;
2472                 default:
2473                         goto out_free_opts;
2474                 }
2475         }
2476
2477         rc = 0;
2478 out_free_opts:
2479         security_free_mnt_opts(&opts);
2480 out_free_secdata:
2481         free_secdata(secdata);
2482         return rc;
2483 out_bad_option:
2484         printk(KERN_WARNING "SELinux: unable to change security options "
2485                "during remount (dev %s, type=%s)\n", sb->s_id,
2486                sb->s_type->name);
2487         goto out_free_opts;
2488 }
2489
2490 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2491 {
2492         const struct cred *cred = current_cred();
2493         struct common_audit_data ad;
2494         int rc;
2495
2496         rc = superblock_doinit(sb, data);
2497         if (rc)
2498                 return rc;
2499
2500         /* Allow all mounts performed by the kernel */
2501         if (flags & MS_KERNMOUNT)
2502                 return 0;
2503
2504         ad.type = LSM_AUDIT_DATA_DENTRY;
2505         ad.u.dentry = sb->s_root;
2506         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2507 }
2508
2509 static int selinux_sb_statfs(struct dentry *dentry)
2510 {
2511         const struct cred *cred = current_cred();
2512         struct common_audit_data ad;
2513
2514         ad.type = LSM_AUDIT_DATA_DENTRY;
2515         ad.u.dentry = dentry->d_sb->s_root;
2516         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2517 }
2518
2519 static int selinux_mount(const char *dev_name,
2520                          struct path *path,
2521                          const char *type,
2522                          unsigned long flags,
2523                          void *data)
2524 {
2525         const struct cred *cred = current_cred();
2526
2527         if (flags & MS_REMOUNT)
2528                 return superblock_has_perm(cred, path->dentry->d_sb,
2529                                            FILESYSTEM__REMOUNT, NULL);
2530         else
2531                 return path_has_perm(cred, path, FILE__MOUNTON);
2532 }
2533
2534 static int selinux_umount(struct vfsmount *mnt, int flags)
2535 {
2536         const struct cred *cred = current_cred();
2537
2538         return superblock_has_perm(cred, mnt->mnt_sb,
2539                                    FILESYSTEM__UNMOUNT, NULL);
2540 }
2541
2542 /* inode security operations */
2543
2544 static int selinux_inode_alloc_security(struct inode *inode)
2545 {
2546         return inode_alloc_security(inode);
2547 }
2548
2549 static void selinux_inode_free_security(struct inode *inode)
2550 {
2551         inode_free_security(inode);
2552 }
2553
2554 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2555                                         struct qstr *name, void **ctx,
2556                                         u32 *ctxlen)
2557 {
2558         const struct cred *cred = current_cred();
2559         struct task_security_struct *tsec;
2560         struct inode_security_struct *dsec;
2561         struct superblock_security_struct *sbsec;
2562         struct inode *dir = dentry->d_parent->d_inode;
2563         u32 newsid;
2564         int rc;
2565
2566         tsec = cred->security;
2567         dsec = dir->i_security;
2568         sbsec = dir->i_sb->s_security;
2569
2570         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2571                 newsid = tsec->create_sid;
2572         } else {
2573                 rc = security_transition_sid(tsec->sid, dsec->sid,
2574                                              inode_mode_to_security_class(mode),
2575                                              name,
2576                                              &newsid);
2577                 if (rc) {
2578                         printk(KERN_WARNING
2579                                 "%s: security_transition_sid failed, rc=%d\n",
2580                                __func__, -rc);
2581                         return rc;
2582                 }
2583         }
2584
2585         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2586 }
2587
2588 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2589                                        const struct qstr *qstr,
2590                                        const char **name,
2591                                        void **value, size_t *len)
2592 {
2593         const struct task_security_struct *tsec = current_security();
2594         struct inode_security_struct *dsec;
2595         struct superblock_security_struct *sbsec;
2596         u32 sid, newsid, clen;
2597         int rc;
2598         char *context;
2599
2600         dsec = dir->i_security;
2601         sbsec = dir->i_sb->s_security;
2602
2603         sid = tsec->sid;
2604         newsid = tsec->create_sid;
2605
2606         if ((sbsec->flags & SE_SBINITIALIZED) &&
2607             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2608                 newsid = sbsec->mntpoint_sid;
2609         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2610                 rc = security_transition_sid(sid, dsec->sid,
2611                                              inode_mode_to_security_class(inode->i_mode),
2612                                              qstr, &newsid);
2613                 if (rc) {
2614                         printk(KERN_WARNING "%s:  "
2615                                "security_transition_sid failed, rc=%d (dev=%s "
2616                                "ino=%ld)\n",
2617                                __func__,
2618                                -rc, inode->i_sb->s_id, inode->i_ino);
2619                         return rc;
2620                 }
2621         }
2622
2623         /* Possibly defer initialization to selinux_complete_init. */
2624         if (sbsec->flags & SE_SBINITIALIZED) {
2625                 struct inode_security_struct *isec = inode->i_security;
2626                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2627                 isec->sid = newsid;
2628                 isec->initialized = 1;
2629         }
2630
2631         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2632                 return -EOPNOTSUPP;
2633
2634         if (name)
2635                 *name = XATTR_SELINUX_SUFFIX;
2636
2637         if (value && len) {
2638                 rc = security_sid_to_context_force(newsid, &context, &clen);
2639                 if (rc)
2640                         return rc;
2641                 *value = context;
2642                 *len = clen;
2643         }
2644
2645         return 0;
2646 }
2647
2648 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2649 {
2650         return may_create(dir, dentry, SECCLASS_FILE);
2651 }
2652
2653 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2654 {
2655         return may_link(dir, old_dentry, MAY_LINK);
2656 }
2657
2658 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2659 {
2660         return may_link(dir, dentry, MAY_UNLINK);
2661 }
2662
2663 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2664 {
2665         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2666 }
2667
2668 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2669 {
2670         return may_create(dir, dentry, SECCLASS_DIR);
2671 }
2672
2673 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2674 {
2675         return may_link(dir, dentry, MAY_RMDIR);
2676 }
2677
2678 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2679 {
2680         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2681 }
2682
2683 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2684                                 struct inode *new_inode, struct dentry *new_dentry)
2685 {
2686         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2687 }
2688
2689 static int selinux_inode_readlink(struct dentry *dentry)
2690 {
2691         const struct cred *cred = current_cred();
2692
2693         return dentry_has_perm(cred, dentry, FILE__READ);
2694 }
2695
2696 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2697 {
2698         const struct cred *cred = current_cred();
2699
2700         return dentry_has_perm(cred, dentry, FILE__READ);
2701 }
2702
2703 static noinline int audit_inode_permission(struct inode *inode,
2704                                            u32 perms, u32 audited, u32 denied,
2705                                            unsigned flags)
2706 {
2707         struct common_audit_data ad;
2708         struct inode_security_struct *isec = inode->i_security;
2709         int rc;
2710
2711         ad.type = LSM_AUDIT_DATA_INODE;
2712         ad.u.inode = inode;
2713
2714         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2715                             audited, denied, &ad, flags);
2716         if (rc)
2717                 return rc;
2718         return 0;
2719 }
2720
2721 static int selinux_inode_permission(struct inode *inode, int mask)
2722 {
2723         const struct cred *cred = current_cred();
2724         u32 perms;
2725         bool from_access;
2726         unsigned flags = mask & MAY_NOT_BLOCK;
2727         struct inode_security_struct *isec;
2728         u32 sid;
2729         struct av_decision avd;
2730         int rc, rc2;
2731         u32 audited, denied;
2732
2733         from_access = mask & MAY_ACCESS;
2734         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2735
2736         /* No permission to check.  Existence test. */
2737         if (!mask)
2738                 return 0;
2739
2740         validate_creds(cred);
2741
2742         if (unlikely(IS_PRIVATE(inode)))
2743                 return 0;
2744
2745         perms = file_mask_to_av(inode->i_mode, mask);
2746
2747         sid = cred_sid(cred);
2748         isec = inode->i_security;
2749
2750         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2751         audited = avc_audit_required(perms, &avd, rc,
2752                                      from_access ? FILE__AUDIT_ACCESS : 0,
2753                                      &denied);
2754         if (likely(!audited))
2755                 return rc;
2756
2757         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2758         if (rc2)
2759                 return rc2;
2760         return rc;
2761 }
2762
2763 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2764 {
2765         const struct cred *cred = current_cred();
2766         unsigned int ia_valid = iattr->ia_valid;
2767         __u32 av = FILE__WRITE;
2768
2769         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2770         if (ia_valid & ATTR_FORCE) {
2771                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2772                               ATTR_FORCE);
2773                 if (!ia_valid)
2774                         return 0;
2775         }
2776
2777         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2778                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2779                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2780
2781         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2782                 av |= FILE__OPEN;
2783
2784         return dentry_has_perm(cred, dentry, av);
2785 }
2786
2787 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2788 {
2789         const struct cred *cred = current_cred();
2790         struct path path;
2791
2792         path.dentry = dentry;
2793         path.mnt = mnt;
2794
2795         return path_has_perm(cred, &path, FILE__GETATTR);
2796 }
2797
2798 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2799 {
2800         const struct cred *cred = current_cred();
2801
2802         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2803                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2804                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2805                         if (!capable(CAP_SETFCAP))
2806                                 return -EPERM;
2807                 } else if (!capable(CAP_SYS_ADMIN)) {
2808                         /* A different attribute in the security namespace.
2809                            Restrict to administrator. */
2810                         return -EPERM;
2811                 }
2812         }
2813
2814         /* Not an attribute we recognize, so just check the
2815            ordinary setattr permission. */
2816         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2817 }
2818
2819 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2820                                   const void *value, size_t size, int flags)
2821 {
2822         struct inode *inode = dentry->d_inode;
2823         struct inode_security_struct *isec = inode->i_security;
2824         struct superblock_security_struct *sbsec;
2825         struct common_audit_data ad;
2826         u32 newsid, sid = current_sid();
2827         int rc = 0;
2828
2829         if (strcmp(name, XATTR_NAME_SELINUX))
2830                 return selinux_inode_setotherxattr(dentry, name);
2831
2832         sbsec = inode->i_sb->s_security;
2833         if (!(sbsec->flags & SE_SBLABELSUPP))
2834                 return -EOPNOTSUPP;
2835
2836         if (!inode_owner_or_capable(inode))
2837                 return -EPERM;
2838
2839         ad.type = LSM_AUDIT_DATA_DENTRY;
2840         ad.u.dentry = dentry;
2841
2842         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2843                           FILE__RELABELFROM, &ad);
2844         if (rc)
2845                 return rc;
2846
2847         rc = security_context_to_sid(value, size, &newsid);
2848         if (rc == -EINVAL) {
2849                 if (!capable(CAP_MAC_ADMIN)) {
2850                         struct audit_buffer *ab;
2851                         size_t audit_size;
2852                         const char *str;
2853
2854                         /* We strip a nul only if it is at the end, otherwise the
2855                          * context contains a nul and we should audit that */
2856                         if (value) {
2857                                 str = value;
2858                                 if (str[size - 1] == '\0')
2859                                         audit_size = size - 1;
2860                                 else
2861                                         audit_size = size;
2862                         } else {
2863                                 str = "";
2864                                 audit_size = 0;
2865                         }
2866                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2867                         audit_log_format(ab, "op=setxattr invalid_context=");
2868                         audit_log_n_untrustedstring(ab, value, audit_size);
2869                         audit_log_end(ab);
2870
2871                         return rc;
2872                 }
2873                 rc = security_context_to_sid_force(value, size, &newsid);
2874         }
2875         if (rc)
2876                 return rc;
2877
2878         rc = avc_has_perm(sid, newsid, isec->sclass,
2879                           FILE__RELABELTO, &ad);
2880         if (rc)
2881                 return rc;
2882
2883         rc = security_validate_transition(isec->sid, newsid, sid,
2884                                           isec->sclass);
2885         if (rc)
2886                 return rc;
2887
2888         return avc_has_perm(newsid,
2889                             sbsec->sid,
2890                             SECCLASS_FILESYSTEM,
2891                             FILESYSTEM__ASSOCIATE,
2892                             &ad);
2893 }
2894
2895 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2896                                         const void *value, size_t size,
2897                                         int flags)
2898 {
2899         struct inode *inode = dentry->d_inode;
2900         struct inode_security_struct *isec = inode->i_security;
2901         u32 newsid;
2902         int rc;
2903
2904         if (strcmp(name, XATTR_NAME_SELINUX)) {
2905                 /* Not an attribute we recognize, so nothing to do. */
2906                 return;
2907         }
2908
2909         rc = security_context_to_sid_force(value, size, &newsid);
2910         if (rc) {
2911                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2912                        "for (%s, %lu), rc=%d\n",
2913                        inode->i_sb->s_id, inode->i_ino, -rc);
2914                 return;
2915         }
2916
2917         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2918         isec->sid = newsid;
2919         isec->initialized = 1;
2920
2921         return;
2922 }
2923
2924 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2925 {
2926         const struct cred *cred = current_cred();
2927
2928         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2929 }
2930
2931 static int selinux_inode_listxattr(struct dentry *dentry)
2932 {
2933         const struct cred *cred = current_cred();
2934
2935         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2936 }
2937
2938 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2939 {
2940         if (strcmp(name, XATTR_NAME_SELINUX))
2941                 return selinux_inode_setotherxattr(dentry, name);
2942
2943         /* No one is allowed to remove a SELinux security label.
