security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76
  77 #define XATTR_SELINUX_SUFFIX "selinux"
  78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  79
  80 extern unsigned int policydb_loaded_version;
  81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  82
  83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  84 int selinux_enforcing = 0;
  85
  86 static int __init enforcing_setup(char *str)
  87 {
  88         selinux_enforcing = simple_strtol(str,NULL,0);
  89         return 1;
  90 }
  91 __setup("enforcing=", enforcing_setup);
  92 #endif
  93
  94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  96
  97 static int __init selinux_enabled_setup(char *str)
  98 {
  99         selinux_enabled = simple_strtol(str, NULL, 0);
 100         return 1;
 101 }
 102 __setup("selinux=", selinux_enabled_setup);
 103 #endif
 104
 105 /* Original (dummy) security module. */
 106 static struct security_operations *original_ops = NULL;
 107
 108 /* Minimal support for a secondary security module,
 109    just to allow the use of the dummy or capability modules.
 110    The owlsm module can alternatively be used as a secondary
 111    module as long as CONFIG_OWLSM_FD is not enabled. */
 112 static struct security_operations *secondary_ops = NULL;
 113
 114 /* Lists of inode and superblock security structures initialized
 115    before the policy was loaded. */
 116 static LIST_HEAD(superblock_security_head);
 117 static DEFINE_SPINLOCK(sb_security_lock);
 118
 119 /* Allocate and free functions for each kind of security blob. */
 120
 121 static int task_alloc_security(struct task_struct *task)
 122 {
 123         struct task_security_struct *tsec;
 124
 125         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 126         if (!tsec)
 127                 return -ENOMEM;
 128
 129         memset(tsec, 0, sizeof(struct task_security_struct));
 130         tsec->magic = SELINUX_MAGIC;
 131         tsec->task = task;
 132         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 133         task->security = tsec;
 134
 135         return 0;
 136 }
 137
 138 static void task_free_security(struct task_struct *task)
 139 {
 140         struct task_security_struct *tsec = task->security;
 141
 142         if (!tsec || tsec->magic != SELINUX_MAGIC)
 143                 return;
 144
 145         task->security = NULL;
 146         kfree(tsec);
 147 }
 148
 149 static int inode_alloc_security(struct inode *inode)
 150 {
 151         struct task_security_struct *tsec = current->security;
 152         struct inode_security_struct *isec;
 153
 154         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 155         if (!isec)
 156                 return -ENOMEM;
 157
 158         memset(isec, 0, sizeof(struct inode_security_struct));
 159         init_MUTEX(&isec->sem);
 160         INIT_LIST_HEAD(&isec->list);
 161         isec->magic = SELINUX_MAGIC;
 162         isec->inode = inode;
 163         isec->sid = SECINITSID_UNLABELED;
 164         isec->sclass = SECCLASS_FILE;
 165         if (tsec && tsec->magic == SELINUX_MAGIC)
 166                 isec->task_sid = tsec->sid;
 167         else
 168                 isec->task_sid = SECINITSID_UNLABELED;
 169         inode->i_security = isec;
 170
 171         return 0;
 172 }
 173
 174 static void inode_free_security(struct inode *inode)
 175 {
 176         struct inode_security_struct *isec = inode->i_security;
 177         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 178
 179         if (!isec || isec->magic != SELINUX_MAGIC)
 180                 return;
 181
 182         spin_lock(&sbsec->isec_lock);
 183         if (!list_empty(&isec->list))
 184                 list_del_init(&isec->list);
 185         spin_unlock(&sbsec->isec_lock);
 186
 187         inode->i_security = NULL;
 188         kfree(isec);
 189 }
 190
 191 static int file_alloc_security(struct file *file)
 192 {
 193         struct task_security_struct *tsec = current->security;
 194         struct file_security_struct *fsec;
 195
 196         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 197         if (!fsec)
 198                 return -ENOMEM;
 199
 200         memset(fsec, 0, sizeof(struct file_security_struct));
 201         fsec->magic = SELINUX_MAGIC;
 202         fsec->file = file;
 203         if (tsec && tsec->magic == SELINUX_MAGIC) {
 204                 fsec->sid = tsec->sid;
 205                 fsec->fown_sid = tsec->sid;
 206         } else {
 207                 fsec->sid = SECINITSID_UNLABELED;
 208                 fsec->fown_sid = SECINITSID_UNLABELED;
 209         }
 210         file->f_security = fsec;
 211
 212         return 0;
 213 }
 214
 215 static void file_free_security(struct file *file)
 216 {
 217         struct file_security_struct *fsec = file->f_security;
 218
 219         if (!fsec || fsec->magic != SELINUX_MAGIC)
 220                 return;
 221
 222         file->f_security = NULL;
 223         kfree(fsec);
 224 }
 225
 226 static int superblock_alloc_security(struct super_block *sb)
 227 {
 228         struct superblock_security_struct *sbsec;
 229
 230         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 231         if (!sbsec)
 232                 return -ENOMEM;
 233
 234         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 235         init_MUTEX(&sbsec->sem);
 236         INIT_LIST_HEAD(&sbsec->list);
 237         INIT_LIST_HEAD(&sbsec->isec_head);
 238         spin_lock_init(&sbsec->isec_lock);
 239         sbsec->magic = SELINUX_MAGIC;
 240         sbsec->sb = sb;
 241         sbsec->sid = SECINITSID_UNLABELED;
 242         sbsec->def_sid = SECINITSID_FILE;
 243         sb->s_security = sbsec;
 244
 245         return 0;
 246 }
 247
 248 static void superblock_free_security(struct super_block *sb)
 249 {
 250         struct superblock_security_struct *sbsec = sb->s_security;
 251
 252         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 253                 return;
 254
 255         spin_lock(&sb_security_lock);
 256         if (!list_empty(&sbsec->list))
 257                 list_del_init(&sbsec->list);
 258         spin_unlock(&sb_security_lock);
 259
 260         sb->s_security = NULL;
 261         kfree(sbsec);
 262 }
 263
 264 #ifdef CONFIG_SECURITY_NETWORK
 265 static int sk_alloc_security(struct sock *sk, int family, int priority)
 266 {
 267         struct sk_security_struct *ssec;
 268
 269         if (family != PF_UNIX)
 270                 return 0;
 271
 272         ssec = kmalloc(sizeof(*ssec), priority);
 273         if (!ssec)
 274                 return -ENOMEM;
 275
 276         memset(ssec, 0, sizeof(*ssec));
 277         ssec->magic = SELINUX_MAGIC;
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         sk->sk_security = ssec;
 281
 282         return 0;
 283 }
 284
 285 static void sk_free_security(struct sock *sk)
 286 {
 287         struct sk_security_struct *ssec = sk->sk_security;
 288
 289         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 290                 return;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295 #endif  /* CONFIG_SECURITY_NETWORK */
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329 };
 330
 331 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 332
 333 static int try_context_mount(struct super_block *sb, void *data)
 334 {
 335         char *context = NULL, *defcontext = NULL;
 336         const char *name;
 337         u32 sid;
 338         int alloc = 0, rc = 0, seen = 0;
 339         struct task_security_struct *tsec = current->security;
 340         struct superblock_security_struct *sbsec = sb->s_security;
 341
 342         if (!data)
 343                 goto out;
 344
 345         name = sb->s_type->name;
 346
 347         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 348
 349                 /* NFS we understand. */
 350                 if (!strcmp(name, "nfs")) {
 351                         struct nfs_mount_data *d = data;
 352
 353                         if (d->version <  NFS_MOUNT_VERSION)
 354                                 goto out;
 355
 356                         if (d->context[0]) {
 357                                 context = d->context;
 358                                 seen |= Opt_context;
 359                         }
 360                 } else
 361                         goto out;
 362
 363         } else {
 364                 /* Standard string-based options. */
 365                 char *p, *options = data;
 366
 367                 while ((p = strsep(&options, ",")) != NULL) {
 368                         int token;
 369                         substring_t args[MAX_OPT_ARGS];
 370
 371                         if (!*p)
 372                                 continue;
 373
 374                         token = match_token(p, tokens, args);
 375
 376                         switch (token) {
 377                         case Opt_context:
 378                                 if (seen) {
 379                                         rc = -EINVAL;
 380                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 381                                         goto out_free;
 382                                 }
 383                                 context = match_strdup(&args[0]);
 384                                 if (!context) {
 385                                         rc = -ENOMEM;
 386                                         goto out_free;
 387                                 }
 388                                 if (!alloc)
 389                                         alloc = 1;
 390                                 seen |= Opt_context;
 391                                 break;
 392
 393                         case Opt_fscontext:
 394                                 if (seen & (Opt_context|Opt_fscontext)) {
 395                                         rc = -EINVAL;
 396                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 397                                         goto out_free;
 398                                 }
 399                                 context = match_strdup(&args[0]);
 400                                 if (!context) {
 401                                         rc = -ENOMEM;
 402                                         goto out_free;
 403                                 }
 404                                 if (!alloc)
 405                                         alloc = 1;
 406                                 seen |= Opt_fscontext;
 407                                 break;
 408
 409                         case Opt_defcontext:
 410                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 411                                         rc = -EINVAL;
 412                                         printk(KERN_WARNING "SELinux:  "
 413                                                "defcontext option is invalid "
 414                                                "for this filesystem type\n");
 415                                         goto out_free;
 416                                 }
 417                                 if (seen & (Opt_context|Opt_defcontext)) {
 418                                         rc = -EINVAL;
 419                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 420                                         goto out_free;
 421                                 }
 422                                 defcontext = match_strdup(&args[0]);
 423                                 if (!defcontext) {
 424                                         rc = -ENOMEM;
 425                                         goto out_free;
 426                                 }
 427                                 if (!alloc)
 428                                         alloc = 1;
 429                                 seen |= Opt_defcontext;
 430                                 break;
 431
 432                         default:
 433                                 rc = -EINVAL;
 434                                 printk(KERN_WARNING "SELinux:  unknown mount "
 435                                        "option\n");
 436                                 goto out_free;
 437
 438                         }
 439                 }
 440         }
 441
 442         if (!seen)
 443                 goto out;
 444
 445         if (context) {
 446                 rc = security_context_to_sid(context, strlen(context), &sid);
 447                 if (rc) {
 448                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 449                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 450                                context, sb->s_id, name, rc);
 451                         goto out_free;
 452                 }
 453
 454                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELFROM, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 460                                   FILESYSTEM__RELABELTO, NULL);
 461                 if (rc)
 462                         goto out_free;
 463
 464                 sbsec->sid = sid;
 465
 466                 if (seen & Opt_context)
 467                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 468         }
 469
 470         if (defcontext) {
 471                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 472                 if (rc) {
 473                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 474                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 475                                defcontext, sb->s_id, name, rc);
 476                         goto out_free;
 477                 }
 478
 479                 if (sid == sbsec->def_sid)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__RELABELFROM, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 488                                   FILESYSTEM__ASSOCIATE, NULL);
 489                 if (rc)
 490                         goto out_free;
 491
 492                 sbsec->def_sid = sid;
 493         }
 494
 495 out_free:
 496         if (alloc) {
 497                 kfree(context);
 498                 kfree(defcontext);
 499         }
 500 out:
 501         return rc;
 502 }
 503
 504 static int superblock_doinit(struct super_block *sb, void *data)
 505 {
 506         struct superblock_security_struct *sbsec = sb->s_security;
 507         struct dentry *root = sb->s_root;
 508         struct inode *inode = root->d_inode;
 509         int rc = 0;
 510
 511         down(&sbsec->sem);
 512         if (sbsec->initialized)
 513                 goto out;
 514
 515         if (!ss_initialized) {
 516                 /* Defer initialization until selinux_complete_init,
 517                    after the initial policy is loaded and the security
 518                    server is ready to handle calls. */
 519                 spin_lock(&sb_security_lock);
 520                 if (list_empty(&sbsec->list))
 521                         list_add(&sbsec->list, &superblock_security_head);
 522                 spin_unlock(&sb_security_lock);
 523                 goto out;
 524         }
 525
 526         /* Determine the labeling behavior to use for this filesystem type. */
 527         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 528         if (rc) {
 529                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 530                        __FUNCTION__, sb->s_type->name, rc);
 531                 goto out;
 532         }
 533
 534         rc = try_context_mount(sb, data);
 535         if (rc)
 536                 goto out;
 537
 538         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 539                 /* Make sure that the xattr handler exists and that no
 540                    error other than -ENODATA is returned by getxattr on
 541                    the root directory.  -ENODATA is ok, as this may be
 542                    the first boot of the SELinux kernel before we have
 543                    assigned xattr values to the filesystem. */
 544                 if (!inode->i_op->getxattr) {
 545                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 546                                "xattr support\n", sb->s_id, sb->s_type->name);
 547                         rc = -EOPNOTSUPP;
 548                         goto out;
 549                 }
 550                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 551                 if (rc < 0 && rc != -ENODATA) {
 552                         if (rc == -EOPNOTSUPP)
 553                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 554                                        "%s) has no security xattr handler\n",
 555                                        sb->s_id, sb->s_type->name);
 556                         else
 557                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 558                                        "%s) getxattr errno %d\n", sb->s_id,
 559                                        sb->s_type->name, -rc);
 560                         goto out;
 561                 }
 562         }
 563
 564         if (strcmp(sb->s_type->name, "proc") == 0)
 565                 sbsec->proc = 1;
 566
 567         sbsec->initialized = 1;
 568
 569         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 570                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 571                        sb->s_id, sb->s_type->name);
 572         }
 573         else {
 574                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 575                        sb->s_id, sb->s_type->name,
 576                        labeling_behaviors[sbsec->behavior-1]);
 577         }
 578
 579         /* Initialize the root inode. */
 580         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 581
 582         /* Initialize any other inodes associated with the superblock, e.g.
