Pileus Git - ~andy/linux/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/security.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88
  89 #include "avc.h"
  90 #include "objsec.h"
  91 #include "netif.h"
  92 #include "netnode.h"
  93 #include "netport.h"
  94 #include "xfrm.h"
  95 #include "netlabel.h"
  96 #include "audit.h"
  97 #include "avc_ss.h"
  98
  99 #define NUM_SEL_MNT_OPTS 5
 100
 101 extern struct security_operations *security_ops;
 102
 103 /* SECMARK reference count */
 104 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 105
 106 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 107 int selinux_enforcing;
 108
 109 static int __init enforcing_setup(char *str)
 110 {
 111         unsigned long enforcing;
 112         if (!strict_strtoul(str, 0, &enforcing))
 113                 selinux_enforcing = enforcing ? 1 : 0;
 114         return 1;
 115 }
 116 __setup("enforcing=", enforcing_setup);
 117 #endif
 118
 119 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 120 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 121
 122 static int __init selinux_enabled_setup(char *str)
 123 {
 124         unsigned long enabled;
 125         if (!strict_strtoul(str, 0, &enabled))
 126                 selinux_enabled = enabled ? 1 : 0;
 127         return 1;
 128 }
 129 __setup("selinux=", selinux_enabled_setup);
 130 #else
 131 int selinux_enabled = 1;
 132 #endif
 133
 134 static struct kmem_cache *sel_inode_cache;
 135
 136 /**
 137  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 138  *
 139  * Description:
 140  * This function checks the SECMARK reference counter to see if any SECMARK
 141  * targets are currently configured, if the reference counter is greater than
 142  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 143  * enabled, false (0) if SECMARK is disabled.
 144  *
 145  */
 146 static int selinux_secmark_enabled(void)
 147 {
 148         return (atomic_read(&selinux_secmark_refcount) > 0);
 149 }
 150
 151 /*
 152  * initialise the security for the init task
 153  */
 154 static void cred_init_security(void)
 155 {
 156         struct cred *cred = (struct cred *) current->real_cred;
 157         struct task_security_struct *tsec;
 158
 159         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 160         if (!tsec)
 161                 panic("SELinux:  Failed to initialize initial task.\n");
 162
 163         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 164         cred->security = tsec;
 165 }
 166
 167 /*
 168  * get the security ID of a set of credentials
 169  */
 170 static inline u32 cred_sid(const struct cred *cred)
 171 {
 172         const struct task_security_struct *tsec;
 173
 174         tsec = cred->security;
 175         return tsec->sid;
 176 }
 177
 178 /*
 179  * get the objective security ID of a task
 180  */
 181 static inline u32 task_sid(const struct task_struct *task)
 182 {
 183         u32 sid;
 184
 185         rcu_read_lock();
 186         sid = cred_sid(__task_cred(task));
 187         rcu_read_unlock();
 188         return sid;
 189 }
 190
 191 /*
 192  * get the subjective security ID of the current task
 193  */
 194 static inline u32 current_sid(void)
 195 {
 196         const struct task_security_struct *tsec = current_security();
 197
 198         return tsec->sid;
 199 }
 200
 201 /* Allocate and free functions for each kind of security blob. */
 202
 203 static int inode_alloc_security(struct inode *inode)
 204 {
 205         struct inode_security_struct *isec;
 206         u32 sid = current_sid();
 207
 208         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 209         if (!isec)
 210                 return -ENOMEM;
 211
 212         mutex_init(&isec->lock);
 213         INIT_LIST_HEAD(&isec->list);
 214         isec->inode = inode;
 215         isec->sid = SECINITSID_UNLABELED;
 216         isec->sclass = SECCLASS_FILE;
 217         isec->task_sid = sid;
 218         inode->i_security = isec;
 219
 220         return 0;
 221 }
 222
 223 static void inode_free_security(struct inode *inode)
 224 {
 225         struct inode_security_struct *isec = inode->i_security;
 226         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 227
 228         spin_lock(&sbsec->isec_lock);
 229         if (!list_empty(&isec->list))
 230                 list_del_init(&isec->list);
 231         spin_unlock(&sbsec->isec_lock);
 232
 233         inode->i_security = NULL;
 234         kmem_cache_free(sel_inode_cache, isec);
 235 }
 236
 237 static int file_alloc_security(struct file *file)
 238 {
 239         struct file_security_struct *fsec;
 240         u32 sid = current_sid();
 241
 242         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 243         if (!fsec)
 244                 return -ENOMEM;
 245
 246         fsec->sid = sid;
 247         fsec->fown_sid = sid;
 248         file->f_security = fsec;
 249
 250         return 0;
 251 }
 252
 253 static void file_free_security(struct file *file)
 254 {
 255         struct file_security_struct *fsec = file->f_security;
 256         file->f_security = NULL;
 257         kfree(fsec);
 258 }
 259
 260 static int superblock_alloc_security(struct super_block *sb)
 261 {
 262         struct superblock_security_struct *sbsec;
 263
 264         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 265         if (!sbsec)
 266                 return -ENOMEM;
 267
 268         mutex_init(&sbsec->lock);
 269         INIT_LIST_HEAD(&sbsec->isec_head);
 270         spin_lock_init(&sbsec->isec_lock);
 271         sbsec->sb = sb;
 272         sbsec->sid = SECINITSID_UNLABELED;
 273         sbsec->def_sid = SECINITSID_FILE;
 274         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 275         sb->s_security = sbsec;
 276
 277         return 0;
 278 }
 279
 280 static void superblock_free_security(struct super_block *sb)
 281 {
 282         struct superblock_security_struct *sbsec = sb->s_security;
 283         sb->s_security = NULL;
 284         kfree(sbsec);
 285 }
 286
 287 /* The file system's label must be initialized prior to use. */
 288
 289 static const char *labeling_behaviors[7] = {
 290         "uses xattr",
 291         "uses transition SIDs",
 292         "uses task SIDs",
 293         "uses genfs_contexts",
 294         "not configured for labeling",
 295         "uses mountpoint labeling",
 296         "uses native labeling",
 297 };
 298
 299 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 300
 301 static inline int inode_doinit(struct inode *inode)
 302 {
 303         return inode_doinit_with_dentry(inode, NULL);
 304 }
 305
 306 enum {
 307         Opt_error = -1,
 308         Opt_context = 1,
 309         Opt_fscontext = 2,
 310         Opt_defcontext = 3,
 311         Opt_rootcontext = 4,
 312         Opt_labelsupport = 5,
 313 };
 314
 315 static const match_table_t tokens = {
 316         {Opt_context, CONTEXT_STR "%s"},
 317         {Opt_fscontext, FSCONTEXT_STR "%s"},
 318         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 319         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 320         {Opt_labelsupport, LABELSUPP_STR},
 321         {Opt_error, NULL},
 322 };
 323
 324 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 325
 326 static int may_context_mount_sb_relabel(u32 sid,
 327                         struct superblock_security_struct *sbsec,
 328                         const struct cred *cred)
 329 {
 330         const struct task_security_struct *tsec = cred->security;
 331         int rc;
 332
 333         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 334                           FILESYSTEM__RELABELFROM, NULL);
 335         if (rc)
 336                 return rc;
 337
 338         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 339                           FILESYSTEM__RELABELTO, NULL);
 340         return rc;
 341 }
 342
 343 static int may_context_mount_inode_relabel(u32 sid,
 344                         struct superblock_security_struct *sbsec,
 345                         const struct cred *cred)
 346 {
 347         const struct task_security_struct *tsec = cred->security;
 348         int rc;
 349         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 350                           FILESYSTEM__RELABELFROM, NULL);
 351         if (rc)
 352                 return rc;
 353
 354         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 355                           FILESYSTEM__ASSOCIATE, NULL);
 356         return rc;
 357 }
 358
 359 static int sb_finish_set_opts(struct super_block *sb)
 360 {
 361         struct superblock_security_struct *sbsec = sb->s_security;
 362         struct dentry *root = sb->s_root;
 363         struct inode *root_inode = root->d_inode;
 364         int rc = 0;
 365
 366         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 367                 /* Make sure that the xattr handler exists and that no
 368                    error other than -ENODATA is returned by getxattr on
 369                    the root directory.  -ENODATA is ok, as this may be
 370                    the first boot of the SELinux kernel before we have
 371                    assigned xattr values to the filesystem. */
 372                 if (!root_inode->i_op->getxattr) {
 373                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 374                                "xattr support\n", sb->s_id, sb->s_type->name);
 375                         rc = -EOPNOTSUPP;
 376                         goto out;
 377                 }
 378                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 379                 if (rc < 0 && rc != -ENODATA) {
 380                         if (rc == -EOPNOTSUPP)
 381                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 382                                        "%s) has no security xattr handler\n",
 383                                        sb->s_id, sb->s_type->name);
 384                         else
 385                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 386                                        "%s) getxattr errno %d\n", sb->s_id,
 387                                        sb->s_type->name, -rc);
 388                         goto out;
 389                 }
 390         }
 391
 392         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 393
 394         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 395                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 396                        sb->s_id, sb->s_type->name);
 397         else
 398                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 399                        sb->s_id, sb->s_type->name,
 400                        labeling_behaviors[sbsec->behavior-1]);
 401
 402         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 403             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 404             sbsec->behavior == SECURITY_FS_USE_NONE ||
 405             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 406                 sbsec->flags &= ~SE_SBLABELSUPP;
 407
 408         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 409         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 410                 sbsec->flags |= SE_SBLABELSUPP;
 411
 412         /* Initialize the root inode. */
 413         rc = inode_doinit_with_dentry(root_inode, root);
 414
 415         /* Initialize any other inodes associated with the superblock, e.g.
 416            inodes created prior to initial policy load or inodes created
 417            during get_sb by a pseudo filesystem that directly
 418            populates itself. */
 419         spin_lock(&sbsec->isec_lock);
 420 next_inode:
 421         if (!list_empty(&sbsec->isec_head)) {
 422                 struct inode_security_struct *isec =
 423                                 list_entry(sbsec->isec_head.next,
 424                                            struct inode_security_struct, list);
 425                 struct inode *inode = isec->inode;
 426                 spin_unlock(&sbsec->isec_lock);
 427                 inode = igrab(inode);
 428                 if (inode) {
 429                         if (!IS_PRIVATE(inode))
 430                                 inode_doinit(inode);
 431                         iput(inode);
 432                 }
 433                 spin_lock(&sbsec->isec_lock);
 434                 list_del_init(&isec->list);
 435                 goto next_inode;
 436         }
 437         spin_unlock(&sbsec->isec_lock);
 438 out:
 439         return rc;
 440 }
 441
 442 /*
 443  * This function should allow an FS to ask what it's mount security
 444  * options were so it can use those later for submounts, displaying
 445  * mount options, or whatever.
 446  */
 447 static int selinux_get_mnt_opts(const struct super_block *sb,
 448                                 struct security_mnt_opts *opts)
 449 {
 450         int rc = 0, i;
 451         struct superblock_security_struct *sbsec = sb->s_security;
 452         char *context = NULL;
 453         u32 len;
 454         char tmp;
 455
 456         security_init_mnt_opts(opts);
 457
 458         if (!(sbsec->flags & SE_SBINITIALIZED))
 459                 return -EINVAL;
 460
 461         if (!ss_initialized)
 462                 return -EINVAL;
 463
 464         tmp = sbsec->flags & SE_MNTMASK;
 465         /* count the number of mount options for this sb */
 466         for (i = 0; i < 8; i++) {
 467                 if (tmp & 0x01)
 468                         opts->num_mnt_opts++;
 469                 tmp >>= 1;
 470         }
 471         /* Check if the Label support flag is set */
 472         if (sbsec->flags & SE_SBLABELSUPP)
 473                 opts->num_mnt_opts++;
 474
 475         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 476         if (!opts->mnt_opts) {
 477                 rc = -ENOMEM;
 478                 goto out_free;
 479         }
 480
 481         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 482         if (!opts->mnt_opts_flags) {
 483                 rc = -ENOMEM;
 484                 goto out_free;
 485         }
 486
 487         i = 0;
 488         if (sbsec->flags & FSCONTEXT_MNT) {
 489                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 490                 if (rc)
 491                         goto out_free;
 492                 opts->mnt_opts[i] = context;
 493                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 494         }
 495         if (sbsec->flags & CONTEXT_MNT) {
 496                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 497                 if (rc)
 498                         goto out_free;
 499                 opts->mnt_opts[i] = context;
 500                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 501         }
 502         if (sbsec->flags & DEFCONTEXT_MNT) {
 503                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 504                 if (rc)
 505                         goto out_free;
 506                 opts->mnt_opts[i] = context;
 507                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 508         }
 509         if (sbsec->flags & ROOTCONTEXT_MNT) {
 510                 struct inode *root = sbsec->sb->s_root->d_inode;
 511                 struct inode_security_struct *isec = root->i_security;
 512
 513                 rc = security_sid_to_context(isec->sid, &context, &len);
 514                 if (rc)
 515                         goto out_free;
 516                 opts->mnt_opts[i] = context;
 517                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 518         }
 519         if (sbsec->flags & SE_SBLABELSUPP) {
 520                 opts->mnt_opts[i] = NULL;
 521                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 522         }
 523
 524         BUG_ON(i != opts->num_mnt_opts);
 525
 526         return 0;
 527
 528 out_free:
 529         security_free_mnt_opts(opts);
 530         return rc;
 531 }
 532
 533 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 534                       u32 old_sid, u32 new_sid)
 535 {
 536         char mnt_flags = sbsec->flags & SE_MNTMASK;
 537
 538         /* check if the old mount command had the same options */
 539         if (sbsec->flags & SE_SBINITIALIZED)
 540                 if (!(sbsec->flags & flag) ||
 541                     (old_sid != new_sid))
 542                         return 1;
 543
 544         /* check if we were passed the same options twice,
 545          * aka someone passed context=a,context=b
 546          */
 547         if (!(sbsec->flags & SE_SBINITIALIZED))
 548                 if (mnt_flags & flag)
 549                         return 1;
 550         return 0;
 551 }
 552
 553 /*
 554  * Allow filesystems with binary mount data to explicitly set mount point
 555  * labeling information.
 556  */
 557 static int selinux_set_mnt_opts(struct super_block *sb,
 558                                 struct security_mnt_opts *opts,
 559                                 unsigned long kern_flags,
 560                                 unsigned long *set_kern_flags)
 561 {
 562         const struct cred *cred = current_cred();
 563         int rc = 0, i;
 564         struct superblock_security_struct *sbsec = sb->s_security;
 565         const char *name = sb->s_type->name;
 566         struct inode *inode = sbsec->sb->s_root->d_inode;
 567         struct inode_security_struct *root_isec = inode->i_security;
 568         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 569         u32 defcontext_sid = 0;
 570         char **mount_options = opts->mnt_opts;
 571         int *flags = opts->mnt_opts_flags;
 572         int num_opts = opts->num_mnt_opts;
 573
 574         mutex_lock(&sbsec->lock);
 575
 576         if (!ss_initialized) {
 577                 if (!num_opts) {
 578                         /* Defer initialization until selinux_complete_init,
 579                            after the initial policy is loaded and the security
 580                            server is ready to handle calls. */
 581                         goto out;
 582                 }
 583                 rc = -EINVAL;
 584                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 585                         "before the security server is initialized\n");
 586                 goto out;
 587         }
 588         if (kern_flags && !set_kern_flags) {
 589                 /* Specifying internal flags without providing a place to
 590                  * place the results is not allowed */
 591                 rc = -EINVAL;
 592                 goto out;
 593         }
 594
 595         /*
 596          * Binary mount data FS will come through this function twice.  Once
 597          * from an explicit call and once from the generic calls from the vfs.
 598          * Since the generic VFS calls will not contain any security mount data
 599          * we need to skip the double mount verification.
 600          *
 601          * This does open a hole in which we will not notice if the first
 602          * mount using this sb set explict options and a second mount using
 603          * this sb does not set any security options.  (The first options
 604          * will be used for both mounts)
 605          */
 606         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 607             && (num_opts == 0))
 608                 goto out;
 609
 610         /*
 611          * parse the mount options, check if they are valid sids.
 612          * also check if someone is trying to mount the same sb more
 613          * than once with different security options.
 614          */
 615         for (i = 0; i < num_opts; i++) {
 616                 u32 sid;
 617
 618                 if (flags[i] == SE_SBLABELSUPP)
 619                         continue;
 620                 rc = security_context_to_sid(mount_options[i],
 621                                              strlen(mount_options[i]), &sid);
 622                 if (rc) {
 623                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 624                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 625                                mount_options[i], sb->s_id, name, rc);
 626                         goto out;
 627                 }
 628                 switch (flags[i]) {
 629                 case FSCONTEXT_MNT:
 630                         fscontext_sid = sid;
 631
 632                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 633                                         fscontext_sid))
 634                                 goto out_double_mount;
 635
 636                         sbsec->flags |= FSCONTEXT_MNT;
 637                         break;
 638                 case CONTEXT_MNT:
 639                         context_sid = sid;
 640
 641                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 642                                         context_sid))
 643                                 goto out_double_mount;
 644
 645                         sbsec->flags |= CONTEXT_MNT;
 646                         break;
 647                 case ROOTCONTEXT_MNT:
 648                         rootcontext_sid = sid;
 649
 650                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 651                                         rootcontext_sid))
 652                                 goto out_double_mount;
 653
 654                         sbsec->flags |= ROOTCONTEXT_MNT;
 655
 656                         break;
 657                 case DEFCONTEXT_MNT:
 658                         defcontext_sid = sid;
 659
 660                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 661                                         defcontext_sid))
 662                                 goto out_double_mount;
 663
 664                         sbsec->flags |= DEFCONTEXT_MNT;
 665
 666                         break;
 667                 default:
 668                         rc = -EINVAL;
 669                         goto out;
 670                 }
 671         }
 672
 673         if (sbsec->flags & SE_SBINITIALIZED) {
 674                 /* previously mounted with options, but not on this attempt? */
 675                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 676                         goto out_double_mount;
 677                 rc = 0;
 678                 goto out;
 679         }
 680
 681         if (strcmp(sb->s_type->name, "proc") == 0)
 682                 sbsec->flags |= SE_SBPROC;
 683
 684         if (!sbsec->behavior) {
 685                 /*
 686                  * Determine the labeling behavior to use for this
 687                  * filesystem type.
 688                  */
 689                 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
 690                                         "proc" : sb->s_type->name,
 691                                         &sbsec->behavior, &sbsec->sid);
 692                 if (rc) {
 693                         printk(KERN_WARNING
 694                                 "%s: security_fs_use(%s) returned %d\n",
 695                                         __func__, sb->s_type->name, rc);
 696                         goto out;
 697                 }
 698         }
 699         /* sets the context of the superblock for the fs being mounted. */
 700         if (fscontext_sid) {
 701                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 702                 if (rc)
 703                         goto out;
 704
 705                 sbsec->sid = fscontext_sid;
 706         }
 707
 708         /*
 709          * Switch to using mount point labeling behavior.
 710          * sets the label used on all file below the mountpoint, and will set
 711          * the superblock context if not already set.
