Pileus Git - ~andy/linux/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/net_namespace.h>
  56 #include <net/netlabel.h>
  57 #include <linux/uaccess.h>
  58 #include <asm/ioctls.h>
  59 #include <linux/atomic.h>
  60 #include <linux/bitops.h>
  61 #include <linux/interrupt.h>
  62 #include <linux/netdevice.h>    /* for network interface checks */
  63 #include <linux/netlink.h>
  64 #include <linux/tcp.h>
  65 #include <linux/udp.h>
  66 #include <linux/dccp.h>
  67 #include <linux/quota.h>
  68 #include <linux/un.h>           /* for Unix socket types */
  69 #include <net/af_unix.h>        /* for Unix socket types */
  70 #include <linux/parser.h>
  71 #include <linux/nfs_mount.h>
  72 #include <net/ipv6.h>
  73 #include <linux/hugetlb.h>
  74 #include <linux/personality.h>
  75 #include <linux/audit.h>
  76 #include <linux/string.h>
  77 #include <linux/selinux.h>
  78 #include <linux/mutex.h>
  79 #include <linux/posix-timers.h>
  80 #include <linux/syslog.h>
  81 #include <linux/user_namespace.h>
  82 #include <linux/export.h>
  83 #include <linux/msg.h>
  84 #include <linux/shm.h>
  85
  86 #include "avc.h"
  87 #include "objsec.h"
  88 #include "netif.h"
  89 #include "netnode.h"
  90 #include "netport.h"
  91 #include "xfrm.h"
  92 #include "netlabel.h"
  93 #include "audit.h"
  94 #include "avc_ss.h"
  95
  96 #define NUM_SEL_MNT_OPTS 5
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (atomic_read(&selinux_secmark_refcount) > 0);
 146 }
 147
 148 /*
 149  * initialise the security for the init task
 150  */
 151 static void cred_init_security(void)
 152 {
 153         struct cred *cred = (struct cred *) current->real_cred;
 154         struct task_security_struct *tsec;
 155
 156         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 157         if (!tsec)
 158                 panic("SELinux:  Failed to initialize initial task.\n");
 159
 160         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 161         cred->security = tsec;
 162 }
 163
 164 /*
 165  * get the security ID of a set of credentials
 166  */
 167 static inline u32 cred_sid(const struct cred *cred)
 168 {
 169         const struct task_security_struct *tsec;
 170
 171         tsec = cred->security;
 172         return tsec->sid;
 173 }
 174
 175 /*
 176  * get the objective security ID of a task
 177  */
 178 static inline u32 task_sid(const struct task_struct *task)
 179 {
 180         u32 sid;
 181
 182         rcu_read_lock();
 183         sid = cred_sid(__task_cred(task));
 184         rcu_read_unlock();
 185         return sid;
 186 }
 187
 188 /*
 189  * get the subjective security ID of the current task
 190  */
 191 static inline u32 current_sid(void)
 192 {
 193         const struct task_security_struct *tsec = current_security();
 194
 195         return tsec->sid;
 196 }
 197
 198 /* Allocate and free functions for each kind of security blob. */
 199
 200 static int inode_alloc_security(struct inode *inode)
 201 {
 202         struct inode_security_struct *isec;
 203         u32 sid = current_sid();
 204
 205         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 206         if (!isec)
 207                 return -ENOMEM;
 208
 209         mutex_init(&isec->lock);
 210         INIT_LIST_HEAD(&isec->list);
 211         isec->inode = inode;
 212         isec->sid = SECINITSID_UNLABELED;
 213         isec->sclass = SECCLASS_FILE;
 214         isec->task_sid = sid;
 215         inode->i_security = isec;
 216
 217         return 0;
 218 }
 219
 220 static void inode_free_security(struct inode *inode)
 221 {
 222         struct inode_security_struct *isec = inode->i_security;
 223         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 224
 225         spin_lock(&sbsec->isec_lock);
 226         if (!list_empty(&isec->list))
 227                 list_del_init(&isec->list);
 228         spin_unlock(&sbsec->isec_lock);
 229
 230         inode->i_security = NULL;
 231         kmem_cache_free(sel_inode_cache, isec);
 232 }
 233
 234 static int file_alloc_security(struct file *file)
 235 {
 236         struct file_security_struct *fsec;
 237         u32 sid = current_sid();
 238
 239         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 240         if (!fsec)
 241                 return -ENOMEM;
 242
 243         fsec->sid = sid;
 244         fsec->fown_sid = sid;
 245         file->f_security = fsec;
 246
 247         return 0;
 248 }
 249
 250 static void file_free_security(struct file *file)
 251 {
 252         struct file_security_struct *fsec = file->f_security;
 253         file->f_security = NULL;
 254         kfree(fsec);
 255 }
 256
 257 static int superblock_alloc_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec;
 260
 261         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 262         if (!sbsec)
 263                 return -ENOMEM;
 264
 265         mutex_init(&sbsec->lock);
 266         INIT_LIST_HEAD(&sbsec->isec_head);
 267         spin_lock_init(&sbsec->isec_lock);
 268         sbsec->sb = sb;
 269         sbsec->sid = SECINITSID_UNLABELED;
 270         sbsec->def_sid = SECINITSID_FILE;
 271         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 272         sb->s_security = sbsec;
 273
 274         return 0;
 275 }
 276
 277 static void superblock_free_security(struct super_block *sb)
 278 {
 279         struct superblock_security_struct *sbsec = sb->s_security;
 280         sb->s_security = NULL;
 281         kfree(sbsec);
 282 }
 283
 284 /* The file system's label must be initialized prior to use. */
 285
 286 static const char *labeling_behaviors[6] = {
 287         "uses xattr",
 288         "uses transition SIDs",
 289         "uses task SIDs",
 290         "uses genfs_contexts",
 291         "not configured for labeling",
 292         "uses mountpoint labeling",
 293 };
 294
 295 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 296
 297 static inline int inode_doinit(struct inode *inode)
 298 {
 299         return inode_doinit_with_dentry(inode, NULL);
 300 }
 301
 302 enum {
 303         Opt_error = -1,
 304         Opt_context = 1,
 305         Opt_fscontext = 2,
 306         Opt_defcontext = 3,
 307         Opt_rootcontext = 4,
 308         Opt_labelsupport = 5,
 309 };
 310
 311 static const match_table_t tokens = {
 312         {Opt_context, CONTEXT_STR "%s"},
 313         {Opt_fscontext, FSCONTEXT_STR "%s"},
 314         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 315         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 316         {Opt_labelsupport, LABELSUPP_STR},
 317         {Opt_error, NULL},
 318 };
 319
 320 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 321
 322 static int may_context_mount_sb_relabel(u32 sid,
 323                         struct superblock_security_struct *sbsec,
 324                         const struct cred *cred)
 325 {
 326         const struct task_security_struct *tsec = cred->security;
 327         int rc;
 328
 329         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 330                           FILESYSTEM__RELABELFROM, NULL);
 331         if (rc)
 332                 return rc;
 333
 334         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 335                           FILESYSTEM__RELABELTO, NULL);
 336         return rc;
 337 }
 338
 339 static int may_context_mount_inode_relabel(u32 sid,
 340                         struct superblock_security_struct *sbsec,
 341                         const struct cred *cred)
 342 {
 343         const struct task_security_struct *tsec = cred->security;
 344         int rc;
 345         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELFROM, NULL);
 347         if (rc)
 348                 return rc;
 349
 350         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 351                           FILESYSTEM__ASSOCIATE, NULL);
 352         return rc;
 353 }
 354
 355 static int sb_finish_set_opts(struct super_block *sb)
 356 {
 357         struct superblock_security_struct *sbsec = sb->s_security;
 358         struct dentry *root = sb->s_root;
 359         struct inode *root_inode = root->d_inode;
 360         int rc = 0;
 361
 362         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 363                 /* Make sure that the xattr handler exists and that no
 364                    error other than -ENODATA is returned by getxattr on
 365                    the root directory.  -ENODATA is ok, as this may be
 366                    the first boot of the SELinux kernel before we have
 367                    assigned xattr values to the filesystem. */
 368                 if (!root_inode->i_op->getxattr) {
 369                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 370                                "xattr support\n", sb->s_id, sb->s_type->name);
 371                         rc = -EOPNOTSUPP;
 372                         goto out;
 373                 }
 374                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 375                 if (rc < 0 && rc != -ENODATA) {
 376                         if (rc == -EOPNOTSUPP)
 377                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 378                                        "%s) has no security xattr handler\n",
 379                                        sb->s_id, sb->s_type->name);
 380                         else
 381                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 382                                        "%s) getxattr errno %d\n", sb->s_id,
 383                                        sb->s_type->name, -rc);
 384                         goto out;
 385                 }
 386         }
 387
 388         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 389
 390         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 391                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 392                        sb->s_id, sb->s_type->name);
 393         else
 394                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 395                        sb->s_id, sb->s_type->name,
 396                        labeling_behaviors[sbsec->behavior-1]);
 397
 398         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 399             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 400             sbsec->behavior == SECURITY_FS_USE_NONE ||
 401             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 402                 sbsec->flags &= ~SE_SBLABELSUPP;
 403
 404         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 405         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 406                 sbsec->flags |= SE_SBLABELSUPP;
 407
 408         /* Initialize the root inode. */
 409         rc = inode_doinit_with_dentry(root_inode, root);
 410
 411         /* Initialize any other inodes associated with the superblock, e.g.
 412            inodes created prior to initial policy load or inodes created
 413            during get_sb by a pseudo filesystem that directly
 414            populates itself. */
 415         spin_lock(&sbsec->isec_lock);
 416 next_inode:
 417         if (!list_empty(&sbsec->isec_head)) {
 418                 struct inode_security_struct *isec =
 419                                 list_entry(sbsec->isec_head.next,
 420                                            struct inode_security_struct, list);
 421                 struct inode *inode = isec->inode;
 422                 spin_unlock(&sbsec->isec_lock);
 423                 inode = igrab(inode);
 424                 if (inode) {
 425                         if (!IS_PRIVATE(inode))
 426                                 inode_doinit(inode);
 427                         iput(inode);
 428                 }
 429                 spin_lock(&sbsec->isec_lock);
 430                 list_del_init(&isec->list);
 431                 goto next_inode;
 432         }
 433         spin_unlock(&sbsec->isec_lock);
 434 out:
 435         return rc;
 436 }
 437
 438 /*
 439  * This function should allow an FS to ask what it's mount security
 440  * options were so it can use those later for submounts, displaying
 441  * mount options, or whatever.
 442  */
 443 static int selinux_get_mnt_opts(const struct super_block *sb,
 444                                 struct security_mnt_opts *opts)
 445 {
 446         int rc = 0, i;
 447         struct superblock_security_struct *sbsec = sb->s_security;
 448         char *context = NULL;
 449         u32 len;
 450         char tmp;
 451
 452         security_init_mnt_opts(opts);
 453
 454         if (!(sbsec->flags & SE_SBINITIALIZED))
 455                 return -EINVAL;
 456
 457         if (!ss_initialized)
 458                 return -EINVAL;
 459
 460         tmp = sbsec->flags & SE_MNTMASK;
 461         /* count the number of mount options for this sb */
 462         for (i = 0; i < 8; i++) {
 463                 if (tmp & 0x01)
 464                         opts->num_mnt_opts++;
 465                 tmp >>= 1;
 466         }
 467         /* Check if the Label support flag is set */
 468         if (sbsec->flags & SE_SBLABELSUPP)
 469                 opts->num_mnt_opts++;
 470
 471         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 472         if (!opts->mnt_opts) {
 473                 rc = -ENOMEM;
 474                 goto out_free;
 475         }
 476
 477         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 478         if (!opts->mnt_opts_flags) {
 479                 rc = -ENOMEM;
 480                 goto out_free;
 481         }
 482
 483         i = 0;
 484         if (sbsec->flags & FSCONTEXT_MNT) {
 485                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 486                 if (rc)
 487                         goto out_free;
 488                 opts->mnt_opts[i] = context;
 489                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 490         }
 491         if (sbsec->flags & CONTEXT_MNT) {
 492                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 493                 if (rc)
 494                         goto out_free;
 495                 opts->mnt_opts[i] = context;
 496                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 497         }
 498         if (sbsec->flags & DEFCONTEXT_MNT) {
 499                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 500                 if (rc)
 501                         goto out_free;
 502                 opts->mnt_opts[i] = context;
 503                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 504         }
 505         if (sbsec->flags & ROOTCONTEXT_MNT) {
 506                 struct inode *root = sbsec->sb->s_root->d_inode;
 507                 struct inode_security_struct *isec = root->i_security;
 508
 509                 rc = security_sid_to_context(isec->sid, &context, &len);
 510                 if (rc)
 511                         goto out_free;
 512                 opts->mnt_opts[i] = context;
 513                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 514         }
 515         if (sbsec->flags & SE_SBLABELSUPP) {
 516                 opts->mnt_opts[i] = NULL;
 517                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 518         }
 519
 520         BUG_ON(i != opts->num_mnt_opts);
 521
 522         return 0;
 523
 524 out_free:
 525         security_free_mnt_opts(opts);
 526         return rc;
 527 }
 528
 529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 530                       u32 old_sid, u32 new_sid)
 531 {
 532         char mnt_flags = sbsec->flags & SE_MNTMASK;
 533
 534         /* check if the old mount command had the same options */
 535         if (sbsec->flags & SE_SBINITIALIZED)
 536                 if (!(sbsec->flags & flag) ||
 537                     (old_sid != new_sid))
 538                         return 1;
 539
 540         /* check if we were passed the same options twice,
 541          * aka someone passed context=a,context=b
 542          */
 543         if (!(sbsec->flags & SE_SBINITIALIZED))
 544                 if (mnt_flags & flag)
 545                         return 1;
 546         return 0;
 547 }
 548
 549 /*
 550  * Allow filesystems with binary mount data to explicitly set mount point
 551  * labeling information.
 552  */
 553 static int selinux_set_mnt_opts(struct super_block *sb,
 554                                 struct security_mnt_opts *opts)
 555 {
 556         const struct cred *cred = current_cred();
 557         int rc = 0, i;
 558         struct superblock_security_struct *sbsec = sb->s_security;
 559         const char *name = sb->s_type->name;
 560         struct inode *inode = sbsec->sb->s_root->d_inode;
 561         struct inode_security_struct *root_isec = inode->i_security;
 562         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 563         u32 defcontext_sid = 0;
 564         char **mount_options = opts->mnt_opts;
 565         int *flags = opts->mnt_opts_flags;
 566         int num_opts = opts->num_mnt_opts;
 567
 568         mutex_lock(&sbsec->lock);
 569
 570         if (!ss_initialized) {
 571                 if (!num_opts) {
 572                         /* Defer initialization until selinux_complete_init,
 573                            after the initial policy is loaded and the security
 574                            server is ready to handle calls. */
 575                         goto out;
 576                 }
 577                 rc = -EINVAL;
 578                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 579                         "before the security server is initialized\n");
 580                 goto out;
 581         }
 582
 583         /*
 584          * Binary mount data FS will come through this function twice.  Once
 585          * from an explicit call and once from the generic calls from the vfs.
 586          * Since the generic VFS calls will not contain any security mount data
 587          * we need to skip the double mount verification.
 588          *
 589          * This does open a hole in which we will not notice if the first
 590          * mount using this sb set explict options and a second mount using
 591          * this sb does not set any security options.  (The first options
 592          * will be used for both mounts)
 593          */
 594         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 595             && (num_opts == 0))
 596                 goto out;
 597
 598         /*
 599          * parse the mount options, check if they are valid sids.
 600          * also check if someone is trying to mount the same sb more
 601          * than once with different security options.
 602          */
 603         for (i = 0; i < num_opts; i++) {
 604                 u32 sid;
 605
 606                 if (flags[i] == SE_SBLABELSUPP)
 607                         continue;
 608                 rc = security_context_to_sid(mount_options[i],
 609                                              strlen(mount_options[i]), &sid);
 610                 if (rc) {
 611                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 612                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 613                                mount_options[i], sb->s_id, name, rc);
 614                         goto out;
 615                 }
 616                 switch (flags[i]) {
 617                 case FSCONTEXT_MNT:
 618                         fscontext_sid = sid;
 619
 620                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 621                                         fscontext_sid))
 622                                 goto out_double_mount;
 623
 624                         sbsec->flags |= FSCONTEXT_MNT;
 625                         break;
 626                 case CONTEXT_MNT:
 627                         context_sid = sid;
 628
 629                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 630                                         context_sid))
 631                                 goto out_double_mount;
 632
 633                         sbsec->flags |= CONTEXT_MNT;
 634                         break;
 635                 case ROOTCONTEXT_MNT:
 636                         rootcontext_sid = sid;
 637
 638                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 639                                         rootcontext_sid))
 640                                 goto out_double_mount;
 641
 642                         sbsec->flags |= ROOTCONTEXT_MNT;
 643
 644                         break;
 645                 case DEFCONTEXT_MNT:
 646                         defcontext_sid = sid;
 647
 648                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 649                                         defcontext_sid))
 650                                 goto out_double_mount;
 651
 652                         sbsec->flags |= DEFCONTEXT_MNT;
 653
 654                         break;
 655                 default:
 656                         rc = -EINVAL;
 657                         goto out;
 658                 }
 659         }
 660
 661         if (sbsec->flags & SE_SBINITIALIZED) {
 662                 /* previously mounted with options, but not on this attempt? */
 663                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 664                         goto out_double_mount;
 665                 rc = 0;
 666                 goto out;
 667         }
 668
 669         if (strcmp(sb->s_type->name, "proc") == 0)
 670                 sbsec->flags |= SE_SBPROC;
 671
 672         /* Determine the labeling behavior to use for this filesystem type. */
 673         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 674         if (rc) {
 675                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 676                        __func__, sb->s_type->name, rc);
 677                 goto out;
 678         }
 679
 680         /* sets the context of the superblock for the fs being mounted. */
 681         if (fscontext_sid) {
 682                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 683                 if (rc)
 684                         goto out;
 685
 686                 sbsec->sid = fscontext_sid;
 687         }
 688
 689         /*
 690          * Switch to using mount point labeling behavior.
 691          * sets the label used on all file below the mountpoint, and will set
 692          * the superblock context if not already set.
