Pileus Git - ~andy/linux/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 extern struct security_operations *security_ops;
  98
  99 /* SECMARK reference count */
 100 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 101
 102 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 103 int selinux_enforcing;
 104
 105 static int __init enforcing_setup(char *str)
 106 {
 107         unsigned long enforcing;
 108         if (!strict_strtoul(str, 0, &enforcing))
 109                 selinux_enforcing = enforcing ? 1 : 0;
 110         return 1;
 111 }
 112 __setup("enforcing=", enforcing_setup);
 113 #endif
 114
 115 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 116 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 117
 118 static int __init selinux_enabled_setup(char *str)
 119 {
 120         unsigned long enabled;
 121         if (!strict_strtoul(str, 0, &enabled))
 122                 selinux_enabled = enabled ? 1 : 0;
 123         return 1;
 124 }
 125 __setup("selinux=", selinux_enabled_setup);
 126 #else
 127 int selinux_enabled = 1;
 128 #endif
 129
 130 static struct kmem_cache *sel_inode_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (atomic_read(&selinux_secmark_refcount) > 0);
 145 }
 146
 147 /*
 148  * initialise the security for the init task
 149  */
 150 static void cred_init_security(void)
 151 {
 152         struct cred *cred = (struct cred *) current->real_cred;
 153         struct task_security_struct *tsec;
 154
 155         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 156         if (!tsec)
 157                 panic("SELinux:  Failed to initialize initial task.\n");
 158
 159         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 160         cred->security = tsec;
 161 }
 162
 163 /*
 164  * get the security ID of a set of credentials
 165  */
 166 static inline u32 cred_sid(const struct cred *cred)
 167 {
 168         const struct task_security_struct *tsec;
 169
 170         tsec = cred->security;
 171         return tsec->sid;
 172 }
 173
 174 /*
 175  * get the objective security ID of a task
 176  */
 177 static inline u32 task_sid(const struct task_struct *task)
 178 {
 179         u32 sid;
 180
 181         rcu_read_lock();
 182         sid = cred_sid(__task_cred(task));
 183         rcu_read_unlock();
 184         return sid;
 185 }
 186
 187 /*
 188  * get the subjective security ID of the current task
 189  */
 190 static inline u32 current_sid(void)
 191 {
 192         const struct task_security_struct *tsec = current_security();
 193
 194         return tsec->sid;
 195 }
 196
 197 /* Allocate and free functions for each kind of security blob. */
 198
 199 static int inode_alloc_security(struct inode *inode)
 200 {
 201         struct inode_security_struct *isec;
 202         u32 sid = current_sid();
 203
 204         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 205         if (!isec)
 206                 return -ENOMEM;
 207
 208         mutex_init(&isec->lock);
 209         INIT_LIST_HEAD(&isec->list);
 210         isec->inode = inode;
 211         isec->sid = SECINITSID_UNLABELED;
 212         isec->sclass = SECCLASS_FILE;
 213         isec->task_sid = sid;
 214         inode->i_security = isec;
 215
 216         return 0;
 217 }
 218
 219 static void inode_free_security(struct inode *inode)
 220 {
 221         struct inode_security_struct *isec = inode->i_security;
 222         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 223
 224         spin_lock(&sbsec->isec_lock);
 225         if (!list_empty(&isec->list))
 226                 list_del_init(&isec->list);
 227         spin_unlock(&sbsec->isec_lock);
 228
 229         inode->i_security = NULL;
 230         kmem_cache_free(sel_inode_cache, isec);
 231 }
 232
 233 static int file_alloc_security(struct file *file)
 234 {
 235         struct file_security_struct *fsec;
 236         u32 sid = current_sid();
 237
 238         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 239         if (!fsec)
 240                 return -ENOMEM;
 241
 242         fsec->sid = sid;
 243         fsec->fown_sid = sid;
 244         file->f_security = fsec;
 245
 246         return 0;
 247 }
 248
 249 static void file_free_security(struct file *file)
 250 {
 251         struct file_security_struct *fsec = file->f_security;
 252         file->f_security = NULL;
 253         kfree(fsec);
 254 }
 255
 256 static int superblock_alloc_security(struct super_block *sb)
 257 {
 258         struct superblock_security_struct *sbsec;
 259
 260         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 261         if (!sbsec)
 262                 return -ENOMEM;
 263
 264         mutex_init(&sbsec->lock);
 265         INIT_LIST_HEAD(&sbsec->isec_head);
 266         spin_lock_init(&sbsec->isec_lock);
 267         sbsec->sb = sb;
 268         sbsec->sid = SECINITSID_UNLABELED;
 269         sbsec->def_sid = SECINITSID_FILE;
 270         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 271         sb->s_security = sbsec;
 272
 273         return 0;
 274 }
 275
 276 static void superblock_free_security(struct super_block *sb)
 277 {
 278         struct superblock_security_struct *sbsec = sb->s_security;
 279         sb->s_security = NULL;
 280         kfree(sbsec);
 281 }
 282
 283 /* The file system's label must be initialized prior to use. */
 284
 285 static const char *labeling_behaviors[6] = {
 286         "uses xattr",
 287         "uses transition SIDs",
 288         "uses task SIDs",
 289         "uses genfs_contexts",
 290         "not configured for labeling",
 291         "uses mountpoint labeling",
 292 };
 293
 294 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 295
 296 static inline int inode_doinit(struct inode *inode)
 297 {
 298         return inode_doinit_with_dentry(inode, NULL);
 299 }
 300
 301 enum {
 302         Opt_error = -1,
 303         Opt_context = 1,
 304         Opt_fscontext = 2,
 305         Opt_defcontext = 3,
 306         Opt_rootcontext = 4,
 307         Opt_labelsupport = 5,
 308         Opt_nextmntopt = 6,
 309 };
 310
 311 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 312
 313 static const match_table_t tokens = {
 314         {Opt_context, CONTEXT_STR "%s"},
 315         {Opt_fscontext, FSCONTEXT_STR "%s"},
 316         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 317         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 318         {Opt_labelsupport, LABELSUPP_STR},
 319         {Opt_error, NULL},
 320 };
 321
 322 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 323
 324 static int may_context_mount_sb_relabel(u32 sid,
 325                         struct superblock_security_struct *sbsec,
 326                         const struct cred *cred)
 327 {
 328         const struct task_security_struct *tsec = cred->security;
 329         int rc;
 330
 331         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 332                           FILESYSTEM__RELABELFROM, NULL);
 333         if (rc)
 334                 return rc;
 335
 336         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 337                           FILESYSTEM__RELABELTO, NULL);
 338         return rc;
 339 }
 340
 341 static int may_context_mount_inode_relabel(u32 sid,
 342                         struct superblock_security_struct *sbsec,
 343                         const struct cred *cred)
 344 {
 345         const struct task_security_struct *tsec = cred->security;
 346         int rc;
 347         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELFROM, NULL);
 349         if (rc)
 350                 return rc;
 351
 352         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 353                           FILESYSTEM__ASSOCIATE, NULL);
 354         return rc;
 355 }
 356
 357 static int sb_finish_set_opts(struct super_block *sb)
 358 {
 359         struct superblock_security_struct *sbsec = sb->s_security;
 360         struct dentry *root = sb->s_root;
 361         struct inode *root_inode = root->d_inode;
 362         int rc = 0;
 363
 364         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 365                 /* Make sure that the xattr handler exists and that no
 366                    error other than -ENODATA is returned by getxattr on
 367                    the root directory.  -ENODATA is ok, as this may be
 368                    the first boot of the SELinux kernel before we have
 369                    assigned xattr values to the filesystem. */
 370                 if (!root_inode->i_op->getxattr) {
 371                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 372                                "xattr support\n", sb->s_id, sb->s_type->name);
 373                         rc = -EOPNOTSUPP;
 374                         goto out;
 375                 }
 376                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 377                 if (rc < 0 && rc != -ENODATA) {
 378                         if (rc == -EOPNOTSUPP)
 379                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 380                                        "%s) has no security xattr handler\n",
 381                                        sb->s_id, sb->s_type->name);
 382                         else
 383                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 384                                        "%s) getxattr errno %d\n", sb->s_id,
 385                                        sb->s_type->name, -rc);
 386                         goto out;
 387                 }
 388         }
 389
 390         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 391
 392         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 393                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 394                        sb->s_id, sb->s_type->name);
 395         else
 396                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 397                        sb->s_id, sb->s_type->name,
 398                        labeling_behaviors[sbsec->behavior-1]);
 399
 400         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 401             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 402             sbsec->behavior == SECURITY_FS_USE_NONE ||
 403             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 404                 sbsec->flags &= ~SE_SBLABELSUPP;
 405
 406         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 407         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 408                 sbsec->flags |= SE_SBLABELSUPP;
 409
 410         /*
 411          * Special handling for rootfs. Is genfs but supports
 412          * setting SELinux context on in-core inodes.
 413          */
 414         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 415                 sbsec->flags |= SE_SBLABELSUPP;
 416
 417         /* Initialize the root inode. */
 418         rc = inode_doinit_with_dentry(root_inode, root);
 419
 420         /* Initialize any other inodes associated with the superblock, e.g.
 421            inodes created prior to initial policy load or inodes created
 422            during get_sb by a pseudo filesystem that directly
 423            populates itself. */
 424         spin_lock(&sbsec->isec_lock);
 425 next_inode:
 426         if (!list_empty(&sbsec->isec_head)) {
 427                 struct inode_security_struct *isec =
 428                                 list_entry(sbsec->isec_head.next,
 429                                            struct inode_security_struct, list);
 430                 struct inode *inode = isec->inode;
 431                 spin_unlock(&sbsec->isec_lock);
 432                 inode = igrab(inode);
 433                 if (inode) {
 434                         if (!IS_PRIVATE(inode))
 435                                 inode_doinit(inode);
 436                         iput(inode);
 437                 }
 438                 spin_lock(&sbsec->isec_lock);
 439                 list_del_init(&isec->list);
 440                 goto next_inode;
 441         }
 442         spin_unlock(&sbsec->isec_lock);
 443 out:
 444         return rc;
 445 }
 446
 447 /*
 448  * This function should allow an FS to ask what it's mount security
 449  * options were so it can use those later for submounts, displaying
 450  * mount options, or whatever.