 712          */
 713         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 714                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 715                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 716         }
 717
 718         if (context_sid) {
 719                 if (!fscontext_sid) {
 720                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 721                                                           cred);
 722                         if (rc)
 723                                 goto out;
 724                         sbsec->sid = context_sid;
 725                 } else {
 726                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 727                                                              cred);
 728                         if (rc)
 729                                 goto out;
 730                 }
 731                 if (!rootcontext_sid)
 732                         rootcontext_sid = context_sid;
 733
 734                 sbsec->mntpoint_sid = context_sid;
 735                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 736         }
 737
 738         if (rootcontext_sid) {
 739                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 740                                                      cred);
 741                 if (rc)
 742                         goto out;
 743
 744                 root_isec->sid = rootcontext_sid;
 745                 root_isec->initialized = 1;
 746         }
 747
 748         if (defcontext_sid) {
 749                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 750                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 751                         rc = -EINVAL;
 752                         printk(KERN_WARNING "SELinux: defcontext option is "
 753                                "invalid for this filesystem type\n");
 754                         goto out;
 755                 }
 756
 757                 if (defcontext_sid != sbsec->def_sid) {
 758                         rc = may_context_mount_inode_relabel(defcontext_sid,
 759                                                              sbsec, cred);
 760                         if (rc)
 761                                 goto out;
 762                 }
 763
 764                 sbsec->def_sid = defcontext_sid;
 765         }
 766
 767         rc = sb_finish_set_opts(sb);
 768 out:
 769         mutex_unlock(&sbsec->lock);
 770         return rc;
 771 out_double_mount:
 772         rc = -EINVAL;
 773         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 774                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 775         goto out;
 776 }
 777
 778 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 779                                     const struct super_block *newsb)
 780 {
 781         struct superblock_security_struct *old = oldsb->s_security;
 782         struct superblock_security_struct *new = newsb->s_security;
 783         char oldflags = old->flags & SE_MNTMASK;
 784         char newflags = new->flags & SE_MNTMASK;
 785
 786         if (oldflags != newflags)
 787                 goto mismatch;
 788         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 789                 goto mismatch;
 790         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 791                 goto mismatch;
 792         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 793                 goto mismatch;
 794         if (oldflags & ROOTCONTEXT_MNT) {
 795                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 796                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 797                 if (oldroot->sid != newroot->sid)
 798                         goto mismatch;
 799         }
 800         return 0;
 801 mismatch:
 802         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 803                             "different security settings for (dev %s, "
 804                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 805         return -EBUSY;
 806 }
 807
 808 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 809                                         struct super_block *newsb)
 810 {
 811         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 812         struct superblock_security_struct *newsbsec = newsb->s_security;
 813
 814         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 815         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 816         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 817
 818         /*
 819          * if the parent was able to be mounted it clearly had no special lsm
 820          * mount options.  thus we can safely deal with this superblock later
 821          */
 822         if (!ss_initialized)
 823                 return 0;
 824
 825         /* how can we clone if the old one wasn't set up?? */
 826         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 827
 828         /* if fs is reusing a sb, make sure that the contexts match */
 829         if (newsbsec->flags & SE_SBINITIALIZED)
 830                 return selinux_cmp_sb_context(oldsb, newsb);
 831
 832         mutex_lock(&newsbsec->lock);
 833
 834         newsbsec->flags = oldsbsec->flags;
 835
 836         newsbsec->sid = oldsbsec->sid;
 837         newsbsec->def_sid = oldsbsec->def_sid;
 838         newsbsec->behavior = oldsbsec->behavior;
 839
 840         if (set_context) {
 841                 u32 sid = oldsbsec->mntpoint_sid;
 842
 843                 if (!set_fscontext)
 844                         newsbsec->sid = sid;
 845                 if (!set_rootcontext) {
 846                         struct inode *newinode = newsb->s_root->d_inode;
 847                         struct inode_security_struct *newisec = newinode->i_security;
 848                         newisec->sid = sid;
 849                 }
 850                 newsbsec->mntpoint_sid = sid;
 851         }
 852         if (set_rootcontext) {
 853                 const struct inode *oldinode = oldsb->s_root->d_inode;
 854                 const struct inode_security_struct *oldisec = oldinode->i_security;
 855                 struct inode *newinode = newsb->s_root->d_inode;
 856                 struct inode_security_struct *newisec = newinode->i_security;
 857
 858                 newisec->sid = oldisec->sid;
 859         }
 860
 861         sb_finish_set_opts(newsb);
 862         mutex_unlock(&newsbsec->lock);
 863         return 0;
 864 }
 865
 866 static int selinux_parse_opts_str(char *options,
 867                                   struct security_mnt_opts *opts)
 868 {
 869         char *p;
 870         char *context = NULL, *defcontext = NULL;
 871         char *fscontext = NULL, *rootcontext = NULL;
 872         int rc, num_mnt_opts = 0;
 873
 874         opts->num_mnt_opts = 0;
 875
 876         /* Standard string-based options. */
 877         while ((p = strsep(&options, "|")) != NULL) {
 878                 int token;
 879                 substring_t args[MAX_OPT_ARGS];
 880
 881                 if (!*p)
 882                         continue;
 883
 884                 token = match_token(p, tokens, args);
 885
 886                 switch (token) {
 887                 case Opt_context:
 888                         if (context || defcontext) {
 889                                 rc = -EINVAL;
 890                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 891                                 goto out_err;
 892                         }
 893                         context = match_strdup(&args[0]);
 894                         if (!context) {
 895                                 rc = -ENOMEM;
 896                                 goto out_err;
 897                         }
 898                         break;
 899
 900                 case Opt_fscontext:
 901                         if (fscontext) {
 902                                 rc = -EINVAL;
 903                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 904                                 goto out_err;
 905                         }
 906                         fscontext = match_strdup(&args[0]);
 907                         if (!fscontext) {
 908                                 rc = -ENOMEM;
 909                                 goto out_err;
 910                         }
 911                         break;
 912
 913                 case Opt_rootcontext:
 914                         if (rootcontext) {
 915                                 rc = -EINVAL;
 916                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 917                                 goto out_err;
 918                         }
 919                         rootcontext = match_strdup(&args[0]);
 920                         if (!rootcontext) {
 921                                 rc = -ENOMEM;
 922                                 goto out_err;
 923                         }
 924                         break;
 925
 926                 case Opt_defcontext:
 927                         if (context || defcontext) {
 928                                 rc = -EINVAL;
 929                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 930                                 goto out_err;
 931                         }
 932                         defcontext = match_strdup(&args[0]);
 933                         if (!defcontext) {
 934                                 rc = -ENOMEM;
 935                                 goto out_err;
 936                         }
 937                         break;
 938                 case Opt_labelsupport:
 939                         break;
 940                 default:
 941                         rc = -EINVAL;
 942                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 943                         goto out_err;
 944
 945                 }
 946         }
 947
 948         rc = -ENOMEM;
 949         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 950         if (!opts->mnt_opts)
 951                 goto out_err;
 952
 953         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 954         if (!opts->mnt_opts_flags) {
 955                 kfree(opts->mnt_opts);
 956                 goto out_err;
 957         }
 958
 959         if (fscontext) {
 960                 opts->mnt_opts[num_mnt_opts] = fscontext;
 961                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 962         }
 963         if (context) {
 964                 opts->mnt_opts[num_mnt_opts] = context;
 965                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 966         }
 967         if (rootcontext) {
 968                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 969                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 970         }
 971         if (defcontext) {
 972                 opts->mnt_opts[num_mnt_opts] = defcontext;
 973                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 974         }
 975
 976         opts->num_mnt_opts = num_mnt_opts;
 977         return 0;
 978
 979 out_err:
 980         kfree(context);
 981         kfree(defcontext);
 982         kfree(fscontext);
 983         kfree(rootcontext);
 984         return rc;
 985 }
 986 /*
 987  * string mount options parsing and call set the sbsec
 988  */
 989 static int superblock_doinit(struct super_block *sb, void *data)
 990 {
 991         int rc = 0;
 992         char *options = data;
 993         struct security_mnt_opts opts;
 994
 995         security_init_mnt_opts(&opts);
 996
 997         if (!data)
 998                 goto out;
 999
1000         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1001
1002         rc = selinux_parse_opts_str(options, &opts);
1003         if (rc)
1004                 goto out_err;
1005
1006 out:
1007         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1008
1009 out_err:
1010         security_free_mnt_opts(&opts);
1011         return rc;
1012 }
1013
1014 static void selinux_write_opts(struct seq_file *m,
1015                                struct security_mnt_opts *opts)
1016 {
1017         int i;
1018         char *prefix;
1019
1020         for (i = 0; i < opts->num_mnt_opts; i++) {
1021                 char *has_comma;
1022
1023                 if (opts->mnt_opts[i])
1024                         has_comma = strchr(opts->mnt_opts[i], ',');
1025                 else
1026                         has_comma = NULL;
1027
1028                 switch (opts->mnt_opts_flags[i]) {
1029                 case CONTEXT_MNT:
1030                         prefix = CONTEXT_STR;
1031                         break;
1032                 case FSCONTEXT_MNT:
1033                         prefix = FSCONTEXT_STR;
1034                         break;
1035                 case ROOTCONTEXT_MNT:
1036                         prefix = ROOTCONTEXT_STR;
1037                         break;
1038                 case DEFCONTEXT_MNT:
1039                         prefix = DEFCONTEXT_STR;
1040                         break;
1041                 case SE_SBLABELSUPP:
1042                         seq_putc(m, ',');
1043                         seq_puts(m, LABELSUPP_STR);
1044                         continue;
1045                 default:
1046                         BUG();
1047                         return;
1048                 };
1049                 /* we need a comma before each option */
1050                 seq_putc(m, ',');
1051                 seq_puts(m, prefix);
1052                 if (has_comma)
1053                         seq_putc(m, '\"');
1054                 seq_puts(m, opts->mnt_opts[i]);
1055                 if (has_comma)
1056                         seq_putc(m, '\"');
1057         }
1058 }
1059
1060 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1061 {
1062         struct security_mnt_opts opts;
1063         int rc;
1064
1065         rc = selinux_get_mnt_opts(sb, &opts);
1066         if (rc) {
1067                 /* before policy load we may get EINVAL, don't show anything */
1068                 if (rc == -EINVAL)
1069                         rc = 0;
1070                 return rc;
1071         }
1072
1073         selinux_write_opts(m, &opts);
1074
1075         security_free_mnt_opts(&opts);
1076
1077         return rc;
1078 }
1079
1080 static inline u16 inode_mode_to_security_class(umode_t mode)
1081 {
1082         switch (mode & S_IFMT) {
1083         case S_IFSOCK:
1084                 return SECCLASS_SOCK_FILE;
1085         case S_IFLNK:
1086                 return SECCLASS_LNK_FILE;
1087         case S_IFREG:
1088                 return SECCLASS_FILE;
1089         case S_IFBLK:
1090                 return SECCLASS_BLK_FILE;
1091         case S_IFDIR:
1092                 return SECCLASS_DIR;
1093         case S_IFCHR:
1094                 return SECCLASS_CHR_FILE;
1095         case S_IFIFO:
1096                 return SECCLASS_FIFO_FILE;
1097
1098         }
1099
1100         return SECCLASS_FILE;
1101 }
1102
1103 static inline int default_protocol_stream(int protocol)
1104 {
1105         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1106 }
1107
1108 static inline int default_protocol_dgram(int protocol)
1109 {
1110         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1111 }
1112
1113 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1114 {
1115         switch (family) {
1116         case PF_UNIX:
1117                 switch (type) {
1118                 case SOCK_STREAM:
1119                 case SOCK_SEQPACKET:
1120                         return SECCLASS_UNIX_STREAM_SOCKET;
1121                 case SOCK_DGRAM:
1122                         return SECCLASS_UNIX_DGRAM_SOCKET;
1123                 }
1124                 break;
1125         case PF_INET:
1126         case PF_INET6:
1127                 switch (type) {
1128                 case SOCK_STREAM:
1129                         if (default_protocol_stream(protocol))
1130                                 return SECCLASS_TCP_SOCKET;
1131                         else
1132                                 return SECCLASS_RAWIP_SOCKET;
1133                 case SOCK_DGRAM:
1134                         if (default_protocol_dgram(protocol))
1135                                 return SECCLASS_UDP_SOCKET;
1136                         else
1137                                 return SECCLASS_RAWIP_SOCKET;
1138                 case SOCK_DCCP:
1139                         return SECCLASS_DCCP_SOCKET;
1140                 default:
1141                         return SECCLASS_RAWIP_SOCKET;
1142                 }
1143                 break;
1144         case PF_NETLINK:
1145                 switch (protocol) {
1146                 case NETLINK_ROUTE:
1147                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1148                 case NETLINK_FIREWALL:
1149                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1150                 case NETLINK_SOCK_DIAG:
1151                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1152                 case NETLINK_NFLOG:
1153                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1154                 case NETLINK_XFRM:
1155                         return SECCLASS_NETLINK_XFRM_SOCKET;
1156                 case NETLINK_SELINUX:
1157                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1158                 case NETLINK_AUDIT:
1159                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1160                 case NETLINK_IP6_FW:
1161                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1162                 case NETLINK_DNRTMSG:
1163                         return SECCLASS_NETLINK_DNRT_SOCKET;
1164                 case NETLINK_KOBJECT_UEVENT:
1165                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1166                 default:
1167                         return SECCLASS_NETLINK_SOCKET;
1168                 }
1169         case PF_PACKET:
1170                 return SECCLASS_PACKET_SOCKET;
1171         case PF_KEY:
1172                 return SECCLASS_KEY_SOCKET;
1173         case PF_APPLETALK:
1174                 return SECCLASS_APPLETALK_SOCKET;
1175         }
1176
1177         return SECCLASS_SOCKET;
1178 }
1179
1180 #ifdef CONFIG_PROC_FS
1181 static int selinux_proc_get_sid(struct dentry *dentry,
1182                                 u16 tclass,
1183                                 u32 *sid)
1184 {
1185         int rc;
1186         char *buffer, *path;
1187
1188         buffer = (char *)__get_free_page(GFP_KERNEL);
1189         if (!buffer)
1190                 return -ENOMEM;
1191
1192         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1193         if (IS_ERR(path))
1194                 rc = PTR_ERR(path);
1195         else {
1196                 /* each process gets a /proc/PID/ entry. Strip off the
1197                  * PID part to get a valid selinux labeling.
1198                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1199                 while (path[1] >= '0' && path[1] <= '9') {
1200                         path[1] = '/';
1201                         path++;
1202                 }
1203                 rc = security_genfs_sid("proc", path, tclass, sid);
1204         }
1205         free_page((unsigned long)buffer);
1206         return rc;
1207 }
1208 #else
1209 static int selinux_proc_get_sid(struct dentry *dentry,
1210                                 u16 tclass,
1211                                 u32 *sid)
1212 {
1213         return -EINVAL;
1214 }
1215 #endif
1216
1217 /* The inode's security attributes must be initialized before first use. */
1218 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1219 {
1220         struct superblock_security_struct *sbsec = NULL;
1221         struct inode_security_struct *isec = inode->i_security;
1222         u32 sid;
1223         struct dentry *dentry;
1224 #define INITCONTEXTLEN 255
1225         char *context = NULL;
1226         unsigned len = 0;
1227         int rc = 0;
1228
1229         if (isec->initialized)
1230                 goto out;
1231
1232         mutex_lock(&isec->lock);
1233         if (isec->initialized)
1234                 goto out_unlock;
1235
1236         sbsec = inode->i_sb->s_security;
1237         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1238                 /* Defer initialization until selinux_complete_init,
1239                    after the initial policy is loaded and the security
1240                    server is ready to handle calls. */
1241                 spin_lock(&sbsec->isec_lock);
1242                 if (list_empty(&isec->list))
1243                         list_add(&isec->list, &sbsec->isec_head);
1244                 spin_unlock(&sbsec->isec_lock);
1245                 goto out_unlock;
1246         }
1247
1248         switch (sbsec->behavior) {
1249         case SECURITY_FS_USE_NATIVE:
1250                 break;
1251         case SECURITY_FS_USE_XATTR:
1252                 if (!inode->i_op->getxattr) {
1253                         isec->sid = sbsec->def_sid;
1254                         break;
1255                 }
1256
1257                 /* Need a dentry, since the xattr API requires one.
1258                    Life would be simpler if we could just pass the inode. */
1259                 if (opt_dentry) {
1260                         /* Called from d_instantiate or d_splice_alias. */
1261                         dentry = dget(opt_dentry);
1262                 } else {
1263                         /* Called from selinux_complete_init, try to find a dentry. */
1264                         dentry = d_find_alias(inode);
1265                 }
1266                 if (!dentry) {
1267                         /*
1268                          * this is can be hit on boot when a file is accessed
1269                          * before the policy is loaded.  When we load policy we
1270                          * may find inodes that have no dentry on the
1271                          * sbsec->isec_head list.  No reason to complain as these
1272                          * will get fixed up the next time we go through
1273                          * inode_doinit with a dentry, before these inodes could
1274                          * be used again by userspace.
1275                          */
1276                         goto out_unlock;
1277                 }
1278
1279                 len = INITCONTEXTLEN;
1280                 context = kmalloc(len+1, GFP_NOFS);
1281                 if (!context) {
1282                         rc = -ENOMEM;
1283                         dput(dentry);
1284                         goto out_unlock;
1285                 }
1286                 context[len] = '\0';
1287                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1288                                            context, len);
1289                 if (rc == -ERANGE) {
1290                         kfree(context);
1291
1292                         /* Need a larger buffer.  Query for the right size. */
1293                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1294                                                    NULL, 0);
1295                         if (rc < 0) {
1296                                 dput(dentry);
1297                                 goto out_unlock;
1298                         }
1299                         len = rc;
1300                         context = kmalloc(len+1, GFP_NOFS);
1301                         if (!context) {
1302                                 rc = -ENOMEM;
1303                                 dput(dentry);
1304                                 goto out_unlock;
1305                         }
1306                         context[len] = '\0';
1307                         rc = inode->i_op->getxattr(dentry,
1308                                                    XATTR_NAME_SELINUX,
1309                                                    context, len);
1310                 }
1311                 dput(dentry);
1312                 if (rc < 0) {
1313                         if (rc != -ENODATA) {
1314                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1315                                        "%d for dev=%s ino=%ld\n", __func__,
1316                                        -rc, inode->i_sb->s_id, inode->i_ino);
1317                                 kfree(context);
1318                                 goto out_unlock;
1319                         }
1320                         /* Map ENODATA to the default file SID */
1321                         sid = sbsec->def_sid;
1322                         rc = 0;
1323                 } else {
1324                         rc = security_context_to_sid_default(context, rc, &sid,
1325                                                              sbsec->def_sid,
1326                                                              GFP_NOFS);
1327                         if (rc) {
1328                                 char *dev = inode->i_sb->s_id;
1329                                 unsigned long ino = inode->i_ino;
1330
1331                                 if (rc == -EINVAL) {
1332                                         if (printk_ratelimit())
1333                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1334                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1335                                                         "filesystem in question.\n", ino, dev, context);
1336                                 } else {
1337                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1338                                                "returned %d for dev=%s ino=%ld\n",
1339                                                __func__, context, -rc, dev, ino);
1340                                 }
1341                                 kfree(context);
1342                                 /* Leave with the unlabeled SID */
1343                                 rc = 0;
1344                                 break;
1345                         }
1346                 }
1347                 kfree(context);
1348                 isec->sid = sid;
1349                 break;
1350         case SECURITY_FS_USE_TASK:
1351                 isec->sid = isec->task_sid;
1352                 break;
1353         case SECURITY_FS_USE_TRANS:
1354                 /* Default to the fs SID. */
1355                 isec->sid = sbsec->sid;
1356
1357                 /* Try to obtain a transition SID. */
1358                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1359                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1360                                              isec->sclass, NULL, &sid);
1361                 if (rc)
1362                         goto out_unlock;
1363                 isec->sid = sid;
1364                 break;
1365         case SECURITY_FS_USE_MNTPOINT:
1366                 isec->sid = sbsec->mntpoint_sid;
1367                 break;
1368         default:
1369                 /* Default to the fs superblock SID. */
1370                 isec->sid = sbsec->sid;
1371
1372                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1373                         if (opt_dentry) {
1374                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1375                                 rc = selinux_proc_get_sid(opt_dentry,
1376                                                           isec->sclass,
1377                                                           &sid);
1378                                 if (rc)
1379                                         goto out_unlock;
1380                                 isec->sid = sid;
1381                         }
1382                 }
1383                 break;
1384         }
1385
1386         isec->initialized = 1;
1387
1388 out_unlock:
1389         mutex_unlock(&isec->lock);
1390 out:
1391         if (isec->sclass == SECCLASS_FILE)
1392                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1393         return rc;
1394 }
1395
1396 /* Convert a Linux signal to an access vector. */
1397 static inline u32 signal_to_av(int sig)
1398 {
1399         u32 perm = 0;
1400
1401         switch (sig) {
1402         case SIGCHLD:
1403                 /* Commonly granted from child to parent. */
1404                 perm = PROCESS__SIGCHLD;
1405                 break;
1406         case SIGKILL:
1407                 /* Cannot be caught or ignored */
1408                 perm = PROCESS__SIGKILL;
1409                 break;
1410         case SIGSTOP:
1411                 /* Cannot be caught or ignored */
1412                 perm = PROCESS__SIGSTOP;
1413                 break;
1414         default:
1415                 /* All other signals. */
1416                 perm = PROCESS__SIGNAL;
1417                 break;
1418         }
1419
1420         return perm;
1421 }
1422
1423 /*
1424  * Check permission between a pair of credentials
1425  * fork check, ptrace check, etc.
1426  */
1427 static int cred_has_perm(const struct cred *actor,
1428                          const struct cred *target,
1429                          u32 perms)
1430 {
1431         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1432
1433         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1434 }
1435
1436 /*
1437  * Check permission between a pair of tasks, e.g. signal checks,
1438  * fork check, ptrace check, etc.
1439  * tsk1 is the actor and tsk2 is the target
1440  * - this uses the default subjective creds of tsk1
1441  */
1442 static int task_has_perm(const struct task_struct *tsk1,
1443                          const struct task_struct *tsk2,
1444                          u32 perms)
1445 {
1446         const struct task_security_struct *__tsec1, *__tsec2;
1447         u32 sid1, sid2;
1448
1449         rcu_read_lock();
1450         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1451         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1452         rcu_read_unlock();
1453         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1454 }
1455
1456 /*
1457  * Check permission between current and another task, e.g. signal checks,
1458  * fork check, ptrace check, etc.
1459  * current is the actor and tsk2 is the target
1460  * - this uses current's subjective creds
1461  */
1462 static int current_has_perm(const struct task_struct *tsk,
1463                             u32 perms)
1464 {
1465         u32 sid, tsid;
1466
1467         sid = current_sid();
1468         tsid = task_sid(tsk);
1469         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1470 }
1471
1472 #if CAP_LAST_CAP > 63
1473 #error Fix SELinux to handle capabilities > 63.
1474 #endif
1475
1476 /* Check whether a task is allowed to use a capability. */
1477 static int cred_has_capability(const struct cred *cred,
1478                                int cap, int audit)
1479 {
1480         struct common_audit_data ad;
1481         struct av_decision avd;
1482         u16 sclass;
1483         u32 sid = cred_sid(cred);
1484         u32 av = CAP_TO_MASK(cap);
1485         int rc;
1486
1487         ad.type = LSM_AUDIT_DATA_CAP;
1488         ad.u.cap = cap;
1489
1490         switch (CAP_TO_INDEX(cap)) {
1491         case 0:
1492                 sclass = SECCLASS_CAPABILITY;
1493                 break;
1494         case 1:
1495                 sclass = SECCLASS_CAPABILITY2;
1496                 break;
1497         default:
1498                 printk(KERN_ERR
1499                        "SELinux:  out of range capability %d\n", cap);
1500                 BUG();
1501                 return -EINVAL;
1502         }
1503
1504         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1505         if (audit == SECURITY_CAP_AUDIT) {
1506                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1507                 if (rc2)
1508                         return rc2;
1509         }
1510         return rc;
1511 }
1512
1513 /* Check whether a task is allowed to use a system operation. */
1514 static int task_has_system(struct task_struct *tsk,
1515                            u32 perms)
1516 {
1517         u32 sid = task_sid(tsk);
1518
1519         return avc_has_perm(sid, SECINITSID_KERNEL,
1520                             SECCLASS_SYSTEM, perms, NULL);
1521 }
1522
1523 /* Check whether a task has a particular permission to an inode.