2944            You can change the label, but all data must be labeled. */
2945         return -EACCES;
2946 }
2947
2948 /*
2949  * Copy the inode security context value to the user.
2950  *
2951  * Permission check is handled by selinux_inode_getxattr hook.
2952  */
2953 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2954 {
2955         u32 size;
2956         int error;
2957         char *context = NULL;
2958         struct inode_security_struct *isec = inode->i_security;
2959
2960         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2961                 return -EOPNOTSUPP;
2962
2963         /*
2964          * If the caller has CAP_MAC_ADMIN, then get the raw context
2965          * value even if it is not defined by current policy; otherwise,
2966          * use the in-core value under current policy.
2967          * Use the non-auditing forms of the permission checks since
2968          * getxattr may be called by unprivileged processes commonly
2969          * and lack of permission just means that we fall back to the
2970          * in-core context value, not a denial.
2971          */
2972         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2973                                 SECURITY_CAP_NOAUDIT);
2974         if (!error)
2975                 error = security_sid_to_context_force(isec->sid, &context,
2976                                                       &size);
2977         else
2978                 error = security_sid_to_context(isec->sid, &context, &size);
2979         if (error)
2980                 return error;
2981         error = size;
2982         if (alloc) {
2983                 *buffer = context;
2984                 goto out_nofree;
2985         }
2986         kfree(context);
2987 out_nofree:
2988         return error;
2989 }
2990
2991 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2992                                      const void *value, size_t size, int flags)
2993 {
2994         struct inode_security_struct *isec = inode->i_security;
2995         u32 newsid;
2996         int rc;
2997
2998         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2999                 return -EOPNOTSUPP;
3000
3001         if (!value || !size)
3002                 return -EACCES;
3003
3004         rc = security_context_to_sid((void *)value, size, &newsid);
3005         if (rc)
3006                 return rc;
3007
3008         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3009         isec->sid = newsid;
3010         isec->initialized = 1;
3011         return 0;
3012 }
3013
3014 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3015 {
3016         const int len = sizeof(XATTR_NAME_SELINUX);
3017         if (buffer && len <= buffer_size)
3018                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3019         return len;
3020 }
3021
3022 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3023 {
3024         struct inode_security_struct *isec = inode->i_security;
3025         *secid = isec->sid;
3026 }
3027
3028 /* file security operations */
3029
3030 static int selinux_revalidate_file_permission(struct file *file, int mask)
3031 {
3032         const struct cred *cred = current_cred();
3033         struct inode *inode = file_inode(file);
3034
3035         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3036         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3037                 mask |= MAY_APPEND;
3038
3039         return file_has_perm(cred, file,
3040                              file_mask_to_av(inode->i_mode, mask));
3041 }
3042
3043 static int selinux_file_permission(struct file *file, int mask)
3044 {
3045         struct inode *inode = file_inode(file);
3046         struct file_security_struct *fsec = file->f_security;
3047         struct inode_security_struct *isec = inode->i_security;
3048         u32 sid = current_sid();
3049
3050         if (!mask)
3051                 /* No permission to check.  Existence test. */
3052                 return 0;
3053
3054         if (sid == fsec->sid && fsec->isid == isec->sid &&
3055             fsec->pseqno == avc_policy_seqno())
3056                 /* No change since file_open check. */
3057                 return 0;
3058
3059         return selinux_revalidate_file_permission(file, mask);
3060 }
3061
3062 static int selinux_file_alloc_security(struct file *file)
3063 {
3064         return file_alloc_security(file);
3065 }
3066
3067 static void selinux_file_free_security(struct file *file)
3068 {
3069         file_free_security(file);
3070 }
3071
3072 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3073                               unsigned long arg)
3074 {
3075         const struct cred *cred = current_cred();
3076         int error = 0;
3077
3078         switch (cmd) {
3079         case FIONREAD:
3080         /* fall through */
3081         case FIBMAP:
3082         /* fall through */
3083         case FIGETBSZ:
3084         /* fall through */
3085         case FS_IOC_GETFLAGS:
3086         /* fall through */
3087         case FS_IOC_GETVERSION:
3088                 error = file_has_perm(cred, file, FILE__GETATTR);
3089                 break;
3090
3091         case FS_IOC_SETFLAGS:
3092         /* fall through */
3093         case FS_IOC_SETVERSION:
3094                 error = file_has_perm(cred, file, FILE__SETATTR);
3095                 break;
3096
3097         /* sys_ioctl() checks */
3098         case FIONBIO:
3099         /* fall through */
3100         case FIOASYNC:
3101                 error = file_has_perm(cred, file, 0);
3102                 break;
3103
3104         case KDSKBENT:
3105         case KDSKBSENT:
3106                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3107                                             SECURITY_CAP_AUDIT);
3108                 break;
3109
3110         /* default case assumes that the command will go
3111          * to the file's ioctl() function.
3112          */
3113         default:
3114                 error = file_has_perm(cred, file, FILE__IOCTL);
3115         }
3116         return error;
3117 }
3118
3119 static int default_noexec;
3120
3121 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3122 {
3123         const struct cred *cred = current_cred();
3124         int rc = 0;
3125
3126         if (default_noexec &&
3127             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3128                 /*
3129                  * We are making executable an anonymous mapping or a
3130                  * private file mapping that will also be writable.
3131                  * This has an additional check.
3132                  */
3133                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3134                 if (rc)
3135                         goto error;
3136         }
3137
3138         if (file) {
3139                 /* read access is always possible with a mapping */
3140                 u32 av = FILE__READ;
3141
3142                 /* write access only matters if the mapping is shared */
3143                 if (shared && (prot & PROT_WRITE))
3144                         av |= FILE__WRITE;
3145
3146                 if (prot & PROT_EXEC)
3147                         av |= FILE__EXECUTE;
3148
3149                 return file_has_perm(cred, file, av);
3150         }
3151
3152 error:
3153         return rc;
3154 }
3155
3156 static int selinux_mmap_addr(unsigned long addr)
3157 {
3158         int rc = 0;
3159         u32 sid = current_sid();
3160
3161         /*
3162          * notice that we are intentionally putting the SELinux check before
3163          * the secondary cap_file_mmap check.  This is such a likely attempt
3164          * at bad behaviour/exploit that we always want to get the AVC, even
3165          * if DAC would have also denied the operation.
3166          */
3167         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3168                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3169                                   MEMPROTECT__MMAP_ZERO, NULL);
3170                 if (rc)
3171                         return rc;
3172         }
3173
3174         /* do DAC check on address space usage */
3175         return cap_mmap_addr(addr);
3176 }
3177
3178 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3179                              unsigned long prot, unsigned long flags)
3180 {
3181         if (selinux_checkreqprot)
3182                 prot = reqprot;
3183
3184         return file_map_prot_check(file, prot,
3185                                    (flags & MAP_TYPE) == MAP_SHARED);
3186 }
3187
3188 static int selinux_file_mprotect(struct vm_area_struct *vma,
3189                                  unsigned long reqprot,
3190                                  unsigned long prot)
3191 {
3192         const struct cred *cred = current_cred();
3193
3194         if (selinux_checkreqprot)
3195                 prot = reqprot;
3196
3197         if (default_noexec &&
3198             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3199                 int rc = 0;
3200                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3201                     vma->vm_end <= vma->vm_mm->brk) {
3202                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3203                 } else if (!vma->vm_file &&
3204                            vma->vm_start <= vma->vm_mm->start_stack &&
3205                            vma->vm_end >= vma->vm_mm->start_stack) {
3206                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3207                 } else if (vma->vm_file && vma->anon_vma) {
3208                         /*
3209                          * We are making executable a file mapping that has
3210                          * had some COW done. Since pages might have been
3211                          * written, check ability to execute the possibly
3212                          * modified content.  This typically should only
3213                          * occur for text relocations.
3214                          */
3215                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3216                 }
3217                 if (rc)
3218                         return rc;
3219         }
3220
3221         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3222 }
3223
3224 static int selinux_file_lock(struct file *file, unsigned int cmd)
3225 {
3226         const struct cred *cred = current_cred();
3227
3228         return file_has_perm(cred, file, FILE__LOCK);
3229 }
3230
3231 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3232                               unsigned long arg)
3233 {
3234         const struct cred *cred = current_cred();
3235         int err = 0;
3236
3237         switch (cmd) {
3238         case F_SETFL:
3239                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3240                         err = file_has_perm(cred, file, FILE__WRITE);
3241                         break;
3242                 }
3243                 /* fall through */
3244         case F_SETOWN:
3245         case F_SETSIG:
3246         case F_GETFL:
3247         case F_GETOWN:
3248         case F_GETSIG:
3249         case F_GETOWNER_UIDS:
3250                 /* Just check FD__USE permission */
3251                 err = file_has_perm(cred, file, 0);
3252                 break;
3253         case F_GETLK:
3254         case F_SETLK:
3255         case F_SETLKW:
3256 #if BITS_PER_LONG == 32
3257         case F_GETLK64:
3258         case F_SETLK64:
3259         case F_SETLKW64:
3260 #endif
3261                 err = file_has_perm(cred, file, FILE__LOCK);
3262                 break;
3263         }
3264
3265         return err;
3266 }
3267
3268 static int selinux_file_set_fowner(struct file *file)
3269 {
3270         struct file_security_struct *fsec;
3271
3272         fsec = file->f_security;
3273         fsec->fown_sid = current_sid();
3274
3275         return 0;
3276 }
3277
3278 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3279                                        struct fown_struct *fown, int signum)
3280 {
3281         struct file *file;
3282         u32 sid = task_sid(tsk);
3283         u32 perm;
3284         struct file_security_struct *fsec;
3285
3286         /* struct fown_struct is never outside the context of a struct file */
3287         file = container_of(fown, struct file, f_owner);
3288
3289         fsec = file->f_security;
3290
3291         if (!signum)
3292                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3293         else
3294                 perm = signal_to_av(signum);
3295
3296         return avc_has_perm(fsec->fown_sid, sid,
3297                             SECCLASS_PROCESS, perm, NULL);
3298 }
3299
3300 static int selinux_file_receive(struct file *file)
3301 {
3302         const struct cred *cred = current_cred();
3303
3304         return file_has_perm(cred, file, file_to_av(file));
3305 }
3306
3307 static int selinux_file_open(struct file *file, const struct cred *cred)
3308 {
3309         struct file_security_struct *fsec;
3310         struct inode_security_struct *isec;
3311
3312         fsec = file->f_security;
3313         isec = file_inode(file)->i_security;
3314         /*
3315          * Save inode label and policy sequence number
3316          * at open-time so that selinux_file_permission
3317          * can determine whether revalidation is necessary.
3318          * Task label is already saved in the file security
3319          * struct as its SID.
3320          */
3321         fsec->isid = isec->sid;
3322         fsec->pseqno = avc_policy_seqno();
3323         /*
3324          * Since the inode label or policy seqno may have changed
3325          * between the selinux_inode_permission check and the saving
3326          * of state above, recheck that access is still permitted.
3327          * Otherwise, access might never be revalidated against the
3328          * new inode label or new policy.
3329          * This check is not redundant - do not remove.
3330          */
3331         return file_path_has_perm(cred, file, open_file_to_av(file));
3332 }
3333
3334 /* task security operations */
3335
3336 static int selinux_task_create(unsigned long clone_flags)
3337 {
3338         return current_has_perm(current, PROCESS__FORK);
3339 }
3340
3341 /*
3342  * allocate the SELinux part of blank credentials
3343  */
3344 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3345 {
3346         struct task_security_struct *tsec;
3347
3348         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3349         if (!tsec)
3350                 return -ENOMEM;
3351
3352         cred->security = tsec;
3353         return 0;
3354 }
3355
3356 /*
3357  * detach and free the LSM part of a set of credentials
3358  */
3359 static void selinux_cred_free(struct cred *cred)
3360 {
3361         struct task_security_struct *tsec = cred->security;
3362
3363         /*
3364          * cred->security == NULL if security_cred_alloc_blank() or
3365          * security_prepare_creds() returned an error.