 693          */
 694         if (context_sid) {
 695                 if (!fscontext_sid) {
 696                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 697                                                           cred);
 698                         if (rc)
 699                                 goto out;
 700                         sbsec->sid = context_sid;
 701                 } else {
 702                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 703                                                              cred);
 704                         if (rc)
 705                                 goto out;
 706                 }
 707                 if (!rootcontext_sid)
 708                         rootcontext_sid = context_sid;
 709
 710                 sbsec->mntpoint_sid = context_sid;
 711                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 712         }
 713
 714         if (rootcontext_sid) {
 715                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 716                                                      cred);
 717                 if (rc)
 718                         goto out;
 719
 720                 root_isec->sid = rootcontext_sid;
 721                 root_isec->initialized = 1;
 722         }
 723
 724         if (defcontext_sid) {
 725                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 726                         rc = -EINVAL;
 727                         printk(KERN_WARNING "SELinux: defcontext option is "
 728                                "invalid for this filesystem type\n");
 729                         goto out;
 730                 }
 731
 732                 if (defcontext_sid != sbsec->def_sid) {
 733                         rc = may_context_mount_inode_relabel(defcontext_sid,
 734                                                              sbsec, cred);
 735                         if (rc)
 736                                 goto out;
 737                 }
 738
 739                 sbsec->def_sid = defcontext_sid;
 740         }
 741
 742         rc = sb_finish_set_opts(sb);
 743 out:
 744         mutex_unlock(&sbsec->lock);
 745         return rc;
 746 out_double_mount:
 747         rc = -EINVAL;
 748         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 749                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 750         goto out;
 751 }
 752
 753 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 754                                         struct super_block *newsb)
 755 {
 756         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 757         struct superblock_security_struct *newsbsec = newsb->s_security;
 758
 759         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 760         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 761         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 762
 763         /*
 764          * if the parent was able to be mounted it clearly had no special lsm
 765          * mount options.  thus we can safely deal with this superblock later
 766          */
 767         if (!ss_initialized)
 768                 return;
 769
 770         /* how can we clone if the old one wasn't set up?? */
 771         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 772
 773         /* if fs is reusing a sb, just let its options stand... */
 774         if (newsbsec->flags & SE_SBINITIALIZED)
 775                 return;
 776
 777         mutex_lock(&newsbsec->lock);
 778
 779         newsbsec->flags = oldsbsec->flags;
 780
 781         newsbsec->sid = oldsbsec->sid;
 782         newsbsec->def_sid = oldsbsec->def_sid;
 783         newsbsec->behavior = oldsbsec->behavior;
 784
 785         if (set_context) {
 786                 u32 sid = oldsbsec->mntpoint_sid;
 787
 788                 if (!set_fscontext)
 789                         newsbsec->sid = sid;
 790                 if (!set_rootcontext) {
 791                         struct inode *newinode = newsb->s_root->d_inode;
 792                         struct inode_security_struct *newisec = newinode->i_security;
 793                         newisec->sid = sid;
 794                 }
 795                 newsbsec->mntpoint_sid = sid;
 796         }
 797         if (set_rootcontext) {
 798                 const struct inode *oldinode = oldsb->s_root->d_inode;
 799                 const struct inode_security_struct *oldisec = oldinode->i_security;
 800                 struct inode *newinode = newsb->s_root->d_inode;
 801                 struct inode_security_struct *newisec = newinode->i_security;
 802
 803                 newisec->sid = oldisec->sid;
 804         }
 805
 806         sb_finish_set_opts(newsb);
 807         mutex_unlock(&newsbsec->lock);
 808 }
 809
 810 static int selinux_parse_opts_str(char *options,
 811                                   struct security_mnt_opts *opts)
 812 {
 813         char *p;
 814         char *context = NULL, *defcontext = NULL;
 815         char *fscontext = NULL, *rootcontext = NULL;
 816         int rc, num_mnt_opts = 0;
 817
 818         opts->num_mnt_opts = 0;
 819
 820         /* Standard string-based options. */
 821         while ((p = strsep(&options, "|")) != NULL) {
 822                 int token;
 823                 substring_t args[MAX_OPT_ARGS];
 824
 825                 if (!*p)
 826                         continue;
 827
 828                 token = match_token(p, tokens, args);
 829
 830                 switch (token) {
 831                 case Opt_context:
 832                         if (context || defcontext) {
 833                                 rc = -EINVAL;
 834                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 835                                 goto out_err;
 836                         }
 837                         context = match_strdup(&args[0]);
 838                         if (!context) {
 839                                 rc = -ENOMEM;
 840                                 goto out_err;
 841                         }
 842                         break;
 843
 844                 case Opt_fscontext:
 845                         if (fscontext) {
 846                                 rc = -EINVAL;
 847                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 848                                 goto out_err;
 849                         }
 850                         fscontext = match_strdup(&args[0]);
 851                         if (!fscontext) {
 852                                 rc = -ENOMEM;
 853                                 goto out_err;
 854                         }
 855                         break;
 856
 857                 case Opt_rootcontext:
 858                         if (rootcontext) {
 859                                 rc = -EINVAL;
 860                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 861                                 goto out_err;
 862                         }
 863                         rootcontext = match_strdup(&args[0]);
 864                         if (!rootcontext) {
 865                                 rc = -ENOMEM;
 866                                 goto out_err;
 867                         }
 868                         break;
 869
 870                 case Opt_defcontext:
 871                         if (context || defcontext) {
 872                                 rc = -EINVAL;
 873                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 874                                 goto out_err;
 875                         }
 876                         defcontext = match_strdup(&args[0]);
 877                         if (!defcontext) {
 878                                 rc = -ENOMEM;
 879                                 goto out_err;
 880                         }
 881                         break;
 882                 case Opt_labelsupport:
 883                         break;
 884                 default:
 885                         rc = -EINVAL;
 886                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 887                         goto out_err;
 888
 889                 }
 890         }
 891
 892         rc = -ENOMEM;
 893         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 894         if (!opts->mnt_opts)
 895                 goto out_err;
 896
 897         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 898         if (!opts->mnt_opts_flags) {
 899                 kfree(opts->mnt_opts);
 900                 goto out_err;
 901         }
 902
 903         if (fscontext) {
 904                 opts->mnt_opts[num_mnt_opts] = fscontext;
 905                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 906         }
 907         if (context) {
 908                 opts->mnt_opts[num_mnt_opts] = context;
 909                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 910         }
 911         if (rootcontext) {
 912                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 913                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 914         }
 915         if (defcontext) {
 916                 opts->mnt_opts[num_mnt_opts] = defcontext;
 917                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 918         }
 919
 920         opts->num_mnt_opts = num_mnt_opts;
 921         return 0;
 922
 923 out_err:
 924         kfree(context);
 925         kfree(defcontext);
 926         kfree(fscontext);
 927         kfree(rootcontext);
 928         return rc;
 929 }
 930 /*
 931  * string mount options parsing and call set the sbsec
 932  */
 933 static int superblock_doinit(struct super_block *sb, void *data)
 934 {
 935         int rc = 0;
 936         char *options = data;
 937         struct security_mnt_opts opts;
 938
 939         security_init_mnt_opts(&opts);
 940
 941         if (!data)
 942                 goto out;
 943
 944         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 945
 946         rc = selinux_parse_opts_str(options, &opts);
 947         if (rc)
 948                 goto out_err;
 949
 950 out:
 951         rc = selinux_set_mnt_opts(sb, &opts);
 952
 953 out_err:
 954         security_free_mnt_opts(&opts);
 955         return rc;
 956 }
 957
 958 static void selinux_write_opts(struct seq_file *m,
 959                                struct security_mnt_opts *opts)
 960 {
 961         int i;
 962         char *prefix;
 963
 964         for (i = 0; i < opts->num_mnt_opts; i++) {
 965                 char *has_comma;
 966
 967                 if (opts->mnt_opts[i])
 968                         has_comma = strchr(opts->mnt_opts[i], ',');
 969                 else
 970                         has_comma = NULL;
 971
 972                 switch (opts->mnt_opts_flags[i]) {
 973                 case CONTEXT_MNT:
 974                         prefix = CONTEXT_STR;
 975                         break;
 976                 case FSCONTEXT_MNT:
 977                         prefix = FSCONTEXT_STR;
 978                         break;
 979                 case ROOTCONTEXT_MNT:
 980                         prefix = ROOTCONTEXT_STR;
 981                         break;
 982                 case DEFCONTEXT_MNT:
 983                         prefix = DEFCONTEXT_STR;
 984                         break;
 985                 case SE_SBLABELSUPP:
 986                         seq_putc(m, ',');
 987                         seq_puts(m, LABELSUPP_STR);
 988                         continue;
 989                 default:
 990                         BUG();
 991                         return;
 992                 };
 993                 /* we need a comma before each option */
 994                 seq_putc(m, ',');
 995                 seq_puts(m, prefix);
 996                 if (has_comma)
 997                         seq_putc(m, '\"');
 998                 seq_puts(m, opts->mnt_opts[i]);
 999                 if (has_comma)
1000                         seq_putc(m, '\"');
1001         }
1002 }
1003
1004 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1005 {
1006         struct security_mnt_opts opts;
1007         int rc;
1008
1009         rc = selinux_get_mnt_opts(sb, &opts);
1010         if (rc) {
1011                 /* before policy load we may get EINVAL, don't show anything */
1012                 if (rc == -EINVAL)
1013                         rc = 0;
1014                 return rc;
1015         }
1016
1017         selinux_write_opts(m, &opts);
1018
1019         security_free_mnt_opts(&opts);
1020
1021         return rc;
1022 }
1023
1024 static inline u16 inode_mode_to_security_class(umode_t mode)
1025 {
1026         switch (mode & S_IFMT) {
1027         case S_IFSOCK:
1028                 return SECCLASS_SOCK_FILE;
1029         case S_IFLNK:
1030                 return SECCLASS_LNK_FILE;
1031         case S_IFREG:
1032                 return SECCLASS_FILE;
1033         case S_IFBLK:
1034                 return SECCLASS_BLK_FILE;
1035         case S_IFDIR:
1036                 return SECCLASS_DIR;
1037         case S_IFCHR:
1038                 return SECCLASS_CHR_FILE;
1039         case S_IFIFO:
1040                 return SECCLASS_FIFO_FILE;
1041
1042         }
1043
1044         return SECCLASS_FILE;
1045 }
1046
1047 static inline int default_protocol_stream(int protocol)
1048 {
1049         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1050 }
1051
1052 static inline int default_protocol_dgram(int protocol)
1053 {
1054         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1055 }
1056
1057 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1058 {
1059         switch (family) {
1060         case PF_UNIX:
1061                 switch (type) {
1062                 case SOCK_STREAM:
1063                 case SOCK_SEQPACKET:
1064                         return SECCLASS_UNIX_STREAM_SOCKET;
1065                 case SOCK_DGRAM:
1066                         return SECCLASS_UNIX_DGRAM_SOCKET;
1067                 }
1068                 break;
1069         case PF_INET:
1070         case PF_INET6:
1071                 switch (type) {
1072                 case SOCK_STREAM:
1073                         if (default_protocol_stream(protocol))
1074                                 return SECCLASS_TCP_SOCKET;
1075                         else
1076                                 return SECCLASS_RAWIP_SOCKET;
1077                 case SOCK_DGRAM:
1078                         if (default_protocol_dgram(protocol))
1079                                 return SECCLASS_UDP_SOCKET;
1080                         else
1081                                 return SECCLASS_RAWIP_SOCKET;
1082                 case SOCK_DCCP:
1083                         return SECCLASS_DCCP_SOCKET;
1084                 default:
1085                         return SECCLASS_RAWIP_SOCKET;
1086                 }
1087                 break;
1088         case PF_NETLINK:
1089                 switch (protocol) {
1090                 case NETLINK_ROUTE:
1091                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1092                 case NETLINK_FIREWALL:
1093                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1094                 case NETLINK_SOCK_DIAG:
1095                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1096                 case NETLINK_NFLOG:
1097                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1098                 case NETLINK_XFRM:
1099                         return SECCLASS_NETLINK_XFRM_SOCKET;
1100                 case NETLINK_SELINUX:
1101                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1102                 case NETLINK_AUDIT:
1103                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1104                 case NETLINK_IP6_FW:
1105                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1106                 case NETLINK_DNRTMSG:
1107                         return SECCLASS_NETLINK_DNRT_SOCKET;
1108                 case NETLINK_KOBJECT_UEVENT:
1109                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1110                 default:
1111                         return SECCLASS_NETLINK_SOCKET;
1112                 }
1113         case PF_PACKET:
1114                 return SECCLASS_PACKET_SOCKET;
1115         case PF_KEY:
1116                 return SECCLASS_KEY_SOCKET;
1117         case PF_APPLETALK:
1118                 return SECCLASS_APPLETALK_SOCKET;
1119         }
1120
1121         return SECCLASS_SOCKET;
1122 }
1123
1124 #ifdef CONFIG_PROC_FS
1125 static int selinux_proc_get_sid(struct dentry *dentry,
1126                                 u16 tclass,
1127                                 u32 *sid)
1128 {
1129         int rc;
1130         char *buffer, *path;
1131
1132         buffer = (char *)__get_free_page(GFP_KERNEL);
1133         if (!buffer)
1134                 return -ENOMEM;
1135
1136         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1137         if (IS_ERR(path))
1138                 rc = PTR_ERR(path);
1139         else {
1140                 /* each process gets a /proc/PID/ entry. Strip off the
1141                  * PID part to get a valid selinux labeling.
1142                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1143                 while (path[1] >= '0' && path[1] <= '9') {
1144                         path[1] = '/';
1145                         path++;
1146                 }
1147                 rc = security_genfs_sid("proc", path, tclass, sid);
1148         }
1149         free_page((unsigned long)buffer);
1150         return rc;
1151 }
1152 #else
1153 static int selinux_proc_get_sid(struct dentry *dentry,
1154                                 u16 tclass,
1155                                 u32 *sid)
1156 {
1157         return -EINVAL;
1158 }
1159 #endif
1160
1161 /* The inode's security attributes must be initialized before first use. */
1162 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1163 {
1164         struct superblock_security_struct *sbsec = NULL;
1165         struct inode_security_struct *isec = inode->i_security;
1166         u32 sid;
1167         struct dentry *dentry;
1168 #define INITCONTEXTLEN 255
1169         char *context = NULL;
1170         unsigned len = 0;
1171         int rc = 0;
1172
1173         if (isec->initialized)
1174                 goto out;
1175
1176         mutex_lock(&isec->lock);
1177         if (isec->initialized)
1178                 goto out_unlock;
1179
1180         sbsec = inode->i_sb->s_security;
1181         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1182                 /* Defer initialization until selinux_complete_init,
1183                    after the initial policy is loaded and the security
1184                    server is ready to handle calls. */
1185                 spin_lock(&sbsec->isec_lock);
1186                 if (list_empty(&isec->list))
1187                         list_add(&isec->list, &sbsec->isec_head);
1188                 spin_unlock(&sbsec->isec_lock);
1189                 goto out_unlock;
1190         }
1191
1192         switch (sbsec->behavior) {
1193         case SECURITY_FS_USE_XATTR:
1194                 if (!inode->i_op->getxattr) {
1195                         isec->sid = sbsec->def_sid;
1196                         break;
1197                 }
1198
1199                 /* Need a dentry, since the xattr API requires one.
1200                    Life would be simpler if we could just pass the inode. */
1201                 if (opt_dentry) {
1202                         /* Called from d_instantiate or d_splice_alias. */
1203                         dentry = dget(opt_dentry);
1204                 } else {
1205                         /* Called from selinux_complete_init, try to find a dentry. */
1206                         dentry = d_find_alias(inode);
1207                 }
1208                 if (!dentry) {
1209                         /*
1210                          * this is can be hit on boot when a file is accessed
1211                          * before the policy is loaded.  When we load policy we
1212                          * may find inodes that have no dentry on the
1213                          * sbsec->isec_head list.  No reason to complain as these
1214                          * will get fixed up the next time we go through
1215                          * inode_doinit with a dentry, before these inodes could
1216                          * be used again by userspace.
1217                          */
1218                         goto out_unlock;
1219                 }
1220
1221                 len = INITCONTEXTLEN;
1222                 context = kmalloc(len+1, GFP_NOFS);
1223                 if (!context) {
1224                         rc = -ENOMEM;
1225                         dput(dentry);
1226                         goto out_unlock;
1227                 }
1228                 context[len] = '\0';
1229                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1230                                            context, len);
1231                 if (rc == -ERANGE) {
1232                         kfree(context);
1233
1234                         /* Need a larger buffer.  Query for the right size. */
1235                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1236                                                    NULL, 0);
1237                         if (rc < 0) {
1238                                 dput(dentry);
1239                                 goto out_unlock;
1240                         }
1241                         len = rc;
1242                         context = kmalloc(len+1, GFP_NOFS);
1243                         if (!context) {
1244                                 rc = -ENOMEM;
1245                                 dput(dentry);
1246                                 goto out_unlock;
1247                         }
1248                         context[len] = '\0';
1249                         rc = inode->i_op->getxattr(dentry,
1250                                                    XATTR_NAME_SELINUX,
1251                                                    context, len);
1252                 }
1253                 dput(dentry);
1254                 if (rc < 0) {
1255                         if (rc != -ENODATA) {
1256                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1257                                        "%d for dev=%s ino=%ld\n", __func__,
1258                                        -rc, inode->i_sb->s_id, inode->i_ino);
1259                                 kfree(context);
1260                                 goto out_unlock;
1261                         }
1262                         /* Map ENODATA to the default file SID */
1263                         sid = sbsec->def_sid;
1264                         rc = 0;
1265                 } else {
1266                         rc = security_context_to_sid_default(context, rc, &sid,
1267                                                              sbsec->def_sid,
1268                                                              GFP_NOFS);
1269                         if (rc) {
1270                                 char *dev = inode->i_sb->s_id;
1271                                 unsigned long ino = inode->i_ino;
1272
1273                                 if (rc == -EINVAL) {
1274                                         if (printk_ratelimit())
1275                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1276                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1277                                                         "filesystem in question.\n", ino, dev, context);
1278                                 } else {
1279                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1280                                                "returned %d for dev=%s ino=%ld\n",
1281                                                __func__, context, -rc, dev, ino);
1282                                 }
1283                                 kfree(context);
1284                                 /* Leave with the unlabeled SID */
1285                                 rc = 0;
1286                                 break;
1287                         }
1288                 }
1289                 kfree(context);
1290                 isec->sid = sid;
1291                 break;
1292         case SECURITY_FS_USE_TASK:
1293                 isec->sid = isec->task_sid;
1294                 break;
1295         case SECURITY_FS_USE_TRANS:
1296                 /* Default to the fs SID. */
1297                 isec->sid = sbsec->sid;
1298
1299                 /* Try to obtain a transition SID. */
1300                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1301                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1302                                              isec->sclass, NULL, &sid);
1303                 if (rc)
1304                         goto out_unlock;
1305                 isec->sid = sid;
1306                 break;
1307         case SECURITY_FS_USE_MNTPOINT:
1308                 isec->sid = sbsec->mntpoint_sid;
1309                 break;
1310         default:
1311                 /* Default to the fs superblock SID. */
1312                 isec->sid = sbsec->sid;
1313
1314                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1315                         if (opt_dentry) {
1316                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1317                                 rc = selinux_proc_get_sid(opt_dentry,
1318                                                           isec->sclass,
1319                                                           &sid);
1320                                 if (rc)
1321                                         goto out_unlock;
1322                                 isec->sid = sid;
1323                         }
1324                 }
1325                 break;
1326         }
1327
1328         isec->initialized = 1;
1329
1330 out_unlock:
1331         mutex_unlock(&isec->lock);
1332 out:
1333         if (isec->sclass == SECCLASS_FILE)
1334                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1335         return rc;
1336 }
1337
1338 /* Convert a Linux signal to an access vector. */
1339 static inline u32 signal_to_av(int sig)
1340 {
1341         u32 perm = 0;
1342
1343         switch (sig) {
1344         case SIGCHLD:
1345                 /* Commonly granted from child to parent. */
1346                 perm = PROCESS__SIGCHLD;
1347                 break;
1348         case SIGKILL:
1349                 /* Cannot be caught or ignored */
1350                 perm = PROCESS__SIGKILL;
1351                 break;
1352         case SIGSTOP:
1353                 /* Cannot be caught or ignored */
1354                 perm = PROCESS__SIGSTOP;
1355                 break;
1356         default:
1357                 /* All other signals. */
1358                 perm = PROCESS__SIGNAL;
1359                 break;
1360         }
1361
1362         return perm;
1363 }
1364
1365 /*
1366  * Check permission between a pair of credentials
1367  * fork check, ptrace check, etc.
1368  */
1369 static int cred_has_perm(const struct cred *actor,
1370                          const struct cred *target,
1371                          u32 perms)
1372 {
1373         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1374
1375         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1376 }
1377
1378 /*
1379  * Check permission between a pair of tasks, e.g. signal checks,
1380  * fork check, ptrace check, etc.
1381  * tsk1 is the actor and tsk2 is the target
1382  * - this uses the default subjective creds of tsk1
1383  */
1384 static int task_has_perm(const struct task_struct *tsk1,
1385                          const struct task_struct *tsk2,
1386                          u32 perms)
1387 {
1388         const struct task_security_struct *__tsec1, *__tsec2;
1389         u32 sid1, sid2;
1390
1391         rcu_read_lock();
1392         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1393         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1394         rcu_read_unlock();
1395         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1396 }
1397
1398 /*
1399  * Check permission between current and another task, e.g. signal checks,
1400  * fork check, ptrace check, etc.
1401  * current is the actor and tsk2 is the target
1402  * - this uses current's subjective creds
1403  */
1404 static int current_has_perm(const struct task_struct *tsk,
1405                             u32 perms)
1406 {
1407         u32 sid, tsid;
1408
1409         sid = current_sid();
1410         tsid = task_sid(tsk);
1411         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1412 }
1413
1414 #if CAP_LAST_CAP > 63
1415 #error Fix SELinux to handle capabilities > 63.
1416 #endif
1417
1418 /* Check whether a task is allowed to use a capability. */
1419 static int cred_has_capability(const struct cred *cred,
1420                                int cap, int audit)
1421 {
1422         struct common_audit_data ad;
1423         struct selinux_audit_data sad = {0,};
1424         struct av_decision avd;
1425         u16 sclass;
1426         u32 sid = cred_sid(cred);
1427         u32 av = CAP_TO_MASK(cap);
1428         int rc;
1429
1430         COMMON_AUDIT_DATA_INIT(&ad, CAP);
1431         ad.selinux_audit_data = &sad;
1432         ad.tsk = current;
1433         ad.u.cap = cap;
1434
1435         switch (CAP_TO_INDEX(cap)) {
1436         case 0:
1437                 sclass = SECCLASS_CAPABILITY;
1438                 break;
1439         case 1:
1440                 sclass = SECCLASS_CAPABILITY2;
1441                 break;
1442         default:
1443                 printk(KERN_ERR
1444                        "SELinux:  out of range capability %d\n", cap);
1445                 BUG();
1446                 return -EINVAL;
1447         }
1448
1449         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1450         if (audit == SECURITY_CAP_AUDIT) {
1451                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1452                 if (rc2)
1453                         return rc2;
1454         }
1455         return rc;
1456 }
1457
1458 /* Check whether a task is allowed to use a system operation. */
1459 static int task_has_system(struct task_struct *tsk,
1460                            u32 perms)
1461 {
1462         u32 sid = task_sid(tsk);
1463
1464         return avc_has_perm(sid, SECINITSID_KERNEL,
1465                             SECCLASS_SYSTEM, perms, NULL);
1466 }
1467
1468 /* Check whether a task has a particular permission to an inode.
1469    The 'adp' parameter is optional and allows other audit
1470    data to be passed (e.g. the dentry). */
1471 static int inode_has_perm(const struct cred *cred,
1472                           struct inode *inode,
1473                           u32 perms,
1474                           struct common_audit_data *adp,
1475                           unsigned flags)
1476 {
1477         struct inode_security_struct *isec;
1478         u32 sid;
1479
1480         validate_creds(cred);
1481
1482         if (unlikely(IS_PRIVATE(inode)))
1483                 return 0;
1484
1485         sid = cred_sid(cred);
1486         isec = inode->i_security;
1487
1488         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1489 }
1490
1491 /* Same as inode_has_perm, but pass explicit audit data containing
1492    the dentry to help the auditing code to more easily generate the
1493    pathname if needed. */
1494 static inline int dentry_has_perm(const struct cred *cred,
1495                                   struct dentry *dentry,
1496                                   u32 av)
1497 {
1498         struct inode *inode = dentry->d_inode;
1499         struct common_audit_data ad;
1500         struct selinux_audit_data sad = {0,};
1501
1502         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1503         ad.u.dentry = dentry;
1504         ad.selinux_audit_data = &sad;
1505         return inode_has_perm(cred, inode, av, &ad, 0);
1506 }
1507
1508 /* Same as inode_has_perm, but pass explicit audit data containing
1509    the path to help the auditing code to more easily generate the
1510    pathname if needed. */
1511 static inline int path_has_perm(const struct cred *cred,
1512                                 struct path *path,
1513                                 u32 av)
1514 {
1515         struct inode *inode = path->dentry->d_inode;
1516         struct common_audit_data ad;
1517         struct selinux_audit_data sad = {0,};
1518
1519         COMMON_AUDIT_DATA_INIT(&ad, PATH);
1520         ad.u.path = *path;
1521         ad.selinux_audit_data = &sad;
1522         return inode_has_perm(cred, inode, av, &ad, 0);
1523 }
1524
1525 /* Check whether a task can use an open file descriptor to
1526    access an inode in a given way.  Check access to the
1527    descriptor itself, and then use dentry_has_perm to
1528    check a particular permission to the file.