 583            inodes created prior to initial policy load or inodes created
 584            during get_sb by a pseudo filesystem that directly
 585            populates itself. */
 586         spin_lock(&sbsec->isec_lock);
 587 next_inode:
 588         if (!list_empty(&sbsec->isec_head)) {
 589                 struct inode_security_struct *isec =
 590                                 list_entry(sbsec->isec_head.next,
 591                                            struct inode_security_struct, list);
 592                 struct inode *inode = isec->inode;
 593                 spin_unlock(&sbsec->isec_lock);
 594                 inode = igrab(inode);
 595                 if (inode) {
 596                         if (!IS_PRIVATE (inode))
 597                                 inode_doinit(inode);
 598                         iput(inode);
 599                 }
 600                 spin_lock(&sbsec->isec_lock);
 601                 list_del_init(&isec->list);
 602                 goto next_inode;
 603         }
 604         spin_unlock(&sbsec->isec_lock);
 605 out:
 606         up(&sbsec->sem);
 607         return rc;
 608 }
 609
 610 static inline u16 inode_mode_to_security_class(umode_t mode)
 611 {
 612         switch (mode & S_IFMT) {
 613         case S_IFSOCK:
 614                 return SECCLASS_SOCK_FILE;
 615         case S_IFLNK:
 616                 return SECCLASS_LNK_FILE;
 617         case S_IFREG:
 618                 return SECCLASS_FILE;
 619         case S_IFBLK:
 620                 return SECCLASS_BLK_FILE;
 621         case S_IFDIR:
 622                 return SECCLASS_DIR;
 623         case S_IFCHR:
 624                 return SECCLASS_CHR_FILE;
 625         case S_IFIFO:
 626                 return SECCLASS_FIFO_FILE;
 627
 628         }
 629
 630         return SECCLASS_FILE;
 631 }
 632
 633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 634 {
 635         switch (family) {
 636         case PF_UNIX:
 637                 switch (type) {
 638                 case SOCK_STREAM:
 639                 case SOCK_SEQPACKET:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644                 break;
 645         case PF_INET:
 646         case PF_INET6:
 647                 switch (type) {
 648                 case SOCK_STREAM:
 649                         return SECCLASS_TCP_SOCKET;
 650                 case SOCK_DGRAM:
 651                         return SECCLASS_UDP_SOCKET;
 652                 case SOCK_RAW:
 653                         return SECCLASS_RAWIP_SOCKET;
 654                 }
 655                 break;
 656         case PF_NETLINK:
 657                 switch (protocol) {
 658                 case NETLINK_ROUTE:
 659                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 660                 case NETLINK_FIREWALL:
 661                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 662                 case NETLINK_INET_DIAG:
 663                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 664                 case NETLINK_NFLOG:
 665                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 666                 case NETLINK_XFRM:
 667                         return SECCLASS_NETLINK_XFRM_SOCKET;
 668                 case NETLINK_SELINUX:
 669                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 670                 case NETLINK_AUDIT:
 671                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 672                 case NETLINK_IP6_FW:
 673                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 674                 case NETLINK_DNRTMSG:
 675                         return SECCLASS_NETLINK_DNRT_SOCKET;
 676                 case NETLINK_KOBJECT_UEVENT:
 677                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 678                 default:
 679                         return SECCLASS_NETLINK_SOCKET;
 680                 }
 681         case PF_PACKET:
 682                 return SECCLASS_PACKET_SOCKET;
 683         case PF_KEY:
 684                 return SECCLASS_KEY_SOCKET;
 685         }
 686
 687         return SECCLASS_SOCKET;
 688 }
 689
 690 #ifdef CONFIG_PROC_FS
 691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 692                                 u16 tclass,
 693                                 u32 *sid)
 694 {
 695         int buflen, rc;
 696         char *buffer, *path, *end;
 697
 698         buffer = (char*)__get_free_page(GFP_KERNEL);
 699         if (!buffer)
 700                 return -ENOMEM;
 701
 702         buflen = PAGE_SIZE;
 703         end = buffer+buflen;
 704         *--end = '\0';
 705         buflen--;
 706         path = end-1;
 707         *path = '/';
 708         while (de && de != de->parent) {
 709                 buflen -= de->namelen + 1;
 710                 if (buflen < 0)
 711                         break;
 712                 end -= de->namelen;
 713                 memcpy(end, de->name, de->namelen);
 714                 *--end = '/';
 715                 path = end;
 716                 de = de->parent;
 717         }
 718         rc = security_genfs_sid("proc", path, tclass, sid);
 719         free_page((unsigned long)buffer);
 720         return rc;
 721 }
 722 #else
 723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 724                                 u16 tclass,
 725                                 u32 *sid)
 726 {
 727         return -EINVAL;
 728 }
 729 #endif
 730
 731 /* The inode's security attributes must be initialized before first use. */
 732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 733 {
 734         struct superblock_security_struct *sbsec = NULL;
 735         struct inode_security_struct *isec = inode->i_security;
 736         u32 sid;
 737         struct dentry *dentry;
 738 #define INITCONTEXTLEN 255
 739         char *context = NULL;
 740         unsigned len = 0;
 741         int rc = 0;
 742         int hold_sem = 0;
 743
 744         if (isec->initialized)
 745                 goto out;
 746
 747         down(&isec->sem);
 748         hold_sem = 1;
 749         if (isec->initialized)
 750                 goto out;
 751
 752         sbsec = inode->i_sb->s_security;
 753         if (!sbsec->initialized) {
 754                 /* Defer initialization until selinux_complete_init,
 755                    after the initial policy is loaded and the security
 756                    server is ready to handle calls. */
 757                 spin_lock(&sbsec->isec_lock);
 758                 if (list_empty(&isec->list))
 759                         list_add(&isec->list, &sbsec->isec_head);
 760                 spin_unlock(&sbsec->isec_lock);
 761                 goto out;
 762         }
 763
 764         switch (sbsec->behavior) {
 765         case SECURITY_FS_USE_XATTR:
 766                 if (!inode->i_op->getxattr) {
 767                         isec->sid = sbsec->def_sid;
 768                         break;
 769                 }
 770
 771                 /* Need a dentry, since the xattr API requires one.
 772                    Life would be simpler if we could just pass the inode. */
 773                 if (opt_dentry) {
 774                         /* Called from d_instantiate or d_splice_alias. */
 775                         dentry = dget(opt_dentry);
 776                 } else {
 777                         /* Called from selinux_complete_init, try to find a dentry. */
 778                         dentry = d_find_alias(inode);
 779                 }
 780                 if (!dentry) {
 781                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 782                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 783                                inode->i_ino);
 784                         goto out;
 785                 }
 786
 787                 len = INITCONTEXTLEN;
 788                 context = kmalloc(len, GFP_KERNEL);
 789                 if (!context) {
 790                         rc = -ENOMEM;
 791                         dput(dentry);
 792                         goto out;
 793                 }
 794                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                            context, len);
 796                 if (rc == -ERANGE) {
 797                         /* Need a larger buffer.  Query for the right size. */
 798                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 799                                                    NULL, 0);
 800                         if (rc < 0) {
 801                                 dput(dentry);
 802                                 goto out;
 803                         }
 804                         kfree(context);
 805                         len = rc;
 806                         context = kmalloc(len, GFP_KERNEL);
 807                         if (!context) {
 808                                 rc = -ENOMEM;
 809                                 dput(dentry);
 810                                 goto out;
 811                         }
 812                         rc = inode->i_op->getxattr(dentry,
 813                                                    XATTR_NAME_SELINUX,
 814                                                    context, len);
 815                 }
 816                 dput(dentry);
 817                 if (rc < 0) {
 818                         if (rc != -ENODATA) {
 819                                 printk(KERN_WARNING "%s:  getxattr returned "
 820                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 821                                        -rc, inode->i_sb->s_id, inode->i_ino);
 822                                 kfree(context);
 823                                 goto out;
 824                         }
 825                         /* Map ENODATA to the default file SID */
 826                         sid = sbsec->def_sid;
 827                         rc = 0;
 828                 } else {
 829                         rc = security_context_to_sid_default(context, rc, &sid,
 830                                                              sbsec->def_sid);
 831                         if (rc) {
 832                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 833                                        "returned %d for dev=%s ino=%ld\n",
 834                                        __FUNCTION__, context, -rc,
 835                                        inode->i_sb->s_id, inode->i_ino);
 836                                 kfree(context);
 837                                 /* Leave with the unlabeled SID */
 838                                 rc = 0;
 839                                 break;
 840                         }
 841                 }
 842                 kfree(context);
 843                 isec->sid = sid;
 844                 break;
 845         case SECURITY_FS_USE_TASK:
 846                 isec->sid = isec->task_sid;
 847                 break;
 848         case SECURITY_FS_USE_TRANS:
 849                 /* Default to the fs SID. */
 850                 isec->sid = sbsec->sid;
 851
 852                 /* Try to obtain a transition SID. */
 853                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 854                 rc = security_transition_sid(isec->task_sid,
 855                                              sbsec->sid,
 856                                              isec->sclass,
 857                                              &sid);
 858                 if (rc)
 859                         goto out;
 860                 isec->sid = sid;
 861                 break;
 862         default:
 863                 /* Default to the fs SID. */
 864                 isec->sid = sbsec->sid;
 865
 866                 if (sbsec->proc) {
 867                         struct proc_inode *proci = PROC_I(inode);
 868                         if (proci->pde) {
 869                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 870                                 rc = selinux_proc_get_sid(proci->pde,
 871                                                           isec->sclass,
 872                                                           &sid);
 873                                 if (rc)
 874                                         goto out;
 875                                 isec->sid = sid;
 876                         }
 877                 }
 878                 break;
 879         }
 880
 881         isec->initialized = 1;
 882
 883 out:
 884         if (isec->sclass == SECCLASS_FILE)
 885                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 886
 887         if (hold_sem)
 888                 up(&isec->sem);
 889         return rc;
 890 }
 891
 892 /* Convert a Linux signal to an access vector. */
 893 static inline u32 signal_to_av(int sig)
 894 {
 895         u32 perm = 0;
 896
 897         switch (sig) {
 898         case SIGCHLD:
 899                 /* Commonly granted from child to parent. */
 900                 perm = PROCESS__SIGCHLD;
 901                 break;
 902         case SIGKILL:
 903                 /* Cannot be caught or ignored */
 904                 perm = PROCESS__SIGKILL;
 905                 break;
 906         case SIGSTOP:
 907                 /* Cannot be caught or ignored */
 908                 perm = PROCESS__SIGSTOP;
 909                 break;
 910         default:
 911                 /* All other signals. */
 912                 perm = PROCESS__SIGNAL;
 913                 break;
 914         }
 915
 916         return perm;
 917 }
 918
 919 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 920    fork check, ptrace check, etc. */
 921 static int task_has_perm(struct task_struct *tsk1,
 922                          struct task_struct *tsk2,
 923                          u32 perms)
 924 {
 925         struct task_security_struct *tsec1, *tsec2;
 926
 927         tsec1 = tsk1->security;
 928         tsec2 = tsk2->security;
 929         return avc_has_perm(tsec1->sid, tsec2->sid,
 930                             SECCLASS_PROCESS, perms, NULL);
 931 }
 932
 933 /* Check whether a task is allowed to use a capability. */
 934 static int task_has_capability(struct task_struct *tsk,
 935                                int cap)
 936 {
 937         struct task_security_struct *tsec;
 938         struct avc_audit_data ad;
 939
 940         tsec = tsk->security;
 941
 942         AVC_AUDIT_DATA_INIT(&ad,CAP);
 943         ad.tsk = tsk;
 944         ad.u.cap = cap;
 945
 946         return avc_has_perm(tsec->sid, tsec->sid,
 947                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 948 }
 949
 950 /* Check whether a task is allowed to use a system operation. */
 951 static int task_has_system(struct task_struct *tsk,
 952                            u32 perms)
 953 {
 954         struct task_security_struct *tsec;
 955
 956         tsec = tsk->security;
 957
 958         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 959                             SECCLASS_SYSTEM, perms, NULL);
 960 }
 961
 962 /* Check whether a task has a particular permission to an inode.
 963    The 'adp' parameter is optional and allows other audit
 964    data to be passed (e.g. the dentry). */
 965 static int inode_has_perm(struct task_struct *tsk,
 966                           struct inode *inode,
 967                           u32 perms,
 968                           struct avc_audit_data *adp)
 969 {
 970         struct task_security_struct *tsec;
 971         struct inode_security_struct *isec;
 972         struct avc_audit_data ad;
 973
 974         tsec = tsk->security;
 975         isec = inode->i_security;
 976
 977         if (!adp) {
 978                 adp = &ad;
 979                 AVC_AUDIT_DATA_INIT(&ad, FS);
 980                 ad.u.fs.inode = inode;
 981         }
 982
 983         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 984 }
 985
 986 /* Same as inode_has_perm, but pass explicit audit data containing
 987    the dentry to help the auditing code to more easily generate the
 988    pathname if needed. */
 989 static inline int dentry_has_perm(struct task_struct *tsk,
 990                                   struct vfsmount *mnt,
 991                                   struct dentry *dentry,
 992                                   u32 av)
 993 {
 994         struct inode *inode = dentry->d_inode;
 995         struct avc_audit_data ad;
 996         AVC_AUDIT_DATA_INIT(&ad,FS);
 997         ad.u.fs.mnt = mnt;
 998         ad.u.fs.dentry = dentry;
 999         return inode_has_perm(tsk, inode, av, &ad);
1000 }
1001
1002 /* Check whether a task can use an open file descriptor to
1003    access an inode in a given way.  Check access to the
1004    descriptor itself, and then use dentry_has_perm to
1005    check a particular permission to the file.
1006    Access to the descriptor is implicitly granted if it
1007    has the same SID as the process.  If av is zero, then
1008    access to the file is not checked, e.g. for cases
1009    where only the descriptor is affected like seek. */
1010 static inline int file_has_perm(struct task_struct *tsk,
1011                                 struct file *file,
1012                                 u32 av)
1013 {
1014         struct task_security_struct *tsec = tsk->security;
1015         struct file_security_struct *fsec = file->f_security;
1016         struct vfsmount *mnt = file->f_vfsmnt;
1017         struct dentry *dentry = file->f_dentry;
1018         struct inode *inode = dentry->d_inode;
1019         struct avc_audit_data ad;
1020         int rc;
1021
1022         AVC_AUDIT_DATA_INIT(&ad, FS);
1023         ad.u.fs.mnt = mnt;
1024         ad.u.fs.dentry = dentry;
1025
1026         if (tsec->sid != fsec->sid) {
1027                 rc = avc_has_perm(tsec->sid, fsec->sid,
1028                                   SECCLASS_FD,
1029                                   FD__USE,
1030                                   &ad);
1031                 if (rc)
1032                         return rc;
1033         }
1034
1035         /* av is zero if only checking access to the descriptor. */
1036         if (av)
1037                 return inode_has_perm(tsk, inode, av, &ad);
1038
1039         return 0;
1040 }
1041
1042 /* Check whether a task can create a file. */
1043 static int may_create(struct inode *dir,
1044                       struct dentry *dentry,
1045                       u16 tclass)
1046 {
1047         struct task_security_struct *tsec;
1048         struct inode_security_struct *dsec;
1049         struct superblock_security_struct *sbsec;
1050         u32 newsid;
1051         struct avc_audit_data ad;
1052         int rc;
1053
1054         tsec = current->security;
1055         dsec = dir->i_security;
1056         sbsec = dir->i_sb->s_security;
1057
1058         AVC_AUDIT_DATA_INIT(&ad, FS);
1059         ad.u.fs.dentry = dentry;
1060
1061         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1062                           DIR__ADD_NAME | DIR__SEARCH,
1063                           &ad);
1064         if (rc)
1065                 return rc;
1066
1067         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1068                 newsid = tsec->create_sid;
1069         } else {
1070                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1071                                              &newsid);
1072                 if (rc)
1073                         return rc;
1074         }
1075
1076         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1077         if (rc)
1078                 return rc;
1079
1080         return avc_has_perm(newsid, sbsec->sid,
1081                             SECCLASS_FILESYSTEM,
1082                             FILESYSTEM__ASSOCIATE, &ad);
1083 }
1084
1085 #define MAY_LINK   0
1086 #define MAY_UNLINK 1
1087 #define MAY_RMDIR  2
1088
1089 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1090 static int may_link(struct inode *dir,
1091                     struct dentry *dentry,
1092                     int kind)
1093
1094 {
1095         struct task_security_struct *tsec;
1096         struct inode_security_struct *dsec, *isec;
1097         struct avc_audit_data ad;
1098         u32 av;
1099         int rc;
1100
1101         tsec = current->security;
1102         dsec = dir->i_security;
1103         isec = dentry->d_inode->i_security;
1104
1105         AVC_AUDIT_DATA_INIT(&ad, FS);
1106         ad.u.fs.dentry = dentry;
1107
1108         av = DIR__SEARCH;
1109         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1110         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1111         if (rc)
1112                 return rc;
1113
1114         switch (kind) {
1115         case MAY_LINK:
1116                 av = FILE__LINK;
1117                 break;
1118         case MAY_UNLINK:
1119                 av = FILE__UNLINK;
1120                 break;
1121         case MAY_RMDIR:
1122                 av = DIR__RMDIR;
1123                 break;
1124         default:
1125                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1126                 return 0;
1127         }
1128
1129         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1130         return rc;
1131 }
1132
1133 static inline int may_rename(struct inode *old_dir,
1134                              struct dentry *old_dentry,
1135                              struct inode *new_dir,
