security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 141  * policy capability is enabled, SECMARK is always considered enabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 147 }
 148
 149 /**
 150  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 151  *
 152  * Description:
 153  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 154  * (1) if any are enabled or false (0) if neither are enabled.  If the
 155  * always_check_network policy capability is enabled, peer labeling
 156  * is always considered enabled.
 157  *
 158  */
 159 static int selinux_peerlbl_enabled(void)
 160 {
 161         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 162 }
 163
 164 /*
 165  * initialise the security for the init task
 166  */
 167 static void cred_init_security(void)
 168 {
 169         struct cred *cred = (struct cred *) current->real_cred;
 170         struct task_security_struct *tsec;
 171
 172         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 173         if (!tsec)
 174                 panic("SELinux:  Failed to initialize initial task.\n");
 175
 176         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 177         cred->security = tsec;
 178 }
 179
 180 /*
 181  * get the security ID of a set of credentials
 182  */
 183 static inline u32 cred_sid(const struct cred *cred)
 184 {
 185         const struct task_security_struct *tsec;
 186
 187         tsec = cred->security;
 188         return tsec->sid;
 189 }
 190
 191 /*
 192  * get the objective security ID of a task
 193  */
 194 static inline u32 task_sid(const struct task_struct *task)
 195 {
 196         u32 sid;
 197
 198         rcu_read_lock();
 199         sid = cred_sid(__task_cred(task));
 200         rcu_read_unlock();
 201         return sid;
 202 }
 203
 204 /*
 205  * get the subjective security ID of the current task
 206  */
 207 static inline u32 current_sid(void)
 208 {
 209         const struct task_security_struct *tsec = current_security();
 210
 211         return tsec->sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         mutex_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         inode->i_security = isec;
 232
 233         return 0;
 234 }
 235
 236 static void inode_free_security(struct inode *inode)
 237 {
 238         struct inode_security_struct *isec = inode->i_security;
 239         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 240
 241         spin_lock(&sbsec->isec_lock);
 242         if (!list_empty(&isec->list))
 243                 list_del_init(&isec->list);
 244         spin_unlock(&sbsec->isec_lock);
 245
 246         inode->i_security = NULL;
 247         kmem_cache_free(sel_inode_cache, isec);
 248 }
 249
 250 static int file_alloc_security(struct file *file)
 251 {
 252         struct file_security_struct *fsec;
 253         u32 sid = current_sid();
 254
 255         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 256         if (!fsec)
 257                 return -ENOMEM;
 258
 259         fsec->sid = sid;
 260         fsec->fown_sid = sid;
 261         file->f_security = fsec;
 262
 263         return 0;
 264 }
 265
 266 static void file_free_security(struct file *file)
 267 {
 268         struct file_security_struct *fsec = file->f_security;
 269         file->f_security = NULL;
 270         kfree(fsec);
 271 }
 272
 273 static int superblock_alloc_security(struct super_block *sb)
 274 {
 275         struct superblock_security_struct *sbsec;
 276
 277         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 278         if (!sbsec)
 279                 return -ENOMEM;
 280
 281         mutex_init(&sbsec->lock);
 282         INIT_LIST_HEAD(&sbsec->isec_head);
 283         spin_lock_init(&sbsec->isec_lock);
 284         sbsec->sb = sb;
 285         sbsec->sid = SECINITSID_UNLABELED;
 286         sbsec->def_sid = SECINITSID_FILE;
 287         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 288         sb->s_security = sbsec;
 289
 290         return 0;
 291 }
 292
 293 static void superblock_free_security(struct super_block *sb)
 294 {
 295         struct superblock_security_struct *sbsec = sb->s_security;
 296         sb->s_security = NULL;
 297         kfree(sbsec);
 298 }
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static const char *labeling_behaviors[7] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309         "uses native labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_error = -1,
 321         Opt_context = 1,
 322         Opt_fscontext = 2,
 323         Opt_defcontext = 3,
 324         Opt_rootcontext = 4,
 325         Opt_labelsupport = 5,
 326         Opt_nextmntopt = 6,
 327 };
 328
 329 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 330
 331 static const match_table_t tokens = {
 332         {Opt_context, CONTEXT_STR "%s"},
 333         {Opt_fscontext, FSCONTEXT_STR "%s"},
 334         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 335         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 336         {Opt_labelsupport, LABELSUPP_STR},
 337         {Opt_error, NULL},
 338 };
 339
 340 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 341
 342 static int may_context_mount_sb_relabel(u32 sid,
 343                         struct superblock_security_struct *sbsec,
 344                         const struct cred *cred)
 345 {
 346         const struct task_security_struct *tsec = cred->security;
 347         int rc;
 348
 349         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 350                           FILESYSTEM__RELABELFROM, NULL);
 351         if (rc)
 352                 return rc;
 353
 354         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 355                           FILESYSTEM__RELABELTO, NULL);
 356         return rc;
 357 }
 358
 359 static int may_context_mount_inode_relabel(u32 sid,
 360                         struct superblock_security_struct *sbsec,
 361                         const struct cred *cred)
 362 {
 363         const struct task_security_struct *tsec = cred->security;
 364         int rc;
 365         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 366                           FILESYSTEM__RELABELFROM, NULL);
 367         if (rc)
 368                 return rc;
 369
 370         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 371                           FILESYSTEM__ASSOCIATE, NULL);
 372         return rc;
 373 }
 374
 375 static int selinux_is_sblabel_mnt(struct super_block *sb)
 376 {
 377         struct superblock_security_struct *sbsec = sb->s_security;
 378
 379         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 380             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 381             sbsec->behavior == SECURITY_FS_USE_TASK)
 382                 return 1;
 383
 384         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 385         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 386                 return 1;
 387
 388         /*
 389          * Special handling for rootfs. Is genfs but supports
 390          * setting SELinux context on in-core inodes.
 391          */
 392         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 393                 return 1;
 394
 395         return 0;
 396 }
 397
 398 static int sb_finish_set_opts(struct super_block *sb)
 399 {
 400         struct superblock_security_struct *sbsec = sb->s_security;
 401         struct dentry *root = sb->s_root;
 402         struct inode *root_inode = root->d_inode;
 403         int rc = 0;
 404
 405         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 406                 /* Make sure that the xattr handler exists and that no
 407                    error other than -ENODATA is returned by getxattr on
 408                    the root directory.  -ENODATA is ok, as this may be
 409                    the first boot of the SELinux kernel before we have
 410                    assigned xattr values to the filesystem. */
 411                 if (!root_inode->i_op->getxattr) {
 412                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 413                                "xattr support\n", sb->s_id, sb->s_type->name);
 414                         rc = -EOPNOTSUPP;
 415                         goto out;
 416                 }
 417                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 418                 if (rc < 0 && rc != -ENODATA) {
 419                         if (rc == -EOPNOTSUPP)
 420                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 421                                        "%s) has no security xattr handler\n",
 422                                        sb->s_id, sb->s_type->name);
 423                         else
 424                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 425                                        "%s) getxattr errno %d\n", sb->s_id,
 426                                        sb->s_type->name, -rc);
 427                         goto out;
 428                 }
 429         }
 430
 431         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 432                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 433                        sb->s_id, sb->s_type->name);
 434         else
 435                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 436                        sb->s_id, sb->s_type->name,
 437                        labeling_behaviors[sbsec->behavior-1]);
 438
 439         sbsec->flags |= SE_SBINITIALIZED;
 440         if (selinux_is_sblabel_mnt(sb))
 441                 sbsec->flags |= SBLABEL_MNT;
 442
 443         /* Initialize the root inode. */
 444         rc = inode_doinit_with_dentry(root_inode, root);
 445
 446         /* Initialize any other inodes associated with the superblock, e.g.
 447            inodes created prior to initial policy load or inodes created
 448            during get_sb by a pseudo filesystem that directly
 449            populates itself. */
 450         spin_lock(&sbsec->isec_lock);
 451 next_inode:
 452         if (!list_empty(&sbsec->isec_head)) {
 453                 struct inode_security_struct *isec =
 454                                 list_entry(sbsec->isec_head.next,
 455                                            struct inode_security_struct, list);
 456                 struct inode *inode = isec->inode;
 457                 spin_unlock(&sbsec->isec_lock);
 458                 inode = igrab(inode);
 459                 if (inode) {
 460                         if (!IS_PRIVATE(inode))
 461                                 inode_doinit(inode);
 462                         iput(inode);
 463                 }
 464                 spin_lock(&sbsec->isec_lock);
 465                 list_del_init(&isec->list);
 466                 goto next_inode;
 467         }
 468         spin_unlock(&sbsec->isec_lock);
 469 out:
 470         return rc;
 471 }
 472
 473 /*
 474  * This function should allow an FS to ask what it's mount security
 475  * options were so it can use those later for submounts, displaying
 476  * mount options, or whatever.
 477  */
 478 static int selinux_get_mnt_opts(const struct super_block *sb,
 479                                 struct security_mnt_opts *opts)
 480 {
 481         int rc = 0, i;
 482         struct superblock_security_struct *sbsec = sb->s_security;
 483         char *context = NULL;
 484         u32 len;
 485         char tmp;
 486
 487         security_init_mnt_opts(opts);
 488
 489         if (!(sbsec->flags & SE_SBINITIALIZED))
 490                 return -EINVAL;
 491
 492         if (!ss_initialized)
 493                 return -EINVAL;
 494
 495         /* make sure we always check enough bits to cover the mask */
 496         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 497
 498         tmp = sbsec->flags & SE_MNTMASK;
 499         /* count the number of mount options for this sb */
 500         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 501                 if (tmp & 0x01)
 502                         opts->num_mnt_opts++;
 503                 tmp >>= 1;
 504         }
 505         /* Check if the Label support flag is set */
 506         if (sbsec->flags & SBLABEL_MNT)
 507                 opts->num_mnt_opts++;
 508
 509         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 510         if (!opts->mnt_opts) {
 511                 rc = -ENOMEM;
 512                 goto out_free;
 513         }
 514
 515         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 516         if (!opts->mnt_opts_flags) {
 517                 rc = -ENOMEM;
 518                 goto out_free;
 519         }
 520
 521         i = 0;
 522         if (sbsec->flags & FSCONTEXT_MNT) {
 523                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 524                 if (rc)
 525                         goto out_free;
 526                 opts->mnt_opts[i] = context;
 527                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 528         }
 529         if (sbsec->flags & CONTEXT_MNT) {
 530                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 531                 if (rc)
 532                         goto out_free;
 533                 opts->mnt_opts[i] = context;
 534                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 535         }
 536         if (sbsec->flags & DEFCONTEXT_MNT) {
 537                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 538                 if (rc)
 539                         goto out_free;
 540                 opts->mnt_opts[i] = context;
 541                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 542         }
 543         if (sbsec->flags & ROOTCONTEXT_MNT) {
 544                 struct inode *root = sbsec->sb->s_root->d_inode;
 545                 struct inode_security_struct *isec = root->i_security;
 546
 547                 rc = security_sid_to_context(isec->sid, &context, &len);
 548                 if (rc)
 549                         goto out_free;
 550                 opts->mnt_opts[i] = context;
 551                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 552         }
 553         if (sbsec->flags & SBLABEL_MNT) {
 554                 opts->mnt_opts[i] = NULL;
 555                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 556         }
 557
 558         BUG_ON(i != opts->num_mnt_opts);
 559
 560         return 0;
 561
 562 out_free:
 563         security_free_mnt_opts(opts);
 564         return rc;
 565 }
 566
 567 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 568                       u32 old_sid, u32 new_sid)
 569 {
 570         char mnt_flags = sbsec->flags & SE_MNTMASK;
 571
 572         /* check if the old mount command had the same options */
 573         if (sbsec->flags & SE_SBINITIALIZED)
 574                 if (!(sbsec->flags & flag) ||
 575                     (old_sid != new_sid))
 576                         return 1;
 577
 578         /* check if we were passed the same options twice,
 579          * aka someone passed context=a,context=b
 580          */
 581         if (!(sbsec->flags & SE_SBINITIALIZED))
 582                 if (mnt_flags & flag)
 583                         return 1;
 584         return 0;
 585 }
 586
 587 /*
 588  * Allow filesystems with binary mount data to explicitly set mount point
 589  * labeling information.
 590  */
 591 static int selinux_set_mnt_opts(struct super_block *sb,
 592                                 struct security_mnt_opts *opts,
 593                                 unsigned long kern_flags,
 594                                 unsigned long *set_kern_flags)
 595 {
 596         const struct cred *cred = current_cred();
 597         int rc = 0, i;
 598         struct superblock_security_struct *sbsec = sb->s_security;
 599         const char *name = sb->s_type->name;
 600         struct inode *inode = sbsec->sb->s_root->d_inode;
 601         struct inode_security_struct *root_isec = inode->i_security;
 602         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 603         u32 defcontext_sid = 0;
 604         char **mount_options = opts->mnt_opts;
 605         int *flags = opts->mnt_opts_flags;
 606         int num_opts = opts->num_mnt_opts;
 607
 608         mutex_lock(&sbsec->lock);
 609
 610         if (!ss_initialized) {
 611                 if (!num_opts) {
 612                         /* Defer initialization until selinux_complete_init,
 613                            after the initial policy is loaded and the security
 614                            server is ready to handle calls. */
 615                         goto out;
 616                 }
 617                 rc = -EINVAL;
 618                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 619                         "before the security server is initialized\n");
 620                 goto out;
 621         }
 622         if (kern_flags && !set_kern_flags) {
 623                 /* Specifying internal flags without providing a place to
 624                  * place the results is not allowed */
 625                 rc = -EINVAL;
 626                 goto out;
 627         }
 628
 629         /*
 630          * Binary mount data FS will come through this function twice.  Once
 631          * from an explicit call and once from the generic calls from the vfs.
 632          * Since the generic VFS calls will not contain any security mount data
 633          * we need to skip the double mount verification.
 634          *
 635          * This does open a hole in which we will not notice if the first
 636          * mount using this sb set explict options and a second mount using
 637          * this sb does not set any security options.  (The first options
 638          * will be used for both mounts)
 639          */
 640         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 641             && (num_opts == 0))
 642                 goto out;
 643
 644         /*
 645          * parse the mount options, check if they are valid sids.
 646          * also check if someone is trying to mount the same sb more
 647          * than once with different security options.
 648          */
 649         for (i = 0; i < num_opts; i++) {
 650                 u32 sid;
 651
 652                 if (flags[i] == SBLABEL_MNT)
 653                         continue;
 654                 rc = security_context_to_sid(mount_options[i],
 655                                              strlen(mount_options[i]), &sid);
 656                 if (rc) {
 657                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 658                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 659                                mount_options[i], sb->s_id, name, rc);
 660                         goto out;
 661                 }
 662                 switch (flags[i]) {
 663                 case FSCONTEXT_MNT:
 664                         fscontext_sid = sid;
 665
 666                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 667                                         fscontext_sid))
 668                                 goto out_double_mount;
 669
 670                         sbsec->flags |= FSCONTEXT_MNT;
 671                         break;
 672                 case CONTEXT_MNT:
 673                         context_sid = sid;
 674
 675                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 676                                         context_sid))
 677                                 goto out_double_mount;
 678
 679                         sbsec->flags |= CONTEXT_MNT;
 680                         break;
 681                 case ROOTCONTEXT_MNT:
 682                         rootcontext_sid = sid;
 683
 684                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 685                                         rootcontext_sid))
 686                                 goto out_double_mount;
 687
 688                         sbsec->flags |= ROOTCONTEXT_MNT;
 689
 690                         break;
 691                 case DEFCONTEXT_MNT:
 692                         defcontext_sid = sid;
 693
 694                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 695                                         defcontext_sid))
 696                                 goto out_double_mount;
 697
 698                         sbsec->flags |= DEFCONTEXT_MNT;
 699
 700                         break;
 701                 default:
 702                         rc = -EINVAL;
 703                         goto out;
 704                 }
 705         }
 706
 707         if (sbsec->flags & SE_SBINITIALIZED) {
 708                 /* previously mounted with options, but not on this attempt? */
 709                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 710                         goto out_double_mount;
 711                 rc = 0;
 712                 goto out;
 713         }
 714
 715         if (strcmp(sb->s_type->name, "proc") == 0)
 716                 sbsec->flags |= SE_SBPROC;
 717
 718         if (!sbsec->behavior) {
 719                 /*
 720                  * Determine the labeling behavior to use for this
 721                  * filesystem type.
 722                  */
 723                 rc = security_fs_use(sb);
 724                 if (rc) {
 725                         printk(KERN_WARNING
 726                                 "%s: security_fs_use(%s) returned %d\n",
 727                                         __func__, sb->s_type->name, rc);
 728                         goto out;
 729                 }
 730         }
 731         /* sets the context of the superblock for the fs being mounted. */
 732         if (fscontext_sid) {
 733                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 734                 if (rc)
 735                         goto out;
 736
 737                 sbsec->sid = fscontext_sid;
 738         }
 739
 740         /*
 741          * Switch to using mount point labeling behavior.
 742          * sets the label used on all file below the mountpoint, and will set
 743          * the superblock context if not already set.