1529    Access to the descriptor is implicitly granted if it
1530    has the same SID as the process.  If av is zero, then
1531    access to the file is not checked, e.g. for cases
1532    where only the descriptor is affected like seek. */
1533 static int file_has_perm(const struct cred *cred,
1534                          struct file *file,
1535                          u32 av)
1536 {
1537         struct file_security_struct *fsec = file->f_security;
1538         struct inode *inode = file->f_path.dentry->d_inode;
1539         struct common_audit_data ad;
1540         struct selinux_audit_data sad = {0,};
1541         u32 sid = cred_sid(cred);
1542         int rc;
1543
1544         COMMON_AUDIT_DATA_INIT(&ad, PATH);
1545         ad.u.path = file->f_path;
1546         ad.selinux_audit_data = &sad;
1547
1548         if (sid != fsec->sid) {
1549                 rc = avc_has_perm(sid, fsec->sid,
1550                                   SECCLASS_FD,
1551                                   FD__USE,
1552                                   &ad);
1553                 if (rc)
1554                         goto out;
1555         }
1556
1557         /* av is zero if only checking access to the descriptor. */
1558         rc = 0;
1559         if (av)
1560                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1561
1562 out:
1563         return rc;
1564 }
1565
1566 /* Check whether a task can create a file. */
1567 static int may_create(struct inode *dir,
1568                       struct dentry *dentry,
1569                       u16 tclass)
1570 {
1571         const struct task_security_struct *tsec = current_security();
1572         struct inode_security_struct *dsec;
1573         struct superblock_security_struct *sbsec;
1574         u32 sid, newsid;
1575         struct common_audit_data ad;
1576         struct selinux_audit_data sad = {0,};
1577         int rc;
1578
1579         dsec = dir->i_security;
1580         sbsec = dir->i_sb->s_security;
1581
1582         sid = tsec->sid;
1583         newsid = tsec->create_sid;
1584
1585         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1586         ad.u.dentry = dentry;
1587         ad.selinux_audit_data = &sad;
1588
1589         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1590                           DIR__ADD_NAME | DIR__SEARCH,
1591                           &ad);
1592         if (rc)
1593                 return rc;
1594
1595         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1596                 rc = security_transition_sid(sid, dsec->sid, tclass,
1597                                              &dentry->d_name, &newsid);
1598                 if (rc)
1599                         return rc;
1600         }
1601
1602         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1603         if (rc)
1604                 return rc;
1605
1606         return avc_has_perm(newsid, sbsec->sid,
1607                             SECCLASS_FILESYSTEM,
1608                             FILESYSTEM__ASSOCIATE, &ad);
1609 }
1610
1611 /* Check whether a task can create a key. */
1612 static int may_create_key(u32 ksid,
1613                           struct task_struct *ctx)
1614 {
1615         u32 sid = task_sid(ctx);
1616
1617         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1618 }
1619
1620 #define MAY_LINK        0
1621 #define MAY_UNLINK      1
1622 #define MAY_RMDIR       2
1623
1624 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1625 static int may_link(struct inode *dir,
1626                     struct dentry *dentry,
1627                     int kind)
1628
1629 {
1630         struct inode_security_struct *dsec, *isec;
1631         struct common_audit_data ad;
1632         struct selinux_audit_data sad = {0,};
1633         u32 sid = current_sid();
1634         u32 av;
1635         int rc;
1636
1637         dsec = dir->i_security;
1638         isec = dentry->d_inode->i_security;
1639
1640         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1641         ad.u.dentry = dentry;
1642         ad.selinux_audit_data = &sad;
1643
1644         av = DIR__SEARCH;
1645         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1646         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1647         if (rc)
1648                 return rc;
1649
1650         switch (kind) {
1651         case MAY_LINK:
1652                 av = FILE__LINK;
1653                 break;
1654         case MAY_UNLINK:
1655                 av = FILE__UNLINK;
1656                 break;
1657         case MAY_RMDIR:
1658                 av = DIR__RMDIR;
1659                 break;
1660         default:
1661                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1662                         __func__, kind);
1663                 return 0;
1664         }
1665
1666         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1667         return rc;
1668 }
1669
1670 static inline int may_rename(struct inode *old_dir,
1671                              struct dentry *old_dentry,
1672                              struct inode *new_dir,
1673                              struct dentry *new_dentry)
1674 {
1675         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1676         struct common_audit_data ad;
1677         struct selinux_audit_data sad = {0,};
1678         u32 sid = current_sid();
1679         u32 av;
1680         int old_is_dir, new_is_dir;
1681         int rc;
1682
1683         old_dsec = old_dir->i_security;
1684         old_isec = old_dentry->d_inode->i_security;
1685         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1686         new_dsec = new_dir->i_security;
1687
1688         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1689         ad.selinux_audit_data = &sad;
1690
1691         ad.u.dentry = old_dentry;
1692         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1693                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1694         if (rc)
1695                 return rc;
1696         rc = avc_has_perm(sid, old_isec->sid,
1697                           old_isec->sclass, FILE__RENAME, &ad);
1698         if (rc)
1699                 return rc;
1700         if (old_is_dir && new_dir != old_dir) {
1701                 rc = avc_has_perm(sid, old_isec->sid,
1702                                   old_isec->sclass, DIR__REPARENT, &ad);
1703                 if (rc)
1704                         return rc;
1705         }
1706
1707         ad.u.dentry = new_dentry;
1708         av = DIR__ADD_NAME | DIR__SEARCH;
1709         if (new_dentry->d_inode)
1710                 av |= DIR__REMOVE_NAME;
1711         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1712         if (rc)
1713                 return rc;
1714         if (new_dentry->d_inode) {
1715                 new_isec = new_dentry->d_inode->i_security;
1716                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1717                 rc = avc_has_perm(sid, new_isec->sid,
1718                                   new_isec->sclass,
1719                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1720                 if (rc)
1721                         return rc;
1722         }
1723
1724         return 0;
1725 }
1726
1727 /* Check whether a task can perform a filesystem operation. */
1728 static int superblock_has_perm(const struct cred *cred,
1729                                struct super_block *sb,
1730                                u32 perms,
1731                                struct common_audit_data *ad)
1732 {
1733         struct superblock_security_struct *sbsec;
1734         u32 sid = cred_sid(cred);
1735
1736         sbsec = sb->s_security;
1737         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1738 }
1739
1740 /* Convert a Linux mode and permission mask to an access vector. */
1741 static inline u32 file_mask_to_av(int mode, int mask)
1742 {
1743         u32 av = 0;
1744
1745         if (!S_ISDIR(mode)) {
1746                 if (mask & MAY_EXEC)
1747                         av |= FILE__EXECUTE;
1748                 if (mask & MAY_READ)
1749                         av |= FILE__READ;
1750
1751                 if (mask & MAY_APPEND)
1752                         av |= FILE__APPEND;
1753                 else if (mask & MAY_WRITE)
1754                         av |= FILE__WRITE;
1755
1756         } else {
1757                 if (mask & MAY_EXEC)
1758                         av |= DIR__SEARCH;
1759                 if (mask & MAY_WRITE)
1760                         av |= DIR__WRITE;
1761                 if (mask & MAY_READ)
1762                         av |= DIR__READ;
1763         }
1764
1765         return av;
1766 }
1767
1768 /* Convert a Linux file to an access vector. */
1769 static inline u32 file_to_av(struct file *file)
1770 {
1771         u32 av = 0;
1772
1773         if (file->f_mode & FMODE_READ)
1774                 av |= FILE__READ;
1775         if (file->f_mode & FMODE_WRITE) {
1776                 if (file->f_flags & O_APPEND)
1777                         av |= FILE__APPEND;
1778                 else
1779                         av |= FILE__WRITE;
1780         }
1781         if (!av) {
1782                 /*
1783                  * Special file opened with flags 3 for ioctl-only use.
1784                  */
1785                 av = FILE__IOCTL;
1786         }
1787
1788         return av;
1789 }
1790
1791 /*
1792  * Convert a file to an access vector and include the correct open
1793  * open permission.
1794  */
1795 static inline u32 open_file_to_av(struct file *file)
1796 {
1797         u32 av = file_to_av(file);
1798
1799         if (selinux_policycap_openperm)
1800                 av |= FILE__OPEN;
1801
1802         return av;
1803 }
1804
1805 /* Hook functions begin here. */
1806
1807 static int selinux_ptrace_access_check(struct task_struct *child,
1808                                      unsigned int mode)
1809 {
1810         int rc;
1811
1812         rc = cap_ptrace_access_check(child, mode);
1813         if (rc)
1814                 return rc;
1815
1816         if (mode & PTRACE_MODE_READ) {
1817                 u32 sid = current_sid();
1818                 u32 csid = task_sid(child);
1819                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1820         }
1821
1822         return current_has_perm(child, PROCESS__PTRACE);
1823 }
1824
1825 static int selinux_ptrace_traceme(struct task_struct *parent)
1826 {
1827         int rc;
1828
1829         rc = cap_ptrace_traceme(parent);
1830         if (rc)
1831                 return rc;
1832
1833         return task_has_perm(parent, current, PROCESS__PTRACE);
1834 }
1835
1836 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1837                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1838 {
1839         int error;
1840
1841         error = current_has_perm(target, PROCESS__GETCAP);
1842         if (error)
1843                 return error;
1844
1845         return cap_capget(target, effective, inheritable, permitted);
1846 }
1847
1848 static int selinux_capset(struct cred *new, const struct cred *old,
1849                           const kernel_cap_t *effective,
1850                           const kernel_cap_t *inheritable,
1851                           const kernel_cap_t *permitted)
1852 {
1853         int error;
1854
1855         error = cap_capset(new, old,
1856                                       effective, inheritable, permitted);
1857         if (error)
1858                 return error;
1859
1860         return cred_has_perm(old, new, PROCESS__SETCAP);
1861 }
1862
1863 /*
1864  * (This comment used to live with the selinux_task_setuid hook,
1865  * which was removed).
1866  *
1867  * Since setuid only affects the current process, and since the SELinux
1868  * controls are not based on the Linux identity attributes, SELinux does not
1869  * need to control this operation.  However, SELinux does control the use of
1870  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1871  */
1872
1873 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1874                            int cap, int audit)
1875 {
1876         int rc;
1877
1878         rc = cap_capable(cred, ns, cap, audit);
1879         if (rc)
1880                 return rc;
1881
1882         return cred_has_capability(cred, cap, audit);
1883 }
1884
1885 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1886 {
1887         const struct cred *cred = current_cred();
1888         int rc = 0;
1889
1890         if (!sb)
1891                 return 0;
1892
1893         switch (cmds) {
1894         case Q_SYNC:
1895         case Q_QUOTAON:
1896         case Q_QUOTAOFF:
1897         case Q_SETINFO:
1898         case Q_SETQUOTA:
1899                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1900                 break;
1901         case Q_GETFMT:
1902         case Q_GETINFO:
1903         case Q_GETQUOTA:
1904                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1905                 break;
1906         default:
1907                 rc = 0;  /* let the kernel handle invalid cmds */
1908                 break;
1909         }
1910         return rc;
1911 }
1912
1913 static int selinux_quota_on(struct dentry *dentry)
1914 {
1915         const struct cred *cred = current_cred();
1916
1917         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1918 }
1919
1920 static int selinux_syslog(int type)
1921 {
1922         int rc;
1923
1924         switch (type) {
1925         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1926         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1927                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1928                 break;
1929         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1930         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1931         /* Set level of messages printed to console */
1932         case SYSLOG_ACTION_CONSOLE_LEVEL:
1933                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1934                 break;
1935         case SYSLOG_ACTION_CLOSE:       /* Close log */
1936         case SYSLOG_ACTION_OPEN:        /* Open log */
1937         case SYSLOG_ACTION_READ:        /* Read from log */
1938         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1939         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1940         default:
1941                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1942                 break;
1943         }
1944         return rc;
1945 }
1946
1947 /*
1948  * Check that a process has enough memory to allocate a new virtual
1949  * mapping. 0 means there is enough memory for the allocation to
1950  * succeed and -ENOMEM implies there is not.
1951  *
1952  * Do not audit the selinux permission check, as this is applied to all
1953  * processes that allocate mappings.
1954  */
1955 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1956 {
1957         int rc, cap_sys_admin = 0;
1958
1959         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1960                              SECURITY_CAP_NOAUDIT);
1961         if (rc == 0)
1962                 cap_sys_admin = 1;
1963
1964         return __vm_enough_memory(mm, pages, cap_sys_admin);
1965 }
1966
1967 /* binprm security operations */
1968
1969 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1970 {
1971         const struct task_security_struct *old_tsec;
1972         struct task_security_struct *new_tsec;
1973         struct inode_security_struct *isec;
1974         struct common_audit_data ad;
1975         struct selinux_audit_data sad = {0,};
1976         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1977         int rc;
1978
1979         rc = cap_bprm_set_creds(bprm);
1980         if (rc)
1981                 return rc;
1982
1983         /* SELinux context only depends on initial program or script and not
1984          * the script interpreter */
1985         if (bprm->cred_prepared)
1986                 return 0;
1987
1988         old_tsec = current_security();
1989         new_tsec = bprm->cred->security;
1990         isec = inode->i_security;
1991
1992         /* Default to the current task SID. */
1993         new_tsec->sid = old_tsec->sid;
1994         new_tsec->osid = old_tsec->sid;
1995
1996         /* Reset fs, key, and sock SIDs on execve. */
1997         new_tsec->create_sid = 0;
1998         new_tsec->keycreate_sid = 0;
1999         new_tsec->sockcreate_sid = 0;
2000
2001         if (old_tsec->exec_sid) {
2002                 new_tsec->sid = old_tsec->exec_sid;
2003                 /* Reset exec SID on execve. */
2004                 new_tsec->exec_sid = 0;
2005         } else {
2006                 /* Check for a default transition on this program. */
2007                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2008                                              SECCLASS_PROCESS, NULL,
2009                                              &new_tsec->sid);
2010                 if (rc)
2011                         return rc;
2012         }
2013
2014         COMMON_AUDIT_DATA_INIT(&ad, PATH);
2015         ad.selinux_audit_data = &sad;
2016         ad.u.path = bprm->file->f_path;
2017
2018         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2019                 new_tsec->sid = old_tsec->sid;
2020
2021         if (new_tsec->sid == old_tsec->sid) {
2022                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2023                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2024                 if (rc)
2025                         return rc;
2026         } else {
2027                 /* Check permissions for the transition. */
2028                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2029                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2030                 if (rc)
2031                         return rc;
2032
2033                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2034                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2035                 if (rc)
2036                         return rc;
2037
2038                 /* Check for shared state */
2039                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2040                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2041                                           SECCLASS_PROCESS, PROCESS__SHARE,
2042                                           NULL);
2043                         if (rc)
2044                                 return -EPERM;
2045                 }
2046
2047                 /* Make sure that anyone attempting to ptrace over a task that
2048                  * changes its SID has the appropriate permit */
2049                 if (bprm->unsafe &
2050                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2051                         struct task_struct *tracer;
2052                         struct task_security_struct *sec;
2053                         u32 ptsid = 0;
2054
2055                         rcu_read_lock();
2056                         tracer = ptrace_parent(current);
2057                         if (likely(tracer != NULL)) {
2058                                 sec = __task_cred(tracer)->security;
2059                                 ptsid = sec->sid;
2060                         }
2061                         rcu_read_unlock();
2062
2063                         if (ptsid != 0) {
2064                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2065                                                   SECCLASS_PROCESS,
2066                                                   PROCESS__PTRACE, NULL);
2067                                 if (rc)
2068                                         return -EPERM;
2069                         }
2070                 }
2071
2072                 /* Clear any possibly unsafe personality bits on exec: */
2073                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2074         }
2075
2076         return 0;
2077 }
2078
2079 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2080 {
2081         const struct task_security_struct *tsec = current_security();
2082         u32 sid, osid;
2083         int atsecure = 0;
2084
2085         sid = tsec->sid;
2086         osid = tsec->osid;
2087
2088         if (osid != sid) {
2089                 /* Enable secure mode for SIDs transitions unless
2090                    the noatsecure permission is granted between
2091                    the two SIDs, i.e. ahp returns 0. */
2092                 atsecure = avc_has_perm(osid, sid,
2093                                         SECCLASS_PROCESS,
2094                                         PROCESS__NOATSECURE, NULL);
2095         }
2096
2097         return (atsecure || cap_bprm_secureexec(bprm));
2098 }
2099
2100 /* Derived from fs/exec.c:flush_old_files. */
2101 static inline void flush_unauthorized_files(const struct cred *cred,
2102                                             struct files_struct *files)
2103 {
2104         struct common_audit_data ad;
2105         struct selinux_audit_data sad = {0,};
2106         struct file *file, *devnull = NULL;
2107         struct tty_struct *tty;
2108         struct fdtable *fdt;
2109         long j = -1;
2110         int drop_tty = 0;
2111
2112         tty = get_current_tty();
2113         if (tty) {
2114                 spin_lock(&tty_files_lock);
2115                 if (!list_empty(&tty->tty_files)) {
2116                         struct tty_file_private *file_priv;
2117
2118                         /* Revalidate access to controlling tty.
2119                            Use path_has_perm on the tty path directly rather
2120                            than using file_has_perm, as this particular open
2121                            file may belong to another process and we are only
2122                            interested in the inode-based check here. */
2123                         file_priv = list_first_entry(&tty->tty_files,
2124                                                 struct tty_file_private, list);
2125                         file = file_priv->file;
2126                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2127                                 drop_tty = 1;
2128                 }
2129                 spin_unlock(&tty_files_lock);
2130                 tty_kref_put(tty);
2131         }
2132         /* Reset controlling tty. */
2133         if (drop_tty)
2134                 no_tty();
2135
2136         /* Revalidate access to inherited open files. */
2137
2138         COMMON_AUDIT_DATA_INIT(&ad, INODE);
2139         ad.selinux_audit_data = &sad;
2140
2141         spin_lock(&files->file_lock);
2142         for (;;) {
2143                 unsigned long set, i;
2144                 int fd;
2145
2146                 j++;
2147                 i = j * __NFDBITS;
2148                 fdt = files_fdtable(files);
2149                 if (i >= fdt->max_fds)
2150                         break;
2151                 set = fdt->open_fds[j];
2152                 if (!set)
2153                         continue;
2154                 spin_unlock(&files->file_lock);
2155                 for ( ; set ; i++, set >>= 1) {
2156                         if (set & 1) {
2157                                 file = fget(i);
2158                                 if (!file)
2159                                         continue;
2160                                 if (file_has_perm(cred,
2161                                                   file,
2162                                                   file_to_av(file))) {
2163                                         sys_close(i);
2164                                         fd = get_unused_fd();
2165                                         if (fd != i) {
2166                                                 if (fd >= 0)
2167                                                         put_unused_fd(fd);
2168                                                 fput(file);
2169                                                 continue;
2170                                         }
2171                                         if (devnull) {
2172                                                 get_file(devnull);
2173                                         } else {
2174                                                 devnull = dentry_open(
2175                                                         dget(selinux_null),
2176                                                         mntget(selinuxfs_mount),
2177                                                         O_RDWR, cred);
2178                                                 if (IS_ERR(devnull)) {
2179                                                         devnull = NULL;
2180                                                         put_unused_fd(fd);
2181                                                         fput(file);
2182                                                         continue;
2183                                                 }
2184                                         }
2185                                         fd_install(fd, devnull);
2186                                 }
2187                                 fput(file);
2188                         }
2189                 }
2190                 spin_lock(&files->file_lock);
2191
2192         }
2193         spin_unlock(&files->file_lock);
2194 }
2195
2196 /*
2197  * Prepare a process for imminent new credential changes due to exec
2198  */
2199 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2200 {
2201         struct task_security_struct *new_tsec;
2202         struct rlimit *rlim, *initrlim;
2203         int rc, i;
2204
2205         new_tsec = bprm->cred->security;
2206         if (new_tsec->sid == new_tsec->osid)
2207                 return;
2208
2209         /* Close files for which the new task SID is not authorized. */
2210         flush_unauthorized_files(bprm->cred, current->files);
2211
2212         /* Always clear parent death signal on SID transitions. */
2213         current->pdeath_signal = 0;
2214
2215         /* Check whether the new SID can inherit resource limits from the old
2216          * SID.  If not, reset all soft limits to the lower of the current
2217          * task's hard limit and the init task's soft limit.