1136                              struct dentry *new_dentry)
1137 {
1138         struct task_security_struct *tsec;
1139         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1140         struct avc_audit_data ad;
1141         u32 av;
1142         int old_is_dir, new_is_dir;
1143         int rc;
1144
1145         tsec = current->security;
1146         old_dsec = old_dir->i_security;
1147         old_isec = old_dentry->d_inode->i_security;
1148         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1149         new_dsec = new_dir->i_security;
1150
1151         AVC_AUDIT_DATA_INIT(&ad, FS);
1152
1153         ad.u.fs.dentry = old_dentry;
1154         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1155                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1156         if (rc)
1157                 return rc;
1158         rc = avc_has_perm(tsec->sid, old_isec->sid,
1159                           old_isec->sclass, FILE__RENAME, &ad);
1160         if (rc)
1161                 return rc;
1162         if (old_is_dir && new_dir != old_dir) {
1163                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1164                                   old_isec->sclass, DIR__REPARENT, &ad);
1165                 if (rc)
1166                         return rc;
1167         }
1168
1169         ad.u.fs.dentry = new_dentry;
1170         av = DIR__ADD_NAME | DIR__SEARCH;
1171         if (new_dentry->d_inode)
1172                 av |= DIR__REMOVE_NAME;
1173         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1174         if (rc)
1175                 return rc;
1176         if (new_dentry->d_inode) {
1177                 new_isec = new_dentry->d_inode->i_security;
1178                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1179                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1180                                   new_isec->sclass,
1181                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1182                 if (rc)
1183                         return rc;
1184         }
1185
1186         return 0;
1187 }
1188
1189 /* Check whether a task can perform a filesystem operation. */
1190 static int superblock_has_perm(struct task_struct *tsk,
1191                                struct super_block *sb,
1192                                u32 perms,
1193                                struct avc_audit_data *ad)
1194 {
1195         struct task_security_struct *tsec;
1196         struct superblock_security_struct *sbsec;
1197
1198         tsec = tsk->security;
1199         sbsec = sb->s_security;
1200         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1201                             perms, ad);
1202 }
1203
1204 /* Convert a Linux mode and permission mask to an access vector. */
1205 static inline u32 file_mask_to_av(int mode, int mask)
1206 {
1207         u32 av = 0;
1208
1209         if ((mode & S_IFMT) != S_IFDIR) {
1210                 if (mask & MAY_EXEC)
1211                         av |= FILE__EXECUTE;
1212                 if (mask & MAY_READ)
1213                         av |= FILE__READ;
1214
1215                 if (mask & MAY_APPEND)
1216                         av |= FILE__APPEND;
1217                 else if (mask & MAY_WRITE)
1218                         av |= FILE__WRITE;
1219
1220         } else {
1221                 if (mask & MAY_EXEC)
1222                         av |= DIR__SEARCH;
1223                 if (mask & MAY_WRITE)
1224                         av |= DIR__WRITE;
1225                 if (mask & MAY_READ)
1226                         av |= DIR__READ;
1227         }
1228
1229         return av;
1230 }
1231
1232 /* Convert a Linux file to an access vector. */
1233 static inline u32 file_to_av(struct file *file)
1234 {
1235         u32 av = 0;
1236
1237         if (file->f_mode & FMODE_READ)
1238                 av |= FILE__READ;
1239         if (file->f_mode & FMODE_WRITE) {
1240                 if (file->f_flags & O_APPEND)
1241                         av |= FILE__APPEND;
1242                 else
1243                         av |= FILE__WRITE;
1244         }
1245
1246         return av;
1247 }
1248
1249 /* Set an inode's SID to a specified value. */
1250 static int inode_security_set_sid(struct inode *inode, u32 sid)
1251 {
1252         struct inode_security_struct *isec = inode->i_security;
1253         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1254
1255         if (!sbsec->initialized) {
1256                 /* Defer initialization to selinux_complete_init. */
1257                 return 0;
1258         }
1259
1260         down(&isec->sem);
1261         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1262         isec->sid = sid;
1263         isec->initialized = 1;
1264         up(&isec->sem);
1265         return 0;
1266 }
1267
1268 /* Hook functions begin here. */
1269
1270 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1271 {
1272         struct task_security_struct *psec = parent->security;
1273         struct task_security_struct *csec = child->security;
1274         int rc;
1275
1276         rc = secondary_ops->ptrace(parent,child);
1277         if (rc)
1278                 return rc;
1279
1280         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1281         /* Save the SID of the tracing process for later use in apply_creds. */
1282         if (!rc)
1283                 csec->ptrace_sid = psec->sid;
1284         return rc;
1285 }
1286
1287 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1288                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1289 {
1290         int error;
1291
1292         error = task_has_perm(current, target, PROCESS__GETCAP);
1293         if (error)
1294                 return error;
1295
1296         return secondary_ops->capget(target, effective, inheritable, permitted);
1297 }
1298
1299 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1300                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1301 {
1302         int error;
1303
1304         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1305         if (error)
1306                 return error;
1307
1308         return task_has_perm(current, target, PROCESS__SETCAP);
1309 }
1310
1311 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1312                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1313 {
1314         secondary_ops->capset_set(target, effective, inheritable, permitted);
1315 }
1316
1317 static int selinux_capable(struct task_struct *tsk, int cap)
1318 {
1319         int rc;
1320
1321         rc = secondary_ops->capable(tsk, cap);
1322         if (rc)
1323                 return rc;
1324
1325         return task_has_capability(tsk,cap);
1326 }
1327
1328 static int selinux_sysctl(ctl_table *table, int op)
1329 {
1330         int error = 0;
1331         u32 av;
1332         struct task_security_struct *tsec;
1333         u32 tsid;
1334         int rc;
1335
1336         rc = secondary_ops->sysctl(table, op);
1337         if (rc)
1338                 return rc;
1339
1340         tsec = current->security;
1341
1342         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1343                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1344         if (rc) {
1345                 /* Default to the well-defined sysctl SID. */
1346                 tsid = SECINITSID_SYSCTL;
1347         }
1348
1349         /* The op values are "defined" in sysctl.c, thereby creating
1350          * a bad coupling between this module and sysctl.c */
1351         if(op == 001) {
1352                 error = avc_has_perm(tsec->sid, tsid,
1353                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1354         } else {
1355                 av = 0;
1356                 if (op & 004)
1357                         av |= FILE__READ;
1358                 if (op & 002)
1359                         av |= FILE__WRITE;
1360                 if (av)
1361                         error = avc_has_perm(tsec->sid, tsid,
1362                                              SECCLASS_FILE, av, NULL);
1363         }
1364
1365         return error;
1366 }
1367
1368 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1369 {
1370         int rc = 0;
1371
1372         if (!sb)
1373                 return 0;
1374
1375         switch (cmds) {
1376                 case Q_SYNC:
1377                 case Q_QUOTAON:
1378                 case Q_QUOTAOFF:
1379                 case Q_SETINFO:
1380                 case Q_SETQUOTA:
1381                         rc = superblock_has_perm(current,
1382                                                  sb,
1383                                                  FILESYSTEM__QUOTAMOD, NULL);
1384                         break;
1385                 case Q_GETFMT:
1386                 case Q_GETINFO:
1387                 case Q_GETQUOTA:
1388                         rc = superblock_has_perm(current,
1389                                                  sb,
1390                                                  FILESYSTEM__QUOTAGET, NULL);
1391                         break;
1392                 default:
1393                         rc = 0;  /* let the kernel handle invalid cmds */
1394                         break;
1395         }
1396         return rc;
1397 }
1398
1399 static int selinux_quota_on(struct dentry *dentry)
1400 {
1401         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1402 }
1403
1404 static int selinux_syslog(int type)
1405 {
1406         int rc;
1407
1408         rc = secondary_ops->syslog(type);
1409         if (rc)
1410                 return rc;
1411
1412         switch (type) {
1413                 case 3:         /* Read last kernel messages */
1414                 case 10:        /* Return size of the log buffer */
1415                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1416                         break;
1417                 case 6:         /* Disable logging to console */
1418                 case 7:         /* Enable logging to console */
1419                 case 8:         /* Set level of messages printed to console */
1420                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1421                         break;
1422                 case 0:         /* Close log */
1423                 case 1:         /* Open log */
1424                 case 2:         /* Read from log */
1425                 case 4:         /* Read/clear last kernel messages */
1426                 case 5:         /* Clear ring buffer */
1427                 default:
1428                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1429                         break;
1430         }
1431         return rc;
1432 }
1433
1434 /*
1435  * Check that a process has enough memory to allocate a new virtual
1436  * mapping. 0 means there is enough memory for the allocation to
1437  * succeed and -ENOMEM implies there is not.
1438  *
1439  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1440  * if the capability is granted, but __vm_enough_memory requires 1 if
1441  * the capability is granted.
1442  *
1443  * Do not audit the selinux permission check, as this is applied to all
1444  * processes that allocate mappings.
1445  */
1446 static int selinux_vm_enough_memory(long pages)
1447 {
1448         int rc, cap_sys_admin = 0;
1449         struct task_security_struct *tsec = current->security;
1450
1451         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1452         if (rc == 0)
1453                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1454                                         SECCLASS_CAPABILITY,
1455                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1456                                         NULL);
1457
1458         if (rc == 0)
1459                 cap_sys_admin = 1;
1460
1461         return __vm_enough_memory(pages, cap_sys_admin);
1462 }
1463
1464 /* binprm security operations */
1465
1466 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1467 {
1468         struct bprm_security_struct *bsec;
1469
1470         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1471         if (!bsec)
1472                 return -ENOMEM;
1473
1474         memset(bsec, 0, sizeof *bsec);
1475         bsec->magic = SELINUX_MAGIC;
1476         bsec->bprm = bprm;
1477         bsec->sid = SECINITSID_UNLABELED;
1478         bsec->set = 0;
1479
1480         bprm->security = bsec;
1481         return 0;
1482 }
1483
1484 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1485 {
1486         struct task_security_struct *tsec;
1487         struct inode *inode = bprm->file->f_dentry->d_inode;
1488         struct inode_security_struct *isec;
1489         struct bprm_security_struct *bsec;
1490         u32 newsid;
1491         struct avc_audit_data ad;
1492         int rc;
1493
1494         rc = secondary_ops->bprm_set_security(bprm);
1495         if (rc)
1496                 return rc;
1497
1498         bsec = bprm->security;
1499
1500         if (bsec->set)
1501                 return 0;
1502
1503         tsec = current->security;
1504         isec = inode->i_security;
1505
1506         /* Default to the current task SID. */
1507         bsec->sid = tsec->sid;
1508
1509         /* Reset create SID on execve. */
1510         tsec->create_sid = 0;
1511
1512         if (tsec->exec_sid) {
1513                 newsid = tsec->exec_sid;
1514                 /* Reset exec SID on execve. */
1515                 tsec->exec_sid = 0;
1516         } else {
1517                 /* Check for a default transition on this program. */
1518                 rc = security_transition_sid(tsec->sid, isec->sid,
1519                                              SECCLASS_PROCESS, &newsid);
1520                 if (rc)
1521                         return rc;
1522         }
1523
1524         AVC_AUDIT_DATA_INIT(&ad, FS);
1525         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1526         ad.u.fs.dentry = bprm->file->f_dentry;
1527
1528         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1529                 newsid = tsec->sid;
1530
1531         if (tsec->sid == newsid) {
1532                 rc = avc_has_perm(tsec->sid, isec->sid,
1533                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1534                 if (rc)
1535                         return rc;
1536         } else {
1537                 /* Check permissions for the transition. */
1538                 rc = avc_has_perm(tsec->sid, newsid,
1539                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1540                 if (rc)
1541                         return rc;
1542
1543                 rc = avc_has_perm(newsid, isec->sid,
1544                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1545                 if (rc)
1546                         return rc;
1547
1548                 /* Clear any possibly unsafe personality bits on exec: */
1549                 current->personality &= ~PER_CLEAR_ON_SETID;
1550
1551                 /* Set the security field to the new SID. */
1552                 bsec->sid = newsid;
1553         }
1554
1555         bsec->set = 1;
1556         return 0;
1557 }
1558
1559 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1560 {
1561         return secondary_ops->bprm_check_security(bprm);
1562 }
1563
1564
1565 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1566 {
1567         struct task_security_struct *tsec = current->security;
1568         int atsecure = 0;
1569
1570         if (tsec->osid != tsec->sid) {
1571                 /* Enable secure mode for SIDs transitions unless
1572                    the noatsecure permission is granted between
1573                    the two SIDs, i.e. ahp returns 0. */
1574                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1575                                          SECCLASS_PROCESS,
1576                                          PROCESS__NOATSECURE, NULL);
1577         }
1578
1579         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1580 }
1581
1582 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1583 {
1584         kfree(bprm->security);
1585         bprm->security = NULL;
1586 }
1587
1588 extern struct vfsmount *selinuxfs_mount;
1589 extern struct dentry *selinux_null;
1590
1591 /* Derived from fs/exec.c:flush_old_files. */
1592 static inline void flush_unauthorized_files(struct files_struct * files)
1593 {
1594         struct avc_audit_data ad;
1595         struct file *file, *devnull = NULL;
1596         struct tty_struct *tty = current->signal->tty;
1597         long j = -1;
1598
1599         if (tty) {
1600                 file_list_lock();
1601                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1602                 if (file) {
1603                         /* Revalidate access to controlling tty.
1604                            Use inode_has_perm on the tty inode directly rather
1605                            than using file_has_perm, as this particular open
1606                            file may belong to another process and we are only
1607                            interested in the inode-based check here. */
1608                         struct inode *inode = file->f_dentry->d_inode;
1609                         if (inode_has_perm(current, inode,
1610                                            FILE__READ | FILE__WRITE, NULL)) {
1611                                 /* Reset controlling tty. */
1612                                 current->signal->tty = NULL;
1613                                 current->signal->tty_old_pgrp = 0;
1614                         }
1615                 }
1616                 file_list_unlock();
1617         }
1618
1619         /* Revalidate access to inherited open files. */
1620
1621         AVC_AUDIT_DATA_INIT(&ad,FS);
1622
1623         spin_lock(&files->file_lock);
1624         for (;;) {
1625                 unsigned long set, i;
1626                 int fd;
1627
1628                 j++;
1629                 i = j * __NFDBITS;
1630                 if (i >= files->max_fds || i >= files->max_fdset)
1631                         break;
1632                 set = files->open_fds->fds_bits[j];
1633                 if (!set)
1634                         continue;
1635                 spin_unlock(&files->file_lock);
1636                 for ( ; set ; i++,set >>= 1) {
1637                         if (set & 1) {
1638                                 file = fget(i);
1639                                 if (!file)
1640                                         continue;
1641                                 if (file_has_perm(current,
1642                                                   file,
1643                                                   file_to_av(file))) {
1644                                         sys_close(i);
1645                                         fd = get_unused_fd();
1646                                         if (fd != i) {
1647                                                 if (fd >= 0)
1648                                                         put_unused_fd(fd);
1649                                                 fput(file);
1650                                                 continue;
1651                                         }
1652                                         if (devnull) {
1653                                                 atomic_inc(&devnull->f_count);
1654                                         } else {
1655                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1656                                                 if (!devnull) {
1657                                                         put_unused_fd(fd);
1658                                                         fput(file);
1659                                                         continue;
1660                                                 }
1661                                         }
1662                                         fd_install(fd, devnull);
1663                                 }
1664                                 fput(file);
1665                         }
1666                 }
1667                 spin_lock(&files->file_lock);
1668
1669         }
1670         spin_unlock(&files->file_lock);
1671 }
1672
1673 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1674 {
1675         struct task_security_struct *tsec;
1676         struct bprm_security_struct *bsec;
1677         u32 sid;
1678         int rc;
1679
1680         secondary_ops->bprm_apply_creds(bprm, unsafe);
1681
1682         tsec = current->security;
1683
1684         bsec = bprm->security;
1685         sid = bsec->sid;
1686
1687         tsec->osid = tsec->sid;
1688         bsec->unsafe = 0;
1689         if (tsec->sid != sid) {
1690                 /* Check for shared state.  If not ok, leave SID
1691                    unchanged and kill. */
1692                 if (unsafe & LSM_UNSAFE_SHARE) {
1693                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1694                                         PROCESS__SHARE, NULL);
1695                         if (rc) {
1696                                 bsec->unsafe = 1;
1697                                 return;
1698                         }
1699                 }
1700
1701                 /* Check for ptracing, and update the task SID if ok.