 744          */
 745         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 746                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 747                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 748         }
 749
 750         if (context_sid) {
 751                 if (!fscontext_sid) {
 752                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 753                                                           cred);
 754                         if (rc)
 755                                 goto out;
 756                         sbsec->sid = context_sid;
 757                 } else {
 758                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 759                                                              cred);
 760                         if (rc)
 761                                 goto out;
 762                 }
 763                 if (!rootcontext_sid)
 764                         rootcontext_sid = context_sid;
 765
 766                 sbsec->mntpoint_sid = context_sid;
 767                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 768         }
 769
 770         if (rootcontext_sid) {
 771                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 772                                                      cred);
 773                 if (rc)
 774                         goto out;
 775
 776                 root_isec->sid = rootcontext_sid;
 777                 root_isec->initialized = 1;
 778         }
 779
 780         if (defcontext_sid) {
 781                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 782                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 783                         rc = -EINVAL;
 784                         printk(KERN_WARNING "SELinux: defcontext option is "
 785                                "invalid for this filesystem type\n");
 786                         goto out;
 787                 }
 788
 789                 if (defcontext_sid != sbsec->def_sid) {
 790                         rc = may_context_mount_inode_relabel(defcontext_sid,
 791                                                              sbsec, cred);
 792                         if (rc)
 793                                 goto out;
 794                 }
 795
 796                 sbsec->def_sid = defcontext_sid;
 797         }
 798
 799         rc = sb_finish_set_opts(sb);
 800 out:
 801         mutex_unlock(&sbsec->lock);
 802         return rc;
 803 out_double_mount:
 804         rc = -EINVAL;
 805         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 806                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 807         goto out;
 808 }
 809
 810 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 811                                     const struct super_block *newsb)
 812 {
 813         struct superblock_security_struct *old = oldsb->s_security;
 814         struct superblock_security_struct *new = newsb->s_security;
 815         char oldflags = old->flags & SE_MNTMASK;
 816         char newflags = new->flags & SE_MNTMASK;
 817
 818         if (oldflags != newflags)
 819                 goto mismatch;
 820         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 821                 goto mismatch;
 822         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 823                 goto mismatch;
 824         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 825                 goto mismatch;
 826         if (oldflags & ROOTCONTEXT_MNT) {
 827                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 828                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 829                 if (oldroot->sid != newroot->sid)
 830                         goto mismatch;
 831         }
 832         return 0;
 833 mismatch:
 834         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 835                             "different security settings for (dev %s, "
 836                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 837         return -EBUSY;
 838 }
 839
 840 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 841                                         struct super_block *newsb)
 842 {
 843         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 844         struct superblock_security_struct *newsbsec = newsb->s_security;
 845
 846         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 847         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 848         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 849
 850         /*
 851          * if the parent was able to be mounted it clearly had no special lsm
 852          * mount options.  thus we can safely deal with this superblock later
 853          */
 854         if (!ss_initialized)
 855                 return 0;
 856
 857         /* how can we clone if the old one wasn't set up?? */
 858         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 859
 860         /* if fs is reusing a sb, make sure that the contexts match */
 861         if (newsbsec->flags & SE_SBINITIALIZED)
 862                 return selinux_cmp_sb_context(oldsb, newsb);
 863
 864         mutex_lock(&newsbsec->lock);
 865
 866         newsbsec->flags = oldsbsec->flags;
 867
 868         newsbsec->sid = oldsbsec->sid;
 869         newsbsec->def_sid = oldsbsec->def_sid;
 870         newsbsec->behavior = oldsbsec->behavior;
 871
 872         if (set_context) {
 873                 u32 sid = oldsbsec->mntpoint_sid;
 874
 875                 if (!set_fscontext)
 876                         newsbsec->sid = sid;
 877                 if (!set_rootcontext) {
 878                         struct inode *newinode = newsb->s_root->d_inode;
 879                         struct inode_security_struct *newisec = newinode->i_security;
 880                         newisec->sid = sid;
 881                 }
 882                 newsbsec->mntpoint_sid = sid;
 883         }
 884         if (set_rootcontext) {
 885                 const struct inode *oldinode = oldsb->s_root->d_inode;
 886                 const struct inode_security_struct *oldisec = oldinode->i_security;
 887                 struct inode *newinode = newsb->s_root->d_inode;
 888                 struct inode_security_struct *newisec = newinode->i_security;
 889
 890                 newisec->sid = oldisec->sid;
 891         }
 892
 893         sb_finish_set_opts(newsb);
 894         mutex_unlock(&newsbsec->lock);
 895         return 0;
 896 }
 897
 898 static int selinux_parse_opts_str(char *options,
 899                                   struct security_mnt_opts *opts)
 900 {
 901         char *p;
 902         char *context = NULL, *defcontext = NULL;
 903         char *fscontext = NULL, *rootcontext = NULL;
 904         int rc, num_mnt_opts = 0;
 905
 906         opts->num_mnt_opts = 0;
 907
 908         /* Standard string-based options. */
 909         while ((p = strsep(&options, "|")) != NULL) {
 910                 int token;
 911                 substring_t args[MAX_OPT_ARGS];
 912
 913                 if (!*p)
 914                         continue;
 915
 916                 token = match_token(p, tokens, args);
 917
 918                 switch (token) {
 919                 case Opt_context:
 920                         if (context || defcontext) {
 921                                 rc = -EINVAL;
 922                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 923                                 goto out_err;
 924                         }
 925                         context = match_strdup(&args[0]);
 926                         if (!context) {
 927                                 rc = -ENOMEM;
 928                                 goto out_err;
 929                         }
 930                         break;
 931
 932                 case Opt_fscontext:
 933                         if (fscontext) {
 934                                 rc = -EINVAL;
 935                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 936                                 goto out_err;
 937                         }
 938                         fscontext = match_strdup(&args[0]);
 939                         if (!fscontext) {
 940                                 rc = -ENOMEM;
 941                                 goto out_err;
 942                         }
 943                         break;
 944
 945                 case Opt_rootcontext:
 946                         if (rootcontext) {
 947                                 rc = -EINVAL;
 948                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 949                                 goto out_err;
 950                         }
 951                         rootcontext = match_strdup(&args[0]);
 952                         if (!rootcontext) {
 953                                 rc = -ENOMEM;
 954                                 goto out_err;
 955                         }
 956                         break;
 957
 958                 case Opt_defcontext:
 959                         if (context || defcontext) {
 960                                 rc = -EINVAL;
 961                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 962                                 goto out_err;
 963                         }
 964                         defcontext = match_strdup(&args[0]);
 965                         if (!defcontext) {
 966                                 rc = -ENOMEM;
 967                                 goto out_err;
 968                         }
 969                         break;
 970                 case Opt_labelsupport:
 971                         break;
 972                 default:
 973                         rc = -EINVAL;
 974                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 975                         goto out_err;
 976
 977                 }
 978         }
 979
 980         rc = -ENOMEM;
 981         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 982         if (!opts->mnt_opts)
 983                 goto out_err;
 984
 985         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 986         if (!opts->mnt_opts_flags) {
 987                 kfree(opts->mnt_opts);
 988                 goto out_err;
 989         }
 990
 991         if (fscontext) {
 992                 opts->mnt_opts[num_mnt_opts] = fscontext;
 993                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 994         }
 995         if (context) {
 996                 opts->mnt_opts[num_mnt_opts] = context;
 997                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 998         }
 999         if (rootcontext) {
1000                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1001                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1002         }
1003         if (defcontext) {
1004                 opts->mnt_opts[num_mnt_opts] = defcontext;
1005                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1006         }
1007
1008         opts->num_mnt_opts = num_mnt_opts;
1009         return 0;
1010
1011 out_err:
1012         kfree(context);
1013         kfree(defcontext);
1014         kfree(fscontext);
1015         kfree(rootcontext);
1016         return rc;
1017 }
1018 /*
1019  * string mount options parsing and call set the sbsec
1020  */
1021 static int superblock_doinit(struct super_block *sb, void *data)
1022 {
1023         int rc = 0;
1024         char *options = data;
1025         struct security_mnt_opts opts;
1026
1027         security_init_mnt_opts(&opts);
1028
1029         if (!data)
1030                 goto out;
1031
1032         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1033
1034         rc = selinux_parse_opts_str(options, &opts);
1035         if (rc)
1036                 goto out_err;
1037
1038 out:
1039         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1040
1041 out_err:
1042         security_free_mnt_opts(&opts);
1043         return rc;
1044 }
1045
1046 static void selinux_write_opts(struct seq_file *m,
1047                                struct security_mnt_opts *opts)
1048 {
1049         int i;
1050         char *prefix;
1051
1052         for (i = 0; i < opts->num_mnt_opts; i++) {
1053                 char *has_comma;
1054
1055                 if (opts->mnt_opts[i])
1056                         has_comma = strchr(opts->mnt_opts[i], ',');
1057                 else
1058                         has_comma = NULL;
1059
1060                 switch (opts->mnt_opts_flags[i]) {
1061                 case CONTEXT_MNT:
1062                         prefix = CONTEXT_STR;
1063                         break;
1064                 case FSCONTEXT_MNT:
1065                         prefix = FSCONTEXT_STR;
1066                         break;
1067                 case ROOTCONTEXT_MNT:
1068                         prefix = ROOTCONTEXT_STR;
1069                         break;
1070                 case DEFCONTEXT_MNT:
1071                         prefix = DEFCONTEXT_STR;
1072                         break;
1073                 case SBLABEL_MNT:
1074                         seq_putc(m, ',');
1075                         seq_puts(m, LABELSUPP_STR);
1076                         continue;
1077                 default:
1078                         BUG();
1079                         return;
1080                 };
1081                 /* we need a comma before each option */
1082                 seq_putc(m, ',');
1083                 seq_puts(m, prefix);
1084                 if (has_comma)
1085                         seq_putc(m, '\"');
1086                 seq_puts(m, opts->mnt_opts[i]);
1087                 if (has_comma)
1088                         seq_putc(m, '\"');
1089         }
1090 }
1091
1092 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1093 {
1094         struct security_mnt_opts opts;
1095         int rc;
1096
1097         rc = selinux_get_mnt_opts(sb, &opts);
1098         if (rc) {
1099                 /* before policy load we may get EINVAL, don't show anything */
1100                 if (rc == -EINVAL)
1101                         rc = 0;
1102                 return rc;
1103         }
1104
1105         selinux_write_opts(m, &opts);
1106
1107         security_free_mnt_opts(&opts);
1108
1109         return rc;
1110 }
1111
1112 static inline u16 inode_mode_to_security_class(umode_t mode)
1113 {
1114         switch (mode & S_IFMT) {
1115         case S_IFSOCK:
1116                 return SECCLASS_SOCK_FILE;
1117         case S_IFLNK:
1118                 return SECCLASS_LNK_FILE;
1119         case S_IFREG:
1120                 return SECCLASS_FILE;
1121         case S_IFBLK:
1122                 return SECCLASS_BLK_FILE;
1123         case S_IFDIR:
1124                 return SECCLASS_DIR;
1125         case S_IFCHR:
1126                 return SECCLASS_CHR_FILE;
1127         case S_IFIFO:
1128                 return SECCLASS_FIFO_FILE;
1129
1130         }
1131
1132         return SECCLASS_FILE;
1133 }
1134
1135 static inline int default_protocol_stream(int protocol)
1136 {
1137         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1138 }
1139
1140 static inline int default_protocol_dgram(int protocol)
1141 {
1142         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1143 }
1144
1145 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1146 {
1147         switch (family) {
1148         case PF_UNIX:
1149                 switch (type) {
1150                 case SOCK_STREAM:
1151                 case SOCK_SEQPACKET:
1152                         return SECCLASS_UNIX_STREAM_SOCKET;
1153                 case SOCK_DGRAM:
1154                         return SECCLASS_UNIX_DGRAM_SOCKET;
1155                 }
1156                 break;
1157         case PF_INET:
1158         case PF_INET6:
1159                 switch (type) {
1160                 case SOCK_STREAM:
1161                         if (default_protocol_stream(protocol))
1162                                 return SECCLASS_TCP_SOCKET;
1163                         else
1164                                 return SECCLASS_RAWIP_SOCKET;
1165                 case SOCK_DGRAM:
1166                         if (default_protocol_dgram(protocol))
1167                                 return SECCLASS_UDP_SOCKET;
1168                         else
1169                                 return SECCLASS_RAWIP_SOCKET;
1170                 case SOCK_DCCP:
1171                         return SECCLASS_DCCP_SOCKET;
1172                 default:
1173                         return SECCLASS_RAWIP_SOCKET;
1174                 }
1175                 break;
1176         case PF_NETLINK:
1177                 switch (protocol) {
1178                 case NETLINK_ROUTE:
1179                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1180                 case NETLINK_FIREWALL:
1181                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1182                 case NETLINK_SOCK_DIAG:
1183                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1184                 case NETLINK_NFLOG:
1185                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1186                 case NETLINK_XFRM:
1187                         return SECCLASS_NETLINK_XFRM_SOCKET;
1188                 case NETLINK_SELINUX:
1189                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1190                 case NETLINK_AUDIT:
1191                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1192                 case NETLINK_IP6_FW:
1193                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1194                 case NETLINK_DNRTMSG:
1195                         return SECCLASS_NETLINK_DNRT_SOCKET;
1196                 case NETLINK_KOBJECT_UEVENT:
1197                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1198                 default:
1199                         return SECCLASS_NETLINK_SOCKET;
1200                 }
1201         case PF_PACKET:
1202                 return SECCLASS_PACKET_SOCKET;
1203         case PF_KEY:
1204                 return SECCLASS_KEY_SOCKET;
1205         case PF_APPLETALK:
1206                 return SECCLASS_APPLETALK_SOCKET;
1207         }
1208
1209         return SECCLASS_SOCKET;
1210 }
1211
1212 #ifdef CONFIG_PROC_FS
1213 static int selinux_proc_get_sid(struct dentry *dentry,
1214                                 u16 tclass,
1215                                 u32 *sid)
1216 {
1217         int rc;
1218         char *buffer, *path;
1219
1220         buffer = (char *)__get_free_page(GFP_KERNEL);
1221         if (!buffer)
1222                 return -ENOMEM;
1223
1224         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1225         if (IS_ERR(path))
1226                 rc = PTR_ERR(path);
1227         else {
1228                 /* each process gets a /proc/PID/ entry. Strip off the
1229                  * PID part to get a valid selinux labeling.
1230                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1231                 while (path[1] >= '0' && path[1] <= '9') {
1232                         path[1] = '/';
1233                         path++;
1234                 }
1235                 rc = security_genfs_sid("proc", path, tclass, sid);
1236         }
1237         free_page((unsigned long)buffer);
1238         return rc;
1239 }
1240 #else
1241 static int selinux_proc_get_sid(struct dentry *dentry,
1242                                 u16 tclass,
1243                                 u32 *sid)
1244 {
1245         return -EINVAL;
1246 }
1247 #endif
1248
1249 /* The inode's security attributes must be initialized before first use. */
1250 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1251 {
1252         struct superblock_security_struct *sbsec = NULL;
1253         struct inode_security_struct *isec = inode->i_security;
1254         u32 sid;
1255         struct dentry *dentry;
1256 #define INITCONTEXTLEN 255
1257         char *context = NULL;
1258         unsigned len = 0;
1259         int rc = 0;
1260
1261         if (isec->initialized)
1262                 goto out;
1263
1264         mutex_lock(&isec->lock);
1265         if (isec->initialized)
1266                 goto out_unlock;
1267
1268         sbsec = inode->i_sb->s_security;
1269         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1270                 /* Defer initialization until selinux_complete_init,
1271                    after the initial policy is loaded and the security
1272                    server is ready to handle calls. */
1273                 spin_lock(&sbsec->isec_lock);
1274                 if (list_empty(&isec->list))
1275                         list_add(&isec->list, &sbsec->isec_head);
1276                 spin_unlock(&sbsec->isec_lock);
1277                 goto out_unlock;
1278         }
1279
1280         switch (sbsec->behavior) {
1281         case SECURITY_FS_USE_NATIVE:
1282                 break;
1283         case SECURITY_FS_USE_XATTR:
1284                 if (!inode->i_op->getxattr) {
1285                         isec->sid = sbsec->def_sid;
1286                         break;
1287                 }
1288
1289                 /* Need a dentry, since the xattr API requires one.
1290                    Life would be simpler if we could just pass the inode. */
1291                 if (opt_dentry) {
1292                         /* Called from d_instantiate or d_splice_alias. */
1293                         dentry = dget(opt_dentry);
1294                 } else {
1295                         /* Called from selinux_complete_init, try to find a dentry. */
1296                         dentry = d_find_alias(inode);
1297                 }
1298                 if (!dentry) {
1299                         /*
1300                          * this is can be hit on boot when a file is accessed
1301                          * before the policy is loaded.  When we load policy we
1302                          * may find inodes that have no dentry on the
1303                          * sbsec->isec_head list.  No reason to complain as these
1304                          * will get fixed up the next time we go through
1305                          * inode_doinit with a dentry, before these inodes could
1306                          * be used again by userspace.
1307                          */
1308                         goto out_unlock;
1309                 }
1310
1311                 len = INITCONTEXTLEN;
1312                 context = kmalloc(len+1, GFP_NOFS);
1313                 if (!context) {
1314                         rc = -ENOMEM;
1315                         dput(dentry);
1316                         goto out_unlock;
1317                 }
1318                 context[len] = '\0';
1319                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1320                                            context, len);
1321                 if (rc == -ERANGE) {
1322                         kfree(context);
1323
1324                         /* Need a larger buffer.  Query for the right size. */
1325                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1326                                                    NULL, 0);
1327                         if (rc < 0) {
1328                                 dput(dentry);
1329                                 goto out_unlock;
1330                         }
1331                         len = rc;
1332                         context = kmalloc(len+1, GFP_NOFS);
1333                         if (!context) {
1334                                 rc = -ENOMEM;
1335                                 dput(dentry);
1336                                 goto out_unlock;
1337                         }
1338                         context[len] = '\0';
1339                         rc = inode->i_op->getxattr(dentry,
1340                                                    XATTR_NAME_SELINUX,
1341                                                    context, len);
1342                 }
1343                 dput(dentry);
1344                 if (rc < 0) {
1345                         if (rc != -ENODATA) {
1346                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1347                                        "%d for dev=%s ino=%ld\n", __func__,
1348                                        -rc, inode->i_sb->s_id, inode->i_ino);
1349                                 kfree(context);
1350                                 goto out_unlock;
1351                         }
1352                         /* Map ENODATA to the default file SID */
1353                         sid = sbsec->def_sid;
1354                         rc = 0;
1355                 } else {
1356                         rc = security_context_to_sid_default(context, rc, &sid,
1357                                                              sbsec->def_sid,
1358                                                              GFP_NOFS);
1359                         if (rc) {
1360                                 char *dev = inode->i_sb->s_id;
1361                                 unsigned long ino = inode->i_ino;
1362
1363                                 if (rc == -EINVAL) {
1364                                         if (printk_ratelimit())
1365                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1366                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1367                                                         "filesystem in question.\n", ino, dev, context);
1368                                 } else {
1369                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1370                                                "returned %d for dev=%s ino=%ld\n",
1371                                                __func__, context, -rc, dev, ino);
1372                                 }
1373                                 kfree(context);
1374                                 /* Leave with the unlabeled SID */
1375                                 rc = 0;
1376                                 break;
1377                         }
1378                 }
1379                 kfree(context);
1380                 isec->sid = sid;
1381                 break;
1382         case SECURITY_FS_USE_TASK:
1383                 isec->sid = isec->task_sid;
1384                 break;
1385         case SECURITY_FS_USE_TRANS:
1386                 /* Default to the fs SID. */
1387                 isec->sid = sbsec->sid;
1388
1389                 /* Try to obtain a transition SID. */
1390                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1391                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1392                                              isec->sclass, NULL, &sid);
1393                 if (rc)
1394                         goto out_unlock;
1395                 isec->sid = sid;
1396                 break;
1397         case SECURITY_FS_USE_MNTPOINT:
1398                 isec->sid = sbsec->mntpoint_sid;
1399                 break;
1400         default:
1401                 /* Default to the fs superblock SID. */
1402                 isec->sid = sbsec->sid;
1403
1404                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1405                         if (opt_dentry) {
1406                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407                                 rc = selinux_proc_get_sid(opt_dentry,
1408                                                           isec->sclass,
1409                                                           &sid);
1410                                 if (rc)
1411                                         goto out_unlock;
1412                                 isec->sid = sid;
1413                         }
1414                 }
1415                 break;
1416         }
1417
1418         isec->initialized = 1;
1419
1420 out_unlock:
1421         mutex_unlock(&isec->lock);
1422 out:
1423         if (isec->sclass == SECCLASS_FILE)
1424                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1425         return rc;
1426 }
1427
1428 /* Convert a Linux signal to an access vector. */
1429 static inline u32 signal_to_av(int sig)
1430 {
1431         u32 perm = 0;
1432
1433         switch (sig) {
1434         case SIGCHLD:
1435                 /* Commonly granted from child to parent. */
1436                 perm = PROCESS__SIGCHLD;
1437                 break;
1438         case SIGKILL:
1439                 /* Cannot be caught or ignored */
1440                 perm = PROCESS__SIGKILL;
1441                 break;
1442         case SIGSTOP:
1443                 /* Cannot be caught or ignored */
1444                 perm = PROCESS__SIGSTOP;
1445                 break;
1446         default:
1447                 /* All other signals. */
1448                 perm = PROCESS__SIGNAL;
1449                 break;
1450         }
1451
1452         return perm;
1453 }
1454
1455 /*
1456  * Check permission between a pair of credentials
1457  * fork check, ptrace check, etc.
1458  */
1459 static int cred_has_perm(const struct cred *actor,
1460                          const struct cred *target,
1461                          u32 perms)
1462 {
1463         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1464
1465         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1466 }
1467
1468 /*
1469  * Check permission between a pair of tasks, e.g. signal checks,
1470  * fork check, ptrace check, etc.
1471  * tsk1 is the actor and tsk2 is the target
1472  * - this uses the default subjective creds of tsk1
1473  */
1474 static int task_has_perm(const struct task_struct *tsk1,
1475                          const struct task_struct *tsk2,
1476                          u32 perms)
1477 {
1478         const struct task_security_struct *__tsec1, *__tsec2;
1479         u32 sid1, sid2;
1480
1481         rcu_read_lock();
1482         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1483         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1484         rcu_read_unlock();
1485         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1486 }
1487
1488 /*
1489  * Check permission between current and another task, e.g. signal checks,
1490  * fork check, ptrace check, etc.
1491  * current is the actor and tsk2 is the target
1492  * - this uses current's subjective creds
1493  */
1494 static int current_has_perm(const struct task_struct *tsk,
1495                             u32 perms)
1496 {
1497         u32 sid, tsid;
1498
1499         sid = current_sid();
1500         tsid = task_sid(tsk);
1501         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1502 }
1503
1504 #if CAP_LAST_CAP > 63
1505 #error Fix SELinux to handle capabilities > 63.
1506 #endif
1507
1508 /* Check whether a task is allowed to use a capability. */
1509 static int cred_has_capability(const struct cred *cred,
1510                                int cap, int audit)
1511 {
1512         struct common_audit_data ad;
1513         struct av_decision avd;
1514         u16 sclass;
1515         u32 sid = cred_sid(cred);
1516         u32 av = CAP_TO_MASK(cap);
1517         int rc;
1518
1519         ad.type = LSM_AUDIT_DATA_CAP;
1520         ad.u.cap = cap;
1521
1522         switch (CAP_TO_INDEX(cap)) {
1523         case 0:
1524                 sclass = SECCLASS_CAPABILITY;
1525                 break;
1526         case 1:
1527                 sclass = SECCLASS_CAPABILITY2;
1528                 break;
1529         default:
1530                 printk(KERN_ERR
1531                        "SELinux:  out of range capability %d\n", cap);
1532                 BUG();
1533                 return -EINVAL;
1534         }
1535
1536         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1537         if (audit == SECURITY_CAP_AUDIT) {
1538                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1539                 if (rc2)
1540                         return rc2;
1541         }
1542         return rc;
1543 }
1544
1545 /* Check whether a task is allowed to use a system operation. */
1546 static int task_has_system(struct task_struct *tsk,
1547                            u32 perms)
1548 {
1549         u32 sid = task_sid(tsk);
1550
1551         return avc_has_perm(sid, SECINITSID_KERNEL,
1552                             SECCLASS_SYSTEM, perms, NULL);
1553 }
1554
1555 /* Check whether a task has a particular permission to an inode.
1556    The 'adp' parameter is optional and allows other audit
1557    data to be passed (e.g. the dentry). */
1558 static int inode_has_perm(const struct cred *cred,
1559                           struct inode *inode,
1560                           u32 perms,
1561                           struct common_audit_data *adp)
1562 {
1563         struct inode_security_struct *isec;
1564         u32 sid;
1565
1566         validate_creds(cred);
1567
1568         if (unlikely(IS_PRIVATE(inode)))
1569                 return 0;
1570
1571         sid = cred_sid(cred);
1572         isec = inode->i_security;
1573
1574         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1575 }
1576
1577 /* Same as inode_has_perm, but pass explicit audit data containing
1578    the dentry to help the auditing code to more easily generate the
1579    pathname if needed. */
1580 static inline int dentry_has_perm(const struct cred *cred,
1581                                   struct dentry *dentry,
1582                                   u32 av)
1583 {
1584         struct inode *inode = dentry->d_inode;
1585         struct common_audit_data ad;
1586
1587         ad.type = LSM_AUDIT_DATA_DENTRY;
1588         ad.u.dentry = dentry;
1589         return inode_has_perm(cred, inode, av, &ad);
1590 }
1591
1592 /* Same as inode_has_perm, but pass explicit audit data containing
1593    the path to help the auditing code to more easily generate the
1594    pathname if needed. */
1595 static inline int path_has_perm(const struct cred *cred,
1596                                 struct path *path,
1597                                 u32 av)
1598 {
1599         struct inode *inode = path->dentry->d_inode;
1600         struct common_audit_data ad;
1601
1602         ad.type = LSM_AUDIT_DATA_PATH;
1603         ad.u.path = *path;
1604         return inode_has_perm(cred, inode, av, &ad);
1605 }
1606
1607 /* Same as path_has_perm, but uses the inode from the file struct. */
1608 static inline int file_path_has_perm(const struct cred *cred,
1609                                      struct file *file,
1610                                      u32 av)
1611 {
1612         struct common_audit_data ad;
1613
1614         ad.type = LSM_AUDIT_DATA_PATH;
1615         ad.u.path = file->f_path;
1616         return inode_has_perm(cred, file_inode(file), av, &ad);
1617 }
1618
1619 /* Check whether a task can use an open file descriptor to
1620    access an inode in a given way.  Check access to the
1621    descriptor itself, and then use dentry_has_perm to
1622    check a particular permission to the file.