1524    The 'adp' parameter is optional and allows other audit
1525    data to be passed (e.g. the dentry). */
1526 static int inode_has_perm(const struct cred *cred,
1527                           struct inode *inode,
1528                           u32 perms,
1529                           struct common_audit_data *adp)
1530 {
1531         struct inode_security_struct *isec;
1532         u32 sid;
1533
1534         validate_creds(cred);
1535
1536         if (unlikely(IS_PRIVATE(inode)))
1537                 return 0;
1538
1539         sid = cred_sid(cred);
1540         isec = inode->i_security;
1541
1542         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1543 }
1544
1545 /* Same as inode_has_perm, but pass explicit audit data containing
1546    the dentry to help the auditing code to more easily generate the
1547    pathname if needed. */
1548 static inline int dentry_has_perm(const struct cred *cred,
1549                                   struct dentry *dentry,
1550                                   u32 av)
1551 {
1552         struct inode *inode = dentry->d_inode;
1553         struct common_audit_data ad;
1554
1555         ad.type = LSM_AUDIT_DATA_DENTRY;
1556         ad.u.dentry = dentry;
1557         return inode_has_perm(cred, inode, av, &ad);
1558 }
1559
1560 /* Same as inode_has_perm, but pass explicit audit data containing
1561    the path to help the auditing code to more easily generate the
1562    pathname if needed. */
1563 static inline int path_has_perm(const struct cred *cred,
1564                                 struct path *path,
1565                                 u32 av)
1566 {
1567         struct inode *inode = path->dentry->d_inode;
1568         struct common_audit_data ad;
1569
1570         ad.type = LSM_AUDIT_DATA_PATH;
1571         ad.u.path = *path;
1572         return inode_has_perm(cred, inode, av, &ad);
1573 }
1574
1575 /* Same as path_has_perm, but uses the inode from the file struct. */
1576 static inline int file_path_has_perm(const struct cred *cred,
1577                                      struct file *file,
1578                                      u32 av)
1579 {
1580         struct common_audit_data ad;
1581
1582         ad.type = LSM_AUDIT_DATA_PATH;
1583         ad.u.path = file->f_path;
1584         return inode_has_perm(cred, file_inode(file), av, &ad);
1585 }
1586
1587 /* Check whether a task can use an open file descriptor to
1588    access an inode in a given way.  Check access to the
1589    descriptor itself, and then use dentry_has_perm to
1590    check a particular permission to the file.
1591    Access to the descriptor is implicitly granted if it
1592    has the same SID as the process.  If av is zero, then
1593    access to the file is not checked, e.g. for cases
1594    where only the descriptor is affected like seek. */
1595 static int file_has_perm(const struct cred *cred,
1596                          struct file *file,
1597                          u32 av)
1598 {
1599         struct file_security_struct *fsec = file->f_security;
1600         struct inode *inode = file_inode(file);
1601         struct common_audit_data ad;
1602         u32 sid = cred_sid(cred);
1603         int rc;
1604
1605         ad.type = LSM_AUDIT_DATA_PATH;
1606         ad.u.path = file->f_path;
1607
1608         if (sid != fsec->sid) {
1609                 rc = avc_has_perm(sid, fsec->sid,
1610                                   SECCLASS_FD,
1611                                   FD__USE,
1612                                   &ad);
1613                 if (rc)
1614                         goto out;
1615         }
1616
1617         /* av is zero if only checking access to the descriptor. */
1618         rc = 0;
1619         if (av)
1620                 rc = inode_has_perm(cred, inode, av, &ad);
1621
1622 out:
1623         return rc;
1624 }
1625
1626 /* Check whether a task can create a file. */
1627 static int may_create(struct inode *dir,
1628                       struct dentry *dentry,
1629                       u16 tclass)
1630 {
1631         const struct task_security_struct *tsec = current_security();
1632         struct inode_security_struct *dsec;
1633         struct superblock_security_struct *sbsec;
1634         u32 sid, newsid;
1635         struct common_audit_data ad;
1636         int rc;
1637
1638         dsec = dir->i_security;
1639         sbsec = dir->i_sb->s_security;
1640
1641         sid = tsec->sid;
1642         newsid = tsec->create_sid;
1643
1644         ad.type = LSM_AUDIT_DATA_DENTRY;
1645         ad.u.dentry = dentry;
1646
1647         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1648                           DIR__ADD_NAME | DIR__SEARCH,
1649                           &ad);
1650         if (rc)
1651                 return rc;
1652
1653         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1654                 rc = security_transition_sid(sid, dsec->sid, tclass,
1655                                              &dentry->d_name, &newsid);
1656                 if (rc)
1657                         return rc;
1658         }
1659
1660         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1661         if (rc)
1662                 return rc;
1663
1664         return avc_has_perm(newsid, sbsec->sid,
1665                             SECCLASS_FILESYSTEM,
1666                             FILESYSTEM__ASSOCIATE, &ad);
1667 }
1668
1669 /* Check whether a task can create a key. */
1670 static int may_create_key(u32 ksid,
1671                           struct task_struct *ctx)
1672 {
1673         u32 sid = task_sid(ctx);
1674
1675         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1676 }
1677
1678 #define MAY_LINK        0
1679 #define MAY_UNLINK      1
1680 #define MAY_RMDIR       2
1681
1682 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1683 static int may_link(struct inode *dir,
1684                     struct dentry *dentry,
1685                     int kind)
1686
1687 {
1688         struct inode_security_struct *dsec, *isec;
1689         struct common_audit_data ad;
1690         u32 sid = current_sid();
1691         u32 av;
1692         int rc;
1693
1694         dsec = dir->i_security;
1695         isec = dentry->d_inode->i_security;
1696
1697         ad.type = LSM_AUDIT_DATA_DENTRY;
1698         ad.u.dentry = dentry;
1699
1700         av = DIR__SEARCH;
1701         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1702         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1703         if (rc)
1704                 return rc;
1705
1706         switch (kind) {
1707         case MAY_LINK:
1708                 av = FILE__LINK;
1709                 break;
1710         case MAY_UNLINK:
1711                 av = FILE__UNLINK;
1712                 break;
1713         case MAY_RMDIR:
1714                 av = DIR__RMDIR;
1715                 break;
1716         default:
1717                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1718                         __func__, kind);
1719                 return 0;
1720         }
1721
1722         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1723         return rc;
1724 }
1725
1726 static inline int may_rename(struct inode *old_dir,
1727                              struct dentry *old_dentry,
1728                              struct inode *new_dir,
1729                              struct dentry *new_dentry)
1730 {
1731         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1732         struct common_audit_data ad;
1733         u32 sid = current_sid();
1734         u32 av;
1735         int old_is_dir, new_is_dir;
1736         int rc;
1737
1738         old_dsec = old_dir->i_security;
1739         old_isec = old_dentry->d_inode->i_security;
1740         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1741         new_dsec = new_dir->i_security;
1742
1743         ad.type = LSM_AUDIT_DATA_DENTRY;
1744
1745         ad.u.dentry = old_dentry;
1746         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1747                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1748         if (rc)
1749                 return rc;
1750         rc = avc_has_perm(sid, old_isec->sid,
1751                           old_isec->sclass, FILE__RENAME, &ad);
1752         if (rc)
1753                 return rc;
1754         if (old_is_dir && new_dir != old_dir) {
1755                 rc = avc_has_perm(sid, old_isec->sid,
1756                                   old_isec->sclass, DIR__REPARENT, &ad);
1757                 if (rc)
1758                         return rc;
1759         }
1760
1761         ad.u.dentry = new_dentry;
1762         av = DIR__ADD_NAME | DIR__SEARCH;
1763         if (new_dentry->d_inode)
1764                 av |= DIR__REMOVE_NAME;
1765         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1766         if (rc)
1767                 return rc;
1768         if (new_dentry->d_inode) {
1769                 new_isec = new_dentry->d_inode->i_security;
1770                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1771                 rc = avc_has_perm(sid, new_isec->sid,
1772                                   new_isec->sclass,
1773                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1774                 if (rc)
1775                         return rc;
1776         }
1777
1778         return 0;
1779 }
1780
1781 /* Check whether a task can perform a filesystem operation. */
1782 static int superblock_has_perm(const struct cred *cred,
1783                                struct super_block *sb,
1784                                u32 perms,
1785                                struct common_audit_data *ad)
1786 {
1787         struct superblock_security_struct *sbsec;
1788         u32 sid = cred_sid(cred);
1789
1790         sbsec = sb->s_security;
1791         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1792 }
1793
1794 /* Convert a Linux mode and permission mask to an access vector. */
1795 static inline u32 file_mask_to_av(int mode, int mask)
1796 {
1797         u32 av = 0;
1798
1799         if (!S_ISDIR(mode)) {
1800                 if (mask & MAY_EXEC)
1801                         av |= FILE__EXECUTE;
1802                 if (mask & MAY_READ)
1803                         av |= FILE__READ;
1804
1805                 if (mask & MAY_APPEND)
1806                         av |= FILE__APPEND;
1807                 else if (mask & MAY_WRITE)
1808                         av |= FILE__WRITE;
1809
1810         } else {
1811                 if (mask & MAY_EXEC)
1812                         av |= DIR__SEARCH;
1813                 if (mask & MAY_WRITE)
1814                         av |= DIR__WRITE;
1815                 if (mask & MAY_READ)
1816                         av |= DIR__READ;
1817         }
1818
1819         return av;
1820 }
1821
1822 /* Convert a Linux file to an access vector. */
1823 static inline u32 file_to_av(struct file *file)
1824 {
1825         u32 av = 0;
1826
1827         if (file->f_mode & FMODE_READ)
1828                 av |= FILE__READ;
1829         if (file->f_mode & FMODE_WRITE) {
1830                 if (file->f_flags & O_APPEND)
1831                         av |= FILE__APPEND;
1832                 else
1833                         av |= FILE__WRITE;
1834         }
1835         if (!av) {
1836                 /*
1837                  * Special file opened with flags 3 for ioctl-only use.
1838                  */
1839                 av = FILE__IOCTL;
1840         }
1841
1842         return av;
1843 }
1844
1845 /*
1846  * Convert a file to an access vector and include the correct open
1847  * open permission.
1848  */
1849 static inline u32 open_file_to_av(struct file *file)
1850 {
1851         u32 av = file_to_av(file);
1852
1853         if (selinux_policycap_openperm)
1854                 av |= FILE__OPEN;
1855
1856         return av;
1857 }
1858
1859 /* Hook functions begin here. */
1860
1861 static int selinux_ptrace_access_check(struct task_struct *child,
1862                                      unsigned int mode)
1863 {
1864         int rc;
1865
1866         rc = cap_ptrace_access_check(child, mode);
1867         if (rc)
1868                 return rc;
1869
1870         if (mode & PTRACE_MODE_READ) {
1871                 u32 sid = current_sid();
1872                 u32 csid = task_sid(child);
1873                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1874         }
1875
1876         return current_has_perm(child, PROCESS__PTRACE);
1877 }
1878
1879 static int selinux_ptrace_traceme(struct task_struct *parent)
1880 {
1881         int rc;
1882
1883         rc = cap_ptrace_traceme(parent);
1884         if (rc)
1885                 return rc;
1886
1887         return task_has_perm(parent, current, PROCESS__PTRACE);
1888 }
1889
1890 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1891                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1892 {
1893         int error;
1894
1895         error = current_has_perm(target, PROCESS__GETCAP);
1896         if (error)
1897                 return error;
1898
1899         return cap_capget(target, effective, inheritable, permitted);
1900 }
1901
1902 static int selinux_capset(struct cred *new, const struct cred *old,
1903                           const kernel_cap_t *effective,
1904                           const kernel_cap_t *inheritable,
1905                           const kernel_cap_t *permitted)
1906 {
1907         int error;
1908
1909         error = cap_capset(new, old,
1910                                       effective, inheritable, permitted);
1911         if (error)
1912                 return error;
1913
1914         return cred_has_perm(old, new, PROCESS__SETCAP);
1915 }
1916
1917 /*
1918  * (This comment used to live with the selinux_task_setuid hook,
1919  * which was removed).
1920  *
1921  * Since setuid only affects the current process, and since the SELinux
1922  * controls are not based on the Linux identity attributes, SELinux does not
1923  * need to control this operation.  However, SELinux does control the use of
1924  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1925  */
1926
1927 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1928                            int cap, int audit)
1929 {
1930         int rc;
1931
1932         rc = cap_capable(cred, ns, cap, audit);
1933         if (rc)
1934                 return rc;
1935
1936         return cred_has_capability(cred, cap, audit);
1937 }
1938
1939 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1940 {
1941         const struct cred *cred = current_cred();
1942         int rc = 0;
1943
1944         if (!sb)
1945                 return 0;
1946
1947         switch (cmds) {
1948         case Q_SYNC:
1949         case Q_QUOTAON:
1950         case Q_QUOTAOFF:
1951         case Q_SETINFO:
1952         case Q_SETQUOTA:
1953                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1954                 break;
1955         case Q_GETFMT:
1956         case Q_GETINFO:
1957         case Q_GETQUOTA:
1958                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1959                 break;
1960         default:
1961                 rc = 0;  /* let the kernel handle invalid cmds */
1962                 break;
1963         }
1964         return rc;
1965 }
1966
1967 static int selinux_quota_on(struct dentry *dentry)
1968 {
1969         const struct cred *cred = current_cred();
1970
1971         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1972 }
1973
1974 static int selinux_syslog(int type)
1975 {
1976         int rc;
1977
1978         switch (type) {
1979         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1980         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1981                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1982                 break;
1983         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1984         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1985         /* Set level of messages printed to console */
1986         case SYSLOG_ACTION_CONSOLE_LEVEL:
1987                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1988                 break;
1989         case SYSLOG_ACTION_CLOSE:       /* Close log */
1990         case SYSLOG_ACTION_OPEN:        /* Open log */
1991         case SYSLOG_ACTION_READ:        /* Read from log */
1992         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1993         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1994         default:
1995                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1996                 break;
1997         }
1998         return rc;
1999 }
2000
2001 /*
2002  * Check that a process has enough memory to allocate a new virtual
2003  * mapping. 0 means there is enough memory for the allocation to
2004  * succeed and -ENOMEM implies there is not.
2005  *
2006  * Do not audit the selinux permission check, as this is applied to all
2007  * processes that allocate mappings.
2008  */
2009 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2010 {
2011         int rc, cap_sys_admin = 0;
2012
2013         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2014                              SECURITY_CAP_NOAUDIT);
2015         if (rc == 0)
2016                 cap_sys_admin = 1;
2017
2018         return __vm_enough_memory(mm, pages, cap_sys_admin);
2019 }
2020
2021 /* binprm security operations */
2022
2023 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2024 {
2025         const struct task_security_struct *old_tsec;
2026         struct task_security_struct *new_tsec;
2027         struct inode_security_struct *isec;
2028         struct common_audit_data ad;
2029         struct inode *inode = file_inode(bprm->file);
2030         int rc;
2031
2032         rc = cap_bprm_set_creds(bprm);
2033         if (rc)
2034                 return rc;
2035
2036         /* SELinux context only depends on initial program or script and not
2037          * the script interpreter */
2038         if (bprm->cred_prepared)
2039                 return 0;
2040
2041         old_tsec = current_security();
2042         new_tsec = bprm->cred->security;
2043         isec = inode->i_security;
2044
2045         /* Default to the current task SID. */
2046         new_tsec->sid = old_tsec->sid;
2047         new_tsec->osid = old_tsec->sid;
2048
2049         /* Reset fs, key, and sock SIDs on execve. */
2050         new_tsec->create_sid = 0;
2051         new_tsec->keycreate_sid = 0;
2052         new_tsec->sockcreate_sid = 0;
2053
2054         if (old_tsec->exec_sid) {
2055                 new_tsec->sid = old_tsec->exec_sid;
2056                 /* Reset exec SID on execve. */
2057                 new_tsec->exec_sid = 0;
2058
2059                 /*
2060                  * Minimize confusion: if no_new_privs and a transition is
2061                  * explicitly requested, then fail the exec.
2062                  */
2063                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2064                         return -EPERM;
2065         } else {
2066                 /* Check for a default transition on this program. */
2067                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2068                                              SECCLASS_PROCESS, NULL,
2069                                              &new_tsec->sid);
2070                 if (rc)
2071                         return rc;
2072         }
2073
2074         ad.type = LSM_AUDIT_DATA_PATH;
2075         ad.u.path = bprm->file->f_path;
2076
2077         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2078             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2079                 new_tsec->sid = old_tsec->sid;
2080
2081         if (new_tsec->sid == old_tsec->sid) {
2082                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2083                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2084                 if (rc)
2085                         return rc;
2086         } else {
2087                 /* Check permissions for the transition. */
2088                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2089                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2090                 if (rc)
2091                         return rc;
2092
2093                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2094                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2095                 if (rc)
2096                         return rc;
2097
2098                 /* Check for shared state */
2099                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2100                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2101                                           SECCLASS_PROCESS, PROCESS__SHARE,
2102                                           NULL);
2103                         if (rc)
2104                                 return -EPERM;
2105                 }
2106
2107                 /* Make sure that anyone attempting to ptrace over a task that
2108                  * changes its SID has the appropriate permit */
2109                 if (bprm->unsafe &
2110                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2111                         struct task_struct *tracer;
2112                         struct task_security_struct *sec;
2113                         u32 ptsid = 0;
2114
2115                         rcu_read_lock();
2116                         tracer = ptrace_parent(current);
2117                         if (likely(tracer != NULL)) {
2118                                 sec = __task_cred(tracer)->security;
2119                                 ptsid = sec->sid;
2120                         }
2121                         rcu_read_unlock();
2122
2123                         if (ptsid != 0) {
2124                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2125                                                   SECCLASS_PROCESS,
2126                                                   PROCESS__PTRACE, NULL);
2127                                 if (rc)
2128                                         return -EPERM;
2129                         }
2130                 }
2131
2132                 /* Clear any possibly unsafe personality bits on exec: */
2133                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2134         }
2135
2136         return 0;
2137 }
2138
2139 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2140 {
2141         const struct task_security_struct *tsec = current_security();
2142         u32 sid, osid;
2143         int atsecure = 0;
2144
2145         sid = tsec->sid;
2146         osid = tsec->osid;
2147
2148         if (osid != sid) {
2149                 /* Enable secure mode for SIDs transitions unless
2150                    the noatsecure permission is granted between
2151                    the two SIDs, i.e. ahp returns 0. */
2152                 atsecure = avc_has_perm(osid, sid,
2153                                         SECCLASS_PROCESS,
2154                                         PROCESS__NOATSECURE, NULL);
2155         }
2156
2157         return (atsecure || cap_bprm_secureexec(bprm));
2158 }
2159
2160 static int match_file(const void *p, struct file *file, unsigned fd)
2161 {
2162         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2163 }
2164
2165 /* Derived from fs/exec.c:flush_old_files. */
2166 static inline void flush_unauthorized_files(const struct cred *cred,
2167                                             struct files_struct *files)
2168 {
2169         struct file *file, *devnull = NULL;
2170         struct tty_struct *tty;
2171         int drop_tty = 0;
2172         unsigned n;
2173
2174         tty = get_current_tty();
2175         if (tty) {
2176                 spin_lock(&tty_files_lock);
2177                 if (!list_empty(&tty->tty_files)) {
2178                         struct tty_file_private *file_priv;
2179
2180                         /* Revalidate access to controlling tty.
2181                            Use file_path_has_perm on the tty path directly
2182                            rather than using file_has_perm, as this particular
2183                            open file may belong to another process and we are
2184                            only interested in the inode-based check here. */
2185                         file_priv = list_first_entry(&tty->tty_files,
2186                                                 struct tty_file_private, list);
2187                         file = file_priv->file;
2188                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2189                                 drop_tty = 1;
2190                 }
2191                 spin_unlock(&tty_files_lock);
2192                 tty_kref_put(tty);
2193         }
2194         /* Reset controlling tty. */
2195         if (drop_tty)
2196                 no_tty();
2197
2198         /* Revalidate access to inherited open files. */
2199         n = iterate_fd(files, 0, match_file, cred);
2200         if (!n) /* none found? */
2201                 return;
2202
2203         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2204         if (IS_ERR(devnull))
2205                 devnull = NULL;
2206         /* replace all the matching ones with this */
2207         do {
2208                 replace_fd(n - 1, devnull, 0);
2209         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2210         if (devnull)
2211                 fput(devnull);
2212 }
2213
2214 /*
2215  * Prepare a process for imminent new credential changes due to exec
2216  */
2217 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2218 {
2219         struct task_security_struct *new_tsec;
2220         struct rlimit *rlim, *initrlim;
2221         int rc, i;
2222
2223         new_tsec = bprm->cred->security;
2224         if (new_tsec->sid == new_tsec->osid)
2225                 return;
2226
2227         /* Close files for which the new task SID is not authorized. */
2228         flush_unauthorized_files(bprm->cred, current->files);
2229
2230         /* Always clear parent death signal on SID transitions. */
2231         current->pdeath_signal = 0;
2232
2233         /* Check whether the new SID can inherit resource limits from the old
2234          * SID.  If not, reset all soft limits to the lower of the current
2235          * task's hard limit and the init task's soft limit.
2236          *
2237          * Note that the setting of hard limits (even to lower them) can be
2238          * controlled by the setrlimit check.  The inclusion of the init task's
2239          * soft limit into the computation is to avoid resetting soft limits
2240          * higher than the default soft limit for cases where the default is
2241          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242          */
2243         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244                           PROCESS__RLIMITINH, NULL);
2245         if (rc) {
2246                 /* protect against do_prlimit() */
2247                 task_lock(current);
2248                 for (i = 0; i < RLIM_NLIMITS; i++) {
2249                         rlim = current->signal->rlim + i;
2250                         initrlim = init_task.signal->rlim + i;
2251                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2252                 }
2253                 task_unlock(current);
2254                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2255         }
2256 }
2257
2258 /*
2259  * Clean up the process immediately after the installation of new credentials
2260  * due to exec
2261  */
2262 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2263 {
2264         const struct task_security_struct *tsec = current_security();
2265         struct itimerval itimer;
2266         u32 osid, sid;
2267         int rc, i;
2268
2269         osid = tsec->osid;
2270         sid = tsec->sid;
2271
2272         if (sid == osid)
2273                 return;
2274
2275         /* Check whether the new SID can inherit signal state from the old SID.
2276          * If not, clear itimers to avoid subsequent signal generation and
2277          * flush and unblock signals.
2278          *
2279          * This must occur _after_ the task SID has been updated so that any
2280          * kill done after the flush will be checked against the new SID.