1702                    Otherwise, leave SID unchanged and kill. */
1703                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1704                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1705                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1706                                           NULL);
1707                         if (rc) {
1708                                 bsec->unsafe = 1;
1709                                 return;
1710                         }
1711                 }
1712                 tsec->sid = sid;
1713         }
1714 }
1715
1716 /*
1717  * called after apply_creds without the task lock held
1718  */
1719 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1720 {
1721         struct task_security_struct *tsec;
1722         struct rlimit *rlim, *initrlim;
1723         struct itimerval itimer;
1724         struct bprm_security_struct *bsec;
1725         int rc, i;
1726
1727         tsec = current->security;
1728         bsec = bprm->security;
1729
1730         if (bsec->unsafe) {
1731                 force_sig_specific(SIGKILL, current);
1732                 return;
1733         }
1734         if (tsec->osid == tsec->sid)
1735                 return;
1736
1737         /* Close files for which the new task SID is not authorized. */
1738         flush_unauthorized_files(current->files);
1739
1740         /* Check whether the new SID can inherit signal state
1741            from the old SID.  If not, clear itimers to avoid
1742            subsequent signal generation and flush and unblock
1743            signals. This must occur _after_ the task SID has
1744           been updated so that any kill done after the flush
1745           will be checked against the new SID. */
1746         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1747                           PROCESS__SIGINH, NULL);
1748         if (rc) {
1749                 memset(&itimer, 0, sizeof itimer);
1750                 for (i = 0; i < 3; i++)
1751                         do_setitimer(i, &itimer, NULL);
1752                 flush_signals(current);
1753                 spin_lock_irq(&current->sighand->siglock);
1754                 flush_signal_handlers(current, 1);
1755                 sigemptyset(&current->blocked);
1756                 recalc_sigpending();
1757                 spin_unlock_irq(&current->sighand->siglock);
1758         }
1759
1760         /* Check whether the new SID can inherit resource limits
1761            from the old SID.  If not, reset all soft limits to
1762            the lower of the current task's hard limit and the init
1763            task's soft limit.  Note that the setting of hard limits
1764            (even to lower them) can be controlled by the setrlimit
1765            check. The inclusion of the init task's soft limit into
1766            the computation is to avoid resetting soft limits higher
1767            than the default soft limit for cases where the default
1768            is lower than the hard limit, e.g. RLIMIT_CORE or
1769            RLIMIT_STACK.*/
1770         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1771                           PROCESS__RLIMITINH, NULL);
1772         if (rc) {
1773                 for (i = 0; i < RLIM_NLIMITS; i++) {
1774                         rlim = current->signal->rlim + i;
1775                         initrlim = init_task.signal->rlim+i;
1776                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1777                 }
1778                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1779                         /*
1780                          * This will cause RLIMIT_CPU calculations
1781                          * to be refigured.
1782                          */
1783                         current->it_prof_expires = jiffies_to_cputime(1);
1784                 }
1785         }
1786
1787         /* Wake up the parent if it is waiting so that it can
1788            recheck wait permission to the new task SID. */
1789         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1790 }
1791
1792 /* superblock security operations */
1793
1794 static int selinux_sb_alloc_security(struct super_block *sb)
1795 {
1796         return superblock_alloc_security(sb);
1797 }
1798
1799 static void selinux_sb_free_security(struct super_block *sb)
1800 {
1801         superblock_free_security(sb);
1802 }
1803
1804 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1805 {
1806         if (plen > olen)
1807                 return 0;
1808
1809         return !memcmp(prefix, option, plen);
1810 }
1811
1812 static inline int selinux_option(char *option, int len)
1813 {
1814         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1815                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1816                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1817 }
1818
1819 static inline void take_option(char **to, char *from, int *first, int len)
1820 {
1821         if (!*first) {
1822                 **to = ',';
1823                 *to += 1;
1824         }
1825         else
1826                 *first = 0;
1827         memcpy(*to, from, len);
1828         *to += len;
1829 }
1830
1831 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1832 {
1833         int fnosec, fsec, rc = 0;
1834         char *in_save, *in_curr, *in_end;
1835         char *sec_curr, *nosec_save, *nosec;
1836
1837         in_curr = orig;
1838         sec_curr = copy;
1839
1840         /* Binary mount data: just copy */
1841         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1842                 copy_page(sec_curr, in_curr);
1843                 goto out;
1844         }
1845
1846         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1847         if (!nosec) {
1848                 rc = -ENOMEM;
1849                 goto out;
1850         }
1851
1852         nosec_save = nosec;
1853         fnosec = fsec = 1;
1854         in_save = in_end = orig;
1855
1856         do {
1857                 if (*in_end == ',' || *in_end == '\0') {
1858                         int len = in_end - in_curr;
1859
1860                         if (selinux_option(in_curr, len))
1861                                 take_option(&sec_curr, in_curr, &fsec, len);
1862                         else
1863                                 take_option(&nosec, in_curr, &fnosec, len);
1864
1865                         in_curr = in_end + 1;
1866                 }
1867         } while (*in_end++);
1868
1869         strcpy(in_save, nosec_save);
1870         free_page((unsigned long)nosec_save);
1871 out:
1872         return rc;
1873 }
1874
1875 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1876 {
1877         struct avc_audit_data ad;
1878         int rc;
1879
1880         rc = superblock_doinit(sb, data);
1881         if (rc)
1882                 return rc;
1883
1884         AVC_AUDIT_DATA_INIT(&ad,FS);
1885         ad.u.fs.dentry = sb->s_root;
1886         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1887 }
1888
1889 static int selinux_sb_statfs(struct super_block *sb)
1890 {
1891         struct avc_audit_data ad;
1892
1893         AVC_AUDIT_DATA_INIT(&ad,FS);
1894         ad.u.fs.dentry = sb->s_root;
1895         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1896 }
1897
1898 static int selinux_mount(char * dev_name,
1899                          struct nameidata *nd,
1900                          char * type,
1901                          unsigned long flags,
1902                          void * data)
1903 {
1904         int rc;
1905
1906         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1907         if (rc)
1908                 return rc;
1909
1910         if (flags & MS_REMOUNT)
1911                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1912                                            FILESYSTEM__REMOUNT, NULL);
1913         else
1914                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1915                                        FILE__MOUNTON);
1916 }
1917
1918 static int selinux_umount(struct vfsmount *mnt, int flags)
1919 {
1920         int rc;
1921
1922         rc = secondary_ops->sb_umount(mnt, flags);
1923         if (rc)
1924                 return rc;
1925
1926         return superblock_has_perm(current,mnt->mnt_sb,
1927                                    FILESYSTEM__UNMOUNT,NULL);
1928 }
1929
1930 /* inode security operations */
1931
1932 static int selinux_inode_alloc_security(struct inode *inode)
1933 {
1934         return inode_alloc_security(inode);
1935 }
1936
1937 static void selinux_inode_free_security(struct inode *inode)
1938 {
1939         inode_free_security(inode);
1940 }
1941
1942 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1943                                        char **name, void **value,
1944                                        size_t *len)
1945 {
1946         struct task_security_struct *tsec;
1947         struct inode_security_struct *dsec;
1948         struct superblock_security_struct *sbsec;
1949         struct inode_security_struct *isec;
1950         u32 newsid, clen;
1951         int rc;
1952         char *namep = NULL, *context;
1953
1954         tsec = current->security;
1955         dsec = dir->i_security;
1956         sbsec = dir->i_sb->s_security;
1957         isec = inode->i_security;
1958
1959         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1960                 newsid = tsec->create_sid;
1961         } else {
1962                 rc = security_transition_sid(tsec->sid, dsec->sid,
1963                                              inode_mode_to_security_class(inode->i_mode),
1964                                              &newsid);
1965                 if (rc) {
1966                         printk(KERN_WARNING "%s:  "
1967                                "security_transition_sid failed, rc=%d (dev=%s "
1968                                "ino=%ld)\n",
1969                                __FUNCTION__,
1970                                -rc, inode->i_sb->s_id, inode->i_ino);
1971                         return rc;
1972                 }
1973         }
1974
1975         inode_security_set_sid(inode, newsid);
1976
1977         if (name) {
1978                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
1979                 if (!namep)
1980                         return -ENOMEM;
1981                 *name = namep;
1982         }
1983
1984         if (value && len) {
1985                 rc = security_sid_to_context(newsid, &context, &clen);
1986                 if (rc) {
1987                         kfree(namep);
1988                         return rc;
1989                 }
1990                 *value = context;
1991                 *len = clen;
1992         }
1993
1994         return 0;
1995 }
1996
1997 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
1998 {
1999         return may_create(dir, dentry, SECCLASS_FILE);
2000 }
2001
2002 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2003 {
2004         int rc;
2005
2006         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2007         if (rc)
2008                 return rc;
2009         return may_link(dir, old_dentry, MAY_LINK);
2010 }
2011
2012 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2013 {
2014         return;
2015 }
2016
2017 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2018 {
2019         int rc;
2020
2021         rc = secondary_ops->inode_unlink(dir, dentry);
2022         if (rc)
2023                 return rc;
2024         return may_link(dir, dentry, MAY_UNLINK);
2025 }
2026
2027 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2028 {
2029         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2030 }
2031
2032 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2033 {
2034         return may_create(dir, dentry, SECCLASS_DIR);
2035 }
2036
2037 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2038 {
2039         return may_link(dir, dentry, MAY_RMDIR);
2040 }
2041
2042 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2043 {
2044         int rc;
2045
2046         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2047         if (rc)
2048                 return rc;
2049
2050         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2051 }
2052
2053 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2054                                 struct inode *new_inode, struct dentry *new_dentry)
2055 {
2056         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2057 }
2058
2059 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2060                                       struct inode *new_inode, struct dentry *new_dentry)
2061 {
2062         return;
2063 }
2064
2065 static int selinux_inode_readlink(struct dentry *dentry)
2066 {
2067         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2068 }
2069
2070 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2071 {
2072         int rc;
2073
2074         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2075         if (rc)
2076                 return rc;
2077         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2078 }
2079
2080 static int selinux_inode_permission(struct inode *inode, int mask,
2081                                     struct nameidata *nd)
2082 {
2083         int rc;
2084
2085         rc = secondary_ops->inode_permission(inode, mask, nd);
2086         if (rc)
2087                 return rc;
2088
2089         if (!mask) {
2090                 /* No permission to check.  Existence test. */
2091                 return 0;
2092         }
2093
2094         return inode_has_perm(current, inode,
2095                                file_mask_to_av(inode->i_mode, mask), NULL);
2096 }
2097
2098 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2099 {
2100         int rc;
2101
2102         rc = secondary_ops->inode_setattr(dentry, iattr);
2103         if (rc)
2104                 return rc;
2105
2106         if (iattr->ia_valid & ATTR_FORCE)
2107                 return 0;
2108
2109         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2110                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2111                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2112
2113         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2114 }
2115
2116 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2117 {
2118         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2119 }
2120
2121 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2122 {
2123         struct task_security_struct *tsec = current->security;
2124         struct inode *inode = dentry->d_inode;
2125         struct inode_security_struct *isec = inode->i_security;
2126         struct superblock_security_struct *sbsec;
2127         struct avc_audit_data ad;
2128         u32 newsid;
2129         int rc = 0;
2130
2131         if (strcmp(name, XATTR_NAME_SELINUX)) {
2132                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2133                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2134                     !capable(CAP_SYS_ADMIN)) {
2135                         /* A different attribute in the security namespace.
2136                            Restrict to administrator. */
2137                         return -EPERM;
2138                 }
2139
2140                 /* Not an attribute we recognize, so just check the
2141                    ordinary setattr permission. */
2142                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2143         }
2144
2145         sbsec = inode->i_sb->s_security;
2146         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2147                 return -EOPNOTSUPP;
2148
2149         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2150                 return -EPERM;
2151
2152         AVC_AUDIT_DATA_INIT(&ad,FS);
2153         ad.u.fs.dentry = dentry;
2154
2155         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2156                           FILE__RELABELFROM, &ad);
2157         if (rc)
2158                 return rc;
2159
2160         rc = security_context_to_sid(value, size, &newsid);
2161         if (rc)
2162                 return rc;
2163
2164         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2165                           FILE__RELABELTO, &ad);
2166         if (rc)
2167                 return rc;
2168
2169         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2170                                           isec->sclass);
2171         if (rc)
2172                 return rc;
2173
2174         return avc_has_perm(newsid,
2175                             sbsec->sid,
2176                             SECCLASS_FILESYSTEM,
2177                             FILESYSTEM__ASSOCIATE,
2178                             &ad);
2179 }
2180
2181 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2182                                         void *value, size_t size, int flags)
2183 {
2184         struct inode *inode = dentry->d_inode;
2185         struct inode_security_struct *isec = inode->i_security;
2186         u32 newsid;
2187         int rc;
2188
2189         if (strcmp(name, XATTR_NAME_SELINUX)) {
2190                 /* Not an attribute we recognize, so nothing to do. */
2191                 return;
2192         }
2193
2194         rc = security_context_to_sid(value, size, &newsid);
2195         if (rc) {
2196                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2197                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2198                 return;
2199         }
2200
2201         isec->sid = newsid;
2202         return;
2203 }
2204
2205 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2206 {
2207         struct inode *inode = dentry->d_inode;
2208         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2209
2210         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2211                 return -EOPNOTSUPP;
2212
2213         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2214 }
2215
2216 static int selinux_inode_listxattr (struct dentry *dentry)
2217 {
2218         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2219 }
2220
2221 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2222 {
2223         if (strcmp(name, XATTR_NAME_SELINUX)) {
2224                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2225                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2226                     !capable(CAP_SYS_ADMIN)) {
2227                         /* A different attribute in the security namespace.
2228                            Restrict to administrator. */
2229                         return -EPERM;
2230                 }
2231
2232                 /* Not an attribute we recognize, so just check the
2233                    ordinary setattr permission. Might want a separate
2234                    permission for removexattr. */
2235                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2236         }
2237
2238         /* No one is allowed to remove a SELinux security label.
2239            You can change the label, but all data must be labeled. */
2240         return -EACCES;
2241 }
2242
2243 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2244 {
2245         struct inode_security_struct *isec = inode->i_security;
2246         char *context;
2247         unsigned len;
2248         int rc;
2249
2250         /* Permission check handled by selinux_inode_getxattr hook.*/
2251
2252         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2253                 return -EOPNOTSUPP;
2254
2255         rc = security_sid_to_context(isec->sid, &context, &len);
2256         if (rc)
2257                 return rc;
2258
2259         if (!buffer || !size) {
2260                 kfree(context);
2261                 return len;
2262         }
2263         if (size < len) {
2264                 kfree(context);
2265                 return -ERANGE;
2266         }
2267         memcpy(buffer, context, len);
2268         kfree(context);
2269         return len;
2270 }
2271
2272 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2273                                      const void *value, size_t size, int flags)
2274 {
2275         struct inode_security_struct *isec = inode->i_security;
2276         u32 newsid;
2277         int rc;
2278
2279         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2280                 return -EOPNOTSUPP;
2281
2282         if (!value || !size)
2283                 return -EACCES;
2284
2285         rc = security_context_to_sid((void*)value, size, &newsid);
2286         if (rc)
2287                 return rc;
2288
2289         isec->sid = newsid;
2290         return 0;
2291 }
2292
2293 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2294 {
2295         const int len = sizeof(XATTR_NAME_SELINUX);
2296         if (buffer && len <= buffer_size)
2297                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2298         return len;
2299 }
2300
2301 /* file security operations */
2302
2303 static int selinux_file_permission(struct file *file, int mask)
2304 {
2305         struct inode *inode = file->f_dentry->d_inode;
2306
2307         if (!mask) {
2308                 /* No permission to check.  Existence test. */
2309                 return 0;
2310         }
2311
2312         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2313         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2314                 mask |= MAY_APPEND;
2315
2316         return file_has_perm(current, file,
2317                              file_mask_to_av(inode->i_mode, mask));
2318 }
2319
2320 static int selinux_file_alloc_security(struct file *file)
2321 {
2322         return file_alloc_security(file);
2323 }
2324
2325 static void selinux_file_free_security(struct file *file)
2326 {
2327         file_free_security(file);
2328 }
2329
2330 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2331                               unsigned long arg)
2332 {
2333         int error = 0;
2334
2335         switch (cmd) {
2336                 case FIONREAD:
2337                 /* fall through */
2338                 case FIBMAP:
2339                 /* fall through */
2340                 case FIGETBSZ:
2341                 /* fall through */
2342                 case EXT2_IOC_GETFLAGS:
2343                 /* fall through */
2344                 case EXT2_IOC_GETVERSION:
2345                         error = file_has_perm(current, file, FILE__GETATTR);
2346                         break;
2347
2348                 case EXT2_IOC_SETFLAGS:
2349                 /* fall through */
2350                 case EXT2_IOC_SETVERSION:
2351                         error = file_has_perm(current, file, FILE__SETATTR);
2352                         break;
2353
2354                 /* sys_ioctl() checks */
2355                 case FIONBIO:
2356                 /* fall through */
2357                 case FIOASYNC:
2358                         error = file_has_perm(current, file, 0);
2359                         break;
2360
2361                 case KDSKBENT:
2362                 case KDSKBSENT:
2363                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2364                         break;
2365
2366                 /* default case assumes that the command will go
2367                  * to the file's ioctl() function.