1623    Access to the descriptor is implicitly granted if it
1624    has the same SID as the process.  If av is zero, then
1625    access to the file is not checked, e.g. for cases
1626    where only the descriptor is affected like seek. */
1627 static int file_has_perm(const struct cred *cred,
1628                          struct file *file,
1629                          u32 av)
1630 {
1631         struct file_security_struct *fsec = file->f_security;
1632         struct inode *inode = file_inode(file);
1633         struct common_audit_data ad;
1634         u32 sid = cred_sid(cred);
1635         int rc;
1636
1637         ad.type = LSM_AUDIT_DATA_PATH;
1638         ad.u.path = file->f_path;
1639
1640         if (sid != fsec->sid) {
1641                 rc = avc_has_perm(sid, fsec->sid,
1642                                   SECCLASS_FD,
1643                                   FD__USE,
1644                                   &ad);
1645                 if (rc)
1646                         goto out;
1647         }
1648
1649         /* av is zero if only checking access to the descriptor. */
1650         rc = 0;
1651         if (av)
1652                 rc = inode_has_perm(cred, inode, av, &ad);
1653
1654 out:
1655         return rc;
1656 }
1657
1658 /* Check whether a task can create a file. */
1659 static int may_create(struct inode *dir,
1660                       struct dentry *dentry,
1661                       u16 tclass)
1662 {
1663         const struct task_security_struct *tsec = current_security();
1664         struct inode_security_struct *dsec;
1665         struct superblock_security_struct *sbsec;
1666         u32 sid, newsid;
1667         struct common_audit_data ad;
1668         int rc;
1669
1670         dsec = dir->i_security;
1671         sbsec = dir->i_sb->s_security;
1672
1673         sid = tsec->sid;
1674         newsid = tsec->create_sid;
1675
1676         ad.type = LSM_AUDIT_DATA_DENTRY;
1677         ad.u.dentry = dentry;
1678
1679         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1680                           DIR__ADD_NAME | DIR__SEARCH,
1681                           &ad);
1682         if (rc)
1683                 return rc;
1684
1685         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1686                 rc = security_transition_sid(sid, dsec->sid, tclass,
1687                                              &dentry->d_name, &newsid);
1688                 if (rc)
1689                         return rc;
1690         }
1691
1692         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1693         if (rc)
1694                 return rc;
1695
1696         return avc_has_perm(newsid, sbsec->sid,
1697                             SECCLASS_FILESYSTEM,
1698                             FILESYSTEM__ASSOCIATE, &ad);
1699 }
1700
1701 /* Check whether a task can create a key. */
1702 static int may_create_key(u32 ksid,
1703                           struct task_struct *ctx)
1704 {
1705         u32 sid = task_sid(ctx);
1706
1707         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1708 }
1709
1710 #define MAY_LINK        0
1711 #define MAY_UNLINK      1
1712 #define MAY_RMDIR       2
1713
1714 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1715 static int may_link(struct inode *dir,
1716                     struct dentry *dentry,
1717                     int kind)
1718
1719 {
1720         struct inode_security_struct *dsec, *isec;
1721         struct common_audit_data ad;
1722         u32 sid = current_sid();
1723         u32 av;
1724         int rc;
1725
1726         dsec = dir->i_security;
1727         isec = dentry->d_inode->i_security;
1728
1729         ad.type = LSM_AUDIT_DATA_DENTRY;
1730         ad.u.dentry = dentry;
1731
1732         av = DIR__SEARCH;
1733         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1734         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1735         if (rc)
1736                 return rc;
1737
1738         switch (kind) {
1739         case MAY_LINK:
1740                 av = FILE__LINK;
1741                 break;
1742         case MAY_UNLINK:
1743                 av = FILE__UNLINK;
1744                 break;
1745         case MAY_RMDIR:
1746                 av = DIR__RMDIR;
1747                 break;
1748         default:
1749                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1750                         __func__, kind);
1751                 return 0;
1752         }
1753
1754         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1755         return rc;
1756 }
1757
1758 static inline int may_rename(struct inode *old_dir,
1759                              struct dentry *old_dentry,
1760                              struct inode *new_dir,
1761                              struct dentry *new_dentry)
1762 {
1763         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1764         struct common_audit_data ad;
1765         u32 sid = current_sid();
1766         u32 av;
1767         int old_is_dir, new_is_dir;
1768         int rc;
1769
1770         old_dsec = old_dir->i_security;
1771         old_isec = old_dentry->d_inode->i_security;
1772         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1773         new_dsec = new_dir->i_security;
1774
1775         ad.type = LSM_AUDIT_DATA_DENTRY;
1776
1777         ad.u.dentry = old_dentry;
1778         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1779                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1780         if (rc)
1781                 return rc;
1782         rc = avc_has_perm(sid, old_isec->sid,
1783                           old_isec->sclass, FILE__RENAME, &ad);
1784         if (rc)
1785                 return rc;
1786         if (old_is_dir && new_dir != old_dir) {
1787                 rc = avc_has_perm(sid, old_isec->sid,
1788                                   old_isec->sclass, DIR__REPARENT, &ad);
1789                 if (rc)
1790                         return rc;
1791         }
1792
1793         ad.u.dentry = new_dentry;
1794         av = DIR__ADD_NAME | DIR__SEARCH;
1795         if (new_dentry->d_inode)
1796                 av |= DIR__REMOVE_NAME;
1797         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1798         if (rc)
1799                 return rc;
1800         if (new_dentry->d_inode) {
1801                 new_isec = new_dentry->d_inode->i_security;
1802                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1803                 rc = avc_has_perm(sid, new_isec->sid,
1804                                   new_isec->sclass,
1805                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1806                 if (rc)
1807                         return rc;
1808         }
1809
1810         return 0;
1811 }
1812
1813 /* Check whether a task can perform a filesystem operation. */
1814 static int superblock_has_perm(const struct cred *cred,
1815                                struct super_block *sb,
1816                                u32 perms,
1817                                struct common_audit_data *ad)
1818 {
1819         struct superblock_security_struct *sbsec;
1820         u32 sid = cred_sid(cred);
1821
1822         sbsec = sb->s_security;
1823         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1824 }
1825
1826 /* Convert a Linux mode and permission mask to an access vector. */
1827 static inline u32 file_mask_to_av(int mode, int mask)
1828 {
1829         u32 av = 0;
1830
1831         if (!S_ISDIR(mode)) {
1832                 if (mask & MAY_EXEC)
1833                         av |= FILE__EXECUTE;
1834                 if (mask & MAY_READ)
1835                         av |= FILE__READ;
1836
1837                 if (mask & MAY_APPEND)
1838                         av |= FILE__APPEND;
1839                 else if (mask & MAY_WRITE)
1840                         av |= FILE__WRITE;
1841
1842         } else {
1843                 if (mask & MAY_EXEC)
1844                         av |= DIR__SEARCH;
1845                 if (mask & MAY_WRITE)
1846                         av |= DIR__WRITE;
1847                 if (mask & MAY_READ)
1848                         av |= DIR__READ;
1849         }
1850
1851         return av;
1852 }
1853
1854 /* Convert a Linux file to an access vector. */
1855 static inline u32 file_to_av(struct file *file)
1856 {
1857         u32 av = 0;
1858
1859         if (file->f_mode & FMODE_READ)
1860                 av |= FILE__READ;
1861         if (file->f_mode & FMODE_WRITE) {
1862                 if (file->f_flags & O_APPEND)
1863                         av |= FILE__APPEND;
1864                 else
1865                         av |= FILE__WRITE;
1866         }
1867         if (!av) {
1868                 /*
1869                  * Special file opened with flags 3 for ioctl-only use.
1870                  */
1871                 av = FILE__IOCTL;
1872         }
1873
1874         return av;
1875 }
1876
1877 /*
1878  * Convert a file to an access vector and include the correct open
1879  * open permission.
1880  */
1881 static inline u32 open_file_to_av(struct file *file)
1882 {
1883         u32 av = file_to_av(file);
1884
1885         if (selinux_policycap_openperm)
1886                 av |= FILE__OPEN;
1887
1888         return av;
1889 }
1890
1891 /* Hook functions begin here. */
1892
1893 static int selinux_ptrace_access_check(struct task_struct *child,
1894                                      unsigned int mode)
1895 {
1896         int rc;
1897
1898         rc = cap_ptrace_access_check(child, mode);
1899         if (rc)
1900                 return rc;
1901
1902         if (mode & PTRACE_MODE_READ) {
1903                 u32 sid = current_sid();
1904                 u32 csid = task_sid(child);
1905                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1906         }
1907
1908         return current_has_perm(child, PROCESS__PTRACE);
1909 }
1910
1911 static int selinux_ptrace_traceme(struct task_struct *parent)
1912 {
1913         int rc;
1914
1915         rc = cap_ptrace_traceme(parent);
1916         if (rc)
1917                 return rc;
1918
1919         return task_has_perm(parent, current, PROCESS__PTRACE);
1920 }
1921
1922 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1923                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1924 {
1925         int error;
1926
1927         error = current_has_perm(target, PROCESS__GETCAP);
1928         if (error)
1929                 return error;
1930
1931         return cap_capget(target, effective, inheritable, permitted);
1932 }
1933
1934 static int selinux_capset(struct cred *new, const struct cred *old,
1935                           const kernel_cap_t *effective,
1936                           const kernel_cap_t *inheritable,
1937                           const kernel_cap_t *permitted)
1938 {
1939         int error;
1940
1941         error = cap_capset(new, old,
1942                                       effective, inheritable, permitted);
1943         if (error)
1944                 return error;
1945
1946         return cred_has_perm(old, new, PROCESS__SETCAP);
1947 }
1948
1949 /*
1950  * (This comment used to live with the selinux_task_setuid hook,
1951  * which was removed).
1952  *
1953  * Since setuid only affects the current process, and since the SELinux
1954  * controls are not based on the Linux identity attributes, SELinux does not
1955  * need to control this operation.  However, SELinux does control the use of
1956  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1957  */
1958
1959 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1960                            int cap, int audit)
1961 {
1962         int rc;
1963
1964         rc = cap_capable(cred, ns, cap, audit);
1965         if (rc)
1966                 return rc;
1967
1968         return cred_has_capability(cred, cap, audit);
1969 }
1970
1971 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1972 {
1973         const struct cred *cred = current_cred();
1974         int rc = 0;
1975
1976         if (!sb)
1977                 return 0;
1978
1979         switch (cmds) {
1980         case Q_SYNC:
1981         case Q_QUOTAON:
1982         case Q_QUOTAOFF:
1983         case Q_SETINFO:
1984         case Q_SETQUOTA:
1985                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1986                 break;
1987         case Q_GETFMT:
1988         case Q_GETINFO:
1989         case Q_GETQUOTA:
1990                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1991                 break;
1992         default:
1993                 rc = 0;  /* let the kernel handle invalid cmds */
1994                 break;
1995         }
1996         return rc;
1997 }
1998
1999 static int selinux_quota_on(struct dentry *dentry)
2000 {
2001         const struct cred *cred = current_cred();
2002
2003         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2004 }
2005
2006 static int selinux_syslog(int type)
2007 {
2008         int rc;
2009
2010         switch (type) {
2011         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2012         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2013                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2014                 break;
2015         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2016         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2017         /* Set level of messages printed to console */
2018         case SYSLOG_ACTION_CONSOLE_LEVEL:
2019                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2020                 break;
2021         case SYSLOG_ACTION_CLOSE:       /* Close log */
2022         case SYSLOG_ACTION_OPEN:        /* Open log */
2023         case SYSLOG_ACTION_READ:        /* Read from log */
2024         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2025         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2026         default:
2027                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2028                 break;
2029         }
2030         return rc;
2031 }
2032
2033 /*
2034  * Check that a process has enough memory to allocate a new virtual
2035  * mapping. 0 means there is enough memory for the allocation to
2036  * succeed and -ENOMEM implies there is not.
2037  *
2038  * Do not audit the selinux permission check, as this is applied to all
2039  * processes that allocate mappings.
2040  */
2041 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2042 {
2043         int rc, cap_sys_admin = 0;
2044
2045         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2046                              SECURITY_CAP_NOAUDIT);
2047         if (rc == 0)
2048                 cap_sys_admin = 1;
2049
2050         return __vm_enough_memory(mm, pages, cap_sys_admin);
2051 }
2052
2053 /* binprm security operations */
2054
2055 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2056 {
2057         const struct task_security_struct *old_tsec;
2058         struct task_security_struct *new_tsec;
2059         struct inode_security_struct *isec;
2060         struct common_audit_data ad;
2061         struct inode *inode = file_inode(bprm->file);
2062         int rc;
2063
2064         rc = cap_bprm_set_creds(bprm);
2065         if (rc)
2066                 return rc;
2067
2068         /* SELinux context only depends on initial program or script and not
2069          * the script interpreter */
2070         if (bprm->cred_prepared)
2071                 return 0;
2072
2073         old_tsec = current_security();
2074         new_tsec = bprm->cred->security;
2075         isec = inode->i_security;
2076
2077         /* Default to the current task SID. */
2078         new_tsec->sid = old_tsec->sid;
2079         new_tsec->osid = old_tsec->sid;
2080
2081         /* Reset fs, key, and sock SIDs on execve. */
2082         new_tsec->create_sid = 0;
2083         new_tsec->keycreate_sid = 0;
2084         new_tsec->sockcreate_sid = 0;
2085
2086         if (old_tsec->exec_sid) {
2087                 new_tsec->sid = old_tsec->exec_sid;
2088                 /* Reset exec SID on execve. */
2089                 new_tsec->exec_sid = 0;
2090
2091                 /*
2092                  * Minimize confusion: if no_new_privs and a transition is
2093                  * explicitly requested, then fail the exec.
2094                  */
2095                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2096                         return -EPERM;
2097         } else {
2098                 /* Check for a default transition on this program. */
2099                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2100                                              SECCLASS_PROCESS, NULL,
2101                                              &new_tsec->sid);
2102                 if (rc)
2103                         return rc;
2104         }
2105
2106         ad.type = LSM_AUDIT_DATA_PATH;
2107         ad.u.path = bprm->file->f_path;
2108
2109         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2110             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2111                 new_tsec->sid = old_tsec->sid;
2112
2113         if (new_tsec->sid == old_tsec->sid) {
2114                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2115                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2116                 if (rc)
2117                         return rc;
2118         } else {
2119                 /* Check permissions for the transition. */
2120                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2121                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2122                 if (rc)
2123                         return rc;
2124
2125                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2126                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2127                 if (rc)
2128                         return rc;
2129
2130                 /* Check for shared state */
2131                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2132                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2133                                           SECCLASS_PROCESS, PROCESS__SHARE,
2134                                           NULL);
2135                         if (rc)
2136                                 return -EPERM;
2137                 }
2138
2139                 /* Make sure that anyone attempting to ptrace over a task that
2140                  * changes its SID has the appropriate permit */
2141                 if (bprm->unsafe &
2142                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2143                         struct task_struct *tracer;
2144                         struct task_security_struct *sec;
2145                         u32 ptsid = 0;
2146
2147                         rcu_read_lock();
2148                         tracer = ptrace_parent(current);
2149                         if (likely(tracer != NULL)) {
2150                                 sec = __task_cred(tracer)->security;
2151                                 ptsid = sec->sid;
2152                         }
2153                         rcu_read_unlock();
2154
2155                         if (ptsid != 0) {
2156                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2157                                                   SECCLASS_PROCESS,
2158                                                   PROCESS__PTRACE, NULL);
2159                                 if (rc)
2160                                         return -EPERM;
2161                         }
2162                 }
2163
2164                 /* Clear any possibly unsafe personality bits on exec: */
2165                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2166         }
2167
2168         return 0;
2169 }
2170
2171 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2172 {
2173         const struct task_security_struct *tsec = current_security();
2174         u32 sid, osid;
2175         int atsecure = 0;
2176
2177         sid = tsec->sid;
2178         osid = tsec->osid;
2179
2180         if (osid != sid) {
2181                 /* Enable secure mode for SIDs transitions unless
2182                    the noatsecure permission is granted between
2183                    the two SIDs, i.e. ahp returns 0. */
2184                 atsecure = avc_has_perm(osid, sid,
2185                                         SECCLASS_PROCESS,
2186                                         PROCESS__NOATSECURE, NULL);
2187         }
2188
2189         return (atsecure || cap_bprm_secureexec(bprm));
2190 }
2191
2192 static int match_file(const void *p, struct file *file, unsigned fd)
2193 {
2194         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2195 }
2196
2197 /* Derived from fs/exec.c:flush_old_files. */
2198 static inline void flush_unauthorized_files(const struct cred *cred,
2199                                             struct files_struct *files)
2200 {
2201         struct file *file, *devnull = NULL;
2202         struct tty_struct *tty;
2203         int drop_tty = 0;
2204         unsigned n;
2205
2206         tty = get_current_tty();
2207         if (tty) {
2208                 spin_lock(&tty_files_lock);
2209                 if (!list_empty(&tty->tty_files)) {
2210                         struct tty_file_private *file_priv;
2211
2212                         /* Revalidate access to controlling tty.
2213                            Use file_path_has_perm on the tty path directly
2214                            rather than using file_has_perm, as this particular
2215                            open file may belong to another process and we are
2216                            only interested in the inode-based check here. */
2217                         file_priv = list_first_entry(&tty->tty_files,
2218                                                 struct tty_file_private, list);
2219                         file = file_priv->file;
2220                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2221                                 drop_tty = 1;
2222                 }
2223                 spin_unlock(&tty_files_lock);
2224                 tty_kref_put(tty);
2225         }
2226         /* Reset controlling tty. */
2227         if (drop_tty)
2228                 no_tty();
2229
2230         /* Revalidate access to inherited open files. */
2231         n = iterate_fd(files, 0, match_file, cred);
2232         if (!n) /* none found? */
2233                 return;
2234
2235         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2236         if (IS_ERR(devnull))
2237                 devnull = NULL;
2238         /* replace all the matching ones with this */
2239         do {
2240                 replace_fd(n - 1, devnull, 0);
2241         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2242         if (devnull)
2243                 fput(devnull);
2244 }
2245
2246 /*
2247  * Prepare a process for imminent new credential changes due to exec
2248  */
2249 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2250 {
2251         struct task_security_struct *new_tsec;
2252         struct rlimit *rlim, *initrlim;
2253         int rc, i;
2254
2255         new_tsec = bprm->cred->security;
2256         if (new_tsec->sid == new_tsec->osid)
2257                 return;
2258
2259         /* Close files for which the new task SID is not authorized. */
2260         flush_unauthorized_files(bprm->cred, current->files);
2261
2262         /* Always clear parent death signal on SID transitions. */
2263         current->pdeath_signal = 0;
2264
2265         /* Check whether the new SID can inherit resource limits from the old
2266          * SID.  If not, reset all soft limits to the lower of the current
2267          * task's hard limit and the init task's soft limit.
2268          *
2269          * Note that the setting of hard limits (even to lower them) can be
2270          * controlled by the setrlimit check.  The inclusion of the init task's
2271          * soft limit into the computation is to avoid resetting soft limits
2272          * higher than the default soft limit for cases where the default is
2273          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2274          */
2275         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2276                           PROCESS__RLIMITINH, NULL);
2277         if (rc) {
2278                 /* protect against do_prlimit() */
2279                 task_lock(current);
2280                 for (i = 0; i < RLIM_NLIMITS; i++) {
2281                         rlim = current->signal->rlim + i;
2282                         initrlim = init_task.signal->rlim + i;
2283                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2284                 }
2285                 task_unlock(current);
2286                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2287         }
2288 }
2289
2290 /*
2291  * Clean up the process immediately after the installation of new credentials
2292  * due to exec
2293  */
2294 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2295 {
2296         const struct task_security_struct *tsec = current_security();
2297         struct itimerval itimer;
2298         u32 osid, sid;
2299         int rc, i;
2300
2301         osid = tsec->osid;
2302         sid = tsec->sid;
2303
2304         if (sid == osid)
2305                 return;
2306
2307         /* Check whether the new SID can inherit signal state from the old SID.
2308          * If not, clear itimers to avoid subsequent signal generation and
2309          * flush and unblock signals.
2310          *
2311          * This must occur _after_ the task SID has been updated so that any
2312          * kill done after the flush will be checked against the new SID.