3366          */
3367         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3368         cred->security = (void *) 0x7UL;
3369         kfree(tsec);
3370 }
3371
3372 /*
3373  * prepare a new set of credentials for modification
3374  */
3375 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3376                                 gfp_t gfp)
3377 {
3378         const struct task_security_struct *old_tsec;
3379         struct task_security_struct *tsec;
3380
3381         old_tsec = old->security;
3382
3383         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3384         if (!tsec)
3385                 return -ENOMEM;
3386
3387         new->security = tsec;
3388         return 0;
3389 }
3390
3391 /*
3392  * transfer the SELinux data to a blank set of creds
3393  */
3394 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3395 {
3396         const struct task_security_struct *old_tsec = old->security;
3397         struct task_security_struct *tsec = new->security;
3398
3399         *tsec = *old_tsec;
3400 }
3401
3402 /*
3403  * set the security data for a kernel service
3404  * - all the creation contexts are set to unlabelled
3405  */
3406 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3407 {
3408         struct task_security_struct *tsec = new->security;
3409         u32 sid = current_sid();
3410         int ret;
3411
3412         ret = avc_has_perm(sid, secid,
3413                            SECCLASS_KERNEL_SERVICE,
3414                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3415                            NULL);
3416         if (ret == 0) {
3417                 tsec->sid = secid;
3418                 tsec->create_sid = 0;
3419                 tsec->keycreate_sid = 0;
3420                 tsec->sockcreate_sid = 0;
3421         }
3422         return ret;
3423 }
3424
3425 /*
3426  * set the file creation context in a security record to the same as the
3427  * objective context of the specified inode
3428  */
3429 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3430 {
3431         struct inode_security_struct *isec = inode->i_security;
3432         struct task_security_struct *tsec = new->security;
3433         u32 sid = current_sid();
3434         int ret;
3435
3436         ret = avc_has_perm(sid, isec->sid,
3437                            SECCLASS_KERNEL_SERVICE,
3438                            KERNEL_SERVICE__CREATE_FILES_AS,
3439                            NULL);
3440
3441         if (ret == 0)
3442                 tsec->create_sid = isec->sid;
3443         return ret;
3444 }
3445
3446 static int selinux_kernel_module_request(char *kmod_name)
3447 {
3448         u32 sid;
3449         struct common_audit_data ad;
3450
3451         sid = task_sid(current);
3452
3453         ad.type = LSM_AUDIT_DATA_KMOD;
3454         ad.u.kmod_name = kmod_name;
3455
3456         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3457                             SYSTEM__MODULE_REQUEST, &ad);
3458 }
3459
3460 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3461 {
3462         return current_has_perm(p, PROCESS__SETPGID);
3463 }
3464
3465 static int selinux_task_getpgid(struct task_struct *p)
3466 {
3467         return current_has_perm(p, PROCESS__GETPGID);
3468 }
3469
3470 static int selinux_task_getsid(struct task_struct *p)
3471 {
3472         return current_has_perm(p, PROCESS__GETSESSION);
3473 }
3474
3475 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3476 {
3477         *secid = task_sid(p);
3478 }
3479
3480 static int selinux_task_setnice(struct task_struct *p, int nice)
3481 {
3482         int rc;
3483
3484         rc = cap_task_setnice(p, nice);
3485         if (rc)
3486                 return rc;
3487
3488         return current_has_perm(p, PROCESS__SETSCHED);
3489 }
3490
3491 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3492 {
3493         int rc;
3494
3495         rc = cap_task_setioprio(p, ioprio);
3496         if (rc)
3497                 return rc;
3498
3499         return current_has_perm(p, PROCESS__SETSCHED);
3500 }
3501
3502 static int selinux_task_getioprio(struct task_struct *p)
3503 {
3504         return current_has_perm(p, PROCESS__GETSCHED);
3505 }
3506
3507 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3508                 struct rlimit *new_rlim)
3509 {
3510         struct rlimit *old_rlim = p->signal->rlim + resource;
3511
3512         /* Control the ability to change the hard limit (whether
3513            lowering or raising it), so that the hard limit can
3514            later be used as a safe reset point for the soft limit
3515            upon context transitions.  See selinux_bprm_committing_creds. */
3516         if (old_rlim->rlim_max != new_rlim->rlim_max)
3517                 return current_has_perm(p, PROCESS__SETRLIMIT);
3518
3519         return 0;
3520 }
3521
3522 static int selinux_task_setscheduler(struct task_struct *p)
3523 {
3524         int rc;
3525
3526         rc = cap_task_setscheduler(p);
3527         if (rc)
3528                 return rc;
3529
3530         return current_has_perm(p, PROCESS__SETSCHED);
3531 }
3532
3533 static int selinux_task_getscheduler(struct task_struct *p)
3534 {
3535         return current_has_perm(p, PROCESS__GETSCHED);
3536 }
3537
3538 static int selinux_task_movememory(struct task_struct *p)
3539 {
3540         return current_has_perm(p, PROCESS__SETSCHED);
3541 }
3542
3543 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3544                                 int sig, u32 secid)
3545 {
3546         u32 perm;
3547         int rc;
3548
3549         if (!sig)
3550                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3551         else
3552                 perm = signal_to_av(sig);
3553         if (secid)
3554                 rc = avc_has_perm(secid, task_sid(p),
3555                                   SECCLASS_PROCESS, perm, NULL);
3556         else
3557                 rc = current_has_perm(p, perm);
3558         return rc;
3559 }
3560
3561 static int selinux_task_wait(struct task_struct *p)
3562 {
3563         return task_has_perm(p, current, PROCESS__SIGCHLD);
3564 }
3565
3566 static void selinux_task_to_inode(struct task_struct *p,
3567                                   struct inode *inode)
3568 {
3569         struct inode_security_struct *isec = inode->i_security;
3570         u32 sid = task_sid(p);
3571
3572         isec->sid = sid;
3573         isec->initialized = 1;
3574 }
3575
3576 /* Returns error only if unable to parse addresses */
3577 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3578                         struct common_audit_data *ad, u8 *proto)
3579 {
3580         int offset, ihlen, ret = -EINVAL;
3581         struct iphdr _iph, *ih;
3582
3583         offset = skb_network_offset(skb);
3584         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3585         if (ih == NULL)
3586                 goto out;
3587
3588         ihlen = ih->ihl * 4;
3589         if (ihlen < sizeof(_iph))
3590                 goto out;
3591
3592         ad->u.net->v4info.saddr = ih->saddr;
3593         ad->u.net->v4info.daddr = ih->daddr;
3594         ret = 0;
3595
3596         if (proto)
3597                 *proto = ih->protocol;
3598
3599         switch (ih->protocol) {
3600         case IPPROTO_TCP: {
3601                 struct tcphdr _tcph, *th;
3602
3603                 if (ntohs(ih->frag_off) & IP_OFFSET)
3604                         break;
3605
3606                 offset += ihlen;
3607                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3608                 if (th == NULL)
3609                         break;
3610
3611                 ad->u.net->sport = th->source;
3612                 ad->u.net->dport = th->dest;
3613                 break;
3614         }
3615
3616         case IPPROTO_UDP: {
3617                 struct udphdr _udph, *uh;
3618
3619                 if (ntohs(ih->frag_off) & IP_OFFSET)
3620                         break;
3621
3622                 offset += ihlen;
3623                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3624                 if (uh == NULL)
3625                         break;
3626
3627                 ad->u.net->sport = uh->source;
3628                 ad->u.net->dport = uh->dest;
3629                 break;
3630         }
3631
3632         case IPPROTO_DCCP: {
3633                 struct dccp_hdr _dccph, *dh;
3634
3635                 if (ntohs(ih->frag_off) & IP_OFFSET)
3636                         break;
3637
3638                 offset += ihlen;
3639                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3640                 if (dh == NULL)
3641                         break;
3642
3643                 ad->u.net->sport = dh->dccph_sport;
3644                 ad->u.net->dport = dh->dccph_dport;
3645                 break;
3646         }
3647
3648         default:
3649                 break;
3650         }
3651 out:
3652         return ret;
3653 }
3654
3655 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3656
3657 /* Returns error only if unable to parse addresses */
3658 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3659                         struct common_audit_data *ad, u8 *proto)
3660 {
3661         u8 nexthdr;
3662         int ret = -EINVAL, offset;
3663         struct ipv6hdr _ipv6h, *ip6;
3664         __be16 frag_off;
3665
3666         offset = skb_network_offset(skb);
3667         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3668         if (ip6 == NULL)
3669                 goto out;
3670
3671         ad->u.net->v6info.saddr = ip6->saddr;
3672         ad->u.net->v6info.daddr = ip6->daddr;
3673         ret = 0;
3674
3675         nexthdr = ip6->nexthdr;
3676         offset += sizeof(_ipv6h);
3677         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3678         if (offset < 0)
3679                 goto out;
3680
3681         if (proto)
3682                 *proto = nexthdr;
3683
3684         switch (nexthdr) {
3685         case IPPROTO_TCP: {
3686                 struct tcphdr _tcph, *th;
3687
3688                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3689                 if (th == NULL)
3690                         break;
3691
3692                 ad->u.net->sport = th->source;
3693                 ad->u.net->dport = th->dest;
3694                 break;
3695         }
3696
3697         case IPPROTO_UDP: {
3698                 struct udphdr _udph, *uh;
3699
3700                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3701                 if (uh == NULL)
3702                         break;
3703
3704                 ad->u.net->sport = uh->source;
3705                 ad->u.net->dport = uh->dest;
3706                 break;
3707         }
3708
3709         case IPPROTO_DCCP: {
3710                 struct dccp_hdr _dccph, *dh;
3711
3712                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3713                 if (dh == NULL)
3714                         break;
3715
3716                 ad->u.net->sport = dh->dccph_sport;
3717                 ad->u.net->dport = dh->dccph_dport;
3718                 break;
3719         }
3720
3721         /* includes fragments */
3722         default:
3723                 break;
3724         }
3725 out:
3726         return ret;
3727 }
3728
3729 #endif /* IPV6 */
3730
3731 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3732                              char **_addrp, int src, u8 *proto)
3733 {
3734         char *addrp;
3735         int ret;
3736
3737         switch (ad->u.net->family) {
3738         case PF_INET:
3739                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3740                 if (ret)
3741                         goto parse_error;
3742                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3743                                        &ad->u.net->v4info.daddr);
3744                 goto okay;
3745
3746 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3747         case PF_INET6:
3748                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3749                 if (ret)
3750                         goto parse_error;
3751                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3752                                        &ad->u.net->v6info.daddr);
3753                 goto okay;
3754 #endif  /* IPV6 */
3755         default:
3756                 addrp = NULL;
3757                 goto okay;
3758         }
3759
3760 parse_error:
3761         printk(KERN_WARNING
3762                "SELinux: failure in selinux_parse_skb(),"
3763                " unable to parse packet\n");
3764         return ret;
3765
3766 okay:
3767         if (_addrp)
3768                 *_addrp = addrp;
3769         return 0;
3770 }
3771
3772 /**
3773  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3774  * @skb: the packet
3775  * @family: protocol family
3776  * @sid: the packet's peer label SID
3777  *
3778  * Description:
3779  * Check the various different forms of network peer labeling and determine
3780  * the peer label/SID for the packet; most of the magic actually occurs in
3781  * the security server function security_net_peersid_cmp().  The function
3782  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3783  * or -EACCES if @sid is invalid due to inconsistencies with the different
3784  * peer labels.
3785  *
3786  */
3787 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3788 {
3789         int err;
3790         u32 xfrm_sid;
3791         u32 nlbl_sid;
3792         u32 nlbl_type;
3793
3794         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3795         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3796
3797         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3798         if (unlikely(err)) {
3799                 printk(KERN_WARNING
3800                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3801                        " unable to determine packet's peer label\n");
3802                 return -EACCES;
3803         }
3804
3805         return 0;
3806 }
3807
3808 /* socket security operations */
3809
3810 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3811                                  u16 secclass, u32 *socksid)
3812 {
3813         if (tsec->sockcreate_sid > SECSID_NULL) {
3814                 *socksid = tsec->sockcreate_sid;
3815                 return 0;
3816         }
3817
3818         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3819                                        socksid);
3820 }
3821
3822 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3823 {
3824         struct sk_security_struct *sksec = sk->sk_security;
3825         struct common_audit_data ad;
3826         struct lsm_network_audit net = {0,};
3827         u32 tsid = task_sid(task);
3828
3829         if (sksec->sid == SECINITSID_KERNEL)
3830                 return 0;
3831
3832         ad.type = LSM_AUDIT_DATA_NET;
3833         ad.u.net = &net;
3834         ad.u.net->sk = sk;
3835
3836         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3837 }
3838
3839 static int selinux_socket_create(int family, int type,
3840                                  int protocol, int kern)
3841 {
3842         const struct task_security_struct *tsec = current_security();
3843         u32 newsid;
3844         u16 secclass;
3845         int rc;
3846
3847         if (kern)
3848                 return 0;
3849
3850         secclass = socket_type_to_security_class(family, type, protocol);
3851         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3852         if (rc)
3853                 return rc;
3854
3855         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3856 }
3857
3858 static int selinux_socket_post_create(struct socket *sock, int family,
3859                                       int type, int protocol, int kern)
3860 {
3861         const struct task_security_struct *tsec = current_security();
3862         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3863         struct sk_security_struct *sksec;
3864         int err = 0;
3865
3866         isec->sclass = socket_type_to_security_class(family, type, protocol);
3867
3868         if (kern)
3869                 isec->sid = SECINITSID_KERNEL;
3870         else {
3871                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3872                 if (err)
3873                         return err;
3874         }
3875
3876         isec->initialized = 1;
3877
3878         if (sock->sk) {
3879                 sksec = sock->sk->sk_security;
3880                 sksec->sid = isec->sid;
3881                 sksec->sclass = isec->sclass;
3882                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3883         }
3884
3885         return err;
3886 }
3887
3888 /* Range of port numbers used to automatically bind.