2368                  */
2369                 default:
2370                         error = file_has_perm(current, file, FILE__IOCTL);
2371
2372         }
2373         return error;
2374 }
2375
2376 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2377 {
2378 #ifndef CONFIG_PPC32
2379         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2380                 /*
2381                  * We are making executable an anonymous mapping or a
2382                  * private file mapping that will also be writable.
2383                  * This has an additional check.
2384                  */
2385                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2386                 if (rc)
2387                         return rc;
2388         }
2389 #endif
2390
2391         if (file) {
2392                 /* read access is always possible with a mapping */
2393                 u32 av = FILE__READ;
2394
2395                 /* write access only matters if the mapping is shared */
2396                 if (shared && (prot & PROT_WRITE))
2397                         av |= FILE__WRITE;
2398
2399                 if (prot & PROT_EXEC)
2400                         av |= FILE__EXECUTE;
2401
2402                 return file_has_perm(current, file, av);
2403         }
2404         return 0;
2405 }
2406
2407 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2408                              unsigned long prot, unsigned long flags)
2409 {
2410         int rc;
2411
2412         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2413         if (rc)
2414                 return rc;
2415
2416         if (selinux_checkreqprot)
2417                 prot = reqprot;
2418
2419         return file_map_prot_check(file, prot,
2420                                    (flags & MAP_TYPE) == MAP_SHARED);
2421 }
2422
2423 static int selinux_file_mprotect(struct vm_area_struct *vma,
2424                                  unsigned long reqprot,
2425                                  unsigned long prot)
2426 {
2427         int rc;
2428
2429         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2430         if (rc)
2431                 return rc;
2432
2433         if (selinux_checkreqprot)
2434                 prot = reqprot;
2435
2436 #ifndef CONFIG_PPC32
2437         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2438            (vma->vm_start >= vma->vm_mm->start_brk &&
2439             vma->vm_end <= vma->vm_mm->brk)) {
2440                 /*
2441                  * We are making an executable mapping in the brk region.
2442                  * This has an additional execheap check.
2443                  */
2444                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2445                 if (rc)
2446                         return rc;
2447         }
2448         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2449                 /*
2450                  * We are making executable a file mapping that has
2451                  * had some COW done. Since pages might have been written,
2452                  * check ability to execute the possibly modified content.
2453                  * This typically should only occur for text relocations.
2454                  */
2455                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2456                 if (rc)
2457                         return rc;
2458         }
2459         if (!vma->vm_file && (prot & PROT_EXEC) &&
2460                 vma->vm_start <= vma->vm_mm->start_stack &&
2461                 vma->vm_end >= vma->vm_mm->start_stack) {
2462                 /* Attempt to make the process stack executable.
2463                  * This has an additional execstack check.
2464                  */
2465                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2466                 if (rc)
2467                         return rc;
2468         }
2469 #endif
2470
2471         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2472 }
2473
2474 static int selinux_file_lock(struct file *file, unsigned int cmd)
2475 {
2476         return file_has_perm(current, file, FILE__LOCK);
2477 }
2478
2479 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2480                               unsigned long arg)
2481 {
2482         int err = 0;
2483
2484         switch (cmd) {
2485                 case F_SETFL:
2486                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2487                                 err = -EINVAL;
2488                                 break;
2489                         }
2490
2491                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2492                                 err = file_has_perm(current, file,FILE__WRITE);
2493                                 break;
2494                         }
2495                         /* fall through */
2496                 case F_SETOWN:
2497                 case F_SETSIG:
2498                 case F_GETFL:
2499                 case F_GETOWN:
2500                 case F_GETSIG:
2501                         /* Just check FD__USE permission */
2502                         err = file_has_perm(current, file, 0);
2503                         break;
2504                 case F_GETLK:
2505                 case F_SETLK:
2506                 case F_SETLKW:
2507 #if BITS_PER_LONG == 32
2508                 case F_GETLK64:
2509                 case F_SETLK64:
2510                 case F_SETLKW64:
2511 #endif
2512                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2513                                 err = -EINVAL;
2514                                 break;
2515                         }
2516                         err = file_has_perm(current, file, FILE__LOCK);
2517                         break;
2518         }
2519
2520         return err;
2521 }
2522
2523 static int selinux_file_set_fowner(struct file *file)
2524 {
2525         struct task_security_struct *tsec;
2526         struct file_security_struct *fsec;
2527
2528         tsec = current->security;
2529         fsec = file->f_security;
2530         fsec->fown_sid = tsec->sid;
2531
2532         return 0;
2533 }
2534
2535 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2536                                        struct fown_struct *fown, int signum)
2537 {
2538         struct file *file;
2539         u32 perm;
2540         struct task_security_struct *tsec;
2541         struct file_security_struct *fsec;
2542
2543         /* struct fown_struct is never outside the context of a struct file */
2544         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2545
2546         tsec = tsk->security;
2547         fsec = file->f_security;
2548
2549         if (!signum)
2550                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2551         else
2552                 perm = signal_to_av(signum);
2553
2554         return avc_has_perm(fsec->fown_sid, tsec->sid,
2555                             SECCLASS_PROCESS, perm, NULL);
2556 }
2557
2558 static int selinux_file_receive(struct file *file)
2559 {
2560         return file_has_perm(current, file, file_to_av(file));
2561 }
2562
2563 /* task security operations */
2564
2565 static int selinux_task_create(unsigned long clone_flags)
2566 {
2567         int rc;
2568
2569         rc = secondary_ops->task_create(clone_flags);
2570         if (rc)
2571                 return rc;
2572
2573         return task_has_perm(current, current, PROCESS__FORK);
2574 }
2575
2576 static int selinux_task_alloc_security(struct task_struct *tsk)
2577 {
2578         struct task_security_struct *tsec1, *tsec2;
2579         int rc;
2580
2581         tsec1 = current->security;
2582
2583         rc = task_alloc_security(tsk);
2584         if (rc)
2585                 return rc;
2586         tsec2 = tsk->security;
2587
2588         tsec2->osid = tsec1->osid;
2589         tsec2->sid = tsec1->sid;
2590
2591         /* Retain the exec and create SIDs across fork */
2592         tsec2->exec_sid = tsec1->exec_sid;
2593         tsec2->create_sid = tsec1->create_sid;
2594
2595         /* Retain ptracer SID across fork, if any.
2596            This will be reset by the ptrace hook upon any
2597            subsequent ptrace_attach operations. */
2598         tsec2->ptrace_sid = tsec1->ptrace_sid;
2599
2600         return 0;
2601 }
2602
2603 static void selinux_task_free_security(struct task_struct *tsk)
2604 {
2605         task_free_security(tsk);
2606 }
2607
2608 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2609 {
2610         /* Since setuid only affects the current process, and
2611            since the SELinux controls are not based on the Linux
2612            identity attributes, SELinux does not need to control
2613            this operation.  However, SELinux does control the use
2614            of the CAP_SETUID and CAP_SETGID capabilities using the
2615            capable hook. */
2616         return 0;
2617 }
2618
2619 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2620 {
2621         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2622 }
2623
2624 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2625 {
2626         /* See the comment for setuid above. */
2627         return 0;
2628 }
2629
2630 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2631 {
2632         return task_has_perm(current, p, PROCESS__SETPGID);
2633 }
2634
2635 static int selinux_task_getpgid(struct task_struct *p)
2636 {
2637         return task_has_perm(current, p, PROCESS__GETPGID);
2638 }
2639
2640 static int selinux_task_getsid(struct task_struct *p)
2641 {
2642         return task_has_perm(current, p, PROCESS__GETSESSION);
2643 }
2644
2645 static int selinux_task_setgroups(struct group_info *group_info)
2646 {
2647         /* See the comment for setuid above. */
2648         return 0;
2649 }
2650
2651 static int selinux_task_setnice(struct task_struct *p, int nice)
2652 {
2653         int rc;
2654
2655         rc = secondary_ops->task_setnice(p, nice);
2656         if (rc)
2657                 return rc;
2658
2659         return task_has_perm(current,p, PROCESS__SETSCHED);
2660 }
2661
2662 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2663 {
2664         struct rlimit *old_rlim = current->signal->rlim + resource;
2665         int rc;
2666
2667         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2668         if (rc)
2669                 return rc;
2670
2671         /* Control the ability to change the hard limit (whether
2672            lowering or raising it), so that the hard limit can
2673            later be used as a safe reset point for the soft limit
2674            upon context transitions. See selinux_bprm_apply_creds. */
2675         if (old_rlim->rlim_max != new_rlim->rlim_max)
2676                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2677
2678         return 0;
2679 }
2680
2681 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2682 {
2683         return task_has_perm(current, p, PROCESS__SETSCHED);
2684 }
2685
2686 static int selinux_task_getscheduler(struct task_struct *p)
2687 {
2688         return task_has_perm(current, p, PROCESS__GETSCHED);
2689 }
2690
2691 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2692 {
2693         u32 perm;
2694         int rc;
2695
2696         rc = secondary_ops->task_kill(p, info, sig);
2697         if (rc)
2698                 return rc;
2699
2700         if (info && ((unsigned long)info == 1 ||
2701                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2702                 return 0;
2703
2704         if (!sig)
2705                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2706         else
2707                 perm = signal_to_av(sig);
2708
2709         return task_has_perm(current, p, perm);
2710 }
2711
2712 static int selinux_task_prctl(int option,
2713                               unsigned long arg2,
2714                               unsigned long arg3,
2715                               unsigned long arg4,
2716                               unsigned long arg5)
2717 {
2718         /* The current prctl operations do not appear to require
2719            any SELinux controls since they merely observe or modify
2720            the state of the current process. */
2721         return 0;
2722 }
2723
2724 static int selinux_task_wait(struct task_struct *p)
2725 {
2726         u32 perm;
2727
2728         perm = signal_to_av(p->exit_signal);
2729
2730         return task_has_perm(p, current, perm);
2731 }
2732
2733 static void selinux_task_reparent_to_init(struct task_struct *p)
2734 {
2735         struct task_security_struct *tsec;
2736
2737         secondary_ops->task_reparent_to_init(p);
2738
2739         tsec = p->security;
2740         tsec->osid = tsec->sid;
2741         tsec->sid = SECINITSID_KERNEL;
2742         return;
2743 }
2744
2745 static void selinux_task_to_inode(struct task_struct *p,
2746                                   struct inode *inode)
2747 {
2748         struct task_security_struct *tsec = p->security;
2749         struct inode_security_struct *isec = inode->i_security;
2750
2751         isec->sid = tsec->sid;
2752         isec->initialized = 1;
2753         return;
2754 }
2755
2756 #ifdef CONFIG_SECURITY_NETWORK
2757
2758 /* Returns error only if unable to parse addresses */
2759 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2760 {
2761         int offset, ihlen, ret = -EINVAL;
2762         struct iphdr _iph, *ih;
2763
2764         offset = skb->nh.raw - skb->data;
2765         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2766         if (ih == NULL)
2767                 goto out;
2768
2769         ihlen = ih->ihl * 4;
2770         if (ihlen < sizeof(_iph))
2771                 goto out;
2772
2773         ad->u.net.v4info.saddr = ih->saddr;
2774         ad->u.net.v4info.daddr = ih->daddr;
2775         ret = 0;
2776
2777         switch (ih->protocol) {
2778         case IPPROTO_TCP: {
2779                 struct tcphdr _tcph, *th;
2780
2781                 if (ntohs(ih->frag_off) & IP_OFFSET)
2782                         break;
2783
2784                 offset += ihlen;
2785                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2786                 if (th == NULL)
2787                         break;
2788
2789                 ad->u.net.sport = th->source;
2790                 ad->u.net.dport = th->dest;
2791                 break;
2792         }
2793
2794         case IPPROTO_UDP: {
2795                 struct udphdr _udph, *uh;
2796
2797                 if (ntohs(ih->frag_off) & IP_OFFSET)
2798                         break;
2799
2800                 offset += ihlen;
2801                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2802                 if (uh == NULL)
2803                         break;
2804
2805                 ad->u.net.sport = uh->source;
2806                 ad->u.net.dport = uh->dest;
2807                 break;
2808         }
2809
2810         default:
2811                 break;
2812         }
2813 out:
2814         return ret;
2815 }
2816
2817 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2818
2819 /* Returns error only if unable to parse addresses */
2820 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2821 {
2822         u8 nexthdr;
2823         int ret = -EINVAL, offset;
2824         struct ipv6hdr _ipv6h, *ip6;
2825
2826         offset = skb->nh.raw - skb->data;
2827         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2828         if (ip6 == NULL)
2829                 goto out;
2830
2831         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2832         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2833         ret = 0;
2834
2835         nexthdr = ip6->nexthdr;
2836         offset += sizeof(_ipv6h);
2837         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2838         if (offset < 0)
2839                 goto out;
2840
2841         switch (nexthdr) {
2842         case IPPROTO_TCP: {
2843                 struct tcphdr _tcph, *th;
2844
2845                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2846                 if (th == NULL)
2847                         break;
2848
2849                 ad->u.net.sport = th->source;
2850                 ad->u.net.dport = th->dest;
2851                 break;
2852         }
2853
2854         case IPPROTO_UDP: {
2855                 struct udphdr _udph, *uh;
2856
2857                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2858                 if (uh == NULL)
2859                         break;
2860
2861                 ad->u.net.sport = uh->source;
2862                 ad->u.net.dport = uh->dest;
2863                 break;
2864         }
2865
2866         /* includes fragments */
2867         default:
2868                 break;
2869         }
2870 out:
2871         return ret;
2872 }
2873
2874 #endif /* IPV6 */
2875
2876 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2877                              char **addrp, int *len, int src)
2878 {
2879         int ret = 0;
2880
2881         switch (ad->u.net.family) {
2882         case PF_INET:
2883                 ret = selinux_parse_skb_ipv4(skb, ad);
2884                 if (ret || !addrp)
2885                         break;
2886                 *len = 4;
2887                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2888                                         &ad->u.net.v4info.daddr);
2889                 break;
2890
2891 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2892         case PF_INET6:
2893                 ret = selinux_parse_skb_ipv6(skb, ad);
2894                 if (ret || !addrp)
2895                         break;
2896                 *len = 16;
2897                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2898                                         &ad->u.net.v6info.daddr);
2899                 break;
2900 #endif  /* IPV6 */
2901         default:
2902                 break;
2903         }
2904
2905         return ret;
2906 }
2907
2908 /* socket security operations */
2909 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2910                            u32 perms)
2911 {
2912         struct inode_security_struct *isec;
2913         struct task_security_struct *tsec;
2914         struct avc_audit_data ad;
2915         int err = 0;
2916
2917         tsec = task->security;
2918         isec = SOCK_INODE(sock)->i_security;
2919
2920         if (isec->sid == SECINITSID_KERNEL)
2921                 goto out;
2922
2923         AVC_AUDIT_DATA_INIT(&ad,NET);
2924         ad.u.net.sk = sock->sk;
2925         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2926
2927 out:
2928         return err;
2929 }
2930
2931 static int selinux_socket_create(int family, int type,
2932                                  int protocol, int kern)
2933 {
2934         int err = 0;
2935         struct task_security_struct *tsec;
2936
2937         if (kern)
2938                 goto out;
2939
2940         tsec = current->security;
2941         err = avc_has_perm(tsec->sid, tsec->sid,
2942                            socket_type_to_security_class(family, type,
2943                            protocol), SOCKET__CREATE, NULL);
2944
2945 out:
2946         return err;
2947 }
2948
2949 static void selinux_socket_post_create(struct socket *sock, int family,
2950                                        int type, int protocol, int kern)
2951 {
2952         struct inode_security_struct *isec;
2953         struct task_security_struct *tsec;
2954
2955         isec = SOCK_INODE(sock)->i_security;
2956
2957         tsec = current->security;
2958         isec->sclass = socket_type_to_security_class(family, type, protocol);
2959         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2960         isec->initialized = 1;
2961
2962         return;
2963 }
2964
2965 /* Range of port numbers used to automatically bind.