 451  */
 452 static int selinux_get_mnt_opts(const struct super_block *sb,
 453                                 struct security_mnt_opts *opts)
 454 {
 455         int rc = 0, i;
 456         struct superblock_security_struct *sbsec = sb->s_security;
 457         char *context = NULL;
 458         u32 len;
 459         char tmp;
 460
 461         security_init_mnt_opts(opts);
 462
 463         if (!(sbsec->flags & SE_SBINITIALIZED))
 464                 return -EINVAL;
 465
 466         if (!ss_initialized)
 467                 return -EINVAL;
 468
 469         tmp = sbsec->flags & SE_MNTMASK;
 470         /* count the number of mount options for this sb */
 471         for (i = 0; i < 8; i++) {
 472                 if (tmp & 0x01)
 473                         opts->num_mnt_opts++;
 474                 tmp >>= 1;
 475         }
 476         /* Check if the Label support flag is set */
 477         if (sbsec->flags & SE_SBLABELSUPP)
 478                 opts->num_mnt_opts++;
 479
 480         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 481         if (!opts->mnt_opts) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 487         if (!opts->mnt_opts_flags) {
 488                 rc = -ENOMEM;
 489                 goto out_free;
 490         }
 491
 492         i = 0;
 493         if (sbsec->flags & FSCONTEXT_MNT) {
 494                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 495                 if (rc)
 496                         goto out_free;
 497                 opts->mnt_opts[i] = context;
 498                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 499         }
 500         if (sbsec->flags & CONTEXT_MNT) {
 501                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 502                 if (rc)
 503                         goto out_free;
 504                 opts->mnt_opts[i] = context;
 505                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 506         }
 507         if (sbsec->flags & DEFCONTEXT_MNT) {
 508                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 509                 if (rc)
 510                         goto out_free;
 511                 opts->mnt_opts[i] = context;
 512                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 513         }
 514         if (sbsec->flags & ROOTCONTEXT_MNT) {
 515                 struct inode *root = sbsec->sb->s_root->d_inode;
 516                 struct inode_security_struct *isec = root->i_security;
 517
 518                 rc = security_sid_to_context(isec->sid, &context, &len);
 519                 if (rc)
 520                         goto out_free;
 521                 opts->mnt_opts[i] = context;
 522                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 523         }
 524         if (sbsec->flags & SE_SBLABELSUPP) {
 525                 opts->mnt_opts[i] = NULL;
 526                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 527         }
 528
 529         BUG_ON(i != opts->num_mnt_opts);
 530
 531         return 0;
 532
 533 out_free:
 534         security_free_mnt_opts(opts);
 535         return rc;
 536 }
 537
 538 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 539                       u32 old_sid, u32 new_sid)
 540 {
 541         char mnt_flags = sbsec->flags & SE_MNTMASK;
 542
 543         /* check if the old mount command had the same options */
 544         if (sbsec->flags & SE_SBINITIALIZED)
 545                 if (!(sbsec->flags & flag) ||
 546                     (old_sid != new_sid))
 547                         return 1;
 548
 549         /* check if we were passed the same options twice,
 550          * aka someone passed context=a,context=b
 551          */
 552         if (!(sbsec->flags & SE_SBINITIALIZED))
 553                 if (mnt_flags & flag)
 554                         return 1;
 555         return 0;
 556 }
 557
 558 /*
 559  * Allow filesystems with binary mount data to explicitly set mount point
 560  * labeling information.
 561  */
 562 static int selinux_set_mnt_opts(struct super_block *sb,
 563                                 struct security_mnt_opts *opts)
 564 {
 565         const struct cred *cred = current_cred();
 566         int rc = 0, i;
 567         struct superblock_security_struct *sbsec = sb->s_security;
 568         const char *name = sb->s_type->name;
 569         struct inode *inode = sbsec->sb->s_root->d_inode;
 570         struct inode_security_struct *root_isec = inode->i_security;
 571         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 572         u32 defcontext_sid = 0;
 573         char **mount_options = opts->mnt_opts;
 574         int *flags = opts->mnt_opts_flags;
 575         int num_opts = opts->num_mnt_opts;
 576
 577         mutex_lock(&sbsec->lock);
 578
 579         if (!ss_initialized) {
 580                 if (!num_opts) {
 581                         /* Defer initialization until selinux_complete_init,
 582                            after the initial policy is loaded and the security
 583                            server is ready to handle calls. */
 584                         goto out;
 585                 }
 586                 rc = -EINVAL;
 587                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 588                         "before the security server is initialized\n");
 589                 goto out;
 590         }
 591
 592         /*
 593          * Binary mount data FS will come through this function twice.  Once
 594          * from an explicit call and once from the generic calls from the vfs.
 595          * Since the generic VFS calls will not contain any security mount data
 596          * we need to skip the double mount verification.
 597          *
 598          * This does open a hole in which we will not notice if the first
 599          * mount using this sb set explict options and a second mount using
 600          * this sb does not set any security options.  (The first options
 601          * will be used for both mounts)
 602          */
 603         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 604             && (num_opts == 0))
 605                 goto out;
 606
 607         /*
 608          * parse the mount options, check if they are valid sids.
 609          * also check if someone is trying to mount the same sb more
 610          * than once with different security options.
 611          */
 612         for (i = 0; i < num_opts; i++) {
 613                 u32 sid;
 614
 615                 if (flags[i] == SE_SBLABELSUPP)
 616                         continue;
 617                 rc = security_context_to_sid(mount_options[i],
 618                                              strlen(mount_options[i]), &sid);
 619                 if (rc) {
 620                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 621                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 622                                mount_options[i], sb->s_id, name, rc);
 623                         goto out;
 624                 }
 625                 switch (flags[i]) {
 626                 case FSCONTEXT_MNT:
 627                         fscontext_sid = sid;
 628
 629                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 630                                         fscontext_sid))
 631                                 goto out_double_mount;
 632
 633                         sbsec->flags |= FSCONTEXT_MNT;
 634                         break;
 635                 case CONTEXT_MNT:
 636                         context_sid = sid;
 637
 638                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 639                                         context_sid))
 640                                 goto out_double_mount;
 641
 642                         sbsec->flags |= CONTEXT_MNT;
 643                         break;
 644                 case ROOTCONTEXT_MNT:
 645                         rootcontext_sid = sid;
 646
 647                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 648                                         rootcontext_sid))
 649                                 goto out_double_mount;
 650
 651                         sbsec->flags |= ROOTCONTEXT_MNT;
 652
 653                         break;
 654                 case DEFCONTEXT_MNT:
 655                         defcontext_sid = sid;
 656
 657                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 658                                         defcontext_sid))
 659                                 goto out_double_mount;
 660
 661                         sbsec->flags |= DEFCONTEXT_MNT;
 662
 663                         break;
 664                 default:
 665                         rc = -EINVAL;
 666                         goto out;
 667                 }
 668         }
 669
 670         if (sbsec->flags & SE_SBINITIALIZED) {
 671                 /* previously mounted with options, but not on this attempt? */
 672                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 673                         goto out_double_mount;
 674                 rc = 0;
 675                 goto out;
 676         }
 677
 678         if (strcmp(sb->s_type->name, "proc") == 0)
 679                 sbsec->flags |= SE_SBPROC;
 680
 681         /* Determine the labeling behavior to use for this filesystem type. */
 682         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 683         if (rc) {
 684                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 685                        __func__, sb->s_type->name, rc);
 686                 goto out;
 687         }
 688
 689         /* sets the context of the superblock for the fs being mounted. */
 690         if (fscontext_sid) {
 691                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 692                 if (rc)
 693                         goto out;
 694
 695                 sbsec->sid = fscontext_sid;
 696         }
 697
 698         /*
 699          * Switch to using mount point labeling behavior.
 700          * sets the label used on all file below the mountpoint, and will set
 701          * the superblock context if not already set.
 702          */
 703         if (context_sid) {
 704                 if (!fscontext_sid) {
 705                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 706                                                           cred);
 707                         if (rc)
 708                                 goto out;
 709                         sbsec->sid = context_sid;
 710                 } else {
 711                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 712                                                              cred);
 713                         if (rc)
 714                                 goto out;
 715                 }
 716                 if (!rootcontext_sid)
 717                         rootcontext_sid = context_sid;
 718
 719                 sbsec->mntpoint_sid = context_sid;
 720                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 721         }
 722
 723         if (rootcontext_sid) {
 724                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 725                                                      cred);
 726                 if (rc)
 727                         goto out;
 728
 729                 root_isec->sid = rootcontext_sid;
 730                 root_isec->initialized = 1;
 731         }
 732
 733         if (defcontext_sid) {
 734                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 735                         rc = -EINVAL;
 736                         printk(KERN_WARNING "SELinux: defcontext option is "
 737                                "invalid for this filesystem type\n");
 738                         goto out;
 739                 }
 740
 741                 if (defcontext_sid != sbsec->def_sid) {
 742                         rc = may_context_mount_inode_relabel(defcontext_sid,
 743                                                              sbsec, cred);
 744                         if (rc)
 745                                 goto out;
 746                 }
 747
 748                 sbsec->def_sid = defcontext_sid;
 749         }
 750
 751         rc = sb_finish_set_opts(sb);
 752 out:
 753         mutex_unlock(&sbsec->lock);
 754         return rc;
 755 out_double_mount:
 756         rc = -EINVAL;
 757         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 758                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 759         goto out;
 760 }
 761
 762 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 763                                     const struct super_block *newsb)
 764 {
 765         struct superblock_security_struct *old = oldsb->s_security;
 766         struct superblock_security_struct *new = newsb->s_security;
 767         char oldflags = old->flags & SE_MNTMASK;
 768         char newflags = new->flags & SE_MNTMASK;
 769
 770         if (oldflags != newflags)
 771                 goto mismatch;
 772         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 773                 goto mismatch;
 774         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 775                 goto mismatch;
 776         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 777                 goto mismatch;
 778         if (oldflags & ROOTCONTEXT_MNT) {
 779                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 780                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 781                 if (oldroot->sid != newroot->sid)
 782                         goto mismatch;
 783         }
 784         return 0;
 785 mismatch:
 786         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 787                             "different security settings for (dev %s, "
 788                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 789         return -EBUSY;
 790 }
 791
 792 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 793                                         struct super_block *newsb)
 794 {
 795         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 796         struct superblock_security_struct *newsbsec = newsb->s_security;
 797
 798         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 799         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 800         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 801