2313          */
2314         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2315         if (rc) {
2316                 memset(&itimer, 0, sizeof itimer);
2317                 for (i = 0; i < 3; i++)
2318                         do_setitimer(i, &itimer, NULL);
2319                 spin_lock_irq(&current->sighand->siglock);
2320                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2321                         __flush_signals(current);
2322                         flush_signal_handlers(current, 1);
2323                         sigemptyset(&current->blocked);
2324                 }
2325                 spin_unlock_irq(&current->sighand->siglock);
2326         }
2327
2328         /* Wake up the parent if it is waiting so that it can recheck
2329          * wait permission to the new task SID. */
2330         read_lock(&tasklist_lock);
2331         __wake_up_parent(current, current->real_parent);
2332         read_unlock(&tasklist_lock);
2333 }
2334
2335 /* superblock security operations */
2336
2337 static int selinux_sb_alloc_security(struct super_block *sb)
2338 {
2339         return superblock_alloc_security(sb);
2340 }
2341
2342 static void selinux_sb_free_security(struct super_block *sb)
2343 {
2344         superblock_free_security(sb);
2345 }
2346
2347 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2348 {
2349         if (plen > olen)
2350                 return 0;
2351
2352         return !memcmp(prefix, option, plen);
2353 }
2354
2355 static inline int selinux_option(char *option, int len)
2356 {
2357         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2358                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2359                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2360                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2361                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2362 }
2363
2364 static inline void take_option(char **to, char *from, int *first, int len)
2365 {
2366         if (!*first) {
2367                 **to = ',';
2368                 *to += 1;
2369         } else
2370                 *first = 0;
2371         memcpy(*to, from, len);
2372         *to += len;
2373 }
2374
2375 static inline void take_selinux_option(char **to, char *from, int *first,
2376                                        int len)
2377 {
2378         int current_size = 0;
2379
2380         if (!*first) {
2381                 **to = '|';
2382                 *to += 1;
2383         } else
2384                 *first = 0;
2385
2386         while (current_size < len) {
2387                 if (*from != '"') {
2388                         **to = *from;
2389                         *to += 1;
2390                 }
2391                 from += 1;
2392                 current_size += 1;
2393         }
2394 }
2395
2396 static int selinux_sb_copy_data(char *orig, char *copy)
2397 {
2398         int fnosec, fsec, rc = 0;
2399         char *in_save, *in_curr, *in_end;
2400         char *sec_curr, *nosec_save, *nosec;
2401         int open_quote = 0;
2402
2403         in_curr = orig;
2404         sec_curr = copy;
2405
2406         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2407         if (!nosec) {
2408                 rc = -ENOMEM;
2409                 goto out;
2410         }
2411
2412         nosec_save = nosec;
2413         fnosec = fsec = 1;
2414         in_save = in_end = orig;
2415
2416         do {
2417                 if (*in_end == '"')
2418                         open_quote = !open_quote;
2419                 if ((*in_end == ',' && open_quote == 0) ||
2420                                 *in_end == '\0') {
2421                         int len = in_end - in_curr;
2422
2423                         if (selinux_option(in_curr, len))
2424                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2425                         else
2426                                 take_option(&nosec, in_curr, &fnosec, len);
2427
2428                         in_curr = in_end + 1;
2429                 }
2430         } while (*in_end++);
2431
2432         strcpy(in_save, nosec_save);
2433         free_page((unsigned long)nosec_save);
2434 out:
2435         return rc;
2436 }
2437
2438 static int selinux_sb_remount(struct super_block *sb, void *data)
2439 {
2440         int rc, i, *flags;
2441         struct security_mnt_opts opts;
2442         char *secdata, **mount_options;
2443         struct superblock_security_struct *sbsec = sb->s_security;
2444
2445         if (!(sbsec->flags & SE_SBINITIALIZED))
2446                 return 0;
2447
2448         if (!data)
2449                 return 0;
2450
2451         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2452                 return 0;
2453
2454         security_init_mnt_opts(&opts);
2455         secdata = alloc_secdata();
2456         if (!secdata)
2457                 return -ENOMEM;
2458         rc = selinux_sb_copy_data(data, secdata);
2459         if (rc)
2460                 goto out_free_secdata;
2461
2462         rc = selinux_parse_opts_str(secdata, &opts);
2463         if (rc)
2464                 goto out_free_secdata;
2465
2466         mount_options = opts.mnt_opts;
2467         flags = opts.mnt_opts_flags;
2468
2469         for (i = 0; i < opts.num_mnt_opts; i++) {
2470                 u32 sid;
2471                 size_t len;
2472
2473                 if (flags[i] == SBLABEL_MNT)
2474                         continue;
2475                 len = strlen(mount_options[i]);
2476                 rc = security_context_to_sid(mount_options[i], len, &sid);
2477                 if (rc) {
2478                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2479                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2480                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2481                         goto out_free_opts;
2482                 }
2483                 rc = -EINVAL;
2484                 switch (flags[i]) {
2485                 case FSCONTEXT_MNT:
2486                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2487                                 goto out_bad_option;
2488                         break;
2489                 case CONTEXT_MNT:
2490                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2491                                 goto out_bad_option;
2492                         break;
2493                 case ROOTCONTEXT_MNT: {
2494                         struct inode_security_struct *root_isec;
2495                         root_isec = sb->s_root->d_inode->i_security;
2496
2497                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2498                                 goto out_bad_option;
2499                         break;
2500                 }
2501                 case DEFCONTEXT_MNT:
2502                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2503                                 goto out_bad_option;
2504                         break;
2505                 default:
2506                         goto out_free_opts;
2507                 }
2508         }
2509
2510         rc = 0;
2511 out_free_opts:
2512         security_free_mnt_opts(&opts);
2513 out_free_secdata:
2514         free_secdata(secdata);
2515         return rc;
2516 out_bad_option:
2517         printk(KERN_WARNING "SELinux: unable to change security options "
2518                "during remount (dev %s, type=%s)\n", sb->s_id,
2519                sb->s_type->name);
2520         goto out_free_opts;
2521 }
2522
2523 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2524 {
2525         const struct cred *cred = current_cred();
2526         struct common_audit_data ad;
2527         int rc;
2528
2529         rc = superblock_doinit(sb, data);
2530         if (rc)
2531                 return rc;
2532
2533         /* Allow all mounts performed by the kernel */
2534         if (flags & MS_KERNMOUNT)
2535                 return 0;
2536
2537         ad.type = LSM_AUDIT_DATA_DENTRY;
2538         ad.u.dentry = sb->s_root;
2539         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2540 }
2541
2542 static int selinux_sb_statfs(struct dentry *dentry)
2543 {
2544         const struct cred *cred = current_cred();
2545         struct common_audit_data ad;
2546
2547         ad.type = LSM_AUDIT_DATA_DENTRY;
2548         ad.u.dentry = dentry->d_sb->s_root;
2549         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2550 }
2551
2552 static int selinux_mount(const char *dev_name,
2553                          struct path *path,
2554                          const char *type,
2555                          unsigned long flags,
2556                          void *data)
2557 {
2558         const struct cred *cred = current_cred();
2559
2560         if (flags & MS_REMOUNT)
2561                 return superblock_has_perm(cred, path->dentry->d_sb,
2562                                            FILESYSTEM__REMOUNT, NULL);
2563         else
2564                 return path_has_perm(cred, path, FILE__MOUNTON);
2565 }
2566
2567 static int selinux_umount(struct vfsmount *mnt, int flags)
2568 {
2569         const struct cred *cred = current_cred();
2570
2571         return superblock_has_perm(cred, mnt->mnt_sb,
2572                                    FILESYSTEM__UNMOUNT, NULL);
2573 }
2574
2575 /* inode security operations */
2576
2577 static int selinux_inode_alloc_security(struct inode *inode)
2578 {
2579         return inode_alloc_security(inode);
2580 }
2581
2582 static void selinux_inode_free_security(struct inode *inode)
2583 {
2584         inode_free_security(inode);
2585 }
2586
2587 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2588                                         struct qstr *name, void **ctx,
2589                                         u32 *ctxlen)
2590 {
2591         const struct cred *cred = current_cred();
2592         struct task_security_struct *tsec;
2593         struct inode_security_struct *dsec;
2594         struct superblock_security_struct *sbsec;
2595         struct inode *dir = dentry->d_parent->d_inode;
2596         u32 newsid;
2597         int rc;
2598
2599         tsec = cred->security;
2600         dsec = dir->i_security;
2601         sbsec = dir->i_sb->s_security;
2602
2603         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2604                 newsid = tsec->create_sid;
2605         } else {
2606                 rc = security_transition_sid(tsec->sid, dsec->sid,
2607                                              inode_mode_to_security_class(mode),
2608                                              name,
2609                                              &newsid);
2610                 if (rc) {
2611                         printk(KERN_WARNING
2612                                 "%s: security_transition_sid failed, rc=%d\n",
2613                                __func__, -rc);
2614                         return rc;
2615                 }
2616         }
2617
2618         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2619 }
2620
2621 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2622                                        const struct qstr *qstr,
2623                                        const char **name,
2624                                        void **value, size_t *len)
2625 {
2626         const struct task_security_struct *tsec = current_security();
2627         struct inode_security_struct *dsec;
2628         struct superblock_security_struct *sbsec;
2629         u32 sid, newsid, clen;
2630         int rc;
2631         char *context;
2632
2633         dsec = dir->i_security;
2634         sbsec = dir->i_sb->s_security;
2635
2636         sid = tsec->sid;
2637         newsid = tsec->create_sid;
2638
2639         if ((sbsec->flags & SE_SBINITIALIZED) &&
2640             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2641                 newsid = sbsec->mntpoint_sid;
2642         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2643                 rc = security_transition_sid(sid, dsec->sid,
2644                                              inode_mode_to_security_class(inode->i_mode),
2645                                              qstr, &newsid);
2646                 if (rc) {
2647                         printk(KERN_WARNING "%s:  "
2648                                "security_transition_sid failed, rc=%d (dev=%s "
2649                                "ino=%ld)\n",
2650                                __func__,
2651                                -rc, inode->i_sb->s_id, inode->i_ino);
2652                         return rc;
2653                 }
2654         }
2655
2656         /* Possibly defer initialization to selinux_complete_init. */
2657         if (sbsec->flags & SE_SBINITIALIZED) {
2658                 struct inode_security_struct *isec = inode->i_security;
2659                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2660                 isec->sid = newsid;
2661                 isec->initialized = 1;
2662         }
2663
2664         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2665                 return -EOPNOTSUPP;
2666
2667         if (name)
2668                 *name = XATTR_SELINUX_SUFFIX;
2669
2670         if (value && len) {
2671                 rc = security_sid_to_context_force(newsid, &context, &clen);
2672                 if (rc)
2673                         return rc;
2674                 *value = context;
2675                 *len = clen;
2676         }
2677
2678         return 0;
2679 }
2680
2681 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2682 {
2683         return may_create(dir, dentry, SECCLASS_FILE);
2684 }
2685
2686 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2687 {
2688         return may_link(dir, old_dentry, MAY_LINK);
2689 }
2690
2691 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2692 {
2693         return may_link(dir, dentry, MAY_UNLINK);
2694 }
2695
2696 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2697 {
2698         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2699 }
2700
2701 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2702 {
2703         return may_create(dir, dentry, SECCLASS_DIR);
2704 }
2705
2706 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2707 {
2708         return may_link(dir, dentry, MAY_RMDIR);
2709 }
2710
2711 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2712 {
2713         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2714 }
2715
2716 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2717                                 struct inode *new_inode, struct dentry *new_dentry)
2718 {
2719         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2720 }
2721
2722 static int selinux_inode_readlink(struct dentry *dentry)
2723 {
2724         const struct cred *cred = current_cred();
2725
2726         return dentry_has_perm(cred, dentry, FILE__READ);
2727 }
2728
2729 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2730 {
2731         const struct cred *cred = current_cred();
2732
2733         return dentry_has_perm(cred, dentry, FILE__READ);
2734 }
2735
2736 static noinline int audit_inode_permission(struct inode *inode,
2737                                            u32 perms, u32 audited, u32 denied,
2738                                            unsigned flags)
2739 {
2740         struct common_audit_data ad;
2741         struct inode_security_struct *isec = inode->i_security;
2742         int rc;
2743
2744         ad.type = LSM_AUDIT_DATA_INODE;
2745         ad.u.inode = inode;
2746
2747         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2748                             audited, denied, &ad, flags);
2749         if (rc)
2750                 return rc;
2751         return 0;
2752 }
2753
2754 static int selinux_inode_permission(struct inode *inode, int mask)
2755 {
2756         const struct cred *cred = current_cred();
2757         u32 perms;
2758         bool from_access;
2759         unsigned flags = mask & MAY_NOT_BLOCK;
2760         struct inode_security_struct *isec;
2761         u32 sid;
2762         struct av_decision avd;
2763         int rc, rc2;
2764         u32 audited, denied;
2765
2766         from_access = mask & MAY_ACCESS;
2767         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2768
2769         /* No permission to check.  Existence test. */
2770         if (!mask)
2771                 return 0;
2772
2773         validate_creds(cred);
2774
2775         if (unlikely(IS_PRIVATE(inode)))
2776                 return 0;
2777
2778         perms = file_mask_to_av(inode->i_mode, mask);
2779
2780         sid = cred_sid(cred);
2781         isec = inode->i_security;
2782
2783         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2784         audited = avc_audit_required(perms, &avd, rc,
2785                                      from_access ? FILE__AUDIT_ACCESS : 0,
2786                                      &denied);
2787         if (likely(!audited))
2788                 return rc;
2789
2790         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2791         if (rc2)
2792                 return rc2;
2793         return rc;
2794 }
2795
2796 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2797 {
2798         const struct cred *cred = current_cred();
2799         unsigned int ia_valid = iattr->ia_valid;
2800         __u32 av = FILE__WRITE;
2801
2802         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2803         if (ia_valid & ATTR_FORCE) {
2804                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2805                               ATTR_FORCE);
2806                 if (!ia_valid)
2807                         return 0;
2808         }
2809
2810         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2811                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2812                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2813
2814         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2815                 av |= FILE__OPEN;
2816
2817         return dentry_has_perm(cred, dentry, av);
2818 }
2819
2820 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2821 {
2822         const struct cred *cred = current_cred();
2823         struct path path;
2824
2825         path.dentry = dentry;
2826         path.mnt = mnt;
2827
2828         return path_has_perm(cred, &path, FILE__GETATTR);
2829 }
2830
2831 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2832 {
2833         const struct cred *cred = current_cred();
2834
2835         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2836                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2837                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2838                         if (!capable(CAP_SETFCAP))
2839                                 return -EPERM;
2840                 } else if (!capable(CAP_SYS_ADMIN)) {
2841                         /* A different attribute in the security namespace.
2842                            Restrict to administrator. */
2843                         return -EPERM;
2844                 }
2845         }
2846
2847         /* Not an attribute we recognize, so just check the
2848            ordinary setattr permission. */
2849         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2850 }
2851
2852 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2853                                   const void *value, size_t size, int flags)
2854 {
2855         struct inode *inode = dentry->d_inode;
2856         struct inode_security_struct *isec = inode->i_security;
2857         struct superblock_security_struct *sbsec;
2858         struct common_audit_data ad;
2859         u32 newsid, sid = current_sid();
2860         int rc = 0;
2861
2862         if (strcmp(name, XATTR_NAME_SELINUX))
2863                 return selinux_inode_setotherxattr(dentry, name);
2864
2865         sbsec = inode->i_sb->s_security;
2866         if (!(sbsec->flags & SBLABEL_MNT))
2867                 return -EOPNOTSUPP;
2868
2869         if (!inode_owner_or_capable(inode))
2870                 return -EPERM;
2871
2872         ad.type = LSM_AUDIT_DATA_DENTRY;
2873         ad.u.dentry = dentry;
2874
2875         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2876                           FILE__RELABELFROM, &ad);
2877         if (rc)
2878                 return rc;
2879
2880         rc = security_context_to_sid(value, size, &newsid);
2881         if (rc == -EINVAL) {
2882                 if (!capable(CAP_MAC_ADMIN)) {
2883                         struct audit_buffer *ab;
2884                         size_t audit_size;
2885                         const char *str;
2886
2887                         /* We strip a nul only if it is at the end, otherwise the
2888                          * context contains a nul and we should audit that */
2889                         if (value) {
2890                                 str = value;
2891                                 if (str[size - 1] == '\0')
2892                                         audit_size = size - 1;
2893                                 else
2894                                         audit_size = size;
2895                         } else {
2896                                 str = "";
2897                                 audit_size = 0;
2898                         }
2899                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2900                         audit_log_format(ab, "op=setxattr invalid_context=");
2901                         audit_log_n_untrustedstring(ab, value, audit_size);
2902                         audit_log_end(ab);
2903
2904                         return rc;
2905                 }
2906                 rc = security_context_to_sid_force(value, size, &newsid);
2907         }
2908         if (rc)
2909                 return rc;
2910
2911         rc = avc_has_perm(sid, newsid, isec->sclass,
2912                           FILE__RELABELTO, &ad);
2913         if (rc)
2914                 return rc;
2915
2916         rc = security_validate_transition(isec->sid, newsid, sid,
2917                                           isec->sclass);
2918         if (rc)
2919                 return rc;
2920
2921         return avc_has_perm(newsid,
2922                             sbsec->sid,
2923                             SECCLASS_FILESYSTEM,
2924                             FILESYSTEM__ASSOCIATE,
2925                             &ad);
2926 }
2927
2928 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2929                                         const void *value, size_t size,
2930                                         int flags)
2931 {
2932         struct inode *inode = dentry->d_inode;
2933         struct inode_security_struct *isec = inode->i_security;
2934         u32 newsid;
2935         int rc;
2936
2937         if (strcmp(name, XATTR_NAME_SELINUX)) {
2938                 /* Not an attribute we recognize, so nothing to do. */
2939                 return;
2940         }
2941
2942         rc = security_context_to_sid_force(value, size, &newsid);
2943         if (rc) {
2944                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2945                        "for (%s, %lu), rc=%d\n",
2946                        inode->i_sb->s_id, inode->i_ino, -rc);
2947                 return;
2948         }
2949
2950         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2951         isec->sid = newsid;
2952         isec->initialized = 1;
2953
2954         return;
2955 }
2956
2957 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2958 {
2959         const struct cred *cred = current_cred();
2960
2961         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2962 }
2963
2964 static int selinux_inode_listxattr(struct dentry *dentry)
2965 {
2966         const struct cred *cred = current_cred();
2967
2968         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2969 }
2970
2971 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2972 {
2973         if (strcmp(name, XATTR_NAME_SELINUX))
2974                 return selinux_inode_setotherxattr(dentry, name);
2975
2976         /* No one is allowed to remove a SELinux security label.
2977            You can change the label, but all data must be labeled. */
2978         return -EACCES;
2979 }
2980
2981 /*
2982  * Copy the inode security context value to the user.
2983  *
2984  * Permission check is handled by selinux_inode_getxattr hook.
2985  */
2986 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2987 {
2988         u32 size;
2989         int error;
2990         char *context = NULL;
2991         struct inode_security_struct *isec = inode->i_security;
2992
2993         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2994                 return -EOPNOTSUPP;
2995
2996         /*
2997          * If the caller has CAP_MAC_ADMIN, then get the raw context
2998          * value even if it is not defined by current policy; otherwise,
2999          * use the in-core value under current policy.
3000          * Use the non-auditing forms of the permission checks since
3001          * getxattr may be called by unprivileged processes commonly
3002          * and lack of permission just means that we fall back to the
3003          * in-core context value, not a denial.
3004          */
3005         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3006                                 SECURITY_CAP_NOAUDIT);
3007         if (!error)
3008                 error = security_sid_to_context_force(isec->sid, &context,
3009                                                       &size);
3010         else
3011                 error = security_sid_to_context(isec->sid, &context, &size);
3012         if (error)
3013                 return error;
3014         error = size;
3015         if (alloc) {
3016                 *buffer = context;
3017                 goto out_nofree;
3018         }
3019         kfree(context);
3020 out_nofree:
3021         return error;
3022 }
3023
3024 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3025                                      const void *value, size_t size, int flags)
3026 {
3027         struct inode_security_struct *isec = inode->i_security;
3028         u32 newsid;
3029         int rc;
3030
3031         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3032                 return -EOPNOTSUPP;
3033
3034         if (!value || !size)
3035                 return -EACCES;
3036
3037         rc = security_context_to_sid((void *)value, size, &newsid);
3038         if (rc)
3039                 return rc;
3040
3041         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3042         isec->sid = newsid;
3043         isec->initialized = 1;
3044         return 0;
3045 }
3046
3047 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3048 {
3049         const int len = sizeof(XATTR_NAME_SELINUX);
3050         if (buffer && len <= buffer_size)
3051                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3052         return len;
3053 }
3054
3055 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3056 {
3057         struct inode_security_struct *isec = inode->i_security;
3058         *secid = isec->sid;
3059 }
3060
3061 /* file security operations */
3062
3063 static int selinux_revalidate_file_permission(struct file *file, int mask)
3064 {
3065         const struct cred *cred = current_cred();
3066         struct inode *inode = file_inode(file);
3067
3068         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3069         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3070                 mask |= MAY_APPEND;
3071
3072         return file_has_perm(cred, file,
3073                              file_mask_to_av(inode->i_mode, mask));
3074 }
3075
3076 static int selinux_file_permission(struct file *file, int mask)
3077 {
3078         struct inode *inode = file_inode(file);
3079         struct file_security_struct *fsec = file->f_security;
3080         struct inode_security_struct *isec = inode->i_security;
3081         u32 sid = current_sid();
3082
3083         if (!mask)
3084                 /* No permission to check.  Existence test. */
3085                 return 0;
3086
3087         if (sid == fsec->sid && fsec->isid == isec->sid &&
3088             fsec->pseqno == avc_policy_seqno())
3089                 /* No change since file_open check. */
3090                 return 0;
3091
3092         return selinux_revalidate_file_permission(file, mask);
3093 }
3094
3095 static int selinux_file_alloc_security(struct file *file)
3096 {
3097         return file_alloc_security(file);
3098 }
3099
3100 static void selinux_file_free_security(struct file *file)
3101 {
3102         file_free_security(file);
3103 }
3104
3105 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3106                               unsigned long arg)
3107 {
3108         const struct cred *cred = current_cred();
3109         int error = 0;
3110
3111         switch (cmd) {
3112         case FIONREAD:
3113         /* fall through */
3114         case FIBMAP:
3115         /* fall through */
3116         case FIGETBSZ:
3117         /* fall through */
3118         case FS_IOC_GETFLAGS:
3119         /* fall through */
3120         case FS_IOC_GETVERSION:
3121                 error = file_has_perm(cred, file, FILE__GETATTR);
3122                 break;
3123
3124         case FS_IOC_SETFLAGS:
3125         /* fall through */
3126         case FS_IOC_SETVERSION:
3127                 error = file_has_perm(cred, file, FILE__SETATTR);
3128                 break;
3129
3130         /* sys_ioctl() checks */
3131         case FIONBIO:
3132         /* fall through */
3133         case FIOASYNC:
3134                 error = file_has_perm(cred, file, 0);
3135                 break;
3136
3137         case KDSKBENT:
3138         case KDSKBSENT:
3139                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3140                                             SECURITY_CAP_AUDIT);
3141                 break;
3142
3143         /* default case assumes that the command will go
3144          * to the file's ioctl() function.