2218          *
2219          * Note that the setting of hard limits (even to lower them) can be
2220          * controlled by the setrlimit check.  The inclusion of the init task's
2221          * soft limit into the computation is to avoid resetting soft limits
2222          * higher than the default soft limit for cases where the default is
2223          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2224          */
2225         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2226                           PROCESS__RLIMITINH, NULL);
2227         if (rc) {
2228                 /* protect against do_prlimit() */
2229                 task_lock(current);
2230                 for (i = 0; i < RLIM_NLIMITS; i++) {
2231                         rlim = current->signal->rlim + i;
2232                         initrlim = init_task.signal->rlim + i;
2233                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2234                 }
2235                 task_unlock(current);
2236                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2237         }
2238 }
2239
2240 /*
2241  * Clean up the process immediately after the installation of new credentials
2242  * due to exec
2243  */
2244 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2245 {
2246         const struct task_security_struct *tsec = current_security();
2247         struct itimerval itimer;
2248         u32 osid, sid;
2249         int rc, i;
2250
2251         osid = tsec->osid;
2252         sid = tsec->sid;
2253
2254         if (sid == osid)
2255                 return;
2256
2257         /* Check whether the new SID can inherit signal state from the old SID.
2258          * If not, clear itimers to avoid subsequent signal generation and
2259          * flush and unblock signals.
2260          *
2261          * This must occur _after_ the task SID has been updated so that any
2262          * kill done after the flush will be checked against the new SID.
2263          */
2264         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2265         if (rc) {
2266                 memset(&itimer, 0, sizeof itimer);
2267                 for (i = 0; i < 3; i++)
2268                         do_setitimer(i, &itimer, NULL);
2269                 spin_lock_irq(&current->sighand->siglock);
2270                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2271                         __flush_signals(current);
2272                         flush_signal_handlers(current, 1);
2273                         sigemptyset(&current->blocked);
2274                 }
2275                 spin_unlock_irq(&current->sighand->siglock);
2276         }
2277
2278         /* Wake up the parent if it is waiting so that it can recheck
2279          * wait permission to the new task SID. */
2280         read_lock(&tasklist_lock);
2281         __wake_up_parent(current, current->real_parent);
2282         read_unlock(&tasklist_lock);
2283 }
2284
2285 /* superblock security operations */
2286
2287 static int selinux_sb_alloc_security(struct super_block *sb)
2288 {
2289         return superblock_alloc_security(sb);
2290 }
2291
2292 static void selinux_sb_free_security(struct super_block *sb)
2293 {
2294         superblock_free_security(sb);
2295 }
2296
2297 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2298 {
2299         if (plen > olen)
2300                 return 0;
2301
2302         return !memcmp(prefix, option, plen);
2303 }
2304
2305 static inline int selinux_option(char *option, int len)
2306 {
2307         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2308                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2309                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2310                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2311                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2312 }
2313
2314 static inline void take_option(char **to, char *from, int *first, int len)
2315 {
2316         if (!*first) {
2317                 **to = ',';
2318                 *to += 1;
2319         } else
2320                 *first = 0;
2321         memcpy(*to, from, len);
2322         *to += len;
2323 }
2324
2325 static inline void take_selinux_option(char **to, char *from, int *first,
2326                                        int len)
2327 {
2328         int current_size = 0;
2329
2330         if (!*first) {
2331                 **to = '|';
2332                 *to += 1;
2333         } else
2334                 *first = 0;
2335
2336         while (current_size < len) {
2337                 if (*from != '"') {
2338                         **to = *from;
2339                         *to += 1;
2340                 }
2341                 from += 1;
2342                 current_size += 1;
2343         }
2344 }
2345
2346 static int selinux_sb_copy_data(char *orig, char *copy)
2347 {
2348         int fnosec, fsec, rc = 0;
2349         char *in_save, *in_curr, *in_end;
2350         char *sec_curr, *nosec_save, *nosec;
2351         int open_quote = 0;
2352
2353         in_curr = orig;
2354         sec_curr = copy;
2355
2356         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2357         if (!nosec) {
2358                 rc = -ENOMEM;
2359                 goto out;
2360         }
2361
2362         nosec_save = nosec;
2363         fnosec = fsec = 1;
2364         in_save = in_end = orig;
2365
2366         do {
2367                 if (*in_end == '"')
2368                         open_quote = !open_quote;
2369                 if ((*in_end == ',' && open_quote == 0) ||
2370                                 *in_end == '\0') {
2371                         int len = in_end - in_curr;
2372
2373                         if (selinux_option(in_curr, len))
2374                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2375                         else
2376                                 take_option(&nosec, in_curr, &fnosec, len);
2377
2378                         in_curr = in_end + 1;
2379                 }
2380         } while (*in_end++);
2381
2382         strcpy(in_save, nosec_save);
2383         free_page((unsigned long)nosec_save);
2384 out:
2385         return rc;
2386 }
2387
2388 static int selinux_sb_remount(struct super_block *sb, void *data)
2389 {
2390         int rc, i, *flags;
2391         struct security_mnt_opts opts;
2392         char *secdata, **mount_options;
2393         struct superblock_security_struct *sbsec = sb->s_security;
2394
2395         if (!(sbsec->flags & SE_SBINITIALIZED))
2396                 return 0;
2397
2398         if (!data)
2399                 return 0;
2400
2401         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2402                 return 0;
2403
2404         security_init_mnt_opts(&opts);
2405         secdata = alloc_secdata();
2406         if (!secdata)
2407                 return -ENOMEM;
2408         rc = selinux_sb_copy_data(data, secdata);
2409         if (rc)
2410                 goto out_free_secdata;
2411
2412         rc = selinux_parse_opts_str(secdata, &opts);
2413         if (rc)
2414                 goto out_free_secdata;
2415
2416         mount_options = opts.mnt_opts;
2417         flags = opts.mnt_opts_flags;
2418
2419         for (i = 0; i < opts.num_mnt_opts; i++) {
2420                 u32 sid;
2421                 size_t len;
2422
2423                 if (flags[i] == SE_SBLABELSUPP)
2424                         continue;
2425                 len = strlen(mount_options[i]);
2426                 rc = security_context_to_sid(mount_options[i], len, &sid);
2427                 if (rc) {
2428                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2429                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2430                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2431                         goto out_free_opts;
2432                 }
2433                 rc = -EINVAL;
2434                 switch (flags[i]) {
2435                 case FSCONTEXT_MNT:
2436                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2437                                 goto out_bad_option;
2438                         break;
2439                 case CONTEXT_MNT:
2440                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2441                                 goto out_bad_option;
2442                         break;
2443                 case ROOTCONTEXT_MNT: {
2444                         struct inode_security_struct *root_isec;
2445                         root_isec = sb->s_root->d_inode->i_security;
2446
2447                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2448                                 goto out_bad_option;
2449                         break;
2450                 }
2451                 case DEFCONTEXT_MNT:
2452                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2453                                 goto out_bad_option;
2454                         break;
2455                 default:
2456                         goto out_free_opts;
2457                 }
2458         }
2459
2460         rc = 0;
2461 out_free_opts:
2462         security_free_mnt_opts(&opts);
2463 out_free_secdata:
2464         free_secdata(secdata);
2465         return rc;
2466 out_bad_option:
2467         printk(KERN_WARNING "SELinux: unable to change security options "
2468                "during remount (dev %s, type=%s)\n", sb->s_id,
2469                sb->s_type->name);
2470         goto out_free_opts;
2471 }
2472
2473 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2474 {
2475         const struct cred *cred = current_cred();
2476         struct common_audit_data ad;
2477         struct selinux_audit_data sad = {0,};
2478         int rc;
2479
2480         rc = superblock_doinit(sb, data);
2481         if (rc)
2482                 return rc;
2483
2484         /* Allow all mounts performed by the kernel */
2485         if (flags & MS_KERNMOUNT)
2486                 return 0;
2487
2488         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2489         ad.selinux_audit_data = &sad;
2490         ad.u.dentry = sb->s_root;
2491         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2492 }
2493
2494 static int selinux_sb_statfs(struct dentry *dentry)
2495 {
2496         const struct cred *cred = current_cred();
2497         struct common_audit_data ad;
2498         struct selinux_audit_data sad = {0,};
2499
2500         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2501         ad.selinux_audit_data = &sad;
2502         ad.u.dentry = dentry->d_sb->s_root;
2503         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2504 }
2505
2506 static int selinux_mount(char *dev_name,
2507                          struct path *path,
2508                          char *type,
2509                          unsigned long flags,
2510                          void *data)
2511 {
2512         const struct cred *cred = current_cred();
2513
2514         if (flags & MS_REMOUNT)
2515                 return superblock_has_perm(cred, path->dentry->d_sb,
2516                                            FILESYSTEM__REMOUNT, NULL);
2517         else
2518                 return path_has_perm(cred, path, FILE__MOUNTON);
2519 }
2520
2521 static int selinux_umount(struct vfsmount *mnt, int flags)
2522 {
2523         const struct cred *cred = current_cred();
2524
2525         return superblock_has_perm(cred, mnt->mnt_sb,
2526                                    FILESYSTEM__UNMOUNT, NULL);
2527 }
2528
2529 /* inode security operations */
2530
2531 static int selinux_inode_alloc_security(struct inode *inode)
2532 {
2533         return inode_alloc_security(inode);
2534 }
2535
2536 static void selinux_inode_free_security(struct inode *inode)
2537 {
2538         inode_free_security(inode);
2539 }
2540
2541 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2542                                        const struct qstr *qstr, char **name,
2543                                        void **value, size_t *len)
2544 {
2545         const struct task_security_struct *tsec = current_security();
2546         struct inode_security_struct *dsec;
2547         struct superblock_security_struct *sbsec;
2548         u32 sid, newsid, clen;
2549         int rc;
2550         char *namep = NULL, *context;
2551
2552         dsec = dir->i_security;
2553         sbsec = dir->i_sb->s_security;
2554
2555         sid = tsec->sid;
2556         newsid = tsec->create_sid;
2557
2558         if ((sbsec->flags & SE_SBINITIALIZED) &&
2559             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2560                 newsid = sbsec->mntpoint_sid;
2561         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2562                 rc = security_transition_sid(sid, dsec->sid,
2563                                              inode_mode_to_security_class(inode->i_mode),
2564                                              qstr, &newsid);
2565                 if (rc) {
2566                         printk(KERN_WARNING "%s:  "
2567                                "security_transition_sid failed, rc=%d (dev=%s "
2568                                "ino=%ld)\n",
2569                                __func__,
2570                                -rc, inode->i_sb->s_id, inode->i_ino);
2571                         return rc;
2572                 }
2573         }
2574
2575         /* Possibly defer initialization to selinux_complete_init. */
2576         if (sbsec->flags & SE_SBINITIALIZED) {
2577                 struct inode_security_struct *isec = inode->i_security;
2578                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2579                 isec->sid = newsid;
2580                 isec->initialized = 1;
2581         }
2582
2583         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2584                 return -EOPNOTSUPP;
2585
2586         if (name) {
2587                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2588                 if (!namep)
2589                         return -ENOMEM;
2590                 *name = namep;
2591         }
2592
2593         if (value && len) {
2594                 rc = security_sid_to_context_force(newsid, &context, &clen);
2595                 if (rc) {
2596                         kfree(namep);
2597                         return rc;
2598                 }
2599                 *value = context;
2600                 *len = clen;
2601         }
2602
2603         return 0;
2604 }
2605
2606 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2607 {
2608         return may_create(dir, dentry, SECCLASS_FILE);
2609 }
2610
2611 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2612 {
2613         return may_link(dir, old_dentry, MAY_LINK);
2614 }
2615
2616 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2617 {
2618         return may_link(dir, dentry, MAY_UNLINK);
2619 }
2620
2621 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2622 {
2623         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2624 }
2625
2626 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2627 {
2628         return may_create(dir, dentry, SECCLASS_DIR);
2629 }
2630
2631 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2632 {
2633         return may_link(dir, dentry, MAY_RMDIR);
2634 }
2635
2636 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2637 {
2638         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2639 }
2640
2641 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2642                                 struct inode *new_inode, struct dentry *new_dentry)
2643 {
2644         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2645 }
2646
2647 static int selinux_inode_readlink(struct dentry *dentry)
2648 {
2649         const struct cred *cred = current_cred();
2650
2651         return dentry_has_perm(cred, dentry, FILE__READ);
2652 }
2653
2654 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2655 {
2656         const struct cred *cred = current_cred();
2657
2658         return dentry_has_perm(cred, dentry, FILE__READ);
2659 }
2660
2661 static int selinux_inode_permission(struct inode *inode, int mask)
2662 {
2663         const struct cred *cred = current_cred();
2664         struct common_audit_data ad;
2665         struct selinux_audit_data sad = {0,};
2666         u32 perms;
2667         bool from_access;
2668         unsigned flags = mask & MAY_NOT_BLOCK;
2669         struct inode_security_struct *isec;
2670         u32 sid;
2671         struct av_decision avd;
2672         int rc, rc2;
2673         u32 audited, denied;
2674
2675         from_access = mask & MAY_ACCESS;
2676         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2677
2678         /* No permission to check.  Existence test. */
2679         if (!mask)
2680                 return 0;
2681
2682         validate_creds(cred);
2683
2684         if (unlikely(IS_PRIVATE(inode)))
2685                 return 0;
2686
2687         perms = file_mask_to_av(inode->i_mode, mask);
2688
2689         sid = cred_sid(cred);
2690         isec = inode->i_security;
2691
2692         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2693         audited = avc_audit_required(perms, &avd, rc,
2694                                      from_access ? FILE__AUDIT_ACCESS : 0,
2695                                      &denied);
2696         if (likely(!audited))
2697                 return rc;
2698
2699         COMMON_AUDIT_DATA_INIT(&ad, INODE);
2700         ad.selinux_audit_data = &sad;
2701         ad.u.inode = inode;
2702
2703         if (from_access)
2704                 ad.selinux_audit_data->auditdeny |= FILE__AUDIT_ACCESS;
2705
2706         rc2 = slow_avc_audit(sid, isec->sid, isec->sclass, perms,
2707                              audited, denied, &ad, flags);
2708         if (rc2)
2709                 return rc2;
2710         return rc;
2711 }
2712
2713 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2714 {
2715         const struct cred *cred = current_cred();
2716         unsigned int ia_valid = iattr->ia_valid;
2717         __u32 av = FILE__WRITE;
2718
2719         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2720         if (ia_valid & ATTR_FORCE) {
2721                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2722                               ATTR_FORCE);
2723                 if (!ia_valid)
2724                         return 0;
2725         }
2726
2727         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2728                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2729                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2730
2731         if (ia_valid & ATTR_SIZE)
2732                 av |= FILE__OPEN;
2733
2734         return dentry_has_perm(cred, dentry, av);
2735 }
2736
2737 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2738 {
2739         const struct cred *cred = current_cred();
2740         struct path path;
2741
2742         path.dentry = dentry;
2743         path.mnt = mnt;
2744
2745         return path_has_perm(cred, &path, FILE__GETATTR);
2746 }
2747
2748 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2749 {
2750         const struct cred *cred = current_cred();
2751
2752         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2753                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2754                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2755                         if (!capable(CAP_SETFCAP))
2756                                 return -EPERM;
2757                 } else if (!capable(CAP_SYS_ADMIN)) {
2758                         /* A different attribute in the security namespace.
2759                            Restrict to administrator. */
2760                         return -EPERM;
2761                 }
2762         }
2763
2764         /* Not an attribute we recognize, so just check the
2765            ordinary setattr permission. */
2766         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2767 }
2768
2769 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2770                                   const void *value, size_t size, int flags)
2771 {
2772         struct inode *inode = dentry->d_inode;
2773         struct inode_security_struct *isec = inode->i_security;
2774         struct superblock_security_struct *sbsec;
2775         struct common_audit_data ad;
2776         struct selinux_audit_data sad = {0,};
2777         u32 newsid, sid = current_sid();
2778         int rc = 0;
2779
2780         if (strcmp(name, XATTR_NAME_SELINUX))
2781                 return selinux_inode_setotherxattr(dentry, name);
2782
2783         sbsec = inode->i_sb->s_security;
2784         if (!(sbsec->flags & SE_SBLABELSUPP))
2785                 return -EOPNOTSUPP;
2786
2787         if (!inode_owner_or_capable(inode))
2788                 return -EPERM;
2789
2790         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2791         ad.selinux_audit_data = &sad;
2792         ad.u.dentry = dentry;
2793
2794         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2795                           FILE__RELABELFROM, &ad);
2796         if (rc)
2797                 return rc;
2798
2799         rc = security_context_to_sid(value, size, &newsid);
2800         if (rc == -EINVAL) {
2801                 if (!capable(CAP_MAC_ADMIN)) {
2802                         struct audit_buffer *ab;
2803                         size_t audit_size;
2804                         const char *str;
2805
2806                         /* We strip a nul only if it is at the end, otherwise the
2807                          * context contains a nul and we should audit that */
2808                         str = value;
2809                         if (str[size - 1] == '\0')
2810                                 audit_size = size - 1;
2811                         else
2812                                 audit_size = size;
2813                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2814                         audit_log_format(ab, "op=setxattr invalid_context=");
2815                         audit_log_n_untrustedstring(ab, value, audit_size);
2816                         audit_log_end(ab);
2817
2818                         return rc;
2819                 }
2820                 rc = security_context_to_sid_force(value, size, &newsid);
2821         }
2822         if (rc)
2823                 return rc;
2824
2825         rc = avc_has_perm(sid, newsid, isec->sclass,
2826                           FILE__RELABELTO, &ad);
2827         if (rc)
2828                 return rc;
2829
2830         rc = security_validate_transition(isec->sid, newsid, sid,
2831                                           isec->sclass);
2832         if (rc)
2833                 return rc;
2834
2835         return avc_has_perm(newsid,
2836                             sbsec->sid,
2837                             SECCLASS_FILESYSTEM,
2838                             FILESYSTEM__ASSOCIATE,
2839                             &ad);
2840 }
2841
2842 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2843                                         const void *value, size_t size,
2844                                         int flags)
2845 {
2846         struct inode *inode = dentry->d_inode;
2847         struct inode_security_struct *isec = inode->i_security;
2848         u32 newsid;
2849         int rc;
2850
2851         if (strcmp(name, XATTR_NAME_SELINUX)) {
2852                 /* Not an attribute we recognize, so nothing to do. */
2853                 return;
2854         }
2855
2856         rc = security_context_to_sid_force(value, size, &newsid);
2857         if (rc) {
2858                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2859                        "for (%s, %lu), rc=%d\n",
2860                        inode->i_sb->s_id, inode->i_ino, -rc);
2861                 return;
2862         }
2863
2864         isec->sid = newsid;
2865         return;
2866 }
2867
2868 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2869 {
2870         const struct cred *cred = current_cred();
2871
2872         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2873 }
2874
2875 static int selinux_inode_listxattr(struct dentry *dentry)
2876 {
2877         const struct cred *cred = current_cred();
2878
2879         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2880 }
2881
2882 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2883 {
2884         if (strcmp(name, XATTR_NAME_SELINUX))
2885                 return selinux_inode_setotherxattr(dentry, name);
2886
2887         /* No one is allowed to remove a SELinux security label.
2888            You can change the label, but all data must be labeled. */
2889         return -EACCES;
2890 }
2891
2892 /*
2893  * Copy the inode security context value to the user.
2894  *
2895  * Permission check is handled by selinux_inode_getxattr hook.
2896  */
2897 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2898 {
2899         u32 size;
2900         int error;
2901         char *context = NULL;
2902         struct inode_security_struct *isec = inode->i_security;
2903
2904         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2905                 return -EOPNOTSUPP;
2906
2907         /*
2908          * If the caller has CAP_MAC_ADMIN, then get the raw context
2909          * value even if it is not defined by current policy; otherwise,
2910          * use the in-core value under current policy.
2911          * Use the non-auditing forms of the permission checks since
2912          * getxattr may be called by unprivileged processes commonly
2913          * and lack of permission just means that we fall back to the
2914          * in-core context value, not a denial.