 802         /*
 803          * if the parent was able to be mounted it clearly had no special lsm
 804          * mount options.  thus we can safely deal with this superblock later
 805          */
 806         if (!ss_initialized)
 807                 return 0;
 808
 809         /* how can we clone if the old one wasn't set up?? */
 810         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 811
 812         /* if fs is reusing a sb, make sure that the contexts match */
 813         if (newsbsec->flags & SE_SBINITIALIZED)
 814                 return selinux_cmp_sb_context(oldsb, newsb);
 815
 816         mutex_lock(&newsbsec->lock);
 817
 818         newsbsec->flags = oldsbsec->flags;
 819
 820         newsbsec->sid = oldsbsec->sid;
 821         newsbsec->def_sid = oldsbsec->def_sid;
 822         newsbsec->behavior = oldsbsec->behavior;
 823
 824         if (set_context) {
 825                 u32 sid = oldsbsec->mntpoint_sid;
 826
 827                 if (!set_fscontext)
 828                         newsbsec->sid = sid;
 829                 if (!set_rootcontext) {
 830                         struct inode *newinode = newsb->s_root->d_inode;
 831                         struct inode_security_struct *newisec = newinode->i_security;
 832                         newisec->sid = sid;
 833                 }
 834                 newsbsec->mntpoint_sid = sid;
 835         }
 836         if (set_rootcontext) {
 837                 const struct inode *oldinode = oldsb->s_root->d_inode;
 838                 const struct inode_security_struct *oldisec = oldinode->i_security;
 839                 struct inode *newinode = newsb->s_root->d_inode;
 840                 struct inode_security_struct *newisec = newinode->i_security;
 841
 842                 newisec->sid = oldisec->sid;
 843         }
 844
 845         sb_finish_set_opts(newsb);
 846         mutex_unlock(&newsbsec->lock);
 847         return 0;
 848 }
 849
 850 static int selinux_parse_opts_str(char *options,
 851                                   struct security_mnt_opts *opts)
 852 {
 853         char *p;
 854         char *context = NULL, *defcontext = NULL;
 855         char *fscontext = NULL, *rootcontext = NULL;
 856         int rc, num_mnt_opts = 0;
 857
 858         opts->num_mnt_opts = 0;
 859
 860         /* Standard string-based options. */
 861         while ((p = strsep(&options, "|")) != NULL) {
 862                 int token;
 863                 substring_t args[MAX_OPT_ARGS];
 864
 865                 if (!*p)
 866                         continue;
 867
 868                 token = match_token(p, tokens, args);
 869
 870                 switch (token) {
 871                 case Opt_context:
 872                         if (context || defcontext) {
 873                                 rc = -EINVAL;
 874                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 875                                 goto out_err;
 876                         }
 877                         context = match_strdup(&args[0]);
 878                         if (!context) {
 879                                 rc = -ENOMEM;
 880                                 goto out_err;
 881                         }
 882                         break;
 883
 884                 case Opt_fscontext:
 885                         if (fscontext) {
 886                                 rc = -EINVAL;
 887                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 888                                 goto out_err;
 889                         }
 890                         fscontext = match_strdup(&args[0]);
 891                         if (!fscontext) {
 892                                 rc = -ENOMEM;
 893                                 goto out_err;
 894                         }
 895                         break;
 896
 897                 case Opt_rootcontext:
 898                         if (rootcontext) {
 899                                 rc = -EINVAL;
 900                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 901                                 goto out_err;
 902                         }
 903                         rootcontext = match_strdup(&args[0]);
 904                         if (!rootcontext) {
 905                                 rc = -ENOMEM;
 906                                 goto out_err;
 907                         }
 908                         break;
 909
 910                 case Opt_defcontext:
 911                         if (context || defcontext) {
 912                                 rc = -EINVAL;
 913                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 914                                 goto out_err;
 915                         }
 916                         defcontext = match_strdup(&args[0]);
 917                         if (!defcontext) {
 918                                 rc = -ENOMEM;
 919                                 goto out_err;
 920                         }
 921                         break;
 922                 case Opt_labelsupport:
 923                         break;
 924                 default:
 925                         rc = -EINVAL;
 926                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 927                         goto out_err;
 928
 929                 }
 930         }
 931
 932         rc = -ENOMEM;
 933         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 934         if (!opts->mnt_opts)
 935                 goto out_err;
 936
 937         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 938         if (!opts->mnt_opts_flags) {
 939                 kfree(opts->mnt_opts);
 940                 goto out_err;
 941         }
 942
 943         if (fscontext) {
 944                 opts->mnt_opts[num_mnt_opts] = fscontext;
 945                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 946         }
 947         if (context) {
 948                 opts->mnt_opts[num_mnt_opts] = context;
 949                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 950         }
 951         if (rootcontext) {
 952                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 953                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 954         }
 955         if (defcontext) {
 956                 opts->mnt_opts[num_mnt_opts] = defcontext;
 957                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 958         }
 959
 960         opts->num_mnt_opts = num_mnt_opts;
 961         return 0;
 962
 963 out_err:
 964         kfree(context);
 965         kfree(defcontext);
 966         kfree(fscontext);
 967         kfree(rootcontext);
 968         return rc;
 969 }
 970 /*
 971  * string mount options parsing and call set the sbsec
 972  */
 973 static int superblock_doinit(struct super_block *sb, void *data)
 974 {
 975         int rc = 0;
 976         char *options = data;
 977         struct security_mnt_opts opts;
 978
 979         security_init_mnt_opts(&opts);
 980
 981         if (!data)
 982                 goto out;
 983
 984         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 985
 986         rc = selinux_parse_opts_str(options, &opts);
 987         if (rc)
 988                 goto out_err;
 989
 990 out:
 991         rc = selinux_set_mnt_opts(sb, &opts);
 992
 993 out_err:
 994         security_free_mnt_opts(&opts);
 995         return rc;
 996 }
 997
 998 static void selinux_write_opts(struct seq_file *m,
 999                                struct security_mnt_opts *opts)
1000 {
1001         int i;
1002         char *prefix;
1003
1004         for (i = 0; i < opts->num_mnt_opts; i++) {
1005                 char *has_comma;
1006
1007                 if (opts->mnt_opts[i])
1008                         has_comma = strchr(opts->mnt_opts[i], ',');
1009                 else
1010                         has_comma = NULL;
1011
1012                 switch (opts->mnt_opts_flags[i]) {
1013                 case CONTEXT_MNT:
1014                         prefix = CONTEXT_STR;
1015                         break;
1016                 case FSCONTEXT_MNT:
1017                         prefix = FSCONTEXT_STR;
1018                         break;
1019                 case ROOTCONTEXT_MNT:
1020                         prefix = ROOTCONTEXT_STR;
1021                         break;
1022                 case DEFCONTEXT_MNT:
1023                         prefix = DEFCONTEXT_STR;
1024                         break;
1025                 case SE_SBLABELSUPP:
1026                         seq_putc(m, ',');
1027                         seq_puts(m, LABELSUPP_STR);
1028                         continue;
1029                 default:
1030                         BUG();
1031                         return;
1032                 };
1033                 /* we need a comma before each option */
1034                 seq_putc(m, ',');
1035                 seq_puts(m, prefix);
1036                 if (has_comma)
1037                         seq_putc(m, '\"');
1038                 seq_puts(m, opts->mnt_opts[i]);
1039                 if (has_comma)
1040                         seq_putc(m, '\"');
1041         }
1042 }
1043
1044 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1045 {
1046         struct security_mnt_opts opts;
1047         int rc;
1048
1049         rc = selinux_get_mnt_opts(sb, &opts);
1050         if (rc) {
1051                 /* before policy load we may get EINVAL, don't show anything */
1052                 if (rc == -EINVAL)
1053                         rc = 0;
1054                 return rc;
1055         }
1056
1057         selinux_write_opts(m, &opts);
1058
1059         security_free_mnt_opts(&opts);
1060
1061         return rc;
1062 }
1063
1064 static inline u16 inode_mode_to_security_class(umode_t mode)
1065 {
1066         switch (mode & S_IFMT) {
1067         case S_IFSOCK:
1068                 return SECCLASS_SOCK_FILE;
1069         case S_IFLNK:
1070                 return SECCLASS_LNK_FILE;
1071         case S_IFREG:
1072                 return SECCLASS_FILE;
1073         case S_IFBLK:
1074                 return SECCLASS_BLK_FILE;
1075         case S_IFDIR:
1076                 return SECCLASS_DIR;
1077         case S_IFCHR:
1078                 return SECCLASS_CHR_FILE;
1079         case S_IFIFO:
1080                 return SECCLASS_FIFO_FILE;
1081
1082         }
1083
1084         return SECCLASS_FILE;
1085 }
1086
1087 static inline int default_protocol_stream(int protocol)
1088 {
1089         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1090 }
1091
1092 static inline int default_protocol_dgram(int protocol)
1093 {
1094         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1095 }
1096
1097 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1098 {
1099         switch (family) {
1100         case PF_UNIX:
1101                 switch (type) {
1102                 case SOCK_STREAM:
1103                 case SOCK_SEQPACKET:
1104                         return SECCLASS_UNIX_STREAM_SOCKET;
1105                 case SOCK_DGRAM:
1106                         return SECCLASS_UNIX_DGRAM_SOCKET;
1107                 }
1108                 break;
1109         case PF_INET:
1110         case PF_INET6:
1111                 switch (type) {
1112                 case SOCK_STREAM:
1113                         if (default_protocol_stream(protocol))
1114                                 return SECCLASS_TCP_SOCKET;
1115                         else
1116                                 return SECCLASS_RAWIP_SOCKET;
1117                 case SOCK_DGRAM:
1118                         if (default_protocol_dgram(protocol))
1119                                 return SECCLASS_UDP_SOCKET;
1120                         else
1121                                 return SECCLASS_RAWIP_SOCKET;
1122                 case SOCK_DCCP:
1123                         return SECCLASS_DCCP_SOCKET;
1124                 default:
1125                         return SECCLASS_RAWIP_SOCKET;
1126                 }
1127                 break;
1128         case PF_NETLINK:
1129                 switch (protocol) {
1130                 case NETLINK_ROUTE:
1131                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1132                 case NETLINK_FIREWALL:
1133                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1134                 case NETLINK_SOCK_DIAG:
1135                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1136                 case NETLINK_NFLOG:
1137                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1138                 case NETLINK_XFRM:
1139                         return SECCLASS_NETLINK_XFRM_SOCKET;
1140                 case NETLINK_SELINUX:
1141                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1142                 case NETLINK_AUDIT:
1143                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1144                 case NETLINK_IP6_FW:
1145                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1146                 case NETLINK_DNRTMSG:
1147                         return SECCLASS_NETLINK_DNRT_SOCKET;
1148                 case NETLINK_KOBJECT_UEVENT:
1149                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1150                 default:
1151                         return SECCLASS_NETLINK_SOCKET;
1152                 }
1153         case PF_PACKET:
1154                 return SECCLASS_PACKET_SOCKET;
1155         case PF_KEY:
1156                 return SECCLASS_KEY_SOCKET;
1157         case PF_APPLETALK:
1158                 return SECCLASS_APPLETALK_SOCKET;
1159         }
1160
1161         return SECCLASS_SOCKET;
1162 }
1163
1164 #ifdef CONFIG_PROC_FS
1165 static int selinux_proc_get_sid(struct dentry *dentry,
1166                                 u16 tclass,
1167                                 u32 *sid)
1168 {
1169         int rc;
1170         char *buffer, *path;
1171
1172         buffer = (char *)__get_free_page(GFP_KERNEL);
1173         if (!buffer)
1174                 return -ENOMEM;
1175
1176         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1177         if (IS_ERR(path))
1178                 rc = PTR_ERR(path);
1179         else {
1180                 /* each process gets a /proc/PID/ entry. Strip off the
1181                  * PID part to get a valid selinux labeling.