3145          */
3146         default:
3147                 error = file_has_perm(cred, file, FILE__IOCTL);
3148         }
3149         return error;
3150 }
3151
3152 static int default_noexec;
3153
3154 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3155 {
3156         const struct cred *cred = current_cred();
3157         int rc = 0;
3158
3159         if (default_noexec &&
3160             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3161                 /*
3162                  * We are making executable an anonymous mapping or a
3163                  * private file mapping that will also be writable.
3164                  * This has an additional check.
3165                  */
3166                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3167                 if (rc)
3168                         goto error;
3169         }
3170
3171         if (file) {
3172                 /* read access is always possible with a mapping */
3173                 u32 av = FILE__READ;
3174
3175                 /* write access only matters if the mapping is shared */
3176                 if (shared && (prot & PROT_WRITE))
3177                         av |= FILE__WRITE;
3178
3179                 if (prot & PROT_EXEC)
3180                         av |= FILE__EXECUTE;
3181
3182                 return file_has_perm(cred, file, av);
3183         }
3184
3185 error:
3186         return rc;
3187 }
3188
3189 static int selinux_mmap_addr(unsigned long addr)
3190 {
3191         int rc = 0;
3192         u32 sid = current_sid();
3193
3194         /*
3195          * notice that we are intentionally putting the SELinux check before
3196          * the secondary cap_file_mmap check.  This is such a likely attempt
3197          * at bad behaviour/exploit that we always want to get the AVC, even
3198          * if DAC would have also denied the operation.
3199          */
3200         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3201                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3202                                   MEMPROTECT__MMAP_ZERO, NULL);
3203                 if (rc)
3204                         return rc;
3205         }
3206
3207         /* do DAC check on address space usage */
3208         return cap_mmap_addr(addr);
3209 }
3210
3211 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3212                              unsigned long prot, unsigned long flags)
3213 {
3214         if (selinux_checkreqprot)
3215                 prot = reqprot;
3216
3217         return file_map_prot_check(file, prot,
3218                                    (flags & MAP_TYPE) == MAP_SHARED);
3219 }
3220
3221 static int selinux_file_mprotect(struct vm_area_struct *vma,
3222                                  unsigned long reqprot,
3223                                  unsigned long prot)
3224 {
3225         const struct cred *cred = current_cred();
3226
3227         if (selinux_checkreqprot)
3228                 prot = reqprot;
3229
3230         if (default_noexec &&
3231             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3232                 int rc = 0;
3233                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3234                     vma->vm_end <= vma->vm_mm->brk) {
3235                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3236                 } else if (!vma->vm_file &&
3237                            vma->vm_start <= vma->vm_mm->start_stack &&
3238                            vma->vm_end >= vma->vm_mm->start_stack) {
3239                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3240                 } else if (vma->vm_file && vma->anon_vma) {
3241                         /*
3242                          * We are making executable a file mapping that has
3243                          * had some COW done. Since pages might have been
3244                          * written, check ability to execute the possibly
3245                          * modified content.  This typically should only
3246                          * occur for text relocations.
3247                          */
3248                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3249                 }
3250                 if (rc)
3251                         return rc;
3252         }
3253
3254         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3255 }
3256
3257 static int selinux_file_lock(struct file *file, unsigned int cmd)
3258 {
3259         const struct cred *cred = current_cred();
3260
3261         return file_has_perm(cred, file, FILE__LOCK);
3262 }
3263
3264 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3265                               unsigned long arg)
3266 {
3267         const struct cred *cred = current_cred();
3268         int err = 0;
3269
3270         switch (cmd) {
3271         case F_SETFL:
3272                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3273                         err = file_has_perm(cred, file, FILE__WRITE);
3274                         break;
3275                 }
3276                 /* fall through */
3277         case F_SETOWN:
3278         case F_SETSIG:
3279         case F_GETFL:
3280         case F_GETOWN:
3281         case F_GETSIG:
3282         case F_GETOWNER_UIDS:
3283                 /* Just check FD__USE permission */
3284                 err = file_has_perm(cred, file, 0);
3285                 break;
3286         case F_GETLK:
3287         case F_SETLK:
3288         case F_SETLKW:
3289 #if BITS_PER_LONG == 32
3290         case F_GETLK64:
3291         case F_SETLK64:
3292         case F_SETLKW64:
3293 #endif
3294                 err = file_has_perm(cred, file, FILE__LOCK);
3295                 break;
3296         }
3297
3298         return err;
3299 }
3300
3301 static int selinux_file_set_fowner(struct file *file)
3302 {
3303         struct file_security_struct *fsec;
3304
3305         fsec = file->f_security;
3306         fsec->fown_sid = current_sid();
3307
3308         return 0;
3309 }
3310
3311 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3312                                        struct fown_struct *fown, int signum)
3313 {
3314         struct file *file;
3315         u32 sid = task_sid(tsk);
3316         u32 perm;
3317         struct file_security_struct *fsec;
3318
3319         /* struct fown_struct is never outside the context of a struct file */
3320         file = container_of(fown, struct file, f_owner);
3321
3322         fsec = file->f_security;
3323
3324         if (!signum)
3325                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3326         else
3327                 perm = signal_to_av(signum);
3328
3329         return avc_has_perm(fsec->fown_sid, sid,
3330                             SECCLASS_PROCESS, perm, NULL);
3331 }
3332
3333 static int selinux_file_receive(struct file *file)
3334 {
3335         const struct cred *cred = current_cred();
3336
3337         return file_has_perm(cred, file, file_to_av(file));
3338 }
3339
3340 static int selinux_file_open(struct file *file, const struct cred *cred)
3341 {
3342         struct file_security_struct *fsec;
3343         struct inode_security_struct *isec;
3344
3345         fsec = file->f_security;
3346         isec = file_inode(file)->i_security;
3347         /*
3348          * Save inode label and policy sequence number
3349          * at open-time so that selinux_file_permission
3350          * can determine whether revalidation is necessary.
3351          * Task label is already saved in the file security
3352          * struct as its SID.
3353          */
3354         fsec->isid = isec->sid;
3355         fsec->pseqno = avc_policy_seqno();
3356         /*
3357          * Since the inode label or policy seqno may have changed
3358          * between the selinux_inode_permission check and the saving
3359          * of state above, recheck that access is still permitted.
3360          * Otherwise, access might never be revalidated against the
3361          * new inode label or new policy.
3362          * This check is not redundant - do not remove.
3363          */
3364         return file_path_has_perm(cred, file, open_file_to_av(file));
3365 }
3366
3367 /* task security operations */
3368
3369 static int selinux_task_create(unsigned long clone_flags)
3370 {
3371         return current_has_perm(current, PROCESS__FORK);
3372 }
3373
3374 /*
3375  * allocate the SELinux part of blank credentials
3376  */
3377 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3378 {
3379         struct task_security_struct *tsec;
3380
3381         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3382         if (!tsec)
3383                 return -ENOMEM;
3384
3385         cred->security = tsec;
3386         return 0;
3387 }
3388
3389 /*
3390  * detach and free the LSM part of a set of credentials
3391  */
3392 static void selinux_cred_free(struct cred *cred)
3393 {
3394         struct task_security_struct *tsec = cred->security;
3395
3396         /*
3397          * cred->security == NULL if security_cred_alloc_blank() or
3398          * security_prepare_creds() returned an error.
3399          */
3400         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3401         cred->security = (void *) 0x7UL;
3402         kfree(tsec);
3403 }
3404
3405 /*
3406  * prepare a new set of credentials for modification
3407  */
3408 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3409                                 gfp_t gfp)
3410 {
3411         const struct task_security_struct *old_tsec;
3412         struct task_security_struct *tsec;
3413
3414         old_tsec = old->security;
3415
3416         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3417         if (!tsec)
3418                 return -ENOMEM;
3419
3420         new->security = tsec;
3421         return 0;
3422 }
3423
3424 /*
3425  * transfer the SELinux data to a blank set of creds
3426  */
3427 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3428 {
3429         const struct task_security_struct *old_tsec = old->security;
3430         struct task_security_struct *tsec = new->security;
3431
3432         *tsec = *old_tsec;
3433 }
3434
3435 /*
3436  * set the security data for a kernel service
3437  * - all the creation contexts are set to unlabelled
3438  */
3439 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3440 {
3441         struct task_security_struct *tsec = new->security;
3442         u32 sid = current_sid();
3443         int ret;
3444
3445         ret = avc_has_perm(sid, secid,
3446                            SECCLASS_KERNEL_SERVICE,
3447                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3448                            NULL);
3449         if (ret == 0) {
3450                 tsec->sid = secid;
3451                 tsec->create_sid = 0;
3452                 tsec->keycreate_sid = 0;
3453                 tsec->sockcreate_sid = 0;
3454         }
3455         return ret;
3456 }
3457
3458 /*
3459  * set the file creation context in a security record to the same as the
3460  * objective context of the specified inode
3461  */
3462 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3463 {
3464         struct inode_security_struct *isec = inode->i_security;
3465         struct task_security_struct *tsec = new->security;
3466         u32 sid = current_sid();
3467         int ret;
3468
3469         ret = avc_has_perm(sid, isec->sid,
3470                            SECCLASS_KERNEL_SERVICE,
3471                            KERNEL_SERVICE__CREATE_FILES_AS,
3472                            NULL);
3473
3474         if (ret == 0)
3475                 tsec->create_sid = isec->sid;
3476         return ret;
3477 }
3478
3479 static int selinux_kernel_module_request(char *kmod_name)
3480 {
3481         u32 sid;
3482         struct common_audit_data ad;
3483
3484         sid = task_sid(current);
3485
3486         ad.type = LSM_AUDIT_DATA_KMOD;
3487         ad.u.kmod_name = kmod_name;
3488
3489         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3490                             SYSTEM__MODULE_REQUEST, &ad);
3491 }
3492
3493 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3494 {
3495         return current_has_perm(p, PROCESS__SETPGID);
3496 }
3497
3498 static int selinux_task_getpgid(struct task_struct *p)
3499 {
3500         return current_has_perm(p, PROCESS__GETPGID);
3501 }
3502
3503 static int selinux_task_getsid(struct task_struct *p)
3504 {
3505         return current_has_perm(p, PROCESS__GETSESSION);
3506 }
3507
3508 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3509 {
3510         *secid = task_sid(p);
3511 }
3512
3513 static int selinux_task_setnice(struct task_struct *p, int nice)
3514 {
3515         int rc;
3516
3517         rc = cap_task_setnice(p, nice);
3518         if (rc)
3519                 return rc;
3520
3521         return current_has_perm(p, PROCESS__SETSCHED);
3522 }
3523
3524 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3525 {
3526         int rc;
3527
3528         rc = cap_task_setioprio(p, ioprio);
3529         if (rc)
3530                 return rc;
3531
3532         return current_has_perm(p, PROCESS__SETSCHED);
3533 }
3534
3535 static int selinux_task_getioprio(struct task_struct *p)
3536 {
3537         return current_has_perm(p, PROCESS__GETSCHED);
3538 }
3539
3540 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3541                 struct rlimit *new_rlim)
3542 {
3543         struct rlimit *old_rlim = p->signal->rlim + resource;
3544
3545         /* Control the ability to change the hard limit (whether
3546            lowering or raising it), so that the hard limit can
3547            later be used as a safe reset point for the soft limit
3548            upon context transitions.  See selinux_bprm_committing_creds. */
3549         if (old_rlim->rlim_max != new_rlim->rlim_max)
3550                 return current_has_perm(p, PROCESS__SETRLIMIT);
3551
3552         return 0;
3553 }
3554
3555 static int selinux_task_setscheduler(struct task_struct *p)
3556 {
3557         int rc;
3558
3559         rc = cap_task_setscheduler(p);
3560         if (rc)
3561                 return rc;
3562
3563         return current_has_perm(p, PROCESS__SETSCHED);
3564 }
3565
3566 static int selinux_task_getscheduler(struct task_struct *p)
3567 {
3568         return current_has_perm(p, PROCESS__GETSCHED);
3569 }
3570
3571 static int selinux_task_movememory(struct task_struct *p)
3572 {
3573         return current_has_perm(p, PROCESS__SETSCHED);
3574 }
3575
3576 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3577                                 int sig, u32 secid)
3578 {
3579         u32 perm;
3580         int rc;
3581
3582         if (!sig)
3583                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3584         else
3585                 perm = signal_to_av(sig);
3586         if (secid)
3587                 rc = avc_has_perm(secid, task_sid(p),
3588                                   SECCLASS_PROCESS, perm, NULL);
3589         else
3590                 rc = current_has_perm(p, perm);
3591         return rc;
3592 }
3593
3594 static int selinux_task_wait(struct task_struct *p)
3595 {
3596         return task_has_perm(p, current, PROCESS__SIGCHLD);
3597 }
3598
3599 static void selinux_task_to_inode(struct task_struct *p,
3600                                   struct inode *inode)
3601 {
3602         struct inode_security_struct *isec = inode->i_security;
3603         u32 sid = task_sid(p);
3604
3605         isec->sid = sid;
3606         isec->initialized = 1;
3607 }
3608
3609 /* Returns error only if unable to parse addresses */
3610 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3611                         struct common_audit_data *ad, u8 *proto)
3612 {
3613         int offset, ihlen, ret = -EINVAL;
3614         struct iphdr _iph, *ih;
3615
3616         offset = skb_network_offset(skb);
3617         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3618         if (ih == NULL)
3619                 goto out;
3620
3621         ihlen = ih->ihl * 4;
3622         if (ihlen < sizeof(_iph))
3623                 goto out;
3624
3625         ad->u.net->v4info.saddr = ih->saddr;
3626         ad->u.net->v4info.daddr = ih->daddr;
3627         ret = 0;
3628
3629         if (proto)
3630                 *proto = ih->protocol;
3631
3632         switch (ih->protocol) {
3633         case IPPROTO_TCP: {
3634                 struct tcphdr _tcph, *th;
3635
3636                 if (ntohs(ih->frag_off) & IP_OFFSET)
3637                         break;
3638
3639                 offset += ihlen;
3640                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3641                 if (th == NULL)
3642                         break;
3643
3644                 ad->u.net->sport = th->source;
3645                 ad->u.net->dport = th->dest;
3646                 break;
3647         }
3648
3649         case IPPROTO_UDP: {
3650                 struct udphdr _udph, *uh;
3651
3652                 if (ntohs(ih->frag_off) & IP_OFFSET)
3653                         break;
3654
3655                 offset += ihlen;
3656                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3657                 if (uh == NULL)
3658                         break;
3659
3660                 ad->u.net->sport = uh->source;
3661                 ad->u.net->dport = uh->dest;
3662                 break;
3663         }
3664
3665         case IPPROTO_DCCP: {
3666                 struct dccp_hdr _dccph, *dh;
3667
3668                 if (ntohs(ih->frag_off) & IP_OFFSET)
3669                         break;
3670
3671                 offset += ihlen;
3672                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3673                 if (dh == NULL)
3674                         break;
3675
3676                 ad->u.net->sport = dh->dccph_sport;
3677                 ad->u.net->dport = dh->dccph_dport;
3678                 break;
3679         }
3680
3681         default:
3682                 break;
3683         }
3684 out:
3685         return ret;
3686 }
3687
3688 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3689
3690 /* Returns error only if unable to parse addresses */
3691 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3692                         struct common_audit_data *ad, u8 *proto)
3693 {
3694         u8 nexthdr;
3695         int ret = -EINVAL, offset;
3696         struct ipv6hdr _ipv6h, *ip6;
3697         __be16 frag_off;
3698
3699         offset = skb_network_offset(skb);
3700         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3701         if (ip6 == NULL)
3702                 goto out;
3703
3704         ad->u.net->v6info.saddr = ip6->saddr;
3705         ad->u.net->v6info.daddr = ip6->daddr;
3706         ret = 0;
3707
3708         nexthdr = ip6->nexthdr;
3709         offset += sizeof(_ipv6h);
3710         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3711         if (offset < 0)
3712                 goto out;
3713
3714         if (proto)
3715                 *proto = nexthdr;
3716
3717         switch (nexthdr) {
3718         case IPPROTO_TCP: {
3719                 struct tcphdr _tcph, *th;
3720
3721                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3722                 if (th == NULL)
3723                         break;
3724
3725                 ad->u.net->sport = th->source;
3726                 ad->u.net->dport = th->dest;
3727                 break;
3728         }
3729
3730         case IPPROTO_UDP: {
3731                 struct udphdr _udph, *uh;
3732
3733                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3734                 if (uh == NULL)
3735                         break;
3736
3737                 ad->u.net->sport = uh->source;
3738                 ad->u.net->dport = uh->dest;
3739                 break;
3740         }
3741
3742         case IPPROTO_DCCP: {
3743                 struct dccp_hdr _dccph, *dh;
3744
3745                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3746                 if (dh == NULL)
3747                         break;
3748
3749                 ad->u.net->sport = dh->dccph_sport;
3750                 ad->u.net->dport = dh->dccph_dport;
3751                 break;
3752         }
3753
3754         /* includes fragments */
3755         default:
3756                 break;
3757         }
3758 out:
3759         return ret;
3760 }
3761
3762 #endif /* IPV6 */
3763
3764 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3765                              char **_addrp, int src, u8 *proto)
3766 {
3767         char *addrp;
3768         int ret;
3769
3770         switch (ad->u.net->family) {
3771         case PF_INET:
3772                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3773                 if (ret)
3774                         goto parse_error;
3775                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3776                                        &ad->u.net->v4info.daddr);
3777                 goto okay;
3778
3779 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3780         case PF_INET6:
3781                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3782                 if (ret)
3783                         goto parse_error;
3784                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3785                                        &ad->u.net->v6info.daddr);
3786                 goto okay;
3787 #endif  /* IPV6 */
3788         default:
3789                 addrp = NULL;
3790                 goto okay;
3791         }
3792
3793 parse_error:
3794         printk(KERN_WARNING
3795                "SELinux: failure in selinux_parse_skb(),"
3796                " unable to parse packet\n");
3797         return ret;
3798
3799 okay:
3800         if (_addrp)
3801                 *_addrp = addrp;
3802         return 0;
3803 }
3804
3805 /**
3806  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3807  * @skb: the packet
3808  * @family: protocol family
3809  * @sid: the packet's peer label SID
3810  *
3811  * Description:
3812  * Check the various different forms of network peer labeling and determine
3813  * the peer label/SID for the packet; most of the magic actually occurs in
3814  * the security server function security_net_peersid_cmp().  The function
3815  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3816  * or -EACCES if @sid is invalid due to inconsistencies with the different
3817  * peer labels.
3818  *
3819  */
3820 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3821 {
3822         int err;
3823         u32 xfrm_sid;
3824         u32 nlbl_sid;
3825         u32 nlbl_type;
3826
3827         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3828         if (unlikely(err))
3829                 return -EACCES;
3830         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3831         if (unlikely(err))
3832                 return -EACCES;
3833
3834         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3835         if (unlikely(err)) {
3836                 printk(KERN_WARNING
3837                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3838                        " unable to determine packet's peer label\n");
3839                 return -EACCES;
3840         }
3841
3842         return 0;
3843 }
3844
3845 /**
3846  * selinux_conn_sid - Determine the child socket label for a connection
3847  * @sk_sid: the parent socket's SID
3848  * @skb_sid: the packet's SID
3849  * @conn_sid: the resulting connection SID
3850  *
3851  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3852  * combined with the MLS information from @skb_sid in order to create
3853  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3854  * of @sk_sid.  Returns zero on success, negative values on failure.
3855  *
3856  */
3857 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3858 {
3859         int err = 0;
3860
3861         if (skb_sid != SECSID_NULL)
3862                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3863         else
3864                 *conn_sid = sk_sid;
3865
3866         return err;
3867 }
3868
3869 /* socket security operations */
3870
3871 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3872                                  u16 secclass, u32 *socksid)
3873 {
3874         if (tsec->sockcreate_sid > SECSID_NULL) {
3875                 *socksid = tsec->sockcreate_sid;
3876                 return 0;
3877         }
3878
3879         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3880                                        socksid);
3881 }
3882
3883 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3884 {
3885         struct sk_security_struct *sksec = sk->sk_security;
3886         struct common_audit_data ad;
3887         struct lsm_network_audit net = {0,};
3888         u32 tsid = task_sid(task);
3889
3890         if (sksec->sid == SECINITSID_KERNEL)
3891                 return 0;
3892
3893         ad.type = LSM_AUDIT_DATA_NET;
3894         ad.u.net = &net;
3895         ad.u.net->sk = sk;
3896
3897         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3898 }
3899
3900 static int selinux_socket_create(int family, int type,
3901                                  int protocol, int kern)
3902 {
3903         const struct task_security_struct *tsec = current_security();
3904         u32 newsid;
3905         u16 secclass;
3906         int rc;
3907
3908         if (kern)
3909                 return 0;
3910
3911         secclass = socket_type_to_security_class(family, type, protocol);
3912         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3913         if (rc)
3914                 return rc;
3915
3916         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3917 }
3918
3919 static int selinux_socket_post_create(struct socket *sock, int family,
3920                                       int type, int protocol, int kern)
3921 {
3922         const struct task_security_struct *tsec = current_security();
3923         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3924         struct sk_security_struct *sksec;
3925         int err = 0;
3926
3927         isec->sclass = socket_type_to_security_class(family, type, protocol);
3928
3929         if (kern)
3930                 isec->sid = SECINITSID_KERNEL;
3931         else {
3932                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3933                 if (err)
3934                         return err;
3935         }
3936
3937         isec->initialized = 1;
3938
3939         if (sock->sk) {
3940                 sksec = sock->sk->sk_security;
3941                 sksec->sid = isec->sid;
3942                 sksec->sclass = isec->sclass;
3943                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3944         }
3945
3946         return err;
3947 }
3948
3949 /* Range of port numbers used to automatically bind.
