security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define NUM_SEL_MNT_OPTS 5
  98
  99 extern struct security_operations *security_ops;
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!strict_strtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!strict_strtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (atomic_read(&selinux_secmark_refcount) > 0);
 147 }
 148
 149 /*
 150  * initialise the security for the init task
 151  */
 152 static void cred_init_security(void)
 153 {
 154         struct cred *cred = (struct cred *) current->real_cred;
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 panic("SELinux:  Failed to initialize initial task.\n");
 160
 161         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 162         cred->security = tsec;
 163 }
 164
 165 /*
 166  * get the security ID of a set of credentials
 167  */
 168 static inline u32 cred_sid(const struct cred *cred)
 169 {
 170         const struct task_security_struct *tsec;
 171
 172         tsec = cred->security;
 173         return tsec->sid;
 174 }
 175
 176 /*
 177  * get the objective security ID of a task
 178  */
 179 static inline u32 task_sid(const struct task_struct *task)
 180 {
 181         u32 sid;
 182
 183         rcu_read_lock();
 184         sid = cred_sid(__task_cred(task));
 185         rcu_read_unlock();
 186         return sid;
 187 }
 188
 189 /*
 190  * get the subjective security ID of the current task
 191  */
 192 static inline u32 current_sid(void)
 193 {
 194         const struct task_security_struct *tsec = current_security();
 195
 196         return tsec->sid;
 197 }
 198
 199 /* Allocate and free functions for each kind of security blob. */
 200
 201 static int inode_alloc_security(struct inode *inode)
 202 {
 203         struct inode_security_struct *isec;
 204         u32 sid = current_sid();
 205
 206         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 207         if (!isec)
 208                 return -ENOMEM;
 209
 210         mutex_init(&isec->lock);
 211         INIT_LIST_HEAD(&isec->list);
 212         isec->inode = inode;
 213         isec->sid = SECINITSID_UNLABELED;
 214         isec->sclass = SECCLASS_FILE;
 215         isec->task_sid = sid;
 216         inode->i_security = isec;
 217
 218         return 0;
 219 }
 220
 221 static void inode_free_security(struct inode *inode)
 222 {
 223         struct inode_security_struct *isec = inode->i_security;
 224         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 225
 226         spin_lock(&sbsec->isec_lock);
 227         if (!list_empty(&isec->list))
 228                 list_del_init(&isec->list);
 229         spin_unlock(&sbsec->isec_lock);
 230
 231         inode->i_security = NULL;
 232         kmem_cache_free(sel_inode_cache, isec);
 233 }
 234
 235 static int file_alloc_security(struct file *file)
 236 {
 237         struct file_security_struct *fsec;
 238         u32 sid = current_sid();
 239
 240         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 241         if (!fsec)
 242                 return -ENOMEM;
 243
 244         fsec->sid = sid;
 245         fsec->fown_sid = sid;
 246         file->f_security = fsec;
 247
 248         return 0;
 249 }
 250
 251 static void file_free_security(struct file *file)
 252 {
 253         struct file_security_struct *fsec = file->f_security;
 254         file->f_security = NULL;
 255         kfree(fsec);
 256 }
 257
 258 static int superblock_alloc_security(struct super_block *sb)
 259 {
 260         struct superblock_security_struct *sbsec;
 261
 262         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 263         if (!sbsec)
 264                 return -ENOMEM;
 265
 266         mutex_init(&sbsec->lock);
 267         INIT_LIST_HEAD(&sbsec->isec_head);
 268         spin_lock_init(&sbsec->isec_lock);
 269         sbsec->sb = sb;
 270         sbsec->sid = SECINITSID_UNLABELED;
 271         sbsec->def_sid = SECINITSID_FILE;
 272         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 273         sb->s_security = sbsec;
 274
 275         return 0;
 276 }
 277
 278 static void superblock_free_security(struct super_block *sb)
 279 {
 280         struct superblock_security_struct *sbsec = sb->s_security;
 281         sb->s_security = NULL;
 282         kfree(sbsec);
 283 }
 284
 285 /* The file system's label must be initialized prior to use. */
 286
 287 static const char *labeling_behaviors[6] = {
 288         "uses xattr",
 289         "uses transition SIDs",
 290         "uses task SIDs",
 291         "uses genfs_contexts",
 292         "not configured for labeling",
 293         "uses mountpoint labeling",
 294 };
 295
 296 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 297
 298 static inline int inode_doinit(struct inode *inode)
 299 {
 300         return inode_doinit_with_dentry(inode, NULL);
 301 }
 302
 303 enum {
 304         Opt_error = -1,
 305         Opt_context = 1,
 306         Opt_fscontext = 2,
 307         Opt_defcontext = 3,
 308         Opt_rootcontext = 4,
 309         Opt_labelsupport = 5,
 310 };
 311
 312 static const match_table_t tokens = {
 313         {Opt_context, CONTEXT_STR "%s"},
 314         {Opt_fscontext, FSCONTEXT_STR "%s"},
 315         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 316         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 317         {Opt_labelsupport, LABELSUPP_STR},
 318         {Opt_error, NULL},
 319 };
 320
 321 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 322
 323 static int may_context_mount_sb_relabel(u32 sid,
 324                         struct superblock_security_struct *sbsec,
 325                         const struct cred *cred)
 326 {
 327         const struct task_security_struct *tsec = cred->security;
 328         int rc;
 329
 330         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 331                           FILESYSTEM__RELABELFROM, NULL);
 332         if (rc)
 333                 return rc;
 334
 335         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 336                           FILESYSTEM__RELABELTO, NULL);
 337         return rc;
 338 }
 339
 340 static int may_context_mount_inode_relabel(u32 sid,
 341                         struct superblock_security_struct *sbsec,
 342                         const struct cred *cred)
 343 {
 344         const struct task_security_struct *tsec = cred->security;
 345         int rc;
 346         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELFROM, NULL);
 348         if (rc)
 349                 return rc;
 350
 351         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 352                           FILESYSTEM__ASSOCIATE, NULL);
 353         return rc;
 354 }
 355
 356 static int sb_finish_set_opts(struct super_block *sb)
 357 {
 358         struct superblock_security_struct *sbsec = sb->s_security;
 359         struct dentry *root = sb->s_root;
 360         struct inode *root_inode = root->d_inode;
 361         int rc = 0;
 362
 363         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 364                 /* Make sure that the xattr handler exists and that no
 365                    error other than -ENODATA is returned by getxattr on
 366                    the root directory.  -ENODATA is ok, as this may be
 367                    the first boot of the SELinux kernel before we have
 368                    assigned xattr values to the filesystem. */
 369                 if (!root_inode->i_op->getxattr) {
 370                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 371                                "xattr support\n", sb->s_id, sb->s_type->name);
 372                         rc = -EOPNOTSUPP;
 373                         goto out;
 374                 }
 375                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 376                 if (rc < 0 && rc != -ENODATA) {
 377                         if (rc == -EOPNOTSUPP)
 378                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 379                                        "%s) has no security xattr handler\n",
 380                                        sb->s_id, sb->s_type->name);
 381                         else
 382                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 383                                        "%s) getxattr errno %d\n", sb->s_id,
 384                                        sb->s_type->name, -rc);
 385                         goto out;
 386                 }
 387         }
 388
 389         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 390
 391         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 392                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 393                        sb->s_id, sb->s_type->name);
 394         else
 395                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 396                        sb->s_id, sb->s_type->name,
 397                        labeling_behaviors[sbsec->behavior-1]);
 398
 399         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 400             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 401             sbsec->behavior == SECURITY_FS_USE_NONE ||
 402             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 sbsec->flags &= ~SE_SBLABELSUPP;
 404
 405         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 406         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 407                 sbsec->flags |= SE_SBLABELSUPP;
 408
 409         /* Initialize the root inode. */
 410         rc = inode_doinit_with_dentry(root_inode, root);
 411
 412         /* Initialize any other inodes associated with the superblock, e.g.
 413            inodes created prior to initial policy load or inodes created
 414            during get_sb by a pseudo filesystem that directly
 415            populates itself. */
 416         spin_lock(&sbsec->isec_lock);
 417 next_inode:
 418         if (!list_empty(&sbsec->isec_head)) {
 419                 struct inode_security_struct *isec =
 420                                 list_entry(sbsec->isec_head.next,
 421                                            struct inode_security_struct, list);
 422                 struct inode *inode = isec->inode;
 423                 spin_unlock(&sbsec->isec_lock);
 424                 inode = igrab(inode);
 425                 if (inode) {
 426                         if (!IS_PRIVATE(inode))
 427                                 inode_doinit(inode);
 428                         iput(inode);
 429                 }
 430                 spin_lock(&sbsec->isec_lock);
 431                 list_del_init(&isec->list);
 432                 goto next_inode;
 433         }
 434         spin_unlock(&sbsec->isec_lock);
 435 out:
 436         return rc;
 437 }
 438
 439 /*
 440  * This function should allow an FS to ask what it's mount security
 441  * options were so it can use those later for submounts, displaying
 442  * mount options, or whatever.
 443  */
 444 static int selinux_get_mnt_opts(const struct super_block *sb,
 445                                 struct security_mnt_opts *opts)
 446 {
 447         int rc = 0, i;
 448         struct superblock_security_struct *sbsec = sb->s_security;
 449         char *context = NULL;
 450         u32 len;
 451         char tmp;
 452
 453         security_init_mnt_opts(opts);
 454
 455         if (!(sbsec->flags & SE_SBINITIALIZED))
 456                 return -EINVAL;
 457
 458         if (!ss_initialized)
 459                 return -EINVAL;
 460
 461         tmp = sbsec->flags & SE_MNTMASK;
 462         /* count the number of mount options for this sb */
 463         for (i = 0; i < 8; i++) {
 464                 if (tmp & 0x01)
 465                         opts->num_mnt_opts++;
 466                 tmp >>= 1;
 467         }
 468         /* Check if the Label support flag is set */
 469         if (sbsec->flags & SE_SBLABELSUPP)
 470                 opts->num_mnt_opts++;
 471
 472         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 473         if (!opts->mnt_opts) {
 474                 rc = -ENOMEM;
 475                 goto out_free;
 476         }
 477
 478         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 479         if (!opts->mnt_opts_flags) {
 480                 rc = -ENOMEM;
 481                 goto out_free;
 482         }
 483
 484         i = 0;
 485         if (sbsec->flags & FSCONTEXT_MNT) {
 486                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 487                 if (rc)
 488                         goto out_free;
 489                 opts->mnt_opts[i] = context;
 490                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 491         }
 492         if (sbsec->flags & CONTEXT_MNT) {
 493                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 494                 if (rc)
 495                         goto out_free;
 496                 opts->mnt_opts[i] = context;
 497                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 498         }
 499         if (sbsec->flags & DEFCONTEXT_MNT) {
 500                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 501                 if (rc)
 502                         goto out_free;
 503                 opts->mnt_opts[i] = context;
 504                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 505         }
 506         if (sbsec->flags & ROOTCONTEXT_MNT) {
 507                 struct inode *root = sbsec->sb->s_root->d_inode;
 508                 struct inode_security_struct *isec = root->i_security;
 509
 510                 rc = security_sid_to_context(isec->sid, &context, &len);
 511                 if (rc)
 512                         goto out_free;
 513                 opts->mnt_opts[i] = context;
 514                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 515         }
 516         if (sbsec->flags & SE_SBLABELSUPP) {
 517                 opts->mnt_opts[i] = NULL;
 518                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 519         }
 520
 521         BUG_ON(i != opts->num_mnt_opts);
 522
 523         return 0;
 524
 525 out_free:
 526         security_free_mnt_opts(opts);
 527         return rc;
 528 }
 529
 530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 531                       u32 old_sid, u32 new_sid)
 532 {
 533         char mnt_flags = sbsec->flags & SE_MNTMASK;
 534
 535         /* check if the old mount command had the same options */
 536         if (sbsec->flags & SE_SBINITIALIZED)
 537                 if (!(sbsec->flags & flag) ||
 538                     (old_sid != new_sid))
 539                         return 1;
 540
 541         /* check if we were passed the same options twice,
 542          * aka someone passed context=a,context=b
 543          */
 544         if (!(sbsec->flags & SE_SBINITIALIZED))
 545                 if (mnt_flags & flag)
 546                         return 1;
 547         return 0;
 548 }
 549
 550 /*
 551  * Allow filesystems with binary mount data to explicitly set mount point
 552  * labeling information.
 553  */
 554 static int selinux_set_mnt_opts(struct super_block *sb,
 555                                 struct security_mnt_opts *opts)
 556 {
 557         const struct cred *cred = current_cred();
 558         int rc = 0, i;
 559         struct superblock_security_struct *sbsec = sb->s_security;
 560         const char *name = sb->s_type->name;
 561         struct inode *inode = sbsec->sb->s_root->d_inode;
 562         struct inode_security_struct *root_isec = inode->i_security;
 563         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 564         u32 defcontext_sid = 0;
 565         char **mount_options = opts->mnt_opts;
 566         int *flags = opts->mnt_opts_flags;
 567         int num_opts = opts->num_mnt_opts;
 568
 569         mutex_lock(&sbsec->lock);
 570
 571         if (!ss_initialized) {
 572                 if (!num_opts) {
 573                         /* Defer initialization until selinux_complete_init,
 574                            after the initial policy is loaded and the security
 575                            server is ready to handle calls. */
 576                         goto out;
 577                 }
 578                 rc = -EINVAL;
 579                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 580                         "before the security server is initialized\n");
 581                 goto out;
 582         }
 583
 584         /*
 585          * Binary mount data FS will come through this function twice.  Once
 586          * from an explicit call and once from the generic calls from the vfs.
 587          * Since the generic VFS calls will not contain any security mount data
 588          * we need to skip the double mount verification.
 589          *
 590          * This does open a hole in which we will not notice if the first
 591          * mount using this sb set explict options and a second mount using
 592          * this sb does not set any security options.  (The first options
 593          * will be used for both mounts)
 594          */
 595         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 596             && (num_opts == 0))
 597                 goto out;
 598
 599         /*
 600          * parse the mount options, check if they are valid sids.
 601          * also check if someone is trying to mount the same sb more
 602          * than once with different security options.
 603          */
 604         for (i = 0; i < num_opts; i++) {
 605                 u32 sid;
 606
 607                 if (flags[i] == SE_SBLABELSUPP)
 608                         continue;
 609                 rc = security_context_to_sid(mount_options[i],
 610                                              strlen(mount_options[i]), &sid);
 611                 if (rc) {
 612                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 613                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 614                                mount_options[i], sb->s_id, name, rc);
 615                         goto out;
 616                 }
 617                 switch (flags[i]) {
 618                 case FSCONTEXT_MNT:
 619                         fscontext_sid = sid;
 620
 621                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 622                                         fscontext_sid))
 623                                 goto out_double_mount;
 624
 625                         sbsec->flags |= FSCONTEXT_MNT;
 626                         break;
 627                 case CONTEXT_MNT:
 628                         context_sid = sid;
 629
 630                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 631                                         context_sid))
 632                                 goto out_double_mount;
 633
 634                         sbsec->flags |= CONTEXT_MNT;
 635                         break;
 636                 case ROOTCONTEXT_MNT:
 637                         rootcontext_sid = sid;
 638
 639                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 640                                         rootcontext_sid))
 641                                 goto out_double_mount;
 642
 643                         sbsec->flags |= ROOTCONTEXT_MNT;
 644
 645                         break;
 646                 case DEFCONTEXT_MNT:
 647                         defcontext_sid = sid;
 648
 649                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 650                                         defcontext_sid))
 651                                 goto out_double_mount;
 652
 653                         sbsec->flags |= DEFCONTEXT_MNT;
 654
 655                         break;
 656                 default:
 657                         rc = -EINVAL;
 658                         goto out;
 659                 }
 660         }
 661
 662         if (sbsec->flags & SE_SBINITIALIZED) {
 663                 /* previously mounted with options, but not on this attempt? */
 664                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 665                         goto out_double_mount;
 666                 rc = 0;
 667                 goto out;
 668         }
 669
 670         if (strcmp(sb->s_type->name, "proc") == 0)
 671                 sbsec->flags |= SE_SBPROC;
 672
 673         /* Determine the labeling behavior to use for this filesystem type. */
 674         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 675         if (rc) {
 676                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 677                        __func__, sb->s_type->name, rc);
 678                 goto out;
 679         }
 680
 681         /* sets the context of the superblock for the fs being mounted. */
 682         if (fscontext_sid) {
 683                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 684                 if (rc)
 685                         goto out;
 686
 687                 sbsec->sid = fscontext_sid;
 688         }
 689
 690         /*
 691          * Switch to using mount point labeling behavior.
 692          * sets the label used on all file below the mountpoint, and will set
 693          * the superblock context if not already set.