1182                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1183                 while (path[1] >= '0' && path[1] <= '9') {
1184                         path[1] = '/';
1185                         path++;
1186                 }
1187                 rc = security_genfs_sid("proc", path, tclass, sid);
1188         }
1189         free_page((unsigned long)buffer);
1190         return rc;
1191 }
1192 #else
1193 static int selinux_proc_get_sid(struct dentry *dentry,
1194                                 u16 tclass,
1195                                 u32 *sid)
1196 {
1197         return -EINVAL;
1198 }
1199 #endif
1200
1201 /* The inode's security attributes must be initialized before first use. */
1202 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1203 {
1204         struct superblock_security_struct *sbsec = NULL;
1205         struct inode_security_struct *isec = inode->i_security;
1206         u32 sid;
1207         struct dentry *dentry;
1208 #define INITCONTEXTLEN 255
1209         char *context = NULL;
1210         unsigned len = 0;
1211         int rc = 0;
1212
1213         if (isec->initialized)
1214                 goto out;
1215
1216         mutex_lock(&isec->lock);
1217         if (isec->initialized)
1218                 goto out_unlock;
1219
1220         sbsec = inode->i_sb->s_security;
1221         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1222                 /* Defer initialization until selinux_complete_init,
1223                    after the initial policy is loaded and the security
1224                    server is ready to handle calls. */
1225                 spin_lock(&sbsec->isec_lock);
1226                 if (list_empty(&isec->list))
1227                         list_add(&isec->list, &sbsec->isec_head);
1228                 spin_unlock(&sbsec->isec_lock);
1229                 goto out_unlock;
1230         }
1231
1232         switch (sbsec->behavior) {
1233         case SECURITY_FS_USE_XATTR:
1234                 if (!inode->i_op->getxattr) {
1235                         isec->sid = sbsec->def_sid;
1236                         break;
1237                 }
1238
1239                 /* Need a dentry, since the xattr API requires one.
1240                    Life would be simpler if we could just pass the inode. */
1241                 if (opt_dentry) {
1242                         /* Called from d_instantiate or d_splice_alias. */
1243                         dentry = dget(opt_dentry);
1244                 } else {
1245                         /* Called from selinux_complete_init, try to find a dentry. */
1246                         dentry = d_find_alias(inode);
1247                 }
1248                 if (!dentry) {
1249                         /*
1250                          * this is can be hit on boot when a file is accessed
1251                          * before the policy is loaded.  When we load policy we
1252                          * may find inodes that have no dentry on the
1253                          * sbsec->isec_head list.  No reason to complain as these
1254                          * will get fixed up the next time we go through
1255                          * inode_doinit with a dentry, before these inodes could
1256                          * be used again by userspace.
1257                          */
1258                         goto out_unlock;
1259                 }
1260
1261                 len = INITCONTEXTLEN;
1262                 context = kmalloc(len+1, GFP_NOFS);
1263                 if (!context) {
1264                         rc = -ENOMEM;
1265                         dput(dentry);
1266                         goto out_unlock;
1267                 }
1268                 context[len] = '\0';
1269                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1270                                            context, len);
1271                 if (rc == -ERANGE) {
1272                         kfree(context);
1273
1274                         /* Need a larger buffer.  Query for the right size. */
1275                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1276                                                    NULL, 0);
1277                         if (rc < 0) {
1278                                 dput(dentry);
1279                                 goto out_unlock;
1280                         }
1281                         len = rc;
1282                         context = kmalloc(len+1, GFP_NOFS);
1283                         if (!context) {
1284                                 rc = -ENOMEM;
1285                                 dput(dentry);
1286                                 goto out_unlock;
1287                         }
1288                         context[len] = '\0';
1289                         rc = inode->i_op->getxattr(dentry,
1290                                                    XATTR_NAME_SELINUX,
1291                                                    context, len);
1292                 }
1293                 dput(dentry);
1294                 if (rc < 0) {
1295                         if (rc != -ENODATA) {
1296                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1297                                        "%d for dev=%s ino=%ld\n", __func__,
1298                                        -rc, inode->i_sb->s_id, inode->i_ino);
1299                                 kfree(context);
1300                                 goto out_unlock;
1301                         }
1302                         /* Map ENODATA to the default file SID */
1303                         sid = sbsec->def_sid;
1304                         rc = 0;
1305                 } else {
1306                         rc = security_context_to_sid_default(context, rc, &sid,
1307                                                              sbsec->def_sid,
1308                                                              GFP_NOFS);
1309                         if (rc) {
1310                                 char *dev = inode->i_sb->s_id;
1311                                 unsigned long ino = inode->i_ino;
1312
1313                                 if (rc == -EINVAL) {
1314                                         if (printk_ratelimit())
1315                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1316                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1317                                                         "filesystem in question.\n", ino, dev, context);
1318                                 } else {
1319                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1320                                                "returned %d for dev=%s ino=%ld\n",
1321                                                __func__, context, -rc, dev, ino);
1322                                 }
1323                                 kfree(context);
1324                                 /* Leave with the unlabeled SID */
1325                                 rc = 0;
1326                                 break;
1327                         }
1328                 }
1329                 kfree(context);
1330                 isec->sid = sid;
1331                 break;
1332         case SECURITY_FS_USE_TASK:
1333                 isec->sid = isec->task_sid;
1334                 break;
1335         case SECURITY_FS_USE_TRANS:
1336                 /* Default to the fs SID. */
1337                 isec->sid = sbsec->sid;
1338
1339                 /* Try to obtain a transition SID. */
1340                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1341                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1342                                              isec->sclass, NULL, &sid);
1343                 if (rc)
1344                         goto out_unlock;
1345                 isec->sid = sid;
1346                 break;
1347         case SECURITY_FS_USE_MNTPOINT:
1348                 isec->sid = sbsec->mntpoint_sid;
1349                 break;
1350         default:
1351                 /* Default to the fs superblock SID. */
1352                 isec->sid = sbsec->sid;
1353
1354                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1355                         if (opt_dentry) {
1356                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1357                                 rc = selinux_proc_get_sid(opt_dentry,
1358                                                           isec->sclass,
1359                                                           &sid);
1360                                 if (rc)
1361                                         goto out_unlock;
1362                                 isec->sid = sid;
1363                         }
1364                 }
1365                 break;
1366         }
1367
1368         isec->initialized = 1;
1369
1370 out_unlock:
1371         mutex_unlock(&isec->lock);
1372 out:
1373         if (isec->sclass == SECCLASS_FILE)
1374                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1375         return rc;
1376 }
1377
1378 /* Convert a Linux signal to an access vector. */
1379 static inline u32 signal_to_av(int sig)
1380 {
1381         u32 perm = 0;
1382
1383         switch (sig) {
1384         case SIGCHLD:
1385                 /* Commonly granted from child to parent. */
1386                 perm = PROCESS__SIGCHLD;
1387                 break;
1388         case SIGKILL:
1389                 /* Cannot be caught or ignored */
1390                 perm = PROCESS__SIGKILL;
1391                 break;
1392         case SIGSTOP:
1393                 /* Cannot be caught or ignored */
1394                 perm = PROCESS__SIGSTOP;
1395                 break;
1396         default:
1397                 /* All other signals. */
1398                 perm = PROCESS__SIGNAL;
1399                 break;
1400         }
1401
1402         return perm;
1403 }
1404
1405 /*
1406  * Check permission between a pair of credentials
1407  * fork check, ptrace check, etc.
1408  */
1409 static int cred_has_perm(const struct cred *actor,
1410                          const struct cred *target,
1411                          u32 perms)
1412 {
1413         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1414
1415         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1416 }
1417
1418 /*
1419  * Check permission between a pair of tasks, e.g. signal checks,
1420  * fork check, ptrace check, etc.
1421  * tsk1 is the actor and tsk2 is the target
1422  * - this uses the default subjective creds of tsk1
1423  */
1424 static int task_has_perm(const struct task_struct *tsk1,
1425                          const struct task_struct *tsk2,
1426                          u32 perms)
1427 {
1428         const struct task_security_struct *__tsec1, *__tsec2;
1429         u32 sid1, sid2;
1430
1431         rcu_read_lock();
1432         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1433         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1434         rcu_read_unlock();
1435         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1436 }
1437
1438 /*
1439  * Check permission between current and another task, e.g. signal checks,
1440  * fork check, ptrace check, etc.
1441  * current is the actor and tsk2 is the target
1442  * - this uses current's subjective creds
1443  */
1444 static int current_has_perm(const struct task_struct *tsk,
1445                             u32 perms)
1446 {
1447         u32 sid, tsid;
1448
1449         sid = current_sid();
1450         tsid = task_sid(tsk);
1451         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1452 }
1453
1454 #if CAP_LAST_CAP > 63
1455 #error Fix SELinux to handle capabilities > 63.
1456 #endif
1457
1458 /* Check whether a task is allowed to use a capability. */
1459 static int cred_has_capability(const struct cred *cred,
1460                                int cap, int audit)
1461 {
1462         struct common_audit_data ad;
1463         struct av_decision avd;
1464         u16 sclass;
1465         u32 sid = cred_sid(cred);
1466         u32 av = CAP_TO_MASK(cap);
1467         int rc;
1468
1469         ad.type = LSM_AUDIT_DATA_CAP;
1470         ad.u.cap = cap;
1471
1472         switch (CAP_TO_INDEX(cap)) {
1473         case 0:
1474                 sclass = SECCLASS_CAPABILITY;
1475                 break;
1476         case 1:
1477                 sclass = SECCLASS_CAPABILITY2;
1478                 break;
1479         default:
1480                 printk(KERN_ERR
1481                        "SELinux:  out of range capability %d\n", cap);
1482                 BUG();
1483                 return -EINVAL;
1484         }
1485
1486         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1487         if (audit == SECURITY_CAP_AUDIT) {
1488                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1489                 if (rc2)
1490                         return rc2;
1491         }
1492         return rc;
1493 }
1494
1495 /* Check whether a task is allowed to use a system operation. */
1496 static int task_has_system(struct task_struct *tsk,
1497                            u32 perms)
1498 {
1499         u32 sid = task_sid(tsk);
1500
1501         return avc_has_perm(sid, SECINITSID_KERNEL,
1502                             SECCLASS_SYSTEM, perms, NULL);
1503 }
1504
1505 /* Check whether a task has a particular permission to an inode.
1506    The 'adp' parameter is optional and allows other audit
1507    data to be passed (e.g. the dentry). */
1508 static int inode_has_perm(const struct cred *cred,
1509                           struct inode *inode,
1510                           u32 perms,
1511                           struct common_audit_data *adp,
1512                           unsigned flags)
1513 {
1514         struct inode_security_struct *isec;
1515         u32 sid;
1516
1517         validate_creds(cred);
1518
1519         if (unlikely(IS_PRIVATE(inode)))
1520                 return 0;
1521
1522         sid = cred_sid(cred);
1523         isec = inode->i_security;
1524
1525         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1526 }
1527
1528 /* Same as inode_has_perm, but pass explicit audit data containing
1529    the dentry to help the auditing code to more easily generate the
1530    pathname if needed. */
1531 static inline int dentry_has_perm(const struct cred *cred,
1532                                   struct dentry *dentry,
1533                                   u32 av)
1534 {
1535         struct inode *inode = dentry->d_inode;
1536         struct common_audit_data ad;
1537
1538         ad.type = LSM_AUDIT_DATA_DENTRY;
1539         ad.u.dentry = dentry;
1540         return inode_has_perm(cred, inode, av, &ad, 0);
1541 }
1542
1543 /* Same as inode_has_perm, but pass explicit audit data containing
1544    the path to help the auditing code to more easily generate the
1545    pathname if needed. */
1546 static inline int path_has_perm(const struct cred *cred,
1547                                 struct path *path,
1548                                 u32 av)
1549 {
1550         struct inode *inode = path->dentry->d_inode;
1551         struct common_audit_data ad;
1552
1553         ad.type = LSM_AUDIT_DATA_PATH;
1554         ad.u.path = *path;
1555         return inode_has_perm(cred, inode, av, &ad, 0);
1556 }
1557
1558 /* Check whether a task can use an open file descriptor to
1559    access an inode in a given way.  Check access to the
1560    descriptor itself, and then use dentry_has_perm to
1561    check a particular permission to the file.