3889    Need to determine whether we should perform a name_bind
3890    permission check between the socket and the port number. */
3891
3892 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3893 {
3894         struct sock *sk = sock->sk;
3895         u16 family;
3896         int err;
3897
3898         err = sock_has_perm(current, sk, SOCKET__BIND);
3899         if (err)
3900                 goto out;
3901
3902         /*
3903          * If PF_INET or PF_INET6, check name_bind permission for the port.
3904          * Multiple address binding for SCTP is not supported yet: we just
3905          * check the first address now.
3906          */
3907         family = sk->sk_family;
3908         if (family == PF_INET || family == PF_INET6) {
3909                 char *addrp;
3910                 struct sk_security_struct *sksec = sk->sk_security;
3911                 struct common_audit_data ad;
3912                 struct lsm_network_audit net = {0,};
3913                 struct sockaddr_in *addr4 = NULL;
3914                 struct sockaddr_in6 *addr6 = NULL;
3915                 unsigned short snum;
3916                 u32 sid, node_perm;
3917
3918                 if (family == PF_INET) {
3919                         addr4 = (struct sockaddr_in *)address;
3920                         snum = ntohs(addr4->sin_port);
3921                         addrp = (char *)&addr4->sin_addr.s_addr;
3922                 } else {
3923                         addr6 = (struct sockaddr_in6 *)address;
3924                         snum = ntohs(addr6->sin6_port);
3925                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3926                 }
3927
3928                 if (snum) {
3929                         int low, high;
3930
3931                         inet_get_local_port_range(&low, &high);
3932
3933                         if (snum < max(PROT_SOCK, low) || snum > high) {
3934                                 err = sel_netport_sid(sk->sk_protocol,
3935                                                       snum, &sid);
3936                                 if (err)
3937                                         goto out;
3938                                 ad.type = LSM_AUDIT_DATA_NET;
3939                                 ad.u.net = &net;
3940                                 ad.u.net->sport = htons(snum);
3941                                 ad.u.net->family = family;
3942                                 err = avc_has_perm(sksec->sid, sid,
3943                                                    sksec->sclass,
3944                                                    SOCKET__NAME_BIND, &ad);
3945                                 if (err)
3946                                         goto out;
3947                         }
3948                 }
3949
3950                 switch (sksec->sclass) {
3951                 case SECCLASS_TCP_SOCKET:
3952                         node_perm = TCP_SOCKET__NODE_BIND;
3953                         break;
3954
3955                 case SECCLASS_UDP_SOCKET:
3956                         node_perm = UDP_SOCKET__NODE_BIND;
3957                         break;
3958
3959                 case SECCLASS_DCCP_SOCKET:
3960                         node_perm = DCCP_SOCKET__NODE_BIND;
3961                         break;
3962
3963                 default:
3964                         node_perm = RAWIP_SOCKET__NODE_BIND;
3965                         break;
3966                 }
3967
3968                 err = sel_netnode_sid(addrp, family, &sid);
3969                 if (err)
3970                         goto out;
3971
3972                 ad.type = LSM_AUDIT_DATA_NET;
3973                 ad.u.net = &net;
3974                 ad.u.net->sport = htons(snum);
3975                 ad.u.net->family = family;
3976
3977                 if (family == PF_INET)
3978                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3979                 else
3980                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3981
3982                 err = avc_has_perm(sksec->sid, sid,
3983                                    sksec->sclass, node_perm, &ad);
3984                 if (err)
3985                         goto out;
3986         }
3987 out:
3988         return err;
3989 }
3990
3991 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3992 {
3993         struct sock *sk = sock->sk;
3994         struct sk_security_struct *sksec = sk->sk_security;
3995         int err;
3996
3997         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3998         if (err)
3999                 return err;
4000
4001         /*
4002          * If a TCP or DCCP socket, check name_connect permission for the port.
4003          */
4004         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4005             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4006                 struct common_audit_data ad;
4007                 struct lsm_network_audit net = {0,};
4008                 struct sockaddr_in *addr4 = NULL;
4009                 struct sockaddr_in6 *addr6 = NULL;
4010                 unsigned short snum;
4011                 u32 sid, perm;
4012
4013                 if (sk->sk_family == PF_INET) {
4014                         addr4 = (struct sockaddr_in *)address;
4015                         if (addrlen < sizeof(struct sockaddr_in))
4016                                 return -EINVAL;
4017                         snum = ntohs(addr4->sin_port);
4018                 } else {
4019                         addr6 = (struct sockaddr_in6 *)address;
4020                         if (addrlen < SIN6_LEN_RFC2133)
4021                                 return -EINVAL;
4022                         snum = ntohs(addr6->sin6_port);
4023                 }
4024
4025                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4026                 if (err)
4027                         goto out;
4028
4029                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4030                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4031
4032                 ad.type = LSM_AUDIT_DATA_NET;
4033                 ad.u.net = &net;
4034                 ad.u.net->dport = htons(snum);
4035                 ad.u.net->family = sk->sk_family;
4036                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4037                 if (err)
4038                         goto out;
4039         }
4040
4041         err = selinux_netlbl_socket_connect(sk, address);
4042
4043 out:
4044         return err;
4045 }
4046
4047 static int selinux_socket_listen(struct socket *sock, int backlog)
4048 {
4049         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4050 }
4051
4052 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4053 {
4054         int err;
4055         struct inode_security_struct *isec;
4056         struct inode_security_struct *newisec;
4057
4058         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4059         if (err)
4060                 return err;
4061
4062         newisec = SOCK_INODE(newsock)->i_security;
4063
4064         isec = SOCK_INODE(sock)->i_security;
4065         newisec->sclass = isec->sclass;
4066         newisec->sid = isec->sid;
4067         newisec->initialized = 1;
4068
4069         return 0;
4070 }
4071
4072 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4073                                   int size)
4074 {
4075         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4076 }
4077
4078 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4079                                   int size, int flags)
4080 {
4081         return sock_has_perm(current, sock->sk, SOCKET__READ);
4082 }
4083
4084 static int selinux_socket_getsockname(struct socket *sock)
4085 {
4086         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4087 }
4088
4089 static int selinux_socket_getpeername(struct socket *sock)
4090 {
4091         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4092 }
4093
4094 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4095 {
4096         int err;
4097
4098         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4099         if (err)
4100                 return err;
4101
4102         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4103 }
4104
4105 static int selinux_socket_getsockopt(struct socket *sock, int level,
4106                                      int optname)
4107 {
4108         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4109 }
4110
4111 static int selinux_socket_shutdown(struct socket *sock, int how)
4112 {
4113         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4114 }
4115
4116 static int selinux_socket_unix_stream_connect(struct sock *sock,
4117                                               struct sock *other,
4118                                               struct sock *newsk)
4119 {
4120         struct sk_security_struct *sksec_sock = sock->sk_security;
4121         struct sk_security_struct *sksec_other = other->sk_security;
4122         struct sk_security_struct *sksec_new = newsk->sk_security;
4123         struct common_audit_data ad;
4124         struct lsm_network_audit net = {0,};
4125         int err;
4126
4127         ad.type = LSM_AUDIT_DATA_NET;
4128         ad.u.net = &net;
4129         ad.u.net->sk = other;
4130
4131         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4132                            sksec_other->sclass,
4133                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4134         if (err)
4135                 return err;
4136
4137         /* server child socket */
4138         sksec_new->peer_sid = sksec_sock->sid;
4139         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4140                                     &sksec_new->sid);
4141         if (err)
4142                 return err;
4143
4144         /* connecting socket */
4145         sksec_sock->peer_sid = sksec_new->sid;
4146
4147         return 0;
4148 }
4149
4150 static int selinux_socket_unix_may_send(struct socket *sock,
4151                                         struct socket *other)
4152 {
4153         struct sk_security_struct *ssec = sock->sk->sk_security;
4154         struct sk_security_struct *osec = other->sk->sk_security;
4155         struct common_audit_data ad;
4156         struct lsm_network_audit net = {0,};
4157
4158         ad.type = LSM_AUDIT_DATA_NET;
4159         ad.u.net = &net;
4160         ad.u.net->sk = other->sk;
4161
4162         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4163                             &ad);
4164 }
4165
4166 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4167                                     u32 peer_sid,
4168                                     struct common_audit_data *ad)
4169 {
4170         int err;
4171         u32 if_sid;
4172         u32 node_sid;
4173
4174         err = sel_netif_sid(ifindex, &if_sid);
4175         if (err)
4176                 return err;
4177         err = avc_has_perm(peer_sid, if_sid,
4178                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4179         if (err)
4180                 return err;
4181
4182         err = sel_netnode_sid(addrp, family, &node_sid);
4183         if (err)
4184                 return err;
4185         return avc_has_perm(peer_sid, node_sid,
4186                             SECCLASS_NODE, NODE__RECVFROM, ad);
4187 }
4188
4189 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4190                                        u16 family)
4191 {
4192         int err = 0;
4193         struct sk_security_struct *sksec = sk->sk_security;
4194         u32 sk_sid = sksec->sid;
4195         struct common_audit_data ad;
4196         struct lsm_network_audit net = {0,};
4197         char *addrp;
4198
4199         ad.type = LSM_AUDIT_DATA_NET;
4200         ad.u.net = &net;
4201         ad.u.net->netif = skb->skb_iif;
4202         ad.u.net->family = family;
4203         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4204         if (err)
4205                 return err;
4206
4207         if (selinux_secmark_enabled()) {
4208                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4209                                    PACKET__RECV, &ad);
4210                 if (err)
4211                         return err;
4212         }
4213
4214         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4215         if (err)
4216                 return err;
4217         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4218
4219         return err;
4220 }
4221
4222 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4223 {
4224         int err;
4225         struct sk_security_struct *sksec = sk->sk_security;
4226         u16 family = sk->sk_family;
4227         u32 sk_sid = sksec->sid;
4228         struct common_audit_data ad;
4229         struct lsm_network_audit net = {0,};
4230         char *addrp;
4231         u8 secmark_active;
4232         u8 peerlbl_active;
4233
4234         if (family != PF_INET && family != PF_INET6)
4235                 return 0;
4236
4237         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4238         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4239                 family = PF_INET;
4240
4241         /* If any sort of compatibility mode is enabled then handoff processing
4242          * to the selinux_sock_rcv_skb_compat() function to deal with the
4243          * special handling.  We do this in an attempt to keep this function
4244          * as fast and as clean as possible. */
4245         if (!selinux_policycap_netpeer)
4246                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4247
4248         secmark_active = selinux_secmark_enabled();
4249         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4250         if (!secmark_active && !peerlbl_active)
4251                 return 0;
4252
4253         ad.type = LSM_AUDIT_DATA_NET;
4254         ad.u.net = &net;
4255         ad.u.net->netif = skb->skb_iif;
4256         ad.u.net->family = family;
4257         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4258         if (err)
4259                 return err;
4260
4261         if (peerlbl_active) {
4262                 u32 peer_sid;
4263
4264                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4265                 if (err)
4266                         return err;
4267                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4268                                                peer_sid, &ad);
4269                 if (err) {
4270                         selinux_netlbl_err(skb, err, 0);
4271                         return err;
4272                 }
4273                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4274                                    PEER__RECV, &ad);
4275                 if (err)
4276                         selinux_netlbl_err(skb, err, 0);
4277         }
4278
4279         if (secmark_active) {
4280                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4281                                    PACKET__RECV, &ad);
4282                 if (err)
4283                         return err;
4284         }
4285
4286         return err;
4287 }
4288
4289 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4290                                             int __user *optlen, unsigned len)
4291 {
4292         int err = 0;
4293         char *scontext;
4294         u32 scontext_len;
4295         struct sk_security_struct *sksec = sock->sk->sk_security;
4296         u32 peer_sid = SECSID_NULL;
4297
4298         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4299             sksec->sclass == SECCLASS_TCP_SOCKET)
4300                 peer_sid = sksec->peer_sid;
4301         if (peer_sid == SECSID_NULL)
4302                 return -ENOPROTOOPT;
4303
4304         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4305         if (err)
4306                 return err;
4307
4308         if (scontext_len > len) {
4309                 err = -ERANGE;
4310                 goto out_len;
4311         }
4312
4313         if (copy_to_user(optval, scontext, scontext_len))
4314                 err = -EFAULT;
4315
4316 out_len:
4317         if (put_user(scontext_len, optlen))
4318                 err = -EFAULT;
4319         kfree(scontext);
4320         return err;
4321 }
4322
4323 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4324 {
4325         u32 peer_secid = SECSID_NULL;
4326         u16 family;
4327
4328         if (skb && skb->protocol == htons(ETH_P_IP))
4329                 family = PF_INET;