 694          */
 695         if (context_sid) {
 696                 if (!fscontext_sid) {
 697                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 698                                                           cred);
 699                         if (rc)
 700                                 goto out;
 701                         sbsec->sid = context_sid;
 702                 } else {
 703                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 704                                                              cred);
 705                         if (rc)
 706                                 goto out;
 707                 }
 708                 if (!rootcontext_sid)
 709                         rootcontext_sid = context_sid;
 710
 711                 sbsec->mntpoint_sid = context_sid;
 712                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 713         }
 714
 715         if (rootcontext_sid) {
 716                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 717                                                      cred);
 718                 if (rc)
 719                         goto out;
 720
 721                 root_isec->sid = rootcontext_sid;
 722                 root_isec->initialized = 1;
 723         }
 724
 725         if (defcontext_sid) {
 726                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 727                         rc = -EINVAL;
 728                         printk(KERN_WARNING "SELinux: defcontext option is "
 729                                "invalid for this filesystem type\n");
 730                         goto out;
 731                 }
 732
 733                 if (defcontext_sid != sbsec->def_sid) {
 734                         rc = may_context_mount_inode_relabel(defcontext_sid,
 735                                                              sbsec, cred);
 736                         if (rc)
 737                                 goto out;
 738                 }
 739
 740                 sbsec->def_sid = defcontext_sid;
 741         }
 742
 743         rc = sb_finish_set_opts(sb);
 744 out:
 745         mutex_unlock(&sbsec->lock);
 746         return rc;
 747 out_double_mount:
 748         rc = -EINVAL;
 749         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 750                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 751         goto out;
 752 }
 753
 754 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 755                                     const struct super_block *newsb)
 756 {
 757         struct superblock_security_struct *old = oldsb->s_security;
 758         struct superblock_security_struct *new = newsb->s_security;
 759         char oldflags = old->flags & SE_MNTMASK;
 760         char newflags = new->flags & SE_MNTMASK;
 761
 762         if (oldflags != newflags)
 763                 goto mismatch;
 764         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 765                 goto mismatch;
 766         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 767                 goto mismatch;
 768         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 769                 goto mismatch;
 770         if (oldflags & ROOTCONTEXT_MNT) {
 771                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 772                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 773                 if (oldroot->sid != newroot->sid)
 774                         goto mismatch;
 775         }
 776         return 0;
 777 mismatch:
 778         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 779                             "different security settings for (dev %s, "
 780                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 781         return -EBUSY;
 782 }
 783
 784 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 785                                         struct super_block *newsb)
 786 {
 787         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 788         struct superblock_security_struct *newsbsec = newsb->s_security;
 789
 790         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 791         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 792         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 793
 794         /*
 795          * if the parent was able to be mounted it clearly had no special lsm
 796          * mount options.  thus we can safely deal with this superblock later
 797          */
 798         if (!ss_initialized)
 799                 return 0;
 800
 801         /* how can we clone if the old one wasn't set up?? */
 802         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 803
 804         /* if fs is reusing a sb, make sure that the contexts match */
 805         if (newsbsec->flags & SE_SBINITIALIZED)
 806                 return selinux_cmp_sb_context(oldsb, newsb);
 807
 808         mutex_lock(&newsbsec->lock);
 809
 810         newsbsec->flags = oldsbsec->flags;
 811
 812         newsbsec->sid = oldsbsec->sid;
 813         newsbsec->def_sid = oldsbsec->def_sid;
 814         newsbsec->behavior = oldsbsec->behavior;
 815
 816         if (set_context) {
 817                 u32 sid = oldsbsec->mntpoint_sid;
 818
 819                 if (!set_fscontext)
 820                         newsbsec->sid = sid;
 821                 if (!set_rootcontext) {
 822                         struct inode *newinode = newsb->s_root->d_inode;
 823                         struct inode_security_struct *newisec = newinode->i_security;
 824                         newisec->sid = sid;
 825                 }
 826                 newsbsec->mntpoint_sid = sid;
 827         }
 828         if (set_rootcontext) {
 829                 const struct inode *oldinode = oldsb->s_root->d_inode;
 830                 const struct inode_security_struct *oldisec = oldinode->i_security;
 831                 struct inode *newinode = newsb->s_root->d_inode;
 832                 struct inode_security_struct *newisec = newinode->i_security;
 833
 834                 newisec->sid = oldisec->sid;
 835         }
 836
 837         sb_finish_set_opts(newsb);
 838         mutex_unlock(&newsbsec->lock);
 839         return 0;
 840 }
 841
 842 static int selinux_parse_opts_str(char *options,
 843                                   struct security_mnt_opts *opts)
 844 {
 845         char *p;
 846         char *context = NULL, *defcontext = NULL;
 847         char *fscontext = NULL, *rootcontext = NULL;
 848         int rc, num_mnt_opts = 0;
 849
 850         opts->num_mnt_opts = 0;
 851
 852         /* Standard string-based options. */
 853         while ((p = strsep(&options, "|")) != NULL) {
 854                 int token;
 855                 substring_t args[MAX_OPT_ARGS];
 856
 857                 if (!*p)
 858                         continue;
 859
 860                 token = match_token(p, tokens, args);
 861
 862                 switch (token) {
 863                 case Opt_context:
 864                         if (context || defcontext) {
 865                                 rc = -EINVAL;
 866                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 867                                 goto out_err;
 868                         }
 869                         context = match_strdup(&args[0]);
 870                         if (!context) {
 871                                 rc = -ENOMEM;
 872                                 goto out_err;
 873                         }
 874                         break;
 875
 876                 case Opt_fscontext:
 877                         if (fscontext) {
 878                                 rc = -EINVAL;
 879                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 880                                 goto out_err;
 881                         }
 882                         fscontext = match_strdup(&args[0]);
 883                         if (!fscontext) {
 884                                 rc = -ENOMEM;
 885                                 goto out_err;
 886                         }
 887                         break;
 888
 889                 case Opt_rootcontext:
 890                         if (rootcontext) {
 891                                 rc = -EINVAL;
 892                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 893                                 goto out_err;
 894                         }
 895                         rootcontext = match_strdup(&args[0]);
 896                         if (!rootcontext) {
 897                                 rc = -ENOMEM;
 898                                 goto out_err;
 899                         }
 900                         break;
 901
 902                 case Opt_defcontext:
 903                         if (context || defcontext) {
 904                                 rc = -EINVAL;
 905                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 906                                 goto out_err;
 907                         }
 908                         defcontext = match_strdup(&args[0]);
 909                         if (!defcontext) {
 910                                 rc = -ENOMEM;
 911                                 goto out_err;
 912                         }
 913                         break;
 914                 case Opt_labelsupport:
 915                         break;
 916                 default:
 917                         rc = -EINVAL;
 918                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 919                         goto out_err;
 920
 921                 }
 922         }
 923
 924         rc = -ENOMEM;
 925         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 926         if (!opts->mnt_opts)
 927                 goto out_err;
 928
 929         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 930         if (!opts->mnt_opts_flags) {
 931                 kfree(opts->mnt_opts);
 932                 goto out_err;
 933         }
 934
 935         if (fscontext) {
 936                 opts->mnt_opts[num_mnt_opts] = fscontext;
 937                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 938         }
 939         if (context) {
 940                 opts->mnt_opts[num_mnt_opts] = context;
 941                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 942         }
 943         if (rootcontext) {
 944                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 945                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 946         }
 947         if (defcontext) {
 948                 opts->mnt_opts[num_mnt_opts] = defcontext;
 949                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 950         }
 951
 952         opts->num_mnt_opts = num_mnt_opts;
 953         return 0;
 954
 955 out_err:
 956         kfree(context);
 957         kfree(defcontext);
 958         kfree(fscontext);
 959         kfree(rootcontext);
 960         return rc;
 961 }
 962 /*
 963  * string mount options parsing and call set the sbsec
 964  */
 965 static int superblock_doinit(struct super_block *sb, void *data)
 966 {
 967         int rc = 0;
 968         char *options = data;
 969         struct security_mnt_opts opts;
 970
 971         security_init_mnt_opts(&opts);
 972
 973         if (!data)
 974                 goto out;
 975
 976         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 977
 978         rc = selinux_parse_opts_str(options, &opts);
 979         if (rc)
 980                 goto out_err;
 981
 982 out:
 983         rc = selinux_set_mnt_opts(sb, &opts);
 984
 985 out_err:
 986         security_free_mnt_opts(&opts);
 987         return rc;
 988 }
 989
 990 static void selinux_write_opts(struct seq_file *m,
 991                                struct security_mnt_opts *opts)
 992 {
 993         int i;
 994         char *prefix;
 995
 996         for (i = 0; i < opts->num_mnt_opts; i++) {
 997                 char *has_comma;
 998
 999                 if (opts->mnt_opts[i])
1000                         has_comma = strchr(opts->mnt_opts[i], ',');
1001                 else
1002                         has_comma = NULL;
1003
1004                 switch (opts->mnt_opts_flags[i]) {
1005                 case CONTEXT_MNT:
1006                         prefix = CONTEXT_STR;
1007                         break;
1008                 case FSCONTEXT_MNT:
1009                         prefix = FSCONTEXT_STR;
1010                         break;
1011                 case ROOTCONTEXT_MNT:
1012                         prefix = ROOTCONTEXT_STR;
1013                         break;
1014                 case DEFCONTEXT_MNT:
1015                         prefix = DEFCONTEXT_STR;
1016                         break;
1017                 case SE_SBLABELSUPP:
1018                         seq_putc(m, ',');
1019                         seq_puts(m, LABELSUPP_STR);
1020                         continue;
1021                 default:
1022                         BUG();
1023                         return;
1024                 };
1025                 /* we need a comma before each option */
1026                 seq_putc(m, ',');
1027                 seq_puts(m, prefix);
1028                 if (has_comma)
1029                         seq_putc(m, '\"');
1030                 seq_puts(m, opts->mnt_opts[i]);
1031                 if (has_comma)
1032                         seq_putc(m, '\"');
1033         }
1034 }
1035
1036 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1037 {
1038         struct security_mnt_opts opts;
1039         int rc;
1040
1041         rc = selinux_get_mnt_opts(sb, &opts);
1042         if (rc) {
1043                 /* before policy load we may get EINVAL, don't show anything */
1044                 if (rc == -EINVAL)
1045                         rc = 0;
1046                 return rc;
1047         }
1048
1049         selinux_write_opts(m, &opts);
1050
1051         security_free_mnt_opts(&opts);
1052
1053         return rc;
1054 }
1055
1056 static inline u16 inode_mode_to_security_class(umode_t mode)
1057 {
1058         switch (mode & S_IFMT) {
1059         case S_IFSOCK:
1060                 return SECCLASS_SOCK_FILE;
1061         case S_IFLNK:
1062                 return SECCLASS_LNK_FILE;
1063         case S_IFREG:
1064                 return SECCLASS_FILE;
1065         case S_IFBLK:
1066                 return SECCLASS_BLK_FILE;
1067         case S_IFDIR:
1068                 return SECCLASS_DIR;
1069         case S_IFCHR:
1070                 return SECCLASS_CHR_FILE;
1071         case S_IFIFO:
1072                 return SECCLASS_FIFO_FILE;
1073
1074         }
1075
1076         return SECCLASS_FILE;
1077 }
1078
1079 static inline int default_protocol_stream(int protocol)
1080 {
1081         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1082 }
1083
1084 static inline int default_protocol_dgram(int protocol)
1085 {
1086         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1087 }
1088
1089 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1090 {
1091         switch (family) {
1092         case PF_UNIX:
1093                 switch (type) {
1094                 case SOCK_STREAM:
1095                 case SOCK_SEQPACKET:
1096                         return SECCLASS_UNIX_STREAM_SOCKET;
1097                 case SOCK_DGRAM:
1098                         return SECCLASS_UNIX_DGRAM_SOCKET;
1099                 }
1100                 break;
1101         case PF_INET:
1102         case PF_INET6:
1103                 switch (type) {
1104                 case SOCK_STREAM:
1105                         if (default_protocol_stream(protocol))
1106                                 return SECCLASS_TCP_SOCKET;
1107                         else
1108                                 return SECCLASS_RAWIP_SOCKET;
1109                 case SOCK_DGRAM:
1110                         if (default_protocol_dgram(protocol))
1111                                 return SECCLASS_UDP_SOCKET;
1112                         else
1113                                 return SECCLASS_RAWIP_SOCKET;
1114                 case SOCK_DCCP:
1115                         return SECCLASS_DCCP_SOCKET;
1116                 default:
1117                         return SECCLASS_RAWIP_SOCKET;
1118                 }
1119                 break;
1120         case PF_NETLINK:
1121                 switch (protocol) {
1122                 case NETLINK_ROUTE:
1123                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1124                 case NETLINK_FIREWALL:
1125                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1126                 case NETLINK_SOCK_DIAG:
1127                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1128                 case NETLINK_NFLOG:
1129                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1130                 case NETLINK_XFRM:
1131                         return SECCLASS_NETLINK_XFRM_SOCKET;
1132                 case NETLINK_SELINUX:
1133                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1134                 case NETLINK_AUDIT:
1135                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1136                 case NETLINK_IP6_FW:
1137                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1138                 case NETLINK_DNRTMSG:
1139                         return SECCLASS_NETLINK_DNRT_SOCKET;
1140                 case NETLINK_KOBJECT_UEVENT:
1141                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1142                 default:
1143                         return SECCLASS_NETLINK_SOCKET;
1144                 }
1145         case PF_PACKET:
1146                 return SECCLASS_PACKET_SOCKET;
1147         case PF_KEY:
1148                 return SECCLASS_KEY_SOCKET;
1149         case PF_APPLETALK:
1150                 return SECCLASS_APPLETALK_SOCKET;
1151         }
1152
1153         return SECCLASS_SOCKET;
1154 }
1155
1156 #ifdef CONFIG_PROC_FS
1157 static int selinux_proc_get_sid(struct dentry *dentry,
1158                                 u16 tclass,
1159                                 u32 *sid)
1160 {
1161         int rc;
1162         char *buffer, *path;
1163
1164         buffer = (char *)__get_free_page(GFP_KERNEL);
1165         if (!buffer)
1166                 return -ENOMEM;
1167
1168         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1169         if (IS_ERR(path))
1170                 rc = PTR_ERR(path);
1171         else {
1172                 /* each process gets a /proc/PID/ entry. Strip off the
1173                  * PID part to get a valid selinux labeling.
1174                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1175                 while (path[1] >= '0' && path[1] <= '9') {
1176                         path[1] = '/';
1177                         path++;
1178                 }
1179                 rc = security_genfs_sid("proc", path, tclass, sid);
1180         }
1181         free_page((unsigned long)buffer);
1182         return rc;
1183 }
1184 #else
1185 static int selinux_proc_get_sid(struct dentry *dentry,
1186                                 u16 tclass,
1187                                 u32 *sid)
1188 {
1189         return -EINVAL;
1190 }
1191 #endif
1192
1193 /* The inode's security attributes must be initialized before first use. */
1194 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1195 {
1196         struct superblock_security_struct *sbsec = NULL;
1197         struct inode_security_struct *isec = inode->i_security;
1198         u32 sid;
1199         struct dentry *dentry;
1200 #define INITCONTEXTLEN 255
1201         char *context = NULL;
1202         unsigned len = 0;
1203         int rc = 0;
1204
1205         if (isec->initialized)
1206                 goto out;
1207
1208         mutex_lock(&isec->lock);
1209         if (isec->initialized)
1210                 goto out_unlock;
1211
1212         sbsec = inode->i_sb->s_security;
1213         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1214                 /* Defer initialization until selinux_complete_init,
1215                    after the initial policy is loaded and the security
1216                    server is ready to handle calls. */
1217                 spin_lock(&sbsec->isec_lock);
1218                 if (list_empty(&isec->list))
1219                         list_add(&isec->list, &sbsec->isec_head);
1220                 spin_unlock(&sbsec->isec_lock);
1221                 goto out_unlock;
1222         }
1223
1224         switch (sbsec->behavior) {
1225         case SECURITY_FS_USE_XATTR:
1226                 if (!inode->i_op->getxattr) {
1227                         isec->sid = sbsec->def_sid;
1228                         break;
1229                 }
1230
1231                 /* Need a dentry, since the xattr API requires one.
1232                    Life would be simpler if we could just pass the inode. */
1233                 if (opt_dentry) {
1234                         /* Called from d_instantiate or d_splice_alias. */
1235                         dentry = dget(opt_dentry);
1236                 } else {
1237                         /* Called from selinux_complete_init, try to find a dentry. */
1238                         dentry = d_find_alias(inode);
1239                 }
1240                 if (!dentry) {
1241                         /*
1242                          * this is can be hit on boot when a file is accessed
1243                          * before the policy is loaded.  When we load policy we
1244                          * may find inodes that have no dentry on the
1245                          * sbsec->isec_head list.  No reason to complain as these
1246                          * will get fixed up the next time we go through
1247                          * inode_doinit with a dentry, before these inodes could
1248                          * be used again by userspace.
1249                          */
1250                         goto out_unlock;
1251                 }
1252
1253                 len = INITCONTEXTLEN;
1254                 context = kmalloc(len+1, GFP_NOFS);
1255                 if (!context) {
1256                         rc = -ENOMEM;
1257                         dput(dentry);
1258                         goto out_unlock;
1259                 }
1260                 context[len] = '\0';
1261                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1262                                            context, len);
1263                 if (rc == -ERANGE) {
1264                         kfree(context);
1265
1266                         /* Need a larger buffer.  Query for the right size. */
1267                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1268                                                    NULL, 0);
1269                         if (rc < 0) {
1270                                 dput(dentry);
1271                                 goto out_unlock;
1272                         }
1273                         len = rc;
1274                         context = kmalloc(len+1, GFP_NOFS);
1275                         if (!context) {
1276                                 rc = -ENOMEM;
1277                                 dput(dentry);
1278                                 goto out_unlock;
1279                         }
1280                         context[len] = '\0';
1281                         rc = inode->i_op->getxattr(dentry,
1282                                                    XATTR_NAME_SELINUX,
1283                                                    context, len);
1284                 }
1285                 dput(dentry);
1286                 if (rc < 0) {
1287                         if (rc != -ENODATA) {
1288                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1289                                        "%d for dev=%s ino=%ld\n", __func__,
1290                                        -rc, inode->i_sb->s_id, inode->i_ino);
1291                                 kfree(context);
1292                                 goto out_unlock;
1293                         }
1294                         /* Map ENODATA to the default file SID */
1295                         sid = sbsec->def_sid;
1296                         rc = 0;
1297                 } else {
1298                         rc = security_context_to_sid_default(context, rc, &sid,
1299                                                              sbsec->def_sid,
1300                                                              GFP_NOFS);
1301                         if (rc) {
1302                                 char *dev = inode->i_sb->s_id;
1303                                 unsigned long ino = inode->i_ino;
1304
1305                                 if (rc == -EINVAL) {
1306                                         if (printk_ratelimit())
1307                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1308                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1309                                                         "filesystem in question.\n", ino, dev, context);
1310                                 } else {
1311                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1312                                                "returned %d for dev=%s ino=%ld\n",
1313                                                __func__, context, -rc, dev, ino);
1314                                 }
1315                                 kfree(context);
1316                                 /* Leave with the unlabeled SID */
1317                                 rc = 0;
1318                                 break;
1319                         }
1320                 }
1321                 kfree(context);
1322                 isec->sid = sid;
1323                 break;
1324         case SECURITY_FS_USE_TASK:
1325                 isec->sid = isec->task_sid;
1326                 break;
1327         case SECURITY_FS_USE_TRANS:
1328                 /* Default to the fs SID. */
1329                 isec->sid = sbsec->sid;
1330
1331                 /* Try to obtain a transition SID. */
1332                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1333                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1334                                              isec->sclass, NULL, &sid);
1335                 if (rc)
1336                         goto out_unlock;
1337                 isec->sid = sid;
1338                 break;
1339         case SECURITY_FS_USE_MNTPOINT:
1340                 isec->sid = sbsec->mntpoint_sid;
1341                 break;
1342         default:
1343                 /* Default to the fs superblock SID. */
1344                 isec->sid = sbsec->sid;
1345
1346                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1347                         if (opt_dentry) {
1348                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1349                                 rc = selinux_proc_get_sid(opt_dentry,
1350                                                           isec->sclass,
1351                                                           &sid);
1352                                 if (rc)
1353                                         goto out_unlock;
1354                                 isec->sid = sid;
1355                         }
1356                 }
1357                 break;
1358         }
1359
1360         isec->initialized = 1;
1361
1362 out_unlock:
1363         mutex_unlock(&isec->lock);
1364 out:
1365         if (isec->sclass == SECCLASS_FILE)
1366                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1367         return rc;
1368 }
1369
1370 /* Convert a Linux signal to an access vector. */
1371 static inline u32 signal_to_av(int sig)
1372 {
1373         u32 perm = 0;
1374
1375         switch (sig) {
1376         case SIGCHLD:
1377                 /* Commonly granted from child to parent. */
1378                 perm = PROCESS__SIGCHLD;
1379                 break;
1380         case SIGKILL:
1381                 /* Cannot be caught or ignored */
1382                 perm = PROCESS__SIGKILL;
1383                 break;
1384         case SIGSTOP:
1385                 /* Cannot be caught or ignored */
1386                 perm = PROCESS__SIGSTOP;
1387                 break;
1388         default:
1389                 /* All other signals. */
1390                 perm = PROCESS__SIGNAL;
1391                 break;
1392         }
1393
1394         return perm;
1395 }
1396
1397 /*
1398  * Check permission between a pair of credentials
1399  * fork check, ptrace check, etc.
1400  */
1401 static int cred_has_perm(const struct cred *actor,
1402                          const struct cred *target,
1403                          u32 perms)
1404 {
1405         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1406
1407         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1408 }
1409
1410 /*
1411  * Check permission between a pair of tasks, e.g. signal checks,
1412  * fork check, ptrace check, etc.
1413  * tsk1 is the actor and tsk2 is the target
1414  * - this uses the default subjective creds of tsk1
1415  */
1416 static int task_has_perm(const struct task_struct *tsk1,
1417                          const struct task_struct *tsk2,
1418                          u32 perms)
1419 {
1420         const struct task_security_struct *__tsec1, *__tsec2;
1421         u32 sid1, sid2;
1422
1423         rcu_read_lock();
1424         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1425         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1426         rcu_read_unlock();
1427         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1428 }
1429
1430 /*
1431  * Check permission between current and another task, e.g. signal checks,
1432  * fork check, ptrace check, etc.
1433  * current is the actor and tsk2 is the target
1434  * - this uses current's subjective creds
1435  */
1436 static int current_has_perm(const struct task_struct *tsk,
1437                             u32 perms)
1438 {
1439         u32 sid, tsid;
1440
1441         sid = current_sid();
1442         tsid = task_sid(tsk);
1443         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1444 }
1445
1446 #if CAP_LAST_CAP > 63
1447 #error Fix SELinux to handle capabilities > 63.
1448 #endif
1449
1450 /* Check whether a task is allowed to use a capability. */
1451 static int cred_has_capability(const struct cred *cred,
1452                                int cap, int audit)
1453 {
1454         struct common_audit_data ad;
1455         struct av_decision avd;
1456         u16 sclass;
1457         u32 sid = cred_sid(cred);
1458         u32 av = CAP_TO_MASK(cap);
1459         int rc;
1460
1461         ad.type = LSM_AUDIT_DATA_CAP;
1462         ad.u.cap = cap;
1463
1464         switch (CAP_TO_INDEX(cap)) {
1465         case 0:
1466                 sclass = SECCLASS_CAPABILITY;
1467                 break;
1468         case 1:
1469                 sclass = SECCLASS_CAPABILITY2;
1470                 break;
1471         default:
1472                 printk(KERN_ERR
1473                        "SELinux:  out of range capability %d\n", cap);
1474                 BUG();
1475                 return -EINVAL;
1476         }
1477
1478         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1479         if (audit == SECURITY_CAP_AUDIT) {
1480                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1481                 if (rc2)
1482                         return rc2;
1483         }
1484         return rc;
1485 }
1486
1487 /* Check whether a task is allowed to use a system operation. */
1488 static int task_has_system(struct task_struct *tsk,
1489                            u32 perms)
1490 {
1491         u32 sid = task_sid(tsk);
1492
1493         return avc_has_perm(sid, SECINITSID_KERNEL,
1494                             SECCLASS_SYSTEM, perms, NULL);
1495 }
1496
1497 /* Check whether a task has a particular permission to an inode.
1498    The 'adp' parameter is optional and allows other audit
1499    data to be passed (e.g. the dentry). */
1500 static int inode_has_perm(const struct cred *cred,
1501                           struct inode *inode,
1502                           u32 perms,
1503                           struct common_audit_data *adp,
1504                           unsigned flags)
1505 {
1506         struct inode_security_struct *isec;
1507         u32 sid;
1508
1509         validate_creds(cred);
1510
1511         if (unlikely(IS_PRIVATE(inode)))
1512                 return 0;
1513
1514         sid = cred_sid(cred);
1515         isec = inode->i_security;
1516
1517         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1518 }
1519
1520 /* Same as inode_has_perm, but pass explicit audit data containing
1521    the dentry to help the auditing code to more easily generate the
1522    pathname if needed. */
1523 static inline int dentry_has_perm(const struct cred *cred,
1524                                   struct dentry *dentry,
1525                                   u32 av)
1526 {
1527         struct inode *inode = dentry->d_inode;
1528         struct common_audit_data ad;
1529
1530         ad.type = LSM_AUDIT_DATA_DENTRY;
1531         ad.u.dentry = dentry;
1532         return inode_has_perm(cred, inode, av, &ad, 0);
1533 }
1534
1535 /* Same as inode_has_perm, but pass explicit audit data containing
1536    the path to help the auditing code to more easily generate the
1537    pathname if needed. */
1538 static inline int path_has_perm(const struct cred *cred,
1539                                 struct path *path,
1540                                 u32 av)
1541 {
1542         struct inode *inode = path->dentry->d_inode;
1543         struct common_audit_data ad;
1544
1545         ad.type = LSM_AUDIT_DATA_PATH;
1546         ad.u.path = *path;
1547         return inode_has_perm(cred, inode, av, &ad, 0);
1548 }
1549
1550 /* Same as path_has_perm, but uses the inode from the file struct. */
1551 static inline int file_path_has_perm(const struct cred *cred,
1552                                      struct file *file,
1553                                      u32 av)
1554 {
1555         struct common_audit_data ad;
1556
1557         ad.type = LSM_AUDIT_DATA_PATH;
1558         ad.u.path = file->f_path;
1559         return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1560 }
1561
1562 /* Check whether a task can use an open file descriptor to
1563    access an inode in a given way.  Check access to the
1564    descriptor itself, and then use dentry_has_perm to
1565    check a particular permission to the file.