1562    Access to the descriptor is implicitly granted if it
1563    has the same SID as the process.  If av is zero, then
1564    access to the file is not checked, e.g. for cases
1565    where only the descriptor is affected like seek. */
1566 static int file_has_perm(const struct cred *cred,
1567                          struct file *file,
1568                          u32 av)
1569 {
1570         struct file_security_struct *fsec = file->f_security;
1571         struct inode *inode = file_inode(file);
1572         struct common_audit_data ad;
1573         u32 sid = cred_sid(cred);
1574         int rc;
1575
1576         ad.type = LSM_AUDIT_DATA_PATH;
1577         ad.u.path = file->f_path;
1578
1579         if (sid != fsec->sid) {
1580                 rc = avc_has_perm(sid, fsec->sid,
1581                                   SECCLASS_FD,
1582                                   FD__USE,
1583                                   &ad);
1584                 if (rc)
1585                         goto out;
1586         }
1587
1588         /* av is zero if only checking access to the descriptor. */
1589         rc = 0;
1590         if (av)
1591                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1592
1593 out:
1594         return rc;
1595 }
1596
1597 /* Check whether a task can create a file. */
1598 static int may_create(struct inode *dir,
1599                       struct dentry *dentry,
1600                       u16 tclass)
1601 {
1602         const struct task_security_struct *tsec = current_security();
1603         struct inode_security_struct *dsec;
1604         struct superblock_security_struct *sbsec;
1605         u32 sid, newsid;
1606         struct common_audit_data ad;
1607         int rc;
1608
1609         dsec = dir->i_security;
1610         sbsec = dir->i_sb->s_security;
1611
1612         sid = tsec->sid;
1613         newsid = tsec->create_sid;
1614
1615         ad.type = LSM_AUDIT_DATA_DENTRY;
1616         ad.u.dentry = dentry;
1617
1618         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1619                           DIR__ADD_NAME | DIR__SEARCH,
1620                           &ad);
1621         if (rc)
1622                 return rc;
1623
1624         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1625                 rc = security_transition_sid(sid, dsec->sid, tclass,
1626                                              &dentry->d_name, &newsid);
1627                 if (rc)
1628                         return rc;
1629         }
1630
1631         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1632         if (rc)
1633                 return rc;
1634
1635         return avc_has_perm(newsid, sbsec->sid,
1636                             SECCLASS_FILESYSTEM,
1637                             FILESYSTEM__ASSOCIATE, &ad);
1638 }
1639
1640 /* Check whether a task can create a key. */
1641 static int may_create_key(u32 ksid,
1642                           struct task_struct *ctx)
1643 {
1644         u32 sid = task_sid(ctx);
1645
1646         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1647 }
1648
1649 #define MAY_LINK        0
1650 #define MAY_UNLINK      1
1651 #define MAY_RMDIR       2
1652
1653 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1654 static int may_link(struct inode *dir,
1655                     struct dentry *dentry,
1656                     int kind)
1657
1658 {
1659         struct inode_security_struct *dsec, *isec;
1660         struct common_audit_data ad;
1661         u32 sid = current_sid();
1662         u32 av;
1663         int rc;
1664
1665         dsec = dir->i_security;
1666         isec = dentry->d_inode->i_security;
1667
1668         ad.type = LSM_AUDIT_DATA_DENTRY;
1669         ad.u.dentry = dentry;
1670
1671         av = DIR__SEARCH;
1672         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1673         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1674         if (rc)
1675                 return rc;
1676
1677         switch (kind) {
1678         case MAY_LINK:
1679                 av = FILE__LINK;
1680                 break;
1681         case MAY_UNLINK:
1682                 av = FILE__UNLINK;
1683                 break;
1684         case MAY_RMDIR:
1685                 av = DIR__RMDIR;
1686                 break;
1687         default:
1688                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1689                         __func__, kind);
1690                 return 0;
1691         }
1692
1693         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1694         return rc;
1695 }
1696
1697 static inline int may_rename(struct inode *old_dir,
1698                              struct dentry *old_dentry,
1699                              struct inode *new_dir,
1700                              struct dentry *new_dentry)
1701 {
1702         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1703         struct common_audit_data ad;
1704         u32 sid = current_sid();
1705         u32 av;
1706         int old_is_dir, new_is_dir;
1707         int rc;
1708
1709         old_dsec = old_dir->i_security;
1710         old_isec = old_dentry->d_inode->i_security;
1711         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1712         new_dsec = new_dir->i_security;
1713
1714         ad.type = LSM_AUDIT_DATA_DENTRY;
1715
1716         ad.u.dentry = old_dentry;
1717         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1718                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1719         if (rc)
1720                 return rc;
1721         rc = avc_has_perm(sid, old_isec->sid,
1722                           old_isec->sclass, FILE__RENAME, &ad);
1723         if (rc)
1724                 return rc;
1725         if (old_is_dir && new_dir != old_dir) {
1726                 rc = avc_has_perm(sid, old_isec->sid,
1727                                   old_isec->sclass, DIR__REPARENT, &ad);
1728                 if (rc)
1729                         return rc;
1730         }
1731
1732         ad.u.dentry = new_dentry;
1733         av = DIR__ADD_NAME | DIR__SEARCH;
1734         if (new_dentry->d_inode)
1735                 av |= DIR__REMOVE_NAME;
1736         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1737         if (rc)
1738                 return rc;
1739         if (new_dentry->d_inode) {
1740                 new_isec = new_dentry->d_inode->i_security;
1741                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1742                 rc = avc_has_perm(sid, new_isec->sid,
1743                                   new_isec->sclass,
1744                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1745                 if (rc)
1746                         return rc;
1747         }
1748
1749         return 0;
1750 }
1751
1752 /* Check whether a task can perform a filesystem operation. */
1753 static int superblock_has_perm(const struct cred *cred,
1754                                struct super_block *sb,
1755                                u32 perms,
1756                                struct common_audit_data *ad)
1757 {
1758         struct superblock_security_struct *sbsec;
1759         u32 sid = cred_sid(cred);
1760
1761         sbsec = sb->s_security;
1762         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1763 }
1764
1765 /* Convert a Linux mode and permission mask to an access vector. */
1766 static inline u32 file_mask_to_av(int mode, int mask)
1767 {
1768         u32 av = 0;
1769
1770         if (!S_ISDIR(mode)) {
1771                 if (mask & MAY_EXEC)
1772                         av |= FILE__EXECUTE;
1773                 if (mask & MAY_READ)
1774                         av |= FILE__READ;
1775
1776                 if (mask & MAY_APPEND)
1777                         av |= FILE__APPEND;
1778                 else if (mask & MAY_WRITE)
1779                         av |= FILE__WRITE;
1780
1781         } else {
1782                 if (mask & MAY_EXEC)
1783                         av |= DIR__SEARCH;
1784                 if (mask & MAY_WRITE)
1785                         av |= DIR__WRITE;
1786                 if (mask & MAY_READ)
1787                         av |= DIR__READ;
1788         }
1789
1790         return av;
1791 }
1792
1793 /* Convert a Linux file to an access vector. */
1794 static inline u32 file_to_av(struct file *file)
1795 {
1796         u32 av = 0;
1797
1798         if (file->f_mode & FMODE_READ)
1799                 av |= FILE__READ;
1800         if (file->f_mode & FMODE_WRITE) {
1801                 if (file->f_flags & O_APPEND)
1802                         av |= FILE__APPEND;
1803                 else
1804                         av |= FILE__WRITE;
1805         }
1806         if (!av) {
1807                 /*
1808                  * Special file opened with flags 3 for ioctl-only use.
1809                  */
1810                 av = FILE__IOCTL;
1811         }
1812
1813         return av;
1814 }
1815
1816 /*
1817  * Convert a file to an access vector and include the correct open
1818  * open permission.
1819  */
1820 static inline u32 open_file_to_av(struct file *file)
1821 {
1822         u32 av = file_to_av(file);
1823
1824         if (selinux_policycap_openperm)
1825                 av |= FILE__OPEN;
1826
1827         return av;
1828 }
1829
1830 /* Hook functions begin here. */
1831
1832 static int selinux_ptrace_access_check(struct task_struct *child,
1833                                      unsigned int mode)
1834 {
1835         int rc;
1836
1837         rc = cap_ptrace_access_check(child, mode);
1838         if (rc)
1839                 return rc;
1840
1841         if (mode & PTRACE_MODE_READ) {
1842                 u32 sid = current_sid();
1843                 u32 csid = task_sid(child);
1844                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1845         }
1846
1847         return current_has_perm(child, PROCESS__PTRACE);
1848 }
1849
1850 static int selinux_ptrace_traceme(struct task_struct *parent)
1851 {
1852         int rc;
1853
1854         rc = cap_ptrace_traceme(parent);
1855         if (rc)
1856                 return rc;
1857
1858         return task_has_perm(parent, current, PROCESS__PTRACE);
1859 }
1860
1861 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1862                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1863 {
1864         int error;
1865
1866         error = current_has_perm(target, PROCESS__GETCAP);
1867         if (error)
1868                 return error;
1869
1870         return cap_capget(target, effective, inheritable, permitted);
1871 }
1872
1873 static int selinux_capset(struct cred *new, const struct cred *old,
1874                           const kernel_cap_t *effective,
1875                           const kernel_cap_t *inheritable,
1876                           const kernel_cap_t *permitted)
1877 {
1878         int error;
1879
1880         error = cap_capset(new, old,
1881                                       effective, inheritable, permitted);
1882         if (error)
1883                 return error;
1884
1885         return cred_has_perm(old, new, PROCESS__SETCAP);
1886 }
1887
1888 /*
1889  * (This comment used to live with the selinux_task_setuid hook,
1890  * which was removed).