2281          */
2282         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2283         if (rc) {
2284                 memset(&itimer, 0, sizeof itimer);
2285                 for (i = 0; i < 3; i++)
2286                         do_setitimer(i, &itimer, NULL);
2287                 spin_lock_irq(&current->sighand->siglock);
2288                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289                         __flush_signals(current);
2290                         flush_signal_handlers(current, 1);
2291                         sigemptyset(&current->blocked);
2292                 }
2293                 spin_unlock_irq(&current->sighand->siglock);
2294         }
2295
2296         /* Wake up the parent if it is waiting so that it can recheck
2297          * wait permission to the new task SID. */
2298         read_lock(&tasklist_lock);
2299         __wake_up_parent(current, current->real_parent);
2300         read_unlock(&tasklist_lock);
2301 }
2302
2303 /* superblock security operations */
2304
2305 static int selinux_sb_alloc_security(struct super_block *sb)
2306 {
2307         return superblock_alloc_security(sb);
2308 }
2309
2310 static void selinux_sb_free_security(struct super_block *sb)
2311 {
2312         superblock_free_security(sb);
2313 }
2314
2315 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316 {
2317         if (plen > olen)
2318                 return 0;
2319
2320         return !memcmp(prefix, option, plen);
2321 }
2322
2323 static inline int selinux_option(char *option, int len)
2324 {
2325         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2328                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2330 }
2331
2332 static inline void take_option(char **to, char *from, int *first, int len)
2333 {
2334         if (!*first) {
2335                 **to = ',';
2336                 *to += 1;
2337         } else
2338                 *first = 0;
2339         memcpy(*to, from, len);
2340         *to += len;
2341 }
2342
2343 static inline void take_selinux_option(char **to, char *from, int *first,
2344                                        int len)
2345 {
2346         int current_size = 0;
2347
2348         if (!*first) {
2349                 **to = '|';
2350                 *to += 1;
2351         } else
2352                 *first = 0;
2353
2354         while (current_size < len) {
2355                 if (*from != '"') {
2356                         **to = *from;
2357                         *to += 1;
2358                 }
2359                 from += 1;
2360                 current_size += 1;
2361         }
2362 }
2363
2364 static int selinux_sb_copy_data(char *orig, char *copy)
2365 {
2366         int fnosec, fsec, rc = 0;
2367         char *in_save, *in_curr, *in_end;
2368         char *sec_curr, *nosec_save, *nosec;
2369         int open_quote = 0;
2370
2371         in_curr = orig;
2372         sec_curr = copy;
2373
2374         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375         if (!nosec) {
2376                 rc = -ENOMEM;
2377                 goto out;
2378         }
2379
2380         nosec_save = nosec;
2381         fnosec = fsec = 1;
2382         in_save = in_end = orig;
2383
2384         do {
2385                 if (*in_end == '"')
2386                         open_quote = !open_quote;
2387                 if ((*in_end == ',' && open_quote == 0) ||
2388                                 *in_end == '\0') {
2389                         int len = in_end - in_curr;
2390
2391                         if (selinux_option(in_curr, len))
2392                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2393                         else
2394                                 take_option(&nosec, in_curr, &fnosec, len);
2395
2396                         in_curr = in_end + 1;
2397                 }
2398         } while (*in_end++);
2399
2400         strcpy(in_save, nosec_save);
2401         free_page((unsigned long)nosec_save);
2402 out:
2403         return rc;
2404 }
2405
2406 static int selinux_sb_remount(struct super_block *sb, void *data)
2407 {
2408         int rc, i, *flags;
2409         struct security_mnt_opts opts;
2410         char *secdata, **mount_options;
2411         struct superblock_security_struct *sbsec = sb->s_security;
2412
2413         if (!(sbsec->flags & SE_SBINITIALIZED))
2414                 return 0;
2415
2416         if (!data)
2417                 return 0;
2418
2419         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420                 return 0;
2421
2422         security_init_mnt_opts(&opts);
2423         secdata = alloc_secdata();
2424         if (!secdata)
2425                 return -ENOMEM;
2426         rc = selinux_sb_copy_data(data, secdata);
2427         if (rc)
2428                 goto out_free_secdata;
2429
2430         rc = selinux_parse_opts_str(secdata, &opts);
2431         if (rc)
2432                 goto out_free_secdata;
2433
2434         mount_options = opts.mnt_opts;
2435         flags = opts.mnt_opts_flags;
2436
2437         for (i = 0; i < opts.num_mnt_opts; i++) {
2438                 u32 sid;
2439                 size_t len;
2440
2441                 if (flags[i] == SE_SBLABELSUPP)
2442                         continue;
2443                 len = strlen(mount_options[i]);
2444                 rc = security_context_to_sid(mount_options[i], len, &sid);
2445                 if (rc) {
2446                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2447                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2448                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2449                         goto out_free_opts;
2450                 }
2451                 rc = -EINVAL;
2452                 switch (flags[i]) {
2453                 case FSCONTEXT_MNT:
2454                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455                                 goto out_bad_option;
2456                         break;
2457                 case CONTEXT_MNT:
2458                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459                                 goto out_bad_option;
2460                         break;
2461                 case ROOTCONTEXT_MNT: {
2462                         struct inode_security_struct *root_isec;
2463                         root_isec = sb->s_root->d_inode->i_security;
2464
2465                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466                                 goto out_bad_option;
2467                         break;
2468                 }
2469                 case DEFCONTEXT_MNT:
2470                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471                                 goto out_bad_option;
2472                         break;
2473                 default:
2474                         goto out_free_opts;
2475                 }
2476         }
2477
2478         rc = 0;
2479 out_free_opts:
2480         security_free_mnt_opts(&opts);
2481 out_free_secdata:
2482         free_secdata(secdata);
2483         return rc;
2484 out_bad_option:
2485         printk(KERN_WARNING "SELinux: unable to change security options "
2486                "during remount (dev %s, type=%s)\n", sb->s_id,
2487                sb->s_type->name);
2488         goto out_free_opts;
2489 }
2490
2491 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2492 {
2493         const struct cred *cred = current_cred();
2494         struct common_audit_data ad;
2495         int rc;
2496
2497         rc = superblock_doinit(sb, data);
2498         if (rc)
2499                 return rc;
2500
2501         /* Allow all mounts performed by the kernel */
2502         if (flags & MS_KERNMOUNT)
2503                 return 0;
2504
2505         ad.type = LSM_AUDIT_DATA_DENTRY;
2506         ad.u.dentry = sb->s_root;
2507         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2508 }
2509
2510 static int selinux_sb_statfs(struct dentry *dentry)
2511 {
2512         const struct cred *cred = current_cred();
2513         struct common_audit_data ad;
2514
2515         ad.type = LSM_AUDIT_DATA_DENTRY;
2516         ad.u.dentry = dentry->d_sb->s_root;
2517         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2518 }
2519
2520 static int selinux_mount(const char *dev_name,
2521                          struct path *path,
2522                          const char *type,
2523                          unsigned long flags,
2524                          void *data)
2525 {
2526         const struct cred *cred = current_cred();
2527
2528         if (flags & MS_REMOUNT)
2529                 return superblock_has_perm(cred, path->dentry->d_sb,
2530                                            FILESYSTEM__REMOUNT, NULL);
2531         else
2532                 return path_has_perm(cred, path, FILE__MOUNTON);
2533 }
2534
2535 static int selinux_umount(struct vfsmount *mnt, int flags)
2536 {
2537         const struct cred *cred = current_cred();
2538
2539         return superblock_has_perm(cred, mnt->mnt_sb,
2540                                    FILESYSTEM__UNMOUNT, NULL);
2541 }
2542
2543 /* inode security operations */
2544
2545 static int selinux_inode_alloc_security(struct inode *inode)
2546 {
2547         return inode_alloc_security(inode);
2548 }
2549
2550 static void selinux_inode_free_security(struct inode *inode)
2551 {
2552         inode_free_security(inode);
2553 }
2554
2555 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2556                                         struct qstr *name, void **ctx,
2557                                         u32 *ctxlen)
2558 {
2559         const struct cred *cred = current_cred();
2560         struct task_security_struct *tsec;
2561         struct inode_security_struct *dsec;
2562         struct superblock_security_struct *sbsec;
2563         struct inode *dir = dentry->d_parent->d_inode;
2564         u32 newsid;
2565         int rc;
2566
2567         tsec = cred->security;
2568         dsec = dir->i_security;
2569         sbsec = dir->i_sb->s_security;
2570
2571         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2572                 newsid = tsec->create_sid;
2573         } else {
2574                 rc = security_transition_sid(tsec->sid, dsec->sid,
2575                                              inode_mode_to_security_class(mode),
2576                                              name,
2577                                              &newsid);
2578                 if (rc) {
2579                         printk(KERN_WARNING
2580                                 "%s: security_transition_sid failed, rc=%d\n",
2581                                __func__, -rc);
2582                         return rc;
2583                 }
2584         }
2585
2586         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2587 }
2588
2589 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2590                                        const struct qstr *qstr,
2591                                        const char **name,
2592                                        void **value, size_t *len)
2593 {
2594         const struct task_security_struct *tsec = current_security();
2595         struct inode_security_struct *dsec;
2596         struct superblock_security_struct *sbsec;
2597         u32 sid, newsid, clen;
2598         int rc;
2599         char *context;
2600
2601         dsec = dir->i_security;
2602         sbsec = dir->i_sb->s_security;
2603
2604         sid = tsec->sid;
2605         newsid = tsec->create_sid;
2606
2607         if ((sbsec->flags & SE_SBINITIALIZED) &&
2608             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2609                 newsid = sbsec->mntpoint_sid;
2610         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2611                 rc = security_transition_sid(sid, dsec->sid,
2612                                              inode_mode_to_security_class(inode->i_mode),
2613                                              qstr, &newsid);
2614                 if (rc) {
2615                         printk(KERN_WARNING "%s:  "
2616                                "security_transition_sid failed, rc=%d (dev=%s "
2617                                "ino=%ld)\n",
2618                                __func__,
2619                                -rc, inode->i_sb->s_id, inode->i_ino);
2620                         return rc;
2621                 }
2622         }
2623
2624         /* Possibly defer initialization to selinux_complete_init. */
2625         if (sbsec->flags & SE_SBINITIALIZED) {
2626                 struct inode_security_struct *isec = inode->i_security;
2627                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2628                 isec->sid = newsid;
2629                 isec->initialized = 1;
2630         }
2631
2632         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2633                 return -EOPNOTSUPP;
2634
2635         if (name)
2636                 *name = XATTR_SELINUX_SUFFIX;
2637
2638         if (value && len) {
2639                 rc = security_sid_to_context_force(newsid, &context, &clen);
2640                 if (rc)
2641                         return rc;
2642                 *value = context;
2643                 *len = clen;
2644         }
2645
2646         return 0;
2647 }
2648
2649 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2650 {
2651         return may_create(dir, dentry, SECCLASS_FILE);
2652 }
2653
2654 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2655 {
2656         return may_link(dir, old_dentry, MAY_LINK);
2657 }
2658
2659 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2660 {
2661         return may_link(dir, dentry, MAY_UNLINK);
2662 }
2663
2664 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2665 {
2666         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2667 }
2668
2669 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2670 {
2671         return may_create(dir, dentry, SECCLASS_DIR);
2672 }
2673
2674 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2675 {
2676         return may_link(dir, dentry, MAY_RMDIR);
2677 }
2678
2679 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2680 {
2681         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2682 }
2683
2684 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2685                                 struct inode *new_inode, struct dentry *new_dentry)
2686 {
2687         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2688 }
2689
2690 static int selinux_inode_readlink(struct dentry *dentry)
2691 {
2692         const struct cred *cred = current_cred();
2693
2694         return dentry_has_perm(cred, dentry, FILE__READ);
2695 }
2696
2697 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2698 {
2699         const struct cred *cred = current_cred();
2700
2701         return dentry_has_perm(cred, dentry, FILE__READ);
2702 }
2703
2704 static noinline int audit_inode_permission(struct inode *inode,
2705                                            u32 perms, u32 audited, u32 denied,
2706                                            unsigned flags)
2707 {
2708         struct common_audit_data ad;
2709         struct inode_security_struct *isec = inode->i_security;
2710         int rc;
2711
2712         ad.type = LSM_AUDIT_DATA_INODE;
2713         ad.u.inode = inode;
2714
2715         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2716                             audited, denied, &ad, flags);
2717         if (rc)
2718                 return rc;
2719         return 0;
2720 }
2721
2722 static int selinux_inode_permission(struct inode *inode, int mask)
2723 {
2724         const struct cred *cred = current_cred();
2725         u32 perms;
2726         bool from_access;
2727         unsigned flags = mask & MAY_NOT_BLOCK;
2728         struct inode_security_struct *isec;
2729         u32 sid;
2730         struct av_decision avd;
2731         int rc, rc2;
2732         u32 audited, denied;
2733
2734         from_access = mask & MAY_ACCESS;
2735         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2736
2737         /* No permission to check.  Existence test. */
2738         if (!mask)
2739                 return 0;
2740
2741         validate_creds(cred);
2742
2743         if (unlikely(IS_PRIVATE(inode)))
2744                 return 0;
2745
2746         perms = file_mask_to_av(inode->i_mode, mask);
2747
2748         sid = cred_sid(cred);
2749         isec = inode->i_security;
2750
2751         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2752         audited = avc_audit_required(perms, &avd, rc,
2753                                      from_access ? FILE__AUDIT_ACCESS : 0,
2754                                      &denied);
2755         if (likely(!audited))
2756                 return rc;
2757
2758         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2759         if (rc2)
2760                 return rc2;
2761         return rc;
2762 }
2763
2764 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2765 {
2766         const struct cred *cred = current_cred();
2767         unsigned int ia_valid = iattr->ia_valid;
2768         __u32 av = FILE__WRITE;
2769
2770         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2771         if (ia_valid & ATTR_FORCE) {
2772                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2773                               ATTR_FORCE);
2774                 if (!ia_valid)
2775                         return 0;
2776         }
2777
2778         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2779                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2780                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2781
2782         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2783                 av |= FILE__OPEN;
2784
2785         return dentry_has_perm(cred, dentry, av);
2786 }
2787
2788 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2789 {
2790         const struct cred *cred = current_cred();
2791         struct path path;
2792
2793         path.dentry = dentry;
2794         path.mnt = mnt;
2795
2796         return path_has_perm(cred, &path, FILE__GETATTR);
2797 }
2798
2799 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2800 {
2801         const struct cred *cred = current_cred();
2802
2803         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2804                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2805                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2806                         if (!capable(CAP_SETFCAP))
2807                                 return -EPERM;
2808                 } else if (!capable(CAP_SYS_ADMIN)) {
2809                         /* A different attribute in the security namespace.
2810                            Restrict to administrator. */
2811                         return -EPERM;
2812                 }
2813         }
2814
2815         /* Not an attribute we recognize, so just check the
2816            ordinary setattr permission. */
2817         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2818 }
2819
2820 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2821                                   const void *value, size_t size, int flags)
2822 {
2823         struct inode *inode = dentry->d_inode;
2824         struct inode_security_struct *isec = inode->i_security;
2825         struct superblock_security_struct *sbsec;
2826         struct common_audit_data ad;
2827         u32 newsid, sid = current_sid();
2828         int rc = 0;
2829
2830         if (strcmp(name, XATTR_NAME_SELINUX))
2831                 return selinux_inode_setotherxattr(dentry, name);
2832
2833         sbsec = inode->i_sb->s_security;
2834         if (!(sbsec->flags & SE_SBLABELSUPP))
2835                 return -EOPNOTSUPP;
2836
2837         if (!inode_owner_or_capable(inode))
2838                 return -EPERM;
2839
2840         ad.type = LSM_AUDIT_DATA_DENTRY;
2841         ad.u.dentry = dentry;
2842
2843         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2844                           FILE__RELABELFROM, &ad);
2845         if (rc)
2846                 return rc;
2847
2848         rc = security_context_to_sid(value, size, &newsid);
2849         if (rc == -EINVAL) {
2850                 if (!capable(CAP_MAC_ADMIN)) {
2851                         struct audit_buffer *ab;
2852                         size_t audit_size;
2853                         const char *str;
2854
2855                         /* We strip a nul only if it is at the end, otherwise the
2856                          * context contains a nul and we should audit that */
2857                         if (value) {
2858                                 str = value;
2859                                 if (str[size - 1] == '\0')
2860                                         audit_size = size - 1;
2861                                 else
2862                                         audit_size = size;
2863                         } else {
2864                                 str = "";
2865                                 audit_size = 0;
2866                         }
2867                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2868                         audit_log_format(ab, "op=setxattr invalid_context=");
2869                         audit_log_n_untrustedstring(ab, value, audit_size);
2870                         audit_log_end(ab);
2871
2872                         return rc;
2873                 }
2874                 rc = security_context_to_sid_force(value, size, &newsid);
2875         }
2876         if (rc)
2877                 return rc;
2878
2879         rc = avc_has_perm(sid, newsid, isec->sclass,
2880                           FILE__RELABELTO, &ad);
2881         if (rc)
2882                 return rc;
2883
2884         rc = security_validate_transition(isec->sid, newsid, sid,
2885                                           isec->sclass);
2886         if (rc)
2887                 return rc;
2888
2889         return avc_has_perm(newsid,
2890                             sbsec->sid,
2891                             SECCLASS_FILESYSTEM,
2892                             FILESYSTEM__ASSOCIATE,
2893                             &ad);
2894 }
2895
2896 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2897                                         const void *value, size_t size,
2898                                         int flags)
2899 {
2900         struct inode *inode = dentry->d_inode;
2901         struct inode_security_struct *isec = inode->i_security;
2902         u32 newsid;
2903         int rc;
2904
2905         if (strcmp(name, XATTR_NAME_SELINUX)) {
2906                 /* Not an attribute we recognize, so nothing to do. */
2907                 return;
2908         }
2909
2910         rc = security_context_to_sid_force(value, size, &newsid);
2911         if (rc) {
2912                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2913                        "for (%s, %lu), rc=%d\n",
2914                        inode->i_sb->s_id, inode->i_ino, -rc);
2915                 return;
2916         }
2917
2918         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2919         isec->sid = newsid;
2920         isec->initialized = 1;
2921
2922         return;
2923 }
2924
2925 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2926 {
2927         const struct cred *cred = current_cred();
2928
2929         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2930 }
2931
2932 static int selinux_inode_listxattr(struct dentry *dentry)
2933 {
2934         const struct cred *cred = current_cred();
2935
2936         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2937 }
2938
2939 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2940 {
2941         if (strcmp(name, XATTR_NAME_SELINUX))
2942                 return selinux_inode_setotherxattr(dentry, name);
2943
2944         /* No one is allowed to remove a SELinux security label.
2945            You can change the label, but all data must be labeled. */
2946         return -EACCES;
2947 }
2948
2949 /*
2950  * Copy the inode security context value to the user.
2951  *
2952  * Permission check is handled by selinux_inode_getxattr hook.
2953  */
2954 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2955 {
2956         u32 size;
2957         int error;
2958         char *context = NULL;
2959         struct inode_security_struct *isec = inode->i_security;
2960
2961         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2962                 return -EOPNOTSUPP;
2963
2964         /*
2965          * If the caller has CAP_MAC_ADMIN, then get the raw context
2966          * value even if it is not defined by current policy; otherwise,
2967          * use the in-core value under current policy.
2968          * Use the non-auditing forms of the permission checks since
2969          * getxattr may be called by unprivileged processes commonly
2970          * and lack of permission just means that we fall back to the
2971          * in-core context value, not a denial.
2972          */
2973         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2974                                 SECURITY_CAP_NOAUDIT);
2975         if (!error)
2976                 error = security_sid_to_context_force(isec->sid, &context,
2977                                                       &size);
2978         else
2979                 error = security_sid_to_context(isec->sid, &context, &size);
2980         if (error)
2981                 return error;
2982         error = size;
2983         if (alloc) {
2984                 *buffer = context;
2985                 goto out_nofree;
2986         }
2987         kfree(context);
2988 out_nofree:
2989         return error;
2990 }
2991
2992 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2993                                      const void *value, size_t size, int flags)
2994 {
2995         struct inode_security_struct *isec = inode->i_security;
2996         u32 newsid;
2997         int rc;
2998
2999         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3000                 return -EOPNOTSUPP;
3001
3002         if (!value || !size)
3003                 return -EACCES;
3004
3005         rc = security_context_to_sid((void *)value, size, &newsid);
3006         if (rc)
3007                 return rc;
3008
3009         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3010         isec->sid = newsid;
3011         isec->initialized = 1;
3012         return 0;
3013 }
3014
3015 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3016 {
3017         const int len = sizeof(XATTR_NAME_SELINUX);
3018         if (buffer && len <= buffer_size)
3019                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3020         return len;
3021 }
3022
3023 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3024 {
3025         struct inode_security_struct *isec = inode->i_security;
3026         *secid = isec->sid;
3027 }
3028
3029 /* file security operations */
3030
3031 static int selinux_revalidate_file_permission(struct file *file, int mask)
3032 {
3033         const struct cred *cred = current_cred();
3034         struct inode *inode = file_inode(file);
3035
3036         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3037         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3038                 mask |= MAY_APPEND;
3039
3040         return file_has_perm(cred, file,
3041                              file_mask_to_av(inode->i_mode, mask));
3042 }
3043
3044 static int selinux_file_permission(struct file *file, int mask)
3045 {
3046         struct inode *inode = file_inode(file);
3047         struct file_security_struct *fsec = file->f_security;
3048         struct inode_security_struct *isec = inode->i_security;
3049         u32 sid = current_sid();
3050
3051         if (!mask)
3052                 /* No permission to check.  Existence test. */
3053                 return 0;
3054
3055         if (sid == fsec->sid && fsec->isid == isec->sid &&
3056             fsec->pseqno == avc_policy_seqno())
3057                 /* No change since file_open check. */
3058                 return 0;
3059
3060         return selinux_revalidate_file_permission(file, mask);
3061 }
3062
3063 static int selinux_file_alloc_security(struct file *file)
3064 {
3065         return file_alloc_security(file);
3066 }
3067
3068 static void selinux_file_free_security(struct file *file)
3069 {
3070         file_free_security(file);
3071 }
3072
3073 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3074                               unsigned long arg)
3075 {
3076         const struct cred *cred = current_cred();
3077         int error = 0;
3078
3079         switch (cmd) {
3080         case FIONREAD:
3081         /* fall through */
3082         case FIBMAP:
3083         /* fall through */
3084         case FIGETBSZ:
3085         /* fall through */
3086         case FS_IOC_GETFLAGS:
3087         /* fall through */
3088         case FS_IOC_GETVERSION:
3089                 error = file_has_perm(cred, file, FILE__GETATTR);
3090                 break;
3091
3092         case FS_IOC_SETFLAGS:
3093         /* fall through */
3094         case FS_IOC_SETVERSION:
3095                 error = file_has_perm(cred, file, FILE__SETATTR);
3096                 break;
3097
3098         /* sys_ioctl() checks */
3099         case FIONBIO:
3100         /* fall through */
3101         case FIOASYNC:
3102                 error = file_has_perm(cred, file, 0);
3103                 break;
3104
3105         case KDSKBENT:
3106         case KDSKBSENT:
3107                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3108                                             SECURITY_CAP_AUDIT);
3109                 break;
3110
3111         /* default case assumes that the command will go
3112          * to the file's ioctl() function.