1566    Access to the descriptor is implicitly granted if it
1567    has the same SID as the process.  If av is zero, then
1568    access to the file is not checked, e.g. for cases
1569    where only the descriptor is affected like seek. */
1570 static int file_has_perm(const struct cred *cred,
1571                          struct file *file,
1572                          u32 av)
1573 {
1574         struct file_security_struct *fsec = file->f_security;
1575         struct inode *inode = file_inode(file);
1576         struct common_audit_data ad;
1577         u32 sid = cred_sid(cred);
1578         int rc;
1579
1580         ad.type = LSM_AUDIT_DATA_PATH;
1581         ad.u.path = file->f_path;
1582
1583         if (sid != fsec->sid) {
1584                 rc = avc_has_perm(sid, fsec->sid,
1585                                   SECCLASS_FD,
1586                                   FD__USE,
1587                                   &ad);
1588                 if (rc)
1589                         goto out;
1590         }
1591
1592         /* av is zero if only checking access to the descriptor. */
1593         rc = 0;
1594         if (av)
1595                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1596
1597 out:
1598         return rc;
1599 }
1600
1601 /* Check whether a task can create a file. */
1602 static int may_create(struct inode *dir,
1603                       struct dentry *dentry,
1604                       u16 tclass)
1605 {
1606         const struct task_security_struct *tsec = current_security();
1607         struct inode_security_struct *dsec;
1608         struct superblock_security_struct *sbsec;
1609         u32 sid, newsid;
1610         struct common_audit_data ad;
1611         int rc;
1612
1613         dsec = dir->i_security;
1614         sbsec = dir->i_sb->s_security;
1615
1616         sid = tsec->sid;
1617         newsid = tsec->create_sid;
1618
1619         ad.type = LSM_AUDIT_DATA_DENTRY;
1620         ad.u.dentry = dentry;
1621
1622         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1623                           DIR__ADD_NAME | DIR__SEARCH,
1624                           &ad);
1625         if (rc)
1626                 return rc;
1627
1628         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1629                 rc = security_transition_sid(sid, dsec->sid, tclass,
1630                                              &dentry->d_name, &newsid);
1631                 if (rc)
1632                         return rc;
1633         }
1634
1635         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1636         if (rc)
1637                 return rc;
1638
1639         return avc_has_perm(newsid, sbsec->sid,
1640                             SECCLASS_FILESYSTEM,
1641                             FILESYSTEM__ASSOCIATE, &ad);
1642 }
1643
1644 /* Check whether a task can create a key. */
1645 static int may_create_key(u32 ksid,
1646                           struct task_struct *ctx)
1647 {
1648         u32 sid = task_sid(ctx);
1649
1650         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1651 }
1652
1653 #define MAY_LINK        0
1654 #define MAY_UNLINK      1
1655 #define MAY_RMDIR       2
1656
1657 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1658 static int may_link(struct inode *dir,
1659                     struct dentry *dentry,
1660                     int kind)
1661
1662 {
1663         struct inode_security_struct *dsec, *isec;
1664         struct common_audit_data ad;
1665         u32 sid = current_sid();
1666         u32 av;
1667         int rc;
1668
1669         dsec = dir->i_security;
1670         isec = dentry->d_inode->i_security;
1671
1672         ad.type = LSM_AUDIT_DATA_DENTRY;
1673         ad.u.dentry = dentry;
1674
1675         av = DIR__SEARCH;
1676         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1677         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1678         if (rc)
1679                 return rc;
1680
1681         switch (kind) {
1682         case MAY_LINK:
1683                 av = FILE__LINK;
1684                 break;
1685         case MAY_UNLINK:
1686                 av = FILE__UNLINK;
1687                 break;
1688         case MAY_RMDIR:
1689                 av = DIR__RMDIR;
1690                 break;
1691         default:
1692                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1693                         __func__, kind);
1694                 return 0;
1695         }
1696
1697         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1698         return rc;
1699 }
1700
1701 static inline int may_rename(struct inode *old_dir,
1702                              struct dentry *old_dentry,
1703                              struct inode *new_dir,
1704                              struct dentry *new_dentry)
1705 {
1706         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1707         struct common_audit_data ad;
1708         u32 sid = current_sid();
1709         u32 av;
1710         int old_is_dir, new_is_dir;
1711         int rc;
1712
1713         old_dsec = old_dir->i_security;
1714         old_isec = old_dentry->d_inode->i_security;
1715         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1716         new_dsec = new_dir->i_security;
1717
1718         ad.type = LSM_AUDIT_DATA_DENTRY;
1719
1720         ad.u.dentry = old_dentry;
1721         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1722                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1723         if (rc)
1724                 return rc;
1725         rc = avc_has_perm(sid, old_isec->sid,
1726                           old_isec->sclass, FILE__RENAME, &ad);
1727         if (rc)
1728                 return rc;
1729         if (old_is_dir && new_dir != old_dir) {
1730                 rc = avc_has_perm(sid, old_isec->sid,
1731                                   old_isec->sclass, DIR__REPARENT, &ad);
1732                 if (rc)
1733                         return rc;
1734         }
1735
1736         ad.u.dentry = new_dentry;
1737         av = DIR__ADD_NAME | DIR__SEARCH;
1738         if (new_dentry->d_inode)
1739                 av |= DIR__REMOVE_NAME;
1740         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1741         if (rc)
1742                 return rc;
1743         if (new_dentry->d_inode) {
1744                 new_isec = new_dentry->d_inode->i_security;
1745                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1746                 rc = avc_has_perm(sid, new_isec->sid,
1747                                   new_isec->sclass,
1748                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1749                 if (rc)
1750                         return rc;
1751         }
1752
1753         return 0;
1754 }
1755
1756 /* Check whether a task can perform a filesystem operation. */
1757 static int superblock_has_perm(const struct cred *cred,
1758                                struct super_block *sb,
1759                                u32 perms,
1760                                struct common_audit_data *ad)
1761 {
1762         struct superblock_security_struct *sbsec;
1763         u32 sid = cred_sid(cred);
1764
1765         sbsec = sb->s_security;
1766         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1767 }
1768
1769 /* Convert a Linux mode and permission mask to an access vector. */
1770 static inline u32 file_mask_to_av(int mode, int mask)
1771 {
1772         u32 av = 0;
1773
1774         if (!S_ISDIR(mode)) {
1775                 if (mask & MAY_EXEC)
1776                         av |= FILE__EXECUTE;
1777                 if (mask & MAY_READ)
1778                         av |= FILE__READ;
1779
1780                 if (mask & MAY_APPEND)
1781                         av |= FILE__APPEND;
1782                 else if (mask & MAY_WRITE)
1783                         av |= FILE__WRITE;
1784
1785         } else {
1786                 if (mask & MAY_EXEC)
1787                         av |= DIR__SEARCH;
1788                 if (mask & MAY_WRITE)
1789                         av |= DIR__WRITE;
1790                 if (mask & MAY_READ)
1791                         av |= DIR__READ;
1792         }
1793
1794         return av;
1795 }
1796
1797 /* Convert a Linux file to an access vector. */
1798 static inline u32 file_to_av(struct file *file)
1799 {
1800         u32 av = 0;
1801
1802         if (file->f_mode & FMODE_READ)
1803                 av |= FILE__READ;
1804         if (file->f_mode & FMODE_WRITE) {
1805                 if (file->f_flags & O_APPEND)
1806                         av |= FILE__APPEND;
1807                 else
1808                         av |= FILE__WRITE;
1809         }
1810         if (!av) {
1811                 /*
1812                  * Special file opened with flags 3 for ioctl-only use.
1813                  */
1814                 av = FILE__IOCTL;
1815         }
1816
1817         return av;
1818 }
1819
1820 /*
1821  * Convert a file to an access vector and include the correct open
1822  * open permission.
1823  */
1824 static inline u32 open_file_to_av(struct file *file)
1825 {
1826         u32 av = file_to_av(file);
1827
1828         if (selinux_policycap_openperm)
1829                 av |= FILE__OPEN;
1830
1831         return av;
1832 }
1833
1834 /* Hook functions begin here. */
1835
1836 static int selinux_ptrace_access_check(struct task_struct *child,
1837                                      unsigned int mode)
1838 {
1839         int rc;
1840
1841         rc = cap_ptrace_access_check(child, mode);
1842         if (rc)
1843                 return rc;
1844
1845         if (mode & PTRACE_MODE_READ) {
1846                 u32 sid = current_sid();
1847                 u32 csid = task_sid(child);
1848                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1849         }
1850
1851         return current_has_perm(child, PROCESS__PTRACE);
1852 }
1853
1854 static int selinux_ptrace_traceme(struct task_struct *parent)
1855 {
1856         int rc;
1857
1858         rc = cap_ptrace_traceme(parent);
1859         if (rc)
1860                 return rc;
1861
1862         return task_has_perm(parent, current, PROCESS__PTRACE);
1863 }
1864
1865 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1866                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1867 {
1868         int error;
1869
1870         error = current_has_perm(target, PROCESS__GETCAP);
1871         if (error)
1872                 return error;
1873
1874         return cap_capget(target, effective, inheritable, permitted);
1875 }
1876
1877 static int selinux_capset(struct cred *new, const struct cred *old,
1878                           const kernel_cap_t *effective,
1879                           const kernel_cap_t *inheritable,
1880                           const kernel_cap_t *permitted)
1881 {
1882         int error;
1883
1884         error = cap_capset(new, old,
1885                                       effective, inheritable, permitted);
1886         if (error)
1887                 return error;
1888
1889         return cred_has_perm(old, new, PROCESS__SETCAP);
1890 }
1891
1892 /*
1893  * (This comment used to live with the selinux_task_setuid hook,
1894  * which was removed).
1895  *
1896  * Since setuid only affects the current process, and since the SELinux
1897  * controls are not based on the Linux identity attributes, SELinux does not
1898  * need to control this operation.  However, SELinux does control the use of
1899  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1900  */
1901
1902 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1903                            int cap, int audit)
1904 {
1905         int rc;
1906
1907         rc = cap_capable(cred, ns, cap, audit);
1908         if (rc)
1909                 return rc;
1910
1911         return cred_has_capability(cred, cap, audit);
1912 }
1913
1914 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1915 {
1916         const struct cred *cred = current_cred();
1917         int rc = 0;
1918
1919         if (!sb)
1920                 return 0;
1921
1922         switch (cmds) {
1923         case Q_SYNC:
1924         case Q_QUOTAON:
1925         case Q_QUOTAOFF:
1926         case Q_SETINFO:
1927         case Q_SETQUOTA:
1928                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1929                 break;
1930         case Q_GETFMT:
1931         case Q_GETINFO:
1932         case Q_GETQUOTA:
1933                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1934                 break;
1935         default:
1936                 rc = 0;  /* let the kernel handle invalid cmds */
1937                 break;
1938         }
1939         return rc;
1940 }
1941
1942 static int selinux_quota_on(struct dentry *dentry)
1943 {
1944         const struct cred *cred = current_cred();
1945
1946         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1947 }
1948
1949 static int selinux_syslog(int type)
1950 {
1951         int rc;
1952
1953         switch (type) {
1954         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1955         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1956                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1957                 break;
1958         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1959         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1960         /* Set level of messages printed to console */
1961         case SYSLOG_ACTION_CONSOLE_LEVEL:
1962                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1963                 break;
1964         case SYSLOG_ACTION_CLOSE:       /* Close log */
1965         case SYSLOG_ACTION_OPEN:        /* Open log */
1966         case SYSLOG_ACTION_READ:        /* Read from log */
1967         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1968         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1969         default:
1970                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1971                 break;
1972         }
1973         return rc;
1974 }
1975
1976 /*
1977  * Check that a process has enough memory to allocate a new virtual
1978  * mapping. 0 means there is enough memory for the allocation to
1979  * succeed and -ENOMEM implies there is not.
1980  *
1981  * Do not audit the selinux permission check, as this is applied to all
1982  * processes that allocate mappings.
1983  */
1984 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1985 {
1986         int rc, cap_sys_admin = 0;
1987
1988         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1989                              SECURITY_CAP_NOAUDIT);
1990         if (rc == 0)
1991                 cap_sys_admin = 1;
1992
1993         return __vm_enough_memory(mm, pages, cap_sys_admin);
1994 }
1995
1996 /* binprm security operations */
1997
1998 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1999 {
2000         const struct task_security_struct *old_tsec;
2001         struct task_security_struct *new_tsec;
2002         struct inode_security_struct *isec;
2003         struct common_audit_data ad;
2004         struct inode *inode = file_inode(bprm->file);
2005         int rc;
2006
2007         rc = cap_bprm_set_creds(bprm);
2008         if (rc)
2009                 return rc;
2010
2011         /* SELinux context only depends on initial program or script and not
2012          * the script interpreter */
2013         if (bprm->cred_prepared)
2014                 return 0;
2015
2016         old_tsec = current_security();
2017         new_tsec = bprm->cred->security;
2018         isec = inode->i_security;
2019
2020         /* Default to the current task SID. */
2021         new_tsec->sid = old_tsec->sid;
2022         new_tsec->osid = old_tsec->sid;
2023
2024         /* Reset fs, key, and sock SIDs on execve. */
2025         new_tsec->create_sid = 0;
2026         new_tsec->keycreate_sid = 0;
2027         new_tsec->sockcreate_sid = 0;
2028
2029         if (old_tsec->exec_sid) {
2030                 new_tsec->sid = old_tsec->exec_sid;
2031                 /* Reset exec SID on execve. */
2032                 new_tsec->exec_sid = 0;
2033
2034                 /*
2035                  * Minimize confusion: if no_new_privs and a transition is
2036                  * explicitly requested, then fail the exec.
2037                  */
2038                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2039                         return -EPERM;
2040         } else {
2041                 /* Check for a default transition on this program. */
2042                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2043                                              SECCLASS_PROCESS, NULL,
2044                                              &new_tsec->sid);
2045                 if (rc)
2046                         return rc;
2047         }
2048
2049         ad.type = LSM_AUDIT_DATA_PATH;
2050         ad.u.path = bprm->file->f_path;
2051
2052         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2053             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2054                 new_tsec->sid = old_tsec->sid;
2055
2056         if (new_tsec->sid == old_tsec->sid) {
2057                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2058                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2059                 if (rc)
2060                         return rc;
2061         } else {
2062                 /* Check permissions for the transition. */
2063                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2064                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2065                 if (rc)
2066                         return rc;
2067
2068                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2069                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2070                 if (rc)
2071                         return rc;
2072
2073                 /* Check for shared state */
2074                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2075                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2076                                           SECCLASS_PROCESS, PROCESS__SHARE,
2077                                           NULL);
2078                         if (rc)
2079                                 return -EPERM;
2080                 }
2081
2082                 /* Make sure that anyone attempting to ptrace over a task that
2083                  * changes its SID has the appropriate permit */
2084                 if (bprm->unsafe &
2085                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2086                         struct task_struct *tracer;
2087                         struct task_security_struct *sec;
2088                         u32 ptsid = 0;
2089
2090                         rcu_read_lock();
2091                         tracer = ptrace_parent(current);
2092                         if (likely(tracer != NULL)) {
2093                                 sec = __task_cred(tracer)->security;
2094                                 ptsid = sec->sid;
2095                         }
2096                         rcu_read_unlock();
2097
2098                         if (ptsid != 0) {
2099                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2100                                                   SECCLASS_PROCESS,
2101                                                   PROCESS__PTRACE, NULL);
2102                                 if (rc)
2103                                         return -EPERM;
2104                         }
2105                 }
2106
2107                 /* Clear any possibly unsafe personality bits on exec: */
2108                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2109         }
2110
2111         return 0;
2112 }
2113
2114 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2115 {
2116         const struct task_security_struct *tsec = current_security();
2117         u32 sid, osid;
2118         int atsecure = 0;
2119
2120         sid = tsec->sid;
2121         osid = tsec->osid;
2122
2123         if (osid != sid) {
2124                 /* Enable secure mode for SIDs transitions unless
2125                    the noatsecure permission is granted between
2126                    the two SIDs, i.e. ahp returns 0. */
2127                 atsecure = avc_has_perm(osid, sid,
2128                                         SECCLASS_PROCESS,
2129                                         PROCESS__NOATSECURE, NULL);
2130         }
2131
2132         return (atsecure || cap_bprm_secureexec(bprm));
2133 }
2134
2135 static int match_file(const void *p, struct file *file, unsigned fd)
2136 {
2137         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2138 }
2139
2140 /* Derived from fs/exec.c:flush_old_files. */
2141 static inline void flush_unauthorized_files(const struct cred *cred,
2142                                             struct files_struct *files)
2143 {
2144         struct file *file, *devnull = NULL;
2145         struct tty_struct *tty;
2146         int drop_tty = 0;
2147         unsigned n;
2148
2149         tty = get_current_tty();
2150         if (tty) {
2151                 spin_lock(&tty_files_lock);
2152                 if (!list_empty(&tty->tty_files)) {
2153                         struct tty_file_private *file_priv;
2154
2155                         /* Revalidate access to controlling tty.
2156                            Use file_path_has_perm on the tty path directly
2157                            rather than using file_has_perm, as this particular
2158                            open file may belong to another process and we are
2159                            only interested in the inode-based check here. */
2160                         file_priv = list_first_entry(&tty->tty_files,
2161                                                 struct tty_file_private, list);
2162                         file = file_priv->file;
2163                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2164                                 drop_tty = 1;
2165                 }
2166                 spin_unlock(&tty_files_lock);
2167                 tty_kref_put(tty);
2168         }
2169         /* Reset controlling tty. */
2170         if (drop_tty)
2171                 no_tty();
2172
2173         /* Revalidate access to inherited open files. */
2174         n = iterate_fd(files, 0, match_file, cred);
2175         if (!n) /* none found? */
2176                 return;
2177
2178         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2179         if (IS_ERR(devnull))
2180                 devnull = NULL;
2181         /* replace all the matching ones with this */
2182         do {
2183                 replace_fd(n - 1, devnull, 0);
2184         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2185         if (devnull)
2186                 fput(devnull);
2187 }
2188
2189 /*
2190  * Prepare a process for imminent new credential changes due to exec
2191  */
2192 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2193 {
2194         struct task_security_struct *new_tsec;
2195         struct rlimit *rlim, *initrlim;
2196         int rc, i;
2197
2198         new_tsec = bprm->cred->security;
2199         if (new_tsec->sid == new_tsec->osid)
2200                 return;
2201
2202         /* Close files for which the new task SID is not authorized. */
2203         flush_unauthorized_files(bprm->cred, current->files);
2204
2205         /* Always clear parent death signal on SID transitions. */
2206         current->pdeath_signal = 0;
2207
2208         /* Check whether the new SID can inherit resource limits from the old
2209          * SID.  If not, reset all soft limits to the lower of the current
2210          * task's hard limit and the init task's soft limit.
2211          *
2212          * Note that the setting of hard limits (even to lower them) can be
2213          * controlled by the setrlimit check.  The inclusion of the init task's
2214          * soft limit into the computation is to avoid resetting soft limits
2215          * higher than the default soft limit for cases where the default is
2216          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2217          */
2218         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2219                           PROCESS__RLIMITINH, NULL);
2220         if (rc) {
2221                 /* protect against do_prlimit() */
2222                 task_lock(current);
2223                 for (i = 0; i < RLIM_NLIMITS; i++) {
2224                         rlim = current->signal->rlim + i;
2225                         initrlim = init_task.signal->rlim + i;
2226                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2227                 }
2228                 task_unlock(current);
2229                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2230         }
2231 }
2232
2233 /*
2234  * Clean up the process immediately after the installation of new credentials
2235  * due to exec
2236  */
2237 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2238 {
2239         const struct task_security_struct *tsec = current_security();
2240         struct itimerval itimer;
2241         u32 osid, sid;
2242         int rc, i;
2243
2244         osid = tsec->osid;
2245         sid = tsec->sid;
2246
2247         if (sid == osid)
2248                 return;
2249
2250         /* Check whether the new SID can inherit signal state from the old SID.
2251          * If not, clear itimers to avoid subsequent signal generation and
2252          * flush and unblock signals.