1891  *
1892  * Since setuid only affects the current process, and since the SELinux
1893  * controls are not based on the Linux identity attributes, SELinux does not
1894  * need to control this operation.  However, SELinux does control the use of
1895  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1896  */
1897
1898 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1899                            int cap, int audit)
1900 {
1901         int rc;
1902
1903         rc = cap_capable(cred, ns, cap, audit);
1904         if (rc)
1905                 return rc;
1906
1907         return cred_has_capability(cred, cap, audit);
1908 }
1909
1910 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1911 {
1912         const struct cred *cred = current_cred();
1913         int rc = 0;
1914
1915         if (!sb)
1916                 return 0;
1917
1918         switch (cmds) {
1919         case Q_SYNC:
1920         case Q_QUOTAON:
1921         case Q_QUOTAOFF:
1922         case Q_SETINFO:
1923         case Q_SETQUOTA:
1924                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1925                 break;
1926         case Q_GETFMT:
1927         case Q_GETINFO:
1928         case Q_GETQUOTA:
1929                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1930                 break;
1931         default:
1932                 rc = 0;  /* let the kernel handle invalid cmds */
1933                 break;
1934         }
1935         return rc;
1936 }
1937
1938 static int selinux_quota_on(struct dentry *dentry)
1939 {
1940         const struct cred *cred = current_cred();
1941
1942         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1943 }
1944
1945 static int selinux_syslog(int type)
1946 {
1947         int rc;
1948
1949         switch (type) {
1950         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1951         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1952                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1953                 break;
1954         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1955         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1956         /* Set level of messages printed to console */
1957         case SYSLOG_ACTION_CONSOLE_LEVEL:
1958                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1959                 break;
1960         case SYSLOG_ACTION_CLOSE:       /* Close log */
1961         case SYSLOG_ACTION_OPEN:        /* Open log */
1962         case SYSLOG_ACTION_READ:        /* Read from log */
1963         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1964         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1965         default:
1966                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1967                 break;
1968         }
1969         return rc;
1970 }
1971
1972 /*
1973  * Check that a process has enough memory to allocate a new virtual
1974  * mapping. 0 means there is enough memory for the allocation to
1975  * succeed and -ENOMEM implies there is not.
1976  *
1977  * Do not audit the selinux permission check, as this is applied to all
1978  * processes that allocate mappings.
1979  */
1980 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1981 {
1982         int rc, cap_sys_admin = 0;
1983
1984         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1985                              SECURITY_CAP_NOAUDIT);
1986         if (rc == 0)
1987                 cap_sys_admin = 1;
1988
1989         return __vm_enough_memory(mm, pages, cap_sys_admin);
1990 }
1991
1992 /* binprm security operations */
1993
1994 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1995 {
1996         const struct task_security_struct *old_tsec;
1997         struct task_security_struct *new_tsec;
1998         struct inode_security_struct *isec;
1999         struct common_audit_data ad;
2000         struct inode *inode = file_inode(bprm->file);
2001         int rc;
2002
2003         rc = cap_bprm_set_creds(bprm);
2004         if (rc)
2005                 return rc;
2006
2007         /* SELinux context only depends on initial program or script and not
2008          * the script interpreter */
2009         if (bprm->cred_prepared)
2010                 return 0;
2011
2012         old_tsec = current_security();
2013         new_tsec = bprm->cred->security;
2014         isec = inode->i_security;
2015
2016         /* Default to the current task SID. */
2017         new_tsec->sid = old_tsec->sid;
2018         new_tsec->osid = old_tsec->sid;
2019
2020         /* Reset fs, key, and sock SIDs on execve. */
2021         new_tsec->create_sid = 0;
2022         new_tsec->keycreate_sid = 0;
2023         new_tsec->sockcreate_sid = 0;
2024
2025         if (old_tsec->exec_sid) {
2026                 new_tsec->sid = old_tsec->exec_sid;
2027                 /* Reset exec SID on execve. */
2028                 new_tsec->exec_sid = 0;
2029
2030                 /*
2031                  * Minimize confusion: if no_new_privs and a transition is
2032                  * explicitly requested, then fail the exec.
2033                  */
2034                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2035                         return -EPERM;
2036         } else {
2037                 /* Check for a default transition on this program. */
2038                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2039                                              SECCLASS_PROCESS, NULL,
2040                                              &new_tsec->sid);
2041                 if (rc)
2042                         return rc;
2043         }
2044
2045         ad.type = LSM_AUDIT_DATA_PATH;
2046         ad.u.path = bprm->file->f_path;
2047
2048         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2049             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2050                 new_tsec->sid = old_tsec->sid;
2051
2052         if (new_tsec->sid == old_tsec->sid) {
2053                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2054                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2055                 if (rc)
2056                         return rc;
2057         } else {
2058                 /* Check permissions for the transition. */
2059                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2060                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2061                 if (rc)
2062                         return rc;
2063
2064                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2065                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2066                 if (rc)
2067                         return rc;
2068
2069                 /* Check for shared state */
2070                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2071                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2072                                           SECCLASS_PROCESS, PROCESS__SHARE,
2073                                           NULL);
2074                         if (rc)
2075                                 return -EPERM;
2076                 }
2077
2078                 /* Make sure that anyone attempting to ptrace over a task that
2079                  * changes its SID has the appropriate permit */
2080                 if (bprm->unsafe &
2081                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2082                         struct task_struct *tracer;
2083                         struct task_security_struct *sec;
2084                         u32 ptsid = 0;
2085
2086                         rcu_read_lock();
2087                         tracer = ptrace_parent(current);
2088                         if (likely(tracer != NULL)) {
2089                                 sec = __task_cred(tracer)->security;
2090                                 ptsid = sec->sid;
2091                         }
2092                         rcu_read_unlock();
2093
2094                         if (ptsid != 0) {
2095                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2096                                                   SECCLASS_PROCESS,
2097                                                   PROCESS__PTRACE, NULL);
2098                                 if (rc)
2099                                         return -EPERM;
2100                         }
2101                 }
2102
2103                 /* Clear any possibly unsafe personality bits on exec: */
2104                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2105         }
2106
2107         return 0;
2108 }
2109
2110 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2111 {
2112         const struct task_security_struct *tsec = current_security();
2113         u32 sid, osid;
2114         int atsecure = 0;
2115
2116         sid = tsec->sid;
2117         osid = tsec->osid;
2118
2119         if (osid != sid) {
2120                 /* Enable secure mode for SIDs transitions unless
2121                    the noatsecure permission is granted between
2122                    the two SIDs, i.e. ahp returns 0. */
2123                 atsecure = avc_has_perm(osid, sid,
2124                                         SECCLASS_PROCESS,
2125                                         PROCESS__NOATSECURE, NULL);
2126         }
2127
2128         return (atsecure || cap_bprm_secureexec(bprm));
2129 }
2130
2131 static int match_file(const void *p, struct file *file, unsigned fd)
2132 {
2133         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2134 }
2135
2136 /* Derived from fs/exec.c:flush_old_files. */
2137 static inline void flush_unauthorized_files(const struct cred *cred,
2138                                             struct files_struct *files)
2139 {
2140         struct file *file, *devnull = NULL;
2141         struct tty_struct *tty;
2142         int drop_tty = 0;
2143         unsigned n;
2144
2145         tty = get_current_tty();
2146         if (tty) {
2147                 spin_lock(&tty_files_lock);
2148                 if (!list_empty(&tty->tty_files)) {
2149                         struct tty_file_private *file_priv;
2150
2151                         /* Revalidate access to controlling tty.
2152                            Use path_has_perm on the tty path directly rather
2153                            than using file_has_perm, as this particular open
2154                            file may belong to another process and we are only
2155                            interested in the inode-based check here. */
2156                         file_priv = list_first_entry(&tty->tty_files,
2157                                                 struct tty_file_private, list);
2158                         file = file_priv->file;
2159                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2160                                 drop_tty = 1;
2161                 }
2162                 spin_unlock(&tty_files_lock);
2163                 tty_kref_put(tty);
2164         }
2165         /* Reset controlling tty. */
2166         if (drop_tty)
2167                 no_tty();
2168
2169         /* Revalidate access to inherited open files. */
2170         n = iterate_fd(files, 0, match_file, cred);
2171         if (!n) /* none found? */
2172                 return;
2173
2174         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2175         if (IS_ERR(devnull))
2176                 devnull = NULL;
2177         /* replace all the matching ones with this */
2178         do {
2179                 replace_fd(n - 1, devnull, 0);
2180         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2181         if (devnull)
2182                 fput(devnull);
2183 }
2184
2185 /*
2186  * Prepare a process for imminent new credential changes due to exec
2187  */
2188 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2189 {
2190         struct task_security_struct *new_tsec;
2191         struct rlimit *rlim, *initrlim;
2192         int rc, i;
2193
2194         new_tsec = bprm->cred->security;
2195         if (new_tsec->sid == new_tsec->osid)
2196                 return;
2197
2198         /* Close files for which the new task SID is not authorized. */
2199         flush_unauthorized_files(bprm->cred, current->files);
2200
2201         /* Always clear parent death signal on SID transitions. */
2202         current->pdeath_signal = 0;
2203
2204         /* Check whether the new SID can inherit resource limits from the old
2205          * SID.  If not, reset all soft limits to the lower of the current
2206          * task's hard limit and the init task's soft limit.
2207          *
2208          * Note that the setting of hard limits (even to lower them) can be
2209          * controlled by the setrlimit check.  The inclusion of the init task's
2210          * soft limit into the computation is to avoid resetting soft limits
2211          * higher than the default soft limit for cases where the default is
2212          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2213          */
2214         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2215                           PROCESS__RLIMITINH, NULL);
2216         if (rc) {
2217                 /* protect against do_prlimit() */
2218                 task_lock(current);
2219                 for (i = 0; i < RLIM_NLIMITS; i++) {
2220                         rlim = current->signal->rlim + i;
2221                         initrlim = init_task.signal->rlim + i;
2222                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2223                 }
2224                 task_unlock(current);
2225                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2226         }
2227 }
2228
2229 /*
2230  * Clean up the process immediately after the installation of new credentials
2231  * due to exec
2232  */
2233 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2234 {
2235         const struct task_security_struct *tsec = current_security();
2236         struct itimerval itimer;
2237         u32 osid, sid;
2238         int rc, i;
2239
2240         osid = tsec->osid;
2241         sid = tsec->sid;
2242
2243         if (sid == osid)
2244                 return;
2245
2246         /* Check whether the new SID can inherit signal state from the old SID.
2247          * If not, clear itimers to avoid subsequent signal generation and
2248          * flush and unblock signals.
2249          *
2250          * This must occur _after_ the task SID has been updated so that any
2251          * kill done after the flush will be checked against the new SID.