3113          */
3114         default:
3115                 error = file_has_perm(cred, file, FILE__IOCTL);
3116         }
3117         return error;
3118 }
3119
3120 static int default_noexec;
3121
3122 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3123 {
3124         const struct cred *cred = current_cred();
3125         int rc = 0;
3126
3127         if (default_noexec &&
3128             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3129                 /*
3130                  * We are making executable an anonymous mapping or a
3131                  * private file mapping that will also be writable.
3132                  * This has an additional check.
3133                  */
3134                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3135                 if (rc)
3136                         goto error;
3137         }
3138
3139         if (file) {
3140                 /* read access is always possible with a mapping */
3141                 u32 av = FILE__READ;
3142
3143                 /* write access only matters if the mapping is shared */
3144                 if (shared && (prot & PROT_WRITE))
3145                         av |= FILE__WRITE;
3146
3147                 if (prot & PROT_EXEC)
3148                         av |= FILE__EXECUTE;
3149
3150                 return file_has_perm(cred, file, av);
3151         }
3152
3153 error:
3154         return rc;
3155 }
3156
3157 static int selinux_mmap_addr(unsigned long addr)
3158 {
3159         int rc = 0;
3160         u32 sid = current_sid();
3161
3162         /*
3163          * notice that we are intentionally putting the SELinux check before
3164          * the secondary cap_file_mmap check.  This is such a likely attempt
3165          * at bad behaviour/exploit that we always want to get the AVC, even
3166          * if DAC would have also denied the operation.
3167          */
3168         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3169                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3170                                   MEMPROTECT__MMAP_ZERO, NULL);
3171                 if (rc)
3172                         return rc;
3173         }
3174
3175         /* do DAC check on address space usage */
3176         return cap_mmap_addr(addr);
3177 }
3178
3179 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3180                              unsigned long prot, unsigned long flags)
3181 {
3182         if (selinux_checkreqprot)
3183                 prot = reqprot;
3184
3185         return file_map_prot_check(file, prot,
3186                                    (flags & MAP_TYPE) == MAP_SHARED);
3187 }
3188
3189 static int selinux_file_mprotect(struct vm_area_struct *vma,
3190                                  unsigned long reqprot,
3191                                  unsigned long prot)
3192 {
3193         const struct cred *cred = current_cred();
3194
3195         if (selinux_checkreqprot)
3196                 prot = reqprot;
3197
3198         if (default_noexec &&
3199             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3200                 int rc = 0;
3201                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3202                     vma->vm_end <= vma->vm_mm->brk) {
3203                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3204                 } else if (!vma->vm_file &&
3205                            vma->vm_start <= vma->vm_mm->start_stack &&
3206                            vma->vm_end >= vma->vm_mm->start_stack) {
3207                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3208                 } else if (vma->vm_file && vma->anon_vma) {
3209                         /*
3210                          * We are making executable a file mapping that has
3211                          * had some COW done. Since pages might have been
3212                          * written, check ability to execute the possibly
3213                          * modified content.  This typically should only
3214                          * occur for text relocations.
3215                          */
3216                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3217                 }
3218                 if (rc)
3219                         return rc;
3220         }
3221
3222         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3223 }
3224
3225 static int selinux_file_lock(struct file *file, unsigned int cmd)
3226 {
3227         const struct cred *cred = current_cred();
3228
3229         return file_has_perm(cred, file, FILE__LOCK);
3230 }
3231
3232 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3233                               unsigned long arg)
3234 {
3235         const struct cred *cred = current_cred();
3236         int err = 0;
3237
3238         switch (cmd) {
3239         case F_SETFL:
3240                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3241                         err = file_has_perm(cred, file, FILE__WRITE);
3242                         break;
3243                 }
3244                 /* fall through */
3245         case F_SETOWN:
3246         case F_SETSIG:
3247         case F_GETFL:
3248         case F_GETOWN:
3249         case F_GETSIG:
3250         case F_GETOWNER_UIDS:
3251                 /* Just check FD__USE permission */
3252                 err = file_has_perm(cred, file, 0);
3253                 break;
3254         case F_GETLK:
3255         case F_SETLK:
3256         case F_SETLKW:
3257 #if BITS_PER_LONG == 32
3258         case F_GETLK64:
3259         case F_SETLK64:
3260         case F_SETLKW64:
3261 #endif
3262                 err = file_has_perm(cred, file, FILE__LOCK);
3263                 break;
3264         }
3265
3266         return err;
3267 }
3268
3269 static int selinux_file_set_fowner(struct file *file)
3270 {
3271         struct file_security_struct *fsec;
3272
3273         fsec = file->f_security;
3274         fsec->fown_sid = current_sid();
3275
3276         return 0;
3277 }
3278
3279 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3280                                        struct fown_struct *fown, int signum)
3281 {
3282         struct file *file;
3283         u32 sid = task_sid(tsk);
3284         u32 perm;
3285         struct file_security_struct *fsec;
3286
3287         /* struct fown_struct is never outside the context of a struct file */
3288         file = container_of(fown, struct file, f_owner);
3289
3290         fsec = file->f_security;
3291
3292         if (!signum)
3293                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3294         else
3295                 perm = signal_to_av(signum);
3296
3297         return avc_has_perm(fsec->fown_sid, sid,
3298                             SECCLASS_PROCESS, perm, NULL);
3299 }
3300
3301 static int selinux_file_receive(struct file *file)
3302 {
3303         const struct cred *cred = current_cred();
3304
3305         return file_has_perm(cred, file, file_to_av(file));
3306 }
3307
3308 static int selinux_file_open(struct file *file, const struct cred *cred)
3309 {
3310         struct file_security_struct *fsec;
3311         struct inode_security_struct *isec;
3312
3313         fsec = file->f_security;
3314         isec = file_inode(file)->i_security;
3315         /*
3316          * Save inode label and policy sequence number
3317          * at open-time so that selinux_file_permission
3318          * can determine whether revalidation is necessary.
3319          * Task label is already saved in the file security
3320          * struct as its SID.
3321          */
3322         fsec->isid = isec->sid;
3323         fsec->pseqno = avc_policy_seqno();
3324         /*
3325          * Since the inode label or policy seqno may have changed
3326          * between the selinux_inode_permission check and the saving
3327          * of state above, recheck that access is still permitted.
3328          * Otherwise, access might never be revalidated against the
3329          * new inode label or new policy.
3330          * This check is not redundant - do not remove.
3331          */
3332         return file_path_has_perm(cred, file, open_file_to_av(file));
3333 }
3334
3335 /* task security operations */
3336
3337 static int selinux_task_create(unsigned long clone_flags)
3338 {
3339         return current_has_perm(current, PROCESS__FORK);
3340 }
3341
3342 /*
3343  * allocate the SELinux part of blank credentials
3344  */
3345 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3346 {
3347         struct task_security_struct *tsec;
3348
3349         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3350         if (!tsec)
3351                 return -ENOMEM;
3352
3353         cred->security = tsec;
3354         return 0;
3355 }
3356
3357 /*
3358  * detach and free the LSM part of a set of credentials
3359  */
3360 static void selinux_cred_free(struct cred *cred)
3361 {
3362         struct task_security_struct *tsec = cred->security;
3363
3364         /*
3365          * cred->security == NULL if security_cred_alloc_blank() or
3366          * security_prepare_creds() returned an error.
3367          */
3368         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3369         cred->security = (void *) 0x7UL;
3370         kfree(tsec);
3371 }
3372
3373 /*
3374  * prepare a new set of credentials for modification
3375  */
3376 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3377                                 gfp_t gfp)
3378 {
3379         const struct task_security_struct *old_tsec;
3380         struct task_security_struct *tsec;
3381
3382         old_tsec = old->security;
3383
3384         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3385         if (!tsec)
3386                 return -ENOMEM;
3387
3388         new->security = tsec;
3389         return 0;
3390 }
3391
3392 /*
3393  * transfer the SELinux data to a blank set of creds
3394  */
3395 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3396 {
3397         const struct task_security_struct *old_tsec = old->security;
3398         struct task_security_struct *tsec = new->security;
3399
3400         *tsec = *old_tsec;
3401 }
3402
3403 /*
3404  * set the security data for a kernel service
3405  * - all the creation contexts are set to unlabelled
3406  */
3407 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3408 {
3409         struct task_security_struct *tsec = new->security;
3410         u32 sid = current_sid();
3411         int ret;
3412
3413         ret = avc_has_perm(sid, secid,
3414                            SECCLASS_KERNEL_SERVICE,
3415                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3416                            NULL);
3417         if (ret == 0) {
3418                 tsec->sid = secid;
3419                 tsec->create_sid = 0;
3420                 tsec->keycreate_sid = 0;
3421                 tsec->sockcreate_sid = 0;
3422         }
3423         return ret;
3424 }
3425
3426 /*
3427  * set the file creation context in a security record to the same as the
3428  * objective context of the specified inode
3429  */
3430 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3431 {
3432         struct inode_security_struct *isec = inode->i_security;
3433         struct task_security_struct *tsec = new->security;
3434         u32 sid = current_sid();
3435         int ret;
3436
3437         ret = avc_has_perm(sid, isec->sid,
3438                            SECCLASS_KERNEL_SERVICE,
3439                            KERNEL_SERVICE__CREATE_FILES_AS,
3440                            NULL);
3441
3442         if (ret == 0)
3443                 tsec->create_sid = isec->sid;
3444         return ret;
3445 }
3446
3447 static int selinux_kernel_module_request(char *kmod_name)
3448 {
3449         u32 sid;
3450         struct common_audit_data ad;
3451
3452         sid = task_sid(current);
3453
3454         ad.type = LSM_AUDIT_DATA_KMOD;
3455         ad.u.kmod_name = kmod_name;
3456
3457         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3458                             SYSTEM__MODULE_REQUEST, &ad);
3459 }
3460
3461 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3462 {
3463         return current_has_perm(p, PROCESS__SETPGID);
3464 }
3465
3466 static int selinux_task_getpgid(struct task_struct *p)
3467 {
3468         return current_has_perm(p, PROCESS__GETPGID);
3469 }
3470
3471 static int selinux_task_getsid(struct task_struct *p)
3472 {
3473         return current_has_perm(p, PROCESS__GETSESSION);
3474 }
3475
3476 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3477 {
3478         *secid = task_sid(p);
3479 }
3480
3481 static int selinux_task_setnice(struct task_struct *p, int nice)
3482 {
3483         int rc;
3484
3485         rc = cap_task_setnice(p, nice);
3486         if (rc)
3487                 return rc;
3488
3489         return current_has_perm(p, PROCESS__SETSCHED);
3490 }
3491
3492 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3493 {
3494         int rc;
3495
3496         rc = cap_task_setioprio(p, ioprio);
3497         if (rc)
3498                 return rc;
3499
3500         return current_has_perm(p, PROCESS__SETSCHED);
3501 }
3502
3503 static int selinux_task_getioprio(struct task_struct *p)
3504 {
3505         return current_has_perm(p, PROCESS__GETSCHED);
3506 }
3507
3508 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3509                 struct rlimit *new_rlim)
3510 {
3511         struct rlimit *old_rlim = p->signal->rlim + resource;
3512
3513         /* Control the ability to change the hard limit (whether
3514            lowering or raising it), so that the hard limit can
3515            later be used as a safe reset point for the soft limit
3516            upon context transitions.  See selinux_bprm_committing_creds. */
3517         if (old_rlim->rlim_max != new_rlim->rlim_max)
3518                 return current_has_perm(p, PROCESS__SETRLIMIT);
3519
3520         return 0;
3521 }
3522
3523 static int selinux_task_setscheduler(struct task_struct *p)
3524 {
3525         int rc;
3526
3527         rc = cap_task_setscheduler(p);
3528         if (rc)
3529                 return rc;
3530
3531         return current_has_perm(p, PROCESS__SETSCHED);
3532 }
3533
3534 static int selinux_task_getscheduler(struct task_struct *p)
3535 {
3536         return current_has_perm(p, PROCESS__GETSCHED);
3537 }
3538
3539 static int selinux_task_movememory(struct task_struct *p)
3540 {
3541         return current_has_perm(p, PROCESS__SETSCHED);
3542 }
3543
3544 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3545                                 int sig, u32 secid)
3546 {
3547         u32 perm;
3548         int rc;
3549
3550         if (!sig)
3551                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3552         else
3553                 perm = signal_to_av(sig);
3554         if (secid)
3555                 rc = avc_has_perm(secid, task_sid(p),
3556                                   SECCLASS_PROCESS, perm, NULL);
3557         else
3558                 rc = current_has_perm(p, perm);
3559         return rc;
3560 }
3561
3562 static int selinux_task_wait(struct task_struct *p)
3563 {
3564         return task_has_perm(p, current, PROCESS__SIGCHLD);
3565 }
3566
3567 static void selinux_task_to_inode(struct task_struct *p,
3568                                   struct inode *inode)
3569 {
3570         struct inode_security_struct *isec = inode->i_security;
3571         u32 sid = task_sid(p);
3572
3573         isec->sid = sid;
3574         isec->initialized = 1;
3575 }
3576
3577 /* Returns error only if unable to parse addresses */
3578 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3579                         struct common_audit_data *ad, u8 *proto)
3580 {
3581         int offset, ihlen, ret = -EINVAL;
3582         struct iphdr _iph, *ih;
3583
3584         offset = skb_network_offset(skb);
3585         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3586         if (ih == NULL)
3587                 goto out;
3588
3589         ihlen = ih->ihl * 4;
3590         if (ihlen < sizeof(_iph))
3591                 goto out;
3592
3593         ad->u.net->v4info.saddr = ih->saddr;
3594         ad->u.net->v4info.daddr = ih->daddr;
3595         ret = 0;
3596
3597         if (proto)
3598                 *proto = ih->protocol;
3599
3600         switch (ih->protocol) {
3601         case IPPROTO_TCP: {
3602                 struct tcphdr _tcph, *th;
3603
3604                 if (ntohs(ih->frag_off) & IP_OFFSET)
3605                         break;
3606
3607                 offset += ihlen;
3608                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3609                 if (th == NULL)
3610                         break;
3611
3612                 ad->u.net->sport = th->source;
3613                 ad->u.net->dport = th->dest;
3614                 break;
3615         }
3616
3617         case IPPROTO_UDP: {
3618                 struct udphdr _udph, *uh;
3619
3620                 if (ntohs(ih->frag_off) & IP_OFFSET)
3621                         break;
3622
3623                 offset += ihlen;
3624                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3625                 if (uh == NULL)
3626                         break;
3627
3628                 ad->u.net->sport = uh->source;
3629                 ad->u.net->dport = uh->dest;
3630                 break;
3631         }
3632
3633         case IPPROTO_DCCP: {
3634                 struct dccp_hdr _dccph, *dh;
3635
3636                 if (ntohs(ih->frag_off) & IP_OFFSET)
3637                         break;
3638
3639                 offset += ihlen;
3640                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3641                 if (dh == NULL)
3642                         break;
3643
3644                 ad->u.net->sport = dh->dccph_sport;
3645                 ad->u.net->dport = dh->dccph_dport;
3646                 break;
3647         }
3648
3649         default:
3650                 break;
3651         }
3652 out:
3653         return ret;
3654 }
3655
3656 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3657
3658 /* Returns error only if unable to parse addresses */
3659 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3660                         struct common_audit_data *ad, u8 *proto)
3661 {
3662         u8 nexthdr;
3663         int ret = -EINVAL, offset;
3664         struct ipv6hdr _ipv6h, *ip6;
3665         __be16 frag_off;
3666
3667         offset = skb_network_offset(skb);
3668         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3669         if (ip6 == NULL)
3670                 goto out;
3671
3672         ad->u.net->v6info.saddr = ip6->saddr;
3673         ad->u.net->v6info.daddr = ip6->daddr;
3674         ret = 0;
3675
3676         nexthdr = ip6->nexthdr;
3677         offset += sizeof(_ipv6h);
3678         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3679         if (offset < 0)
3680                 goto out;
3681
3682         if (proto)
3683                 *proto = nexthdr;
3684
3685         switch (nexthdr) {
3686         case IPPROTO_TCP: {
3687                 struct tcphdr _tcph, *th;
3688
3689                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3690                 if (th == NULL)
3691                         break;
3692
3693                 ad->u.net->sport = th->source;
3694                 ad->u.net->dport = th->dest;
3695                 break;
3696         }
3697
3698         case IPPROTO_UDP: {
3699                 struct udphdr _udph, *uh;
3700
3701                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3702                 if (uh == NULL)
3703                         break;
3704
3705                 ad->u.net->sport = uh->source;
3706                 ad->u.net->dport = uh->dest;
3707                 break;
3708         }
3709
3710         case IPPROTO_DCCP: {
3711                 struct dccp_hdr _dccph, *dh;
3712
3713                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3714                 if (dh == NULL)
3715                         break;
3716
3717                 ad->u.net->sport = dh->dccph_sport;
3718                 ad->u.net->dport = dh->dccph_dport;
3719                 break;
3720         }
3721
3722         /* includes fragments */
3723         default:
3724                 break;
3725         }
3726 out:
3727         return ret;
3728 }
3729
3730 #endif /* IPV6 */
3731
3732 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3733                              char **_addrp, int src, u8 *proto)
3734 {
3735         char *addrp;
3736         int ret;
3737
3738         switch (ad->u.net->family) {
3739         case PF_INET:
3740                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3741                 if (ret)
3742                         goto parse_error;
3743                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3744                                        &ad->u.net->v4info.daddr);
3745                 goto okay;
3746
3747 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3748         case PF_INET6:
3749                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3750                 if (ret)
3751                         goto parse_error;
3752                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3753                                        &ad->u.net->v6info.daddr);
3754                 goto okay;
3755 #endif  /* IPV6 */
3756         default:
3757                 addrp = NULL;
3758                 goto okay;
3759         }
3760
3761 parse_error:
3762         printk(KERN_WARNING
3763                "SELinux: failure in selinux_parse_skb(),"
3764                " unable to parse packet\n");
3765         return ret;
3766
3767 okay:
3768         if (_addrp)
3769                 *_addrp = addrp;
3770         return 0;
3771 }
3772
3773 /**
3774  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3775  * @skb: the packet
3776  * @family: protocol family
3777  * @sid: the packet's peer label SID
3778  *
3779  * Description:
3780  * Check the various different forms of network peer labeling and determine
3781  * the peer label/SID for the packet; most of the magic actually occurs in
3782  * the security server function security_net_peersid_cmp().  The function
3783  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3784  * or -EACCES if @sid is invalid due to inconsistencies with the different
3785  * peer labels.
3786  *
3787  */
3788 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3789 {
3790         int err;
3791         u32 xfrm_sid;
3792         u32 nlbl_sid;
3793         u32 nlbl_type;
3794
3795         selinux_xfrm_skb_sid(skb, &xfrm_sid);
3796         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3797
3798         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3799         if (unlikely(err)) {
3800                 printk(KERN_WARNING
3801                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3802                        " unable to determine packet's peer label\n");
3803                 return -EACCES;
3804         }
3805
3806         return 0;
3807 }
3808
3809 /**
3810  * selinux_conn_sid - Determine the child socket label for a connection
3811  * @sk_sid: the parent socket's SID
3812  * @skb_sid: the packet's SID
3813  * @conn_sid: the resulting connection SID
3814  *
3815  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3816  * combined with the MLS information from @skb_sid in order to create
3817  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3818  * of @sk_sid.  Returns zero on success, negative values on failure.
3819  *
3820  */
3821 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3822 {
3823         int err = 0;
3824
3825         if (skb_sid != SECSID_NULL)
3826                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3827         else
3828                 *conn_sid = sk_sid;
3829
3830         return err;
3831 }
3832
3833 /* socket security operations */
3834
3835 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3836                                  u16 secclass, u32 *socksid)
3837 {
3838         if (tsec->sockcreate_sid > SECSID_NULL) {
3839                 *socksid = tsec->sockcreate_sid;
3840                 return 0;
3841         }
3842
3843         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3844                                        socksid);
3845 }
3846
3847 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3848 {
3849         struct sk_security_struct *sksec = sk->sk_security;
3850         struct common_audit_data ad;
3851         struct lsm_network_audit net = {0,};
3852         u32 tsid = task_sid(task);
3853
3854         if (sksec->sid == SECINITSID_KERNEL)
3855                 return 0;
3856
3857         ad.type = LSM_AUDIT_DATA_NET;
3858         ad.u.net = &net;
3859         ad.u.net->sk = sk;
3860
3861         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3862 }
3863
3864 static int selinux_socket_create(int family, int type,
3865                                  int protocol, int kern)
3866 {
3867         const struct task_security_struct *tsec = current_security();
3868         u32 newsid;
3869         u16 secclass;
3870         int rc;
3871
3872         if (kern)
3873                 return 0;
3874
3875         secclass = socket_type_to_security_class(family, type, protocol);
3876         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3877         if (rc)
3878                 return rc;
3879
3880         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3881 }
3882
3883 static int selinux_socket_post_create(struct socket *sock, int family,
3884                                       int type, int protocol, int kern)
3885 {
3886         const struct task_security_struct *tsec = current_security();
3887         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3888         struct sk_security_struct *sksec;
3889         int err = 0;
3890
3891         isec->sclass = socket_type_to_security_class(family, type, protocol);
3892
3893         if (kern)
3894                 isec->sid = SECINITSID_KERNEL;
3895         else {
3896                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3897                 if (err)
3898                         return err;
3899         }
3900
3901         isec->initialized = 1;
3902
3903         if (sock->sk) {
3904                 sksec = sock->sk->sk_security;
3905                 sksec->sid = isec->sid;
3906                 sksec->sclass = isec->sclass;
3907                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3908         }
3909
3910         return err;
3911 }
3912
3913 /* Range of port numbers used to automatically bind.