2253          *
2254          * This must occur _after_ the task SID has been updated so that any
2255          * kill done after the flush will be checked against the new SID.
2256          */
2257         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2258         if (rc) {
2259                 memset(&itimer, 0, sizeof itimer);
2260                 for (i = 0; i < 3; i++)
2261                         do_setitimer(i, &itimer, NULL);
2262                 spin_lock_irq(&current->sighand->siglock);
2263                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2264                         __flush_signals(current);
2265                         flush_signal_handlers(current, 1);
2266                         sigemptyset(&current->blocked);
2267                 }
2268                 spin_unlock_irq(&current->sighand->siglock);
2269         }
2270
2271         /* Wake up the parent if it is waiting so that it can recheck
2272          * wait permission to the new task SID. */
2273         read_lock(&tasklist_lock);
2274         __wake_up_parent(current, current->real_parent);
2275         read_unlock(&tasklist_lock);
2276 }
2277
2278 /* superblock security operations */
2279
2280 static int selinux_sb_alloc_security(struct super_block *sb)
2281 {
2282         return superblock_alloc_security(sb);
2283 }
2284
2285 static void selinux_sb_free_security(struct super_block *sb)
2286 {
2287         superblock_free_security(sb);
2288 }
2289
2290 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2291 {
2292         if (plen > olen)
2293                 return 0;
2294
2295         return !memcmp(prefix, option, plen);
2296 }
2297
2298 static inline int selinux_option(char *option, int len)
2299 {
2300         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2301                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2302                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2303                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2304                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2305 }
2306
2307 static inline void take_option(char **to, char *from, int *first, int len)
2308 {
2309         if (!*first) {
2310                 **to = ',';
2311                 *to += 1;
2312         } else
2313                 *first = 0;
2314         memcpy(*to, from, len);
2315         *to += len;
2316 }
2317
2318 static inline void take_selinux_option(char **to, char *from, int *first,
2319                                        int len)
2320 {
2321         int current_size = 0;
2322
2323         if (!*first) {
2324                 **to = '|';
2325                 *to += 1;
2326         } else
2327                 *first = 0;
2328
2329         while (current_size < len) {
2330                 if (*from != '"') {
2331                         **to = *from;
2332                         *to += 1;
2333                 }
2334                 from += 1;
2335                 current_size += 1;
2336         }
2337 }
2338
2339 static int selinux_sb_copy_data(char *orig, char *copy)
2340 {
2341         int fnosec, fsec, rc = 0;
2342         char *in_save, *in_curr, *in_end;
2343         char *sec_curr, *nosec_save, *nosec;
2344         int open_quote = 0;
2345
2346         in_curr = orig;
2347         sec_curr = copy;
2348
2349         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2350         if (!nosec) {
2351                 rc = -ENOMEM;
2352                 goto out;
2353         }
2354
2355         nosec_save = nosec;
2356         fnosec = fsec = 1;
2357         in_save = in_end = orig;
2358
2359         do {
2360                 if (*in_end == '"')
2361                         open_quote = !open_quote;
2362                 if ((*in_end == ',' && open_quote == 0) ||
2363                                 *in_end == '\0') {
2364                         int len = in_end - in_curr;
2365
2366                         if (selinux_option(in_curr, len))
2367                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2368                         else
2369                                 take_option(&nosec, in_curr, &fnosec, len);
2370
2371                         in_curr = in_end + 1;
2372                 }
2373         } while (*in_end++);
2374
2375         strcpy(in_save, nosec_save);
2376         free_page((unsigned long)nosec_save);
2377 out:
2378         return rc;
2379 }
2380
2381 static int selinux_sb_remount(struct super_block *sb, void *data)
2382 {
2383         int rc, i, *flags;
2384         struct security_mnt_opts opts;
2385         char *secdata, **mount_options;
2386         struct superblock_security_struct *sbsec = sb->s_security;
2387
2388         if (!(sbsec->flags & SE_SBINITIALIZED))
2389                 return 0;
2390
2391         if (!data)
2392                 return 0;
2393
2394         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2395                 return 0;
2396
2397         security_init_mnt_opts(&opts);
2398         secdata = alloc_secdata();
2399         if (!secdata)
2400                 return -ENOMEM;
2401         rc = selinux_sb_copy_data(data, secdata);
2402         if (rc)
2403                 goto out_free_secdata;
2404
2405         rc = selinux_parse_opts_str(secdata, &opts);
2406         if (rc)
2407                 goto out_free_secdata;
2408
2409         mount_options = opts.mnt_opts;
2410         flags = opts.mnt_opts_flags;
2411
2412         for (i = 0; i < opts.num_mnt_opts; i++) {
2413                 u32 sid;
2414                 size_t len;
2415
2416                 if (flags[i] == SE_SBLABELSUPP)
2417                         continue;
2418                 len = strlen(mount_options[i]);
2419                 rc = security_context_to_sid(mount_options[i], len, &sid);
2420                 if (rc) {
2421                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2422                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2423                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2424                         goto out_free_opts;
2425                 }
2426                 rc = -EINVAL;
2427                 switch (flags[i]) {
2428                 case FSCONTEXT_MNT:
2429                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2430                                 goto out_bad_option;
2431                         break;
2432                 case CONTEXT_MNT:
2433                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2434                                 goto out_bad_option;
2435                         break;
2436                 case ROOTCONTEXT_MNT: {
2437                         struct inode_security_struct *root_isec;
2438                         root_isec = sb->s_root->d_inode->i_security;
2439
2440                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2441                                 goto out_bad_option;
2442                         break;
2443                 }
2444                 case DEFCONTEXT_MNT:
2445                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2446                                 goto out_bad_option;
2447                         break;
2448                 default:
2449                         goto out_free_opts;
2450                 }
2451         }
2452
2453         rc = 0;
2454 out_free_opts:
2455         security_free_mnt_opts(&opts);
2456 out_free_secdata:
2457         free_secdata(secdata);
2458         return rc;
2459 out_bad_option:
2460         printk(KERN_WARNING "SELinux: unable to change security options "
2461                "during remount (dev %s, type=%s)\n", sb->s_id,
2462                sb->s_type->name);
2463         goto out_free_opts;
2464 }
2465
2466 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2467 {
2468         const struct cred *cred = current_cred();
2469         struct common_audit_data ad;
2470         int rc;
2471
2472         rc = superblock_doinit(sb, data);
2473         if (rc)
2474                 return rc;
2475
2476         /* Allow all mounts performed by the kernel */
2477         if (flags & MS_KERNMOUNT)
2478                 return 0;
2479
2480         ad.type = LSM_AUDIT_DATA_DENTRY;
2481         ad.u.dentry = sb->s_root;
2482         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2483 }
2484
2485 static int selinux_sb_statfs(struct dentry *dentry)
2486 {
2487         const struct cred *cred = current_cred();
2488         struct common_audit_data ad;
2489
2490         ad.type = LSM_AUDIT_DATA_DENTRY;
2491         ad.u.dentry = dentry->d_sb->s_root;
2492         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2493 }
2494
2495 static int selinux_mount(const char *dev_name,
2496                          struct path *path,
2497                          const char *type,
2498                          unsigned long flags,
2499                          void *data)
2500 {
2501         const struct cred *cred = current_cred();
2502
2503         if (flags & MS_REMOUNT)
2504                 return superblock_has_perm(cred, path->dentry->d_sb,
2505                                            FILESYSTEM__REMOUNT, NULL);
2506         else
2507                 return path_has_perm(cred, path, FILE__MOUNTON);
2508 }
2509
2510 static int selinux_umount(struct vfsmount *mnt, int flags)
2511 {
2512         const struct cred *cred = current_cred();
2513
2514         return superblock_has_perm(cred, mnt->mnt_sb,
2515                                    FILESYSTEM__UNMOUNT, NULL);
2516 }
2517
2518 /* inode security operations */
2519
2520 static int selinux_inode_alloc_security(struct inode *inode)
2521 {
2522         return inode_alloc_security(inode);
2523 }
2524
2525 static void selinux_inode_free_security(struct inode *inode)
2526 {
2527         inode_free_security(inode);
2528 }
2529
2530 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2531                                        const struct qstr *qstr, char **name,
2532                                        void **value, size_t *len)
2533 {
2534         const struct task_security_struct *tsec = current_security();
2535         struct inode_security_struct *dsec;
2536         struct superblock_security_struct *sbsec;
2537         u32 sid, newsid, clen;
2538         int rc;
2539         char *namep = NULL, *context;
2540
2541         dsec = dir->i_security;
2542         sbsec = dir->i_sb->s_security;
2543
2544         sid = tsec->sid;
2545         newsid = tsec->create_sid;
2546
2547         if ((sbsec->flags & SE_SBINITIALIZED) &&
2548             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2549                 newsid = sbsec->mntpoint_sid;
2550         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2551                 rc = security_transition_sid(sid, dsec->sid,
2552                                              inode_mode_to_security_class(inode->i_mode),
2553                                              qstr, &newsid);
2554                 if (rc) {
2555                         printk(KERN_WARNING "%s:  "
2556                                "security_transition_sid failed, rc=%d (dev=%s "
2557                                "ino=%ld)\n",
2558                                __func__,
2559                                -rc, inode->i_sb->s_id, inode->i_ino);
2560                         return rc;
2561                 }
2562         }
2563
2564         /* Possibly defer initialization to selinux_complete_init. */
2565         if (sbsec->flags & SE_SBINITIALIZED) {
2566                 struct inode_security_struct *isec = inode->i_security;
2567                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2568                 isec->sid = newsid;
2569                 isec->initialized = 1;
2570         }
2571
2572         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2573                 return -EOPNOTSUPP;
2574
2575         if (name) {
2576                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2577                 if (!namep)
2578                         return -ENOMEM;
2579                 *name = namep;
2580         }
2581
2582         if (value && len) {
2583                 rc = security_sid_to_context_force(newsid, &context, &clen);
2584                 if (rc) {
2585                         kfree(namep);
2586                         return rc;
2587                 }
2588                 *value = context;
2589                 *len = clen;
2590         }
2591
2592         return 0;
2593 }
2594
2595 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2596 {
2597         return may_create(dir, dentry, SECCLASS_FILE);
2598 }
2599
2600 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2601 {
2602         return may_link(dir, old_dentry, MAY_LINK);
2603 }
2604
2605 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2606 {
2607         return may_link(dir, dentry, MAY_UNLINK);
2608 }
2609
2610 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2611 {
2612         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2613 }
2614
2615 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2616 {
2617         return may_create(dir, dentry, SECCLASS_DIR);
2618 }
2619
2620 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2621 {
2622         return may_link(dir, dentry, MAY_RMDIR);
2623 }
2624
2625 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2626 {
2627         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2628 }
2629
2630 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2631                                 struct inode *new_inode, struct dentry *new_dentry)
2632 {
2633         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2634 }
2635
2636 static int selinux_inode_readlink(struct dentry *dentry)
2637 {
2638         const struct cred *cred = current_cred();
2639
2640         return dentry_has_perm(cred, dentry, FILE__READ);
2641 }
2642
2643 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2644 {
2645         const struct cred *cred = current_cred();
2646
2647         return dentry_has_perm(cred, dentry, FILE__READ);
2648 }
2649
2650 static noinline int audit_inode_permission(struct inode *inode,
2651                                            u32 perms, u32 audited, u32 denied,
2652                                            unsigned flags)
2653 {
2654         struct common_audit_data ad;
2655         struct inode_security_struct *isec = inode->i_security;
2656         int rc;
2657
2658         ad.type = LSM_AUDIT_DATA_INODE;
2659         ad.u.inode = inode;
2660
2661         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2662                             audited, denied, &ad, flags);
2663         if (rc)
2664                 return rc;
2665         return 0;
2666 }
2667
2668 static int selinux_inode_permission(struct inode *inode, int mask)
2669 {
2670         const struct cred *cred = current_cred();
2671         u32 perms;
2672         bool from_access;
2673         unsigned flags = mask & MAY_NOT_BLOCK;
2674         struct inode_security_struct *isec;
2675         u32 sid;
2676         struct av_decision avd;
2677         int rc, rc2;
2678         u32 audited, denied;
2679
2680         from_access = mask & MAY_ACCESS;
2681         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2682
2683         /* No permission to check.  Existence test. */
2684         if (!mask)
2685                 return 0;
2686
2687         validate_creds(cred);
2688
2689         if (unlikely(IS_PRIVATE(inode)))
2690                 return 0;
2691
2692         perms = file_mask_to_av(inode->i_mode, mask);
2693
2694         sid = cred_sid(cred);
2695         isec = inode->i_security;
2696
2697         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2698         audited = avc_audit_required(perms, &avd, rc,
2699                                      from_access ? FILE__AUDIT_ACCESS : 0,
2700                                      &denied);
2701         if (likely(!audited))
2702                 return rc;
2703
2704         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2705         if (rc2)
2706                 return rc2;
2707         return rc;
2708 }
2709
2710 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2711 {
2712         const struct cred *cred = current_cred();
2713         unsigned int ia_valid = iattr->ia_valid;
2714         __u32 av = FILE__WRITE;
2715
2716         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2717         if (ia_valid & ATTR_FORCE) {
2718                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2719                               ATTR_FORCE);
2720                 if (!ia_valid)
2721                         return 0;
2722         }
2723
2724         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2725                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2726                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2727
2728         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2729                 av |= FILE__OPEN;
2730
2731         return dentry_has_perm(cred, dentry, av);
2732 }
2733
2734 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2735 {
2736         const struct cred *cred = current_cred();
2737         struct path path;
2738
2739         path.dentry = dentry;
2740         path.mnt = mnt;
2741
2742         return path_has_perm(cred, &path, FILE__GETATTR);
2743 }
2744
2745 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2746 {
2747         const struct cred *cred = current_cred();
2748
2749         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2750                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2751                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2752                         if (!capable(CAP_SETFCAP))
2753                                 return -EPERM;
2754                 } else if (!capable(CAP_SYS_ADMIN)) {
2755                         /* A different attribute in the security namespace.
2756                            Restrict to administrator. */
2757                         return -EPERM;
2758                 }
2759         }
2760
2761         /* Not an attribute we recognize, so just check the
2762            ordinary setattr permission. */
2763         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2764 }
2765
2766 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2767                                   const void *value, size_t size, int flags)
2768 {
2769         struct inode *inode = dentry->d_inode;
2770         struct inode_security_struct *isec = inode->i_security;
2771         struct superblock_security_struct *sbsec;
2772         struct common_audit_data ad;
2773         u32 newsid, sid = current_sid();
2774         int rc = 0;
2775
2776         if (strcmp(name, XATTR_NAME_SELINUX))
2777                 return selinux_inode_setotherxattr(dentry, name);
2778
2779         sbsec = inode->i_sb->s_security;
2780         if (!(sbsec->flags & SE_SBLABELSUPP))
2781                 return -EOPNOTSUPP;
2782
2783         if (!inode_owner_or_capable(inode))
2784                 return -EPERM;
2785
2786         ad.type = LSM_AUDIT_DATA_DENTRY;
2787         ad.u.dentry = dentry;
2788
2789         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2790                           FILE__RELABELFROM, &ad);
2791         if (rc)
2792                 return rc;
2793
2794         rc = security_context_to_sid(value, size, &newsid);
2795         if (rc == -EINVAL) {
2796                 if (!capable(CAP_MAC_ADMIN)) {
2797                         struct audit_buffer *ab;
2798                         size_t audit_size;
2799                         const char *str;
2800
2801                         /* We strip a nul only if it is at the end, otherwise the
2802                          * context contains a nul and we should audit that */
2803                         if (value) {
2804                                 str = value;
2805                                 if (str[size - 1] == '\0')
2806                                         audit_size = size - 1;
2807                                 else
2808                                         audit_size = size;
2809                         } else {
2810                                 str = "";
2811                                 audit_size = 0;
2812                         }
2813                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2814                         audit_log_format(ab, "op=setxattr invalid_context=");
2815                         audit_log_n_untrustedstring(ab, value, audit_size);
2816                         audit_log_end(ab);
2817
2818                         return rc;
2819                 }
2820                 rc = security_context_to_sid_force(value, size, &newsid);
2821         }
2822         if (rc)
2823                 return rc;
2824
2825         rc = avc_has_perm(sid, newsid, isec->sclass,
2826                           FILE__RELABELTO, &ad);
2827         if (rc)
2828                 return rc;
2829
2830         rc = security_validate_transition(isec->sid, newsid, sid,
2831                                           isec->sclass);
2832         if (rc)
2833                 return rc;
2834
2835         return avc_has_perm(newsid,
2836                             sbsec->sid,
2837                             SECCLASS_FILESYSTEM,
2838                             FILESYSTEM__ASSOCIATE,
2839                             &ad);
2840 }
2841
2842 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2843                                         const void *value, size_t size,
2844                                         int flags)
2845 {
2846         struct inode *inode = dentry->d_inode;
2847         struct inode_security_struct *isec = inode->i_security;
2848         u32 newsid;
2849         int rc;
2850
2851         if (strcmp(name, XATTR_NAME_SELINUX)) {
2852                 /* Not an attribute we recognize, so nothing to do. */
2853                 return;
2854         }
2855
2856         rc = security_context_to_sid_force(value, size, &newsid);
2857         if (rc) {
2858                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2859                        "for (%s, %lu), rc=%d\n",
2860                        inode->i_sb->s_id, inode->i_ino, -rc);
2861                 return;
2862         }
2863
2864         isec->sid = newsid;
2865         return;
2866 }
2867
2868 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2869 {
2870         const struct cred *cred = current_cred();
2871
2872         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2873 }
2874
2875 static int selinux_inode_listxattr(struct dentry *dentry)
2876 {
2877         const struct cred *cred = current_cred();
2878
2879         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2880 }
2881
2882 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2883 {
2884         if (strcmp(name, XATTR_NAME_SELINUX))
2885                 return selinux_inode_setotherxattr(dentry, name);
2886
2887         /* No one is allowed to remove a SELinux security label.
2888            You can change the label, but all data must be labeled. */
2889         return -EACCES;
2890 }
2891
2892 /*
2893  * Copy the inode security context value to the user.
2894  *
2895  * Permission check is handled by selinux_inode_getxattr hook.
2896  */
2897 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2898 {
2899         u32 size;
2900         int error;
2901         char *context = NULL;
2902         struct inode_security_struct *isec = inode->i_security;
2903
2904         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2905                 return -EOPNOTSUPP;
2906
2907         /*
2908          * If the caller has CAP_MAC_ADMIN, then get the raw context
2909          * value even if it is not defined by current policy; otherwise,
2910          * use the in-core value under current policy.
2911          * Use the non-auditing forms of the permission checks since
2912          * getxattr may be called by unprivileged processes commonly
2913          * and lack of permission just means that we fall back to the
2914          * in-core context value, not a denial.
2915          */
2916         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2917                                 SECURITY_CAP_NOAUDIT);
2918         if (!error)
2919                 error = security_sid_to_context_force(isec->sid, &context,
2920                                                       &size);
2921         else
2922                 error = security_sid_to_context(isec->sid, &context, &size);
2923         if (error)
2924                 return error;
2925         error = size;
2926         if (alloc) {
2927                 *buffer = context;
2928                 goto out_nofree;
2929         }
2930         kfree(context);
2931 out_nofree:
2932         return error;
2933 }
2934
2935 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2936                                      const void *value, size_t size, int flags)
2937 {
2938         struct inode_security_struct *isec = inode->i_security;
2939         u32 newsid;
2940         int rc;
2941
2942         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2943                 return -EOPNOTSUPP;
2944
2945         if (!value || !size)
2946                 return -EACCES;
2947
2948         rc = security_context_to_sid((void *)value, size, &newsid);
2949         if (rc)
2950                 return rc;
2951
2952         isec->sid = newsid;
2953         isec->initialized = 1;
2954         return 0;
2955 }
2956
2957 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2958 {
2959         const int len = sizeof(XATTR_NAME_SELINUX);
2960         if (buffer && len <= buffer_size)
2961                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2962         return len;
2963 }
2964
2965 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2966 {
2967         struct inode_security_struct *isec = inode->i_security;
2968         *secid = isec->sid;
2969 }
2970
2971 /* file security operations */
2972
2973 static int selinux_revalidate_file_permission(struct file *file, int mask)
2974 {
2975         const struct cred *cred = current_cred();
2976         struct inode *inode = file_inode(file);
2977
2978         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2979         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2980                 mask |= MAY_APPEND;
2981
2982         return file_has_perm(cred, file,
2983                              file_mask_to_av(inode->i_mode, mask));
2984 }
2985
2986 static int selinux_file_permission(struct file *file, int mask)
2987 {
2988         struct inode *inode = file_inode(file);
2989         struct file_security_struct *fsec = file->f_security;
2990         struct inode_security_struct *isec = inode->i_security;
2991         u32 sid = current_sid();
2992
2993         if (!mask)
2994                 /* No permission to check.  Existence test. */
2995                 return 0;
2996
2997         if (sid == fsec->sid && fsec->isid == isec->sid &&
2998             fsec->pseqno == avc_policy_seqno())
2999                 /* No change since file_open check. */
3000                 return 0;
3001
3002         return selinux_revalidate_file_permission(file, mask);
3003 }
3004
3005 static int selinux_file_alloc_security(struct file *file)
3006 {
3007         return file_alloc_security(file);
3008 }
3009
3010 static void selinux_file_free_security(struct file *file)
3011 {
3012         file_free_security(file);
3013 }
3014
3015 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3016                               unsigned long arg)
3017 {
3018         const struct cred *cred = current_cred();
3019         int error = 0;
3020
3021         switch (cmd) {
3022         case FIONREAD:
3023         /* fall through */
3024         case FIBMAP:
3025         /* fall through */
3026         case FIGETBSZ:
3027         /* fall through */
3028         case FS_IOC_GETFLAGS:
3029         /* fall through */
3030         case FS_IOC_GETVERSION:
3031                 error = file_has_perm(cred, file, FILE__GETATTR);
3032                 break;
3033
3034         case FS_IOC_SETFLAGS:
3035         /* fall through */
3036         case FS_IOC_SETVERSION:
3037                 error = file_has_perm(cred, file, FILE__SETATTR);
3038                 break;
3039
3040         /* sys_ioctl() checks */
3041         case FIONBIO:
3042         /* fall through */
3043         case FIOASYNC:
3044                 error = file_has_perm(cred, file, 0);
3045                 break;
3046
3047         case KDSKBENT:
3048         case KDSKBSENT:
3049                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3050                                             SECURITY_CAP_AUDIT);
3051                 break;
3052
3053         /* default case assumes that the command will go
3054          * to the file's ioctl() function.