2252          */
2253         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2254         if (rc) {
2255                 memset(&itimer, 0, sizeof itimer);
2256                 for (i = 0; i < 3; i++)
2257                         do_setitimer(i, &itimer, NULL);
2258                 spin_lock_irq(&current->sighand->siglock);
2259                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2260                         __flush_signals(current);
2261                         flush_signal_handlers(current, 1);
2262                         sigemptyset(&current->blocked);
2263                 }
2264                 spin_unlock_irq(&current->sighand->siglock);
2265         }
2266
2267         /* Wake up the parent if it is waiting so that it can recheck
2268          * wait permission to the new task SID. */
2269         read_lock(&tasklist_lock);
2270         __wake_up_parent(current, current->real_parent);
2271         read_unlock(&tasklist_lock);
2272 }
2273
2274 /* superblock security operations */
2275
2276 static int selinux_sb_alloc_security(struct super_block *sb)
2277 {
2278         return superblock_alloc_security(sb);
2279 }
2280
2281 static void selinux_sb_free_security(struct super_block *sb)
2282 {
2283         superblock_free_security(sb);
2284 }
2285
2286 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2287 {
2288         if (plen > olen)
2289                 return 0;
2290
2291         return !memcmp(prefix, option, plen);
2292 }
2293
2294 static inline int selinux_option(char *option, int len)
2295 {
2296         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2297                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2298                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2299                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2300                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2301 }
2302
2303 static inline void take_option(char **to, char *from, int *first, int len)
2304 {
2305         if (!*first) {
2306                 **to = ',';
2307                 *to += 1;
2308         } else
2309                 *first = 0;
2310         memcpy(*to, from, len);
2311         *to += len;
2312 }
2313
2314 static inline void take_selinux_option(char **to, char *from, int *first,
2315                                        int len)
2316 {
2317         int current_size = 0;
2318
2319         if (!*first) {
2320                 **to = '|';
2321                 *to += 1;
2322         } else
2323                 *first = 0;
2324
2325         while (current_size < len) {
2326                 if (*from != '"') {
2327                         **to = *from;
2328                         *to += 1;
2329                 }
2330                 from += 1;
2331                 current_size += 1;
2332         }
2333 }
2334
2335 static int selinux_sb_copy_data(char *orig, char *copy)
2336 {
2337         int fnosec, fsec, rc = 0;
2338         char *in_save, *in_curr, *in_end;
2339         char *sec_curr, *nosec_save, *nosec;
2340         int open_quote = 0;
2341
2342         in_curr = orig;
2343         sec_curr = copy;
2344
2345         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2346         if (!nosec) {
2347                 rc = -ENOMEM;
2348                 goto out;
2349         }
2350
2351         nosec_save = nosec;
2352         fnosec = fsec = 1;
2353         in_save = in_end = orig;
2354
2355         do {
2356                 if (*in_end == '"')
2357                         open_quote = !open_quote;
2358                 if ((*in_end == ',' && open_quote == 0) ||
2359                                 *in_end == '\0') {
2360                         int len = in_end - in_curr;
2361
2362                         if (selinux_option(in_curr, len))
2363                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2364                         else
2365                                 take_option(&nosec, in_curr, &fnosec, len);
2366
2367                         in_curr = in_end + 1;
2368                 }
2369         } while (*in_end++);
2370
2371         strcpy(in_save, nosec_save);
2372         free_page((unsigned long)nosec_save);
2373 out:
2374         return rc;
2375 }
2376
2377 static int selinux_sb_remount(struct super_block *sb, void *data)
2378 {
2379         int rc, i, *flags;
2380         struct security_mnt_opts opts;
2381         char *secdata, **mount_options;
2382         struct superblock_security_struct *sbsec = sb->s_security;
2383
2384         if (!(sbsec->flags & SE_SBINITIALIZED))
2385                 return 0;
2386
2387         if (!data)
2388                 return 0;
2389
2390         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2391                 return 0;
2392
2393         security_init_mnt_opts(&opts);
2394         secdata = alloc_secdata();
2395         if (!secdata)
2396                 return -ENOMEM;
2397         rc = selinux_sb_copy_data(data, secdata);
2398         if (rc)
2399                 goto out_free_secdata;
2400
2401         rc = selinux_parse_opts_str(secdata, &opts);
2402         if (rc)
2403                 goto out_free_secdata;
2404
2405         mount_options = opts.mnt_opts;
2406         flags = opts.mnt_opts_flags;
2407
2408         for (i = 0; i < opts.num_mnt_opts; i++) {
2409                 u32 sid;
2410                 size_t len;
2411
2412                 if (flags[i] == SE_SBLABELSUPP)
2413                         continue;
2414                 len = strlen(mount_options[i]);
2415                 rc = security_context_to_sid(mount_options[i], len, &sid);
2416                 if (rc) {
2417                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2418                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2419                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2420                         goto out_free_opts;
2421                 }
2422                 rc = -EINVAL;
2423                 switch (flags[i]) {
2424                 case FSCONTEXT_MNT:
2425                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2426                                 goto out_bad_option;
2427                         break;
2428                 case CONTEXT_MNT:
2429                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2430                                 goto out_bad_option;
2431                         break;
2432                 case ROOTCONTEXT_MNT: {
2433                         struct inode_security_struct *root_isec;
2434                         root_isec = sb->s_root->d_inode->i_security;
2435
2436                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2437                                 goto out_bad_option;
2438                         break;
2439                 }
2440                 case DEFCONTEXT_MNT:
2441                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2442                                 goto out_bad_option;
2443                         break;
2444                 default:
2445                         goto out_free_opts;
2446                 }
2447         }
2448
2449         rc = 0;
2450 out_free_opts:
2451         security_free_mnt_opts(&opts);
2452 out_free_secdata:
2453         free_secdata(secdata);
2454         return rc;
2455 out_bad_option:
2456         printk(KERN_WARNING "SELinux: unable to change security options "
2457                "during remount (dev %s, type=%s)\n", sb->s_id,
2458                sb->s_type->name);
2459         goto out_free_opts;
2460 }
2461
2462 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2463 {
2464         const struct cred *cred = current_cred();
2465         struct common_audit_data ad;
2466         int rc;
2467
2468         rc = superblock_doinit(sb, data);
2469         if (rc)
2470                 return rc;
2471
2472         /* Allow all mounts performed by the kernel */
2473         if (flags & MS_KERNMOUNT)
2474                 return 0;
2475
2476         ad.type = LSM_AUDIT_DATA_DENTRY;
2477         ad.u.dentry = sb->s_root;
2478         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2479 }
2480
2481 static int selinux_sb_statfs(struct dentry *dentry)
2482 {
2483         const struct cred *cred = current_cred();
2484         struct common_audit_data ad;
2485
2486         ad.type = LSM_AUDIT_DATA_DENTRY;
2487         ad.u.dentry = dentry->d_sb->s_root;
2488         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2489 }
2490
2491 static int selinux_mount(const char *dev_name,
2492                          struct path *path,
2493                          const char *type,
2494                          unsigned long flags,
2495                          void *data)
2496 {
2497         const struct cred *cred = current_cred();
2498
2499         if (flags & MS_REMOUNT)
2500                 return superblock_has_perm(cred, path->dentry->d_sb,
2501                                            FILESYSTEM__REMOUNT, NULL);
2502         else
2503                 return path_has_perm(cred, path, FILE__MOUNTON);
2504 }
2505
2506 static int selinux_umount(struct vfsmount *mnt, int flags)
2507 {
2508         const struct cred *cred = current_cred();
2509
2510         return superblock_has_perm(cred, mnt->mnt_sb,
2511                                    FILESYSTEM__UNMOUNT, NULL);
2512 }
2513
2514 /* inode security operations */
2515
2516 static int selinux_inode_alloc_security(struct inode *inode)
2517 {
2518         return inode_alloc_security(inode);
2519 }
2520
2521 static void selinux_inode_free_security(struct inode *inode)
2522 {
2523         inode_free_security(inode);
2524 }
2525
2526 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2527                                        const struct qstr *qstr, char **name,
2528                                        void **value, size_t *len)
2529 {
2530         const struct task_security_struct *tsec = current_security();
2531         struct inode_security_struct *dsec;
2532         struct superblock_security_struct *sbsec;
2533         u32 sid, newsid, clen;
2534         int rc;
2535         char *namep = NULL, *context;
2536
2537         dsec = dir->i_security;
2538         sbsec = dir->i_sb->s_security;
2539
2540         sid = tsec->sid;
2541         newsid = tsec->create_sid;
2542
2543         if ((sbsec->flags & SE_SBINITIALIZED) &&
2544             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2545                 newsid = sbsec->mntpoint_sid;
2546         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2547                 rc = security_transition_sid(sid, dsec->sid,
2548                                              inode_mode_to_security_class(inode->i_mode),
2549                                              qstr, &newsid);
2550                 if (rc) {
2551                         printk(KERN_WARNING "%s:  "
2552                                "security_transition_sid failed, rc=%d (dev=%s "
2553                                "ino=%ld)\n",
2554                                __func__,
2555                                -rc, inode->i_sb->s_id, inode->i_ino);
2556                         return rc;
2557                 }
2558         }
2559
2560         /* Possibly defer initialization to selinux_complete_init. */
2561         if (sbsec->flags & SE_SBINITIALIZED) {
2562                 struct inode_security_struct *isec = inode->i_security;
2563                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2564                 isec->sid = newsid;
2565                 isec->initialized = 1;
2566         }
2567
2568         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2569                 return -EOPNOTSUPP;
2570
2571         if (name) {
2572                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2573                 if (!namep)
2574                         return -ENOMEM;
2575                 *name = namep;
2576         }
2577
2578         if (value && len) {
2579                 rc = security_sid_to_context_force(newsid, &context, &clen);
2580                 if (rc) {
2581                         kfree(namep);
2582                         return rc;
2583                 }
2584                 *value = context;
2585                 *len = clen;
2586         }
2587
2588         return 0;
2589 }
2590
2591 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2592 {
2593         return may_create(dir, dentry, SECCLASS_FILE);
2594 }
2595
2596 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2597 {
2598         return may_link(dir, old_dentry, MAY_LINK);
2599 }
2600
2601 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2602 {
2603         return may_link(dir, dentry, MAY_UNLINK);
2604 }
2605
2606 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2607 {
2608         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2609 }
2610
2611 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2612 {
2613         return may_create(dir, dentry, SECCLASS_DIR);
2614 }
2615
2616 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2617 {
2618         return may_link(dir, dentry, MAY_RMDIR);
2619 }
2620
2621 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2622 {
2623         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2624 }
2625
2626 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2627                                 struct inode *new_inode, struct dentry *new_dentry)
2628 {
2629         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2630 }
2631
2632 static int selinux_inode_readlink(struct dentry *dentry)
2633 {
2634         const struct cred *cred = current_cred();
2635
2636         return dentry_has_perm(cred, dentry, FILE__READ);
2637 }
2638
2639 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2640 {
2641         const struct cred *cred = current_cred();
2642
2643         return dentry_has_perm(cred, dentry, FILE__READ);
2644 }
2645
2646 static noinline int audit_inode_permission(struct inode *inode,
2647                                            u32 perms, u32 audited, u32 denied,
2648                                            unsigned flags)
2649 {
2650         struct common_audit_data ad;
2651         struct inode_security_struct *isec = inode->i_security;
2652         int rc;
2653
2654         ad.type = LSM_AUDIT_DATA_INODE;
2655         ad.u.inode = inode;
2656
2657         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2658                             audited, denied, &ad, flags);
2659         if (rc)
2660                 return rc;
2661         return 0;
2662 }
2663
2664 static int selinux_inode_permission(struct inode *inode, int mask)
2665 {
2666         const struct cred *cred = current_cred();
2667         u32 perms;
2668         bool from_access;
2669         unsigned flags = mask & MAY_NOT_BLOCK;
2670         struct inode_security_struct *isec;
2671         u32 sid;
2672         struct av_decision avd;
2673         int rc, rc2;
2674         u32 audited, denied;
2675
2676         from_access = mask & MAY_ACCESS;
2677         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2678
2679         /* No permission to check.  Existence test. */
2680         if (!mask)
2681                 return 0;
2682
2683         validate_creds(cred);
2684
2685         if (unlikely(IS_PRIVATE(inode)))
2686                 return 0;
2687
2688         perms = file_mask_to_av(inode->i_mode, mask);
2689
2690         sid = cred_sid(cred);
2691         isec = inode->i_security;
2692
2693         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2694         audited = avc_audit_required(perms, &avd, rc,
2695                                      from_access ? FILE__AUDIT_ACCESS : 0,
2696                                      &denied);
2697         if (likely(!audited))
2698                 return rc;
2699
2700         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2701         if (rc2)
2702                 return rc2;
2703         return rc;
2704 }
2705
2706 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2707 {
2708         const struct cred *cred = current_cred();
2709         unsigned int ia_valid = iattr->ia_valid;
2710         __u32 av = FILE__WRITE;
2711
2712         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2713         if (ia_valid & ATTR_FORCE) {
2714                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2715                               ATTR_FORCE);
2716                 if (!ia_valid)
2717                         return 0;
2718         }
2719
2720         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2721                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2722                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2723
2724         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2725                 av |= FILE__OPEN;
2726
2727         return dentry_has_perm(cred, dentry, av);
2728 }
2729
2730 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2731 {
2732         const struct cred *cred = current_cred();
2733         struct path path;
2734
2735         path.dentry = dentry;
2736         path.mnt = mnt;
2737
2738         return path_has_perm(cred, &path, FILE__GETATTR);
2739 }
2740
2741 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2742 {
2743         const struct cred *cred = current_cred();
2744
2745         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2746                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2747                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2748                         if (!capable(CAP_SETFCAP))
2749                                 return -EPERM;
2750                 } else if (!capable(CAP_SYS_ADMIN)) {
2751                         /* A different attribute in the security namespace.