3914    Need to determine whether we should perform a name_bind
3915    permission check between the socket and the port number. */
3916
3917 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3918 {
3919         struct sock *sk = sock->sk;
3920         u16 family;
3921         int err;
3922
3923         err = sock_has_perm(current, sk, SOCKET__BIND);
3924         if (err)
3925                 goto out;
3926
3927         /*
3928          * If PF_INET or PF_INET6, check name_bind permission for the port.
3929          * Multiple address binding for SCTP is not supported yet: we just
3930          * check the first address now.
3931          */
3932         family = sk->sk_family;
3933         if (family == PF_INET || family == PF_INET6) {
3934                 char *addrp;
3935                 struct sk_security_struct *sksec = sk->sk_security;
3936                 struct common_audit_data ad;
3937                 struct lsm_network_audit net = {0,};
3938                 struct sockaddr_in *addr4 = NULL;
3939                 struct sockaddr_in6 *addr6 = NULL;
3940                 unsigned short snum;
3941                 u32 sid, node_perm;
3942
3943                 if (family == PF_INET) {
3944                         addr4 = (struct sockaddr_in *)address;
3945                         snum = ntohs(addr4->sin_port);
3946                         addrp = (char *)&addr4->sin_addr.s_addr;
3947                 } else {
3948                         addr6 = (struct sockaddr_in6 *)address;
3949                         snum = ntohs(addr6->sin6_port);
3950                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3951                 }
3952
3953                 if (snum) {
3954                         int low, high;
3955
3956                         inet_get_local_port_range(&low, &high);
3957
3958                         if (snum < max(PROT_SOCK, low) || snum > high) {
3959                                 err = sel_netport_sid(sk->sk_protocol,
3960                                                       snum, &sid);
3961                                 if (err)
3962                                         goto out;
3963                                 ad.type = LSM_AUDIT_DATA_NET;
3964                                 ad.u.net = &net;
3965                                 ad.u.net->sport = htons(snum);
3966                                 ad.u.net->family = family;
3967                                 err = avc_has_perm(sksec->sid, sid,
3968                                                    sksec->sclass,
3969                                                    SOCKET__NAME_BIND, &ad);
3970                                 if (err)
3971                                         goto out;
3972                         }
3973                 }
3974
3975                 switch (sksec->sclass) {
3976                 case SECCLASS_TCP_SOCKET:
3977                         node_perm = TCP_SOCKET__NODE_BIND;
3978                         break;
3979
3980                 case SECCLASS_UDP_SOCKET:
3981                         node_perm = UDP_SOCKET__NODE_BIND;
3982                         break;
3983
3984                 case SECCLASS_DCCP_SOCKET:
3985                         node_perm = DCCP_SOCKET__NODE_BIND;
3986                         break;
3987
3988                 default:
3989                         node_perm = RAWIP_SOCKET__NODE_BIND;
3990                         break;
3991                 }
3992
3993                 err = sel_netnode_sid(addrp, family, &sid);
3994                 if (err)
3995                         goto out;
3996
3997                 ad.type = LSM_AUDIT_DATA_NET;
3998                 ad.u.net = &net;
3999                 ad.u.net->sport = htons(snum);
4000                 ad.u.net->family = family;
4001
4002                 if (family == PF_INET)
4003                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4004                 else
4005                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4006
4007                 err = avc_has_perm(sksec->sid, sid,
4008                                    sksec->sclass, node_perm, &ad);
4009                 if (err)
4010                         goto out;
4011         }
4012 out:
4013         return err;
4014 }
4015
4016 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4017 {
4018         struct sock *sk = sock->sk;
4019         struct sk_security_struct *sksec = sk->sk_security;
4020         int err;
4021
4022         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4023         if (err)
4024                 return err;
4025
4026         /*
4027          * If a TCP or DCCP socket, check name_connect permission for the port.
4028          */
4029         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4030             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4031                 struct common_audit_data ad;
4032                 struct lsm_network_audit net = {0,};
4033                 struct sockaddr_in *addr4 = NULL;
4034                 struct sockaddr_in6 *addr6 = NULL;
4035                 unsigned short snum;
4036                 u32 sid, perm;
4037
4038                 if (sk->sk_family == PF_INET) {
4039                         addr4 = (struct sockaddr_in *)address;
4040                         if (addrlen < sizeof(struct sockaddr_in))
4041                                 return -EINVAL;
4042                         snum = ntohs(addr4->sin_port);
4043                 } else {
4044                         addr6 = (struct sockaddr_in6 *)address;
4045                         if (addrlen < SIN6_LEN_RFC2133)
4046                                 return -EINVAL;
4047                         snum = ntohs(addr6->sin6_port);
4048                 }
4049
4050                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4051                 if (err)
4052                         goto out;
4053
4054                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4055                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4056
4057                 ad.type = LSM_AUDIT_DATA_NET;
4058                 ad.u.net = &net;
4059                 ad.u.net->dport = htons(snum);
4060                 ad.u.net->family = sk->sk_family;
4061                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4062                 if (err)
4063                         goto out;
4064         }
4065
4066         err = selinux_netlbl_socket_connect(sk, address);
4067
4068 out:
4069         return err;
4070 }
4071
4072 static int selinux_socket_listen(struct socket *sock, int backlog)
4073 {
4074         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4075 }
4076
4077 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4078 {
4079         int err;
4080         struct inode_security_struct *isec;
4081         struct inode_security_struct *newisec;
4082
4083         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4084         if (err)
4085                 return err;
4086
4087         newisec = SOCK_INODE(newsock)->i_security;
4088
4089         isec = SOCK_INODE(sock)->i_security;
4090         newisec->sclass = isec->sclass;
4091         newisec->sid = isec->sid;
4092         newisec->initialized = 1;
4093
4094         return 0;
4095 }
4096
4097 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4098                                   int size)
4099 {
4100         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4101 }
4102
4103 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4104                                   int size, int flags)
4105 {
4106         return sock_has_perm(current, sock->sk, SOCKET__READ);
4107 }
4108
4109 static int selinux_socket_getsockname(struct socket *sock)
4110 {
4111         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4112 }
4113
4114 static int selinux_socket_getpeername(struct socket *sock)
4115 {
4116         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4117 }
4118
4119 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4120 {
4121         int err;
4122
4123         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4124         if (err)
4125                 return err;
4126
4127         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4128 }
4129
4130 static int selinux_socket_getsockopt(struct socket *sock, int level,
4131                                      int optname)
4132 {
4133         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4134 }
4135
4136 static int selinux_socket_shutdown(struct socket *sock, int how)
4137 {
4138         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4139 }
4140
4141 static int selinux_socket_unix_stream_connect(struct sock *sock,
4142                                               struct sock *other,
4143                                               struct sock *newsk)
4144 {
4145         struct sk_security_struct *sksec_sock = sock->sk_security;
4146         struct sk_security_struct *sksec_other = other->sk_security;
4147         struct sk_security_struct *sksec_new = newsk->sk_security;
4148         struct common_audit_data ad;
4149         struct lsm_network_audit net = {0,};
4150         int err;
4151
4152         ad.type = LSM_AUDIT_DATA_NET;
4153         ad.u.net = &net;
4154         ad.u.net->sk = other;
4155
4156         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4157                            sksec_other->sclass,
4158                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4159         if (err)
4160                 return err;
4161
4162         /* server child socket */
4163         sksec_new->peer_sid = sksec_sock->sid;
4164         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4165                                     &sksec_new->sid);
4166         if (err)
4167                 return err;
4168
4169         /* connecting socket */
4170         sksec_sock->peer_sid = sksec_new->sid;
4171
4172         return 0;
4173 }
4174
4175 static int selinux_socket_unix_may_send(struct socket *sock,
4176                                         struct socket *other)
4177 {
4178         struct sk_security_struct *ssec = sock->sk->sk_security;
4179         struct sk_security_struct *osec = other->sk->sk_security;
4180         struct common_audit_data ad;
4181         struct lsm_network_audit net = {0,};
4182
4183         ad.type = LSM_AUDIT_DATA_NET;
4184         ad.u.net = &net;
4185         ad.u.net->sk = other->sk;
4186
4187         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4188                             &ad);
4189 }
4190
4191 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4192                                     u32 peer_sid,
4193                                     struct common_audit_data *ad)
4194 {
4195         int err;
4196         u32 if_sid;
4197         u32 node_sid;
4198
4199         err = sel_netif_sid(ifindex, &if_sid);
4200         if (err)
4201                 return err;
4202         err = avc_has_perm(peer_sid, if_sid,
4203                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4204         if (err)
4205                 return err;
4206
4207         err = sel_netnode_sid(addrp, family, &node_sid);
4208         if (err)
4209                 return err;
4210         return avc_has_perm(peer_sid, node_sid,
4211                             SECCLASS_NODE, NODE__RECVFROM, ad);
4212 }
4213
4214 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4215                                        u16 family)
4216 {
4217         int err = 0;
4218         struct sk_security_struct *sksec = sk->sk_security;
4219         u32 sk_sid = sksec->sid;
4220         struct common_audit_data ad;
4221         struct lsm_network_audit net = {0,};
4222         char *addrp;
4223
4224         ad.type = LSM_AUDIT_DATA_NET;
4225         ad.u.net = &net;
4226         ad.u.net->netif = skb->skb_iif;
4227         ad.u.net->family = family;
4228         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4229         if (err)
4230                 return err;
4231
4232         if (selinux_secmark_enabled()) {
4233                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4234                                    PACKET__RECV, &ad);
4235                 if (err)
4236                         return err;
4237         }
4238
4239         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4240         if (err)
4241                 return err;
4242         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4243
4244         return err;
4245 }
4246
4247 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4248 {
4249         int err;
4250         struct sk_security_struct *sksec = sk->sk_security;
4251         u16 family = sk->sk_family;
4252         u32 sk_sid = sksec->sid;
4253         struct common_audit_data ad;
4254         struct lsm_network_audit net = {0,};
4255         char *addrp;
4256         u8 secmark_active;
4257         u8 peerlbl_active;
4258
4259         if (family != PF_INET && family != PF_INET6)
4260                 return 0;
4261
4262         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4263         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4264                 family = PF_INET;
4265
4266         /* If any sort of compatibility mode is enabled then handoff processing
4267          * to the selinux_sock_rcv_skb_compat() function to deal with the
4268          * special handling.  We do this in an attempt to keep this function
4269          * as fast and as clean as possible. */
4270         if (!selinux_policycap_netpeer)
4271                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4272
4273         secmark_active = selinux_secmark_enabled();
4274         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4275         if (!secmark_active && !peerlbl_active)
4276                 return 0;
4277
4278         ad.type = LSM_AUDIT_DATA_NET;
4279         ad.u.net = &net;
4280         ad.u.net->netif = skb->skb_iif;
4281         ad.u.net->family = family;
4282         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4283         if (err)
4284                 return err;
4285
4286         if (peerlbl_active) {
4287                 u32 peer_sid;
4288
4289                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4290                 if (err)
4291                         return err;
4292                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4293                                                peer_sid, &ad);
4294                 if (err) {
4295                         selinux_netlbl_err(skb, err, 0);
4296                         return err;
4297                 }
4298                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4299                                    PEER__RECV, &ad);
4300                 if (err) {
4301                         selinux_netlbl_err(skb, err, 0);
4302                         return err;
4303                 }
4304         }
4305
4306         if (secmark_active) {
4307                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4308                                    PACKET__RECV, &ad);
4309                 if (err)
4310                         return err;
4311         }
4312
4313         return err;
4314 }
4315
4316 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4317                                             int __user *optlen, unsigned len)
4318 {
4319         int err = 0;
4320         char *scontext;
4321         u32 scontext_len;
4322         struct sk_security_struct *sksec = sock->sk->sk_security;
4323         u32 peer_sid = SECSID_NULL;
4324
4325         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4326             sksec->sclass == SECCLASS_TCP_SOCKET)
4327                 peer_sid = sksec->peer_sid;
4328         if (peer_sid == SECSID_NULL)
4329                 return -ENOPROTOOPT;
4330
4331         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4332         if (err)
4333                 return err;
4334
4335         if (scontext_len > len) {
4336                 err = -ERANGE;
4337                 goto out_len;
4338         }
4339
4340         if (copy_to_user(optval, scontext, scontext_len))
4341                 err = -EFAULT;
4342
4343 out_len:
4344         if (put_user(scontext_len, optlen))
4345                 err = -EFAULT;
4346         kfree(scontext);
4347         return err;
4348 }
4349
4350 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4351 {
4352         u32 peer_secid = SECSID_NULL;
4353         u16 family;
4354
4355         if (skb && skb->protocol == htons(ETH_P_IP))
4356                 family = PF_INET;
4357         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4358                 family = PF_INET6;
4359         else if (sock)
4360                 family = sock->sk->sk_family;
4361         else
4362                 goto out;
4363
4364         if (sock && family == PF_UNIX)
4365                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4366         else if (skb)
4367                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4368
4369 out:
4370         *secid = peer_secid;
4371         if (peer_secid == SECSID_NULL)
4372                 return -EINVAL;
4373         return 0;
4374 }
4375
4376 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4377 {
4378         struct sk_security_struct *sksec;
4379
4380         sksec = kzalloc(sizeof(*sksec), priority);
4381         if (!sksec)
4382                 return -ENOMEM;
4383
4384         sksec->peer_sid = SECINITSID_UNLABELED;
4385         sksec->sid = SECINITSID_UNLABELED;
4386         selinux_netlbl_sk_security_reset(sksec);
4387         sk->sk_security = sksec;
4388
4389         return 0;
4390 }
4391
4392 static void selinux_sk_free_security(struct sock *sk)
4393 {
4394         struct sk_security_struct *sksec = sk->sk_security;
4395
4396         sk->sk_security = NULL;
4397         selinux_netlbl_sk_security_free(sksec);
4398         kfree(sksec);
4399 }
4400
4401 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4402 {
4403         struct sk_security_struct *sksec = sk->sk_security;
4404         struct sk_security_struct *newsksec = newsk->sk_security;
4405
4406         newsksec->sid = sksec->sid;
4407         newsksec->peer_sid = sksec->peer_sid;
4408         newsksec->sclass = sksec->sclass;
4409
4410         selinux_netlbl_sk_security_reset(newsksec);
4411 }
4412
4413 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4414 {
4415         if (!sk)
4416                 *secid = SECINITSID_ANY_SOCKET;
4417         else {
4418                 struct sk_security_struct *sksec = sk->sk_security;
4419
4420                 *secid = sksec->sid;
4421         }
4422 }
4423
4424 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4425 {
4426         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4427         struct sk_security_struct *sksec = sk->sk_security;
4428
4429         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4430             sk->sk_family == PF_UNIX)
4431                 isec->sid = sksec->sid;
4432         sksec->sclass = isec->sclass;
4433 }
4434
4435 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4436                                      struct request_sock *req)
4437 {
4438         struct sk_security_struct *sksec = sk->sk_security;
4439         int err;
4440         u16 family = sk->sk_family;
4441         u32 connsid;
4442         u32 peersid;
4443
4444         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4445         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4446                 family = PF_INET;
4447
4448         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4449         if (err)
4450                 return err;
4451         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4452         if (err)
4453                 return err;
4454         req->secid = connsid;
4455         req->peer_secid = peersid;
4456
4457         return selinux_netlbl_inet_conn_request(req, family);
4458 }
4459
4460 static void selinux_inet_csk_clone(struct sock *newsk,
4461                                    const struct request_sock *req)
4462 {
4463         struct sk_security_struct *newsksec = newsk->sk_security;
4464
4465         newsksec->sid = req->secid;
4466         newsksec->peer_sid = req->peer_secid;
4467         /* NOTE: Ideally, we should also get the isec->sid for the
4468            new socket in sync, but we don't have the isec available yet.
4469            So we will wait until sock_graft to do it, by which
4470            time it will have been created and available. */
4471
4472         /* We don't need to take any sort of lock here as we are the only
4473          * thread with access to newsksec */
4474         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4475 }
4476
4477 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4478 {
4479         u16 family = sk->sk_family;
4480         struct sk_security_struct *sksec = sk->sk_security;
4481
4482         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4483         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4484                 family = PF_INET;
4485
4486         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4487 }
4488
4489 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4490 {
4491         skb_set_owner_w(skb, sk);
4492 }
4493
4494 static int selinux_secmark_relabel_packet(u32 sid)
4495 {
4496         const struct task_security_struct *__tsec;
4497         u32 tsid;
4498
4499         __tsec = current_security();
4500         tsid = __tsec->sid;
4501
4502         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4503 }
4504
4505 static void selinux_secmark_refcount_inc(void)
4506 {
4507         atomic_inc(&selinux_secmark_refcount);
4508 }
4509
4510 static void selinux_secmark_refcount_dec(void)
4511 {
4512         atomic_dec(&selinux_secmark_refcount);
4513 }
4514
4515 static void selinux_req_classify_flow(const struct request_sock *req,
4516                                       struct flowi *fl)
4517 {
4518         fl->flowi_secid = req->secid;
4519 }
4520
4521 static int selinux_tun_dev_alloc_security(void **security)
4522 {
4523         struct tun_security_struct *tunsec;
4524
4525         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4526         if (!tunsec)
4527                 return -ENOMEM;
4528         tunsec->sid = current_sid();
4529
4530         *security = tunsec;
4531         return 0;
4532 }
4533
4534 static void selinux_tun_dev_free_security(void *security)
4535 {
4536         kfree(security);
4537 }
4538
4539 static int selinux_tun_dev_create(void)
4540 {
4541         u32 sid = current_sid();
4542
4543         /* we aren't taking into account the "sockcreate" SID since the socket
4544          * that is being created here is not a socket in the traditional sense,
4545          * instead it is a private sock, accessible only to the kernel, and
4546          * representing a wide range of network traffic spanning multiple
4547          * connections unlike traditional sockets - check the TUN driver to
4548          * get a better understanding of why this socket is special */
4549
4550         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4551                             NULL);
4552 }
4553
4554 static int selinux_tun_dev_attach_queue(void *security)
4555 {
4556         struct tun_security_struct *tunsec = security;
4557
4558         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4559                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4560 }
4561
4562 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4563 {
4564         struct tun_security_struct *tunsec = security;
4565         struct sk_security_struct *sksec = sk->sk_security;
4566
4567         /* we don't currently perform any NetLabel based labeling here and it
4568          * isn't clear that we would want to do so anyway; while we could apply
4569          * labeling without the support of the TUN user the resulting labeled
4570          * traffic from the other end of the connection would almost certainly
4571          * cause confusion to the TUN user that had no idea network labeling
4572          * protocols were being used */
4573
4574         sksec->sid = tunsec->sid;
4575         sksec->sclass = SECCLASS_TUN_SOCKET;
4576
4577         return 0;
4578 }
4579
4580 static int selinux_tun_dev_open(void *security)
4581 {
4582         struct tun_security_struct *tunsec = security;
4583         u32 sid = current_sid();
4584         int err;
4585
4586         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4587                            TUN_SOCKET__RELABELFROM, NULL);
4588         if (err)
4589                 return err;
4590         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4591                            TUN_SOCKET__RELABELTO, NULL);
4592         if (err)
4593                 return err;
4594         tunsec->sid = sid;
4595
4596         return 0;
4597 }
4598
4599 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4600 {
4601         int err = 0;
4602         u32 perm;
4603         struct nlmsghdr *nlh;
4604         struct sk_security_struct *sksec = sk->sk_security;
4605
4606         if (skb->len < NLMSG_HDRLEN) {
4607                 err = -EINVAL;
4608                 goto out;
4609         }
4610         nlh = nlmsg_hdr(skb);
4611
4612         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4613         if (err) {
4614                 if (err == -EINVAL) {
4615                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4616                                   "SELinux:  unrecognized netlink message"
4617                                   " type=%hu for sclass=%hu\n",
4618                                   nlh->nlmsg_type, sksec->sclass);
4619                         if (!selinux_enforcing || security_get_allow_unknown())
4620                                 err = 0;
4621                 }
4622
4623                 /* Ignore */
4624                 if (err == -ENOENT)
4625                         err = 0;
4626                 goto out;
4627         }
4628
4629         err = sock_has_perm(current, sk, perm);
4630 out:
4631         return err;
4632 }
4633
4634 #ifdef CONFIG_NETFILTER
4635
4636 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4637                                        u16 family)
4638 {
4639         int err;
4640         char *addrp;
4641         u32 peer_sid;
4642         struct common_audit_data ad;
4643         struct lsm_network_audit net = {0,};
4644         u8 secmark_active;
4645         u8 netlbl_active;
4646         u8 peerlbl_active;
4647
4648         if (!selinux_policycap_netpeer)
4649                 return NF_ACCEPT;
4650
4651         secmark_active = selinux_secmark_enabled();
4652         netlbl_active = netlbl_enabled();
4653         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4654         if (!secmark_active && !peerlbl_active)
4655                 return NF_ACCEPT;
4656
4657         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4658                 return NF_DROP;
4659
4660         ad.type = LSM_AUDIT_DATA_NET;
4661         ad.u.net = &net;
4662         ad.u.net->netif = ifindex;
4663         ad.u.net->family = family;
4664         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4665                 return NF_DROP;
4666
4667         if (peerlbl_active) {
4668                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4669                                                peer_sid, &ad);
4670                 if (err) {
4671                         selinux_netlbl_err(skb, err, 1);
4672                         return NF_DROP;
4673                 }
4674         }
4675
4676         if (secmark_active)
4677                 if (avc_has_perm(peer_sid, skb->secmark,
4678                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4679                         return NF_DROP;
4680
4681         if (netlbl_active)
4682                 /* we do this in the FORWARD path and not the POST_ROUTING
4683                  * path because we want to make sure we apply the necessary
4684                  * labeling before IPsec is applied so we can leverage AH
4685                  * protection */
4686                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4687                         return NF_DROP;
4688
4689         return NF_ACCEPT;
4690 }
4691
4692 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4693                                          struct sk_buff *skb,
4694                                          const struct net_device *in,
4695                                          const struct net_device *out,
4696                                          int (*okfn)(struct sk_buff *))
4697 {
4698         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4699 }
4700
4701 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4702 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4703                                          struct sk_buff *skb,
4704                                          const struct net_device *in,
4705                                          const struct net_device *out,
4706                                          int (*okfn)(struct sk_buff *))
4707 {
4708         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4709 }
4710 #endif  /* IPV6 */
4711
4712 static unsigned int selinux_ip_output(struct sk_buff *skb,
4713                                       u16 family)
4714 {
4715         struct sock *sk;
4716         u32 sid;
4717
4718         if (!netlbl_enabled())
4719                 return NF_ACCEPT;
4720
4721         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4722          * because we want to make sure we apply the necessary labeling
4723          * before IPsec is applied so we can leverage AH protection */
4724         sk = skb->sk;
4725         if (sk) {
4726                 struct sk_security_struct *sksec;
4727
4728                 if (sk->sk_state == TCP_LISTEN)
4729                         /* if the socket is the listening state then this
4730                          * packet is a SYN-ACK packet which means it needs to
4731                          * be labeled based on the connection/request_sock and
4732                          * not the parent socket.  unfortunately, we can't
4733                          * lookup the request_sock yet as it isn't queued on
4734                          * the parent socket until after the SYN-ACK is sent.