3055          */
3056         default:
3057                 error = file_has_perm(cred, file, FILE__IOCTL);
3058         }
3059         return error;
3060 }
3061
3062 static int default_noexec;
3063
3064 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3065 {
3066         const struct cred *cred = current_cred();
3067         int rc = 0;
3068
3069         if (default_noexec &&
3070             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3071                 /*
3072                  * We are making executable an anonymous mapping or a
3073                  * private file mapping that will also be writable.
3074                  * This has an additional check.
3075                  */
3076                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3077                 if (rc)
3078                         goto error;
3079         }
3080
3081         if (file) {
3082                 /* read access is always possible with a mapping */
3083                 u32 av = FILE__READ;
3084
3085                 /* write access only matters if the mapping is shared */
3086                 if (shared && (prot & PROT_WRITE))
3087                         av |= FILE__WRITE;
3088
3089                 if (prot & PROT_EXEC)
3090                         av |= FILE__EXECUTE;
3091
3092                 return file_has_perm(cred, file, av);
3093         }
3094
3095 error:
3096         return rc;
3097 }
3098
3099 static int selinux_mmap_addr(unsigned long addr)
3100 {
3101         int rc = 0;
3102         u32 sid = current_sid();
3103
3104         /*
3105          * notice that we are intentionally putting the SELinux check before
3106          * the secondary cap_file_mmap check.  This is such a likely attempt
3107          * at bad behaviour/exploit that we always want to get the AVC, even
3108          * if DAC would have also denied the operation.
3109          */
3110         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3111                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3112                                   MEMPROTECT__MMAP_ZERO, NULL);
3113                 if (rc)
3114                         return rc;
3115         }
3116
3117         /* do DAC check on address space usage */
3118         return cap_mmap_addr(addr);
3119 }
3120
3121 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3122                              unsigned long prot, unsigned long flags)
3123 {
3124         if (selinux_checkreqprot)
3125                 prot = reqprot;
3126
3127         return file_map_prot_check(file, prot,
3128                                    (flags & MAP_TYPE) == MAP_SHARED);
3129 }
3130
3131 static int selinux_file_mprotect(struct vm_area_struct *vma,
3132                                  unsigned long reqprot,
3133                                  unsigned long prot)
3134 {
3135         const struct cred *cred = current_cred();
3136
3137         if (selinux_checkreqprot)
3138                 prot = reqprot;
3139
3140         if (default_noexec &&
3141             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3142                 int rc = 0;
3143                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3144                     vma->vm_end <= vma->vm_mm->brk) {
3145                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3146                 } else if (!vma->vm_file &&
3147                            vma->vm_start <= vma->vm_mm->start_stack &&
3148                            vma->vm_end >= vma->vm_mm->start_stack) {
3149                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3150                 } else if (vma->vm_file && vma->anon_vma) {
3151                         /*
3152                          * We are making executable a file mapping that has
3153                          * had some COW done. Since pages might have been
3154                          * written, check ability to execute the possibly
3155                          * modified content.  This typically should only
3156                          * occur for text relocations.
3157                          */
3158                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3159                 }
3160                 if (rc)
3161                         return rc;
3162         }
3163
3164         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3165 }
3166
3167 static int selinux_file_lock(struct file *file, unsigned int cmd)
3168 {
3169         const struct cred *cred = current_cred();
3170
3171         return file_has_perm(cred, file, FILE__LOCK);
3172 }
3173
3174 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3175                               unsigned long arg)
3176 {
3177         const struct cred *cred = current_cred();
3178         int err = 0;
3179
3180         switch (cmd) {
3181         case F_SETFL:
3182                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3183                         err = file_has_perm(cred, file, FILE__WRITE);
3184                         break;
3185                 }
3186                 /* fall through */
3187         case F_SETOWN:
3188         case F_SETSIG:
3189         case F_GETFL:
3190         case F_GETOWN:
3191         case F_GETSIG:
3192         case F_GETOWNER_UIDS:
3193                 /* Just check FD__USE permission */
3194                 err = file_has_perm(cred, file, 0);
3195                 break;
3196         case F_GETLK:
3197         case F_SETLK:
3198         case F_SETLKW:
3199 #if BITS_PER_LONG == 32
3200         case F_GETLK64:
3201         case F_SETLK64:
3202         case F_SETLKW64:
3203 #endif
3204                 err = file_has_perm(cred, file, FILE__LOCK);
3205                 break;
3206         }
3207
3208         return err;
3209 }
3210
3211 static int selinux_file_set_fowner(struct file *file)
3212 {
3213         struct file_security_struct *fsec;
3214
3215         fsec = file->f_security;
3216         fsec->fown_sid = current_sid();
3217
3218         return 0;
3219 }
3220
3221 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3222                                        struct fown_struct *fown, int signum)
3223 {
3224         struct file *file;
3225         u32 sid = task_sid(tsk);
3226         u32 perm;
3227         struct file_security_struct *fsec;
3228
3229         /* struct fown_struct is never outside the context of a struct file */
3230         file = container_of(fown, struct file, f_owner);
3231
3232         fsec = file->f_security;
3233
3234         if (!signum)
3235                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3236         else
3237                 perm = signal_to_av(signum);
3238
3239         return avc_has_perm(fsec->fown_sid, sid,
3240                             SECCLASS_PROCESS, perm, NULL);
3241 }
3242
3243 static int selinux_file_receive(struct file *file)
3244 {
3245         const struct cred *cred = current_cred();
3246
3247         return file_has_perm(cred, file, file_to_av(file));
3248 }
3249
3250 static int selinux_file_open(struct file *file, const struct cred *cred)
3251 {
3252         struct file_security_struct *fsec;
3253         struct inode_security_struct *isec;
3254
3255         fsec = file->f_security;
3256         isec = file_inode(file)->i_security;
3257         /*
3258          * Save inode label and policy sequence number
3259          * at open-time so that selinux_file_permission
3260          * can determine whether revalidation is necessary.
3261          * Task label is already saved in the file security
3262          * struct as its SID.
3263          */
3264         fsec->isid = isec->sid;
3265         fsec->pseqno = avc_policy_seqno();
3266         /*
3267          * Since the inode label or policy seqno may have changed
3268          * between the selinux_inode_permission check and the saving
3269          * of state above, recheck that access is still permitted.
3270          * Otherwise, access might never be revalidated against the
3271          * new inode label or new policy.
3272          * This check is not redundant - do not remove.
3273          */
3274         return file_path_has_perm(cred, file, open_file_to_av(file));
3275 }
3276
3277 /* task security operations */
3278
3279 static int selinux_task_create(unsigned long clone_flags)
3280 {
3281         return current_has_perm(current, PROCESS__FORK);
3282 }
3283
3284 /*
3285  * allocate the SELinux part of blank credentials
3286  */
3287 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3288 {
3289         struct task_security_struct *tsec;
3290
3291         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3292         if (!tsec)
3293                 return -ENOMEM;
3294
3295         cred->security = tsec;
3296         return 0;
3297 }
3298
3299 /*
3300  * detach and free the LSM part of a set of credentials
3301  */
3302 static void selinux_cred_free(struct cred *cred)
3303 {
3304         struct task_security_struct *tsec = cred->security;
3305
3306         /*
3307          * cred->security == NULL if security_cred_alloc_blank() or
3308          * security_prepare_creds() returned an error.
3309          */
3310         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3311         cred->security = (void *) 0x7UL;
3312         kfree(tsec);
3313 }
3314
3315 /*
3316  * prepare a new set of credentials for modification
3317  */
3318 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3319                                 gfp_t gfp)
3320 {
3321         const struct task_security_struct *old_tsec;
3322         struct task_security_struct *tsec;
3323
3324         old_tsec = old->security;
3325
3326         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3327         if (!tsec)
3328                 return -ENOMEM;
3329
3330         new->security = tsec;
3331         return 0;
3332 }
3333
3334 /*
3335  * transfer the SELinux data to a blank set of creds
3336  */
3337 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3338 {
3339         const struct task_security_struct *old_tsec = old->security;
3340         struct task_security_struct *tsec = new->security;
3341
3342         *tsec = *old_tsec;
3343 }
3344
3345 /*
3346  * set the security data for a kernel service
3347  * - all the creation contexts are set to unlabelled
3348  */
3349 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3350 {
3351         struct task_security_struct *tsec = new->security;
3352         u32 sid = current_sid();
3353         int ret;
3354
3355         ret = avc_has_perm(sid, secid,
3356                            SECCLASS_KERNEL_SERVICE,
3357                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3358                            NULL);
3359         if (ret == 0) {
3360                 tsec->sid = secid;
3361                 tsec->create_sid = 0;
3362                 tsec->keycreate_sid = 0;
3363                 tsec->sockcreate_sid = 0;
3364         }
3365         return ret;
3366 }
3367
3368 /*
3369  * set the file creation context in a security record to the same as the
3370  * objective context of the specified inode
3371  */
3372 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3373 {
3374         struct inode_security_struct *isec = inode->i_security;
3375         struct task_security_struct *tsec = new->security;
3376         u32 sid = current_sid();
3377         int ret;
3378
3379         ret = avc_has_perm(sid, isec->sid,
3380                            SECCLASS_KERNEL_SERVICE,
3381                            KERNEL_SERVICE__CREATE_FILES_AS,
3382                            NULL);
3383
3384         if (ret == 0)
3385                 tsec->create_sid = isec->sid;
3386         return ret;
3387 }
3388
3389 static int selinux_kernel_module_request(char *kmod_name)
3390 {
3391         u32 sid;
3392         struct common_audit_data ad;
3393
3394         sid = task_sid(current);
3395
3396         ad.type = LSM_AUDIT_DATA_KMOD;
3397         ad.u.kmod_name = kmod_name;
3398
3399         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3400                             SYSTEM__MODULE_REQUEST, &ad);
3401 }
3402
3403 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3404 {
3405         return current_has_perm(p, PROCESS__SETPGID);
3406 }
3407
3408 static int selinux_task_getpgid(struct task_struct *p)
3409 {
3410         return current_has_perm(p, PROCESS__GETPGID);
3411 }
3412
3413 static int selinux_task_getsid(struct task_struct *p)
3414 {
3415         return current_has_perm(p, PROCESS__GETSESSION);
3416 }
3417
3418 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3419 {
3420         *secid = task_sid(p);
3421 }
3422
3423 static int selinux_task_setnice(struct task_struct *p, int nice)
3424 {
3425         int rc;
3426
3427         rc = cap_task_setnice(p, nice);
3428         if (rc)
3429                 return rc;
3430
3431         return current_has_perm(p, PROCESS__SETSCHED);
3432 }
3433
3434 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3435 {
3436         int rc;
3437
3438         rc = cap_task_setioprio(p, ioprio);
3439         if (rc)
3440                 return rc;
3441
3442         return current_has_perm(p, PROCESS__SETSCHED);
3443 }
3444
3445 static int selinux_task_getioprio(struct task_struct *p)
3446 {
3447         return current_has_perm(p, PROCESS__GETSCHED);
3448 }
3449
3450 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3451                 struct rlimit *new_rlim)
3452 {
3453         struct rlimit *old_rlim = p->signal->rlim + resource;
3454
3455         /* Control the ability to change the hard limit (whether
3456            lowering or raising it), so that the hard limit can
3457            later be used as a safe reset point for the soft limit
3458            upon context transitions.  See selinux_bprm_committing_creds. */
3459         if (old_rlim->rlim_max != new_rlim->rlim_max)
3460                 return current_has_perm(p, PROCESS__SETRLIMIT);
3461
3462         return 0;
3463 }
3464
3465 static int selinux_task_setscheduler(struct task_struct *p)
3466 {
3467         int rc;
3468
3469         rc = cap_task_setscheduler(p);
3470         if (rc)
3471                 return rc;
3472
3473         return current_has_perm(p, PROCESS__SETSCHED);
3474 }
3475
3476 static int selinux_task_getscheduler(struct task_struct *p)
3477 {
3478         return current_has_perm(p, PROCESS__GETSCHED);
3479 }
3480
3481 static int selinux_task_movememory(struct task_struct *p)
3482 {
3483         return current_has_perm(p, PROCESS__SETSCHED);
3484 }
3485
3486 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3487                                 int sig, u32 secid)
3488 {
3489         u32 perm;
3490         int rc;
3491
3492         if (!sig)
3493                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3494         else
3495                 perm = signal_to_av(sig);
3496         if (secid)
3497                 rc = avc_has_perm(secid, task_sid(p),
3498                                   SECCLASS_PROCESS, perm, NULL);
3499         else
3500                 rc = current_has_perm(p, perm);
3501         return rc;
3502 }
3503
3504 static int selinux_task_wait(struct task_struct *p)
3505 {
3506         return task_has_perm(p, current, PROCESS__SIGCHLD);
3507 }
3508
3509 static void selinux_task_to_inode(struct task_struct *p,
3510                                   struct inode *inode)
3511 {
3512         struct inode_security_struct *isec = inode->i_security;
3513         u32 sid = task_sid(p);
3514
3515         isec->sid = sid;
3516         isec->initialized = 1;
3517 }
3518
3519 /* Returns error only if unable to parse addresses */
3520 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3521                         struct common_audit_data *ad, u8 *proto)
3522 {
3523         int offset, ihlen, ret = -EINVAL;
3524         struct iphdr _iph, *ih;
3525
3526         offset = skb_network_offset(skb);
3527         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3528         if (ih == NULL)
3529                 goto out;
3530
3531         ihlen = ih->ihl * 4;
3532         if (ihlen < sizeof(_iph))
3533                 goto out;
3534
3535         ad->u.net->v4info.saddr = ih->saddr;
3536         ad->u.net->v4info.daddr = ih->daddr;
3537         ret = 0;
3538
3539         if (proto)
3540                 *proto = ih->protocol;
3541
3542         switch (ih->protocol) {
3543         case IPPROTO_TCP: {
3544                 struct tcphdr _tcph, *th;
3545
3546                 if (ntohs(ih->frag_off) & IP_OFFSET)
3547                         break;
3548
3549                 offset += ihlen;
3550                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3551                 if (th == NULL)
3552                         break;
3553
3554                 ad->u.net->sport = th->source;
3555                 ad->u.net->dport = th->dest;
3556                 break;
3557         }
3558
3559         case IPPROTO_UDP: {
3560                 struct udphdr _udph, *uh;
3561
3562                 if (ntohs(ih->frag_off) & IP_OFFSET)
3563                         break;
3564
3565                 offset += ihlen;
3566                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3567                 if (uh == NULL)
3568                         break;
3569
3570                 ad->u.net->sport = uh->source;
3571                 ad->u.net->dport = uh->dest;
3572                 break;
3573         }
3574
3575         case IPPROTO_DCCP: {
3576                 struct dccp_hdr _dccph, *dh;
3577
3578                 if (ntohs(ih->frag_off) & IP_OFFSET)
3579                         break;
3580
3581                 offset += ihlen;
3582                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3583                 if (dh == NULL)
3584                         break;
3585
3586                 ad->u.net->sport = dh->dccph_sport;
3587                 ad->u.net->dport = dh->dccph_dport;
3588                 break;
3589         }
3590
3591         default:
3592                 break;
3593         }
3594 out:
3595         return ret;
3596 }
3597
3598 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3599
3600 /* Returns error only if unable to parse addresses */
3601 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3602                         struct common_audit_data *ad, u8 *proto)
3603 {
3604         u8 nexthdr;
3605         int ret = -EINVAL, offset;
3606         struct ipv6hdr _ipv6h, *ip6;
3607         __be16 frag_off;
3608
3609         offset = skb_network_offset(skb);
3610         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3611         if (ip6 == NULL)
3612                 goto out;
3613
3614         ad->u.net->v6info.saddr = ip6->saddr;
3615         ad->u.net->v6info.daddr = ip6->daddr;
3616         ret = 0;
3617
3618         nexthdr = ip6->nexthdr;
3619         offset += sizeof(_ipv6h);
3620         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3621         if (offset < 0)
3622                 goto out;
3623
3624         if (proto)
3625                 *proto = nexthdr;
3626
3627         switch (nexthdr) {
3628         case IPPROTO_TCP: {
3629                 struct tcphdr _tcph, *th;
3630
3631                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3632                 if (th == NULL)
3633                         break;
3634
3635                 ad->u.net->sport = th->source;
3636                 ad->u.net->dport = th->dest;
3637                 break;
3638         }
3639
3640         case IPPROTO_UDP: {
3641                 struct udphdr _udph, *uh;
3642
3643                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3644                 if (uh == NULL)
3645                         break;
3646
3647                 ad->u.net->sport = uh->source;
3648                 ad->u.net->dport = uh->dest;
3649                 break;
3650         }
3651
3652         case IPPROTO_DCCP: {
3653                 struct dccp_hdr _dccph, *dh;
3654
3655                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3656                 if (dh == NULL)
3657                         break;
3658
3659                 ad->u.net->sport = dh->dccph_sport;
3660                 ad->u.net->dport = dh->dccph_dport;
3661                 break;
3662         }
3663
3664         /* includes fragments */
3665         default:
3666                 break;
3667         }
3668 out:
3669         return ret;
3670 }
3671
3672 #endif /* IPV6 */
3673
3674 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3675                              char **_addrp, int src, u8 *proto)
3676 {
3677         char *addrp;
3678         int ret;
3679
3680         switch (ad->u.net->family) {
3681         case PF_INET:
3682                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3683                 if (ret)
3684                         goto parse_error;
3685                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3686                                        &ad->u.net->v4info.daddr);
3687                 goto okay;
3688
3689 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3690         case PF_INET6:
3691                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3692                 if (ret)
3693                         goto parse_error;
3694                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3695                                        &ad->u.net->v6info.daddr);
3696                 goto okay;
3697 #endif  /* IPV6 */
3698         default:
3699                 addrp = NULL;
3700                 goto okay;
3701         }
3702
3703 parse_error:
3704         printk(KERN_WARNING
3705                "SELinux: failure in selinux_parse_skb(),"
3706                " unable to parse packet\n");
3707         return ret;
3708
3709 okay:
3710         if (_addrp)
3711                 *_addrp = addrp;
3712         return 0;
3713 }
3714
3715 /**
3716  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3717  * @skb: the packet
3718  * @family: protocol family
3719  * @sid: the packet's peer label SID
3720  *
3721  * Description:
3722  * Check the various different forms of network peer labeling and determine
3723  * the peer label/SID for the packet; most of the magic actually occurs in
3724  * the security server function security_net_peersid_cmp().  The function
3725  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3726  * or -EACCES if @sid is invalid due to inconsistencies with the different
3727  * peer labels.
3728  *
3729  */
3730 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3731 {
3732         int err;
3733         u32 xfrm_sid;
3734         u32 nlbl_sid;
3735         u32 nlbl_type;
3736
3737         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3738         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3739
3740         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3741         if (unlikely(err)) {
3742                 printk(KERN_WARNING
3743                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3744                        " unable to determine packet's peer label\n");
3745                 return -EACCES;
3746         }
3747
3748         return 0;
3749 }
3750
3751 /* socket security operations */
3752
3753 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3754                                  u16 secclass, u32 *socksid)
3755 {
3756         if (tsec->sockcreate_sid > SECSID_NULL) {
3757                 *socksid = tsec->sockcreate_sid;
3758                 return 0;
3759         }
3760
3761         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3762                                        socksid);
3763 }
3764
3765 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3766 {
3767         struct sk_security_struct *sksec = sk->sk_security;
3768         struct common_audit_data ad;
3769         struct lsm_network_audit net = {0,};
3770         u32 tsid = task_sid(task);
3771
3772         if (sksec->sid == SECINITSID_KERNEL)
3773                 return 0;
3774
3775         ad.type = LSM_AUDIT_DATA_NET;
3776         ad.u.net = &net;
3777         ad.u.net->sk = sk;
3778
3779         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3780 }
3781
3782 static int selinux_socket_create(int family, int type,
3783                                  int protocol, int kern)
3784 {
3785         const struct task_security_struct *tsec = current_security();
3786         u32 newsid;
3787         u16 secclass;
3788         int rc;
3789
3790         if (kern)
3791                 return 0;
3792
3793         secclass = socket_type_to_security_class(family, type, protocol);
3794         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3795         if (rc)
3796                 return rc;
3797
3798         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3799 }
3800
3801 static int selinux_socket_post_create(struct socket *sock, int family,
3802                                       int type, int protocol, int kern)
3803 {
3804         const struct task_security_struct *tsec = current_security();
3805         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3806         struct sk_security_struct *sksec;
3807         int err = 0;
3808
3809         isec->sclass = socket_type_to_security_class(family, type, protocol);
3810
3811         if (kern)
3812                 isec->sid = SECINITSID_KERNEL;
3813         else {
3814                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3815                 if (err)
3816                         return err;
3817         }
3818
3819         isec->initialized = 1;
3820
3821         if (sock->sk) {
3822                 sksec = sock->sk->sk_security;
3823                 sksec->sid = isec->sid;
3824                 sksec->sclass = isec->sclass;
3825                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3826         }
3827
3828         return err;
3829 }
3830
3831 /* Range of port numbers used to automatically bind.