4330         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4331                 family = PF_INET6;
4332         else if (sock)
4333                 family = sock->sk->sk_family;
4334         else
4335                 goto out;
4336
4337         if (sock && family == PF_UNIX)
4338                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4339         else if (skb)
4340                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4341
4342 out:
4343         *secid = peer_secid;
4344         if (peer_secid == SECSID_NULL)
4345                 return -EINVAL;
4346         return 0;
4347 }
4348
4349 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4350 {
4351         struct sk_security_struct *sksec;
4352
4353         sksec = kzalloc(sizeof(*sksec), priority);
4354         if (!sksec)
4355                 return -ENOMEM;
4356
4357         sksec->peer_sid = SECINITSID_UNLABELED;
4358         sksec->sid = SECINITSID_UNLABELED;
4359         selinux_netlbl_sk_security_reset(sksec);
4360         sk->sk_security = sksec;
4361
4362         return 0;
4363 }
4364
4365 static void selinux_sk_free_security(struct sock *sk)
4366 {
4367         struct sk_security_struct *sksec = sk->sk_security;
4368
4369         sk->sk_security = NULL;
4370         selinux_netlbl_sk_security_free(sksec);
4371         kfree(sksec);
4372 }
4373
4374 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4375 {
4376         struct sk_security_struct *sksec = sk->sk_security;
4377         struct sk_security_struct *newsksec = newsk->sk_security;
4378
4379         newsksec->sid = sksec->sid;
4380         newsksec->peer_sid = sksec->peer_sid;
4381         newsksec->sclass = sksec->sclass;
4382
4383         selinux_netlbl_sk_security_reset(newsksec);
4384 }
4385
4386 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4387 {
4388         if (!sk)
4389                 *secid = SECINITSID_ANY_SOCKET;
4390         else {
4391                 struct sk_security_struct *sksec = sk->sk_security;
4392
4393                 *secid = sksec->sid;
4394         }
4395 }
4396
4397 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4398 {
4399         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4400         struct sk_security_struct *sksec = sk->sk_security;
4401
4402         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4403             sk->sk_family == PF_UNIX)
4404                 isec->sid = sksec->sid;
4405         sksec->sclass = isec->sclass;
4406 }
4407
4408 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4409                                      struct request_sock *req)
4410 {
4411         struct sk_security_struct *sksec = sk->sk_security;
4412         int err;
4413         u16 family = sk->sk_family;
4414         u32 newsid;
4415         u32 peersid;
4416
4417         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4418         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4419                 family = PF_INET;
4420
4421         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4422         if (err)
4423                 return err;
4424         if (peersid == SECSID_NULL) {
4425                 req->secid = sksec->sid;
4426                 req->peer_secid = SECSID_NULL;
4427         } else {
4428                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4429                 if (err)
4430                         return err;
4431                 req->secid = newsid;
4432                 req->peer_secid = peersid;
4433         }
4434
4435         return selinux_netlbl_inet_conn_request(req, family);
4436 }
4437
4438 static void selinux_inet_csk_clone(struct sock *newsk,
4439                                    const struct request_sock *req)
4440 {
4441         struct sk_security_struct *newsksec = newsk->sk_security;
4442
4443         newsksec->sid = req->secid;
4444         newsksec->peer_sid = req->peer_secid;
4445         /* NOTE: Ideally, we should also get the isec->sid for the
4446            new socket in sync, but we don't have the isec available yet.
4447            So we will wait until sock_graft to do it, by which
4448            time it will have been created and available. */
4449
4450         /* We don't need to take any sort of lock here as we are the only
4451          * thread with access to newsksec */
4452         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4453 }
4454
4455 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4456 {
4457         u16 family = sk->sk_family;
4458         struct sk_security_struct *sksec = sk->sk_security;
4459
4460         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4461         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4462                 family = PF_INET;
4463
4464         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4465 }
4466
4467 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4468 {
4469         skb_set_owner_w(skb, sk);
4470 }
4471
4472 static int selinux_secmark_relabel_packet(u32 sid)
4473 {
4474         const struct task_security_struct *__tsec;
4475         u32 tsid;
4476
4477         __tsec = current_security();
4478         tsid = __tsec->sid;
4479
4480         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4481 }
4482
4483 static void selinux_secmark_refcount_inc(void)
4484 {
4485         atomic_inc(&selinux_secmark_refcount);
4486 }
4487
4488 static void selinux_secmark_refcount_dec(void)
4489 {
4490         atomic_dec(&selinux_secmark_refcount);
4491 }
4492
4493 static void selinux_req_classify_flow(const struct request_sock *req,
4494                                       struct flowi *fl)
4495 {
4496         fl->flowi_secid = req->secid;
4497 }
4498
4499 static int selinux_tun_dev_alloc_security(void **security)
4500 {
4501         struct tun_security_struct *tunsec;
4502
4503         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4504         if (!tunsec)
4505                 return -ENOMEM;
4506         tunsec->sid = current_sid();
4507
4508         *security = tunsec;
4509         return 0;
4510 }
4511
4512 static void selinux_tun_dev_free_security(void *security)
4513 {
4514         kfree(security);
4515 }
4516
4517 static int selinux_tun_dev_create(void)
4518 {
4519         u32 sid = current_sid();
4520
4521         /* we aren't taking into account the "sockcreate" SID since the socket
4522          * that is being created here is not a socket in the traditional sense,
4523          * instead it is a private sock, accessible only to the kernel, and
4524          * representing a wide range of network traffic spanning multiple
4525          * connections unlike traditional sockets - check the TUN driver to
4526          * get a better understanding of why this socket is special */
4527
4528         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4529                             NULL);
4530 }
4531
4532 static int selinux_tun_dev_attach_queue(void *security)
4533 {
4534         struct tun_security_struct *tunsec = security;
4535
4536         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4537                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4538 }
4539
4540 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4541 {
4542         struct tun_security_struct *tunsec = security;
4543         struct sk_security_struct *sksec = sk->sk_security;
4544
4545         /* we don't currently perform any NetLabel based labeling here and it
4546          * isn't clear that we would want to do so anyway; while we could apply
4547          * labeling without the support of the TUN user the resulting labeled
4548          * traffic from the other end of the connection would almost certainly
4549          * cause confusion to the TUN user that had no idea network labeling
4550          * protocols were being used */
4551
4552         sksec->sid = tunsec->sid;
4553         sksec->sclass = SECCLASS_TUN_SOCKET;
4554
4555         return 0;
4556 }
4557
4558 static int selinux_tun_dev_open(void *security)
4559 {
4560         struct tun_security_struct *tunsec = security;
4561         u32 sid = current_sid();
4562         int err;
4563
4564         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4565                            TUN_SOCKET__RELABELFROM, NULL);
4566         if (err)
4567                 return err;
4568         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4569                            TUN_SOCKET__RELABELTO, NULL);
4570         if (err)
4571                 return err;
4572         tunsec->sid = sid;
4573
4574         return 0;
4575 }
4576
4577 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4578 {
4579         int err = 0;
4580         u32 perm;
4581         struct nlmsghdr *nlh;
4582         struct sk_security_struct *sksec = sk->sk_security;
4583
4584         if (skb->len < NLMSG_HDRLEN) {
4585                 err = -EINVAL;
4586                 goto out;
4587         }
4588         nlh = nlmsg_hdr(skb);
4589
4590         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4591         if (err) {
4592                 if (err == -EINVAL) {
4593                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4594                                   "SELinux:  unrecognized netlink message"
4595                                   " type=%hu for sclass=%hu\n",
4596                                   nlh->nlmsg_type, sksec->sclass);
4597                         if (!selinux_enforcing || security_get_allow_unknown())
4598                                 err = 0;
4599                 }
4600
4601                 /* Ignore */
4602                 if (err == -ENOENT)
4603                         err = 0;
4604                 goto out;
4605         }
4606
4607         err = sock_has_perm(current, sk, perm);
4608 out:
4609         return err;
4610 }
4611
4612 #ifdef CONFIG_NETFILTER
4613
4614 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4615                                        u16 family)
4616 {
4617         int err;
4618         char *addrp;
4619         u32 peer_sid;
4620         struct common_audit_data ad;
4621         struct lsm_network_audit net = {0,};
4622         u8 secmark_active;
4623         u8 netlbl_active;
4624         u8 peerlbl_active;
4625
4626         if (!selinux_policycap_netpeer)
4627                 return NF_ACCEPT;
4628
4629         secmark_active = selinux_secmark_enabled();
4630         netlbl_active = netlbl_enabled();
4631         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4632         if (!secmark_active && !peerlbl_active)
4633                 return NF_ACCEPT;
4634
4635         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4636                 return NF_DROP;
4637
4638         ad.type = LSM_AUDIT_DATA_NET;
4639         ad.u.net = &net;
4640         ad.u.net->netif = ifindex;
4641         ad.u.net->family = family;
4642         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4643                 return NF_DROP;
4644
4645         if (peerlbl_active) {
4646                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4647                                                peer_sid, &ad);
4648                 if (err) {
4649                         selinux_netlbl_err(skb, err, 1);
4650                         return NF_DROP;
4651                 }
4652         }
4653
4654         if (secmark_active)
4655                 if (avc_has_perm(peer_sid, skb->secmark,
4656                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4657                         return NF_DROP;
4658
4659         if (netlbl_active)
4660                 /* we do this in the FORWARD path and not the POST_ROUTING
4661                  * path because we want to make sure we apply the necessary
4662                  * labeling before IPsec is applied so we can leverage AH
4663                  * protection */
4664                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4665                         return NF_DROP;
4666
4667         return NF_ACCEPT;
4668 }
4669
4670 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4671                                          struct sk_buff *skb,
4672                                          const struct net_device *in,
4673                                          const struct net_device *out,
4674                                          int (*okfn)(struct sk_buff *))
4675 {
4676         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4677 }
4678
4679 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4680 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4681                                          struct sk_buff *skb,
4682                                          const struct net_device *in,
4683                                          const struct net_device *out,
4684                                          int (*okfn)(struct sk_buff *))
4685 {
4686         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4687 }
4688 #endif  /* IPV6 */
4689
4690 static unsigned int selinux_ip_output(struct sk_buff *skb,
4691                                       u16 family)
4692 {
4693         u32 sid;
4694
4695         if (!netlbl_enabled())
4696                 return NF_ACCEPT;
4697
4698         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4699          * because we want to make sure we apply the necessary labeling
4700          * before IPsec is applied so we can leverage AH protection */
4701         if (skb->sk) {
4702                 struct sk_security_struct *sksec = skb->sk->sk_security;
4703                 sid = sksec->sid;
4704         } else
4705                 sid = SECINITSID_KERNEL;
4706         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4707                 return NF_DROP;
4708
4709         return NF_ACCEPT;
4710 }
4711
4712 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4713                                         struct sk_buff *skb,
4714                                         const struct net_device *in,
4715                                         const struct net_device *out,
4716                                         int (*okfn)(struct sk_buff *))
4717 {
4718         return selinux_ip_output(skb, PF_INET);
4719 }
4720
4721 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4722                                                 int ifindex,
4723                                                 u16 family)
4724 {
4725         struct sock *sk = skb->sk;
4726         struct sk_security_struct *sksec;
4727         struct common_audit_data ad;
4728         struct lsm_network_audit net = {0,};
4729         char *addrp;
4730         u8 proto;
4731
4732         if (sk == NULL)
4733                 return NF_ACCEPT;
4734         sksec = sk->sk_security;
4735
4736         ad.type = LSM_AUDIT_DATA_NET;
4737         ad.u.net = &net;
4738         ad.u.net->netif = ifindex;
4739         ad.u.net->family = family;
4740         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4741                 return NF_DROP;
4742
4743         if (selinux_secmark_enabled())
4744                 if (avc_has_perm(sksec->sid, skb->secmark,
4745                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4746                         return NF_DROP_ERR(-ECONNREFUSED);
4747
4748         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4749                 return NF_DROP_ERR(-ECONNREFUSED);
4750
4751         return NF_ACCEPT;
4752 }
4753
4754 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4755                                          u16 family)
4756 {
4757         u32 secmark_perm;
4758         u32 peer_sid;
4759         struct sock *sk;
4760         struct common_audit_data ad;
4761         struct lsm_network_audit net = {0,};
4762         char *addrp;
4763         u8 secmark_active;
4764         u8 peerlbl_active;
4765
4766         /* If any sort of compatibility mode is enabled then handoff processing
4767          * to the selinux_ip_postroute_compat() function to deal with the
4768          * special handling.  We do this in an attempt to keep this function
4769          * as fast and as clean as possible. */
4770         if (!selinux_policycap_netpeer)
4771                 return selinux_ip_postroute_compat(skb, ifindex, family);
4772 #ifdef CONFIG_XFRM
4773         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4774          * packet transformation so allow the packet to pass without any checks
4775          * since we'll have another chance to perform access control checks
4776          * when the packet is on it's final way out.