4735                          * the "solution" is to simply pass the packet as-is
4736                          * as any IP option based labeling should be copied
4737                          * from the initial connection request (in the IP
4738                          * layer).  it is far from ideal, but until we get a
4739                          * security label in the packet itself this is the
4740                          * best we can do. */
4741                         return NF_ACCEPT;
4742
4743                 /* standard practice, label using the parent socket */
4744                 sksec = sk->sk_security;
4745                 sid = sksec->sid;
4746         } else
4747                 sid = SECINITSID_KERNEL;
4748         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4749                 return NF_DROP;
4750
4751         return NF_ACCEPT;
4752 }
4753
4754 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4755                                         struct sk_buff *skb,
4756                                         const struct net_device *in,
4757                                         const struct net_device *out,
4758                                         int (*okfn)(struct sk_buff *))
4759 {
4760         return selinux_ip_output(skb, PF_INET);
4761 }
4762
4763 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4764                                                 int ifindex,
4765                                                 u16 family)
4766 {
4767         struct sock *sk = skb->sk;
4768         struct sk_security_struct *sksec;
4769         struct common_audit_data ad;
4770         struct lsm_network_audit net = {0,};
4771         char *addrp;
4772         u8 proto;
4773
4774         if (sk == NULL)
4775                 return NF_ACCEPT;
4776         sksec = sk->sk_security;
4777
4778         ad.type = LSM_AUDIT_DATA_NET;
4779         ad.u.net = &net;
4780         ad.u.net->netif = ifindex;
4781         ad.u.net->family = family;
4782         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4783                 return NF_DROP;
4784
4785         if (selinux_secmark_enabled())
4786                 if (avc_has_perm(sksec->sid, skb->secmark,
4787                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4788                         return NF_DROP_ERR(-ECONNREFUSED);
4789
4790         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4791                 return NF_DROP_ERR(-ECONNREFUSED);
4792
4793         return NF_ACCEPT;
4794 }
4795
4796 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4797                                          u16 family)
4798 {
4799         u32 secmark_perm;
4800         u32 peer_sid;
4801         struct sock *sk;
4802         struct common_audit_data ad;
4803         struct lsm_network_audit net = {0,};
4804         char *addrp;
4805         u8 secmark_active;
4806         u8 peerlbl_active;
4807
4808         /* If any sort of compatibility mode is enabled then handoff processing
4809          * to the selinux_ip_postroute_compat() function to deal with the
4810          * special handling.  We do this in an attempt to keep this function
4811          * as fast and as clean as possible. */
4812         if (!selinux_policycap_netpeer)
4813                 return selinux_ip_postroute_compat(skb, ifindex, family);
4814
4815         secmark_active = selinux_secmark_enabled();
4816         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4817         if (!secmark_active && !peerlbl_active)
4818                 return NF_ACCEPT;
4819
4820         sk = skb->sk;
4821
4822 #ifdef CONFIG_XFRM
4823         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4824          * packet transformation so allow the packet to pass without any checks
4825          * since we'll have another chance to perform access control checks
4826          * when the packet is on it's final way out.
4827          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4828          *       is NULL, in this case go ahead and apply access control.
4829          *       is NULL, in this case go ahead and apply access control.
4830          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4831          *       TCP listening state we cannot wait until the XFRM processing
4832          *       is done as we will miss out on the SA label if we do;
4833          *       unfortunately, this means more work, but it is only once per
4834          *       connection. */
4835         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4836             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4837                 return NF_ACCEPT;
4838 #endif
4839
4840         if (sk == NULL) {
4841                 /* Without an associated socket the packet is either coming
4842                  * from the kernel or it is being forwarded; check the packet
4843                  * to determine which and if the packet is being forwarded
4844                  * query the packet directly to determine the security label. */
4845                 if (skb->skb_iif) {
4846                         secmark_perm = PACKET__FORWARD_OUT;
4847                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4848                                 return NF_DROP;
4849                 } else {
4850                         secmark_perm = PACKET__SEND;
4851                         peer_sid = SECINITSID_KERNEL;
4852                 }
4853         } else if (sk->sk_state == TCP_LISTEN) {
4854                 /* Locally generated packet but the associated socket is in the
4855                  * listening state which means this is a SYN-ACK packet.  In
4856                  * this particular case the correct security label is assigned
4857                  * to the connection/request_sock but unfortunately we can't
4858                  * query the request_sock as it isn't queued on the parent
4859                  * socket until after the SYN-ACK packet is sent; the only
4860                  * viable choice is to regenerate the label like we do in
4861                  * selinux_inet_conn_request().  See also selinux_ip_output()
4862                  * for similar problems. */
4863                 u32 skb_sid;
4864                 struct sk_security_struct *sksec = sk->sk_security;
4865                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4866                         return NF_DROP;
4867                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4868                  * and the packet has been through at least one XFRM
4869                  * transformation then we must be dealing with the "final"
4870                  * form of labeled IPsec packet; since we've already applied
4871                  * all of our access controls on this packet we can safely
4872                  * pass the packet. */
4873                 if (skb_sid == SECSID_NULL) {
4874                         switch (family) {
4875                         case PF_INET:
4876                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4877                                         return NF_ACCEPT;
4878                                 break;
4879                         case PF_INET6:
4880                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4881                                         return NF_ACCEPT;
4882                         default:
4883                                 return NF_DROP_ERR(-ECONNREFUSED);
4884                         }
4885                 }
4886                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4887                         return NF_DROP;
4888                 secmark_perm = PACKET__SEND;
4889         } else {
4890                 /* Locally generated packet, fetch the security label from the
4891                  * associated socket. */
4892                 struct sk_security_struct *sksec = sk->sk_security;
4893                 peer_sid = sksec->sid;
4894                 secmark_perm = PACKET__SEND;
4895         }
4896
4897         ad.type = LSM_AUDIT_DATA_NET;
4898         ad.u.net = &net;
4899         ad.u.net->netif = ifindex;
4900         ad.u.net->family = family;
4901         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4902                 return NF_DROP;
4903
4904         if (secmark_active)
4905                 if (avc_has_perm(peer_sid, skb->secmark,
4906                                  SECCLASS_PACKET, secmark_perm, &ad))
4907                         return NF_DROP_ERR(-ECONNREFUSED);
4908
4909         if (peerlbl_active) {
4910                 u32 if_sid;
4911                 u32 node_sid;
4912
4913                 if (sel_netif_sid(ifindex, &if_sid))
4914                         return NF_DROP;
4915                 if (avc_has_perm(peer_sid, if_sid,
4916                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4917                         return NF_DROP_ERR(-ECONNREFUSED);
4918
4919                 if (sel_netnode_sid(addrp, family, &node_sid))
4920                         return NF_DROP;
4921                 if (avc_has_perm(peer_sid, node_sid,
4922                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4923                         return NF_DROP_ERR(-ECONNREFUSED);
4924         }
4925
4926         return NF_ACCEPT;
4927 }
4928
4929 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4930                                            struct sk_buff *skb,
4931                                            const struct net_device *in,
4932                                            const struct net_device *out,
4933                                            int (*okfn)(struct sk_buff *))
4934 {
4935         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4936 }
4937
4938 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4939 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4940                                            struct sk_buff *skb,
4941                                            const struct net_device *in,
4942                                            const struct net_device *out,
4943                                            int (*okfn)(struct sk_buff *))
4944 {
4945         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4946 }
4947 #endif  /* IPV6 */
4948
4949 #endif  /* CONFIG_NETFILTER */
4950
4951 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4952 {
4953         int err;
4954
4955         err = cap_netlink_send(sk, skb);
4956         if (err)
4957                 return err;
4958
4959         return selinux_nlmsg_perm(sk, skb);
4960 }
4961
4962 static int ipc_alloc_security(struct task_struct *task,
4963                               struct kern_ipc_perm *perm,
4964                               u16 sclass)
4965 {
4966         struct ipc_security_struct *isec;
4967         u32 sid;
4968
4969         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4970         if (!isec)
4971                 return -ENOMEM;
4972
4973         sid = task_sid(task);
4974         isec->sclass = sclass;
4975         isec->sid = sid;
4976         perm->security = isec;
4977
4978         return 0;
4979 }
4980
4981 static void ipc_free_security(struct kern_ipc_perm *perm)
4982 {
4983         struct ipc_security_struct *isec = perm->security;
4984         perm->security = NULL;
4985         kfree(isec);
4986 }
4987
4988 static int msg_msg_alloc_security(struct msg_msg *msg)
4989 {
4990         struct msg_security_struct *msec;
4991
4992         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4993         if (!msec)
4994                 return -ENOMEM;
4995
4996         msec->sid = SECINITSID_UNLABELED;
4997         msg->security = msec;
4998
4999         return 0;
5000 }
5001
5002 static void msg_msg_free_security(struct msg_msg *msg)
5003 {
5004         struct msg_security_struct *msec = msg->security;
5005
5006         msg->security = NULL;
5007         kfree(msec);
5008 }
5009
5010 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5011                         u32 perms)
5012 {
5013         struct ipc_security_struct *isec;
5014         struct common_audit_data ad;
5015         u32 sid = current_sid();
5016
5017         isec = ipc_perms->security;
5018
5019         ad.type = LSM_AUDIT_DATA_IPC;
5020         ad.u.ipc_id = ipc_perms->key;
5021
5022         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5023 }
5024
5025 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5026 {
5027         return msg_msg_alloc_security(msg);
5028 }
5029
5030 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5031 {
5032         msg_msg_free_security(msg);
5033 }
5034
5035 /* message queue security operations */
5036 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5037 {
5038         struct ipc_security_struct *isec;
5039         struct common_audit_data ad;
5040         u32 sid = current_sid();
5041         int rc;
5042
5043         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5044         if (rc)
5045                 return rc;
5046
5047         isec = msq->q_perm.security;
5048
5049         ad.type = LSM_AUDIT_DATA_IPC;
5050         ad.u.ipc_id = msq->q_perm.key;
5051
5052         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5053                           MSGQ__CREATE, &ad);
5054         if (rc) {
5055                 ipc_free_security(&msq->q_perm);
5056                 return rc;
5057         }
5058         return 0;
5059 }
5060
5061 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5062 {
5063         ipc_free_security(&msq->q_perm);
5064 }
5065
5066 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5067 {
5068         struct ipc_security_struct *isec;
5069         struct common_audit_data ad;
5070         u32 sid = current_sid();
5071
5072         isec = msq->q_perm.security;
5073
5074         ad.type = LSM_AUDIT_DATA_IPC;
5075         ad.u.ipc_id = msq->q_perm.key;
5076
5077         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5078                             MSGQ__ASSOCIATE, &ad);
5079 }
5080
5081 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5082 {
5083         int err;
5084         int perms;
5085
5086         switch (cmd) {
5087         case IPC_INFO:
5088         case MSG_INFO:
5089                 /* No specific object, just general system-wide information. */
5090                 return task_has_system(current, SYSTEM__IPC_INFO);
5091         case IPC_STAT:
5092         case MSG_STAT:
5093                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5094                 break;
5095         case IPC_SET:
5096                 perms = MSGQ__SETATTR;
5097                 break;
5098         case IPC_RMID:
5099                 perms = MSGQ__DESTROY;
5100                 break;
5101         default:
5102                 return 0;
5103         }
5104
5105         err = ipc_has_perm(&msq->q_perm, perms);
5106         return err;
5107 }
5108
5109 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5110 {
5111         struct ipc_security_struct *isec;
5112         struct msg_security_struct *msec;
5113         struct common_audit_data ad;
5114         u32 sid = current_sid();
5115         int rc;
5116
5117         isec = msq->q_perm.security;
5118         msec = msg->security;
5119
5120         /*
5121          * First time through, need to assign label to the message
5122          */
5123         if (msec->sid == SECINITSID_UNLABELED) {
5124                 /*
5125                  * Compute new sid based on current process and
5126                  * message queue this message will be stored in
5127                  */
5128                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5129                                              NULL, &msec->sid);
5130                 if (rc)
5131                         return rc;
5132         }
5133
5134         ad.type = LSM_AUDIT_DATA_IPC;
5135         ad.u.ipc_id = msq->q_perm.key;
5136
5137         /* Can this process write to the queue? */
5138         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5139                           MSGQ__WRITE, &ad);
5140         if (!rc)
5141                 /* Can this process send the message */
5142                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5143                                   MSG__SEND, &ad);
5144         if (!rc)
5145                 /* Can the message be put in the queue? */
5146                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5147                                   MSGQ__ENQUEUE, &ad);
5148
5149         return rc;
5150 }
5151
5152 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5153                                     struct task_struct *target,
5154                                     long type, int mode)
5155 {
5156         struct ipc_security_struct *isec;
5157         struct msg_security_struct *msec;
5158         struct common_audit_data ad;
5159         u32 sid = task_sid(target);
5160         int rc;
5161
5162         isec = msq->q_perm.security;
5163         msec = msg->security;
5164
5165         ad.type = LSM_AUDIT_DATA_IPC;
5166         ad.u.ipc_id = msq->q_perm.key;
5167
5168         rc = avc_has_perm(sid, isec->sid,
5169                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5170         if (!rc)
5171                 rc = avc_has_perm(sid, msec->sid,
5172                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5173         return rc;
5174 }
5175
5176 /* Shared Memory security operations */
5177 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5178 {
5179         struct ipc_security_struct *isec;
5180         struct common_audit_data ad;
5181         u32 sid = current_sid();
5182         int rc;
5183
5184         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5185         if (rc)
5186                 return rc;
5187
5188         isec = shp->shm_perm.security;
5189
5190         ad.type = LSM_AUDIT_DATA_IPC;
5191         ad.u.ipc_id = shp->shm_perm.key;
5192
5193         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5194                           SHM__CREATE, &ad);
5195         if (rc) {
5196                 ipc_free_security(&shp->shm_perm);
5197                 return rc;
5198         }
5199         return 0;
5200 }
5201
5202 static void selinux_shm_free_security(struct shmid_kernel *shp)
5203 {
5204         ipc_free_security(&shp->shm_perm);
5205 }
5206
5207 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5208 {
5209         struct ipc_security_struct *isec;
5210         struct common_audit_data ad;
5211         u32 sid = current_sid();
5212
5213         isec = shp->shm_perm.security;
5214
5215         ad.type = LSM_AUDIT_DATA_IPC;
5216         ad.u.ipc_id = shp->shm_perm.key;
5217
5218         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5219                             SHM__ASSOCIATE, &ad);
5220 }
5221
5222 /* Note, at this point, shp is locked down */
5223 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5224 {
5225         int perms;
5226         int err;
5227
5228         switch (cmd) {
5229         case IPC_INFO:
5230         case SHM_INFO:
5231                 /* No specific object, just general system-wide information. */
5232                 return task_has_system(current, SYSTEM__IPC_INFO);
5233         case IPC_STAT:
5234         case SHM_STAT:
5235                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5236                 break;
5237         case IPC_SET:
5238                 perms = SHM__SETATTR;
5239                 break;
5240         case SHM_LOCK:
5241         case SHM_UNLOCK:
5242                 perms = SHM__LOCK;
5243                 break;
5244         case IPC_RMID:
5245                 perms = SHM__DESTROY;
5246                 break;
5247         default:
5248                 return 0;
5249         }
5250
5251         err = ipc_has_perm(&shp->shm_perm, perms);
5252         return err;
5253 }
5254
5255 static int selinux_shm_shmat(struct shmid_kernel *shp,
5256                              char __user *shmaddr, int shmflg)
5257 {
5258         u32 perms;
5259
5260         if (shmflg & SHM_RDONLY)
5261                 perms = SHM__READ;
5262         else
5263                 perms = SHM__READ | SHM__WRITE;
5264
5265         return ipc_has_perm(&shp->shm_perm, perms);
5266 }
5267
5268 /* Semaphore security operations */
5269 static int selinux_sem_alloc_security(struct sem_array *sma)
5270 {
5271         struct ipc_security_struct *isec;
5272         struct common_audit_data ad;
5273         u32 sid = current_sid();
5274         int rc;
5275
5276         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5277         if (rc)
5278                 return rc;
5279
5280         isec = sma->sem_perm.security;
5281
5282         ad.type = LSM_AUDIT_DATA_IPC;
5283         ad.u.ipc_id = sma->sem_perm.key;
5284
5285         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5286                           SEM__CREATE, &ad);
5287         if (rc) {
5288                 ipc_free_security(&sma->sem_perm);
5289                 return rc;
5290         }
5291         return 0;
5292 }
5293
5294 static void selinux_sem_free_security(struct sem_array *sma)
5295 {
5296         ipc_free_security(&sma->sem_perm);
5297 }
5298
5299 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5300 {
5301         struct ipc_security_struct *isec;
5302         struct common_audit_data ad;
5303         u32 sid = current_sid();
5304
5305         isec = sma->sem_perm.security;
5306
5307         ad.type = LSM_AUDIT_DATA_IPC;
5308         ad.u.ipc_id = sma->sem_perm.key;
5309
5310         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5311                             SEM__ASSOCIATE, &ad);
5312 }
5313
5314 /* Note, at this point, sma is locked down */
5315 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5316 {
5317         int err;
5318         u32 perms;
5319
5320         switch (cmd) {
5321         case IPC_INFO:
5322         case SEM_INFO:
5323                 /* No specific object, just general system-wide information. */
5324                 return task_has_system(current, SYSTEM__IPC_INFO);
5325         case GETPID:
5326         case GETNCNT:
5327         case GETZCNT:
5328                 perms = SEM__GETATTR;
5329                 break;
5330         case GETVAL:
5331         case GETALL:
5332                 perms = SEM__READ;
5333                 break;
5334         case SETVAL:
5335         case SETALL:
5336                 perms = SEM__WRITE;
5337                 break;
5338         case IPC_RMID:
5339                 perms = SEM__DESTROY;
5340                 break;
5341         case IPC_SET:
5342                 perms = SEM__SETATTR;
5343                 break;
5344         case IPC_STAT:
5345         case SEM_STAT:
5346                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5347                 break;
5348         default:
5349                 return 0;
5350         }
5351
5352         err = ipc_has_perm(&sma->sem_perm, perms);
5353         return err;
5354 }
5355
5356 static int selinux_sem_semop(struct sem_array *sma,
5357                              struct sembuf *sops, unsigned nsops, int alter)
5358 {
5359         u32 perms;
5360
5361         if (alter)
5362                 perms = SEM__READ | SEM__WRITE;
5363         else
5364                 perms = SEM__READ;
5365
5366         return ipc_has_perm(&sma->sem_perm, perms);
5367 }
5368
5369 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5370 {
5371         u32 av = 0;
5372
5373         av = 0;
5374         if (flag & S_IRUGO)
5375                 av |= IPC__UNIX_READ;
5376         if (flag & S_IWUGO)
5377                 av |= IPC__UNIX_WRITE;
5378
5379         if (av == 0)
5380                 return 0;
5381
5382         return ipc_has_perm(ipcp, av);
5383 }
5384
5385 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5386 {
5387         struct ipc_security_struct *isec = ipcp->security;
5388         *secid = isec->sid;
5389 }
5390
5391 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5392 {
5393         if (inode)
5394                 inode_doinit_with_dentry(inode, dentry);
5395 }
5396
5397 static int selinux_getprocattr(struct task_struct *p,
5398                                char *name, char **value)
5399 {
5400         const struct task_security_struct *__tsec;
5401         u32 sid;
5402         int error;
5403         unsigned len;
5404
5405         if (current != p) {
5406                 error = current_has_perm(p, PROCESS__GETATTR);
5407                 if (error)
5408                         return error;
5409         }
5410
5411         rcu_read_lock();
5412         __tsec = __task_cred(p)->security;
5413
5414         if (!strcmp(name, "current"))
5415                 sid = __tsec->sid;
5416         else if (!strcmp(name, "prev"))
5417                 sid = __tsec->osid;
5418         else if (!strcmp(name, "exec"))
5419                 sid = __tsec->exec_sid;
5420         else if (!strcmp(name, "fscreate"))
5421                 sid = __tsec->create_sid;
5422         else if (!strcmp(name, "keycreate"))
5423                 sid = __tsec->keycreate_sid;
5424         else if (!strcmp(name, "sockcreate"))
5425                 sid = __tsec->sockcreate_sid;
5426         else
5427                 goto invalid;
5428         rcu_read_unlock();
5429
5430         if (!sid)
5431                 return 0;
5432
5433         error = security_sid_to_context(sid, value, &len);
5434         if (error)
5435                 return error;
5436         return len;
5437
5438 invalid:
5439         rcu_read_unlock();
5440         return -EINVAL;
5441 }
5442
5443 static int selinux_setprocattr(struct task_struct *p,
5444                                char *name, void *value, size_t size)
5445 {
5446         struct task_security_struct *tsec;
5447         struct task_struct *tracer;
5448         struct cred *new;
5449         u32 sid = 0, ptsid;
5450         int error;
5451         char *str = value;
5452
5453         if (current != p) {
5454                 /* SELinux only allows a process to change its own
5455                    security attributes. */
5456                 return -EACCES;
5457         }
5458
5459         /*
5460          * Basic control over ability to set these attributes at all.