3832    Need to determine whether we should perform a name_bind
3833    permission check between the socket and the port number. */
3834
3835 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3836 {
3837         struct sock *sk = sock->sk;
3838         u16 family;
3839         int err;
3840
3841         err = sock_has_perm(current, sk, SOCKET__BIND);
3842         if (err)
3843                 goto out;
3844
3845         /*
3846          * If PF_INET or PF_INET6, check name_bind permission for the port.
3847          * Multiple address binding for SCTP is not supported yet: we just
3848          * check the first address now.
3849          */
3850         family = sk->sk_family;
3851         if (family == PF_INET || family == PF_INET6) {
3852                 char *addrp;
3853                 struct sk_security_struct *sksec = sk->sk_security;
3854                 struct common_audit_data ad;
3855                 struct lsm_network_audit net = {0,};
3856                 struct sockaddr_in *addr4 = NULL;
3857                 struct sockaddr_in6 *addr6 = NULL;
3858                 unsigned short snum;
3859                 u32 sid, node_perm;
3860
3861                 if (family == PF_INET) {
3862                         addr4 = (struct sockaddr_in *)address;
3863                         snum = ntohs(addr4->sin_port);
3864                         addrp = (char *)&addr4->sin_addr.s_addr;
3865                 } else {
3866                         addr6 = (struct sockaddr_in6 *)address;
3867                         snum = ntohs(addr6->sin6_port);
3868                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3869                 }
3870
3871                 if (snum) {
3872                         int low, high;
3873
3874                         inet_get_local_port_range(&low, &high);
3875
3876                         if (snum < max(PROT_SOCK, low) || snum > high) {
3877                                 err = sel_netport_sid(sk->sk_protocol,
3878                                                       snum, &sid);
3879                                 if (err)
3880                                         goto out;
3881                                 ad.type = LSM_AUDIT_DATA_NET;
3882                                 ad.u.net = &net;
3883                                 ad.u.net->sport = htons(snum);
3884                                 ad.u.net->family = family;
3885                                 err = avc_has_perm(sksec->sid, sid,
3886                                                    sksec->sclass,
3887                                                    SOCKET__NAME_BIND, &ad);
3888                                 if (err)
3889                                         goto out;
3890                         }
3891                 }
3892
3893                 switch (sksec->sclass) {
3894                 case SECCLASS_TCP_SOCKET:
3895                         node_perm = TCP_SOCKET__NODE_BIND;
3896                         break;
3897
3898                 case SECCLASS_UDP_SOCKET:
3899                         node_perm = UDP_SOCKET__NODE_BIND;
3900                         break;
3901
3902                 case SECCLASS_DCCP_SOCKET:
3903                         node_perm = DCCP_SOCKET__NODE_BIND;
3904                         break;
3905
3906                 default:
3907                         node_perm = RAWIP_SOCKET__NODE_BIND;
3908                         break;
3909                 }
3910
3911                 err = sel_netnode_sid(addrp, family, &sid);
3912                 if (err)
3913                         goto out;
3914
3915                 ad.type = LSM_AUDIT_DATA_NET;
3916                 ad.u.net = &net;
3917                 ad.u.net->sport = htons(snum);
3918                 ad.u.net->family = family;
3919
3920                 if (family == PF_INET)
3921                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3922                 else
3923                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3924
3925                 err = avc_has_perm(sksec->sid, sid,
3926                                    sksec->sclass, node_perm, &ad);
3927                 if (err)
3928                         goto out;
3929         }
3930 out:
3931         return err;
3932 }
3933
3934 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3935 {
3936         struct sock *sk = sock->sk;
3937         struct sk_security_struct *sksec = sk->sk_security;
3938         int err;
3939
3940         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3941         if (err)
3942                 return err;
3943
3944         /*
3945          * If a TCP or DCCP socket, check name_connect permission for the port.
3946          */
3947         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3948             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3949                 struct common_audit_data ad;
3950                 struct lsm_network_audit net = {0,};
3951                 struct sockaddr_in *addr4 = NULL;
3952                 struct sockaddr_in6 *addr6 = NULL;
3953                 unsigned short snum;
3954                 u32 sid, perm;
3955
3956                 if (sk->sk_family == PF_INET) {
3957                         addr4 = (struct sockaddr_in *)address;
3958                         if (addrlen < sizeof(struct sockaddr_in))
3959                                 return -EINVAL;
3960                         snum = ntohs(addr4->sin_port);
3961                 } else {
3962                         addr6 = (struct sockaddr_in6 *)address;
3963                         if (addrlen < SIN6_LEN_RFC2133)
3964                                 return -EINVAL;
3965                         snum = ntohs(addr6->sin6_port);
3966                 }
3967
3968                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3969                 if (err)
3970                         goto out;
3971
3972                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3973                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3974
3975                 ad.type = LSM_AUDIT_DATA_NET;
3976                 ad.u.net = &net;
3977                 ad.u.net->dport = htons(snum);
3978                 ad.u.net->family = sk->sk_family;
3979                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3980                 if (err)
3981                         goto out;
3982         }
3983
3984         err = selinux_netlbl_socket_connect(sk, address);
3985
3986 out:
3987         return err;
3988 }
3989
3990 static int selinux_socket_listen(struct socket *sock, int backlog)
3991 {
3992         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3993 }
3994
3995 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3996 {
3997         int err;
3998         struct inode_security_struct *isec;
3999         struct inode_security_struct *newisec;
4000
4001         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4002         if (err)
4003                 return err;
4004
4005         newisec = SOCK_INODE(newsock)->i_security;
4006
4007         isec = SOCK_INODE(sock)->i_security;
4008         newisec->sclass = isec->sclass;
4009         newisec->sid = isec->sid;
4010         newisec->initialized = 1;
4011
4012         return 0;
4013 }
4014
4015 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4016                                   int size)
4017 {
4018         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4019 }
4020
4021 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4022                                   int size, int flags)
4023 {
4024         return sock_has_perm(current, sock->sk, SOCKET__READ);
4025 }
4026
4027 static int selinux_socket_getsockname(struct socket *sock)
4028 {
4029         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4030 }
4031
4032 static int selinux_socket_getpeername(struct socket *sock)
4033 {
4034         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4035 }
4036
4037 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4038 {
4039         int err;
4040
4041         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4042         if (err)
4043                 return err;
4044
4045         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4046 }
4047
4048 static int selinux_socket_getsockopt(struct socket *sock, int level,
4049                                      int optname)
4050 {
4051         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4052 }
4053
4054 static int selinux_socket_shutdown(struct socket *sock, int how)
4055 {
4056         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4057 }
4058
4059 static int selinux_socket_unix_stream_connect(struct sock *sock,
4060                                               struct sock *other,
4061                                               struct sock *newsk)
4062 {
4063         struct sk_security_struct *sksec_sock = sock->sk_security;
4064         struct sk_security_struct *sksec_other = other->sk_security;
4065         struct sk_security_struct *sksec_new = newsk->sk_security;
4066         struct common_audit_data ad;
4067         struct lsm_network_audit net = {0,};
4068         int err;
4069
4070         ad.type = LSM_AUDIT_DATA_NET;
4071         ad.u.net = &net;
4072         ad.u.net->sk = other;
4073
4074         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4075                            sksec_other->sclass,
4076                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4077         if (err)
4078                 return err;
4079
4080         /* server child socket */
4081         sksec_new->peer_sid = sksec_sock->sid;
4082         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4083                                     &sksec_new->sid);
4084         if (err)
4085                 return err;
4086
4087         /* connecting socket */
4088         sksec_sock->peer_sid = sksec_new->sid;
4089
4090         return 0;
4091 }
4092
4093 static int selinux_socket_unix_may_send(struct socket *sock,
4094                                         struct socket *other)
4095 {
4096         struct sk_security_struct *ssec = sock->sk->sk_security;
4097         struct sk_security_struct *osec = other->sk->sk_security;
4098         struct common_audit_data ad;
4099         struct lsm_network_audit net = {0,};
4100
4101         ad.type = LSM_AUDIT_DATA_NET;
4102         ad.u.net = &net;
4103         ad.u.net->sk = other->sk;
4104
4105         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4106                             &ad);
4107 }
4108
4109 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4110                                     u32 peer_sid,
4111                                     struct common_audit_data *ad)
4112 {
4113         int err;
4114         u32 if_sid;
4115         u32 node_sid;
4116
4117         err = sel_netif_sid(ifindex, &if_sid);
4118         if (err)
4119                 return err;
4120         err = avc_has_perm(peer_sid, if_sid,
4121                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4122         if (err)
4123                 return err;
4124
4125         err = sel_netnode_sid(addrp, family, &node_sid);
4126         if (err)
4127                 return err;
4128         return avc_has_perm(peer_sid, node_sid,
4129                             SECCLASS_NODE, NODE__RECVFROM, ad);
4130 }
4131
4132 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4133                                        u16 family)
4134 {
4135         int err = 0;
4136         struct sk_security_struct *sksec = sk->sk_security;
4137         u32 sk_sid = sksec->sid;
4138         struct common_audit_data ad;
4139         struct lsm_network_audit net = {0,};
4140         char *addrp;
4141
4142         ad.type = LSM_AUDIT_DATA_NET;
4143         ad.u.net = &net;
4144         ad.u.net->netif = skb->skb_iif;
4145         ad.u.net->family = family;
4146         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4147         if (err)
4148                 return err;
4149
4150         if (selinux_secmark_enabled()) {
4151                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4152                                    PACKET__RECV, &ad);
4153                 if (err)
4154                         return err;
4155         }
4156
4157         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4158         if (err)
4159                 return err;
4160         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4161
4162         return err;
4163 }
4164
4165 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4166 {
4167         int err;
4168         struct sk_security_struct *sksec = sk->sk_security;
4169         u16 family = sk->sk_family;
4170         u32 sk_sid = sksec->sid;
4171         struct common_audit_data ad;
4172         struct lsm_network_audit net = {0,};
4173         char *addrp;
4174         u8 secmark_active;
4175         u8 peerlbl_active;
4176
4177         if (family != PF_INET && family != PF_INET6)
4178                 return 0;
4179
4180         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4181         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4182                 family = PF_INET;
4183
4184         /* If any sort of compatibility mode is enabled then handoff processing
4185          * to the selinux_sock_rcv_skb_compat() function to deal with the
4186          * special handling.  We do this in an attempt to keep this function
4187          * as fast and as clean as possible. */
4188         if (!selinux_policycap_netpeer)
4189                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4190
4191         secmark_active = selinux_secmark_enabled();
4192         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4193         if (!secmark_active && !peerlbl_active)
4194                 return 0;
4195
4196         ad.type = LSM_AUDIT_DATA_NET;
4197         ad.u.net = &net;
4198         ad.u.net->netif = skb->skb_iif;
4199         ad.u.net->family = family;
4200         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4201         if (err)
4202                 return err;
4203
4204         if (peerlbl_active) {
4205                 u32 peer_sid;
4206
4207                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4208                 if (err)
4209                         return err;
4210                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4211                                                peer_sid, &ad);
4212                 if (err) {
4213                         selinux_netlbl_err(skb, err, 0);
4214                         return err;
4215                 }
4216                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4217                                    PEER__RECV, &ad);
4218                 if (err)
4219                         selinux_netlbl_err(skb, err, 0);
4220         }
4221
4222         if (secmark_active) {
4223                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4224                                    PACKET__RECV, &ad);
4225                 if (err)
4226                         return err;
4227         }
4228
4229         return err;
4230 }
4231
4232 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4233                                             int __user *optlen, unsigned len)
4234 {
4235         int err = 0;
4236         char *scontext;
4237         u32 scontext_len;
4238         struct sk_security_struct *sksec = sock->sk->sk_security;
4239         u32 peer_sid = SECSID_NULL;
4240
4241         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4242             sksec->sclass == SECCLASS_TCP_SOCKET)
4243                 peer_sid = sksec->peer_sid;
4244         if (peer_sid == SECSID_NULL)
4245                 return -ENOPROTOOPT;
4246
4247         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4248         if (err)
4249                 return err;
4250
4251         if (scontext_len > len) {
4252                 err = -ERANGE;
4253                 goto out_len;
4254         }
4255
4256         if (copy_to_user(optval, scontext, scontext_len))
4257                 err = -EFAULT;
4258
4259 out_len:
4260         if (put_user(scontext_len, optlen))
4261                 err = -EFAULT;
4262         kfree(scontext);
4263         return err;
4264 }
4265
4266 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4267 {
4268         u32 peer_secid = SECSID_NULL;
4269         u16 family;
4270
4271         if (skb && skb->protocol == htons(ETH_P_IP))
4272                 family = PF_INET;
4273         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4274                 family = PF_INET6;
4275         else if (sock)
4276                 family = sock->sk->sk_family;
4277         else
4278                 goto out;
4279
4280         if (sock && family == PF_UNIX)
4281                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4282         else if (skb)
4283                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4284
4285 out:
4286         *secid = peer_secid;
4287         if (peer_secid == SECSID_NULL)
4288                 return -EINVAL;
4289         return 0;
4290 }
4291
4292 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4293 {
4294         struct sk_security_struct *sksec;
4295
4296         sksec = kzalloc(sizeof(*sksec), priority);
4297         if (!sksec)
4298                 return -ENOMEM;
4299
4300         sksec->peer_sid = SECINITSID_UNLABELED;
4301         sksec->sid = SECINITSID_UNLABELED;
4302         selinux_netlbl_sk_security_reset(sksec);
4303         sk->sk_security = sksec;
4304
4305         return 0;
4306 }
4307
4308 static void selinux_sk_free_security(struct sock *sk)
4309 {
4310         struct sk_security_struct *sksec = sk->sk_security;
4311
4312         sk->sk_security = NULL;
4313         selinux_netlbl_sk_security_free(sksec);
4314         kfree(sksec);
4315 }
4316
4317 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4318 {
4319         struct sk_security_struct *sksec = sk->sk_security;
4320         struct sk_security_struct *newsksec = newsk->sk_security;
4321
4322         newsksec->sid = sksec->sid;
4323         newsksec->peer_sid = sksec->peer_sid;
4324         newsksec->sclass = sksec->sclass;
4325
4326         selinux_netlbl_sk_security_reset(newsksec);
4327 }
4328
4329 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4330 {
4331         if (!sk)
4332                 *secid = SECINITSID_ANY_SOCKET;
4333         else {
4334                 struct sk_security_struct *sksec = sk->sk_security;
4335
4336                 *secid = sksec->sid;
4337         }
4338 }
4339
4340 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4341 {
4342         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4343         struct sk_security_struct *sksec = sk->sk_security;
4344
4345         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4346             sk->sk_family == PF_UNIX)
4347                 isec->sid = sksec->sid;
4348         sksec->sclass = isec->sclass;
4349 }
4350
4351 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4352                                      struct request_sock *req)
4353 {
4354         struct sk_security_struct *sksec = sk->sk_security;
4355         int err;
4356         u16 family = sk->sk_family;
4357         u32 newsid;
4358         u32 peersid;
4359
4360         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4361         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4362                 family = PF_INET;
4363
4364         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4365         if (err)
4366                 return err;
4367         if (peersid == SECSID_NULL) {
4368                 req->secid = sksec->sid;
4369                 req->peer_secid = SECSID_NULL;
4370         } else {
4371                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4372                 if (err)
4373                         return err;
4374                 req->secid = newsid;
4375                 req->peer_secid = peersid;
4376         }
4377
4378         return selinux_netlbl_inet_conn_request(req, family);
4379 }
4380
4381 static void selinux_inet_csk_clone(struct sock *newsk,
4382                                    const struct request_sock *req)
4383 {
4384         struct sk_security_struct *newsksec = newsk->sk_security;
4385
4386         newsksec->sid = req->secid;
4387         newsksec->peer_sid = req->peer_secid;
4388         /* NOTE: Ideally, we should also get the isec->sid for the
4389            new socket in sync, but we don't have the isec available yet.