4777          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4778          *       is NULL, in this case go ahead and apply access control. */
4779         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4780                 return NF_ACCEPT;
4781 #endif
4782         secmark_active = selinux_secmark_enabled();
4783         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4784         if (!secmark_active && !peerlbl_active)
4785                 return NF_ACCEPT;
4786
4787         /* if the packet is being forwarded then get the peer label from the
4788          * packet itself; otherwise check to see if it is from a local
4789          * application or the kernel, if from an application get the peer label
4790          * from the sending socket, otherwise use the kernel's sid */
4791         sk = skb->sk;
4792         if (sk == NULL) {
4793                 if (skb->skb_iif) {
4794                         secmark_perm = PACKET__FORWARD_OUT;
4795                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4796                                 return NF_DROP;
4797                 } else {
4798                         secmark_perm = PACKET__SEND;
4799                         peer_sid = SECINITSID_KERNEL;
4800                 }
4801         } else {
4802                 struct sk_security_struct *sksec = sk->sk_security;
4803                 peer_sid = sksec->sid;
4804                 secmark_perm = PACKET__SEND;
4805         }
4806
4807         ad.type = LSM_AUDIT_DATA_NET;
4808         ad.u.net = &net;
4809         ad.u.net->netif = ifindex;
4810         ad.u.net->family = family;
4811         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4812                 return NF_DROP;
4813
4814         if (secmark_active)
4815                 if (avc_has_perm(peer_sid, skb->secmark,
4816                                  SECCLASS_PACKET, secmark_perm, &ad))
4817                         return NF_DROP_ERR(-ECONNREFUSED);
4818
4819         if (peerlbl_active) {
4820                 u32 if_sid;
4821                 u32 node_sid;
4822
4823                 if (sel_netif_sid(ifindex, &if_sid))
4824                         return NF_DROP;
4825                 if (avc_has_perm(peer_sid, if_sid,
4826                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4827                         return NF_DROP_ERR(-ECONNREFUSED);
4828
4829                 if (sel_netnode_sid(addrp, family, &node_sid))
4830                         return NF_DROP;
4831                 if (avc_has_perm(peer_sid, node_sid,
4832                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4833                         return NF_DROP_ERR(-ECONNREFUSED);
4834         }
4835
4836         return NF_ACCEPT;
4837 }
4838
4839 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4840                                            struct sk_buff *skb,
4841                                            const struct net_device *in,
4842                                            const struct net_device *out,
4843                                            int (*okfn)(struct sk_buff *))
4844 {
4845         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4846 }
4847
4848 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4849 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4850                                            struct sk_buff *skb,
4851                                            const struct net_device *in,
4852                                            const struct net_device *out,
4853                                            int (*okfn)(struct sk_buff *))
4854 {
4855         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4856 }
4857 #endif  /* IPV6 */
4858
4859 #endif  /* CONFIG_NETFILTER */
4860
4861 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4862 {
4863         int err;
4864
4865         err = cap_netlink_send(sk, skb);
4866         if (err)
4867                 return err;
4868
4869         return selinux_nlmsg_perm(sk, skb);
4870 }
4871
4872 static int ipc_alloc_security(struct task_struct *task,
4873                               struct kern_ipc_perm *perm,
4874                               u16 sclass)
4875 {
4876         struct ipc_security_struct *isec;
4877         u32 sid;
4878
4879         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4880         if (!isec)
4881                 return -ENOMEM;
4882
4883         sid = task_sid(task);
4884         isec->sclass = sclass;
4885         isec->sid = sid;
4886         perm->security = isec;
4887
4888         return 0;
4889 }
4890
4891 static void ipc_free_security(struct kern_ipc_perm *perm)
4892 {
4893         struct ipc_security_struct *isec = perm->security;
4894         perm->security = NULL;
4895         kfree(isec);
4896 }
4897
4898 static int msg_msg_alloc_security(struct msg_msg *msg)
4899 {
4900         struct msg_security_struct *msec;
4901
4902         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4903         if (!msec)
4904                 return -ENOMEM;
4905
4906         msec->sid = SECINITSID_UNLABELED;
4907         msg->security = msec;
4908
4909         return 0;
4910 }
4911
4912 static void msg_msg_free_security(struct msg_msg *msg)
4913 {
4914         struct msg_security_struct *msec = msg->security;
4915
4916         msg->security = NULL;
4917         kfree(msec);
4918 }
4919
4920 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4921                         u32 perms)
4922 {
4923         struct ipc_security_struct *isec;
4924         struct common_audit_data ad;
4925         u32 sid = current_sid();
4926
4927         isec = ipc_perms->security;
4928
4929         ad.type = LSM_AUDIT_DATA_IPC;
4930         ad.u.ipc_id = ipc_perms->key;
4931
4932         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4933 }
4934
4935 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4936 {
4937         return msg_msg_alloc_security(msg);
4938 }
4939
4940 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4941 {
4942         msg_msg_free_security(msg);
4943 }
4944
4945 /* message queue security operations */
4946 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4947 {
4948         struct ipc_security_struct *isec;
4949         struct common_audit_data ad;
4950         u32 sid = current_sid();
4951         int rc;
4952
4953         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4954         if (rc)
4955                 return rc;
4956
4957         isec = msq->q_perm.security;
4958
4959         ad.type = LSM_AUDIT_DATA_IPC;
4960         ad.u.ipc_id = msq->q_perm.key;
4961
4962         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4963                           MSGQ__CREATE, &ad);
4964         if (rc) {
4965                 ipc_free_security(&msq->q_perm);
4966                 return rc;
4967         }
4968         return 0;
4969 }
4970
4971 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4972 {
4973         ipc_free_security(&msq->q_perm);
4974 }
4975
4976 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4977 {
4978         struct ipc_security_struct *isec;
4979         struct common_audit_data ad;
4980         u32 sid = current_sid();
4981
4982         isec = msq->q_perm.security;
4983
4984         ad.type = LSM_AUDIT_DATA_IPC;
4985         ad.u.ipc_id = msq->q_perm.key;
4986
4987         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4988                             MSGQ__ASSOCIATE, &ad);
4989 }
4990
4991 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4992 {
4993         int err;
4994         int perms;
4995
4996         switch (cmd) {
4997         case IPC_INFO:
4998         case MSG_INFO:
4999                 /* No specific object, just general system-wide information. */
5000                 return task_has_system(current, SYSTEM__IPC_INFO);
5001         case IPC_STAT:
5002         case MSG_STAT:
5003                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5004                 break;
5005         case IPC_SET:
5006                 perms = MSGQ__SETATTR;
5007                 break;
5008         case IPC_RMID:
5009                 perms = MSGQ__DESTROY;
5010                 break;
5011         default:
5012                 return 0;
5013         }
5014
5015         err = ipc_has_perm(&msq->q_perm, perms);
5016         return err;
5017 }
5018
5019 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5020 {
5021         struct ipc_security_struct *isec;
5022         struct msg_security_struct *msec;
5023         struct common_audit_data ad;
5024         u32 sid = current_sid();
5025         int rc;
5026
5027         isec = msq->q_perm.security;
5028         msec = msg->security;
5029
5030         /*
5031          * First time through, need to assign label to the message
5032          */
5033         if (msec->sid == SECINITSID_UNLABELED) {
5034                 /*
5035                  * Compute new sid based on current process and
5036                  * message queue this message will be stored in
5037                  */
5038                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5039                                              NULL, &msec->sid);
5040                 if (rc)
5041                         return rc;
5042         }
5043
5044         ad.type = LSM_AUDIT_DATA_IPC;
5045         ad.u.ipc_id = msq->q_perm.key;
5046
5047         /* Can this process write to the queue? */
5048         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5049                           MSGQ__WRITE, &ad);
5050         if (!rc)
5051                 /* Can this process send the message */
5052                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5053                                   MSG__SEND, &ad);
5054         if (!rc)
5055                 /* Can the message be put in the queue? */
5056                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5057                                   MSGQ__ENQUEUE, &ad);
5058
5059         return rc;
5060 }
5061
5062 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5063                                     struct task_struct *target,
5064                                     long type, int mode)
5065 {
5066         struct ipc_security_struct *isec;
5067         struct msg_security_struct *msec;
5068         struct common_audit_data ad;
5069         u32 sid = task_sid(target);
5070         int rc;
5071
5072         isec = msq->q_perm.security;
5073         msec = msg->security;
5074
5075         ad.type = LSM_AUDIT_DATA_IPC;
5076         ad.u.ipc_id = msq->q_perm.key;
5077
5078         rc = avc_has_perm(sid, isec->sid,
5079                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5080         if (!rc)
5081                 rc = avc_has_perm(sid, msec->sid,
5082                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5083         return rc;
5084 }
5085
5086 /* Shared Memory security operations */
5087 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5088 {
5089         struct ipc_security_struct *isec;
5090         struct common_audit_data ad;
5091         u32 sid = current_sid();
5092         int rc;
5093
5094         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5095         if (rc)
5096                 return rc;
5097
5098         isec = shp->shm_perm.security;
5099
5100         ad.type = LSM_AUDIT_DATA_IPC;
5101         ad.u.ipc_id = shp->shm_perm.key;
5102
5103         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5104                           SHM__CREATE, &ad);
5105         if (rc) {
5106                 ipc_free_security(&shp->shm_perm);
5107                 return rc;
5108         }
5109         return 0;
5110 }
5111
5112 static void selinux_shm_free_security(struct shmid_kernel *shp)
5113 {
5114         ipc_free_security(&shp->shm_perm);
5115 }
5116
5117 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5118 {
5119         struct ipc_security_struct *isec;
5120         struct common_audit_data ad;
5121         u32 sid = current_sid();
5122
5123         isec = shp->shm_perm.security;
5124
5125         ad.type = LSM_AUDIT_DATA_IPC;
5126         ad.u.ipc_id = shp->shm_perm.key;
5127
5128         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5129                             SHM__ASSOCIATE, &ad);
5130 }
5131
5132 /* Note, at this point, shp is locked down */
5133 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5134 {
5135         int perms;
5136         int err;
5137
5138         switch (cmd) {
5139         case IPC_INFO:
5140         case SHM_INFO:
5141                 /* No specific object, just general system-wide information. */
5142                 return task_has_system(current, SYSTEM__IPC_INFO);
5143         case IPC_STAT:
5144         case SHM_STAT:
5145                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5146                 break;
5147         case IPC_SET:
5148                 perms = SHM__SETATTR;
5149                 break;
5150         case SHM_LOCK:
5151         case SHM_UNLOCK:
5152                 perms = SHM__LOCK;
5153                 break;
5154         case IPC_RMID:
5155                 perms = SHM__DESTROY;
5156                 break;
5157         default:
5158                 return 0;
5159         }
5160
5161         err = ipc_has_perm(&shp->shm_perm, perms);
5162         return err;
5163 }
5164
5165 static int selinux_shm_shmat(struct shmid_kernel *shp,
5166                              char __user *shmaddr, int shmflg)
5167 {
5168         u32 perms;
5169
5170         if (shmflg & SHM_RDONLY)
5171                 perms = SHM__READ;
5172         else
5173                 perms = SHM__READ | SHM__WRITE;
5174
5175         return ipc_has_perm(&shp->shm_perm, perms);
5176 }
5177
5178 /* Semaphore security operations */
5179 static int selinux_sem_alloc_security(struct sem_array *sma)
5180 {
5181         struct ipc_security_struct *isec;
5182         struct common_audit_data ad;
5183         u32 sid = current_sid();
5184         int rc;
5185
5186         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5187         if (rc)
5188                 return rc;
5189
5190         isec = sma->sem_perm.security;
5191
5192         ad.type = LSM_AUDIT_DATA_IPC;
5193         ad.u.ipc_id = sma->sem_perm.key;
5194
5195         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5196                           SEM__CREATE, &ad);
5197         if (rc) {
5198                 ipc_free_security(&sma->sem_perm);
5199                 return rc;
5200         }
5201         return 0;
5202 }
5203
5204 static void selinux_sem_free_security(struct sem_array *sma)
5205 {
5206         ipc_free_security(&sma->sem_perm);
5207 }
5208
5209 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5210 {
5211         struct ipc_security_struct *isec;
5212         struct common_audit_data ad;
5213         u32 sid = current_sid();
5214
5215         isec = sma->sem_perm.security;
5216
5217         ad.type = LSM_AUDIT_DATA_IPC;
5218         ad.u.ipc_id = sma->sem_perm.key;
5219
5220         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5221                             SEM__ASSOCIATE, &ad);
5222 }
5223
5224 /* Note, at this point, sma is locked down */
5225 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5226 {
5227         int err;
5228         u32 perms;
5229
5230         switch (cmd) {
5231         case IPC_INFO:
5232         case SEM_INFO:
5233                 /* No specific object, just general system-wide information. */
5234                 return task_has_system(current, SYSTEM__IPC_INFO);