2915          */
2916         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2917                                 SECURITY_CAP_NOAUDIT);
2918         if (!error)
2919                 error = security_sid_to_context_force(isec->sid, &context,
2920                                                       &size);
2921         else
2922                 error = security_sid_to_context(isec->sid, &context, &size);
2923         if (error)
2924                 return error;
2925         error = size;
2926         if (alloc) {
2927                 *buffer = context;
2928                 goto out_nofree;
2929         }
2930         kfree(context);
2931 out_nofree:
2932         return error;
2933 }
2934
2935 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2936                                      const void *value, size_t size, int flags)
2937 {
2938         struct inode_security_struct *isec = inode->i_security;
2939         u32 newsid;
2940         int rc;
2941
2942         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2943                 return -EOPNOTSUPP;
2944
2945         if (!value || !size)
2946                 return -EACCES;
2947
2948         rc = security_context_to_sid((void *)value, size, &newsid);
2949         if (rc)
2950                 return rc;
2951
2952         isec->sid = newsid;
2953         isec->initialized = 1;
2954         return 0;
2955 }
2956
2957 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2958 {
2959         const int len = sizeof(XATTR_NAME_SELINUX);
2960         if (buffer && len <= buffer_size)
2961                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2962         return len;
2963 }
2964
2965 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2966 {
2967         struct inode_security_struct *isec = inode->i_security;
2968         *secid = isec->sid;
2969 }
2970
2971 /* file security operations */
2972
2973 static int selinux_revalidate_file_permission(struct file *file, int mask)
2974 {
2975         const struct cred *cred = current_cred();
2976         struct inode *inode = file->f_path.dentry->d_inode;
2977
2978         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2979         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2980                 mask |= MAY_APPEND;
2981
2982         return file_has_perm(cred, file,
2983                              file_mask_to_av(inode->i_mode, mask));
2984 }
2985
2986 static int selinux_file_permission(struct file *file, int mask)
2987 {
2988         struct inode *inode = file->f_path.dentry->d_inode;
2989         struct file_security_struct *fsec = file->f_security;
2990         struct inode_security_struct *isec = inode->i_security;
2991         u32 sid = current_sid();
2992
2993         if (!mask)
2994                 /* No permission to check.  Existence test. */
2995                 return 0;
2996
2997         if (sid == fsec->sid && fsec->isid == isec->sid &&
2998             fsec->pseqno == avc_policy_seqno())
2999                 /* No change since file_open check. */
3000                 return 0;
3001
3002         return selinux_revalidate_file_permission(file, mask);
3003 }
3004
3005 static int selinux_file_alloc_security(struct file *file)
3006 {
3007         return file_alloc_security(file);
3008 }
3009
3010 static void selinux_file_free_security(struct file *file)
3011 {
3012         file_free_security(file);
3013 }
3014
3015 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3016                               unsigned long arg)
3017 {
3018         const struct cred *cred = current_cred();
3019         int error = 0;
3020
3021         switch (cmd) {
3022         case FIONREAD:
3023         /* fall through */
3024         case FIBMAP:
3025         /* fall through */
3026         case FIGETBSZ:
3027         /* fall through */
3028         case FS_IOC_GETFLAGS:
3029         /* fall through */
3030         case FS_IOC_GETVERSION:
3031                 error = file_has_perm(cred, file, FILE__GETATTR);
3032                 break;
3033
3034         case FS_IOC_SETFLAGS:
3035         /* fall through */
3036         case FS_IOC_SETVERSION:
3037                 error = file_has_perm(cred, file, FILE__SETATTR);
3038                 break;
3039
3040         /* sys_ioctl() checks */
3041         case FIONBIO:
3042         /* fall through */
3043         case FIOASYNC:
3044                 error = file_has_perm(cred, file, 0);
3045                 break;
3046
3047         case KDSKBENT:
3048         case KDSKBSENT:
3049                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3050                                             SECURITY_CAP_AUDIT);
3051                 break;
3052
3053         /* default case assumes that the command will go
3054          * to the file's ioctl() function.
3055          */
3056         default:
3057                 error = file_has_perm(cred, file, FILE__IOCTL);
3058         }
3059         return error;
3060 }
3061
3062 static int default_noexec;
3063
3064 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3065 {
3066         const struct cred *cred = current_cred();
3067         int rc = 0;
3068
3069         if (default_noexec &&
3070             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3071                 /*
3072                  * We are making executable an anonymous mapping or a
3073                  * private file mapping that will also be writable.
3074                  * This has an additional check.
3075                  */
3076                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3077                 if (rc)
3078                         goto error;
3079         }
3080
3081         if (file) {
3082                 /* read access is always possible with a mapping */
3083                 u32 av = FILE__READ;
3084
3085                 /* write access only matters if the mapping is shared */
3086                 if (shared && (prot & PROT_WRITE))
3087                         av |= FILE__WRITE;
3088
3089                 if (prot & PROT_EXEC)
3090                         av |= FILE__EXECUTE;
3091
3092                 return file_has_perm(cred, file, av);
3093         }
3094
3095 error:
3096         return rc;
3097 }
3098
3099 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3100                              unsigned long prot, unsigned long flags,
3101                              unsigned long addr, unsigned long addr_only)
3102 {
3103         int rc = 0;
3104         u32 sid = current_sid();
3105
3106         /*
3107          * notice that we are intentionally putting the SELinux check before
3108          * the secondary cap_file_mmap check.  This is such a likely attempt
3109          * at bad behaviour/exploit that we always want to get the AVC, even
3110          * if DAC would have also denied the operation.
3111          */
3112         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3113                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3114                                   MEMPROTECT__MMAP_ZERO, NULL);
3115                 if (rc)
3116                         return rc;
3117         }
3118
3119         /* do DAC check on address space usage */
3120         rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3121         if (rc || addr_only)
3122                 return rc;
3123
3124         if (selinux_checkreqprot)
3125                 prot = reqprot;
3126
3127         return file_map_prot_check(file, prot,
3128                                    (flags & MAP_TYPE) == MAP_SHARED);
3129 }
3130
3131 static int selinux_file_mprotect(struct vm_area_struct *vma,
3132                                  unsigned long reqprot,
3133                                  unsigned long prot)
3134 {
3135         const struct cred *cred = current_cred();
3136
3137         if (selinux_checkreqprot)
3138                 prot = reqprot;
3139
3140         if (default_noexec &&
3141             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3142                 int rc = 0;
3143                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3144                     vma->vm_end <= vma->vm_mm->brk) {
3145                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3146                 } else if (!vma->vm_file &&
3147                            vma->vm_start <= vma->vm_mm->start_stack &&
3148                            vma->vm_end >= vma->vm_mm->start_stack) {
3149                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3150                 } else if (vma->vm_file && vma->anon_vma) {
3151                         /*
3152                          * We are making executable a file mapping that has
3153                          * had some COW done. Since pages might have been
3154                          * written, check ability to execute the possibly
3155                          * modified content.  This typically should only
3156                          * occur for text relocations.
3157                          */
3158                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3159                 }
3160                 if (rc)
3161                         return rc;
3162         }
3163
3164         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3165 }
3166
3167 static int selinux_file_lock(struct file *file, unsigned int cmd)
3168 {
3169         const struct cred *cred = current_cred();
3170
3171         return file_has_perm(cred, file, FILE__LOCK);
3172 }
3173
3174 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3175                               unsigned long arg)
3176 {
3177         const struct cred *cred = current_cred();
3178         int err = 0;
3179
3180         switch (cmd) {
3181         case F_SETFL:
3182                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3183                         err = -EINVAL;
3184                         break;
3185                 }
3186
3187                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3188                         err = file_has_perm(cred, file, FILE__WRITE);
3189                         break;
3190                 }
3191                 /* fall through */
3192         case F_SETOWN:
3193         case F_SETSIG:
3194         case F_GETFL:
3195         case F_GETOWN:
3196         case F_GETSIG:
3197                 /* Just check FD__USE permission */
3198                 err = file_has_perm(cred, file, 0);
3199                 break;
3200         case F_GETLK:
3201         case F_SETLK:
3202         case F_SETLKW:
3203 #if BITS_PER_LONG == 32
3204         case F_GETLK64:
3205         case F_SETLK64:
3206         case F_SETLKW64:
3207 #endif
3208                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3209                         err = -EINVAL;
3210                         break;
3211                 }
3212                 err = file_has_perm(cred, file, FILE__LOCK);
3213                 break;
3214         }
3215
3216         return err;
3217 }
3218
3219 static int selinux_file_set_fowner(struct file *file)
3220 {
3221         struct file_security_struct *fsec;
3222
3223         fsec = file->f_security;
3224         fsec->fown_sid = current_sid();
3225
3226         return 0;
3227 }
3228
3229 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3230                                        struct fown_struct *fown, int signum)
3231 {
3232         struct file *file;
3233         u32 sid = task_sid(tsk);
3234         u32 perm;
3235         struct file_security_struct *fsec;
3236
3237         /* struct fown_struct is never outside the context of a struct file */
3238         file = container_of(fown, struct file, f_owner);
3239
3240         fsec = file->f_security;
3241
3242         if (!signum)
3243                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3244         else
3245                 perm = signal_to_av(signum);
3246
3247         return avc_has_perm(fsec->fown_sid, sid,
3248                             SECCLASS_PROCESS, perm, NULL);
3249 }
3250
3251 static int selinux_file_receive(struct file *file)
3252 {
3253         const struct cred *cred = current_cred();
3254
3255         return file_has_perm(cred, file, file_to_av(file));
3256 }
3257
3258 static int selinux_file_open(struct file *file, const struct cred *cred)
3259 {
3260         struct file_security_struct *fsec;
3261         struct inode_security_struct *isec;
3262
3263         fsec = file->f_security;
3264         isec = file->f_path.dentry->d_inode->i_security;
3265         /*
3266          * Save inode label and policy sequence number
3267          * at open-time so that selinux_file_permission
3268          * can determine whether revalidation is necessary.
3269          * Task label is already saved in the file security
3270          * struct as its SID.
3271          */
3272         fsec->isid = isec->sid;
3273         fsec->pseqno = avc_policy_seqno();
3274         /*
3275          * Since the inode label or policy seqno may have changed
3276          * between the selinux_inode_permission check and the saving
3277          * of state above, recheck that access is still permitted.
3278          * Otherwise, access might never be revalidated against the
3279          * new inode label or new policy.
3280          * This check is not redundant - do not remove.
3281          */
3282         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3283 }
3284
3285 /* task security operations */
3286
3287 static int selinux_task_create(unsigned long clone_flags)
3288 {
3289         return current_has_perm(current, PROCESS__FORK);
3290 }
3291
3292 /*
3293  * allocate the SELinux part of blank credentials
3294  */
3295 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3296 {
3297         struct task_security_struct *tsec;
3298
3299         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3300         if (!tsec)
3301                 return -ENOMEM;
3302
3303         cred->security = tsec;
3304         return 0;
3305 }
3306
3307 /*
3308  * detach and free the LSM part of a set of credentials
3309  */
3310 static void selinux_cred_free(struct cred *cred)
3311 {
3312         struct task_security_struct *tsec = cred->security;
3313
3314         /*
3315          * cred->security == NULL if security_cred_alloc_blank() or
3316          * security_prepare_creds() returned an error.
3317          */
3318         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3319         cred->security = (void *) 0x7UL;
3320         kfree(tsec);
3321 }
3322
3323 /*
3324  * prepare a new set of credentials for modification
3325  */
3326 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3327                                 gfp_t gfp)
3328 {
3329         const struct task_security_struct *old_tsec;
3330         struct task_security_struct *tsec;
3331
3332         old_tsec = old->security;
3333
3334         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3335         if (!tsec)
3336                 return -ENOMEM;
3337
3338         new->security = tsec;
3339         return 0;
3340 }
3341
3342 /*
3343  * transfer the SELinux data to a blank set of creds
3344  */
3345 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3346 {
3347         const struct task_security_struct *old_tsec = old->security;
3348         struct task_security_struct *tsec = new->security;
3349
3350         *tsec = *old_tsec;
3351 }
3352
3353 /*
3354  * set the security data for a kernel service
3355  * - all the creation contexts are set to unlabelled
3356  */
3357 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3358 {
3359         struct task_security_struct *tsec = new->security;
3360         u32 sid = current_sid();
3361         int ret;
3362
3363         ret = avc_has_perm(sid, secid,
3364                            SECCLASS_KERNEL_SERVICE,
3365                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3366                            NULL);
3367         if (ret == 0) {
3368                 tsec->sid = secid;
3369                 tsec->create_sid = 0;
3370                 tsec->keycreate_sid = 0;
3371                 tsec->sockcreate_sid = 0;
3372         }
3373         return ret;
3374 }
3375
3376 /*
3377  * set the file creation context in a security record to the same as the
3378  * objective context of the specified inode
3379  */
3380 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3381 {
3382         struct inode_security_struct *isec = inode->i_security;
3383         struct task_security_struct *tsec = new->security;
3384         u32 sid = current_sid();
3385         int ret;
3386
3387         ret = avc_has_perm(sid, isec->sid,
3388                            SECCLASS_KERNEL_SERVICE,
3389                            KERNEL_SERVICE__CREATE_FILES_AS,
3390                            NULL);
3391
3392         if (ret == 0)
3393                 tsec->create_sid = isec->sid;
3394         return ret;
3395 }
3396
3397 static int selinux_kernel_module_request(char *kmod_name)
3398 {
3399         u32 sid;
3400         struct common_audit_data ad;
3401         struct selinux_audit_data sad = {0,};
3402
3403         sid = task_sid(current);
3404
3405         COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3406         ad.selinux_audit_data = &sad;
3407         ad.u.kmod_name = kmod_name;
3408
3409         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3410                             SYSTEM__MODULE_REQUEST, &ad);
3411 }
3412
3413 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3414 {
3415         return current_has_perm(p, PROCESS__SETPGID);
3416 }
3417
3418 static int selinux_task_getpgid(struct task_struct *p)
3419 {
3420         return current_has_perm(p, PROCESS__GETPGID);
3421 }
3422
3423 static int selinux_task_getsid(struct task_struct *p)
3424 {
3425         return current_has_perm(p, PROCESS__GETSESSION);
3426 }
3427
3428 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3429 {
3430         *secid = task_sid(p);
3431 }
3432
3433 static int selinux_task_setnice(struct task_struct *p, int nice)
3434 {
3435         int rc;
3436
3437         rc = cap_task_setnice(p, nice);
3438         if (rc)
3439                 return rc;
3440
3441         return current_has_perm(p, PROCESS__SETSCHED);
3442 }
3443
3444 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3445 {
3446         int rc;
3447
3448         rc = cap_task_setioprio(p, ioprio);
3449         if (rc)
3450                 return rc;
3451
3452         return current_has_perm(p, PROCESS__SETSCHED);
3453 }
3454
3455 static int selinux_task_getioprio(struct task_struct *p)
3456 {
3457         return current_has_perm(p, PROCESS__GETSCHED);
3458 }
3459
3460 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3461                 struct rlimit *new_rlim)
3462 {
3463         struct rlimit *old_rlim = p->signal->rlim + resource;
3464
3465         /* Control the ability to change the hard limit (whether
3466            lowering or raising it), so that the hard limit can
3467            later be used as a safe reset point for the soft limit
3468            upon context transitions.  See selinux_bprm_committing_creds. */
3469         if (old_rlim->rlim_max != new_rlim->rlim_max)
3470                 return current_has_perm(p, PROCESS__SETRLIMIT);
3471
3472         return 0;
3473 }
3474
3475 static int selinux_task_setscheduler(struct task_struct *p)
3476 {
3477         int rc;
3478
3479         rc = cap_task_setscheduler(p);
3480         if (rc)
3481                 return rc;
3482
3483         return current_has_perm(p, PROCESS__SETSCHED);
3484 }
3485
3486 static int selinux_task_getscheduler(struct task_struct *p)
3487 {
3488         return current_has_perm(p, PROCESS__GETSCHED);
3489 }
3490
3491 static int selinux_task_movememory(struct task_struct *p)
3492 {
3493         return current_has_perm(p, PROCESS__SETSCHED);
3494 }
3495
3496 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3497                                 int sig, u32 secid)
3498 {
3499         u32 perm;
3500         int rc;
3501
3502         if (!sig)
3503                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3504         else
3505                 perm = signal_to_av(sig);
3506         if (secid)
3507                 rc = avc_has_perm(secid, task_sid(p),
3508                                   SECCLASS_PROCESS, perm, NULL);
3509         else
3510                 rc = current_has_perm(p, perm);
3511         return rc;
3512 }
3513
3514 static int selinux_task_wait(struct task_struct *p)
3515 {
3516         return task_has_perm(p, current, PROCESS__SIGCHLD);
3517 }
3518
3519 static void selinux_task_to_inode(struct task_struct *p,
3520                                   struct inode *inode)
3521 {
3522         struct inode_security_struct *isec = inode->i_security;
3523         u32 sid = task_sid(p);
3524
3525         isec->sid = sid;
3526         isec->initialized = 1;
3527 }
3528
3529 /* Returns error only if unable to parse addresses */
3530 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3531                         struct common_audit_data *ad, u8 *proto)
3532 {
3533         int offset, ihlen, ret = -EINVAL;
3534         struct iphdr _iph, *ih;
3535
3536         offset = skb_network_offset(skb);
3537         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3538         if (ih == NULL)
3539                 goto out;
3540
3541         ihlen = ih->ihl * 4;
3542         if (ihlen < sizeof(_iph))
3543                 goto out;
3544
3545         ad->u.net->v4info.saddr = ih->saddr;
3546         ad->u.net->v4info.daddr = ih->daddr;
3547         ret = 0;
3548
3549         if (proto)
3550                 *proto = ih->protocol;
3551
3552         switch (ih->protocol) {
3553         case IPPROTO_TCP: {
3554                 struct tcphdr _tcph, *th;
3555
3556                 if (ntohs(ih->frag_off) & IP_OFFSET)
3557                         break;
3558
3559                 offset += ihlen;
3560                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3561                 if (th == NULL)
3562                         break;
3563
3564                 ad->u.net->sport = th->source;
3565                 ad->u.net->dport = th->dest;
3566                 break;
3567         }
3568
3569         case IPPROTO_UDP: {
3570                 struct udphdr _udph, *uh;
3571
3572                 if (ntohs(ih->frag_off) & IP_OFFSET)
3573                         break;
3574
3575                 offset += ihlen;
3576                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3577                 if (uh == NULL)
3578                         break;
3579
3580                 ad->u.net->sport = uh->source;
3581                 ad->u.net->dport = uh->dest;
3582                 break;
3583         }
3584
3585         case IPPROTO_DCCP: {
3586                 struct dccp_hdr _dccph, *dh;
3587
3588                 if (ntohs(ih->frag_off) & IP_OFFSET)
3589                         break;
3590
3591                 offset += ihlen;
3592                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3593                 if (dh == NULL)
3594                         break;
3595
3596                 ad->u.net->sport = dh->dccph_sport;
3597                 ad->u.net->dport = dh->dccph_dport;
3598                 break;
3599         }
3600
3601         default:
3602                 break;
3603         }
3604 out:
3605         return ret;
3606 }
3607
3608 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3609
3610 /* Returns error only if unable to parse addresses */
3611 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3612                         struct common_audit_data *ad, u8 *proto)
3613 {
3614         u8 nexthdr;
3615         int ret = -EINVAL, offset;
3616         struct ipv6hdr _ipv6h, *ip6;
3617         __be16 frag_off;
3618
3619         offset = skb_network_offset(skb);
3620         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3621         if (ip6 == NULL)
3622                 goto out;
3623
3624         ad->u.net->v6info.saddr = ip6->saddr;
3625         ad->u.net->v6info.daddr = ip6->daddr;
3626         ret = 0;
3627
3628         nexthdr = ip6->nexthdr;
3629         offset += sizeof(_ipv6h);
3630         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3631         if (offset < 0)
3632                 goto out;
3633
3634         if (proto)
3635                 *proto = nexthdr;
3636
3637         switch (nexthdr) {
3638         case IPPROTO_TCP: {
3639                 struct tcphdr _tcph, *th;
3640
3641                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3642                 if (th == NULL)
3643                         break;
3644
3645                 ad->u.net->sport = th->source;
3646                 ad->u.net->dport = th->dest;
3647                 break;
3648         }
3649
3650         case IPPROTO_UDP: {
3651                 struct udphdr _udph, *uh;
3652
3653                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3654                 if (uh == NULL)
3655                         break;
3656
3657                 ad->u.net->sport = uh->source;
3658                 ad->u.net->dport = uh->dest;
3659                 break;
3660         }
3661
3662         case IPPROTO_DCCP: {
3663                 struct dccp_hdr _dccph, *dh;
3664
3665                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3666                 if (dh == NULL)
3667                         break;
3668
3669                 ad->u.net->sport = dh->dccph_sport;
3670                 ad->u.net->dport = dh->dccph_dport;
3671                 break;
3672         }
3673
3674         /* includes fragments */
3675         default:
3676                 break;
3677         }
3678 out:
3679         return ret;
3680 }
3681
3682 #endif /* IPV6 */
3683
3684 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3685                              char **_addrp, int src, u8 *proto)
3686 {
3687         char *addrp;
3688         int ret;
3689
3690         switch (ad->u.net->family) {
3691         case PF_INET:
3692                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3693                 if (ret)
3694                         goto parse_error;
3695                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3696                                        &ad->u.net->v4info.daddr);
3697                 goto okay;
3698
3699 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3700         case PF_INET6:
3701                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3702                 if (ret)
3703                         goto parse_error;
3704                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3705                                        &ad->u.net->v6info.daddr);
3706                 goto okay;
3707 #endif  /* IPV6 */
3708         default:
3709                 addrp = NULL;
3710                 goto okay;
3711         }
3712
3713 parse_error:
3714         printk(KERN_WARNING
3715                "SELinux: failure in selinux_parse_skb(),"
3716                " unable to parse packet\n");
3717         return ret;
3718
3719 okay:
3720         if (_addrp)
3721                 *_addrp = addrp;
3722         return 0;
3723 }
3724
3725 /**
3726  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3727  * @skb: the packet
3728  * @family: protocol family
3729  * @sid: the packet's peer label SID
3730  *
3731  * Description:
3732  * Check the various different forms of network peer labeling and determine
3733  * the peer label/SID for the packet; most of the magic actually occurs in
3734  * the security server function security_net_peersid_cmp().  The function
3735  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3736  * or -EACCES if @sid is invalid due to inconsistencies with the different
3737  * peer labels.