4390            So we will wait until sock_graft to do it, by which
4391            time it will have been created and available. */
4392
4393         /* We don't need to take any sort of lock here as we are the only
4394          * thread with access to newsksec */
4395         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4396 }
4397
4398 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4399 {
4400         u16 family = sk->sk_family;
4401         struct sk_security_struct *sksec = sk->sk_security;
4402
4403         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4404         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4405                 family = PF_INET;
4406
4407         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4408 }
4409
4410 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4411 {
4412         skb_set_owner_w(skb, sk);
4413 }
4414
4415 static int selinux_secmark_relabel_packet(u32 sid)
4416 {
4417         const struct task_security_struct *__tsec;
4418         u32 tsid;
4419
4420         __tsec = current_security();
4421         tsid = __tsec->sid;
4422
4423         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4424 }
4425
4426 static void selinux_secmark_refcount_inc(void)
4427 {
4428         atomic_inc(&selinux_secmark_refcount);
4429 }
4430
4431 static void selinux_secmark_refcount_dec(void)
4432 {
4433         atomic_dec(&selinux_secmark_refcount);
4434 }
4435
4436 static void selinux_req_classify_flow(const struct request_sock *req,
4437                                       struct flowi *fl)
4438 {
4439         fl->flowi_secid = req->secid;
4440 }
4441
4442 static int selinux_tun_dev_alloc_security(void **security)
4443 {
4444         struct tun_security_struct *tunsec;
4445
4446         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4447         if (!tunsec)
4448                 return -ENOMEM;
4449         tunsec->sid = current_sid();
4450
4451         *security = tunsec;
4452         return 0;
4453 }
4454
4455 static void selinux_tun_dev_free_security(void *security)
4456 {
4457         kfree(security);
4458 }
4459
4460 static int selinux_tun_dev_create(void)
4461 {
4462         u32 sid = current_sid();
4463
4464         /* we aren't taking into account the "sockcreate" SID since the socket
4465          * that is being created here is not a socket in the traditional sense,
4466          * instead it is a private sock, accessible only to the kernel, and
4467          * representing a wide range of network traffic spanning multiple
4468          * connections unlike traditional sockets - check the TUN driver to
4469          * get a better understanding of why this socket is special */
4470
4471         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4472                             NULL);
4473 }
4474
4475 static int selinux_tun_dev_attach_queue(void *security)
4476 {
4477         struct tun_security_struct *tunsec = security;
4478
4479         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4480                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4481 }
4482
4483 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4484 {
4485         struct tun_security_struct *tunsec = security;
4486         struct sk_security_struct *sksec = sk->sk_security;
4487
4488         /* we don't currently perform any NetLabel based labeling here and it
4489          * isn't clear that we would want to do so anyway; while we could apply
4490          * labeling without the support of the TUN user the resulting labeled
4491          * traffic from the other end of the connection would almost certainly
4492          * cause confusion to the TUN user that had no idea network labeling
4493          * protocols were being used */
4494
4495         sksec->sid = tunsec->sid;
4496         sksec->sclass = SECCLASS_TUN_SOCKET;
4497
4498         return 0;
4499 }
4500
4501 static int selinux_tun_dev_open(void *security)
4502 {
4503         struct tun_security_struct *tunsec = security;
4504         u32 sid = current_sid();
4505         int err;
4506
4507         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4508                            TUN_SOCKET__RELABELFROM, NULL);
4509         if (err)
4510                 return err;
4511         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4512                            TUN_SOCKET__RELABELTO, NULL);
4513         if (err)
4514                 return err;
4515         tunsec->sid = sid;
4516
4517         return 0;
4518 }
4519
4520 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4521 {
4522         int err = 0;
4523         u32 perm;
4524         struct nlmsghdr *nlh;
4525         struct sk_security_struct *sksec = sk->sk_security;
4526
4527         if (skb->len < NLMSG_HDRLEN) {
4528                 err = -EINVAL;
4529                 goto out;
4530         }
4531         nlh = nlmsg_hdr(skb);
4532
4533         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4534         if (err) {
4535                 if (err == -EINVAL) {
4536                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4537                                   "SELinux:  unrecognized netlink message"
4538                                   " type=%hu for sclass=%hu\n",
4539                                   nlh->nlmsg_type, sksec->sclass);
4540                         if (!selinux_enforcing || security_get_allow_unknown())
4541                                 err = 0;
4542                 }
4543
4544                 /* Ignore */
4545                 if (err == -ENOENT)
4546                         err = 0;
4547                 goto out;
4548         }
4549
4550         err = sock_has_perm(current, sk, perm);
4551 out:
4552         return err;
4553 }
4554
4555 #ifdef CONFIG_NETFILTER
4556
4557 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4558                                        u16 family)
4559 {
4560         int err;
4561         char *addrp;
4562         u32 peer_sid;
4563         struct common_audit_data ad;
4564         struct lsm_network_audit net = {0,};
4565         u8 secmark_active;
4566         u8 netlbl_active;
4567         u8 peerlbl_active;
4568
4569         if (!selinux_policycap_netpeer)
4570                 return NF_ACCEPT;
4571
4572         secmark_active = selinux_secmark_enabled();
4573         netlbl_active = netlbl_enabled();
4574         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4575         if (!secmark_active && !peerlbl_active)
4576                 return NF_ACCEPT;
4577
4578         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4579                 return NF_DROP;
4580
4581         ad.type = LSM_AUDIT_DATA_NET;
4582         ad.u.net = &net;
4583         ad.u.net->netif = ifindex;
4584         ad.u.net->family = family;
4585         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4586                 return NF_DROP;
4587
4588         if (peerlbl_active) {
4589                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4590                                                peer_sid, &ad);
4591                 if (err) {
4592                         selinux_netlbl_err(skb, err, 1);
4593                         return NF_DROP;
4594                 }
4595         }
4596
4597         if (secmark_active)
4598                 if (avc_has_perm(peer_sid, skb->secmark,
4599                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4600                         return NF_DROP;
4601
4602         if (netlbl_active)
4603                 /* we do this in the FORWARD path and not the POST_ROUTING
4604                  * path because we want to make sure we apply the necessary
4605                  * labeling before IPsec is applied so we can leverage AH
4606                  * protection */
4607                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4608                         return NF_DROP;
4609
4610         return NF_ACCEPT;
4611 }
4612
4613 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4614                                          struct sk_buff *skb,
4615                                          const struct net_device *in,
4616                                          const struct net_device *out,
4617                                          int (*okfn)(struct sk_buff *))
4618 {
4619         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4620 }
4621
4622 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4623 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4624                                          struct sk_buff *skb,
4625                                          const struct net_device *in,
4626                                          const struct net_device *out,
4627                                          int (*okfn)(struct sk_buff *))
4628 {
4629         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4630 }
4631 #endif  /* IPV6 */
4632
4633 static unsigned int selinux_ip_output(struct sk_buff *skb,
4634                                       u16 family)
4635 {
4636         u32 sid;
4637
4638         if (!netlbl_enabled())
4639                 return NF_ACCEPT;
4640
4641         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4642          * because we want to make sure we apply the necessary labeling
4643          * before IPsec is applied so we can leverage AH protection */
4644         if (skb->sk) {
4645                 struct sk_security_struct *sksec = skb->sk->sk_security;
4646                 sid = sksec->sid;
4647         } else
4648                 sid = SECINITSID_KERNEL;
4649         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4650                 return NF_DROP;
4651
4652         return NF_ACCEPT;
4653 }
4654
4655 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4656                                         struct sk_buff *skb,
4657                                         const struct net_device *in,
4658                                         const struct net_device *out,
4659                                         int (*okfn)(struct sk_buff *))
4660 {
4661         return selinux_ip_output(skb, PF_INET);
4662 }
4663
4664 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4665                                                 int ifindex,
4666                                                 u16 family)
4667 {
4668         struct sock *sk = skb->sk;
4669         struct sk_security_struct *sksec;
4670         struct common_audit_data ad;
4671         struct lsm_network_audit net = {0,};
4672         char *addrp;
4673         u8 proto;
4674
4675         if (sk == NULL)
4676                 return NF_ACCEPT;
4677         sksec = sk->sk_security;
4678
4679         ad.type = LSM_AUDIT_DATA_NET;
4680         ad.u.net = &net;
4681         ad.u.net->netif = ifindex;
4682         ad.u.net->family = family;
4683         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4684                 return NF_DROP;
4685
4686         if (selinux_secmark_enabled())
4687                 if (avc_has_perm(sksec->sid, skb->secmark,
4688                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4689                         return NF_DROP_ERR(-ECONNREFUSED);
4690
4691         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4692                 return NF_DROP_ERR(-ECONNREFUSED);
4693
4694         return NF_ACCEPT;
4695 }
4696
4697 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4698                                          u16 family)
4699 {
4700         u32 secmark_perm;
4701         u32 peer_sid;
4702         struct sock *sk;
4703         struct common_audit_data ad;
4704         struct lsm_network_audit net = {0,};
4705         char *addrp;
4706         u8 secmark_active;
4707         u8 peerlbl_active;
4708
4709         /* If any sort of compatibility mode is enabled then handoff processing
4710          * to the selinux_ip_postroute_compat() function to deal with the
4711          * special handling.  We do this in an attempt to keep this function
4712          * as fast and as clean as possible. */
4713         if (!selinux_policycap_netpeer)
4714                 return selinux_ip_postroute_compat(skb, ifindex, family);
4715 #ifdef CONFIG_XFRM
4716         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4717          * packet transformation so allow the packet to pass without any checks
4718          * since we'll have another chance to perform access control checks
4719          * when the packet is on it's final way out.
4720          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4721          *       is NULL, in this case go ahead and apply access control. */
4722         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4723                 return NF_ACCEPT;
4724 #endif
4725         secmark_active = selinux_secmark_enabled();
4726         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4727         if (!secmark_active && !peerlbl_active)
4728                 return NF_ACCEPT;
4729
4730         /* if the packet is being forwarded then get the peer label from the
4731          * packet itself; otherwise check to see if it is from a local
4732          * application or the kernel, if from an application get the peer label
4733          * from the sending socket, otherwise use the kernel's sid */
4734         sk = skb->sk;
4735         if (sk == NULL) {
4736                 if (skb->skb_iif) {
4737                         secmark_perm = PACKET__FORWARD_OUT;
4738                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4739                                 return NF_DROP;
4740                 } else {
4741                         secmark_perm = PACKET__SEND;
4742                         peer_sid = SECINITSID_KERNEL;
4743                 }
4744         } else {
4745                 struct sk_security_struct *sksec = sk->sk_security;
4746                 peer_sid = sksec->sid;
4747                 secmark_perm = PACKET__SEND;
4748         }
4749
4750         ad.type = LSM_AUDIT_DATA_NET;
4751         ad.u.net = &net;
4752         ad.u.net->netif = ifindex;
4753         ad.u.net->family = family;
4754         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4755                 return NF_DROP;
4756
4757         if (secmark_active)
4758                 if (avc_has_perm(peer_sid, skb->secmark,
4759                                  SECCLASS_PACKET, secmark_perm, &ad))
4760                         return NF_DROP_ERR(-ECONNREFUSED);
4761
4762         if (peerlbl_active) {
4763                 u32 if_sid;
4764                 u32 node_sid;
4765
4766                 if (sel_netif_sid(ifindex, &if_sid))
4767                         return NF_DROP;
4768                 if (avc_has_perm(peer_sid, if_sid,
4769                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4770                         return NF_DROP_ERR(-ECONNREFUSED);
4771
4772                 if (sel_netnode_sid(addrp, family, &node_sid))
4773                         return NF_DROP;
4774                 if (avc_has_perm(peer_sid, node_sid,
4775                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4776                         return NF_DROP_ERR(-ECONNREFUSED);
4777         }
4778
4779         return NF_ACCEPT;
4780 }
4781
4782 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4783                                            struct sk_buff *skb,
4784                                            const struct net_device *in,
4785                                            const struct net_device *out,
4786                                            int (*okfn)(struct sk_buff *))
4787 {
4788         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4789 }
4790
4791 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4792 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4793                                            struct sk_buff *skb,
4794                                            const struct net_device *in,
4795                                            const struct net_device *out,
4796                                            int (*okfn)(struct sk_buff *))
4797 {
4798         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4799 }
4800 #endif  /* IPV6 */
4801
4802 #endif  /* CONFIG_NETFILTER */
4803
4804 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4805 {
4806         int err;
4807
4808         err = cap_netlink_send(sk, skb);
4809         if (err)
4810                 return err;
4811
4812         return selinux_nlmsg_perm(sk, skb);
4813 }
4814
4815 static int ipc_alloc_security(struct task_struct *task,
4816                               struct kern_ipc_perm *perm,
4817                               u16 sclass)
4818 {
4819         struct ipc_security_struct *isec;
4820         u32 sid;
4821
4822         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4823         if (!isec)
4824                 return -ENOMEM;
4825
4826         sid = task_sid(task);
4827         isec->sclass = sclass;
4828         isec->sid = sid;
4829         perm->security = isec;
4830
4831         return 0;
4832 }
4833
4834 static void ipc_free_security(struct kern_ipc_perm *perm)
4835 {
4836         struct ipc_security_struct *isec = perm->security;
4837         perm->security = NULL;
4838         kfree(isec);
4839 }
4840
4841 static int msg_msg_alloc_security(struct msg_msg *msg)
4842 {
4843         struct msg_security_struct *msec;
4844
4845         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4846         if (!msec)
4847                 return -ENOMEM;
4848
4849         msec->sid = SECINITSID_UNLABELED;
4850         msg->security = msec;
4851
4852         return 0;
4853 }
4854
4855 static void msg_msg_free_security(struct msg_msg *msg)
4856 {
4857         struct msg_security_struct *msec = msg->security;
4858
4859         msg->security = NULL;
4860         kfree(msec);
4861 }
4862
4863 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4864                         u32 perms)
4865 {
4866         struct ipc_security_struct *isec;
4867         struct common_audit_data ad;
4868         u32 sid = current_sid();
4869
4870         isec = ipc_perms->security;
4871
4872         ad.type = LSM_AUDIT_DATA_IPC;
4873         ad.u.ipc_id = ipc_perms->key;
4874
4875         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4876 }
4877
4878 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4879 {
4880         return msg_msg_alloc_security(msg);
4881 }
4882
4883 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4884 {
4885         msg_msg_free_security(msg);
4886 }
4887
4888 /* message queue security operations */
4889 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4890 {
4891         struct ipc_security_struct *isec;
4892         struct common_audit_data ad;
4893         u32 sid = current_sid();
4894         int rc;
4895
4896         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4897         if (rc)
4898                 return rc;
4899
4900         isec = msq->q_perm.security;
4901
4902         ad.type = LSM_AUDIT_DATA_IPC;
4903         ad.u.ipc_id = msq->q_perm.key;
4904
4905         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4906                           MSGQ__CREATE, &ad);
4907         if (rc) {
4908                 ipc_free_security(&msq->q_perm);
4909                 return rc;
4910         }
4911         return 0;
4912 }
4913
4914 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4915 {
4916         ipc_free_security(&msq->q_perm);
4917 }
4918
4919 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4920 {
4921         struct ipc_security_struct *isec;
4922         struct common_audit_data ad;
4923         u32 sid = current_sid();
4924
4925         isec = msq->q_perm.security;
4926
4927         ad.type = LSM_AUDIT_DATA_IPC;
4928         ad.u.ipc_id = msq->q_perm.key;
4929
4930         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4931                             MSGQ__ASSOCIATE, &ad);
4932 }
4933
4934 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4935 {
4936         int err;
4937         int perms;
4938
4939         switch (cmd) {
4940         case IPC_INFO:
4941         case MSG_INFO:
4942                 /* No specific object, just general system-wide information. */
4943                 return task_has_system(current, SYSTEM__IPC_INFO);
4944         case IPC_STAT:
4945         case MSG_STAT:
4946                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4947                 break;
4948         case IPC_SET:
4949                 perms = MSGQ__SETATTR;
4950                 break;
4951         case IPC_RMID:
4952                 perms = MSGQ__DESTROY;
4953                 break;
4954         default:
4955                 return 0;
4956         }
4957
4958         err = ipc_has_perm(&msq->q_perm, perms);
4959         return err;
4960 }
4961
4962 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4963 {
4964         struct ipc_security_struct *isec;
4965         struct msg_security_struct *msec;
4966         struct common_audit_data ad;
4967         u32 sid = current_sid();
4968         int rc;
4969
4970         isec = msq->q_perm.security;
4971         msec = msg->security;
4972
4973         /*
4974          * First time through, need to assign label to the message
4975          */
4976         if (msec->sid == SECINITSID_UNLABELED) {
4977                 /*
4978                  * Compute new sid based on current process and
4979                  * message queue this message will be stored in
4980                  */
4981                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4982                                              NULL, &msec->sid);
4983                 if (rc)
4984                         return rc;
4985         }
4986
4987         ad.type = LSM_AUDIT_DATA_IPC;
4988         ad.u.ipc_id = msq->q_perm.key;
4989
4990         /* Can this process write to the queue? */
4991         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4992                           MSGQ__WRITE, &ad);
4993         if (!rc)
4994                 /* Can this process send the message */
4995                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4996                                   MSG__SEND, &ad);
4997         if (!rc)
4998                 /* Can the message be put in the queue? */
4999                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5000                                   MSGQ__ENQUEUE, &ad);
5001
5002         return rc;
5003 }
5004
5005 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5006                                     struct task_struct *target,
5007                                     long type, int mode)
5008 {
5009         struct ipc_security_struct *isec;
5010         struct msg_security_struct *msec;
5011         struct common_audit_data ad;
5012         u32 sid = task_sid(target);
5013         int rc;
5014
5015         isec = msq->q_perm.security;
5016         msec = msg->security;
5017
5018         ad.type = LSM_AUDIT_DATA_IPC;
5019         ad.u.ipc_id = msq->q_perm.key;
5020
5021         rc = avc_has_perm(sid, isec->sid,
5022                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5023         if (!rc)
5024                 rc = avc_has_perm(sid, msec->sid,
5025                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5026         return rc;
5027 }
5028
5029 /* Shared Memory security operations */
5030 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5031 {
5032         struct ipc_security_struct *isec;
5033         struct common_audit_data ad;
5034         u32 sid = current_sid();
5035         int rc;
5036
5037         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5038         if (rc)
5039                 return rc;
5040
5041         isec = shp->shm_perm.security;
5042
5043         ad.type = LSM_AUDIT_DATA_IPC;
5044         ad.u.ipc_id = shp->shm_perm.key;
5045
5046         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5047                           SHM__CREATE, &ad);
5048         if (rc) {
5049                 ipc_free_security(&shp->shm_perm);
5050                 return rc;
5051         }
5052         return 0;
5053 }
5054
5055 static void selinux_shm_free_security(struct shmid_kernel *shp)
5056 {
5057         ipc_free_security(&shp->shm_perm);
5058 }
5059
5060 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5061 {
5062         struct ipc_security_struct *isec;
5063         struct common_audit_data ad;
5064         u32 sid = current_sid();
5065
5066         isec = shp->shm_perm.security;
5067
5068         ad.type = LSM_AUDIT_DATA_IPC;
5069         ad.u.ipc_id = shp->shm_perm.key;
5070
5071         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5072                             SHM__ASSOCIATE, &ad);
5073 }
5074
5075 /* Note, at this point, shp is locked down */
5076 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5077 {
5078         int perms;
5079         int err;
5080
5081         switch (cmd) {
5082         case IPC_INFO:
5083         case SHM_INFO:
5084                 /* No specific object, just general system-wide information. */
5085                 return task_has_system(current, SYSTEM__IPC_INFO);
5086         case IPC_STAT:
5087         case SHM_STAT:
5088                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5089                 break;
5090         case IPC_SET:
5091                 perms = SHM__SETATTR;
5092                 break;
5093         case SHM_LOCK:
5094         case SHM_UNLOCK:
5095                 perms = SHM__LOCK;
5096                 break;
5097         case IPC_RMID:
5098                 perms = SHM__DESTROY;
5099                 break;
5100         default:
5101                 return 0;
5102         }
5103
5104         err = ipc_has_perm(&shp->shm_perm, perms);
5105         return err;
5106 }
5107
5108 static int selinux_shm_shmat(struct shmid_kernel *shp,
5109                              char __user *shmaddr, int shmflg)
5110 {
5111         u32 perms;
5112
5113         if (shmflg & SHM_RDONLY)
5114                 perms = SHM__READ;
5115         else
5116                 perms = SHM__READ | SHM__WRITE;
5117
5118         return ipc_has_perm(&shp->shm_perm, perms);
5119 }
5120
5121 /* Semaphore security operations */
5122 static int selinux_sem_alloc_security(struct sem_array *sma)
5123 {
5124         struct ipc_security_struct *isec;
5125         struct common_audit_data ad;
5126         u32 sid = current_sid();
5127         int rc;
5128
5129         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5130         if (rc)
5131                 return rc;
5132
5133         isec = sma->sem_perm.security;
5134
5135         ad.type = LSM_AUDIT_DATA_IPC;
5136         ad.u.ipc_id = sma->sem_perm.key;
5137
5138         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5139                           SEM__CREATE, &ad);
5140         if (rc) {
5141                 ipc_free_security(&sma->sem_perm);
5142                 return rc;
5143         }
5144         return 0;
5145 }
5146
5147 static void selinux_sem_free_security(struct sem_array *sma)
5148 {
5149         ipc_free_security(&sma->sem_perm);
5150 }
5151
5152 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5153 {
5154         struct ipc_security_struct *isec;
5155         struct common_audit_data ad;
5156         u32 sid = current_sid();
5157
5158         isec = sma->sem_perm.security;
5159
5160         ad.type = LSM_AUDIT_DATA_IPC;
5161         ad.u.ipc_id = sma->sem_perm.key;
5162
5163         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5164                             SEM__ASSOCIATE, &ad);
5165 }
5166
5167 /* Note, at this point, sma is locked down */
5168 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5169 {
5170         int err;
5171         u32 perms;
5172
5173         switch (cmd) {
5174         case IPC_INFO:
5175         case SEM_INFO:
5176                 /* No specific object, just general system-wide information. */
5177                 return task_has_system(current, SYSTEM__IPC_INFO);
5178         case GETPID:
5179         case GETNCNT:
5180         case GETZCNT:
5181                 perms = SEM__GETATTR;
5182                 break;
5183         case GETVAL:
5184         case GETALL:
5185                 perms = SEM__READ;
5186                 break;
5187         case SETVAL:
5188         case SETALL:
5189                 perms = SEM__WRITE;
5190                 break;
5191         case IPC_RMID:
5192                 perms = SEM__DESTROY;
5193                 break;
5194         case IPC_SET:
5195                 perms = SEM__SETATTR;
5196                 break;
5197         case IPC_STAT:
5198         case SEM_STAT:
5199                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5200                 break;
5201         default:
5202                 return 0;
5203         }
5204
5205         err = ipc_has_perm(&sma->sem_perm, perms);
5206         return err;
5207 }
5208
5209 static int selinux_sem_semop(struct sem_array *sma,
5210                              struct sembuf *sops, unsigned nsops, int alter)
5211 {
5212         u32 perms;
5213
5214         if (alter)
5215                 perms = SEM__READ | SEM__WRITE;
5216         else
5217                 perms = SEM__READ;
5218
5219         return ipc_has_perm(&sma->sem_perm, perms);
5220 }
5221
5222 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5223 {
5224         u32 av = 0;
5225
5226         av = 0;
5227         if (flag & S_IRUGO)
5228                 av |= IPC__UNIX_READ;
5229         if (flag & S_IWUGO)
5230                 av |= IPC__UNIX_WRITE;
5231
5232         if (av == 0)
5233                 return 0;
5234
5235         return ipc_has_perm(ipcp, av);
5236 }
5237
5238 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5239 {
5240         struct ipc_security_struct *isec = ipcp->security;
5241         *secid = isec->sid;
5242 }
5243
5244 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5245 {
5246         if (inode)
5247                 inode_doinit_with_dentry(inode, dentry);
5248 }
5249
5250 static int selinux_getprocattr(struct task_struct *p,
5251                                char *name, char **value)
5252 {
5253         const struct task_security_struct *__tsec;
5254         u32 sid;
5255         int error;
5256         unsigned len;
5257
5258         if (current != p) {
5259                 error = current_has_perm(p, PROCESS__GETATTR);
5260                 if (error)
5261                         return error;
5262         }
5263
5264         rcu_read_lock();
5265         __tsec = __task_cred(p)->security;
5266
5267         if (!strcmp(name, "current"))
5268                 sid = __tsec->sid;
5269         else if (!strcmp(name, "prev"))
5270                 sid = __tsec->osid;
5271         else if (!strcmp(name, "exec"))
5272                 sid = __tsec->exec_sid;
5273         else if (!strcmp(name, "fscreate"))
5274                 sid = __tsec->create_sid;
5275         else if (!strcmp(name, "keycreate"))
5276                 sid = __tsec->keycreate_sid;
5277         else if (!strcmp(name, "sockcreate"))
5278                 sid = __tsec->sockcreate_sid;
5279         else
5280                 goto invalid;
5281         rcu_read_unlock();
5282
5283         if (!sid)
5284                 return 0;
5285
5286         error = security_sid_to_context(sid, value, &len);
5287         if (error)
5288                 return error;
5289         return len;
5290
5291 invalid:
5292         rcu_read_unlock();
5293         return -EINVAL;
5294 }
5295
5296 static int selinux_setprocattr(struct task_struct *p,
5297                                char *name, void *value, size_t size)
5298 {
5299         struct task_security_struct *tsec;
5300         struct task_struct *tracer;
5301         struct cred *new;
5302         u32 sid = 0, ptsid;
5303         int error;
5304         char *str = value;
5305
5306         if (current != p) {
5307                 /* SELinux only allows a process to change its own
5308                    security attributes. */
5309                 return -EACCES;
5310         }
5311
5312         /*
5313          * Basic control over ability to set these attributes at all.