5235         case GETPID:
5236         case GETNCNT:
5237         case GETZCNT:
5238                 perms = SEM__GETATTR;
5239                 break;
5240         case GETVAL:
5241         case GETALL:
5242                 perms = SEM__READ;
5243                 break;
5244         case SETVAL:
5245         case SETALL:
5246                 perms = SEM__WRITE;
5247                 break;
5248         case IPC_RMID:
5249                 perms = SEM__DESTROY;
5250                 break;
5251         case IPC_SET:
5252                 perms = SEM__SETATTR;
5253                 break;
5254         case IPC_STAT:
5255         case SEM_STAT:
5256                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5257                 break;
5258         default:
5259                 return 0;
5260         }
5261
5262         err = ipc_has_perm(&sma->sem_perm, perms);
5263         return err;
5264 }
5265
5266 static int selinux_sem_semop(struct sem_array *sma,
5267                              struct sembuf *sops, unsigned nsops, int alter)
5268 {
5269         u32 perms;
5270
5271         if (alter)
5272                 perms = SEM__READ | SEM__WRITE;
5273         else
5274                 perms = SEM__READ;
5275
5276         return ipc_has_perm(&sma->sem_perm, perms);
5277 }
5278
5279 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5280 {
5281         u32 av = 0;
5282
5283         av = 0;
5284         if (flag & S_IRUGO)
5285                 av |= IPC__UNIX_READ;
5286         if (flag & S_IWUGO)
5287                 av |= IPC__UNIX_WRITE;
5288
5289         if (av == 0)
5290                 return 0;
5291
5292         return ipc_has_perm(ipcp, av);
5293 }
5294
5295 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5296 {
5297         struct ipc_security_struct *isec = ipcp->security;
5298         *secid = isec->sid;
5299 }
5300
5301 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5302 {
5303         if (inode)
5304                 inode_doinit_with_dentry(inode, dentry);
5305 }
5306
5307 static int selinux_getprocattr(struct task_struct *p,
5308                                char *name, char **value)
5309 {
5310         const struct task_security_struct *__tsec;
5311         u32 sid;
5312         int error;
5313         unsigned len;
5314
5315         if (current != p) {
5316                 error = current_has_perm(p, PROCESS__GETATTR);
5317                 if (error)
5318                         return error;
5319         }
5320
5321         rcu_read_lock();
5322         __tsec = __task_cred(p)->security;
5323
5324         if (!strcmp(name, "current"))
5325                 sid = __tsec->sid;
5326         else if (!strcmp(name, "prev"))
5327                 sid = __tsec->osid;
5328         else if (!strcmp(name, "exec"))
5329                 sid = __tsec->exec_sid;
5330         else if (!strcmp(name, "fscreate"))
5331                 sid = __tsec->create_sid;
5332         else if (!strcmp(name, "keycreate"))
5333                 sid = __tsec->keycreate_sid;
5334         else if (!strcmp(name, "sockcreate"))
5335                 sid = __tsec->sockcreate_sid;
5336         else
5337                 goto invalid;
5338         rcu_read_unlock();
5339
5340         if (!sid)
5341                 return 0;
5342
5343         error = security_sid_to_context(sid, value, &len);
5344         if (error)
5345                 return error;
5346         return len;
5347
5348 invalid:
5349         rcu_read_unlock();
5350         return -EINVAL;
5351 }
5352
5353 static int selinux_setprocattr(struct task_struct *p,
5354                                char *name, void *value, size_t size)
5355 {
5356         struct task_security_struct *tsec;
5357         struct task_struct *tracer;
5358         struct cred *new;
5359         u32 sid = 0, ptsid;
5360         int error;
5361         char *str = value;
5362
5363         if (current != p) {
5364                 /* SELinux only allows a process to change its own
5365                    security attributes. */
5366                 return -EACCES;
5367         }
5368
5369         /*
5370          * Basic control over ability to set these attributes at all.
5371          * current == p, but we'll pass them separately in case the
5372          * above restriction is ever removed.
5373          */
5374         if (!strcmp(name, "exec"))
5375                 error = current_has_perm(p, PROCESS__SETEXEC);
5376         else if (!strcmp(name, "fscreate"))
5377                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5378         else if (!strcmp(name, "keycreate"))
5379                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5380         else if (!strcmp(name, "sockcreate"))
5381                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5382         else if (!strcmp(name, "current"))
5383                 error = current_has_perm(p, PROCESS__SETCURRENT);
5384         else
5385                 error = -EINVAL;
5386         if (error)
5387                 return error;
5388
5389         /* Obtain a SID for the context, if one was specified. */
5390         if (size && str[1] && str[1] != '\n') {
5391                 if (str[size-1] == '\n') {
5392                         str[size-1] = 0;
5393                         size--;
5394                 }
5395                 error = security_context_to_sid(value, size, &sid);
5396                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5397                         if (!capable(CAP_MAC_ADMIN)) {
5398                                 struct audit_buffer *ab;
5399                                 size_t audit_size;
5400
5401                                 /* We strip a nul only if it is at the end, otherwise the
5402                                  * context contains a nul and we should audit that */
5403                                 if (str[size - 1] == '\0')
5404                                         audit_size = size - 1;
5405                                 else
5406                                         audit_size = size;
5407                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5408                                 audit_log_format(ab, "op=fscreate invalid_context=");
5409                                 audit_log_n_untrustedstring(ab, value, audit_size);
5410                                 audit_log_end(ab);
5411
5412                                 return error;
5413                         }
5414                         error = security_context_to_sid_force(value, size,
5415                                                               &sid);
5416                 }
5417                 if (error)
5418                         return error;
5419         }
5420
5421         new = prepare_creds();
5422         if (!new)
5423                 return -ENOMEM;
5424
5425         /* Permission checking based on the specified context is
5426            performed during the actual operation (execve,
5427            open/mkdir/...), when we know the full context of the
5428            operation.  See selinux_bprm_set_creds for the execve
5429            checks and may_create for the file creation checks. The
5430            operation will then fail if the context is not permitted. */
5431         tsec = new->security;
5432         if (!strcmp(name, "exec")) {
5433                 tsec->exec_sid = sid;
5434         } else if (!strcmp(name, "fscreate")) {
5435                 tsec->create_sid = sid;
5436         } else if (!strcmp(name, "keycreate")) {
5437                 error = may_create_key(sid, p);
5438                 if (error)
5439                         goto abort_change;
5440                 tsec->keycreate_sid = sid;
5441         } else if (!strcmp(name, "sockcreate")) {
5442                 tsec->sockcreate_sid = sid;
5443         } else if (!strcmp(name, "current")) {
5444                 error = -EINVAL;
5445                 if (sid == 0)
5446                         goto abort_change;
5447
5448                 /* Only allow single threaded processes to change context */
5449                 error = -EPERM;
5450                 if (!current_is_single_threaded()) {
5451                         error = security_bounded_transition(tsec->sid, sid);
5452                         if (error)
5453                                 goto abort_change;
5454                 }
5455
5456                 /* Check permissions for the transition. */
5457                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5458                                      PROCESS__DYNTRANSITION, NULL);
5459                 if (error)
5460                         goto abort_change;
5461
5462                 /* Check for ptracing, and update the task SID if ok.
5463                    Otherwise, leave SID unchanged and fail. */
5464                 ptsid = 0;
5465                 task_lock(p);
5466                 tracer = ptrace_parent(p);
5467                 if (tracer)
5468                         ptsid = task_sid(tracer);
5469                 task_unlock(p);
5470
5471                 if (tracer) {
5472                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5473                                              PROCESS__PTRACE, NULL);
5474                         if (error)
5475                                 goto abort_change;
5476                 }
5477
5478                 tsec->sid = sid;
5479         } else {
5480                 error = -EINVAL;
5481                 goto abort_change;
5482         }
5483
5484         commit_creds(new);
5485         return size;
5486
5487 abort_change:
5488         abort_creds(new);
5489         return error;
5490 }
5491
5492 static int selinux_ismaclabel(const char *name)
5493 {
5494         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5495 }
5496
5497 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5498 {
5499         return security_sid_to_context(secid, secdata, seclen);
5500 }
5501
5502 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5503 {
5504         return security_context_to_sid(secdata, seclen, secid);
5505 }
5506
5507 static void selinux_release_secctx(char *secdata, u32 seclen)
5508 {
5509         kfree(secdata);
5510 }
5511
5512 /*
5513  *      called with inode->i_mutex locked
5514  */
5515 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5516 {
5517         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5518 }
5519
5520 /*
5521  *      called with inode->i_mutex locked
5522  */
5523 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5524 {
5525         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5526 }
5527
5528 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5529 {
5530         int len = 0;
5531         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5532                                                 ctx, true);
5533         if (len < 0)
5534                 return len;
5535         *ctxlen = len;
5536         return 0;
5537 }
5538 #ifdef CONFIG_KEYS
5539
5540 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5541                              unsigned long flags)
5542 {
5543         const struct task_security_struct *tsec;
5544         struct key_security_struct *ksec;
5545
5546         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5547         if (!ksec)
5548                 return -ENOMEM;
5549
5550         tsec = cred->security;
5551         if (tsec->keycreate_sid)
5552                 ksec->sid = tsec->keycreate_sid;
5553         else
5554                 ksec->sid = tsec->sid;
5555
5556         k->security = ksec;
5557         return 0;
5558 }
5559
5560 static void selinux_key_free(struct key *k)
5561 {
5562         struct key_security_struct *ksec = k->security;
5563
5564         k->security = NULL;
5565         kfree(ksec);
5566 }
5567
5568 static int selinux_key_permission(key_ref_t key_ref,
5569                                   const struct cred *cred,
5570                                   key_perm_t perm)
5571 {
5572         struct key *key;
5573         struct key_security_struct *ksec;
5574         u32 sid;
5575
5576         /* if no specific permissions are requested, we skip the
5577            permission check. No serious, additional covert channels
5578            appear to be created. */
5579         if (perm == 0)
5580                 return 0;
5581
5582         sid = cred_sid(cred);
5583
5584         key = key_ref_to_ptr(key_ref);
5585         ksec = key->security;
5586
5587         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5588 }
5589
5590 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5591 {
5592         struct key_security_struct *ksec = key->security;
5593         char *context = NULL;
5594         unsigned len;
5595         int rc;
5596
5597         rc = security_sid_to_context(ksec->sid, &context, &len);
5598         if (!rc)
5599                 rc = len;
5600         *_buffer = context;
5601         return rc;
5602 }
5603
5604 #endif
5605
5606 static struct security_operations selinux_ops = {
5607         .name =                         "selinux",
5608
5609         .ptrace_access_check =          selinux_ptrace_access_check,
5610         .ptrace_traceme =               selinux_ptrace_traceme,
5611         .capget =                       selinux_capget,
5612         .capset =                       selinux_capset,
5613         .capable =                      selinux_capable,
5614         .quotactl =                     selinux_quotactl,
5615         .quota_on =                     selinux_quota_on,
5616         .syslog =                       selinux_syslog,
5617         .vm_enough_memory =             selinux_vm_enough_memory,
5618
5619         .netlink_send =                 selinux_netlink_send,
5620
5621         .bprm_set_creds =               selinux_bprm_set_creds,
5622         .bprm_committing_creds =        selinux_bprm_committing_creds,
5623         .bprm_committed_creds =         selinux_bprm_committed_creds,
5624         .bprm_secureexec =              selinux_bprm_secureexec,
5625
5626         .sb_alloc_security =            selinux_sb_alloc_security,
5627         .sb_free_security =             selinux_sb_free_security,
5628         .sb_copy_data =                 selinux_sb_copy_data,
5629         .sb_remount =                   selinux_sb_remount,
5630         .sb_kern_mount =                selinux_sb_kern_mount,
5631         .sb_show_options =              selinux_sb_show_options,
5632         .sb_statfs =                    selinux_sb_statfs,
5633         .sb_mount =                     selinux_mount,
5634         .sb_umount =                    selinux_umount,
5635         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5636         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5637         .sb_parse_opts_str =            selinux_parse_opts_str,
5638
5639         .dentry_init_security =         selinux_dentry_init_security,
5640
5641         .inode_alloc_security =         selinux_inode_alloc_security,
5642         .inode_free_security =          selinux_inode_free_security,
5643         .inode_init_security =          selinux_inode_init_security,
5644         .inode_create =                 selinux_inode_create,
5645         .inode_link =                   selinux_inode_link,
5646         .inode_unlink =                 selinux_inode_unlink,
5647         .inode_symlink =                selinux_inode_symlink,
5648         .inode_mkdir =                  selinux_inode_mkdir,
5649         .inode_rmdir =                  selinux_inode_rmdir,