3738  *
3739  */
3740 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3741 {
3742         int err;
3743         u32 xfrm_sid;
3744         u32 nlbl_sid;
3745         u32 nlbl_type;
3746
3747         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3748         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3749
3750         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3751         if (unlikely(err)) {
3752                 printk(KERN_WARNING
3753                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3754                        " unable to determine packet's peer label\n");
3755                 return -EACCES;
3756         }
3757
3758         return 0;
3759 }
3760
3761 /* socket security operations */
3762
3763 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3764                                  u16 secclass, u32 *socksid)
3765 {
3766         if (tsec->sockcreate_sid > SECSID_NULL) {
3767                 *socksid = tsec->sockcreate_sid;
3768                 return 0;
3769         }
3770
3771         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3772                                        socksid);
3773 }
3774
3775 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3776 {
3777         struct sk_security_struct *sksec = sk->sk_security;
3778         struct common_audit_data ad;
3779         struct selinux_audit_data sad = {0,};
3780         struct lsm_network_audit net = {0,};
3781         u32 tsid = task_sid(task);
3782
3783         if (sksec->sid == SECINITSID_KERNEL)
3784                 return 0;
3785
3786         COMMON_AUDIT_DATA_INIT(&ad, NET);
3787         ad.selinux_audit_data = &sad;
3788         ad.u.net = &net;
3789         ad.u.net->sk = sk;
3790
3791         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3792 }
3793
3794 static int selinux_socket_create(int family, int type,
3795                                  int protocol, int kern)
3796 {
3797         const struct task_security_struct *tsec = current_security();
3798         u32 newsid;
3799         u16 secclass;
3800         int rc;
3801
3802         if (kern)
3803                 return 0;
3804
3805         secclass = socket_type_to_security_class(family, type, protocol);
3806         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3807         if (rc)
3808                 return rc;
3809
3810         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3811 }
3812
3813 static int selinux_socket_post_create(struct socket *sock, int family,
3814                                       int type, int protocol, int kern)
3815 {
3816         const struct task_security_struct *tsec = current_security();
3817         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3818         struct sk_security_struct *sksec;
3819         int err = 0;
3820
3821         isec->sclass = socket_type_to_security_class(family, type, protocol);
3822
3823         if (kern)
3824                 isec->sid = SECINITSID_KERNEL;
3825         else {
3826                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3827                 if (err)
3828                         return err;
3829         }
3830
3831         isec->initialized = 1;
3832
3833         if (sock->sk) {
3834                 sksec = sock->sk->sk_security;
3835                 sksec->sid = isec->sid;
3836                 sksec->sclass = isec->sclass;
3837                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3838         }
3839
3840         return err;
3841 }
3842
3843 /* Range of port numbers used to automatically bind.
3844    Need to determine whether we should perform a name_bind
3845    permission check between the socket and the port number. */
3846
3847 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3848 {
3849         struct sock *sk = sock->sk;
3850         u16 family;
3851         int err;
3852
3853         err = sock_has_perm(current, sk, SOCKET__BIND);
3854         if (err)
3855                 goto out;
3856
3857         /*
3858          * If PF_INET or PF_INET6, check name_bind permission for the port.
3859          * Multiple address binding for SCTP is not supported yet: we just
3860          * check the first address now.
3861          */
3862         family = sk->sk_family;
3863         if (family == PF_INET || family == PF_INET6) {
3864                 char *addrp;
3865                 struct sk_security_struct *sksec = sk->sk_security;
3866                 struct common_audit_data ad;
3867                 struct selinux_audit_data sad = {0,};
3868                 struct lsm_network_audit net = {0,};
3869                 struct sockaddr_in *addr4 = NULL;
3870                 struct sockaddr_in6 *addr6 = NULL;
3871                 unsigned short snum;
3872                 u32 sid, node_perm;
3873
3874                 if (family == PF_INET) {
3875                         addr4 = (struct sockaddr_in *)address;
3876                         snum = ntohs(addr4->sin_port);
3877                         addrp = (char *)&addr4->sin_addr.s_addr;
3878                 } else {
3879                         addr6 = (struct sockaddr_in6 *)address;
3880                         snum = ntohs(addr6->sin6_port);
3881                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3882                 }
3883
3884                 if (snum) {
3885                         int low, high;
3886
3887                         inet_get_local_port_range(&low, &high);
3888
3889                         if (snum < max(PROT_SOCK, low) || snum > high) {
3890                                 err = sel_netport_sid(sk->sk_protocol,
3891                                                       snum, &sid);
3892                                 if (err)
3893                                         goto out;
3894                                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3895                                 ad.selinux_audit_data = &sad;
3896                                 ad.u.net = &net;
3897                                 ad.u.net->sport = htons(snum);
3898                                 ad.u.net->family = family;
3899                                 err = avc_has_perm(sksec->sid, sid,
3900                                                    sksec->sclass,
3901                                                    SOCKET__NAME_BIND, &ad);
3902                                 if (err)
3903                                         goto out;
3904                         }
3905                 }
3906
3907                 switch (sksec->sclass) {
3908                 case SECCLASS_TCP_SOCKET:
3909                         node_perm = TCP_SOCKET__NODE_BIND;
3910                         break;
3911
3912                 case SECCLASS_UDP_SOCKET:
3913                         node_perm = UDP_SOCKET__NODE_BIND;
3914                         break;
3915
3916                 case SECCLASS_DCCP_SOCKET:
3917                         node_perm = DCCP_SOCKET__NODE_BIND;
3918                         break;
3919
3920                 default:
3921                         node_perm = RAWIP_SOCKET__NODE_BIND;
3922                         break;
3923                 }
3924
3925                 err = sel_netnode_sid(addrp, family, &sid);
3926                 if (err)
3927                         goto out;
3928
3929                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3930                 ad.selinux_audit_data = &sad;
3931                 ad.u.net = &net;
3932                 ad.u.net->sport = htons(snum);
3933                 ad.u.net->family = family;
3934
3935                 if (family == PF_INET)
3936                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3937                 else
3938                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3939
3940                 err = avc_has_perm(sksec->sid, sid,
3941                                    sksec->sclass, node_perm, &ad);
3942                 if (err)
3943                         goto out;
3944         }
3945 out:
3946         return err;
3947 }
3948
3949 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3950 {
3951         struct sock *sk = sock->sk;
3952         struct sk_security_struct *sksec = sk->sk_security;
3953         int err;
3954
3955         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3956         if (err)
3957                 return err;
3958
3959         /*
3960          * If a TCP or DCCP socket, check name_connect permission for the port.
3961          */
3962         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3963             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3964                 struct common_audit_data ad;
3965                 struct selinux_audit_data sad = {0,};
3966                 struct lsm_network_audit net = {0,};
3967                 struct sockaddr_in *addr4 = NULL;
3968                 struct sockaddr_in6 *addr6 = NULL;
3969                 unsigned short snum;
3970                 u32 sid, perm;
3971
3972                 if (sk->sk_family == PF_INET) {
3973                         addr4 = (struct sockaddr_in *)address;
3974                         if (addrlen < sizeof(struct sockaddr_in))
3975                                 return -EINVAL;
3976                         snum = ntohs(addr4->sin_port);
3977                 } else {
3978                         addr6 = (struct sockaddr_in6 *)address;
3979                         if (addrlen < SIN6_LEN_RFC2133)
3980                                 return -EINVAL;
3981                         snum = ntohs(addr6->sin6_port);
3982                 }
3983
3984                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3985                 if (err)
3986                         goto out;
3987
3988                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3989                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3990
3991                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3992                 ad.selinux_audit_data = &sad;
3993                 ad.u.net = &net;
3994                 ad.u.net->dport = htons(snum);
3995                 ad.u.net->family = sk->sk_family;
3996                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3997                 if (err)
3998                         goto out;
3999         }
4000
4001         err = selinux_netlbl_socket_connect(sk, address);
4002
4003 out:
4004         return err;
4005 }
4006
4007 static int selinux_socket_listen(struct socket *sock, int backlog)
4008 {
4009         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4010 }
4011
4012 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4013 {
4014         int err;
4015         struct inode_security_struct *isec;
4016         struct inode_security_struct *newisec;
4017
4018         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4019         if (err)
4020                 return err;
4021
4022         newisec = SOCK_INODE(newsock)->i_security;
4023
4024         isec = SOCK_INODE(sock)->i_security;
4025         newisec->sclass = isec->sclass;
4026         newisec->sid = isec->sid;
4027         newisec->initialized = 1;
4028
4029         return 0;
4030 }
4031
4032 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4033                                   int size)
4034 {
4035         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4036 }
4037
4038 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4039                                   int size, int flags)
4040 {
4041         return sock_has_perm(current, sock->sk, SOCKET__READ);
4042 }
4043
4044 static int selinux_socket_getsockname(struct socket *sock)
4045 {
4046         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4047 }
4048
4049 static int selinux_socket_getpeername(struct socket *sock)
4050 {
4051         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4052 }
4053
4054 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4055 {
4056         int err;
4057
4058         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4059         if (err)
4060                 return err;
4061
4062         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4063 }
4064
4065 static int selinux_socket_getsockopt(struct socket *sock, int level,
4066                                      int optname)
4067 {
4068         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4069 }
4070
4071 static int selinux_socket_shutdown(struct socket *sock, int how)
4072 {
4073         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4074 }
4075
4076 static int selinux_socket_unix_stream_connect(struct sock *sock,
4077                                               struct sock *other,
4078                                               struct sock *newsk)
4079 {
4080         struct sk_security_struct *sksec_sock = sock->sk_security;
4081         struct sk_security_struct *sksec_other = other->sk_security;
4082         struct sk_security_struct *sksec_new = newsk->sk_security;
4083         struct common_audit_data ad;
4084         struct selinux_audit_data sad = {0,};
4085         struct lsm_network_audit net = {0,};
4086         int err;
4087
4088         COMMON_AUDIT_DATA_INIT(&ad, NET);
4089         ad.selinux_audit_data = &sad;
4090         ad.u.net = &net;
4091         ad.u.net->sk = other;
4092
4093         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4094                            sksec_other->sclass,
4095                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4096         if (err)
4097                 return err;
4098
4099         /* server child socket */
4100         sksec_new->peer_sid = sksec_sock->sid;
4101         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4102                                     &sksec_new->sid);
4103         if (err)
4104                 return err;
4105
4106         /* connecting socket */
4107         sksec_sock->peer_sid = sksec_new->sid;
4108
4109         return 0;
4110 }
4111
4112 static int selinux_socket_unix_may_send(struct socket *sock,
4113                                         struct socket *other)
4114 {
4115         struct sk_security_struct *ssec = sock->sk->sk_security;
4116         struct sk_security_struct *osec = other->sk->sk_security;
4117         struct common_audit_data ad;
4118         struct selinux_audit_data sad = {0,};
4119         struct lsm_network_audit net = {0,};
4120
4121         COMMON_AUDIT_DATA_INIT(&ad, NET);
4122         ad.selinux_audit_data = &sad;
4123         ad.u.net = &net;
4124         ad.u.net->sk = other->sk;
4125
4126         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4127                             &ad);
4128 }
4129
4130 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4131                                     u32 peer_sid,
4132                                     struct common_audit_data *ad)
4133 {
4134         int err;
4135         u32 if_sid;
4136         u32 node_sid;
4137
4138         err = sel_netif_sid(ifindex, &if_sid);
4139         if (err)
4140                 return err;
4141         err = avc_has_perm(peer_sid, if_sid,
4142                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4143         if (err)
4144                 return err;
4145
4146         err = sel_netnode_sid(addrp, family, &node_sid);
4147         if (err)
4148                 return err;
4149         return avc_has_perm(peer_sid, node_sid,
4150                             SECCLASS_NODE, NODE__RECVFROM, ad);
4151 }
4152
4153 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4154                                        u16 family)
4155 {
4156         int err = 0;
4157         struct sk_security_struct *sksec = sk->sk_security;
4158         u32 sk_sid = sksec->sid;
4159         struct common_audit_data ad;
4160         struct selinux_audit_data sad = {0,};
4161         struct lsm_network_audit net = {0,};
4162         char *addrp;
4163
4164         COMMON_AUDIT_DATA_INIT(&ad, NET);
4165         ad.selinux_audit_data = &sad;
4166         ad.u.net = &net;
4167         ad.u.net->netif = skb->skb_iif;
4168         ad.u.net->family = family;
4169         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4170         if (err)
4171                 return err;
4172
4173         if (selinux_secmark_enabled()) {
4174                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4175                                    PACKET__RECV, &ad);
4176                 if (err)
4177                         return err;
4178         }
4179
4180         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4181         if (err)
4182                 return err;
4183         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4184
4185         return err;
4186 }
4187
4188 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4189 {
4190         int err;
4191         struct sk_security_struct *sksec = sk->sk_security;
4192         u16 family = sk->sk_family;
4193         u32 sk_sid = sksec->sid;
4194         struct common_audit_data ad;
4195         struct selinux_audit_data sad = {0,};
4196         struct lsm_network_audit net = {0,};
4197         char *addrp;
4198         u8 secmark_active;
4199         u8 peerlbl_active;
4200
4201         if (family != PF_INET && family != PF_INET6)
4202                 return 0;
4203
4204         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4205         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4206                 family = PF_INET;
4207
4208         /* If any sort of compatibility mode is enabled then handoff processing
4209          * to the selinux_sock_rcv_skb_compat() function to deal with the
4210          * special handling.  We do this in an attempt to keep this function
4211          * as fast and as clean as possible. */
4212         if (!selinux_policycap_netpeer)
4213                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4214
4215         secmark_active = selinux_secmark_enabled();
4216         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4217         if (!secmark_active && !peerlbl_active)
4218                 return 0;
4219
4220         COMMON_AUDIT_DATA_INIT(&ad, NET);
4221         ad.selinux_audit_data = &sad;
4222         ad.u.net = &net;
4223         ad.u.net->netif = skb->skb_iif;
4224         ad.u.net->family = family;
4225         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4226         if (err)
4227                 return err;
4228
4229         if (peerlbl_active) {
4230                 u32 peer_sid;
4231
4232                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4233                 if (err)
4234                         return err;
4235                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4236                                                peer_sid, &ad);
4237                 if (err) {
4238                         selinux_netlbl_err(skb, err, 0);
4239                         return err;
4240                 }
4241                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4242                                    PEER__RECV, &ad);
4243                 if (err)
4244                         selinux_netlbl_err(skb, err, 0);
4245         }
4246
4247         if (secmark_active) {
4248                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4249                                    PACKET__RECV, &ad);
4250                 if (err)
4251                         return err;
4252         }
4253
4254         return err;
4255 }
4256
4257 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4258                                             int __user *optlen, unsigned len)
4259 {
4260         int err = 0;
4261         char *scontext;
4262         u32 scontext_len;
4263         struct sk_security_struct *sksec = sock->sk->sk_security;
4264         u32 peer_sid = SECSID_NULL;
4265
4266         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4267             sksec->sclass == SECCLASS_TCP_SOCKET)
4268                 peer_sid = sksec->peer_sid;
4269         if (peer_sid == SECSID_NULL)
4270                 return -ENOPROTOOPT;
4271
4272         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4273         if (err)
4274                 return err;
4275
4276         if (scontext_len > len) {
4277                 err = -ERANGE;
4278                 goto out_len;
4279         }
4280
4281         if (copy_to_user(optval, scontext, scontext_len))
4282                 err = -EFAULT;
4283
4284 out_len:
4285         if (put_user(scontext_len, optlen))
4286                 err = -EFAULT;
4287         kfree(scontext);
4288         return err;
4289 }
4290
4291 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4292 {
4293         u32 peer_secid = SECSID_NULL;
4294         u16 family;
4295
4296         if (skb && skb->protocol == htons(ETH_P_IP))
4297                 family = PF_INET;
4298         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4299                 family = PF_INET6;
4300         else if (sock)
4301                 family = sock->sk->sk_family;
4302         else
4303                 goto out;
4304
4305         if (sock && family == PF_UNIX)
4306                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4307         else if (skb)
4308                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4309
4310 out:
4311         *secid = peer_secid;
4312         if (peer_secid == SECSID_NULL)
4313                 return -EINVAL;
4314         return 0;
4315 }
4316
4317 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4318 {
4319         struct sk_security_struct *sksec;
4320
4321         sksec = kzalloc(sizeof(*sksec), priority);
4322         if (!sksec)
4323                 return -ENOMEM;
4324
4325         sksec->peer_sid = SECINITSID_UNLABELED;
4326         sksec->sid = SECINITSID_UNLABELED;
4327         selinux_netlbl_sk_security_reset(sksec);
4328         sk->sk_security = sksec;
4329
4330         return 0;
4331 }
4332
4333 static void selinux_sk_free_security(struct sock *sk)
4334 {
4335         struct sk_security_struct *sksec = sk->sk_security;
4336
4337         sk->sk_security = NULL;
4338         selinux_netlbl_sk_security_free(sksec);
4339         kfree(sksec);
4340 }
4341
4342 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4343 {
4344         struct sk_security_struct *sksec = sk->sk_security;
4345         struct sk_security_struct *newsksec = newsk->sk_security;
4346
4347         newsksec->sid = sksec->sid;
4348         newsksec->peer_sid = sksec->peer_sid;
4349         newsksec->sclass = sksec->sclass;
4350
4351         selinux_netlbl_sk_security_reset(newsksec);
4352 }
4353
4354 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4355 {
4356         if (!sk)
4357                 *secid = SECINITSID_ANY_SOCKET;
4358         else {
4359                 struct sk_security_struct *sksec = sk->sk_security;
4360
4361                 *secid = sksec->sid;
4362         }
4363 }
4364
4365 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4366 {
4367         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4368         struct sk_security_struct *sksec = sk->sk_security;
4369
4370         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4371             sk->sk_family == PF_UNIX)
4372                 isec->sid = sksec->sid;
4373         sksec->sclass = isec->sclass;
4374 }
4375
4376 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4377                                      struct request_sock *req)
4378 {
4379         struct sk_security_struct *sksec = sk->sk_security;
4380         int err;
4381         u16 family = sk->sk_family;
4382         u32 newsid;
4383         u32 peersid;
4384
4385         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4386         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4387                 family = PF_INET;
4388
4389         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4390         if (err)
4391                 return err;
4392         if (peersid == SECSID_NULL) {
4393                 req->secid = sksec->sid;
4394                 req->peer_secid = SECSID_NULL;
4395         } else {
4396                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4397                 if (err)
4398                         return err;
4399                 req->secid = newsid;
4400                 req->peer_secid = peersid;
4401         }
4402
4403         return selinux_netlbl_inet_conn_request(req, family);
4404 }
4405
4406 static void selinux_inet_csk_clone(struct sock *newsk,
4407                                    const struct request_sock *req)
4408 {
4409         struct sk_security_struct *newsksec = newsk->sk_security;
4410
4411         newsksec->sid = req->secid;
4412         newsksec->peer_sid = req->peer_secid;
4413         /* NOTE: Ideally, we should also get the isec->sid for the
4414            new socket in sync, but we don't have the isec available yet.