3950    Need to determine whether we should perform a name_bind
3951    permission check between the socket and the port number. */
3952
3953 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3954 {
3955         struct sock *sk = sock->sk;
3956         u16 family;
3957         int err;
3958
3959         err = sock_has_perm(current, sk, SOCKET__BIND);
3960         if (err)
3961                 goto out;
3962
3963         /*
3964          * If PF_INET or PF_INET6, check name_bind permission for the port.
3965          * Multiple address binding for SCTP is not supported yet: we just
3966          * check the first address now.
3967          */
3968         family = sk->sk_family;
3969         if (family == PF_INET || family == PF_INET6) {
3970                 char *addrp;
3971                 struct sk_security_struct *sksec = sk->sk_security;
3972                 struct common_audit_data ad;
3973                 struct lsm_network_audit net = {0,};
3974                 struct sockaddr_in *addr4 = NULL;
3975                 struct sockaddr_in6 *addr6 = NULL;
3976                 unsigned short snum;
3977                 u32 sid, node_perm;
3978
3979                 if (family == PF_INET) {
3980                         addr4 = (struct sockaddr_in *)address;
3981                         snum = ntohs(addr4->sin_port);
3982                         addrp = (char *)&addr4->sin_addr.s_addr;
3983                 } else {
3984                         addr6 = (struct sockaddr_in6 *)address;
3985                         snum = ntohs(addr6->sin6_port);
3986                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3987                 }
3988
3989                 if (snum) {
3990                         int low, high;
3991
3992                         inet_get_local_port_range(&low, &high);
3993
3994                         if (snum < max(PROT_SOCK, low) || snum > high) {
3995                                 err = sel_netport_sid(sk->sk_protocol,
3996                                                       snum, &sid);
3997                                 if (err)
3998                                         goto out;
3999                                 ad.type = LSM_AUDIT_DATA_NET;
4000                                 ad.u.net = &net;
4001                                 ad.u.net->sport = htons(snum);
4002                                 ad.u.net->family = family;
4003                                 err = avc_has_perm(sksec->sid, sid,
4004                                                    sksec->sclass,
4005                                                    SOCKET__NAME_BIND, &ad);
4006                                 if (err)
4007                                         goto out;
4008                         }
4009                 }
4010
4011                 switch (sksec->sclass) {
4012                 case SECCLASS_TCP_SOCKET:
4013                         node_perm = TCP_SOCKET__NODE_BIND;
4014                         break;
4015
4016                 case SECCLASS_UDP_SOCKET:
4017                         node_perm = UDP_SOCKET__NODE_BIND;
4018                         break;
4019
4020                 case SECCLASS_DCCP_SOCKET:
4021                         node_perm = DCCP_SOCKET__NODE_BIND;
4022                         break;
4023
4024                 default:
4025                         node_perm = RAWIP_SOCKET__NODE_BIND;
4026                         break;
4027                 }
4028
4029                 err = sel_netnode_sid(addrp, family, &sid);
4030                 if (err)
4031                         goto out;
4032
4033                 ad.type = LSM_AUDIT_DATA_NET;
4034                 ad.u.net = &net;
4035                 ad.u.net->sport = htons(snum);
4036                 ad.u.net->family = family;
4037
4038                 if (family == PF_INET)
4039                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4040                 else
4041                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4042
4043                 err = avc_has_perm(sksec->sid, sid,
4044                                    sksec->sclass, node_perm, &ad);
4045                 if (err)
4046                         goto out;
4047         }
4048 out:
4049         return err;
4050 }
4051
4052 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4053 {
4054         struct sock *sk = sock->sk;
4055         struct sk_security_struct *sksec = sk->sk_security;
4056         int err;
4057
4058         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4059         if (err)
4060                 return err;
4061
4062         /*
4063          * If a TCP or DCCP socket, check name_connect permission for the port.
4064          */
4065         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4066             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4067                 struct common_audit_data ad;
4068                 struct lsm_network_audit net = {0,};
4069                 struct sockaddr_in *addr4 = NULL;
4070                 struct sockaddr_in6 *addr6 = NULL;
4071                 unsigned short snum;
4072                 u32 sid, perm;
4073
4074                 if (sk->sk_family == PF_INET) {
4075                         addr4 = (struct sockaddr_in *)address;
4076                         if (addrlen < sizeof(struct sockaddr_in))
4077                                 return -EINVAL;
4078                         snum = ntohs(addr4->sin_port);
4079                 } else {
4080                         addr6 = (struct sockaddr_in6 *)address;
4081                         if (addrlen < SIN6_LEN_RFC2133)
4082                                 return -EINVAL;
4083                         snum = ntohs(addr6->sin6_port);
4084                 }
4085
4086                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4087                 if (err)
4088                         goto out;
4089
4090                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4091                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4092
4093                 ad.type = LSM_AUDIT_DATA_NET;
4094                 ad.u.net = &net;
4095                 ad.u.net->dport = htons(snum);
4096                 ad.u.net->family = sk->sk_family;
4097                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4098                 if (err)
4099                         goto out;
4100         }
4101
4102         err = selinux_netlbl_socket_connect(sk, address);
4103
4104 out:
4105         return err;
4106 }
4107
4108 static int selinux_socket_listen(struct socket *sock, int backlog)
4109 {
4110         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4111 }
4112
4113 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4114 {
4115         int err;
4116         struct inode_security_struct *isec;
4117         struct inode_security_struct *newisec;
4118
4119         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4120         if (err)
4121                 return err;
4122
4123         newisec = SOCK_INODE(newsock)->i_security;
4124
4125         isec = SOCK_INODE(sock)->i_security;
4126         newisec->sclass = isec->sclass;
4127         newisec->sid = isec->sid;
4128         newisec->initialized = 1;
4129
4130         return 0;
4131 }
4132
4133 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4134                                   int size)
4135 {
4136         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4137 }
4138
4139 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4140                                   int size, int flags)
4141 {
4142         return sock_has_perm(current, sock->sk, SOCKET__READ);
4143 }
4144
4145 static int selinux_socket_getsockname(struct socket *sock)
4146 {
4147         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4148 }
4149
4150 static int selinux_socket_getpeername(struct socket *sock)
4151 {
4152         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4153 }
4154
4155 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4156 {
4157         int err;
4158
4159         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4160         if (err)
4161                 return err;
4162
4163         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4164 }
4165
4166 static int selinux_socket_getsockopt(struct socket *sock, int level,
4167                                      int optname)
4168 {
4169         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4170 }
4171
4172 static int selinux_socket_shutdown(struct socket *sock, int how)
4173 {
4174         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4175 }
4176
4177 static int selinux_socket_unix_stream_connect(struct sock *sock,
4178                                               struct sock *other,
4179                                               struct sock *newsk)
4180 {
4181         struct sk_security_struct *sksec_sock = sock->sk_security;
4182         struct sk_security_struct *sksec_other = other->sk_security;
4183         struct sk_security_struct *sksec_new = newsk->sk_security;
4184         struct common_audit_data ad;
4185         struct lsm_network_audit net = {0,};
4186         int err;
4187
4188         ad.type = LSM_AUDIT_DATA_NET;
4189         ad.u.net = &net;
4190         ad.u.net->sk = other;
4191
4192         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4193                            sksec_other->sclass,
4194                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4195         if (err)
4196                 return err;
4197
4198         /* server child socket */
4199         sksec_new->peer_sid = sksec_sock->sid;
4200         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4201                                     &sksec_new->sid);
4202         if (err)
4203                 return err;
4204
4205         /* connecting socket */
4206         sksec_sock->peer_sid = sksec_new->sid;
4207
4208         return 0;
4209 }
4210
4211 static int selinux_socket_unix_may_send(struct socket *sock,
4212                                         struct socket *other)
4213 {
4214         struct sk_security_struct *ssec = sock->sk->sk_security;
4215         struct sk_security_struct *osec = other->sk->sk_security;
4216         struct common_audit_data ad;
4217         struct lsm_network_audit net = {0,};
4218
4219         ad.type = LSM_AUDIT_DATA_NET;
4220         ad.u.net = &net;
4221         ad.u.net->sk = other->sk;
4222
4223         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4224                             &ad);
4225 }
4226
4227 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4228                                     u32 peer_sid,
4229                                     struct common_audit_data *ad)
4230 {
4231         int err;
4232         u32 if_sid;
4233         u32 node_sid;
4234
4235         err = sel_netif_sid(ifindex, &if_sid);
4236         if (err)
4237                 return err;
4238         err = avc_has_perm(peer_sid, if_sid,
4239                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4240         if (err)
4241                 return err;
4242
4243         err = sel_netnode_sid(addrp, family, &node_sid);
4244         if (err)
4245                 return err;
4246         return avc_has_perm(peer_sid, node_sid,
4247                             SECCLASS_NODE, NODE__RECVFROM, ad);
4248 }
4249
4250 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4251                                        u16 family)
4252 {
4253         int err = 0;
4254         struct sk_security_struct *sksec = sk->sk_security;
4255         u32 sk_sid = sksec->sid;
4256         struct common_audit_data ad;
4257         struct lsm_network_audit net = {0,};
4258         char *addrp;
4259
4260         ad.type = LSM_AUDIT_DATA_NET;
4261         ad.u.net = &net;
4262         ad.u.net->netif = skb->skb_iif;
4263         ad.u.net->family = family;
4264         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4265         if (err)
4266                 return err;
4267
4268         if (selinux_secmark_enabled()) {
4269                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4270                                    PACKET__RECV, &ad);
4271                 if (err)
4272                         return err;
4273         }
4274
4275         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4276         if (err)
4277                 return err;
4278         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4279
4280         return err;
4281 }
4282
4283 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4284 {
4285         int err;
4286         struct sk_security_struct *sksec = sk->sk_security;
4287         u16 family = sk->sk_family;
4288         u32 sk_sid = sksec->sid;
4289         struct common_audit_data ad;
4290         struct lsm_network_audit net = {0,};
4291         char *addrp;
4292         u8 secmark_active;
4293         u8 peerlbl_active;
4294
4295         if (family != PF_INET && family != PF_INET6)
4296                 return 0;
4297
4298         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4299         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4300                 family = PF_INET;
4301
4302         /* If any sort of compatibility mode is enabled then handoff processing
4303          * to the selinux_sock_rcv_skb_compat() function to deal with the
4304          * special handling.  We do this in an attempt to keep this function
4305          * as fast and as clean as possible. */
4306         if (!selinux_policycap_netpeer)
4307                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4308
4309         secmark_active = selinux_secmark_enabled();
4310         peerlbl_active = selinux_peerlbl_enabled();
4311         if (!secmark_active && !peerlbl_active)
4312                 return 0;
4313
4314         ad.type = LSM_AUDIT_DATA_NET;
4315         ad.u.net = &net;
4316         ad.u.net->netif = skb->skb_iif;
4317         ad.u.net->family = family;
4318         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4319         if (err)
4320                 return err;
4321
4322         if (peerlbl_active) {
4323                 u32 peer_sid;
4324
4325                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4326                 if (err)
4327                         return err;
4328                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4329                                                peer_sid, &ad);
4330                 if (err) {
4331                         selinux_netlbl_err(skb, err, 0);
4332                         return err;
4333                 }
4334                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4335                                    PEER__RECV, &ad);
4336                 if (err) {
4337                         selinux_netlbl_err(skb, err, 0);
4338                         return err;
4339                 }
4340         }
4341
4342         if (secmark_active) {
4343                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4344                                    PACKET__RECV, &ad);
4345                 if (err)
4346                         return err;
4347         }
4348
4349         return err;
4350 }
4351
4352 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4353                                             int __user *optlen, unsigned len)
4354 {
4355         int err = 0;
4356         char *scontext;
4357         u32 scontext_len;
4358         struct sk_security_struct *sksec = sock->sk->sk_security;
4359         u32 peer_sid = SECSID_NULL;
4360
4361         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4362             sksec->sclass == SECCLASS_TCP_SOCKET)
4363                 peer_sid = sksec->peer_sid;
4364         if (peer_sid == SECSID_NULL)
4365                 return -ENOPROTOOPT;
4366
4367         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4368         if (err)
4369                 return err;
4370
4371         if (scontext_len > len) {
4372                 err = -ERANGE;
4373                 goto out_len;
4374         }
4375
4376         if (copy_to_user(optval, scontext, scontext_len))
4377                 err = -EFAULT;
4378
4379 out_len:
4380         if (put_user(scontext_len, optlen))
4381                 err = -EFAULT;
4382         kfree(scontext);
4383         return err;
4384 }
4385
4386 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4387 {
4388         u32 peer_secid = SECSID_NULL;
4389         u16 family;
4390
4391         if (skb && skb->protocol == htons(ETH_P_IP))
4392                 family = PF_INET;
4393         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4394                 family = PF_INET6;
4395         else if (sock)
4396                 family = sock->sk->sk_family;
4397         else
4398                 goto out;
4399
4400         if (sock && family == PF_UNIX)
4401                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4402         else if (skb)
4403                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4404
4405 out:
4406         *secid = peer_secid;
4407         if (peer_secid == SECSID_NULL)
4408                 return -EINVAL;
4409         return 0;
4410 }
4411
4412 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4413 {
4414         struct sk_security_struct *sksec;
4415
4416         sksec = kzalloc(sizeof(*sksec), priority);
4417         if (!sksec)
4418                 return -ENOMEM;
4419
4420         sksec->peer_sid = SECINITSID_UNLABELED;
4421         sksec->sid = SECINITSID_UNLABELED;
4422         selinux_netlbl_sk_security_reset(sksec);
4423         sk->sk_security = sksec;
4424
4425         return 0;
4426 }
4427
4428 static void selinux_sk_free_security(struct sock *sk)
4429 {
4430         struct sk_security_struct *sksec = sk->sk_security;
4431
4432         sk->sk_security = NULL;
4433         selinux_netlbl_sk_security_free(sksec);
4434         kfree(sksec);
4435 }
4436
4437 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4438 {
4439         struct sk_security_struct *sksec = sk->sk_security;
4440         struct sk_security_struct *newsksec = newsk->sk_security;
4441
4442         newsksec->sid = sksec->sid;
4443         newsksec->peer_sid = sksec->peer_sid;
4444         newsksec->sclass = sksec->sclass;
4445
4446         selinux_netlbl_sk_security_reset(newsksec);
4447 }
4448
4449 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4450 {
4451         if (!sk)
4452                 *secid = SECINITSID_ANY_SOCKET;
4453         else {
4454                 struct sk_security_struct *sksec = sk->sk_security;
4455
4456                 *secid = sksec->sid;
4457         }
4458 }
4459
4460 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4461 {
4462         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4463         struct sk_security_struct *sksec = sk->sk_security;
4464
4465         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4466             sk->sk_family == PF_UNIX)
4467                 isec->sid = sksec->sid;
4468         sksec->sclass = isec->sclass;
4469 }
4470
4471 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4472                                      struct request_sock *req)
4473 {
4474         struct sk_security_struct *sksec = sk->sk_security;
4475         int err;
4476         u16 family = req->rsk_ops->family;
4477         u32 connsid;
4478         u32 peersid;
4479
4480         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4481         if (err)
4482                 return err;
4483         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4484         if (err)
4485                 return err;
4486         req->secid = connsid;
4487         req->peer_secid = peersid;
4488
4489         return selinux_netlbl_inet_conn_request(req, family);
4490 }
4491
4492 static void selinux_inet_csk_clone(struct sock *newsk,
4493                                    const struct request_sock *req)
4494 {
4495         struct sk_security_struct *newsksec = newsk->sk_security;
4496
4497         newsksec->sid = req->secid;
4498         newsksec->peer_sid = req->peer_secid;
4499         /* NOTE: Ideally, we should also get the isec->sid for the
4500            new socket in sync, but we don't have the isec available yet.
4501            So we will wait until sock_graft to do it, by which
4502            time it will have been created and available. */
4503
4504         /* We don't need to take any sort of lock here as we are the only
4505          * thread with access to newsksec */
4506         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4507 }
4508
4509 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4510 {
4511         u16 family = sk->sk_family;
4512         struct sk_security_struct *sksec = sk->sk_security;
4513
4514         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4515         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4516                 family = PF_INET;
4517
4518         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4519 }
4520
4521 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4522 {
4523         skb_set_owner_w(skb, sk);
4524 }
4525
4526 static int selinux_secmark_relabel_packet(u32 sid)
4527 {
4528         const struct task_security_struct *__tsec;
4529         u32 tsid;
4530
4531         __tsec = current_security();
4532         tsid = __tsec->sid;
4533
4534         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4535 }
4536
4537 static void selinux_secmark_refcount_inc(void)
4538 {
4539         atomic_inc(&selinux_secmark_refcount);
4540 }
4541
4542 static void selinux_secmark_refcount_dec(void)
4543 {
4544         atomic_dec(&selinux_secmark_refcount);
4545 }
4546
4547 static void selinux_req_classify_flow(const struct request_sock *req,
4548                                       struct flowi *fl)
4549 {
4550         fl->flowi_secid = req->secid;
4551 }
4552
4553 static int selinux_tun_dev_alloc_security(void **security)
4554 {
4555         struct tun_security_struct *tunsec;
4556
4557         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4558         if (!tunsec)
4559                 return -ENOMEM;
4560         tunsec->sid = current_sid();
4561
4562         *security = tunsec;
4563         return 0;
4564 }
4565
4566 static void selinux_tun_dev_free_security(void *security)
4567 {
4568         kfree(security);
4569 }
4570
4571 static int selinux_tun_dev_create(void)
4572 {
4573         u32 sid = current_sid();
4574
4575         /* we aren't taking into account the "sockcreate" SID since the socket
4576          * that is being created here is not a socket in the traditional sense,
4577          * instead it is a private sock, accessible only to the kernel, and
4578          * representing a wide range of network traffic spanning multiple
4579          * connections unlike traditional sockets - check the TUN driver to
4580          * get a better understanding of why this socket is special */
4581
4582         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4583                             NULL);
4584 }
4585
4586 static int selinux_tun_dev_attach_queue(void *security)
4587 {
4588         struct tun_security_struct *tunsec = security;
4589
4590         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4591                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4592 }
4593
4594 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4595 {
4596         struct tun_security_struct *tunsec = security;
4597         struct sk_security_struct *sksec = sk->sk_security;
4598
4599         /* we don't currently perform any NetLabel based labeling here and it
4600          * isn't clear that we would want to do so anyway; while we could apply
4601          * labeling without the support of the TUN user the resulting labeled
4602          * traffic from the other end of the connection would almost certainly
4603          * cause confusion to the TUN user that had no idea network labeling
4604          * protocols were being used */
4605
4606         sksec->sid = tunsec->sid;
4607         sksec->sclass = SECCLASS_TUN_SOCKET;
4608
4609         return 0;
4610 }
4611
4612 static int selinux_tun_dev_open(void *security)
4613 {
4614         struct tun_security_struct *tunsec = security;
4615         u32 sid = current_sid();
4616         int err;
4617
4618         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4619                            TUN_SOCKET__RELABELFROM, NULL);
4620         if (err)
4621                 return err;
4622         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4623                            TUN_SOCKET__RELABELTO, NULL);
4624         if (err)
4625                 return err;
4626         tunsec->sid = sid;
4627
4628         return 0;
4629 }
4630
4631 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4632 {
4633         int err = 0;
4634         u32 perm;
4635         struct nlmsghdr *nlh;
4636         struct sk_security_struct *sksec = sk->sk_security;
4637
4638         if (skb->len < NLMSG_HDRLEN) {
4639                 err = -EINVAL;
4640                 goto out;
4641         }
4642         nlh = nlmsg_hdr(skb);
4643
4644         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4645         if (err) {
4646                 if (err == -EINVAL) {
4647                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4648                                   "SELinux:  unrecognized netlink message"
4649                                   " type=%hu for sclass=%hu\n",
4650                                   nlh->nlmsg_type, sksec->sclass);
4651                         if (!selinux_enforcing || security_get_allow_unknown())
4652                                 err = 0;
4653                 }
4654
4655                 /* Ignore */
4656                 if (err == -ENOENT)
4657                         err = 0;
4658                 goto out;
4659         }
4660
4661         err = sock_has_perm(current, sk, perm);
4662 out:
4663         return err;
4664 }
4665
4666 #ifdef CONFIG_NETFILTER
4667
4668 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4669                                        u16 family)
4670 {
4671         int err;
4672         char *addrp;
4673         u32 peer_sid;
4674         struct common_audit_data ad;
4675         struct lsm_network_audit net = {0,};
4676         u8 secmark_active;
4677         u8 netlbl_active;
4678         u8 peerlbl_active;
4679
4680         if (!selinux_policycap_netpeer)
4681                 return NF_ACCEPT;
4682
4683         secmark_active = selinux_secmark_enabled();
4684         netlbl_active = netlbl_enabled();
4685         peerlbl_active = selinux_peerlbl_enabled();
4686         if (!secmark_active && !peerlbl_active)
4687                 return NF_ACCEPT;
4688
4689         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4690                 return NF_DROP;
4691
4692         ad.type = LSM_AUDIT_DATA_NET;
4693         ad.u.net = &net;
4694         ad.u.net->netif = ifindex;
4695         ad.u.net->family = family;
4696         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4697                 return NF_DROP;
4698
4699         if (peerlbl_active) {
4700                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4701                                                peer_sid, &ad);
4702                 if (err) {
4703                         selinux_netlbl_err(skb, err, 1);
4704                         return NF_DROP;
4705                 }
4706         }
4707
4708         if (secmark_active)
4709                 if (avc_has_perm(peer_sid, skb->secmark,
4710                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4711                         return NF_DROP;
4712
4713         if (netlbl_active)
4714                 /* we do this in the FORWARD path and not the POST_ROUTING
4715                  * path because we want to make sure we apply the necessary
4716                  * labeling before IPsec is applied so we can leverage AH
4717                  * protection */
4718                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4719                         return NF_DROP;
4720
4721         return NF_ACCEPT;
4722 }
4723
4724 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4725                                          struct sk_buff *skb,
4726                                          const struct net_device *in,
4727                                          const struct net_device *out,
4728                                          int (*okfn)(struct sk_buff *))
4729 {
4730         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4731 }
4732
4733 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4734 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4735                                          struct sk_buff *skb,
4736                                          const struct net_device *in,
4737                                          const struct net_device *out,
4738                                          int (*okfn)(struct sk_buff *))
4739 {
4740         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4741 }
4742 #endif  /* IPV6 */
4743
4744 static unsigned int selinux_ip_output(struct sk_buff *skb,
4745                                       u16 family)
4746 {
4747         struct sock *sk;
4748         u32 sid;
4749
4750         if (!netlbl_enabled())
4751                 return NF_ACCEPT;
4752
4753         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4754          * because we want to make sure we apply the necessary labeling
4755          * before IPsec is applied so we can leverage AH protection */
4756         sk = skb->sk;
4757         if (sk) {
4758                 struct sk_security_struct *sksec;
4759
4760                 if (sk->sk_state == TCP_LISTEN)
4761                         /* if the socket is the listening state then this
4762                          * packet is a SYN-ACK packet which means it needs to
4763                          * be labeled based on the connection/request_sock and
4764                          * not the parent socket.  unfortunately, we can't
4765                          * lookup the request_sock yet as it isn't queued on
4766                          * the parent socket until after the SYN-ACK is sent.