2966    Need to determine whether we should perform a name_bind
2967    permission check between the socket and the port number. */
2968 #define ip_local_port_range_0 sysctl_local_port_range[0]
2969 #define ip_local_port_range_1 sysctl_local_port_range[1]
2970
2971 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2972 {
2973         u16 family;
2974         int err;
2975
2976         err = socket_has_perm(current, sock, SOCKET__BIND);
2977         if (err)
2978                 goto out;
2979
2980         /*
2981          * If PF_INET or PF_INET6, check name_bind permission for the port.
2982          */
2983         family = sock->sk->sk_family;
2984         if (family == PF_INET || family == PF_INET6) {
2985                 char *addrp;
2986                 struct inode_security_struct *isec;
2987                 struct task_security_struct *tsec;
2988                 struct avc_audit_data ad;
2989                 struct sockaddr_in *addr4 = NULL;
2990                 struct sockaddr_in6 *addr6 = NULL;
2991                 unsigned short snum;
2992                 struct sock *sk = sock->sk;
2993                 u32 sid, node_perm, addrlen;
2994
2995                 tsec = current->security;
2996                 isec = SOCK_INODE(sock)->i_security;
2997
2998                 if (family == PF_INET) {
2999                         addr4 = (struct sockaddr_in *)address;
3000                         snum = ntohs(addr4->sin_port);
3001                         addrlen = sizeof(addr4->sin_addr.s_addr);
3002                         addrp = (char *)&addr4->sin_addr.s_addr;
3003                 } else {
3004                         addr6 = (struct sockaddr_in6 *)address;
3005                         snum = ntohs(addr6->sin6_port);
3006                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3007                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3008                 }
3009
3010                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3011                            snum > ip_local_port_range_1)) {
3012                         err = security_port_sid(sk->sk_family, sk->sk_type,
3013                                                 sk->sk_protocol, snum, &sid);
3014                         if (err)
3015                                 goto out;
3016                         AVC_AUDIT_DATA_INIT(&ad,NET);
3017                         ad.u.net.sport = htons(snum);
3018                         ad.u.net.family = family;
3019                         err = avc_has_perm(isec->sid, sid,
3020                                            isec->sclass,
3021                                            SOCKET__NAME_BIND, &ad);
3022                         if (err)
3023                                 goto out;
3024                 }
3025
3026                 switch(sk->sk_protocol) {
3027                 case IPPROTO_TCP:
3028                         node_perm = TCP_SOCKET__NODE_BIND;
3029                         break;
3030
3031                 case IPPROTO_UDP:
3032                         node_perm = UDP_SOCKET__NODE_BIND;
3033                         break;
3034
3035                 default:
3036                         node_perm = RAWIP_SOCKET__NODE_BIND;
3037                         break;
3038                 }
3039
3040                 err = security_node_sid(family, addrp, addrlen, &sid);
3041                 if (err)
3042                         goto out;
3043
3044                 AVC_AUDIT_DATA_INIT(&ad,NET);
3045                 ad.u.net.sport = htons(snum);
3046                 ad.u.net.family = family;
3047
3048                 if (family == PF_INET)
3049                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3050                 else
3051                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3052
3053                 err = avc_has_perm(isec->sid, sid,
3054                                    isec->sclass, node_perm, &ad);
3055                 if (err)
3056                         goto out;
3057         }
3058 out:
3059         return err;
3060 }
3061
3062 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3063 {
3064         struct inode_security_struct *isec;
3065         int err;
3066
3067         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3068         if (err)
3069                 return err;
3070
3071         /*
3072          * If a TCP socket, check name_connect permission for the port.
3073          */
3074         isec = SOCK_INODE(sock)->i_security;
3075         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3076                 struct sock *sk = sock->sk;
3077                 struct avc_audit_data ad;
3078                 struct sockaddr_in *addr4 = NULL;
3079                 struct sockaddr_in6 *addr6 = NULL;
3080                 unsigned short snum;
3081                 u32 sid;
3082
3083                 if (sk->sk_family == PF_INET) {
3084                         addr4 = (struct sockaddr_in *)address;
3085                         if (addrlen < sizeof(struct sockaddr_in))
3086                                 return -EINVAL;
3087                         snum = ntohs(addr4->sin_port);
3088                 } else {
3089                         addr6 = (struct sockaddr_in6 *)address;
3090                         if (addrlen < SIN6_LEN_RFC2133)
3091                                 return -EINVAL;
3092                         snum = ntohs(addr6->sin6_port);
3093                 }
3094
3095                 err = security_port_sid(sk->sk_family, sk->sk_type,
3096                                         sk->sk_protocol, snum, &sid);
3097                 if (err)
3098                         goto out;
3099
3100                 AVC_AUDIT_DATA_INIT(&ad,NET);
3101                 ad.u.net.dport = htons(snum);
3102                 ad.u.net.family = sk->sk_family;
3103                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3104                                    TCP_SOCKET__NAME_CONNECT, &ad);
3105                 if (err)
3106                         goto out;
3107         }
3108
3109 out:
3110         return err;
3111 }
3112
3113 static int selinux_socket_listen(struct socket *sock, int backlog)
3114 {
3115         return socket_has_perm(current, sock, SOCKET__LISTEN);
3116 }
3117
3118 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3119 {
3120         int err;
3121         struct inode_security_struct *isec;
3122         struct inode_security_struct *newisec;
3123
3124         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3125         if (err)
3126                 return err;
3127
3128         newisec = SOCK_INODE(newsock)->i_security;
3129
3130         isec = SOCK_INODE(sock)->i_security;
3131         newisec->sclass = isec->sclass;
3132         newisec->sid = isec->sid;
3133         newisec->initialized = 1;
3134
3135         return 0;
3136 }
3137
3138 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3139                                   int size)
3140 {
3141         return socket_has_perm(current, sock, SOCKET__WRITE);
3142 }
3143
3144 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3145                                   int size, int flags)
3146 {
3147         return socket_has_perm(current, sock, SOCKET__READ);
3148 }
3149
3150 static int selinux_socket_getsockname(struct socket *sock)
3151 {
3152         return socket_has_perm(current, sock, SOCKET__GETATTR);
3153 }
3154
3155 static int selinux_socket_getpeername(struct socket *sock)
3156 {
3157         return socket_has_perm(current, sock, SOCKET__GETATTR);
3158 }
3159
3160 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3161 {
3162         return socket_has_perm(current, sock, SOCKET__SETOPT);
3163 }
3164
3165 static int selinux_socket_getsockopt(struct socket *sock, int level,
3166                                      int optname)
3167 {
3168         return socket_has_perm(current, sock, SOCKET__GETOPT);
3169 }
3170
3171 static int selinux_socket_shutdown(struct socket *sock, int how)
3172 {
3173         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3174 }
3175
3176 static int selinux_socket_unix_stream_connect(struct socket *sock,
3177                                               struct socket *other,
3178                                               struct sock *newsk)
3179 {
3180         struct sk_security_struct *ssec;
3181         struct inode_security_struct *isec;
3182         struct inode_security_struct *other_isec;
3183         struct avc_audit_data ad;
3184         int err;
3185
3186         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3187         if (err)
3188                 return err;
3189
3190         isec = SOCK_INODE(sock)->i_security;
3191         other_isec = SOCK_INODE(other)->i_security;
3192
3193         AVC_AUDIT_DATA_INIT(&ad,NET);
3194         ad.u.net.sk = other->sk;
3195
3196         err = avc_has_perm(isec->sid, other_isec->sid,
3197                            isec->sclass,
3198                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3199         if (err)
3200                 return err;
3201
3202         /* connecting socket */
3203         ssec = sock->sk->sk_security;
3204         ssec->peer_sid = other_isec->sid;
3205
3206         /* server child socket */
3207         ssec = newsk->sk_security;
3208         ssec->peer_sid = isec->sid;
3209
3210         return 0;
3211 }
3212
3213 static int selinux_socket_unix_may_send(struct socket *sock,
3214                                         struct socket *other)
3215 {
3216         struct inode_security_struct *isec;
3217         struct inode_security_struct *other_isec;
3218         struct avc_audit_data ad;
3219         int err;
3220
3221         isec = SOCK_INODE(sock)->i_security;
3222         other_isec = SOCK_INODE(other)->i_security;
3223
3224         AVC_AUDIT_DATA_INIT(&ad,NET);
3225         ad.u.net.sk = other->sk;
3226
3227         err = avc_has_perm(isec->sid, other_isec->sid,
3228                            isec->sclass, SOCKET__SENDTO, &ad);
3229         if (err)
3230                 return err;
3231
3232         return 0;
3233 }
3234
3235 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3236 {
3237         u16 family;
3238         char *addrp;
3239         int len, err = 0;
3240         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3241         u32 sock_sid = 0;
3242         u16 sock_class = 0;
3243         struct socket *sock;
3244         struct net_device *dev;
3245         struct avc_audit_data ad;
3246
3247         family = sk->sk_family;
3248         if (family != PF_INET && family != PF_INET6)
3249                 goto out;
3250
3251         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3252         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3253                 family = PF_INET;
3254
3255         read_lock_bh(&sk->sk_callback_lock);
3256         sock = sk->sk_socket;
3257         if (sock) {
3258                 struct inode *inode;
3259                 inode = SOCK_INODE(sock);
3260                 if (inode) {
3261                         struct inode_security_struct *isec;
3262                         isec = inode->i_security;
3263                         sock_sid = isec->sid;
3264                         sock_class = isec->sclass;
3265                 }
3266         }
3267         read_unlock_bh(&sk->sk_callback_lock);
3268         if (!sock_sid)
3269                 goto out;
3270
3271         dev = skb->dev;
3272         if (!dev)
3273                 goto out;
3274
3275         err = sel_netif_sids(dev, &if_sid, NULL);
3276         if (err)
3277                 goto out;
3278
3279         switch (sock_class) {
3280         case SECCLASS_UDP_SOCKET:
3281                 netif_perm = NETIF__UDP_RECV;
3282                 node_perm = NODE__UDP_RECV;
3283                 recv_perm = UDP_SOCKET__RECV_MSG;
3284                 break;
3285
3286         case SECCLASS_TCP_SOCKET:
3287                 netif_perm = NETIF__TCP_RECV;
3288                 node_perm = NODE__TCP_RECV;
3289                 recv_perm = TCP_SOCKET__RECV_MSG;
3290                 break;
3291
3292         default:
3293                 netif_perm = NETIF__RAWIP_RECV;
3294                 node_perm = NODE__RAWIP_RECV;
3295                 break;
3296         }
3297
3298         AVC_AUDIT_DATA_INIT(&ad, NET);
3299         ad.u.net.netif = dev->name;
3300         ad.u.net.family = family;
3301
3302         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3303         if (err)
3304                 goto out;
3305
3306         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3307         if (err)
3308                 goto out;
3309
3310         /* Fixme: this lookup is inefficient */
3311         err = security_node_sid(family, addrp, len, &node_sid);
3312         if (err)
3313                 goto out;
3314
3315         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3316         if (err)
3317                 goto out;
3318
3319         if (recv_perm) {
3320                 u32 port_sid;
3321
3322                 /* Fixme: make this more efficient */
3323                 err = security_port_sid(sk->sk_family, sk->sk_type,
3324                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3325                                         &port_sid);
3326                 if (err)
3327                         goto out;
3328
3329                 err = avc_has_perm(sock_sid, port_sid,
3330                                    sock_class, recv_perm, &ad);
3331         }
3332 out:
3333         return err;
3334 }
3335
3336 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3337                                      int __user *optlen, unsigned len)
3338 {
3339         int err = 0;
3340         char *scontext;
3341         u32 scontext_len;
3342         struct sk_security_struct *ssec;
3343         struct inode_security_struct *isec;
3344
3345         isec = SOCK_INODE(sock)->i_security;
3346         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3347                 err = -ENOPROTOOPT;
3348                 goto out;
3349         }
3350
3351         ssec = sock->sk->sk_security;
3352
3353         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3354         if (err)
3355                 goto out;
3356
3357         if (scontext_len > len) {
3358                 err = -ERANGE;
3359                 goto out_len;
3360         }
3361
3362         if (copy_to_user(optval, scontext, scontext_len))
3363                 err = -EFAULT;
3364
3365 out_len:
3366         if (put_user(scontext_len, optlen))
3367                 err = -EFAULT;
3368
3369         kfree(scontext);
3370 out:
3371         return err;
3372 }
3373
3374 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3375 {
3376         return sk_alloc_security(sk, family, priority);
3377 }
3378
3379 static void selinux_sk_free_security(struct sock *sk)
3380 {
3381         sk_free_security(sk);
3382 }
3383
3384 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3385 {
3386         int err = 0;
3387         u32 perm;
3388         struct nlmsghdr *nlh;
3389         struct socket *sock = sk->sk_socket;
3390         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3391
3392         if (skb->len < NLMSG_SPACE(0)) {
3393                 err = -EINVAL;
3394                 goto out;
3395         }
3396         nlh = (struct nlmsghdr *)skb->data;
3397
3398         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3399         if (err) {
3400                 if (err == -EINVAL) {
3401                         audit_log(current->audit_context, AUDIT_SELINUX_ERR,
3402                                   "SELinux:  unrecognized netlink message"
3403                                   " type=%hu for sclass=%hu\n",
3404                                   nlh->nlmsg_type, isec->sclass);
3405                         if (!selinux_enforcing)
3406                                 err = 0;
3407                 }
3408
3409                 /* Ignore */
3410                 if (err == -ENOENT)
3411                         err = 0;
3412                 goto out;
3413         }
3414
3415         err = socket_has_perm(current, sock, perm);
3416 out:
3417         return err;
3418 }
3419
3420 #ifdef CONFIG_NETFILTER
3421
3422 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3423                                               struct sk_buff **pskb,
3424                                               const struct net_device *in,
3425                                               const struct net_device *out,
3426                                               int (*okfn)(struct sk_buff *),
3427                                               u16 family)
3428 {
3429         char *addrp;
3430         int len, err = NF_ACCEPT;
3431         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3432         struct sock *sk;
3433         struct socket *sock;
3434         struct inode *inode;
3435         struct sk_buff *skb = *pskb;
3436         struct inode_security_struct *isec;
3437         struct avc_audit_data ad;
3438         struct net_device *dev = (struct net_device *)out;
3439
3440         sk = skb->sk;
3441         if (!sk)
3442                 goto out;
3443
3444         sock = sk->sk_socket;
3445         if (!sock)
3446                 goto out;
3447
3448         inode = SOCK_INODE(sock);
3449         if (!inode)
3450                 goto out;
3451
3452         err = sel_netif_sids(dev, &if_sid, NULL);
3453         if (err)
3454                 goto out;
3455
3456         isec = inode->i_security;
3457
3458         switch (isec->sclass) {
3459         case SECCLASS_UDP_SOCKET:
3460                 netif_perm = NETIF__UDP_SEND;
3461                 node_perm = NODE__UDP_SEND;
3462                 send_perm = UDP_SOCKET__SEND_MSG;
3463                 break;
3464
3465         case SECCLASS_TCP_SOCKET:
3466                 netif_perm = NETIF__TCP_SEND;
3467                 node_perm = NODE__TCP_SEND;
3468                 send_perm = TCP_SOCKET__SEND_MSG;
3469                 break;
3470
3471         default:
3472                 netif_perm = NETIF__RAWIP_SEND;
3473                 node_perm = NODE__RAWIP_SEND;
3474                 break;
3475         }
3476
3477
3478         AVC_AUDIT_DATA_INIT(&ad, NET);
3479         ad.u.net.netif = dev->name;
3480         ad.u.net.family = family;
3481
3482         err = selinux_parse_skb(skb, &ad, &addrp,
3483                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3484         if (err != NF_ACCEPT)
3485                 goto out;
3486
3487         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3488                            netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3489         if (err != NF_ACCEPT)
3490                 goto out;
3491
3492         /* Fixme: this lookup is inefficient */
3493         err = security_node_sid(family, addrp, len,
3494                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3495         if (err != NF_ACCEPT)
3496                 goto out;
3497
3498         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3499                            node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3500         if (err != NF_ACCEPT)
3501                 goto out;
3502
3503         if (send_perm) {
3504                 u32 port_sid;
3505
3506                 /* Fixme: make this more efficient */
3507                 err = security_port_sid(sk->sk_family,
3508                                         sk->sk_type,
3509                                         sk->sk_protocol,
3510                                         ntohs(ad.u.net.dport),
3511                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3512                 if (err != NF_ACCEPT)
3513                         goto out;
3514
3515                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3516                                    send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3517         }