4415            So we will wait until sock_graft to do it, by which
4416            time it will have been created and available. */
4417
4418         /* We don't need to take any sort of lock here as we are the only
4419          * thread with access to newsksec */
4420         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4421 }
4422
4423 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4424 {
4425         u16 family = sk->sk_family;
4426         struct sk_security_struct *sksec = sk->sk_security;
4427
4428         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4429         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4430                 family = PF_INET;
4431
4432         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4433 }
4434
4435 static int selinux_secmark_relabel_packet(u32 sid)
4436 {
4437         const struct task_security_struct *__tsec;
4438         u32 tsid;
4439
4440         __tsec = current_security();
4441         tsid = __tsec->sid;
4442
4443         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4444 }
4445
4446 static void selinux_secmark_refcount_inc(void)
4447 {
4448         atomic_inc(&selinux_secmark_refcount);
4449 }
4450
4451 static void selinux_secmark_refcount_dec(void)
4452 {
4453         atomic_dec(&selinux_secmark_refcount);
4454 }
4455
4456 static void selinux_req_classify_flow(const struct request_sock *req,
4457                                       struct flowi *fl)
4458 {
4459         fl->flowi_secid = req->secid;
4460 }
4461
4462 static int selinux_tun_dev_create(void)
4463 {
4464         u32 sid = current_sid();
4465
4466         /* we aren't taking into account the "sockcreate" SID since the socket
4467          * that is being created here is not a socket in the traditional sense,
4468          * instead it is a private sock, accessible only to the kernel, and
4469          * representing a wide range of network traffic spanning multiple
4470          * connections unlike traditional sockets - check the TUN driver to
4471          * get a better understanding of why this socket is special */
4472
4473         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4474                             NULL);
4475 }
4476
4477 static void selinux_tun_dev_post_create(struct sock *sk)
4478 {
4479         struct sk_security_struct *sksec = sk->sk_security;
4480
4481         /* we don't currently perform any NetLabel based labeling here and it
4482          * isn't clear that we would want to do so anyway; while we could apply
4483          * labeling without the support of the TUN user the resulting labeled
4484          * traffic from the other end of the connection would almost certainly
4485          * cause confusion to the TUN user that had no idea network labeling
4486          * protocols were being used */
4487
4488         /* see the comments in selinux_tun_dev_create() about why we don't use
4489          * the sockcreate SID here */
4490
4491         sksec->sid = current_sid();
4492         sksec->sclass = SECCLASS_TUN_SOCKET;
4493 }
4494
4495 static int selinux_tun_dev_attach(struct sock *sk)
4496 {
4497         struct sk_security_struct *sksec = sk->sk_security;
4498         u32 sid = current_sid();
4499         int err;
4500
4501         err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4502                            TUN_SOCKET__RELABELFROM, NULL);
4503         if (err)
4504                 return err;
4505         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4506                            TUN_SOCKET__RELABELTO, NULL);
4507         if (err)
4508                 return err;
4509
4510         sksec->sid = sid;
4511
4512         return 0;
4513 }
4514
4515 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4516 {
4517         int err = 0;
4518         u32 perm;
4519         struct nlmsghdr *nlh;
4520         struct sk_security_struct *sksec = sk->sk_security;
4521
4522         if (skb->len < NLMSG_SPACE(0)) {
4523                 err = -EINVAL;
4524                 goto out;
4525         }
4526         nlh = nlmsg_hdr(skb);
4527
4528         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4529         if (err) {
4530                 if (err == -EINVAL) {
4531                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4532                                   "SELinux:  unrecognized netlink message"
4533                                   " type=%hu for sclass=%hu\n",
4534                                   nlh->nlmsg_type, sksec->sclass);
4535                         if (!selinux_enforcing || security_get_allow_unknown())
4536                                 err = 0;
4537                 }
4538
4539                 /* Ignore */
4540                 if (err == -ENOENT)
4541                         err = 0;
4542                 goto out;
4543         }
4544
4545         err = sock_has_perm(current, sk, perm);
4546 out:
4547         return err;
4548 }
4549
4550 #ifdef CONFIG_NETFILTER
4551
4552 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4553                                        u16 family)
4554 {
4555         int err;
4556         char *addrp;
4557         u32 peer_sid;
4558         struct common_audit_data ad;
4559         struct selinux_audit_data sad = {0,};
4560         struct lsm_network_audit net = {0,};
4561         u8 secmark_active;
4562         u8 netlbl_active;
4563         u8 peerlbl_active;
4564
4565         if (!selinux_policycap_netpeer)
4566                 return NF_ACCEPT;
4567
4568         secmark_active = selinux_secmark_enabled();
4569         netlbl_active = netlbl_enabled();
4570         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4571         if (!secmark_active && !peerlbl_active)
4572                 return NF_ACCEPT;
4573
4574         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4575                 return NF_DROP;
4576
4577         COMMON_AUDIT_DATA_INIT(&ad, NET);
4578         ad.selinux_audit_data = &sad;
4579         ad.u.net = &net;
4580         ad.u.net->netif = ifindex;
4581         ad.u.net->family = family;
4582         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4583                 return NF_DROP;
4584
4585         if (peerlbl_active) {
4586                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4587                                                peer_sid, &ad);
4588                 if (err) {
4589                         selinux_netlbl_err(skb, err, 1);
4590                         return NF_DROP;
4591                 }
4592         }
4593
4594         if (secmark_active)
4595                 if (avc_has_perm(peer_sid, skb->secmark,
4596                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4597                         return NF_DROP;
4598
4599         if (netlbl_active)
4600                 /* we do this in the FORWARD path and not the POST_ROUTING
4601                  * path because we want to make sure we apply the necessary
4602                  * labeling before IPsec is applied so we can leverage AH
4603                  * protection */
4604                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4605                         return NF_DROP;
4606
4607         return NF_ACCEPT;
4608 }
4609
4610 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4611                                          struct sk_buff *skb,
4612                                          const struct net_device *in,
4613                                          const struct net_device *out,
4614                                          int (*okfn)(struct sk_buff *))
4615 {
4616         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4617 }
4618
4619 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4620 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4621                                          struct sk_buff *skb,
4622                                          const struct net_device *in,
4623                                          const struct net_device *out,
4624                                          int (*okfn)(struct sk_buff *))
4625 {
4626         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4627 }
4628 #endif  /* IPV6 */
4629
4630 static unsigned int selinux_ip_output(struct sk_buff *skb,
4631                                       u16 family)
4632 {
4633         u32 sid;
4634
4635         if (!netlbl_enabled())
4636                 return NF_ACCEPT;
4637
4638         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4639          * because we want to make sure we apply the necessary labeling
4640          * before IPsec is applied so we can leverage AH protection */
4641         if (skb->sk) {
4642                 struct sk_security_struct *sksec = skb->sk->sk_security;
4643                 sid = sksec->sid;
4644         } else
4645                 sid = SECINITSID_KERNEL;
4646         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4647                 return NF_DROP;
4648
4649         return NF_ACCEPT;
4650 }
4651
4652 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4653                                         struct sk_buff *skb,
4654                                         const struct net_device *in,
4655                                         const struct net_device *out,
4656                                         int (*okfn)(struct sk_buff *))
4657 {
4658         return selinux_ip_output(skb, PF_INET);
4659 }
4660
4661 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4662                                                 int ifindex,
4663                                                 u16 family)
4664 {
4665         struct sock *sk = skb->sk;
4666         struct sk_security_struct *sksec;
4667         struct common_audit_data ad;
4668         struct selinux_audit_data sad = {0,};
4669         struct lsm_network_audit net = {0,};
4670         char *addrp;
4671         u8 proto;
4672
4673         if (sk == NULL)
4674                 return NF_ACCEPT;
4675         sksec = sk->sk_security;
4676
4677         COMMON_AUDIT_DATA_INIT(&ad, NET);
4678         ad.selinux_audit_data = &sad;
4679         ad.u.net = &net;
4680         ad.u.net->netif = ifindex;
4681         ad.u.net->family = family;
4682         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4683                 return NF_DROP;
4684
4685         if (selinux_secmark_enabled())
4686                 if (avc_has_perm(sksec->sid, skb->secmark,
4687                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4688                         return NF_DROP_ERR(-ECONNREFUSED);
4689
4690         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4691                 return NF_DROP_ERR(-ECONNREFUSED);
4692
4693         return NF_ACCEPT;
4694 }
4695
4696 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4697                                          u16 family)
4698 {
4699         u32 secmark_perm;
4700         u32 peer_sid;
4701         struct sock *sk;
4702         struct common_audit_data ad;
4703         struct selinux_audit_data sad = {0,};
4704         struct lsm_network_audit net = {0,};
4705         char *addrp;
4706         u8 secmark_active;
4707         u8 peerlbl_active;
4708
4709         /* If any sort of compatibility mode is enabled then handoff processing
4710          * to the selinux_ip_postroute_compat() function to deal with the
4711          * special handling.  We do this in an attempt to keep this function
4712          * as fast and as clean as possible. */
4713         if (!selinux_policycap_netpeer)
4714                 return selinux_ip_postroute_compat(skb, ifindex, family);
4715 #ifdef CONFIG_XFRM
4716         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4717          * packet transformation so allow the packet to pass without any checks
4718          * since we'll have another chance to perform access control checks
4719          * when the packet is on it's final way out.
4720          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4721          *       is NULL, in this case go ahead and apply access control. */
4722         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4723                 return NF_ACCEPT;
4724 #endif
4725         secmark_active = selinux_secmark_enabled();
4726         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4727         if (!secmark_active && !peerlbl_active)
4728                 return NF_ACCEPT;
4729
4730         /* if the packet is being forwarded then get the peer label from the
4731          * packet itself; otherwise check to see if it is from a local
4732          * application or the kernel, if from an application get the peer label
4733          * from the sending socket, otherwise use the kernel's sid */
4734         sk = skb->sk;
4735         if (sk == NULL) {
4736                 if (skb->skb_iif) {
4737                         secmark_perm = PACKET__FORWARD_OUT;
4738                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4739                                 return NF_DROP;
4740                 } else {
4741                         secmark_perm = PACKET__SEND;
4742                         peer_sid = SECINITSID_KERNEL;
4743                 }
4744         } else {
4745                 struct sk_security_struct *sksec = sk->sk_security;
4746                 peer_sid = sksec->sid;
4747                 secmark_perm = PACKET__SEND;
4748         }
4749
4750         COMMON_AUDIT_DATA_INIT(&ad, NET);
4751         ad.selinux_audit_data = &sad;
4752         ad.u.net = &net;
4753         ad.u.net->netif = ifindex;
4754         ad.u.net->family = family;
4755         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4756                 return NF_DROP;
4757
4758         if (secmark_active)
4759                 if (avc_has_perm(peer_sid, skb->secmark,
4760                                  SECCLASS_PACKET, secmark_perm, &ad))
4761                         return NF_DROP_ERR(-ECONNREFUSED);
4762
4763         if (peerlbl_active) {
4764                 u32 if_sid;
4765                 u32 node_sid;
4766
4767                 if (sel_netif_sid(ifindex, &if_sid))
4768                         return NF_DROP;
4769                 if (avc_has_perm(peer_sid, if_sid,
4770                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4771                         return NF_DROP_ERR(-ECONNREFUSED);
4772
4773                 if (sel_netnode_sid(addrp, family, &node_sid))
4774                         return NF_DROP;
4775                 if (avc_has_perm(peer_sid, node_sid,
4776                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4777                         return NF_DROP_ERR(-ECONNREFUSED);
4778         }
4779
4780         return NF_ACCEPT;
4781 }
4782
4783 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4784                                            struct sk_buff *skb,
4785                                            const struct net_device *in,
4786                                            const struct net_device *out,
4787                                            int (*okfn)(struct sk_buff *))
4788 {
4789         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4790 }
4791
4792 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4793 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4794                                            struct sk_buff *skb,
4795                                            const struct net_device *in,
4796                                            const struct net_device *out,
4797                                            int (*okfn)(struct sk_buff *))
4798 {
4799         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4800 }
4801 #endif  /* IPV6 */
4802
4803 #endif  /* CONFIG_NETFILTER */
4804
4805 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4806 {
4807         int err;
4808
4809         err = cap_netlink_send(sk, skb);
4810         if (err)
4811                 return err;
4812
4813         return selinux_nlmsg_perm(sk, skb);
4814 }
4815
4816 static int ipc_alloc_security(struct task_struct *task,
4817                               struct kern_ipc_perm *perm,
4818                               u16 sclass)
4819 {
4820         struct ipc_security_struct *isec;
4821         u32 sid;
4822
4823         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4824         if (!isec)
4825                 return -ENOMEM;
4826
4827         sid = task_sid(task);
4828         isec->sclass = sclass;
4829         isec->sid = sid;
4830         perm->security = isec;
4831
4832         return 0;
4833 }
4834
4835 static void ipc_free_security(struct kern_ipc_perm *perm)
4836 {
4837         struct ipc_security_struct *isec = perm->security;
4838         perm->security = NULL;
4839         kfree(isec);
4840 }
4841
4842 static int msg_msg_alloc_security(struct msg_msg *msg)
4843 {
4844         struct msg_security_struct *msec;
4845
4846         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4847         if (!msec)
4848                 return -ENOMEM;
4849
4850         msec->sid = SECINITSID_UNLABELED;
4851         msg->security = msec;
4852
4853         return 0;
4854 }
4855
4856 static void msg_msg_free_security(struct msg_msg *msg)
4857 {
4858         struct msg_security_struct *msec = msg->security;
4859
4860         msg->security = NULL;
4861         kfree(msec);
4862 }
4863
4864 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4865                         u32 perms)
4866 {
4867         struct ipc_security_struct *isec;
4868         struct common_audit_data ad;
4869         struct selinux_audit_data sad = {0,};
4870         u32 sid = current_sid();
4871
4872         isec = ipc_perms->security;
4873
4874         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4875         ad.selinux_audit_data = &sad;
4876         ad.u.ipc_id = ipc_perms->key;
4877
4878         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4879 }
4880
4881 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4882 {
4883         return msg_msg_alloc_security(msg);
4884 }
4885
4886 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4887 {
4888         msg_msg_free_security(msg);
4889 }
4890
4891 /* message queue security operations */
4892 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4893 {
4894         struct ipc_security_struct *isec;
4895         struct common_audit_data ad;
4896         struct selinux_audit_data sad = {0,};
4897         u32 sid = current_sid();
4898         int rc;
4899
4900         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4901         if (rc)
4902                 return rc;
4903
4904         isec = msq->q_perm.security;
4905
4906         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4907         ad.selinux_audit_data = &sad;
4908         ad.u.ipc_id = msq->q_perm.key;
4909
4910         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4911                           MSGQ__CREATE, &ad);
4912         if (rc) {
4913                 ipc_free_security(&msq->q_perm);
4914                 return rc;
4915         }
4916         return 0;
4917 }
4918
4919 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4920 {
4921         ipc_free_security(&msq->q_perm);
4922 }
4923
4924 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4925 {
4926         struct ipc_security_struct *isec;
4927         struct common_audit_data ad;
4928         struct selinux_audit_data sad = {0,};
4929         u32 sid = current_sid();
4930
4931         isec = msq->q_perm.security;
4932
4933         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4934         ad.selinux_audit_data = &sad;
4935         ad.u.ipc_id = msq->q_perm.key;
4936
4937         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4938                             MSGQ__ASSOCIATE, &ad);
4939 }
4940
4941 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4942 {
4943         int err;
4944         int perms;
4945
4946         switch (cmd) {
4947         case IPC_INFO:
4948         case MSG_INFO:
4949                 /* No specific object, just general system-wide information. */
4950                 return task_has_system(current, SYSTEM__IPC_INFO);
4951         case IPC_STAT:
4952         case MSG_STAT:
4953                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4954                 break;
4955         case IPC_SET:
4956                 perms = MSGQ__SETATTR;
4957                 break;
4958         case IPC_RMID:
4959                 perms = MSGQ__DESTROY;
4960                 break;
4961         default:
4962                 return 0;
4963         }
4964
4965         err = ipc_has_perm(&msq->q_perm, perms);
4966         return err;
4967 }
4968
4969 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4970 {
4971         struct ipc_security_struct *isec;
4972         struct msg_security_struct *msec;
4973         struct common_audit_data ad;
4974         struct selinux_audit_data sad = {0,};
4975         u32 sid = current_sid();
4976         int rc;
4977
4978         isec = msq->q_perm.security;
4979         msec = msg->security;
4980
4981         /*
4982          * First time through, need to assign label to the message
4983          */
4984         if (msec->sid == SECINITSID_UNLABELED) {
4985                 /*
4986                  * Compute new sid based on current process and
4987                  * message queue this message will be stored in
4988                  */
4989                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4990                                              NULL, &msec->sid);
4991                 if (rc)
4992                         return rc;
4993         }
4994
4995         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4996         ad.selinux_audit_data = &sad;
4997         ad.u.ipc_id = msq->q_perm.key;
4998
4999         /* Can this process write to the queue? */
5000         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5001                           MSGQ__WRITE, &ad);
5002         if (!rc)
5003                 /* Can this process send the message */
5004                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5005                                   MSG__SEND, &ad);
5006         if (!rc)
5007                 /* Can the message be put in the queue? */
5008                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5009                                   MSGQ__ENQUEUE, &ad);
5010
5011         return rc;
5012 }
5013
5014 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5015                                     struct task_struct *target,
5016                                     long type, int mode)
5017 {
5018         struct ipc_security_struct *isec;
5019         struct msg_security_struct *msec;
5020         struct common_audit_data ad;
5021         struct selinux_audit_data sad = {0,};
5022         u32 sid = task_sid(target);
5023         int rc;
5024
5025         isec = msq->q_perm.security;
5026         msec = msg->security;
5027
5028         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5029         ad.selinux_audit_data = &sad;
5030         ad.u.ipc_id = msq->q_perm.key;
5031
5032         rc = avc_has_perm(sid, isec->sid,
5033                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5034         if (!rc)
5035                 rc = avc_has_perm(sid, msec->sid,
5036                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5037         return rc;
5038 }
5039
5040 /* Shared Memory security operations */
5041 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5042 {
5043         struct ipc_security_struct *isec;
5044         struct common_audit_data ad;
5045         struct selinux_audit_data sad = {0,};
5046         u32 sid = current_sid();
5047         int rc;
5048
5049         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5050         if (rc)
5051                 return rc;
5052
5053         isec = shp->shm_perm.security;
5054
5055         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5056         ad.selinux_audit_data = &sad;
5057         ad.u.ipc_id = shp->shm_perm.key;
5058
5059         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5060                           SHM__CREATE, &ad);
5061         if (rc) {
5062                 ipc_free_security(&shp->shm_perm);
5063                 return rc;
5064         }
5065         return 0;
5066 }
5067
5068 static void selinux_shm_free_security(struct shmid_kernel *shp)
5069 {
5070         ipc_free_security(&shp->shm_perm);
5071 }
5072
5073 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5074 {
5075         struct ipc_security_struct *isec;
5076         struct common_audit_data ad;
5077         struct selinux_audit_data sad = {0,};
5078         u32 sid = current_sid();
5079
5080         isec = shp->shm_perm.security;
5081
5082         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5083         ad.selinux_audit_data = &sad;
5084         ad.u.ipc_id = shp->shm_perm.key;
5085
5086         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5087                             SHM__ASSOCIATE, &ad);
5088 }
5089
5090 /* Note, at this point, shp is locked down */
5091 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5092 {
5093         int perms;
5094         int err;
5095
5096         switch (cmd) {
5097         case IPC_INFO:
5098         case SHM_INFO:
5099                 /* No specific object, just general system-wide information. */
5100                 return task_has_system(current, SYSTEM__IPC_INFO);
5101         case IPC_STAT:
5102         case SHM_STAT:
5103                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5104                 break;
5105         case IPC_SET:
5106                 perms = SHM__SETATTR;
5107                 break;
5108         case SHM_LOCK:
5109         case SHM_UNLOCK:
5110                 perms = SHM__LOCK;
5111                 break;
5112         case IPC_RMID:
5113                 perms = SHM__DESTROY;
5114                 break;
5115         default:
5116                 return 0;
5117         }
5118
5119         err = ipc_has_perm(&shp->shm_perm, perms);
5120         return err;
5121 }
5122
5123 static int selinux_shm_shmat(struct shmid_kernel *shp,
5124                              char __user *shmaddr, int shmflg)
5125 {
5126         u32 perms;
5127
5128         if (shmflg & SHM_RDONLY)
5129                 perms = SHM__READ;
5130         else
5131                 perms = SHM__READ | SHM__WRITE;
5132
5133         return ipc_has_perm(&shp->shm_perm, perms);
5134 }
5135
5136 /* Semaphore security operations */
5137 static int selinux_sem_alloc_security(struct sem_array *sma)
5138 {
5139         struct ipc_security_struct *isec;
5140         struct common_audit_data ad;
5141         struct selinux_audit_data sad = {0,};
5142         u32 sid = current_sid();
5143         int rc;
5144
5145         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5146         if (rc)
5147                 return rc;
5148
5149         isec = sma->sem_perm.security;
5150
5151         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5152         ad.selinux_audit_data = &sad;
5153         ad.u.ipc_id = sma->sem_perm.key;
5154
5155         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5156                           SEM__CREATE, &ad);
5157         if (rc) {
5158                 ipc_free_security(&sma->sem_perm);
5159                 return rc;
5160         }
5161         return 0;
5162 }
5163
5164 static void selinux_sem_free_security(struct sem_array *sma)
5165 {
5166         ipc_free_security(&sma->sem_perm);
5167 }
5168
5169 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5170 {
5171         struct ipc_security_struct *isec;
5172         struct common_audit_data ad;
5173         struct selinux_audit_data sad = {0,};
5174         u32 sid = current_sid();
5175
5176         isec = sma->sem_perm.security;
5177
5178         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5179         ad.selinux_audit_data = &sad;
5180         ad.u.ipc_id = sma->sem_perm.key;
5181
5182         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5183                             SEM__ASSOCIATE, &ad);
5184 }
5185
5186 /* Note, at this point, sma is locked down */
5187 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5188 {
5189         int err;
5190         u32 perms;
5191
5192         switch (cmd) {
5193         case IPC_INFO:
5194         case SEM_INFO:
5195                 /* No specific object, just general system-wide information. */
5196                 return task_has_system(current, SYSTEM__IPC_INFO);
5197         case GETPID:
5198         case GETNCNT:
5199         case GETZCNT:
5200                 perms = SEM__GETATTR;
5201                 break;
5202         case GETVAL:
5203         case GETALL:
5204                 perms = SEM__READ;
5205                 break;
5206         case SETVAL:
5207         case SETALL:
5208                 perms = SEM__WRITE;
5209                 break;
5210         case IPC_RMID:
5211                 perms = SEM__DESTROY;
5212                 break;
5213         case IPC_SET:
5214                 perms = SEM__SETATTR;
5215                 break;
5216         case IPC_STAT:
5217         case SEM_STAT:
5218                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5219                 break;
5220         default:
5221                 return 0;
5222         }
5223
5224         err = ipc_has_perm(&sma->sem_perm, perms);
5225         return err;
5226 }
5227
5228 static int selinux_sem_semop(struct sem_array *sma,
5229                              struct sembuf *sops, unsigned nsops, int alter)
5230 {
5231         u32 perms;
5232
5233         if (alter)
5234                 perms = SEM__READ | SEM__WRITE;
5235         else
5236                 perms = SEM__READ;
5237
5238         return ipc_has_perm(&sma->sem_perm, perms);
5239 }
5240
5241 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5242 {
5243         u32 av = 0;
5244
5245         av = 0;
5246         if (flag & S_IRUGO)
5247                 av |= IPC__UNIX_READ;
5248         if (flag & S_IWUGO)
5249                 av |= IPC__UNIX_WRITE;
5250
5251         if (av == 0)
5252                 return 0;
5253
5254         return ipc_has_perm(ipcp, av);
5255 }
5256
5257 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5258 {
5259         struct ipc_security_struct *isec = ipcp->security;
5260         *secid = isec->sid;
5261 }
5262
5263 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5264 {
5265         if (inode)
5266                 inode_doinit_with_dentry(inode, dentry);
5267 }
5268
5269 static int selinux_getprocattr(struct task_struct *p,
5270                                char *name, char **value)
5271 {
5272         const struct task_security_struct *__tsec;
5273         u32 sid;
5274         int error;
5275         unsigned len;
5276
5277         if (current != p) {
5278                 error = current_has_perm(p, PROCESS__GETATTR);
5279                 if (error)
5280                         return error;
5281         }
5282
5283         rcu_read_lock();
5284         __tsec = __task_cred(p)->security;
5285
5286         if (!strcmp(name, "current"))
5287                 sid = __tsec->sid;
5288         else if (!strcmp(name, "prev"))
5289                 sid = __tsec->osid;
5290         else if (!strcmp(name, "exec"))
5291                 sid = __tsec->exec_sid;
5292         else if (!strcmp(name, "fscreate"))
5293                 sid = __tsec->create_sid;
5294         else if (!strcmp(name, "keycreate"))
5295                 sid = __tsec->keycreate_sid;
5296         else if (!strcmp(name, "sockcreate"))
5297                 sid = __tsec->sockcreate_sid;
5298         else
5299                 goto invalid;
5300         rcu_read_unlock();
5301
5302         if (!sid)
5303                 return 0;
5304
5305         error = security_sid_to_context(sid, value, &len);
5306         if (error)
5307                 return error;
5308         return len;
5309
5310 invalid:
5311         rcu_read_unlock();
5312         return -EINVAL;
5313 }
5314
5315 static int selinux_setprocattr(struct task_struct *p,
5316                                char *name, void *value, size_t size)
5317 {
5318         struct task_security_struct *tsec;
5319         struct task_struct *tracer;
5320         struct cred *new;
5321         u32 sid = 0, ptsid;
5322         int error;
5323         char *str = value;
5324
5325         if (current != p) {
5326                 /* SELinux only allows a process to change its own
5327                    security attributes. */
5328                 return -EACCES;
5329         }
5330
5331         /*
5332          * Basic control over ability to set these attributes at all.