4767                          * the "solution" is to simply pass the packet as-is
4768                          * as any IP option based labeling should be copied
4769                          * from the initial connection request (in the IP
4770                          * layer).  it is far from ideal, but until we get a
4771                          * security label in the packet itself this is the
4772                          * best we can do. */
4773                         return NF_ACCEPT;
4774
4775                 /* standard practice, label using the parent socket */
4776                 sksec = sk->sk_security;
4777                 sid = sksec->sid;
4778         } else
4779                 sid = SECINITSID_KERNEL;
4780         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4781                 return NF_DROP;
4782
4783         return NF_ACCEPT;
4784 }
4785
4786 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4787                                         struct sk_buff *skb,
4788                                         const struct net_device *in,
4789                                         const struct net_device *out,
4790                                         int (*okfn)(struct sk_buff *))
4791 {
4792         return selinux_ip_output(skb, PF_INET);
4793 }
4794
4795 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4796                                                 int ifindex,
4797                                                 u16 family)
4798 {
4799         struct sock *sk = skb->sk;
4800         struct sk_security_struct *sksec;
4801         struct common_audit_data ad;
4802         struct lsm_network_audit net = {0,};
4803         char *addrp;
4804         u8 proto;
4805
4806         if (sk == NULL)
4807                 return NF_ACCEPT;
4808         sksec = sk->sk_security;
4809
4810         ad.type = LSM_AUDIT_DATA_NET;
4811         ad.u.net = &net;
4812         ad.u.net->netif = ifindex;
4813         ad.u.net->family = family;
4814         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4815                 return NF_DROP;
4816
4817         if (selinux_secmark_enabled())
4818                 if (avc_has_perm(sksec->sid, skb->secmark,
4819                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4820                         return NF_DROP_ERR(-ECONNREFUSED);
4821
4822         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4823                 return NF_DROP_ERR(-ECONNREFUSED);
4824
4825         return NF_ACCEPT;
4826 }
4827
4828 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4829                                          u16 family)
4830 {
4831         u32 secmark_perm;
4832         u32 peer_sid;
4833         struct sock *sk;
4834         struct common_audit_data ad;
4835         struct lsm_network_audit net = {0,};
4836         char *addrp;
4837         u8 secmark_active;
4838         u8 peerlbl_active;
4839
4840         /* If any sort of compatibility mode is enabled then handoff processing
4841          * to the selinux_ip_postroute_compat() function to deal with the
4842          * special handling.  We do this in an attempt to keep this function
4843          * as fast and as clean as possible. */
4844         if (!selinux_policycap_netpeer)
4845                 return selinux_ip_postroute_compat(skb, ifindex, family);
4846
4847         secmark_active = selinux_secmark_enabled();
4848         peerlbl_active = selinux_peerlbl_enabled();
4849         if (!secmark_active && !peerlbl_active)
4850                 return NF_ACCEPT;
4851
4852         sk = skb->sk;
4853
4854 #ifdef CONFIG_XFRM
4855         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4856          * packet transformation so allow the packet to pass without any checks
4857          * since we'll have another chance to perform access control checks
4858          * when the packet is on it's final way out.
4859          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4860          *       is NULL, in this case go ahead and apply access control.
4861          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4862          *       TCP listening state we cannot wait until the XFRM processing
4863          *       is done as we will miss out on the SA label if we do;
4864          *       unfortunately, this means more work, but it is only once per
4865          *       connection. */
4866         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4867             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4868                 return NF_ACCEPT;
4869 #endif
4870
4871         if (sk == NULL) {
4872                 /* Without an associated socket the packet is either coming
4873                  * from the kernel or it is being forwarded; check the packet
4874                  * to determine which and if the packet is being forwarded
4875                  * query the packet directly to determine the security label. */
4876                 if (skb->skb_iif) {
4877                         secmark_perm = PACKET__FORWARD_OUT;
4878                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4879                                 return NF_DROP;
4880                 } else {
4881                         secmark_perm = PACKET__SEND;
4882                         peer_sid = SECINITSID_KERNEL;
4883                 }
4884         } else if (sk->sk_state == TCP_LISTEN) {
4885                 /* Locally generated packet but the associated socket is in the
4886                  * listening state which means this is a SYN-ACK packet.  In
4887                  * this particular case the correct security label is assigned
4888                  * to the connection/request_sock but unfortunately we can't
4889                  * query the request_sock as it isn't queued on the parent
4890                  * socket until after the SYN-ACK packet is sent; the only
4891                  * viable choice is to regenerate the label like we do in
4892                  * selinux_inet_conn_request().  See also selinux_ip_output()
4893                  * for similar problems. */
4894                 u32 skb_sid;
4895                 struct sk_security_struct *sksec = sk->sk_security;
4896                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4897                         return NF_DROP;
4898                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4899                  * and the packet has been through at least one XFRM
4900                  * transformation then we must be dealing with the "final"
4901                  * form of labeled IPsec packet; since we've already applied
4902                  * all of our access controls on this packet we can safely
4903                  * pass the packet. */
4904                 if (skb_sid == SECSID_NULL) {
4905                         switch (family) {
4906                         case PF_INET:
4907                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4908                                         return NF_ACCEPT;
4909                                 break;
4910                         case PF_INET6:
4911                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4912                                         return NF_ACCEPT;
4913                         default:
4914                                 return NF_DROP_ERR(-ECONNREFUSED);
4915                         }
4916                 }
4917                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4918                         return NF_DROP;
4919                 secmark_perm = PACKET__SEND;
4920         } else {
4921                 /* Locally generated packet, fetch the security label from the
4922                  * associated socket. */
4923                 struct sk_security_struct *sksec = sk->sk_security;
4924                 peer_sid = sksec->sid;
4925                 secmark_perm = PACKET__SEND;
4926         }
4927
4928         ad.type = LSM_AUDIT_DATA_NET;
4929         ad.u.net = &net;
4930         ad.u.net->netif = ifindex;
4931         ad.u.net->family = family;
4932         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4933                 return NF_DROP;
4934
4935         if (secmark_active)
4936                 if (avc_has_perm(peer_sid, skb->secmark,
4937                                  SECCLASS_PACKET, secmark_perm, &ad))
4938                         return NF_DROP_ERR(-ECONNREFUSED);
4939
4940         if (peerlbl_active) {
4941                 u32 if_sid;
4942                 u32 node_sid;
4943
4944                 if (sel_netif_sid(ifindex, &if_sid))
4945                         return NF_DROP;
4946                 if (avc_has_perm(peer_sid, if_sid,
4947                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4948                         return NF_DROP_ERR(-ECONNREFUSED);
4949
4950                 if (sel_netnode_sid(addrp, family, &node_sid))
4951                         return NF_DROP;
4952                 if (avc_has_perm(peer_sid, node_sid,
4953                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4954                         return NF_DROP_ERR(-ECONNREFUSED);
4955         }
4956
4957         return NF_ACCEPT;
4958 }
4959
4960 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4961                                            struct sk_buff *skb,
4962                                            const struct net_device *in,
4963                                            const struct net_device *out,
4964                                            int (*okfn)(struct sk_buff *))
4965 {
4966         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4967 }
4968
4969 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4970 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4971                                            struct sk_buff *skb,
4972                                            const struct net_device *in,
4973                                            const struct net_device *out,
4974                                            int (*okfn)(struct sk_buff *))
4975 {
4976         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4977 }
4978 #endif  /* IPV6 */
4979
4980 #endif  /* CONFIG_NETFILTER */
4981
4982 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4983 {
4984         int err;
4985
4986         err = cap_netlink_send(sk, skb);
4987         if (err)
4988                 return err;
4989
4990         return selinux_nlmsg_perm(sk, skb);
4991 }
4992
4993 static int ipc_alloc_security(struct task_struct *task,
4994                               struct kern_ipc_perm *perm,
4995                               u16 sclass)
4996 {
4997         struct ipc_security_struct *isec;
4998         u32 sid;
4999
5000         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5001         if (!isec)
5002                 return -ENOMEM;
5003
5004         sid = task_sid(task);
5005         isec->sclass = sclass;
5006         isec->sid = sid;
5007         perm->security = isec;
5008
5009         return 0;
5010 }
5011
5012 static void ipc_free_security(struct kern_ipc_perm *perm)
5013 {
5014         struct ipc_security_struct *isec = perm->security;
5015         perm->security = NULL;
5016         kfree(isec);
5017 }
5018
5019 static int msg_msg_alloc_security(struct msg_msg *msg)
5020 {
5021         struct msg_security_struct *msec;
5022
5023         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5024         if (!msec)
5025                 return -ENOMEM;
5026
5027         msec->sid = SECINITSID_UNLABELED;
5028         msg->security = msec;
5029
5030         return 0;
5031 }
5032
5033 static void msg_msg_free_security(struct msg_msg *msg)
5034 {
5035         struct msg_security_struct *msec = msg->security;
5036
5037         msg->security = NULL;
5038         kfree(msec);
5039 }
5040
5041 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5042                         u32 perms)
5043 {
5044         struct ipc_security_struct *isec;
5045         struct common_audit_data ad;
5046         u32 sid = current_sid();
5047
5048         isec = ipc_perms->security;
5049
5050         ad.type = LSM_AUDIT_DATA_IPC;
5051         ad.u.ipc_id = ipc_perms->key;
5052
5053         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5054 }
5055
5056 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5057 {
5058         return msg_msg_alloc_security(msg);
5059 }
5060
5061 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5062 {
5063         msg_msg_free_security(msg);
5064 }
5065
5066 /* message queue security operations */
5067 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5068 {
5069         struct ipc_security_struct *isec;
5070         struct common_audit_data ad;
5071         u32 sid = current_sid();
5072         int rc;
5073
5074         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5075         if (rc)
5076                 return rc;
5077
5078         isec = msq->q_perm.security;
5079
5080         ad.type = LSM_AUDIT_DATA_IPC;
5081         ad.u.ipc_id = msq->q_perm.key;
5082
5083         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5084                           MSGQ__CREATE, &ad);
5085         if (rc) {
5086                 ipc_free_security(&msq->q_perm);
5087                 return rc;
5088         }
5089         return 0;
5090 }
5091
5092 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5093 {
5094         ipc_free_security(&msq->q_perm);
5095 }
5096
5097 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5098 {
5099         struct ipc_security_struct *isec;
5100         struct common_audit_data ad;
5101         u32 sid = current_sid();
5102
5103         isec = msq->q_perm.security;
5104
5105         ad.type = LSM_AUDIT_DATA_IPC;
5106         ad.u.ipc_id = msq->q_perm.key;
5107
5108         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5109                             MSGQ__ASSOCIATE, &ad);
5110 }
5111
5112 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5113 {
5114         int err;
5115         int perms;
5116
5117         switch (cmd) {
5118         case IPC_INFO:
5119         case MSG_INFO:
5120                 /* No specific object, just general system-wide information. */
5121                 return task_has_system(current, SYSTEM__IPC_INFO);
5122         case IPC_STAT:
5123         case MSG_STAT:
5124                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5125                 break;
5126         case IPC_SET:
5127                 perms = MSGQ__SETATTR;
5128                 break;
5129         case IPC_RMID:
5130                 perms = MSGQ__DESTROY;
5131                 break;
5132         default:
5133                 return 0;
5134         }
5135
5136         err = ipc_has_perm(&msq->q_perm, perms);
5137         return err;
5138 }
5139
5140 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5141 {
5142         struct ipc_security_struct *isec;
5143         struct msg_security_struct *msec;
5144         struct common_audit_data ad;
5145         u32 sid = current_sid();
5146         int rc;
5147
5148         isec = msq->q_perm.security;
5149         msec = msg->security;
5150
5151         /*
5152          * First time through, need to assign label to the message
5153          */
5154         if (msec->sid == SECINITSID_UNLABELED) {
5155                 /*
5156                  * Compute new sid based on current process and
5157                  * message queue this message will be stored in
5158                  */
5159                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5160                                              NULL, &msec->sid);
5161                 if (rc)
5162                         return rc;
5163         }
5164
5165         ad.type = LSM_AUDIT_DATA_IPC;
5166         ad.u.ipc_id = msq->q_perm.key;
5167
5168         /* Can this process write to the queue? */
5169         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5170                           MSGQ__WRITE, &ad);
5171         if (!rc)
5172                 /* Can this process send the message */
5173                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5174                                   MSG__SEND, &ad);
5175         if (!rc)
5176                 /* Can the message be put in the queue? */
5177                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5178                                   MSGQ__ENQUEUE, &ad);
5179
5180         return rc;
5181 }
5182
5183 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5184                                     struct task_struct *target,
5185                                     long type, int mode)
5186 {
5187         struct ipc_security_struct *isec;
5188         struct msg_security_struct *msec;
5189         struct common_audit_data ad;
5190         u32 sid = task_sid(target);
5191         int rc;
5192
5193         isec = msq->q_perm.security;
5194         msec = msg->security;
5195
5196         ad.type = LSM_AUDIT_DATA_IPC;
5197         ad.u.ipc_id = msq->q_perm.key;
5198
5199         rc = avc_has_perm(sid, isec->sid,
5200                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5201         if (!rc)
5202                 rc = avc_has_perm(sid, msec->sid,
5203                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5204         return rc;
5205 }
5206
5207 /* Shared Memory security operations */
5208 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5209 {
5210         struct ipc_security_struct *isec;
5211         struct common_audit_data ad;
5212         u32 sid = current_sid();
5213         int rc;
5214
5215         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5216         if (rc)
5217                 return rc;
5218
5219         isec = shp->shm_perm.security;
5220
5221         ad.type = LSM_AUDIT_DATA_IPC;
5222         ad.u.ipc_id = shp->shm_perm.key;
5223
5224         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5225                           SHM__CREATE, &ad);
5226         if (rc) {
5227                 ipc_free_security(&shp->shm_perm);
5228                 return rc;
5229         }
5230         return 0;
5231 }
5232
5233 static void selinux_shm_free_security(struct shmid_kernel *shp)
5234 {
5235         ipc_free_security(&shp->shm_perm);
5236 }
5237
5238 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5239 {
5240         struct ipc_security_struct *isec;
5241         struct common_audit_data ad;
5242         u32 sid = current_sid();
5243
5244         isec = shp->shm_perm.security;
5245
5246         ad.type = LSM_AUDIT_DATA_IPC;
5247         ad.u.ipc_id = shp->shm_perm.key;
5248
5249         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5250                             SHM__ASSOCIATE, &ad);
5251 }
5252
5253 /* Note, at this point, shp is locked down */
5254 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5255 {
5256         int perms;
5257         int err;
5258
5259         switch (cmd) {
5260         case IPC_INFO:
5261         case SHM_INFO:
5262                 /* No specific object, just general system-wide information. */
5263                 return task_has_system(current, SYSTEM__IPC_INFO);
5264         case IPC_STAT:
5265         case SHM_STAT:
5266                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5267                 break;
5268         case IPC_SET:
5269                 perms = SHM__SETATTR;
5270                 break;
5271         case SHM_LOCK:
5272         case SHM_UNLOCK:
5273                 perms = SHM__LOCK;
5274                 break;
5275         case IPC_RMID:
5276                 perms = SHM__DESTROY;
5277                 break;
5278         default:
5279                 return 0;
5280         }
5281
5282         err = ipc_has_perm(&shp->shm_perm, perms);
5283         return err;
5284 }
5285
5286 static int selinux_shm_shmat(struct shmid_kernel *shp,
5287                              char __user *shmaddr, int shmflg)
5288 {
5289         u32 perms;
5290
5291         if (shmflg & SHM_RDONLY)
5292                 perms = SHM__READ;
5293         else
5294                 perms = SHM__READ | SHM__WRITE;
5295
5296         return ipc_has_perm(&shp->shm_perm, perms);
5297 }
5298
5299 /* Semaphore security operations */
5300 static int selinux_sem_alloc_security(struct sem_array *sma)
5301 {
5302         struct ipc_security_struct *isec;
5303         struct common_audit_data ad;
5304         u32 sid = current_sid();
5305         int rc;
5306
5307         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5308         if (rc)
5309                 return rc;
5310
5311         isec = sma->sem_perm.security;
5312
5313         ad.type = LSM_AUDIT_DATA_IPC;
5314         ad.u.ipc_id = sma->sem_perm.key;
5315
5316         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5317                           SEM__CREATE, &ad);
5318         if (rc) {
5319                 ipc_free_security(&sma->sem_perm);
5320                 return rc;
5321         }
5322         return 0;
5323 }
5324
5325 static void selinux_sem_free_security(struct sem_array *sma)
5326 {
5327         ipc_free_security(&sma->sem_perm);
5328 }
5329
5330 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5331 {
5332         struct ipc_security_struct *isec;
5333         struct common_audit_data ad;
5334         u32 sid = current_sid();
5335
5336         isec = sma->sem_perm.security;
5337
5338         ad.type = LSM_AUDIT_DATA_IPC;
5339         ad.u.ipc_id = sma->sem_perm.key;
5340
5341         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5342                             SEM__ASSOCIATE, &ad);
5343 }
5344
5345 /* Note, at this point, sma is locked down */
5346 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5347 {
5348         int err;
5349         u32 perms;
5350
5351         switch (cmd) {
5352         case IPC_INFO:
5353         case SEM_INFO:
5354                 /* No specific object, just general system-wide information. */
5355                 return task_has_system(current, SYSTEM__IPC_INFO);
5356         case GETPID:
5357         case GETNCNT:
5358         case GETZCNT:
5359                 perms = SEM__GETATTR;
5360                 break;
5361         case GETVAL:
5362         case GETALL:
5363                 perms = SEM__READ;
5364                 break;
5365         case SETVAL:
5366         case SETALL:
5367                 perms = SEM__WRITE;
5368                 break;
5369         case IPC_RMID:
5370                 perms = SEM__DESTROY;
5371                 break;
5372         case IPC_SET:
5373                 perms = SEM__SETATTR;
5374                 break;
5375         case IPC_STAT:
5376         case SEM_STAT:
5377                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5378                 break;
5379         default:
5380                 return 0;
5381         }
5382
5383         err = ipc_has_perm(&sma->sem_perm, perms);
5384         return err;
5385 }
5386
5387 static int selinux_sem_semop(struct sem_array *sma,
5388                              struct sembuf *sops, unsigned nsops, int alter)
5389 {
5390         u32 perms;
5391
5392         if (alter)
5393                 perms = SEM__READ | SEM__WRITE;
5394         else
5395                 perms = SEM__READ;
5396
5397         return ipc_has_perm(&sma->sem_perm, perms);
5398 }
5399
5400 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5401 {
5402         u32 av = 0;
5403
5404         av = 0;
5405         if (flag & S_IRUGO)
5406                 av |= IPC__UNIX_READ;
5407         if (flag & S_IWUGO)
5408                 av |= IPC__UNIX_WRITE;
5409
5410         if (av == 0)
5411                 return 0;
5412
5413         return ipc_has_perm(ipcp, av);
5414 }
5415
5416 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5417 {
5418         struct ipc_security_struct *isec = ipcp->security;
5419         *secid = isec->sid;
5420 }
5421
5422 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5423 {
5424         if (inode)
5425                 inode_doinit_with_dentry(inode, dentry);
5426 }
5427
5428 static int selinux_getprocattr(struct task_struct *p,
5429                                char *name, char **value)
5430 {
5431         const struct task_security_struct *__tsec;
5432         u32 sid;
5433         int error;
5434         unsigned len;
5435
5436         if (current != p) {
5437                 error = current_has_perm(p, PROCESS__GETATTR);
5438                 if (error)
5439                         return error;
5440         }
5441
5442         rcu_read_lock();
5443         __tsec = __task_cred(p)->security;
5444
5445         if (!strcmp(name, "current"))
5446                 sid = __tsec->sid;
5447         else if (!strcmp(name, "prev"))
5448                 sid = __tsec->osid;
5449         else if (!strcmp(name, "exec"))
5450                 sid = __tsec->exec_sid;
5451         else if (!strcmp(name, "fscreate"))
5452                 sid = __tsec->create_sid;
5453         else if (!strcmp(name, "keycreate"))
5454                 sid = __tsec->keycreate_sid;
5455         else if (!strcmp(name, "sockcreate"))
5456                 sid = __tsec->sockcreate_sid;
5457         else
5458                 goto invalid;
5459         rcu_read_unlock();
5460
5461         if (!sid)
5462                 return 0;
5463
5464         error = security_sid_to_context(sid, value, &len);
5465         if (error)
5466                 return error;
5467         return len;
5468
5469 invalid:
5470         rcu_read_unlock();
5471         return -EINVAL;
5472 }
5473
5474 static int selinux_setprocattr(struct task_struct *p,
5475                                char *name, void *value, size_t size)
5476 {
5477         struct task_security_struct *tsec;
5478         struct task_struct *tracer;
5479         struct cred *new;
5480         u32 sid = 0, ptsid;
5481         int error;
5482         char *str = value;
5483
5484         if (current != p) {
5485                 /* SELinux only allows a process to change its own
5486                    security attributes. */
5487                 return -EACCES;
5488         }
5489
5490         /*
5491          * Basic control over ability to set these attributes at all.