3518
3519 out:
3520         return err;
3521 }
3522
3523 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3524                                                 struct sk_buff **pskb,
3525                                                 const struct net_device *in,
3526                                                 const struct net_device *out,
3527                                                 int (*okfn)(struct sk_buff *))
3528 {
3529         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3530 }
3531
3532 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3533
3534 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3535                                                 struct sk_buff **pskb,
3536                                                 const struct net_device *in,
3537                                                 const struct net_device *out,
3538                                                 int (*okfn)(struct sk_buff *))
3539 {
3540         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3541 }
3542
3543 #endif  /* IPV6 */
3544
3545 #endif  /* CONFIG_NETFILTER */
3546
3547 #else
3548
3549 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3550 {
3551         return 0;
3552 }
3553
3554 #endif  /* CONFIG_SECURITY_NETWORK */
3555
3556 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3557 {
3558         struct task_security_struct *tsec;
3559         struct av_decision avd;
3560         int err;
3561
3562         err = secondary_ops->netlink_send(sk, skb);
3563         if (err)
3564                 return err;
3565
3566         tsec = current->security;
3567
3568         avd.allowed = 0;
3569         avc_has_perm_noaudit(tsec->sid, tsec->sid,
3570                                 SECCLASS_CAPABILITY, ~0, &avd);
3571         cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3572
3573         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3574                 err = selinux_nlmsg_perm(sk, skb);
3575
3576         return err;
3577 }
3578
3579 static int selinux_netlink_recv(struct sk_buff *skb)
3580 {
3581         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3582                 return -EPERM;
3583         return 0;
3584 }
3585
3586 static int ipc_alloc_security(struct task_struct *task,
3587                               struct kern_ipc_perm *perm,
3588                               u16 sclass)
3589 {
3590         struct task_security_struct *tsec = task->security;
3591         struct ipc_security_struct *isec;
3592
3593         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3594         if (!isec)
3595                 return -ENOMEM;
3596
3597         memset(isec, 0, sizeof(struct ipc_security_struct));
3598         isec->magic = SELINUX_MAGIC;
3599         isec->sclass = sclass;
3600         isec->ipc_perm = perm;
3601         if (tsec) {
3602                 isec->sid = tsec->sid;
3603         } else {
3604                 isec->sid = SECINITSID_UNLABELED;
3605         }
3606         perm->security = isec;
3607
3608         return 0;
3609 }
3610
3611 static void ipc_free_security(struct kern_ipc_perm *perm)
3612 {
3613         struct ipc_security_struct *isec = perm->security;
3614         if (!isec || isec->magic != SELINUX_MAGIC)
3615                 return;
3616
3617         perm->security = NULL;
3618         kfree(isec);
3619 }
3620
3621 static int msg_msg_alloc_security(struct msg_msg *msg)
3622 {
3623         struct msg_security_struct *msec;
3624
3625         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3626         if (!msec)
3627                 return -ENOMEM;
3628
3629         memset(msec, 0, sizeof(struct msg_security_struct));
3630         msec->magic = SELINUX_MAGIC;
3631         msec->msg = msg;
3632         msec->sid = SECINITSID_UNLABELED;
3633         msg->security = msec;
3634
3635         return 0;
3636 }
3637
3638 static void msg_msg_free_security(struct msg_msg *msg)
3639 {
3640         struct msg_security_struct *msec = msg->security;
3641         if (!msec || msec->magic != SELINUX_MAGIC)
3642                 return;
3643
3644         msg->security = NULL;
3645         kfree(msec);
3646 }
3647
3648 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3649                         u32 perms)
3650 {
3651         struct task_security_struct *tsec;
3652         struct ipc_security_struct *isec;
3653         struct avc_audit_data ad;
3654
3655         tsec = current->security;
3656         isec = ipc_perms->security;
3657
3658         AVC_AUDIT_DATA_INIT(&ad, IPC);
3659         ad.u.ipc_id = ipc_perms->key;
3660
3661         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3662 }
3663
3664 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3665 {
3666         return msg_msg_alloc_security(msg);
3667 }
3668
3669 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3670 {
3671         msg_msg_free_security(msg);
3672 }
3673
3674 /* message queue security operations */
3675 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3676 {
3677         struct task_security_struct *tsec;
3678         struct ipc_security_struct *isec;
3679         struct avc_audit_data ad;
3680         int rc;
3681
3682         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3683         if (rc)
3684                 return rc;
3685
3686         tsec = current->security;
3687         isec = msq->q_perm.security;
3688
3689         AVC_AUDIT_DATA_INIT(&ad, IPC);
3690         ad.u.ipc_id = msq->q_perm.key;
3691
3692         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3693                           MSGQ__CREATE, &ad);
3694         if (rc) {
3695                 ipc_free_security(&msq->q_perm);
3696                 return rc;
3697         }
3698         return 0;
3699 }
3700
3701 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3702 {
3703         ipc_free_security(&msq->q_perm);
3704 }
3705
3706 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3707 {
3708         struct task_security_struct *tsec;
3709         struct ipc_security_struct *isec;
3710         struct avc_audit_data ad;
3711
3712         tsec = current->security;
3713         isec = msq->q_perm.security;
3714
3715         AVC_AUDIT_DATA_INIT(&ad, IPC);
3716         ad.u.ipc_id = msq->q_perm.key;
3717
3718         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3719                             MSGQ__ASSOCIATE, &ad);
3720 }
3721
3722 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3723 {
3724         int err;
3725         int perms;
3726
3727         switch(cmd) {
3728         case IPC_INFO:
3729         case MSG_INFO:
3730                 /* No specific object, just general system-wide information. */
3731                 return task_has_system(current, SYSTEM__IPC_INFO);
3732         case IPC_STAT:
3733         case MSG_STAT:
3734                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3735                 break;
3736         case IPC_SET:
3737                 perms = MSGQ__SETATTR;
3738                 break;
3739         case IPC_RMID:
3740                 perms = MSGQ__DESTROY;
3741                 break;
3742         default:
3743                 return 0;
3744         }
3745
3746         err = ipc_has_perm(&msq->q_perm, perms);
3747         return err;
3748 }
3749
3750 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3751 {
3752         struct task_security_struct *tsec;
3753         struct ipc_security_struct *isec;
3754         struct msg_security_struct *msec;
3755         struct avc_audit_data ad;
3756         int rc;
3757
3758         tsec = current->security;
3759         isec = msq->q_perm.security;
3760         msec = msg->security;
3761
3762         /*
3763          * First time through, need to assign label to the message
3764          */
3765         if (msec->sid == SECINITSID_UNLABELED) {
3766                 /*
3767                  * Compute new sid based on current process and
3768                  * message queue this message will be stored in
3769                  */
3770                 rc = security_transition_sid(tsec->sid,
3771                                              isec->sid,
3772                                              SECCLASS_MSG,
3773                                              &msec->sid);
3774                 if (rc)
3775                         return rc;
3776         }
3777
3778         AVC_AUDIT_DATA_INIT(&ad, IPC);
3779         ad.u.ipc_id = msq->q_perm.key;
3780
3781         /* Can this process write to the queue? */
3782         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3783                           MSGQ__WRITE, &ad);
3784         if (!rc)
3785                 /* Can this process send the message */
3786                 rc = avc_has_perm(tsec->sid, msec->sid,
3787                                   SECCLASS_MSG, MSG__SEND, &ad);
3788         if (!rc)
3789                 /* Can the message be put in the queue? */
3790                 rc = avc_has_perm(msec->sid, isec->sid,
3791                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3792
3793         return rc;
3794 }
3795
3796 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3797                                     struct task_struct *target,
3798                                     long type, int mode)
3799 {
3800         struct task_security_struct *tsec;
3801         struct ipc_security_struct *isec;
3802         struct msg_security_struct *msec;
3803         struct avc_audit_data ad;
3804         int rc;
3805
3806         tsec = target->security;
3807         isec = msq->q_perm.security;
3808         msec = msg->security;
3809
3810         AVC_AUDIT_DATA_INIT(&ad, IPC);
3811         ad.u.ipc_id = msq->q_perm.key;
3812
3813         rc = avc_has_perm(tsec->sid, isec->sid,
3814                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3815         if (!rc)
3816                 rc = avc_has_perm(tsec->sid, msec->sid,
3817                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3818         return rc;
3819 }
3820
3821 /* Shared Memory security operations */
3822 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3823 {
3824         struct task_security_struct *tsec;
3825         struct ipc_security_struct *isec;
3826         struct avc_audit_data ad;
3827         int rc;
3828
3829         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3830         if (rc)
3831                 return rc;
3832
3833         tsec = current->security;
3834         isec = shp->shm_perm.security;
3835
3836         AVC_AUDIT_DATA_INIT(&ad, IPC);
3837         ad.u.ipc_id = shp->shm_perm.key;
3838
3839         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3840                           SHM__CREATE, &ad);
3841         if (rc) {
3842                 ipc_free_security(&shp->shm_perm);
3843                 return rc;
3844         }
3845         return 0;
3846 }
3847
3848 static void selinux_shm_free_security(struct shmid_kernel *shp)
3849 {
3850         ipc_free_security(&shp->shm_perm);
3851 }
3852
3853 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3854 {
3855         struct task_security_struct *tsec;
3856         struct ipc_security_struct *isec;
3857         struct avc_audit_data ad;
3858
3859         tsec = current->security;
3860         isec = shp->shm_perm.security;
3861
3862         AVC_AUDIT_DATA_INIT(&ad, IPC);
3863         ad.u.ipc_id = shp->shm_perm.key;
3864
3865         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3866                             SHM__ASSOCIATE, &ad);
3867 }
3868
3869 /* Note, at this point, shp is locked down */
3870 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3871 {
3872         int perms;
3873         int err;
3874
3875         switch(cmd) {
3876         case IPC_INFO:
3877         case SHM_INFO:
3878                 /* No specific object, just general system-wide information. */
3879                 return task_has_system(current, SYSTEM__IPC_INFO);
3880         case IPC_STAT:
3881         case SHM_STAT:
3882                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3883                 break;
3884         case IPC_SET:
3885                 perms = SHM__SETATTR;
3886                 break;
3887         case SHM_LOCK:
3888         case SHM_UNLOCK:
3889                 perms = SHM__LOCK;
3890                 break;
3891         case IPC_RMID:
3892                 perms = SHM__DESTROY;
3893                 break;
3894         default:
3895                 return 0;
3896         }
3897
3898         err = ipc_has_perm(&shp->shm_perm, perms);
3899         return err;
3900 }
3901
3902 static int selinux_shm_shmat(struct shmid_kernel *shp,
3903                              char __user *shmaddr, int shmflg)
3904 {
3905         u32 perms;
3906         int rc;
3907
3908         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3909         if (rc)
3910                 return rc;
3911
3912         if (shmflg & SHM_RDONLY)
3913                 perms = SHM__READ;
3914         else
3915                 perms = SHM__READ | SHM__WRITE;
3916
3917         return ipc_has_perm(&shp->shm_perm, perms);
3918 }
3919
3920 /* Semaphore security operations */
3921 static int selinux_sem_alloc_security(struct sem_array *sma)
3922 {
3923         struct task_security_struct *tsec;
3924         struct ipc_security_struct *isec;
3925         struct avc_audit_data ad;
3926         int rc;
3927
3928         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3929         if (rc)
3930                 return rc;
3931
3932         tsec = current->security;
3933         isec = sma->sem_perm.security;
3934
3935         AVC_AUDIT_DATA_INIT(&ad, IPC);
3936         ad.u.ipc_id = sma->sem_perm.key;
3937
3938         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3939                           SEM__CREATE, &ad);
3940         if (rc) {
3941                 ipc_free_security(&sma->sem_perm);
3942                 return rc;
3943         }
3944         return 0;
3945 }
3946
3947 static void selinux_sem_free_security(struct sem_array *sma)
3948 {
3949         ipc_free_security(&sma->sem_perm);
3950 }
3951
3952 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3953 {
3954         struct task_security_struct *tsec;
3955         struct ipc_security_struct *isec;
3956         struct avc_audit_data ad;
3957
3958         tsec = current->security;
3959         isec = sma->sem_perm.security;
3960
3961         AVC_AUDIT_DATA_INIT(&ad, IPC);
3962         ad.u.ipc_id = sma->sem_perm.key;
3963
3964         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3965                             SEM__ASSOCIATE, &ad);
3966 }
3967
3968 /* Note, at this point, sma is locked down */
3969 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3970 {
3971         int err;
3972         u32 perms;
3973
3974         switch(cmd) {
3975         case IPC_INFO:
3976         case SEM_INFO:
3977                 /* No specific object, just general system-wide information. */
3978                 return task_has_system(current, SYSTEM__IPC_INFO);
3979         case GETPID:
3980         case GETNCNT:
3981         case GETZCNT:
3982                 perms = SEM__GETATTR;
3983                 break;
3984         case GETVAL:
3985         case GETALL:
3986                 perms = SEM__READ;
3987                 break;
3988         case SETVAL:
3989         case SETALL:
3990                 perms = SEM__WRITE;
3991                 break;
3992         case IPC_RMID:
3993                 perms = SEM__DESTROY;
3994                 break;
3995         case IPC_SET:
3996                 perms = SEM__SETATTR;
3997                 break;
3998         case IPC_STAT:
3999         case SEM_STAT:
4000                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4001                 break;
4002         default:
4003                 return 0;
4004         }
4005
4006         err = ipc_has_perm(&sma->sem_perm, perms);
4007         return err;
4008 }
4009
4010 static int selinux_sem_semop(struct sem_array *sma,
4011                              struct sembuf *sops, unsigned nsops, int alter)
4012 {
4013         u32 perms;
4014
4015         if (alter)
4016                 perms = SEM__READ | SEM__WRITE;
4017         else
4018                 perms = SEM__READ;
4019
4020         return ipc_has_perm(&sma->sem_perm, perms);
4021 }
4022
4023 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4024 {
4025         u32 av = 0;
4026
4027         av = 0;
4028         if (flag & S_IRUGO)
4029                 av |= IPC__UNIX_READ;
4030         if (flag & S_IWUGO)
4031                 av |= IPC__UNIX_WRITE;
4032
4033         if (av == 0)
4034                 return 0;
4035
4036         return ipc_has_perm(ipcp, av);
4037 }
4038
4039 /* module stacking operations */
4040 static int selinux_register_security (const char *name, struct security_operations *ops)
4041 {
4042         if (secondary_ops != original_ops) {
4043                 printk(KERN_INFO "%s:  There is already a secondary security "
4044                        "module registered.\n", __FUNCTION__);
4045                 return -EINVAL;
4046         }
4047
4048         secondary_ops = ops;
4049
4050         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4051                __FUNCTION__,
4052                name);
4053
4054         return 0;
4055 }
4056
4057 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4058 {
4059         if (ops != secondary_ops) {
4060                 printk (KERN_INFO "%s:  trying to unregister a security module "
4061                         "that is not registered.\n", __FUNCTION__);
4062                 return -EINVAL;
4063         }
4064
4065         secondary_ops = original_ops;
4066
4067         return 0;
4068 }
4069
4070 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4071 {
4072         if (inode)
4073                 inode_doinit_with_dentry(inode, dentry);
4074 }
4075
4076 static int selinux_getprocattr(struct task_struct *p,
4077                                char *name, void *value, size_t size)
4078 {
4079         struct task_security_struct *tsec;
4080         u32 sid, len;
4081         char *context;
4082         int error;
4083
4084         if (current != p) {
4085                 error = task_has_perm(current, p, PROCESS__GETATTR);
4086                 if (error)
4087                         return error;
4088         }
4089
4090         if (!size)
4091                 return -ERANGE;
4092
4093         tsec = p->security;
4094
4095         if (!strcmp(name, "current"))
4096                 sid = tsec->sid;
4097         else if (!strcmp(name, "prev"))
4098                 sid = tsec->osid;
4099         else if (!strcmp(name, "exec"))
4100                 sid = tsec->exec_sid;
4101         else if (!strcmp(name, "fscreate"))
4102                 sid = tsec->create_sid;
4103         else
4104                 return -EINVAL;
4105
4106         if (!sid)
4107                 return 0;
4108
4109         error = security_sid_to_context(sid, &context, &len);
4110         if (error)
4111                 return error;
4112         if (len > size) {
4113                 kfree(context);
4114                 return -ERANGE;
4115         }
4116         memcpy(value, context, len);
4117         kfree(context);
4118         return len;
4119 }
4120
4121 static int selinux_setprocattr(struct task_struct *p,
4122                                char *name, void *value, size_t size)
4123 {
4124         struct task_security_struct *tsec;
4125         u32 sid = 0;
4126         int error;
4127         char *str = value;
4128
4129         if (current != p) {
4130                 /* SELinux only allows a process to change its own
4131                    security attributes. */
4132                 return -EACCES;
4133         }
4134
4135         /*
4136          * Basic control over ability to set these attributes at all.