5333          * current == p, but we'll pass them separately in case the
5334          * above restriction is ever removed.
5335          */
5336         if (!strcmp(name, "exec"))
5337                 error = current_has_perm(p, PROCESS__SETEXEC);
5338         else if (!strcmp(name, "fscreate"))
5339                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5340         else if (!strcmp(name, "keycreate"))
5341                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5342         else if (!strcmp(name, "sockcreate"))
5343                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5344         else if (!strcmp(name, "current"))
5345                 error = current_has_perm(p, PROCESS__SETCURRENT);
5346         else
5347                 error = -EINVAL;
5348         if (error)
5349                 return error;
5350
5351         /* Obtain a SID for the context, if one was specified. */
5352         if (size && str[1] && str[1] != '\n') {
5353                 if (str[size-1] == '\n') {
5354                         str[size-1] = 0;
5355                         size--;
5356                 }
5357                 error = security_context_to_sid(value, size, &sid);
5358                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5359                         if (!capable(CAP_MAC_ADMIN)) {
5360                                 struct audit_buffer *ab;
5361                                 size_t audit_size;
5362
5363                                 /* We strip a nul only if it is at the end, otherwise the
5364                                  * context contains a nul and we should audit that */
5365                                 if (str[size - 1] == '\0')
5366                                         audit_size = size - 1;
5367                                 else
5368                                         audit_size = size;
5369                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5370                                 audit_log_format(ab, "op=fscreate invalid_context=");
5371                                 audit_log_n_untrustedstring(ab, value, audit_size);
5372                                 audit_log_end(ab);
5373
5374                                 return error;
5375                         }
5376                         error = security_context_to_sid_force(value, size,
5377                                                               &sid);
5378                 }
5379                 if (error)
5380                         return error;
5381         }
5382
5383         new = prepare_creds();
5384         if (!new)
5385                 return -ENOMEM;
5386
5387         /* Permission checking based on the specified context is
5388            performed during the actual operation (execve,
5389            open/mkdir/...), when we know the full context of the
5390            operation.  See selinux_bprm_set_creds for the execve
5391            checks and may_create for the file creation checks. The
5392            operation will then fail if the context is not permitted. */
5393         tsec = new->security;
5394         if (!strcmp(name, "exec")) {
5395                 tsec->exec_sid = sid;
5396         } else if (!strcmp(name, "fscreate")) {
5397                 tsec->create_sid = sid;
5398         } else if (!strcmp(name, "keycreate")) {
5399                 error = may_create_key(sid, p);
5400                 if (error)
5401                         goto abort_change;
5402                 tsec->keycreate_sid = sid;
5403         } else if (!strcmp(name, "sockcreate")) {
5404                 tsec->sockcreate_sid = sid;
5405         } else if (!strcmp(name, "current")) {
5406                 error = -EINVAL;
5407                 if (sid == 0)
5408                         goto abort_change;
5409
5410                 /* Only allow single threaded processes to change context */
5411                 error = -EPERM;
5412                 if (!current_is_single_threaded()) {
5413                         error = security_bounded_transition(tsec->sid, sid);
5414                         if (error)
5415                                 goto abort_change;
5416                 }
5417
5418                 /* Check permissions for the transition. */
5419                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5420                                      PROCESS__DYNTRANSITION, NULL);
5421                 if (error)
5422                         goto abort_change;
5423
5424                 /* Check for ptracing, and update the task SID if ok.
5425                    Otherwise, leave SID unchanged and fail. */
5426                 ptsid = 0;
5427                 task_lock(p);
5428                 tracer = ptrace_parent(p);
5429                 if (tracer)
5430                         ptsid = task_sid(tracer);
5431                 task_unlock(p);
5432
5433                 if (tracer) {
5434                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5435                                              PROCESS__PTRACE, NULL);
5436                         if (error)
5437                                 goto abort_change;
5438                 }
5439
5440                 tsec->sid = sid;
5441         } else {
5442                 error = -EINVAL;
5443                 goto abort_change;
5444         }
5445
5446         commit_creds(new);
5447         return size;
5448
5449 abort_change:
5450         abort_creds(new);
5451         return error;
5452 }
5453
5454 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5455 {
5456         return security_sid_to_context(secid, secdata, seclen);
5457 }
5458
5459 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5460 {
5461         return security_context_to_sid(secdata, seclen, secid);
5462 }
5463
5464 static void selinux_release_secctx(char *secdata, u32 seclen)
5465 {
5466         kfree(secdata);
5467 }
5468
5469 /*
5470  *      called with inode->i_mutex locked
5471  */
5472 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5473 {
5474         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5475 }
5476
5477 /*
5478  *      called with inode->i_mutex locked
5479  */
5480 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5481 {
5482         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5483 }
5484
5485 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5486 {
5487         int len = 0;
5488         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5489                                                 ctx, true);
5490         if (len < 0)
5491                 return len;
5492         *ctxlen = len;
5493         return 0;
5494 }
5495 #ifdef CONFIG_KEYS
5496
5497 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5498                              unsigned long flags)
5499 {
5500         const struct task_security_struct *tsec;
5501         struct key_security_struct *ksec;
5502
5503         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5504         if (!ksec)
5505                 return -ENOMEM;
5506
5507         tsec = cred->security;
5508         if (tsec->keycreate_sid)
5509                 ksec->sid = tsec->keycreate_sid;
5510         else
5511                 ksec->sid = tsec->sid;
5512
5513         k->security = ksec;
5514         return 0;
5515 }
5516
5517 static void selinux_key_free(struct key *k)
5518 {
5519         struct key_security_struct *ksec = k->security;
5520
5521         k->security = NULL;
5522         kfree(ksec);
5523 }
5524
5525 static int selinux_key_permission(key_ref_t key_ref,
5526                                   const struct cred *cred,
5527                                   key_perm_t perm)
5528 {
5529         struct key *key;
5530         struct key_security_struct *ksec;
5531         u32 sid;
5532
5533         /* if no specific permissions are requested, we skip the
5534            permission check. No serious, additional covert channels
5535            appear to be created. */
5536         if (perm == 0)
5537                 return 0;
5538
5539         sid = cred_sid(cred);
5540
5541         key = key_ref_to_ptr(key_ref);
5542         ksec = key->security;
5543
5544         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5545 }
5546
5547 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5548 {
5549         struct key_security_struct *ksec = key->security;
5550         char *context = NULL;
5551         unsigned len;
5552         int rc;
5553
5554         rc = security_sid_to_context(ksec->sid, &context, &len);
5555         if (!rc)
5556                 rc = len;
5557         *_buffer = context;
5558         return rc;
5559 }
5560
5561 #endif
5562
5563 static struct security_operations selinux_ops = {
5564         .name =                         "selinux",
5565
5566         .ptrace_access_check =          selinux_ptrace_access_check,
5567         .ptrace_traceme =               selinux_ptrace_traceme,
5568         .capget =                       selinux_capget,
5569         .capset =                       selinux_capset,
5570         .capable =                      selinux_capable,
5571         .quotactl =                     selinux_quotactl,
5572         .quota_on =                     selinux_quota_on,
5573         .syslog =                       selinux_syslog,
5574         .vm_enough_memory =             selinux_vm_enough_memory,
5575
5576         .netlink_send =                 selinux_netlink_send,
5577
5578         .bprm_set_creds =               selinux_bprm_set_creds,
5579         .bprm_committing_creds =        selinux_bprm_committing_creds,
5580         .bprm_committed_creds =         selinux_bprm_committed_creds,
5581         .bprm_secureexec =              selinux_bprm_secureexec,
5582
5583         .sb_alloc_security =            selinux_sb_alloc_security,
5584         .sb_free_security =             selinux_sb_free_security,
5585         .sb_copy_data =                 selinux_sb_copy_data,
5586         .sb_remount =                   selinux_sb_remount,
5587         .sb_kern_mount =                selinux_sb_kern_mount,
5588         .sb_show_options =              selinux_sb_show_options,
5589         .sb_statfs =                    selinux_sb_statfs,
5590         .sb_mount =                     selinux_mount,
5591         .sb_umount =                    selinux_umount,
5592         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5593         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5594         .sb_parse_opts_str =            selinux_parse_opts_str,
5595
5596
5597         .inode_alloc_security =         selinux_inode_alloc_security,
5598         .inode_free_security =          selinux_inode_free_security,
5599         .inode_init_security =          selinux_inode_init_security,
5600         .inode_create =                 selinux_inode_create,
5601         .inode_link =                   selinux_inode_link,
5602         .inode_unlink =                 selinux_inode_unlink,
5603         .inode_symlink =                selinux_inode_symlink,
5604         .inode_mkdir =                  selinux_inode_mkdir,
5605         .inode_rmdir =                  selinux_inode_rmdir,
5606         .inode_mknod =                  selinux_inode_mknod,
5607         .inode_rename =                 selinux_inode_rename,
5608         .inode_readlink =               selinux_inode_readlink,
5609         .inode_follow_link =            selinux_inode_follow_link,
5610         .inode_permission =             selinux_inode_permission,
5611         .inode_setattr =                selinux_inode_setattr,
5612         .inode_getattr =                selinux_inode_getattr,
5613         .inode_setxattr =               selinux_inode_setxattr,
5614         .inode_post_setxattr =          selinux_inode_post_setxattr,
5615         .inode_getxattr =               selinux_inode_getxattr,
5616         .inode_listxattr =              selinux_inode_listxattr,
5617         .inode_removexattr =            selinux_inode_removexattr,
5618         .inode_getsecurity =            selinux_inode_getsecurity,
5619         .inode_setsecurity =            selinux_inode_setsecurity,
5620         .inode_listsecurity =           selinux_inode_listsecurity,
5621         .inode_getsecid =               selinux_inode_getsecid,
5622
5623         .file_permission =              selinux_file_permission,
5624         .file_alloc_security =          selinux_file_alloc_security,
5625         .file_free_security =           selinux_file_free_security,
5626         .file_ioctl =                   selinux_file_ioctl,
5627         .file_mmap =                    selinux_file_mmap,
5628         .file_mprotect =                selinux_file_mprotect,
5629         .file_lock =                    selinux_file_lock,
5630         .file_fcntl =                   selinux_file_fcntl,
5631         .file_set_fowner =              selinux_file_set_fowner,
5632         .file_send_sigiotask =          selinux_file_send_sigiotask,
5633         .file_receive =                 selinux_file_receive,
5634
5635         .file_open =                    selinux_file_open,
5636
5637         .task_create =                  selinux_task_create,
5638         .cred_alloc_blank =             selinux_cred_alloc_blank,
5639         .cred_free =                    selinux_cred_free,
5640         .cred_prepare =                 selinux_cred_prepare,
5641         .cred_transfer =                selinux_cred_transfer,
5642         .kernel_act_as =                selinux_kernel_act_as,
5643         .kernel_create_files_as =       selinux_kernel_create_files_as,
5644         .kernel_module_request =        selinux_kernel_module_request,
5645         .task_setpgid =                 selinux_task_setpgid,
5646         .task_getpgid =                 selinux_task_getpgid,
5647         .task_getsid =                  selinux_task_getsid,
5648         .task_getsecid =                selinux_task_getsecid,
5649         .task_setnice =                 selinux_task_setnice,
5650         .task_setioprio =               selinux_task_setioprio,
5651         .task_getioprio =               selinux_task_getioprio,
5652         .task_setrlimit =               selinux_task_setrlimit,
5653         .task_setscheduler =            selinux_task_setscheduler,
5654         .task_getscheduler =            selinux_task_getscheduler,
5655         .task_movememory =              selinux_task_movememory,
5656         .task_kill =                    selinux_task_kill,
5657         .task_wait =                    selinux_task_wait,
5658         .task_to_inode =                selinux_task_to_inode,
5659
5660         .ipc_permission =               selinux_ipc_permission,
5661         .ipc_getsecid =                 selinux_ipc_getsecid,
5662
5663         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5664         .msg_msg_free_security =        selinux_msg_msg_free_security,
5665
5666         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5667         .msg_queue_free_security =      selinux_msg_queue_free_security,
5668         .msg_queue_associate =          selinux_msg_queue_associate,
5669         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5670         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5671         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5672
5673         .shm_alloc_security =           selinux_shm_alloc_security,
5674         .shm_free_security =            selinux_shm_free_security,
5675         .shm_associate =                selinux_shm_associate,
5676         .shm_shmctl =                   selinux_shm_shmctl,
5677         .shm_shmat =                    selinux_shm_shmat,
5678
5679         .sem_alloc_security =           selinux_sem_alloc_security,
5680         .sem_free_security =            selinux_sem_free_security,
5681         .sem_associate =                selinux_sem_associate,
5682         .sem_semctl =                   selinux_sem_semctl,
5683         .sem_semop =                    selinux_sem_semop,
5684
5685         .d_instantiate =                selinux_d_instantiate,
5686
5687         .getprocattr =                  selinux_getprocattr,
5688         .setprocattr =                  selinux_setprocattr,
5689
5690         .secid_to_secctx =              selinux_secid_to_secctx,
5691         .secctx_to_secid =              selinux_secctx_to_secid,
5692         .release_secctx =               selinux_release_secctx,
5693         .inode_notifysecctx =           selinux_inode_notifysecctx,
5694         .inode_setsecctx =              selinux_inode_setsecctx,
5695         .inode_getsecctx =              selinux_inode_getsecctx,
5696
5697         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5698         .unix_may_send =                selinux_socket_unix_may_send,
5699
5700         .socket_create =                selinux_socket_create,
5701         .socket_post_create =           selinux_socket_post_create,
5702         .socket_bind =                  selinux_socket_bind,
5703         .socket_connect =               selinux_socket_connect,
5704         .socket_listen =                selinux_socket_listen,
5705         .socket_accept =                selinux_socket_accept,
5706         .socket_sendmsg =               selinux_socket_sendmsg,
5707         .socket_recvmsg =               selinux_socket_recvmsg,
5708         .socket_getsockname =           selinux_socket_getsockname,
5709         .socket_getpeername =           selinux_socket_getpeername,
5710         .socket_getsockopt =            selinux_socket_getsockopt,
5711         .socket_setsockopt =            selinux_socket_setsockopt,
5712         .socket_shutdown =              selinux_socket_shutdown,
5713         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5714         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5715         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5716         .sk_alloc_security =            selinux_sk_alloc_security,
5717         .sk_free_security =             selinux_sk_free_security,
5718         .sk_clone_security =            selinux_sk_clone_security,
5719         .sk_getsecid =                  selinux_sk_getsecid,
5720         .sock_graft =                   selinux_sock_graft,
5721         .inet_conn_request =            selinux_inet_conn_request,
5722         .inet_csk_clone =               selinux_inet_csk_clone,
5723         .inet_conn_established =        selinux_inet_conn_established,
5724         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5725         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5726         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5727         .req_classify_flow =            selinux_req_classify_flow,
5728         .tun_dev_create =               selinux_tun_dev_create,
5729         .tun_dev_post_create =          selinux_tun_dev_post_create,
5730         .tun_dev_attach =               selinux_tun_dev_attach,
5731
5732 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5733         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5734         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5735         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5736         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5737         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5738         .xfrm_state_free_security =     selinux_xfrm_state_free,
5739         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5740         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5741         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5742         .xfrm_decode_session =          selinux_xfrm_decode_session,
5743 #endif
5744
5745 #ifdef CONFIG_KEYS
5746         .key_alloc =                    selinux_key_alloc,
5747         .key_free =                     selinux_key_free,
5748         .key_permission =               selinux_key_permission,
5749         .key_getsecurity =              selinux_key_getsecurity,
5750 #endif
5751
5752 #ifdef CONFIG_AUDIT
5753         .audit_rule_init =              selinux_audit_rule_init,
5754         .audit_rule_known =             selinux_audit_rule_known,
5755         .audit_rule_match =             selinux_audit_rule_match,
5756         .audit_rule_free =              selinux_audit_rule_free,
5757 #endif
5758 };
5759
5760 static __init int selinux_init(void)
5761 {
5762         if (!security_module_enable(&selinux_ops)) {
5763                 selinux_enabled = 0;
5764                 return 0;
5765         }
5766
5767         if (!selinux_enabled) {
5768                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5769                 return 0;
5770         }
5771
5772         printk(KERN_INFO "SELinux:  Initializing.\n");
5773
5774         /* Set the security state for the initial task. */
5775         cred_init_security();
5776
5777         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5778
5779         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5780                                             sizeof(struct inode_security_struct),
5781                                             0, SLAB_PANIC, NULL);
5782         avc_init();
5783
5784         if (register_security(&selinux_ops))
5785                 panic("SELinux: Unable to register with kernel.\n");
5786
5787         if (selinux_enforcing)
5788                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5789         else
5790                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5791
5792         return 0;
5793 }
5794
5795 static void delayed_superblock_init(struct super_block *sb, void *unused)
5796 {
5797         superblock_doinit(sb, NULL);
5798 }
5799
5800 void selinux_complete_init(void)
5801 {
5802         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5803
5804         /* Set up any superblocks initialized prior to the policy load. */
5805         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5806         iterate_supers(delayed_superblock_init, NULL);
5807 }
5808
5809 /* SELinux requires early initialization in order to label
5810    all processes and objects when they are created. */
5811 security_initcall(selinux_init);
5812
5813 #if defined(CONFIG_NETFILTER)
5814
5815 static struct nf_hook_ops selinux_ipv4_ops[] = {
5816         {
5817                 .hook =         selinux_ipv4_postroute,
5818                 .owner =        THIS_MODULE,
5819                 .pf =           PF_INET,
5820                 .hooknum =      NF_INET_POST_ROUTING,
5821                 .priority =     NF_IP_PRI_SELINUX_LAST,
5822         },
5823         {
5824                 .hook =         selinux_ipv4_forward,
5825                 .owner =        THIS_MODULE,
5826                 .pf =           PF_INET,
5827                 .hooknum =      NF_INET_FORWARD,
5828                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5829         },
5830         {
5831                 .hook =         selinux_ipv4_output,
5832                 .owner =        THIS_MODULE,
5833                 .pf =           PF_INET,
5834                 .hooknum =      NF_INET_LOCAL_OUT,
5835                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5836         }
5837 };
5838
5839 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5840
5841 static struct nf_hook_ops selinux_ipv6_ops[] = {
5842         {
5843                 .hook =         selinux_ipv6_postroute,
5844                 .owner =        THIS_MODULE,
5845                 .pf =           PF_INET6,
5846                 .hooknum =      NF_INET_POST_ROUTING,
5847                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5848         },
5849         {
5850                 .hook =         selinux_ipv6_forward,
5851                 .owner =        THIS_MODULE,
5852                 .pf =           PF_INET6,
5853                 .hooknum =      NF_INET_FORWARD,
5854                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5855         }
5856 };
5857
5858 #endif  /* IPV6 */
5859
5860 static int __init selinux_nf_ip_init(void)
5861 {
5862         int err = 0;
5863
5864         if (!selinux_enabled)
5865                 goto out;
5866
5867         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5868
5869         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5870         if (err)
5871                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5872
5873 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5874         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5875         if (err)
5876                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5877 #endif  /* IPV6 */
5878
5879 out:
5880         return err;
5881 }
5882
5883 __initcall(selinux_nf_ip_init);
5884
5885 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5886 static void selinux_nf_ip_exit(void)
5887 {
5888         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5889
5890         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5891 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5892         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5893 #endif  /* IPV6 */
5894 }
5895 #endif
5896
5897 #else /* CONFIG_NETFILTER */
5898
5899 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5900 #define selinux_nf_ip_exit()
5901 #endif
5902
5903 #endif /* CONFIG_NETFILTER */
5904
5905 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5906 static int selinux_disabled;
5907
5908 int selinux_disable(void)
5909 {
5910         if (ss_initialized) {
5911                 /* Not permitted after initial policy load. */
5912                 return -EINVAL;
5913         }
5914
5915         if (selinux_disabled) {
5916                 /* Only do this once. */
5917                 return -EINVAL;
5918         }
5919
5920         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5921
5922         selinux_disabled = 1;
5923         selinux_enabled = 0;
5924
5925         reset_security_ops();
5926
5927         /* Try to destroy the avc node cache */
5928         avc_disable();
5929
5930         /* Unregister netfilter hooks. */
5931         selinux_nf_ip_exit();
5932
5933         /* Unregister selinuxfs. */
5934         exit_sel_fs();
5935
5936         return 0;
5937 }
5938 #endif