5492          * current == p, but we'll pass them separately in case the
5493          * above restriction is ever removed.
5494          */
5495         if (!strcmp(name, "exec"))
5496                 error = current_has_perm(p, PROCESS__SETEXEC);
5497         else if (!strcmp(name, "fscreate"))
5498                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5499         else if (!strcmp(name, "keycreate"))
5500                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5501         else if (!strcmp(name, "sockcreate"))
5502                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5503         else if (!strcmp(name, "current"))
5504                 error = current_has_perm(p, PROCESS__SETCURRENT);
5505         else
5506                 error = -EINVAL;
5507         if (error)
5508                 return error;
5509
5510         /* Obtain a SID for the context, if one was specified. */
5511         if (size && str[1] && str[1] != '\n') {
5512                 if (str[size-1] == '\n') {
5513                         str[size-1] = 0;
5514                         size--;
5515                 }
5516                 error = security_context_to_sid(value, size, &sid);
5517                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5518                         if (!capable(CAP_MAC_ADMIN)) {
5519                                 struct audit_buffer *ab;
5520                                 size_t audit_size;
5521
5522                                 /* We strip a nul only if it is at the end, otherwise the
5523                                  * context contains a nul and we should audit that */
5524                                 if (str[size - 1] == '\0')
5525                                         audit_size = size - 1;
5526                                 else
5527                                         audit_size = size;
5528                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5529                                 audit_log_format(ab, "op=fscreate invalid_context=");
5530                                 audit_log_n_untrustedstring(ab, value, audit_size);
5531                                 audit_log_end(ab);
5532
5533                                 return error;
5534                         }
5535                         error = security_context_to_sid_force(value, size,
5536                                                               &sid);
5537                 }
5538                 if (error)
5539                         return error;
5540         }
5541
5542         new = prepare_creds();
5543         if (!new)
5544                 return -ENOMEM;
5545
5546         /* Permission checking based on the specified context is
5547            performed during the actual operation (execve,
5548            open/mkdir/...), when we know the full context of the
5549            operation.  See selinux_bprm_set_creds for the execve
5550            checks and may_create for the file creation checks. The
5551            operation will then fail if the context is not permitted. */
5552         tsec = new->security;
5553         if (!strcmp(name, "exec")) {
5554                 tsec->exec_sid = sid;
5555         } else if (!strcmp(name, "fscreate")) {
5556                 tsec->create_sid = sid;
5557         } else if (!strcmp(name, "keycreate")) {
5558                 error = may_create_key(sid, p);
5559                 if (error)
5560                         goto abort_change;
5561                 tsec->keycreate_sid = sid;
5562         } else if (!strcmp(name, "sockcreate")) {
5563                 tsec->sockcreate_sid = sid;
5564         } else if (!strcmp(name, "current")) {
5565                 error = -EINVAL;
5566                 if (sid == 0)
5567                         goto abort_change;
5568
5569                 /* Only allow single threaded processes to change context */
5570                 error = -EPERM;
5571                 if (!current_is_single_threaded()) {
5572                         error = security_bounded_transition(tsec->sid, sid);
5573                         if (error)
5574                                 goto abort_change;
5575                 }
5576
5577                 /* Check permissions for the transition. */
5578                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5579                                      PROCESS__DYNTRANSITION, NULL);
5580                 if (error)
5581                         goto abort_change;
5582
5583                 /* Check for ptracing, and update the task SID if ok.
5584                    Otherwise, leave SID unchanged and fail. */
5585                 ptsid = 0;
5586                 rcu_read_lock();
5587                 tracer = ptrace_parent(p);
5588                 if (tracer)
5589                         ptsid = task_sid(tracer);
5590                 rcu_read_unlock();
5591
5592                 if (tracer) {
5593                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5594                                              PROCESS__PTRACE, NULL);
5595                         if (error)
5596                                 goto abort_change;
5597                 }
5598
5599                 tsec->sid = sid;
5600         } else {
5601                 error = -EINVAL;
5602                 goto abort_change;
5603         }
5604
5605         commit_creds(new);
5606         return size;
5607
5608 abort_change:
5609         abort_creds(new);
5610         return error;
5611 }
5612
5613 static int selinux_ismaclabel(const char *name)
5614 {
5615         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5616 }
5617
5618 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5619 {
5620         return security_sid_to_context(secid, secdata, seclen);
5621 }
5622
5623 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5624 {
5625         return security_context_to_sid(secdata, seclen, secid);
5626 }
5627
5628 static void selinux_release_secctx(char *secdata, u32 seclen)
5629 {
5630         kfree(secdata);
5631 }
5632
5633 /*
5634  *      called with inode->i_mutex locked
5635  */
5636 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5637 {
5638         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5639 }
5640
5641 /*
5642  *      called with inode->i_mutex locked
5643  */
5644 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5645 {
5646         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5647 }
5648
5649 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5650 {
5651         int len = 0;
5652         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5653                                                 ctx, true);
5654         if (len < 0)
5655                 return len;
5656         *ctxlen = len;
5657         return 0;
5658 }
5659 #ifdef CONFIG_KEYS
5660
5661 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5662                              unsigned long flags)
5663 {
5664         const struct task_security_struct *tsec;
5665         struct key_security_struct *ksec;
5666
5667         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5668         if (!ksec)
5669                 return -ENOMEM;
5670
5671         tsec = cred->security;
5672         if (tsec->keycreate_sid)
5673                 ksec->sid = tsec->keycreate_sid;
5674         else
5675                 ksec->sid = tsec->sid;
5676
5677         k->security = ksec;
5678         return 0;
5679 }
5680
5681 static void selinux_key_free(struct key *k)
5682 {
5683         struct key_security_struct *ksec = k->security;
5684
5685         k->security = NULL;
5686         kfree(ksec);
5687 }
5688
5689 static int selinux_key_permission(key_ref_t key_ref,
5690                                   const struct cred *cred,
5691                                   key_perm_t perm)
5692 {
5693         struct key *key;
5694         struct key_security_struct *ksec;
5695         u32 sid;
5696
5697         /* if no specific permissions are requested, we skip the
5698            permission check. No serious, additional covert channels
5699            appear to be created. */
5700         if (perm == 0)
5701                 return 0;
5702
5703         sid = cred_sid(cred);
5704
5705         key = key_ref_to_ptr(key_ref);
5706         ksec = key->security;
5707
5708         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5709 }
5710
5711 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5712 {
5713         struct key_security_struct *ksec = key->security;
5714         char *context = NULL;
5715         unsigned len;
5716         int rc;
5717
5718         rc = security_sid_to_context(ksec->sid, &context, &len);
5719         if (!rc)
5720                 rc = len;
5721         *_buffer = context;
5722         return rc;
5723 }
5724
5725 #endif
5726
5727 static struct security_operations selinux_ops = {
5728         .name =                         "selinux",
5729
5730         .ptrace_access_check =          selinux_ptrace_access_check,
5731         .ptrace_traceme =               selinux_ptrace_traceme,
5732         .capget =                       selinux_capget,
5733         .capset =                       selinux_capset,
5734         .capable =                      selinux_capable,
5735         .quotactl =                     selinux_quotactl,
5736         .quota_on =                     selinux_quota_on,
5737         .syslog =                       selinux_syslog,
5738         .vm_enough_memory =             selinux_vm_enough_memory,
5739
5740         .netlink_send =                 selinux_netlink_send,
5741
5742         .bprm_set_creds =               selinux_bprm_set_creds,
5743         .bprm_committing_creds =        selinux_bprm_committing_creds,
5744         .bprm_committed_creds =         selinux_bprm_committed_creds,
5745         .bprm_secureexec =              selinux_bprm_secureexec,
5746
5747         .sb_alloc_security =            selinux_sb_alloc_security,
5748         .sb_free_security =             selinux_sb_free_security,
5749         .sb_copy_data =                 selinux_sb_copy_data,
5750         .sb_remount =                   selinux_sb_remount,
5751         .sb_kern_mount =                selinux_sb_kern_mount,
5752         .sb_show_options =              selinux_sb_show_options,
5753         .sb_statfs =                    selinux_sb_statfs,
5754         .sb_mount =                     selinux_mount,
5755         .sb_umount =                    selinux_umount,
5756         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5757         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5758         .sb_parse_opts_str =            selinux_parse_opts_str,
5759
5760         .dentry_init_security =         selinux_dentry_init_security,
5761
5762         .inode_alloc_security =         selinux_inode_alloc_security,
5763         .inode_free_security =          selinux_inode_free_security,
5764         .inode_init_security =          selinux_inode_init_security,
5765         .inode_create =                 selinux_inode_create,
5766         .inode_link =                   selinux_inode_link,
5767         .inode_unlink =                 selinux_inode_unlink,
5768         .inode_symlink =                selinux_inode_symlink,
5769         .inode_mkdir =                  selinux_inode_mkdir,
5770         .inode_rmdir =                  selinux_inode_rmdir,
5771         .inode_mknod =                  selinux_inode_mknod,
5772         .inode_rename =                 selinux_inode_rename,
5773         .inode_readlink =               selinux_inode_readlink,
5774         .inode_follow_link =            selinux_inode_follow_link,
5775         .inode_permission =             selinux_inode_permission,
5776         .inode_setattr =                selinux_inode_setattr,
5777         .inode_getattr =                selinux_inode_getattr,
5778         .inode_setxattr =               selinux_inode_setxattr,
5779         .inode_post_setxattr =          selinux_inode_post_setxattr,
5780         .inode_getxattr =               selinux_inode_getxattr,
5781         .inode_listxattr =              selinux_inode_listxattr,
5782         .inode_removexattr =            selinux_inode_removexattr,
5783         .inode_getsecurity =            selinux_inode_getsecurity,
5784         .inode_setsecurity =            selinux_inode_setsecurity,
5785         .inode_listsecurity =           selinux_inode_listsecurity,
5786         .inode_getsecid =               selinux_inode_getsecid,
5787
5788         .file_permission =              selinux_file_permission,
5789         .file_alloc_security =          selinux_file_alloc_security,
5790         .file_free_security =           selinux_file_free_security,
5791         .file_ioctl =                   selinux_file_ioctl,
5792         .mmap_file =                    selinux_mmap_file,
5793         .mmap_addr =                    selinux_mmap_addr,
5794         .file_mprotect =                selinux_file_mprotect,
5795         .file_lock =                    selinux_file_lock,
5796         .file_fcntl =                   selinux_file_fcntl,
5797         .file_set_fowner =              selinux_file_set_fowner,
5798         .file_send_sigiotask =          selinux_file_send_sigiotask,
5799         .file_receive =                 selinux_file_receive,
5800
5801         .file_open =                    selinux_file_open,
5802
5803         .task_create =                  selinux_task_create,
5804         .cred_alloc_blank =             selinux_cred_alloc_blank,
5805         .cred_free =                    selinux_cred_free,
5806         .cred_prepare =                 selinux_cred_prepare,
5807         .cred_transfer =                selinux_cred_transfer,
5808         .kernel_act_as =                selinux_kernel_act_as,
5809         .kernel_create_files_as =       selinux_kernel_create_files_as,
5810         .kernel_module_request =        selinux_kernel_module_request,
5811         .task_setpgid =                 selinux_task_setpgid,
5812         .task_getpgid =                 selinux_task_getpgid,
5813         .task_getsid =                  selinux_task_getsid,
5814         .task_getsecid =                selinux_task_getsecid,
5815         .task_setnice =                 selinux_task_setnice,
5816         .task_setioprio =               selinux_task_setioprio,
5817         .task_getioprio =               selinux_task_getioprio,
5818         .task_setrlimit =               selinux_task_setrlimit,
5819         .task_setscheduler =            selinux_task_setscheduler,
5820         .task_getscheduler =            selinux_task_getscheduler,
5821         .task_movememory =              selinux_task_movememory,
5822         .task_kill =                    selinux_task_kill,
5823         .task_wait =                    selinux_task_wait,
5824         .task_to_inode =                selinux_task_to_inode,
5825
5826         .ipc_permission =               selinux_ipc_permission,
5827         .ipc_getsecid =                 selinux_ipc_getsecid,
5828
5829         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5830         .msg_msg_free_security =        selinux_msg_msg_free_security,
5831
5832         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5833         .msg_queue_free_security =      selinux_msg_queue_free_security,
5834         .msg_queue_associate =          selinux_msg_queue_associate,
5835         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5836         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5837         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5838
5839         .shm_alloc_security =           selinux_shm_alloc_security,
5840         .shm_free_security =            selinux_shm_free_security,
5841         .shm_associate =                selinux_shm_associate,
5842         .shm_shmctl =                   selinux_shm_shmctl,
5843         .shm_shmat =                    selinux_shm_shmat,
5844
5845         .sem_alloc_security =           selinux_sem_alloc_security,
5846         .sem_free_security =            selinux_sem_free_security,
5847         .sem_associate =                selinux_sem_associate,
5848         .sem_semctl =                   selinux_sem_semctl,
5849         .sem_semop =                    selinux_sem_semop,
5850
5851         .d_instantiate =                selinux_d_instantiate,
5852
5853         .getprocattr =                  selinux_getprocattr,
5854         .setprocattr =                  selinux_setprocattr,
5855
5856         .ismaclabel =                   selinux_ismaclabel,
5857         .secid_to_secctx =              selinux_secid_to_secctx,
5858         .secctx_to_secid =              selinux_secctx_to_secid,
5859         .release_secctx =               selinux_release_secctx,
5860         .inode_notifysecctx =           selinux_inode_notifysecctx,
5861         .inode_setsecctx =              selinux_inode_setsecctx,
5862         .inode_getsecctx =              selinux_inode_getsecctx,
5863
5864         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5865         .unix_may_send =                selinux_socket_unix_may_send,
5866
5867         .socket_create =                selinux_socket_create,
5868         .socket_post_create =           selinux_socket_post_create,
5869         .socket_bind =                  selinux_socket_bind,
5870         .socket_connect =               selinux_socket_connect,
5871         .socket_listen =                selinux_socket_listen,
5872         .socket_accept =                selinux_socket_accept,
5873         .socket_sendmsg =               selinux_socket_sendmsg,
5874         .socket_recvmsg =               selinux_socket_recvmsg,
5875         .socket_getsockname =           selinux_socket_getsockname,
5876         .socket_getpeername =           selinux_socket_getpeername,
5877         .socket_getsockopt =            selinux_socket_getsockopt,
5878         .socket_setsockopt =            selinux_socket_setsockopt,
5879         .socket_shutdown =              selinux_socket_shutdown,
5880         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5881         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5882         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5883         .sk_alloc_security =            selinux_sk_alloc_security,
5884         .sk_free_security =             selinux_sk_free_security,
5885         .sk_clone_security =            selinux_sk_clone_security,
5886         .sk_getsecid =                  selinux_sk_getsecid,
5887         .sock_graft =                   selinux_sock_graft,
5888         .inet_conn_request =            selinux_inet_conn_request,
5889         .inet_csk_clone =               selinux_inet_csk_clone,
5890         .inet_conn_established =        selinux_inet_conn_established,
5891         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5892         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5893         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5894         .req_classify_flow =            selinux_req_classify_flow,
5895         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5896         .tun_dev_free_security =        selinux_tun_dev_free_security,
5897         .tun_dev_create =               selinux_tun_dev_create,
5898         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5899         .tun_dev_attach =               selinux_tun_dev_attach,
5900         .tun_dev_open =                 selinux_tun_dev_open,
5901         .skb_owned_by =                 selinux_skb_owned_by,
5902
5903 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5904         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5905         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5906         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5907         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5908         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5909         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5910         .xfrm_state_free_security =     selinux_xfrm_state_free,
5911         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5912         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5913         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5914         .xfrm_decode_session =          selinux_xfrm_decode_session,
5915 #endif
5916
5917 #ifdef CONFIG_KEYS
5918         .key_alloc =                    selinux_key_alloc,
5919         .key_free =                     selinux_key_free,
5920         .key_permission =               selinux_key_permission,
5921         .key_getsecurity =              selinux_key_getsecurity,
5922 #endif
5923
5924 #ifdef CONFIG_AUDIT
5925         .audit_rule_init =              selinux_audit_rule_init,
5926         .audit_rule_known =             selinux_audit_rule_known,
5927         .audit_rule_match =             selinux_audit_rule_match,
5928         .audit_rule_free =              selinux_audit_rule_free,
5929 #endif
5930 };
5931
5932 static __init int selinux_init(void)
5933 {
5934         if (!security_module_enable(&selinux_ops)) {
5935                 selinux_enabled = 0;
5936                 return 0;
5937         }
5938
5939         if (!selinux_enabled) {
5940                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5941                 return 0;
5942         }
5943
5944         printk(KERN_INFO "SELinux:  Initializing.\n");
5945
5946         /* Set the security state for the initial task. */
5947         cred_init_security();
5948
5949         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5950
5951         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5952                                             sizeof(struct inode_security_struct),
5953                                             0, SLAB_PANIC, NULL);
5954         avc_init();
5955
5956         if (register_security(&selinux_ops))
5957                 panic("SELinux: Unable to register with kernel.\n");
5958
5959         if (selinux_enforcing)
5960                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5961         else
5962                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5963
5964         return 0;
5965 }
5966
5967 static void delayed_superblock_init(struct super_block *sb, void *unused)
5968 {
5969         superblock_doinit(sb, NULL);
5970 }
5971
5972 void selinux_complete_init(void)
5973 {
5974         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5975
5976         /* Set up any superblocks initialized prior to the policy load. */
5977         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5978         iterate_supers(delayed_superblock_init, NULL);
5979 }
5980
5981 /* SELinux requires early initialization in order to label
5982    all processes and objects when they are created. */
5983 security_initcall(selinux_init);
5984
5985 #if defined(CONFIG_NETFILTER)
5986
5987 static struct nf_hook_ops selinux_ipv4_ops[] = {
5988         {
5989                 .hook =         selinux_ipv4_postroute,
5990                 .owner =        THIS_MODULE,
5991                 .pf =           NFPROTO_IPV4,
5992                 .hooknum =      NF_INET_POST_ROUTING,
5993                 .priority =     NF_IP_PRI_SELINUX_LAST,
5994         },
5995         {
5996                 .hook =         selinux_ipv4_forward,
5997                 .owner =        THIS_MODULE,
5998                 .pf =           NFPROTO_IPV4,
5999                 .hooknum =      NF_INET_FORWARD,
6000                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6001         },
6002         {
6003                 .hook =         selinux_ipv4_output,
6004                 .owner =        THIS_MODULE,
6005                 .pf =           NFPROTO_IPV4,
6006                 .hooknum =      NF_INET_LOCAL_OUT,
6007                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6008         }
6009 };
6010
6011 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6012
6013 static struct nf_hook_ops selinux_ipv6_ops[] = {
6014         {
6015                 .hook =         selinux_ipv6_postroute,
6016                 .owner =        THIS_MODULE,
6017                 .pf =           NFPROTO_IPV6,
6018                 .hooknum =      NF_INET_POST_ROUTING,
6019                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6020         },
6021         {
6022                 .hook =         selinux_ipv6_forward,
6023                 .owner =        THIS_MODULE,
6024                 .pf =           NFPROTO_IPV6,
6025                 .hooknum =      NF_INET_FORWARD,
6026                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6027         }
6028 };
6029
6030 #endif  /* IPV6 */
6031
6032 static int __init selinux_nf_ip_init(void)
6033 {
6034         int err = 0;
6035
6036         if (!selinux_enabled)
6037                 goto out;
6038
6039         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6040
6041         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6042         if (err)
6043                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6044
6045 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6046         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6047         if (err)
6048                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6049 #endif  /* IPV6 */
6050
6051 out:
6052         return err;
6053 }
6054
6055 __initcall(selinux_nf_ip_init);
6056
6057 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6058 static void selinux_nf_ip_exit(void)
6059 {
6060         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6061
6062         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6063 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6064         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6065 #endif  /* IPV6 */
6066 }
6067 #endif
6068
6069 #else /* CONFIG_NETFILTER */
6070
6071 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6072 #define selinux_nf_ip_exit()
6073 #endif
6074
6075 #endif /* CONFIG_NETFILTER */
6076
6077 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6078 static int selinux_disabled;
6079
6080 int selinux_disable(void)
6081 {
6082         if (ss_initialized) {
6083                 /* Not permitted after initial policy load. */
6084                 return -EINVAL;
6085         }
6086
6087         if (selinux_disabled) {
6088                 /* Only do this once. */
6089                 return -EINVAL;
6090         }
6091
6092         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6093
6094         selinux_disabled = 1;
6095         selinux_enabled = 0;
6096
6097         reset_security_ops();
6098
6099         /* Try to destroy the avc node cache */
6100         avc_disable();
6101
6102         /* Unregister netfilter hooks. */
6103         selinux_nf_ip_exit();
6104
6105         /* Unregister selinuxfs. */
6106         exit_sel_fs();
6107
6108         return 0;
6109 }
6110 #endif