4137          * current == p, but we'll pass them separately in case the
4138          * above restriction is ever removed.
4139          */
4140         if (!strcmp(name, "exec"))
4141                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4142         else if (!strcmp(name, "fscreate"))
4143                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4144         else if (!strcmp(name, "current"))
4145                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4146         else
4147                 error = -EINVAL;
4148         if (error)
4149                 return error;
4150
4151         /* Obtain a SID for the context, if one was specified. */
4152         if (size && str[1] && str[1] != '\n') {
4153                 if (str[size-1] == '\n') {
4154                         str[size-1] = 0;
4155                         size--;
4156                 }
4157                 error = security_context_to_sid(value, size, &sid);
4158                 if (error)
4159                         return error;
4160         }
4161
4162         /* Permission checking based on the specified context is
4163            performed during the actual operation (execve,
4164            open/mkdir/...), when we know the full context of the
4165            operation.  See selinux_bprm_set_security for the execve
4166            checks and may_create for the file creation checks. The
4167            operation will then fail if the context is not permitted. */
4168         tsec = p->security;
4169         if (!strcmp(name, "exec"))
4170                 tsec->exec_sid = sid;
4171         else if (!strcmp(name, "fscreate"))
4172                 tsec->create_sid = sid;
4173         else if (!strcmp(name, "current")) {
4174                 struct av_decision avd;
4175
4176                 if (sid == 0)
4177                         return -EINVAL;
4178
4179                 /* Only allow single threaded processes to change context */
4180                 if (atomic_read(&p->mm->mm_users) != 1) {
4181                         struct task_struct *g, *t;
4182                         struct mm_struct *mm = p->mm;
4183                         read_lock(&tasklist_lock);
4184                         do_each_thread(g, t)
4185                                 if (t->mm == mm && t != p) {
4186                                         read_unlock(&tasklist_lock);
4187                                         return -EPERM;
4188                                 }
4189                         while_each_thread(g, t);
4190                         read_unlock(&tasklist_lock);
4191                 }
4192
4193                 /* Check permissions for the transition. */
4194                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4195                                      PROCESS__DYNTRANSITION, NULL);
4196                 if (error)
4197                         return error;
4198
4199                 /* Check for ptracing, and update the task SID if ok.
4200                    Otherwise, leave SID unchanged and fail. */
4201                 task_lock(p);
4202                 if (p->ptrace & PT_PTRACED) {
4203                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4204                                                      SECCLASS_PROCESS,
4205                                                      PROCESS__PTRACE, &avd);
4206                         if (!error)
4207                                 tsec->sid = sid;
4208                         task_unlock(p);
4209                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4210                                   PROCESS__PTRACE, &avd, error, NULL);
4211                         if (error)
4212                                 return error;
4213                 } else {
4214                         tsec->sid = sid;
4215                         task_unlock(p);
4216                 }
4217         }
4218         else
4219                 return -EINVAL;
4220
4221         return size;
4222 }
4223
4224 static struct security_operations selinux_ops = {
4225         .ptrace =                       selinux_ptrace,
4226         .capget =                       selinux_capget,
4227         .capset_check =                 selinux_capset_check,
4228         .capset_set =                   selinux_capset_set,
4229         .sysctl =                       selinux_sysctl,
4230         .capable =                      selinux_capable,
4231         .quotactl =                     selinux_quotactl,
4232         .quota_on =                     selinux_quota_on,
4233         .syslog =                       selinux_syslog,
4234         .vm_enough_memory =             selinux_vm_enough_memory,
4235
4236         .netlink_send =                 selinux_netlink_send,
4237         .netlink_recv =                 selinux_netlink_recv,
4238
4239         .bprm_alloc_security =          selinux_bprm_alloc_security,
4240         .bprm_free_security =           selinux_bprm_free_security,
4241         .bprm_apply_creds =             selinux_bprm_apply_creds,
4242         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4243         .bprm_set_security =            selinux_bprm_set_security,
4244         .bprm_check_security =          selinux_bprm_check_security,
4245         .bprm_secureexec =              selinux_bprm_secureexec,
4246
4247         .sb_alloc_security =            selinux_sb_alloc_security,
4248         .sb_free_security =             selinux_sb_free_security,
4249         .sb_copy_data =                 selinux_sb_copy_data,
4250         .sb_kern_mount =                selinux_sb_kern_mount,
4251         .sb_statfs =                    selinux_sb_statfs,
4252         .sb_mount =                     selinux_mount,
4253         .sb_umount =                    selinux_umount,
4254
4255         .inode_alloc_security =         selinux_inode_alloc_security,
4256         .inode_free_security =          selinux_inode_free_security,
4257         .inode_init_security =          selinux_inode_init_security,
4258         .inode_create =                 selinux_inode_create,
4259         .inode_link =                   selinux_inode_link,
4260         .inode_post_link =              selinux_inode_post_link,
4261         .inode_unlink =                 selinux_inode_unlink,
4262         .inode_symlink =                selinux_inode_symlink,
4263         .inode_mkdir =                  selinux_inode_mkdir,
4264         .inode_rmdir =                  selinux_inode_rmdir,
4265         .inode_mknod =                  selinux_inode_mknod,
4266         .inode_rename =                 selinux_inode_rename,
4267         .inode_post_rename =            selinux_inode_post_rename,
4268         .inode_readlink =               selinux_inode_readlink,
4269         .inode_follow_link =            selinux_inode_follow_link,
4270         .inode_permission =             selinux_inode_permission,
4271         .inode_setattr =                selinux_inode_setattr,
4272         .inode_getattr =                selinux_inode_getattr,
4273         .inode_setxattr =               selinux_inode_setxattr,
4274         .inode_post_setxattr =          selinux_inode_post_setxattr,
4275         .inode_getxattr =               selinux_inode_getxattr,
4276         .inode_listxattr =              selinux_inode_listxattr,
4277         .inode_removexattr =            selinux_inode_removexattr,
4278         .inode_getsecurity =            selinux_inode_getsecurity,
4279         .inode_setsecurity =            selinux_inode_setsecurity,
4280         .inode_listsecurity =           selinux_inode_listsecurity,
4281
4282         .file_permission =              selinux_file_permission,
4283         .file_alloc_security =          selinux_file_alloc_security,
4284         .file_free_security =           selinux_file_free_security,
4285         .file_ioctl =                   selinux_file_ioctl,
4286         .file_mmap =                    selinux_file_mmap,
4287         .file_mprotect =                selinux_file_mprotect,
4288         .file_lock =                    selinux_file_lock,
4289         .file_fcntl =                   selinux_file_fcntl,
4290         .file_set_fowner =              selinux_file_set_fowner,
4291         .file_send_sigiotask =          selinux_file_send_sigiotask,
4292         .file_receive =                 selinux_file_receive,
4293
4294         .task_create =                  selinux_task_create,
4295         .task_alloc_security =          selinux_task_alloc_security,
4296         .task_free_security =           selinux_task_free_security,
4297         .task_setuid =                  selinux_task_setuid,
4298         .task_post_setuid =             selinux_task_post_setuid,
4299         .task_setgid =                  selinux_task_setgid,
4300         .task_setpgid =                 selinux_task_setpgid,
4301         .task_getpgid =                 selinux_task_getpgid,
4302         .task_getsid =                  selinux_task_getsid,
4303         .task_setgroups =               selinux_task_setgroups,
4304         .task_setnice =                 selinux_task_setnice,
4305         .task_setrlimit =               selinux_task_setrlimit,
4306         .task_setscheduler =            selinux_task_setscheduler,
4307         .task_getscheduler =            selinux_task_getscheduler,
4308         .task_kill =                    selinux_task_kill,
4309         .task_wait =                    selinux_task_wait,
4310         .task_prctl =                   selinux_task_prctl,
4311         .task_reparent_to_init =        selinux_task_reparent_to_init,
4312         .task_to_inode =                selinux_task_to_inode,
4313
4314         .ipc_permission =               selinux_ipc_permission,
4315
4316         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4317         .msg_msg_free_security =        selinux_msg_msg_free_security,
4318
4319         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4320         .msg_queue_free_security =      selinux_msg_queue_free_security,
4321         .msg_queue_associate =          selinux_msg_queue_associate,
4322         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4323         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4324         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4325
4326         .shm_alloc_security =           selinux_shm_alloc_security,
4327         .shm_free_security =            selinux_shm_free_security,
4328         .shm_associate =                selinux_shm_associate,
4329         .shm_shmctl =                   selinux_shm_shmctl,
4330         .shm_shmat =                    selinux_shm_shmat,
4331
4332         .sem_alloc_security =           selinux_sem_alloc_security,
4333         .sem_free_security =            selinux_sem_free_security,
4334         .sem_associate =                selinux_sem_associate,
4335         .sem_semctl =                   selinux_sem_semctl,
4336         .sem_semop =                    selinux_sem_semop,
4337
4338         .register_security =            selinux_register_security,
4339         .unregister_security =          selinux_unregister_security,
4340
4341         .d_instantiate =                selinux_d_instantiate,
4342
4343         .getprocattr =                  selinux_getprocattr,
4344         .setprocattr =                  selinux_setprocattr,
4345
4346 #ifdef CONFIG_SECURITY_NETWORK
4347         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4348         .unix_may_send =                selinux_socket_unix_may_send,
4349
4350         .socket_create =                selinux_socket_create,
4351         .socket_post_create =           selinux_socket_post_create,
4352         .socket_bind =                  selinux_socket_bind,
4353         .socket_connect =               selinux_socket_connect,
4354         .socket_listen =                selinux_socket_listen,
4355         .socket_accept =                selinux_socket_accept,
4356         .socket_sendmsg =               selinux_socket_sendmsg,
4357         .socket_recvmsg =               selinux_socket_recvmsg,
4358         .socket_getsockname =           selinux_socket_getsockname,
4359         .socket_getpeername =           selinux_socket_getpeername,
4360         .socket_getsockopt =            selinux_socket_getsockopt,
4361         .socket_setsockopt =            selinux_socket_setsockopt,
4362         .socket_shutdown =              selinux_socket_shutdown,
4363         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4364         .socket_getpeersec =            selinux_socket_getpeersec,
4365         .sk_alloc_security =            selinux_sk_alloc_security,
4366         .sk_free_security =             selinux_sk_free_security,
4367 #endif
4368 };
4369
4370 static __init int selinux_init(void)
4371 {
4372         struct task_security_struct *tsec;
4373
4374         if (!selinux_enabled) {
4375                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4376                 return 0;
4377         }
4378
4379         printk(KERN_INFO "SELinux:  Initializing.\n");
4380
4381         /* Set the security state for the initial task. */
4382         if (task_alloc_security(current))
4383                 panic("SELinux:  Failed to initialize initial task.\n");
4384         tsec = current->security;
4385         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4386
4387         avc_init();
4388
4389         original_ops = secondary_ops = security_ops;
4390         if (!secondary_ops)
4391                 panic ("SELinux: No initial security operations\n");
4392         if (register_security (&selinux_ops))
4393                 panic("SELinux: Unable to register with kernel.\n");
4394
4395         if (selinux_enforcing) {
4396                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4397         } else {
4398                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4399         }
4400         return 0;
4401 }
4402
4403 void selinux_complete_init(void)
4404 {
4405         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4406
4407         /* Set up any superblocks initialized prior to the policy load. */
4408         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4409         spin_lock(&sb_security_lock);
4410 next_sb:
4411         if (!list_empty(&superblock_security_head)) {
4412                 struct superblock_security_struct *sbsec =
4413                                 list_entry(superblock_security_head.next,
4414                                            struct superblock_security_struct,
4415                                            list);
4416                 struct super_block *sb = sbsec->sb;
4417                 spin_lock(&sb_lock);
4418                 sb->s_count++;
4419                 spin_unlock(&sb_lock);
4420                 spin_unlock(&sb_security_lock);
4421                 down_read(&sb->s_umount);
4422                 if (sb->s_root)
4423                         superblock_doinit(sb, NULL);
4424                 drop_super(sb);
4425                 spin_lock(&sb_security_lock);
4426                 list_del_init(&sbsec->list);
4427                 goto next_sb;
4428         }
4429         spin_unlock(&sb_security_lock);
4430 }
4431
4432 /* SELinux requires early initialization in order to label
4433    all processes and objects when they are created. */
4434 security_initcall(selinux_init);
4435
4436 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4437
4438 static struct nf_hook_ops selinux_ipv4_op = {
4439         .hook =         selinux_ipv4_postroute_last,
4440         .owner =        THIS_MODULE,
4441         .pf =           PF_INET,
4442         .hooknum =      NF_IP_POST_ROUTING,
4443         .priority =     NF_IP_PRI_SELINUX_LAST,
4444 };
4445
4446 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4447
4448 static struct nf_hook_ops selinux_ipv6_op = {
4449         .hook =         selinux_ipv6_postroute_last,
4450         .owner =        THIS_MODULE,
4451         .pf =           PF_INET6,
4452         .hooknum =      NF_IP6_POST_ROUTING,
4453         .priority =     NF_IP6_PRI_SELINUX_LAST,
4454 };
4455
4456 #endif  /* IPV6 */
4457
4458 static int __init selinux_nf_ip_init(void)
4459 {
4460         int err = 0;
4461
4462         if (!selinux_enabled)
4463                 goto out;
4464
4465         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4466
4467         err = nf_register_hook(&selinux_ipv4_op);
4468         if (err)
4469                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4470
4471 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4472
4473         err = nf_register_hook(&selinux_ipv6_op);
4474         if (err)
4475                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4476
4477 #endif  /* IPV6 */
4478 out:
4479         return err;
4480 }
4481
4482 __initcall(selinux_nf_ip_init);
4483
4484 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4485 static void selinux_nf_ip_exit(void)
4486 {
4487         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4488
4489         nf_unregister_hook(&selinux_ipv4_op);
4490 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4491         nf_unregister_hook(&selinux_ipv6_op);
4492 #endif  /* IPV6 */
4493 }
4494 #endif
4495
4496 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4497
4498 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4499 #define selinux_nf_ip_exit()
4500 #endif
4501
4502 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4503
4504 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4505 int selinux_disable(void)
4506 {
4507         extern void exit_sel_fs(void);
4508         static int selinux_disabled = 0;
4509
4510         if (ss_initialized) {
4511                 /* Not permitted after initial policy load. */
4512                 return -EINVAL;
4513         }
4514
4515         if (selinux_disabled) {
4516                 /* Only do this once. */
4517                 return -EINVAL;
4518         }
4519
4520         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4521
4522         selinux_disabled = 1;
4523
4524         /* Reset security_ops to the secondary module, dummy or capability. */
4525         security_ops = secondary_ops;
4526
4527         /* Unregister netfilter hooks. */
4528         selinux_nf_ip_exit();
4529
4530         /* Unregister selinuxfs. */
4531         exit_sel_fs();
4532
4533         return 0;
4534 }
4535 #endif
4536
4537