5650         .inode_mknod =                  selinux_inode_mknod,
5651         .inode_rename =                 selinux_inode_rename,
5652         .inode_readlink =               selinux_inode_readlink,
5653         .inode_follow_link =            selinux_inode_follow_link,
5654         .inode_permission =             selinux_inode_permission,
5655         .inode_setattr =                selinux_inode_setattr,
5656         .inode_getattr =                selinux_inode_getattr,
5657         .inode_setxattr =               selinux_inode_setxattr,
5658         .inode_post_setxattr =          selinux_inode_post_setxattr,
5659         .inode_getxattr =               selinux_inode_getxattr,
5660         .inode_listxattr =              selinux_inode_listxattr,
5661         .inode_removexattr =            selinux_inode_removexattr,
5662         .inode_getsecurity =            selinux_inode_getsecurity,
5663         .inode_setsecurity =            selinux_inode_setsecurity,
5664         .inode_listsecurity =           selinux_inode_listsecurity,
5665         .inode_getsecid =               selinux_inode_getsecid,
5666
5667         .file_permission =              selinux_file_permission,
5668         .file_alloc_security =          selinux_file_alloc_security,
5669         .file_free_security =           selinux_file_free_security,
5670         .file_ioctl =                   selinux_file_ioctl,
5671         .mmap_file =                    selinux_mmap_file,
5672         .mmap_addr =                    selinux_mmap_addr,
5673         .file_mprotect =                selinux_file_mprotect,
5674         .file_lock =                    selinux_file_lock,
5675         .file_fcntl =                   selinux_file_fcntl,
5676         .file_set_fowner =              selinux_file_set_fowner,
5677         .file_send_sigiotask =          selinux_file_send_sigiotask,
5678         .file_receive =                 selinux_file_receive,
5679
5680         .file_open =                    selinux_file_open,
5681
5682         .task_create =                  selinux_task_create,
5683         .cred_alloc_blank =             selinux_cred_alloc_blank,
5684         .cred_free =                    selinux_cred_free,
5685         .cred_prepare =                 selinux_cred_prepare,
5686         .cred_transfer =                selinux_cred_transfer,
5687         .kernel_act_as =                selinux_kernel_act_as,
5688         .kernel_create_files_as =       selinux_kernel_create_files_as,
5689         .kernel_module_request =        selinux_kernel_module_request,
5690         .task_setpgid =                 selinux_task_setpgid,
5691         .task_getpgid =                 selinux_task_getpgid,
5692         .task_getsid =                  selinux_task_getsid,
5693         .task_getsecid =                selinux_task_getsecid,
5694         .task_setnice =                 selinux_task_setnice,
5695         .task_setioprio =               selinux_task_setioprio,
5696         .task_getioprio =               selinux_task_getioprio,
5697         .task_setrlimit =               selinux_task_setrlimit,
5698         .task_setscheduler =            selinux_task_setscheduler,
5699         .task_getscheduler =            selinux_task_getscheduler,
5700         .task_movememory =              selinux_task_movememory,
5701         .task_kill =                    selinux_task_kill,
5702         .task_wait =                    selinux_task_wait,
5703         .task_to_inode =                selinux_task_to_inode,
5704
5705         .ipc_permission =               selinux_ipc_permission,
5706         .ipc_getsecid =                 selinux_ipc_getsecid,
5707
5708         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5709         .msg_msg_free_security =        selinux_msg_msg_free_security,
5710
5711         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5712         .msg_queue_free_security =      selinux_msg_queue_free_security,
5713         .msg_queue_associate =          selinux_msg_queue_associate,
5714         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5715         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5716         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5717
5718         .shm_alloc_security =           selinux_shm_alloc_security,
5719         .shm_free_security =            selinux_shm_free_security,
5720         .shm_associate =                selinux_shm_associate,
5721         .shm_shmctl =                   selinux_shm_shmctl,
5722         .shm_shmat =                    selinux_shm_shmat,
5723
5724         .sem_alloc_security =           selinux_sem_alloc_security,
5725         .sem_free_security =            selinux_sem_free_security,
5726         .sem_associate =                selinux_sem_associate,
5727         .sem_semctl =                   selinux_sem_semctl,
5728         .sem_semop =                    selinux_sem_semop,
5729
5730         .d_instantiate =                selinux_d_instantiate,
5731
5732         .getprocattr =                  selinux_getprocattr,
5733         .setprocattr =                  selinux_setprocattr,
5734
5735         .ismaclabel =                   selinux_ismaclabel,
5736         .secid_to_secctx =              selinux_secid_to_secctx,
5737         .secctx_to_secid =              selinux_secctx_to_secid,
5738         .release_secctx =               selinux_release_secctx,
5739         .inode_notifysecctx =           selinux_inode_notifysecctx,
5740         .inode_setsecctx =              selinux_inode_setsecctx,
5741         .inode_getsecctx =              selinux_inode_getsecctx,
5742
5743         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5744         .unix_may_send =                selinux_socket_unix_may_send,
5745
5746         .socket_create =                selinux_socket_create,
5747         .socket_post_create =           selinux_socket_post_create,
5748         .socket_bind =                  selinux_socket_bind,
5749         .socket_connect =               selinux_socket_connect,
5750         .socket_listen =                selinux_socket_listen,
5751         .socket_accept =                selinux_socket_accept,
5752         .socket_sendmsg =               selinux_socket_sendmsg,
5753         .socket_recvmsg =               selinux_socket_recvmsg,
5754         .socket_getsockname =           selinux_socket_getsockname,
5755         .socket_getpeername =           selinux_socket_getpeername,
5756         .socket_getsockopt =            selinux_socket_getsockopt,
5757         .socket_setsockopt =            selinux_socket_setsockopt,
5758         .socket_shutdown =              selinux_socket_shutdown,
5759         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5760         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5761         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5762         .sk_alloc_security =            selinux_sk_alloc_security,
5763         .sk_free_security =             selinux_sk_free_security,
5764         .sk_clone_security =            selinux_sk_clone_security,
5765         .sk_getsecid =                  selinux_sk_getsecid,
5766         .sock_graft =                   selinux_sock_graft,
5767         .inet_conn_request =            selinux_inet_conn_request,
5768         .inet_csk_clone =               selinux_inet_csk_clone,
5769         .inet_conn_established =        selinux_inet_conn_established,
5770         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5771         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5772         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5773         .req_classify_flow =            selinux_req_classify_flow,
5774         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5775         .tun_dev_free_security =        selinux_tun_dev_free_security,
5776         .tun_dev_create =               selinux_tun_dev_create,
5777         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5778         .tun_dev_attach =               selinux_tun_dev_attach,
5779         .tun_dev_open =                 selinux_tun_dev_open,
5780         .skb_owned_by =                 selinux_skb_owned_by,
5781
5782 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5783         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5784         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5785         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5786         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5787         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5788         .xfrm_state_free_security =     selinux_xfrm_state_free,
5789         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5790         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5791         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5792         .xfrm_decode_session =          selinux_xfrm_decode_session,
5793 #endif
5794
5795 #ifdef CONFIG_KEYS
5796         .key_alloc =                    selinux_key_alloc,
5797         .key_free =                     selinux_key_free,
5798         .key_permission =               selinux_key_permission,
5799         .key_getsecurity =              selinux_key_getsecurity,
5800 #endif
5801
5802 #ifdef CONFIG_AUDIT
5803         .audit_rule_init =              selinux_audit_rule_init,
5804         .audit_rule_known =             selinux_audit_rule_known,
5805         .audit_rule_match =             selinux_audit_rule_match,
5806         .audit_rule_free =              selinux_audit_rule_free,
5807 #endif
5808 };
5809
5810 static __init int selinux_init(void)
5811 {
5812         if (!security_module_enable(&selinux_ops)) {
5813                 selinux_enabled = 0;
5814                 return 0;
5815         }
5816
5817         if (!selinux_enabled) {
5818                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5819                 return 0;
5820         }
5821
5822         printk(KERN_INFO "SELinux:  Initializing.\n");
5823
5824         /* Set the security state for the initial task. */
5825         cred_init_security();
5826
5827         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5828
5829         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5830                                             sizeof(struct inode_security_struct),
5831                                             0, SLAB_PANIC, NULL);
5832         avc_init();
5833
5834         if (register_security(&selinux_ops))
5835                 panic("SELinux: Unable to register with kernel.\n");
5836
5837         if (selinux_enforcing)
5838                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5839         else
5840                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5841
5842         return 0;
5843 }
5844
5845 static void delayed_superblock_init(struct super_block *sb, void *unused)
5846 {
5847         superblock_doinit(sb, NULL);
5848 }
5849
5850 void selinux_complete_init(void)
5851 {
5852         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5853
5854         /* Set up any superblocks initialized prior to the policy load. */
5855         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5856         iterate_supers(delayed_superblock_init, NULL);
5857 }
5858
5859 /* SELinux requires early initialization in order to label
5860    all processes and objects when they are created. */
5861 security_initcall(selinux_init);
5862
5863 #if defined(CONFIG_NETFILTER)
5864
5865 static struct nf_hook_ops selinux_ipv4_ops[] = {
5866         {
5867                 .hook =         selinux_ipv4_postroute,
5868                 .owner =        THIS_MODULE,
5869                 .pf =           NFPROTO_IPV4,
5870                 .hooknum =      NF_INET_POST_ROUTING,
5871                 .priority =     NF_IP_PRI_SELINUX_LAST,
5872         },
5873         {
5874                 .hook =         selinux_ipv4_forward,
5875                 .owner =        THIS_MODULE,
5876                 .pf =           NFPROTO_IPV4,
5877                 .hooknum =      NF_INET_FORWARD,
5878                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5879         },
5880         {
5881                 .hook =         selinux_ipv4_output,
5882                 .owner =        THIS_MODULE,
5883                 .pf =           NFPROTO_IPV4,
5884                 .hooknum =      NF_INET_LOCAL_OUT,
5885                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5886         }
5887 };
5888
5889 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5890
5891 static struct nf_hook_ops selinux_ipv6_ops[] = {
5892         {
5893                 .hook =         selinux_ipv6_postroute,
5894                 .owner =        THIS_MODULE,
5895                 .pf =           NFPROTO_IPV6,
5896                 .hooknum =      NF_INET_POST_ROUTING,
5897                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5898         },
5899         {
5900                 .hook =         selinux_ipv6_forward,
5901                 .owner =        THIS_MODULE,
5902                 .pf =           NFPROTO_IPV6,
5903                 .hooknum =      NF_INET_FORWARD,
5904                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5905         }
5906 };
5907
5908 #endif  /* IPV6 */
5909
5910 static int __init selinux_nf_ip_init(void)
5911 {
5912         int err = 0;
5913
5914         if (!selinux_enabled)
5915                 goto out;
5916
5917         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5918
5919         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5920         if (err)
5921                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5922
5923 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5924         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5925         if (err)
5926                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5927 #endif  /* IPV6 */
5928
5929 out:
5930         return err;
5931 }
5932
5933 __initcall(selinux_nf_ip_init);
5934
5935 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5936 static void selinux_nf_ip_exit(void)
5937 {
5938         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5939
5940         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5941 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5942         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5943 #endif  /* IPV6 */
5944 }
5945 #endif
5946
5947 #else /* CONFIG_NETFILTER */
5948
5949 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5950 #define selinux_nf_ip_exit()
5951 #endif
5952
5953 #endif /* CONFIG_NETFILTER */
5954
5955 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5956 static int selinux_disabled;
5957
5958 int selinux_disable(void)
5959 {
5960         if (ss_initialized) {
5961                 /* Not permitted after initial policy load. */
5962                 return -EINVAL;
5963         }
5964
5965         if (selinux_disabled) {
5966                 /* Only do this once. */
5967                 return -EINVAL;
5968         }
5969
5970         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5971
5972         selinux_disabled = 1;
5973         selinux_enabled = 0;
5974
5975         reset_security_ops();
5976
5977         /* Try to destroy the avc node cache */
5978         avc_disable();
5979
5980         /* Unregister netfilter hooks. */
5981         selinux_nf_ip_exit();
5982
5983         /* Unregister selinuxfs. */
5984         exit_sel_fs();
5985
5986         return 0;
5987 }
5988 #endif