5461          * current == p, but we'll pass them separately in case the
5462          * above restriction is ever removed.
5463          */
5464         if (!strcmp(name, "exec"))
5465                 error = current_has_perm(p, PROCESS__SETEXEC);
5466         else if (!strcmp(name, "fscreate"))
5467                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5468         else if (!strcmp(name, "keycreate"))
5469                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5470         else if (!strcmp(name, "sockcreate"))
5471                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5472         else if (!strcmp(name, "current"))
5473                 error = current_has_perm(p, PROCESS__SETCURRENT);
5474         else
5475                 error = -EINVAL;
5476         if (error)
5477                 return error;
5478
5479         /* Obtain a SID for the context, if one was specified. */
5480         if (size && str[1] && str[1] != '\n') {
5481                 if (str[size-1] == '\n') {
5482                         str[size-1] = 0;
5483                         size--;
5484                 }
5485                 error = security_context_to_sid(value, size, &sid);
5486                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5487                         if (!capable(CAP_MAC_ADMIN)) {
5488                                 struct audit_buffer *ab;
5489                                 size_t audit_size;
5490
5491                                 /* We strip a nul only if it is at the end, otherwise the
5492                                  * context contains a nul and we should audit that */
5493                                 if (str[size - 1] == '\0')
5494                                         audit_size = size - 1;
5495                                 else
5496                                         audit_size = size;
5497                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5498                                 audit_log_format(ab, "op=fscreate invalid_context=");
5499                                 audit_log_n_untrustedstring(ab, value, audit_size);
5500                                 audit_log_end(ab);
5501
5502                                 return error;
5503                         }
5504                         error = security_context_to_sid_force(value, size,
5505                                                               &sid);
5506                 }
5507                 if (error)
5508                         return error;
5509         }
5510
5511         new = prepare_creds();
5512         if (!new)
5513                 return -ENOMEM;
5514
5515         /* Permission checking based on the specified context is
5516            performed during the actual operation (execve,
5517            open/mkdir/...), when we know the full context of the
5518            operation.  See selinux_bprm_set_creds for the execve
5519            checks and may_create for the file creation checks. The
5520            operation will then fail if the context is not permitted. */
5521         tsec = new->security;
5522         if (!strcmp(name, "exec")) {
5523                 tsec->exec_sid = sid;
5524         } else if (!strcmp(name, "fscreate")) {
5525                 tsec->create_sid = sid;
5526         } else if (!strcmp(name, "keycreate")) {
5527                 error = may_create_key(sid, p);
5528                 if (error)
5529                         goto abort_change;
5530                 tsec->keycreate_sid = sid;
5531         } else if (!strcmp(name, "sockcreate")) {
5532                 tsec->sockcreate_sid = sid;
5533         } else if (!strcmp(name, "current")) {
5534                 error = -EINVAL;
5535                 if (sid == 0)
5536                         goto abort_change;
5537
5538                 /* Only allow single threaded processes to change context */
5539                 error = -EPERM;
5540                 if (!current_is_single_threaded()) {
5541                         error = security_bounded_transition(tsec->sid, sid);
5542                         if (error)
5543                                 goto abort_change;
5544                 }
5545
5546                 /* Check permissions for the transition. */
5547                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5548                                      PROCESS__DYNTRANSITION, NULL);
5549                 if (error)
5550                         goto abort_change;
5551
5552                 /* Check for ptracing, and update the task SID if ok.
5553                    Otherwise, leave SID unchanged and fail. */
5554                 ptsid = 0;
5555                 rcu_read_lock();
5556                 tracer = ptrace_parent(p);
5557                 if (tracer)
5558                         ptsid = task_sid(tracer);
5559                 rcu_read_unlock();
5560
5561                 if (tracer) {
5562                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5563                                              PROCESS__PTRACE, NULL);
5564                         if (error)
5565                                 goto abort_change;
5566                 }
5567
5568                 tsec->sid = sid;
5569         } else {
5570                 error = -EINVAL;
5571                 goto abort_change;
5572         }
5573
5574         commit_creds(new);
5575         return size;
5576
5577 abort_change:
5578         abort_creds(new);
5579         return error;
5580 }
5581
5582 static int selinux_ismaclabel(const char *name)
5583 {
5584         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5585 }
5586
5587 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5588 {
5589         return security_sid_to_context(secid, secdata, seclen);
5590 }
5591
5592 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5593 {
5594         return security_context_to_sid(secdata, seclen, secid);
5595 }
5596
5597 static void selinux_release_secctx(char *secdata, u32 seclen)
5598 {
5599         kfree(secdata);
5600 }
5601
5602 /*
5603  *      called with inode->i_mutex locked
5604  */
5605 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5606 {
5607         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5608 }
5609
5610 /*
5611  *      called with inode->i_mutex locked
5612  */
5613 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5614 {
5615         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5616 }
5617
5618 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5619 {
5620         int len = 0;
5621         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5622                                                 ctx, true);
5623         if (len < 0)
5624                 return len;
5625         *ctxlen = len;
5626         return 0;
5627 }
5628 #ifdef CONFIG_KEYS
5629
5630 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5631                              unsigned long flags)
5632 {
5633         const struct task_security_struct *tsec;
5634         struct key_security_struct *ksec;
5635
5636         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5637         if (!ksec)
5638                 return -ENOMEM;
5639
5640         tsec = cred->security;
5641         if (tsec->keycreate_sid)
5642                 ksec->sid = tsec->keycreate_sid;
5643         else
5644                 ksec->sid = tsec->sid;
5645
5646         k->security = ksec;
5647         return 0;
5648 }
5649
5650 static void selinux_key_free(struct key *k)
5651 {
5652         struct key_security_struct *ksec = k->security;
5653
5654         k->security = NULL;
5655         kfree(ksec);
5656 }
5657
5658 static int selinux_key_permission(key_ref_t key_ref,
5659                                   const struct cred *cred,
5660                                   key_perm_t perm)
5661 {
5662         struct key *key;
5663         struct key_security_struct *ksec;
5664         u32 sid;
5665
5666         /* if no specific permissions are requested, we skip the
5667            permission check. No serious, additional covert channels
5668            appear to be created. */
5669         if (perm == 0)
5670                 return 0;
5671
5672         sid = cred_sid(cred);
5673
5674         key = key_ref_to_ptr(key_ref);
5675         ksec = key->security;
5676
5677         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5678 }
5679
5680 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5681 {
5682         struct key_security_struct *ksec = key->security;
5683         char *context = NULL;
5684         unsigned len;
5685         int rc;
5686
5687         rc = security_sid_to_context(ksec->sid, &context, &len);
5688         if (!rc)
5689                 rc = len;
5690         *_buffer = context;
5691         return rc;
5692 }
5693
5694 #endif
5695
5696 static struct security_operations selinux_ops = {
5697         .name =                         "selinux",
5698
5699         .ptrace_access_check =          selinux_ptrace_access_check,
5700         .ptrace_traceme =               selinux_ptrace_traceme,
5701         .capget =                       selinux_capget,
5702         .capset =                       selinux_capset,
5703         .capable =                      selinux_capable,
5704         .quotactl =                     selinux_quotactl,
5705         .quota_on =                     selinux_quota_on,
5706         .syslog =                       selinux_syslog,
5707         .vm_enough_memory =             selinux_vm_enough_memory,
5708
5709         .netlink_send =                 selinux_netlink_send,
5710
5711         .bprm_set_creds =               selinux_bprm_set_creds,
5712         .bprm_committing_creds =        selinux_bprm_committing_creds,
5713         .bprm_committed_creds =         selinux_bprm_committed_creds,
5714         .bprm_secureexec =              selinux_bprm_secureexec,
5715
5716         .sb_alloc_security =            selinux_sb_alloc_security,
5717         .sb_free_security =             selinux_sb_free_security,
5718         .sb_copy_data =                 selinux_sb_copy_data,
5719         .sb_remount =                   selinux_sb_remount,
5720         .sb_kern_mount =                selinux_sb_kern_mount,
5721         .sb_show_options =              selinux_sb_show_options,
5722         .sb_statfs =                    selinux_sb_statfs,
5723         .sb_mount =                     selinux_mount,
5724         .sb_umount =                    selinux_umount,
5725         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5726         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5727         .sb_parse_opts_str =            selinux_parse_opts_str,
5728
5729         .dentry_init_security =         selinux_dentry_init_security,
5730
5731         .inode_alloc_security =         selinux_inode_alloc_security,
5732         .inode_free_security =          selinux_inode_free_security,
5733         .inode_init_security =          selinux_inode_init_security,
5734         .inode_create =                 selinux_inode_create,
5735         .inode_link =                   selinux_inode_link,
5736         .inode_unlink =                 selinux_inode_unlink,
5737         .inode_symlink =                selinux_inode_symlink,
5738         .inode_mkdir =                  selinux_inode_mkdir,
5739         .inode_rmdir =                  selinux_inode_rmdir,
5740         .inode_mknod =                  selinux_inode_mknod,
5741         .inode_rename =                 selinux_inode_rename,
5742         .inode_readlink =               selinux_inode_readlink,
5743         .inode_follow_link =            selinux_inode_follow_link,
5744         .inode_permission =             selinux_inode_permission,
5745         .inode_setattr =                selinux_inode_setattr,
5746         .inode_getattr =                selinux_inode_getattr,
5747         .inode_setxattr =               selinux_inode_setxattr,
5748         .inode_post_setxattr =          selinux_inode_post_setxattr,
5749         .inode_getxattr =               selinux_inode_getxattr,
5750         .inode_listxattr =              selinux_inode_listxattr,
5751         .inode_removexattr =            selinux_inode_removexattr,
5752         .inode_getsecurity =            selinux_inode_getsecurity,
5753         .inode_setsecurity =            selinux_inode_setsecurity,
5754         .inode_listsecurity =           selinux_inode_listsecurity,
5755         .inode_getsecid =               selinux_inode_getsecid,
5756
5757         .file_permission =              selinux_file_permission,
5758         .file_alloc_security =          selinux_file_alloc_security,
5759         .file_free_security =           selinux_file_free_security,
5760         .file_ioctl =                   selinux_file_ioctl,
5761         .mmap_file =                    selinux_mmap_file,
5762         .mmap_addr =                    selinux_mmap_addr,
5763         .file_mprotect =                selinux_file_mprotect,
5764         .file_lock =                    selinux_file_lock,
5765         .file_fcntl =                   selinux_file_fcntl,
5766         .file_set_fowner =              selinux_file_set_fowner,
5767         .file_send_sigiotask =          selinux_file_send_sigiotask,
5768         .file_receive =                 selinux_file_receive,
5769
5770         .file_open =                    selinux_file_open,
5771
5772         .task_create =                  selinux_task_create,
5773         .cred_alloc_blank =             selinux_cred_alloc_blank,
5774         .cred_free =                    selinux_cred_free,
5775         .cred_prepare =                 selinux_cred_prepare,
5776         .cred_transfer =                selinux_cred_transfer,
5777         .kernel_act_as =                selinux_kernel_act_as,
5778         .kernel_create_files_as =       selinux_kernel_create_files_as,
5779         .kernel_module_request =        selinux_kernel_module_request,
5780         .task_setpgid =                 selinux_task_setpgid,
5781         .task_getpgid =                 selinux_task_getpgid,
5782         .task_getsid =                  selinux_task_getsid,
5783         .task_getsecid =                selinux_task_getsecid,
5784         .task_setnice =                 selinux_task_setnice,
5785         .task_setioprio =               selinux_task_setioprio,
5786         .task_getioprio =               selinux_task_getioprio,
5787         .task_setrlimit =               selinux_task_setrlimit,
5788         .task_setscheduler =            selinux_task_setscheduler,
5789         .task_getscheduler =            selinux_task_getscheduler,
5790         .task_movememory =              selinux_task_movememory,
5791         .task_kill =                    selinux_task_kill,
5792         .task_wait =                    selinux_task_wait,
5793         .task_to_inode =                selinux_task_to_inode,
5794
5795         .ipc_permission =               selinux_ipc_permission,
5796         .ipc_getsecid =                 selinux_ipc_getsecid,
5797
5798         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5799         .msg_msg_free_security =        selinux_msg_msg_free_security,
5800
5801         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5802         .msg_queue_free_security =      selinux_msg_queue_free_security,
5803         .msg_queue_associate =          selinux_msg_queue_associate,
5804         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5805         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5806         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5807
5808         .shm_alloc_security =           selinux_shm_alloc_security,
5809         .shm_free_security =            selinux_shm_free_security,
5810         .shm_associate =                selinux_shm_associate,
5811         .shm_shmctl =                   selinux_shm_shmctl,
5812         .shm_shmat =                    selinux_shm_shmat,
5813
5814         .sem_alloc_security =           selinux_sem_alloc_security,
5815         .sem_free_security =            selinux_sem_free_security,
5816         .sem_associate =                selinux_sem_associate,
5817         .sem_semctl =                   selinux_sem_semctl,
5818         .sem_semop =                    selinux_sem_semop,
5819
5820         .d_instantiate =                selinux_d_instantiate,
5821
5822         .getprocattr =                  selinux_getprocattr,
5823         .setprocattr =                  selinux_setprocattr,
5824
5825         .ismaclabel =                   selinux_ismaclabel,
5826         .secid_to_secctx =              selinux_secid_to_secctx,
5827         .secctx_to_secid =              selinux_secctx_to_secid,
5828         .release_secctx =               selinux_release_secctx,
5829         .inode_notifysecctx =           selinux_inode_notifysecctx,
5830         .inode_setsecctx =              selinux_inode_setsecctx,
5831         .inode_getsecctx =              selinux_inode_getsecctx,
5832
5833         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5834         .unix_may_send =                selinux_socket_unix_may_send,
5835
5836         .socket_create =                selinux_socket_create,
5837         .socket_post_create =           selinux_socket_post_create,
5838         .socket_bind =                  selinux_socket_bind,
5839         .socket_connect =               selinux_socket_connect,
5840         .socket_listen =                selinux_socket_listen,
5841         .socket_accept =                selinux_socket_accept,
5842         .socket_sendmsg =               selinux_socket_sendmsg,
5843         .socket_recvmsg =               selinux_socket_recvmsg,
5844         .socket_getsockname =           selinux_socket_getsockname,
5845         .socket_getpeername =           selinux_socket_getpeername,
5846         .socket_getsockopt =            selinux_socket_getsockopt,
5847         .socket_setsockopt =            selinux_socket_setsockopt,
5848         .socket_shutdown =              selinux_socket_shutdown,
5849         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5850         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5851         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5852         .sk_alloc_security =            selinux_sk_alloc_security,
5853         .sk_free_security =             selinux_sk_free_security,
5854         .sk_clone_security =            selinux_sk_clone_security,
5855         .sk_getsecid =                  selinux_sk_getsecid,
5856         .sock_graft =                   selinux_sock_graft,
5857         .inet_conn_request =            selinux_inet_conn_request,
5858         .inet_csk_clone =               selinux_inet_csk_clone,
5859         .inet_conn_established =        selinux_inet_conn_established,
5860         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5861         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5862         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5863         .req_classify_flow =            selinux_req_classify_flow,
5864         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5865         .tun_dev_free_security =        selinux_tun_dev_free_security,
5866         .tun_dev_create =               selinux_tun_dev_create,
5867         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5868         .tun_dev_attach =               selinux_tun_dev_attach,
5869         .tun_dev_open =                 selinux_tun_dev_open,
5870         .skb_owned_by =                 selinux_skb_owned_by,
5871
5872 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5873         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5874         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5875         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5876         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5877         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5878         .xfrm_state_free_security =     selinux_xfrm_state_free,
5879         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5880         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5881         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5882         .xfrm_decode_session =          selinux_xfrm_decode_session,
5883 #endif
5884
5885 #ifdef CONFIG_KEYS
5886         .key_alloc =                    selinux_key_alloc,
5887         .key_free =                     selinux_key_free,
5888         .key_permission =               selinux_key_permission,
5889         .key_getsecurity =              selinux_key_getsecurity,
5890 #endif
5891
5892 #ifdef CONFIG_AUDIT
5893         .audit_rule_init =              selinux_audit_rule_init,
5894         .audit_rule_known =             selinux_audit_rule_known,
5895         .audit_rule_match =             selinux_audit_rule_match,
5896         .audit_rule_free =              selinux_audit_rule_free,
5897 #endif
5898 };
5899
5900 static __init int selinux_init(void)
5901 {
5902         if (!security_module_enable(&selinux_ops)) {
5903                 selinux_enabled = 0;
5904                 return 0;
5905         }
5906
5907         if (!selinux_enabled) {
5908                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5909                 return 0;
5910         }
5911
5912         printk(KERN_INFO "SELinux:  Initializing.\n");
5913
5914         /* Set the security state for the initial task. */
5915         cred_init_security();
5916
5917         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5918
5919         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5920                                             sizeof(struct inode_security_struct),
5921                                             0, SLAB_PANIC, NULL);
5922         avc_init();
5923
5924         if (register_security(&selinux_ops))
5925                 panic("SELinux: Unable to register with kernel.\n");
5926
5927         if (selinux_enforcing)
5928                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5929         else
5930                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5931
5932         return 0;
5933 }
5934
5935 static void delayed_superblock_init(struct super_block *sb, void *unused)
5936 {
5937         superblock_doinit(sb, NULL);
5938 }
5939
5940 void selinux_complete_init(void)
5941 {
5942         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5943
5944         /* Set up any superblocks initialized prior to the policy load. */
5945         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5946         iterate_supers(delayed_superblock_init, NULL);
5947 }
5948
5949 /* SELinux requires early initialization in order to label
5950    all processes and objects when they are created. */
5951 security_initcall(selinux_init);
5952
5953 #if defined(CONFIG_NETFILTER)
5954
5955 static struct nf_hook_ops selinux_ipv4_ops[] = {
5956         {
5957                 .hook =         selinux_ipv4_postroute,
5958                 .owner =        THIS_MODULE,
5959                 .pf =           NFPROTO_IPV4,
5960                 .hooknum =      NF_INET_POST_ROUTING,
5961                 .priority =     NF_IP_PRI_SELINUX_LAST,
5962         },
5963         {
5964                 .hook =         selinux_ipv4_forward,
5965                 .owner =        THIS_MODULE,
5966                 .pf =           NFPROTO_IPV4,
5967                 .hooknum =      NF_INET_FORWARD,
5968                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5969         },
5970         {
5971                 .hook =         selinux_ipv4_output,
5972                 .owner =        THIS_MODULE,
5973                 .pf =           NFPROTO_IPV4,
5974                 .hooknum =      NF_INET_LOCAL_OUT,
5975                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5976         }
5977 };
5978
5979 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5980
5981 static struct nf_hook_ops selinux_ipv6_ops[] = {
5982         {
5983                 .hook =         selinux_ipv6_postroute,
5984                 .owner =        THIS_MODULE,
5985                 .pf =           NFPROTO_IPV6,
5986                 .hooknum =      NF_INET_POST_ROUTING,
5987                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5988         },
5989         {
5990                 .hook =         selinux_ipv6_forward,
5991                 .owner =        THIS_MODULE,
5992                 .pf =           NFPROTO_IPV6,
5993                 .hooknum =      NF_INET_FORWARD,
5994                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5995         }
5996 };
5997
5998 #endif  /* IPV6 */
5999
6000 static int __init selinux_nf_ip_init(void)
6001 {
6002         int err = 0;
6003
6004         if (!selinux_enabled)
6005                 goto out;
6006
6007         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6008
6009         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6010         if (err)
6011                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6012
6013 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6014         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6015         if (err)
6016                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6017 #endif  /* IPV6 */
6018
6019 out:
6020         return err;
6021 }
6022
6023 __initcall(selinux_nf_ip_init);
6024
6025 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6026 static void selinux_nf_ip_exit(void)
6027 {
6028         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6029
6030         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6031 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6032         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6033 #endif  /* IPV6 */
6034 }
6035 #endif
6036
6037 #else /* CONFIG_NETFILTER */
6038
6039 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6040 #define selinux_nf_ip_exit()
6041 #endif
6042
6043 #endif /* CONFIG_NETFILTER */
6044
6045 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6046 static int selinux_disabled;
6047
6048 int selinux_disable(void)
6049 {
6050         if (ss_initialized) {
6051                 /* Not permitted after initial policy load. */
6052                 return -EINVAL;
6053         }
6054
6055         if (selinux_disabled) {
6056                 /* Only do this once. */
6057                 return -EINVAL;
6058         }
6059
6060         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6061
6062         selinux_disabled = 1;
6063         selinux_enabled = 0;
6064
6065         reset_security_ops();
6066
6067         /* Try to destroy the avc node cache */
6068         avc_disable();
6069
6070         /* Unregister netfilter hooks. */
6071         selinux_nf_ip_exit();
6072
6073         /* Unregister selinuxfs. */
6074         exit_sel_fs();
6075
6076         return 0;
6077 }
6078 #endif