5314          * current == p, but we'll pass them separately in case the
5315          * above restriction is ever removed.
5316          */
5317         if (!strcmp(name, "exec"))
5318                 error = current_has_perm(p, PROCESS__SETEXEC);
5319         else if (!strcmp(name, "fscreate"))
5320                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5321         else if (!strcmp(name, "keycreate"))
5322                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5323         else if (!strcmp(name, "sockcreate"))
5324                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5325         else if (!strcmp(name, "current"))
5326                 error = current_has_perm(p, PROCESS__SETCURRENT);
5327         else
5328                 error = -EINVAL;
5329         if (error)
5330                 return error;
5331
5332         /* Obtain a SID for the context, if one was specified. */
5333         if (size && str[1] && str[1] != '\n') {
5334                 if (str[size-1] == '\n') {
5335                         str[size-1] = 0;
5336                         size--;
5337                 }
5338                 error = security_context_to_sid(value, size, &sid);
5339                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5340                         if (!capable(CAP_MAC_ADMIN)) {
5341                                 struct audit_buffer *ab;
5342                                 size_t audit_size;
5343
5344                                 /* We strip a nul only if it is at the end, otherwise the
5345                                  * context contains a nul and we should audit that */
5346                                 if (str[size - 1] == '\0')
5347                                         audit_size = size - 1;
5348                                 else
5349                                         audit_size = size;
5350                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5351                                 audit_log_format(ab, "op=fscreate invalid_context=");
5352                                 audit_log_n_untrustedstring(ab, value, audit_size);
5353                                 audit_log_end(ab);
5354
5355                                 return error;
5356                         }
5357                         error = security_context_to_sid_force(value, size,
5358                                                               &sid);
5359                 }
5360                 if (error)
5361                         return error;
5362         }
5363
5364         new = prepare_creds();
5365         if (!new)
5366                 return -ENOMEM;
5367
5368         /* Permission checking based on the specified context is
5369            performed during the actual operation (execve,
5370            open/mkdir/...), when we know the full context of the
5371            operation.  See selinux_bprm_set_creds for the execve
5372            checks and may_create for the file creation checks. The
5373            operation will then fail if the context is not permitted. */
5374         tsec = new->security;
5375         if (!strcmp(name, "exec")) {
5376                 tsec->exec_sid = sid;
5377         } else if (!strcmp(name, "fscreate")) {
5378                 tsec->create_sid = sid;
5379         } else if (!strcmp(name, "keycreate")) {
5380                 error = may_create_key(sid, p);
5381                 if (error)
5382                         goto abort_change;
5383                 tsec->keycreate_sid = sid;
5384         } else if (!strcmp(name, "sockcreate")) {
5385                 tsec->sockcreate_sid = sid;
5386         } else if (!strcmp(name, "current")) {
5387                 error = -EINVAL;
5388                 if (sid == 0)
5389                         goto abort_change;
5390
5391                 /* Only allow single threaded processes to change context */
5392                 error = -EPERM;
5393                 if (!current_is_single_threaded()) {
5394                         error = security_bounded_transition(tsec->sid, sid);
5395                         if (error)
5396                                 goto abort_change;
5397                 }
5398
5399                 /* Check permissions for the transition. */
5400                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5401                                      PROCESS__DYNTRANSITION, NULL);
5402                 if (error)
5403                         goto abort_change;
5404
5405                 /* Check for ptracing, and update the task SID if ok.
5406                    Otherwise, leave SID unchanged and fail. */
5407                 ptsid = 0;
5408                 task_lock(p);
5409                 tracer = ptrace_parent(p);
5410                 if (tracer)
5411                         ptsid = task_sid(tracer);
5412                 task_unlock(p);
5413
5414                 if (tracer) {
5415                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5416                                              PROCESS__PTRACE, NULL);
5417                         if (error)
5418                                 goto abort_change;
5419                 }
5420
5421                 tsec->sid = sid;
5422         } else {
5423                 error = -EINVAL;
5424                 goto abort_change;
5425         }
5426
5427         commit_creds(new);
5428         return size;
5429
5430 abort_change:
5431         abort_creds(new);
5432         return error;
5433 }
5434
5435 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5436 {
5437         return security_sid_to_context(secid, secdata, seclen);
5438 }
5439
5440 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5441 {
5442         return security_context_to_sid(secdata, seclen, secid);
5443 }
5444
5445 static void selinux_release_secctx(char *secdata, u32 seclen)
5446 {
5447         kfree(secdata);
5448 }
5449
5450 /*
5451  *      called with inode->i_mutex locked
5452  */
5453 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5454 {
5455         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5456 }
5457
5458 /*
5459  *      called with inode->i_mutex locked
5460  */
5461 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5462 {
5463         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5464 }
5465
5466 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5467 {
5468         int len = 0;
5469         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5470                                                 ctx, true);
5471         if (len < 0)
5472                 return len;
5473         *ctxlen = len;
5474         return 0;
5475 }
5476 #ifdef CONFIG_KEYS
5477
5478 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5479                              unsigned long flags)
5480 {
5481         const struct task_security_struct *tsec;
5482         struct key_security_struct *ksec;
5483
5484         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5485         if (!ksec)
5486                 return -ENOMEM;
5487
5488         tsec = cred->security;
5489         if (tsec->keycreate_sid)
5490                 ksec->sid = tsec->keycreate_sid;
5491         else
5492                 ksec->sid = tsec->sid;
5493
5494         k->security = ksec;
5495         return 0;
5496 }
5497
5498 static void selinux_key_free(struct key *k)
5499 {
5500         struct key_security_struct *ksec = k->security;
5501
5502         k->security = NULL;
5503         kfree(ksec);
5504 }
5505
5506 static int selinux_key_permission(key_ref_t key_ref,
5507                                   const struct cred *cred,
5508                                   key_perm_t perm)
5509 {
5510         struct key *key;
5511         struct key_security_struct *ksec;
5512         u32 sid;
5513
5514         /* if no specific permissions are requested, we skip the
5515            permission check. No serious, additional covert channels
5516            appear to be created. */
5517         if (perm == 0)
5518                 return 0;
5519
5520         sid = cred_sid(cred);
5521
5522         key = key_ref_to_ptr(key_ref);
5523         ksec = key->security;
5524
5525         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5526 }
5527
5528 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5529 {
5530         struct key_security_struct *ksec = key->security;
5531         char *context = NULL;
5532         unsigned len;
5533         int rc;
5534
5535         rc = security_sid_to_context(ksec->sid, &context, &len);
5536         if (!rc)
5537                 rc = len;
5538         *_buffer = context;
5539         return rc;
5540 }
5541
5542 #endif
5543
5544 static struct security_operations selinux_ops = {
5545         .name =                         "selinux",
5546
5547         .ptrace_access_check =          selinux_ptrace_access_check,
5548         .ptrace_traceme =               selinux_ptrace_traceme,
5549         .capget =                       selinux_capget,
5550         .capset =                       selinux_capset,
5551         .capable =                      selinux_capable,
5552         .quotactl =                     selinux_quotactl,
5553         .quota_on =                     selinux_quota_on,
5554         .syslog =                       selinux_syslog,
5555         .vm_enough_memory =             selinux_vm_enough_memory,
5556
5557         .netlink_send =                 selinux_netlink_send,
5558
5559         .bprm_set_creds =               selinux_bprm_set_creds,
5560         .bprm_committing_creds =        selinux_bprm_committing_creds,
5561         .bprm_committed_creds =         selinux_bprm_committed_creds,
5562         .bprm_secureexec =              selinux_bprm_secureexec,
5563
5564         .sb_alloc_security =            selinux_sb_alloc_security,
5565         .sb_free_security =             selinux_sb_free_security,
5566         .sb_copy_data =                 selinux_sb_copy_data,
5567         .sb_remount =                   selinux_sb_remount,
5568         .sb_kern_mount =                selinux_sb_kern_mount,
5569         .sb_show_options =              selinux_sb_show_options,
5570         .sb_statfs =                    selinux_sb_statfs,
5571         .sb_mount =                     selinux_mount,
5572         .sb_umount =                    selinux_umount,
5573         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5574         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5575         .sb_parse_opts_str =            selinux_parse_opts_str,
5576
5577
5578         .inode_alloc_security =         selinux_inode_alloc_security,
5579         .inode_free_security =          selinux_inode_free_security,
5580         .inode_init_security =          selinux_inode_init_security,
5581         .inode_create =                 selinux_inode_create,
5582         .inode_link =                   selinux_inode_link,
5583         .inode_unlink =                 selinux_inode_unlink,
5584         .inode_symlink =                selinux_inode_symlink,
5585         .inode_mkdir =                  selinux_inode_mkdir,
5586         .inode_rmdir =                  selinux_inode_rmdir,
5587         .inode_mknod =                  selinux_inode_mknod,
5588         .inode_rename =                 selinux_inode_rename,
5589         .inode_readlink =               selinux_inode_readlink,
5590         .inode_follow_link =            selinux_inode_follow_link,
5591         .inode_permission =             selinux_inode_permission,
5592         .inode_setattr =                selinux_inode_setattr,
5593         .inode_getattr =                selinux_inode_getattr,
5594         .inode_setxattr =               selinux_inode_setxattr,
5595         .inode_post_setxattr =          selinux_inode_post_setxattr,
5596         .inode_getxattr =               selinux_inode_getxattr,
5597         .inode_listxattr =              selinux_inode_listxattr,
5598         .inode_removexattr =            selinux_inode_removexattr,
5599         .inode_getsecurity =            selinux_inode_getsecurity,
5600         .inode_setsecurity =            selinux_inode_setsecurity,
5601         .inode_listsecurity =           selinux_inode_listsecurity,
5602         .inode_getsecid =               selinux_inode_getsecid,
5603
5604         .file_permission =              selinux_file_permission,
5605         .file_alloc_security =          selinux_file_alloc_security,
5606         .file_free_security =           selinux_file_free_security,
5607         .file_ioctl =                   selinux_file_ioctl,
5608         .mmap_file =                    selinux_mmap_file,
5609         .mmap_addr =                    selinux_mmap_addr,
5610         .file_mprotect =                selinux_file_mprotect,
5611         .file_lock =                    selinux_file_lock,
5612         .file_fcntl =                   selinux_file_fcntl,
5613         .file_set_fowner =              selinux_file_set_fowner,
5614         .file_send_sigiotask =          selinux_file_send_sigiotask,
5615         .file_receive =                 selinux_file_receive,
5616
5617         .file_open =                    selinux_file_open,
5618
5619         .task_create =                  selinux_task_create,
5620         .cred_alloc_blank =             selinux_cred_alloc_blank,
5621         .cred_free =                    selinux_cred_free,
5622         .cred_prepare =                 selinux_cred_prepare,
5623         .cred_transfer =                selinux_cred_transfer,
5624         .kernel_act_as =                selinux_kernel_act_as,
5625         .kernel_create_files_as =       selinux_kernel_create_files_as,
5626         .kernel_module_request =        selinux_kernel_module_request,
5627         .task_setpgid =                 selinux_task_setpgid,
5628         .task_getpgid =                 selinux_task_getpgid,
5629         .task_getsid =                  selinux_task_getsid,
5630         .task_getsecid =                selinux_task_getsecid,
5631         .task_setnice =                 selinux_task_setnice,
5632         .task_setioprio =               selinux_task_setioprio,
5633         .task_getioprio =               selinux_task_getioprio,
5634         .task_setrlimit =               selinux_task_setrlimit,
5635         .task_setscheduler =            selinux_task_setscheduler,
5636         .task_getscheduler =            selinux_task_getscheduler,
5637         .task_movememory =              selinux_task_movememory,
5638         .task_kill =                    selinux_task_kill,
5639         .task_wait =                    selinux_task_wait,
5640         .task_to_inode =                selinux_task_to_inode,
5641
5642         .ipc_permission =               selinux_ipc_permission,
5643         .ipc_getsecid =                 selinux_ipc_getsecid,
5644
5645         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5646         .msg_msg_free_security =        selinux_msg_msg_free_security,
5647
5648         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5649         .msg_queue_free_security =      selinux_msg_queue_free_security,
5650         .msg_queue_associate =          selinux_msg_queue_associate,
5651         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5652         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5653         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5654
5655         .shm_alloc_security =           selinux_shm_alloc_security,
5656         .shm_free_security =            selinux_shm_free_security,
5657         .shm_associate =                selinux_shm_associate,
5658         .shm_shmctl =                   selinux_shm_shmctl,
5659         .shm_shmat =                    selinux_shm_shmat,
5660
5661         .sem_alloc_security =           selinux_sem_alloc_security,
5662         .sem_free_security =            selinux_sem_free_security,
5663         .sem_associate =                selinux_sem_associate,
5664         .sem_semctl =                   selinux_sem_semctl,
5665         .sem_semop =                    selinux_sem_semop,
5666
5667         .d_instantiate =                selinux_d_instantiate,
5668
5669         .getprocattr =                  selinux_getprocattr,
5670         .setprocattr =                  selinux_setprocattr,
5671
5672         .secid_to_secctx =              selinux_secid_to_secctx,
5673         .secctx_to_secid =              selinux_secctx_to_secid,
5674         .release_secctx =               selinux_release_secctx,
5675         .inode_notifysecctx =           selinux_inode_notifysecctx,
5676         .inode_setsecctx =              selinux_inode_setsecctx,
5677         .inode_getsecctx =              selinux_inode_getsecctx,
5678
5679         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5680         .unix_may_send =                selinux_socket_unix_may_send,
5681
5682         .socket_create =                selinux_socket_create,
5683         .socket_post_create =           selinux_socket_post_create,
5684         .socket_bind =                  selinux_socket_bind,
5685         .socket_connect =               selinux_socket_connect,
5686         .socket_listen =                selinux_socket_listen,
5687         .socket_accept =                selinux_socket_accept,
5688         .socket_sendmsg =               selinux_socket_sendmsg,
5689         .socket_recvmsg =               selinux_socket_recvmsg,
5690         .socket_getsockname =           selinux_socket_getsockname,
5691         .socket_getpeername =           selinux_socket_getpeername,
5692         .socket_getsockopt =            selinux_socket_getsockopt,
5693         .socket_setsockopt =            selinux_socket_setsockopt,
5694         .socket_shutdown =              selinux_socket_shutdown,
5695         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5696         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5697         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5698         .sk_alloc_security =            selinux_sk_alloc_security,
5699         .sk_free_security =             selinux_sk_free_security,
5700         .sk_clone_security =            selinux_sk_clone_security,
5701         .sk_getsecid =                  selinux_sk_getsecid,
5702         .sock_graft =                   selinux_sock_graft,
5703         .inet_conn_request =            selinux_inet_conn_request,
5704         .inet_csk_clone =               selinux_inet_csk_clone,
5705         .inet_conn_established =        selinux_inet_conn_established,
5706         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5707         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5708         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5709         .req_classify_flow =            selinux_req_classify_flow,
5710         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5711         .tun_dev_free_security =        selinux_tun_dev_free_security,
5712         .tun_dev_create =               selinux_tun_dev_create,
5713         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5714         .tun_dev_attach =               selinux_tun_dev_attach,
5715         .tun_dev_open =                 selinux_tun_dev_open,
5716         .skb_owned_by =                 selinux_skb_owned_by,
5717
5718 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5719         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5720         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5721         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5722         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5723         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5724         .xfrm_state_free_security =     selinux_xfrm_state_free,
5725         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5726         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5727         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5728         .xfrm_decode_session =          selinux_xfrm_decode_session,
5729 #endif
5730
5731 #ifdef CONFIG_KEYS
5732         .key_alloc =                    selinux_key_alloc,
5733         .key_free =                     selinux_key_free,
5734         .key_permission =               selinux_key_permission,
5735         .key_getsecurity =              selinux_key_getsecurity,
5736 #endif
5737
5738 #ifdef CONFIG_AUDIT
5739         .audit_rule_init =              selinux_audit_rule_init,
5740         .audit_rule_known =             selinux_audit_rule_known,
5741         .audit_rule_match =             selinux_audit_rule_match,
5742         .audit_rule_free =              selinux_audit_rule_free,
5743 #endif
5744 };
5745
5746 static __init int selinux_init(void)
5747 {
5748         if (!security_module_enable(&selinux_ops)) {
5749                 selinux_enabled = 0;
5750                 return 0;
5751         }
5752
5753         if (!selinux_enabled) {
5754                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5755                 return 0;
5756         }
5757
5758         printk(KERN_INFO "SELinux:  Initializing.\n");
5759
5760         /* Set the security state for the initial task. */
5761         cred_init_security();
5762
5763         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5764
5765         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5766                                             sizeof(struct inode_security_struct),
5767                                             0, SLAB_PANIC, NULL);
5768         avc_init();
5769
5770         if (register_security(&selinux_ops))
5771                 panic("SELinux: Unable to register with kernel.\n");
5772
5773         if (selinux_enforcing)
5774                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5775         else
5776                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5777
5778         return 0;
5779 }
5780
5781 static void delayed_superblock_init(struct super_block *sb, void *unused)
5782 {
5783         superblock_doinit(sb, NULL);
5784 }
5785
5786 void selinux_complete_init(void)
5787 {
5788         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5789
5790         /* Set up any superblocks initialized prior to the policy load. */
5791         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5792         iterate_supers(delayed_superblock_init, NULL);
5793 }
5794
5795 /* SELinux requires early initialization in order to label
5796    all processes and objects when they are created. */
5797 security_initcall(selinux_init);
5798
5799 #if defined(CONFIG_NETFILTER)
5800
5801 static struct nf_hook_ops selinux_ipv4_ops[] = {
5802         {
5803                 .hook =         selinux_ipv4_postroute,
5804                 .owner =        THIS_MODULE,
5805                 .pf =           NFPROTO_IPV4,
5806                 .hooknum =      NF_INET_POST_ROUTING,
5807                 .priority =     NF_IP_PRI_SELINUX_LAST,
5808         },
5809         {
5810                 .hook =         selinux_ipv4_forward,
5811                 .owner =        THIS_MODULE,
5812                 .pf =           NFPROTO_IPV4,
5813                 .hooknum =      NF_INET_FORWARD,
5814                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5815         },
5816         {
5817                 .hook =         selinux_ipv4_output,
5818                 .owner =        THIS_MODULE,
5819                 .pf =           NFPROTO_IPV4,
5820                 .hooknum =      NF_INET_LOCAL_OUT,
5821                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5822         }
5823 };
5824
5825 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5826
5827 static struct nf_hook_ops selinux_ipv6_ops[] = {
5828         {
5829                 .hook =         selinux_ipv6_postroute,
5830                 .owner =        THIS_MODULE,
5831                 .pf =           NFPROTO_IPV6,
5832                 .hooknum =      NF_INET_POST_ROUTING,
5833                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5834         },
5835         {
5836                 .hook =         selinux_ipv6_forward,
5837                 .owner =        THIS_MODULE,
5838                 .pf =           NFPROTO_IPV6,
5839                 .hooknum =      NF_INET_FORWARD,
5840                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5841         }
5842 };
5843
5844 #endif  /* IPV6 */
5845
5846 static int __init selinux_nf_ip_init(void)
5847 {
5848         int err = 0;
5849
5850         if (!selinux_enabled)
5851                 goto out;
5852
5853         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5854
5855         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5856         if (err)
5857                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5858
5859 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5860         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5861         if (err)
5862                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5863 #endif  /* IPV6 */
5864
5865 out:
5866         return err;
5867 }
5868
5869 __initcall(selinux_nf_ip_init);
5870
5871 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5872 static void selinux_nf_ip_exit(void)
5873 {
5874         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5875
5876         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5877 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5878         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5879 #endif  /* IPV6 */
5880 }
5881 #endif
5882
5883 #else /* CONFIG_NETFILTER */
5884
5885 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5886 #define selinux_nf_ip_exit()
5887 #endif
5888
5889 #endif /* CONFIG_NETFILTER */
5890
5891 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5892 static int selinux_disabled;
5893
5894 int selinux_disable(void)
5895 {
5896         if (ss_initialized) {
5897                 /* Not permitted after initial policy load. */
5898                 return -EINVAL;
5899         }
5900
5901         if (selinux_disabled) {
5902                 /* Only do this once. */
5903                 return -EINVAL;
5904         }
5905
5906         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5907
5908         selinux_disabled = 1;
5909         selinux_enabled = 0;
5910
5911         reset_security_ops();
5912
5913         /* Try to destroy the avc node cache */
5914         avc_disable();
5915
5916         /* Unregister netfilter hooks. */
5917         selinux_nf_ip_exit();
5918
5919         /* Unregister selinuxfs. */
5920         exit_sel_fs();
5921
5922         return 0;
5923 }
5924 #endif