2752                            Restrict to administrator. */
2753                         return -EPERM;
2754                 }
2755         }
2756
2757         /* Not an attribute we recognize, so just check the
2758            ordinary setattr permission. */
2759         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2760 }
2761
2762 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2763                                   const void *value, size_t size, int flags)
2764 {
2765         struct inode *inode = dentry->d_inode;
2766         struct inode_security_struct *isec = inode->i_security;
2767         struct superblock_security_struct *sbsec;
2768         struct common_audit_data ad;
2769         u32 newsid, sid = current_sid();
2770         int rc = 0;
2771
2772         if (strcmp(name, XATTR_NAME_SELINUX))
2773                 return selinux_inode_setotherxattr(dentry, name);
2774
2775         sbsec = inode->i_sb->s_security;
2776         if (!(sbsec->flags & SE_SBLABELSUPP))
2777                 return -EOPNOTSUPP;
2778
2779         if (!inode_owner_or_capable(inode))
2780                 return -EPERM;
2781
2782         ad.type = LSM_AUDIT_DATA_DENTRY;
2783         ad.u.dentry = dentry;
2784
2785         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2786                           FILE__RELABELFROM, &ad);
2787         if (rc)
2788                 return rc;
2789
2790         rc = security_context_to_sid(value, size, &newsid);
2791         if (rc == -EINVAL) {
2792                 if (!capable(CAP_MAC_ADMIN)) {
2793                         struct audit_buffer *ab;
2794                         size_t audit_size;
2795                         const char *str;
2796
2797                         /* We strip a nul only if it is at the end, otherwise the
2798                          * context contains a nul and we should audit that */
2799                         if (value) {
2800                                 str = value;
2801                                 if (str[size - 1] == '\0')
2802                                         audit_size = size - 1;
2803                                 else
2804                                         audit_size = size;
2805                         } else {
2806                                 str = "";
2807                                 audit_size = 0;
2808                         }
2809                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2810                         audit_log_format(ab, "op=setxattr invalid_context=");
2811                         audit_log_n_untrustedstring(ab, value, audit_size);
2812                         audit_log_end(ab);
2813
2814                         return rc;
2815                 }
2816                 rc = security_context_to_sid_force(value, size, &newsid);
2817         }
2818         if (rc)
2819                 return rc;
2820
2821         rc = avc_has_perm(sid, newsid, isec->sclass,
2822                           FILE__RELABELTO, &ad);
2823         if (rc)
2824                 return rc;
2825
2826         rc = security_validate_transition(isec->sid, newsid, sid,
2827                                           isec->sclass);
2828         if (rc)
2829                 return rc;
2830
2831         return avc_has_perm(newsid,
2832                             sbsec->sid,
2833                             SECCLASS_FILESYSTEM,
2834                             FILESYSTEM__ASSOCIATE,
2835                             &ad);
2836 }
2837
2838 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2839                                         const void *value, size_t size,
2840                                         int flags)
2841 {
2842         struct inode *inode = dentry->d_inode;
2843         struct inode_security_struct *isec = inode->i_security;
2844         u32 newsid;
2845         int rc;
2846
2847         if (strcmp(name, XATTR_NAME_SELINUX)) {
2848                 /* Not an attribute we recognize, so nothing to do. */
2849                 return;
2850         }
2851
2852         rc = security_context_to_sid_force(value, size, &newsid);
2853         if (rc) {
2854                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2855                        "for (%s, %lu), rc=%d\n",
2856                        inode->i_sb->s_id, inode->i_ino, -rc);
2857                 return;
2858         }
2859
2860         isec->sid = newsid;
2861         return;
2862 }
2863
2864 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2865 {
2866         const struct cred *cred = current_cred();
2867
2868         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2869 }
2870
2871 static int selinux_inode_listxattr(struct dentry *dentry)
2872 {
2873         const struct cred *cred = current_cred();
2874
2875         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2876 }
2877
2878 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2879 {
2880         if (strcmp(name, XATTR_NAME_SELINUX))
2881                 return selinux_inode_setotherxattr(dentry, name);
2882
2883         /* No one is allowed to remove a SELinux security label.
2884            You can change the label, but all data must be labeled. */
2885         return -EACCES;
2886 }
2887
2888 /*
2889  * Copy the inode security context value to the user.
2890  *
2891  * Permission check is handled by selinux_inode_getxattr hook.
2892  */
2893 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2894 {
2895         u32 size;
2896         int error;
2897         char *context = NULL;
2898         struct inode_security_struct *isec = inode->i_security;
2899
2900         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2901                 return -EOPNOTSUPP;
2902
2903         /*
2904          * If the caller has CAP_MAC_ADMIN, then get the raw context
2905          * value even if it is not defined by current policy; otherwise,
2906          * use the in-core value under current policy.
2907          * Use the non-auditing forms of the permission checks since
2908          * getxattr may be called by unprivileged processes commonly
2909          * and lack of permission just means that we fall back to the
2910          * in-core context value, not a denial.
2911          */
2912         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2913                                 SECURITY_CAP_NOAUDIT);
2914         if (!error)
2915                 error = security_sid_to_context_force(isec->sid, &context,
2916                                                       &size);
2917         else
2918                 error = security_sid_to_context(isec->sid, &context, &size);
2919         if (error)
2920                 return error;
2921         error = size;
2922         if (alloc) {
2923                 *buffer = context;
2924                 goto out_nofree;
2925         }
2926         kfree(context);
2927 out_nofree:
2928         return error;
2929 }
2930
2931 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2932                                      const void *value, size_t size, int flags)
2933 {
2934         struct inode_security_struct *isec = inode->i_security;
2935         u32 newsid;
2936         int rc;
2937
2938         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2939                 return -EOPNOTSUPP;
2940
2941         if (!value || !size)
2942                 return -EACCES;
2943
2944         rc = security_context_to_sid((void *)value, size, &newsid);
2945         if (rc)
2946                 return rc;
2947
2948         isec->sid = newsid;
2949         isec->initialized = 1;
2950         return 0;
2951 }
2952
2953 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2954 {
2955         const int len = sizeof(XATTR_NAME_SELINUX);
2956         if (buffer && len <= buffer_size)
2957                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2958         return len;
2959 }
2960
2961 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2962 {
2963         struct inode_security_struct *isec = inode->i_security;
2964         *secid = isec->sid;
2965 }
2966
2967 /* file security operations */
2968
2969 static int selinux_revalidate_file_permission(struct file *file, int mask)
2970 {
2971         const struct cred *cred = current_cred();
2972         struct inode *inode = file_inode(file);
2973
2974         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2975         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2976                 mask |= MAY_APPEND;
2977
2978         return file_has_perm(cred, file,
2979                              file_mask_to_av(inode->i_mode, mask));
2980 }
2981
2982 static int selinux_file_permission(struct file *file, int mask)
2983 {
2984         struct inode *inode = file_inode(file);
2985         struct file_security_struct *fsec = file->f_security;
2986         struct inode_security_struct *isec = inode->i_security;
2987         u32 sid = current_sid();
2988
2989         if (!mask)
2990                 /* No permission to check.  Existence test. */
2991                 return 0;
2992
2993         if (sid == fsec->sid && fsec->isid == isec->sid &&
2994             fsec->pseqno == avc_policy_seqno())
2995                 /* No change since file_open check. */
2996                 return 0;
2997
2998         return selinux_revalidate_file_permission(file, mask);
2999 }
3000
3001 static int selinux_file_alloc_security(struct file *file)
3002 {
3003         return file_alloc_security(file);
3004 }
3005
3006 static void selinux_file_free_security(struct file *file)
3007 {
3008         file_free_security(file);
3009 }
3010
3011 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3012                               unsigned long arg)
3013 {
3014         const struct cred *cred = current_cred();
3015         int error = 0;
3016
3017         switch (cmd) {
3018         case FIONREAD:
3019         /* fall through */
3020         case FIBMAP:
3021         /* fall through */
3022         case FIGETBSZ:
3023         /* fall through */
3024         case FS_IOC_GETFLAGS:
3025         /* fall through */
3026         case FS_IOC_GETVERSION:
3027                 error = file_has_perm(cred, file, FILE__GETATTR);
3028                 break;
3029
3030         case FS_IOC_SETFLAGS:
3031         /* fall through */
3032         case FS_IOC_SETVERSION:
3033                 error = file_has_perm(cred, file, FILE__SETATTR);
3034                 break;
3035
3036         /* sys_ioctl() checks */
3037         case FIONBIO:
3038         /* fall through */
3039         case FIOASYNC:
3040                 error = file_has_perm(cred, file, 0);
3041                 break;
3042
3043         case KDSKBENT:
3044         case KDSKBSENT:
3045                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3046                                             SECURITY_CAP_AUDIT);
3047                 break;
3048
3049         /* default case assumes that the command will go
3050          * to the file's ioctl() function.
3051          */
3052         default:
3053                 error = file_has_perm(cred, file, FILE__IOCTL);
3054         }
3055         return error;
3056 }
3057
3058 static int default_noexec;
3059
3060 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3061 {
3062         const struct cred *cred = current_cred();
3063         int rc = 0;
3064
3065         if (default_noexec &&
3066             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3067                 /*
3068                  * We are making executable an anonymous mapping or a
3069                  * private file mapping that will also be writable.
3070                  * This has an additional check.
3071                  */
3072                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3073                 if (rc)
3074                         goto error;
3075         }
3076
3077         if (file) {
3078                 /* read access is always possible with a mapping */
3079                 u32 av = FILE__READ;
3080
3081                 /* write access only matters if the mapping is shared */
3082                 if (shared && (prot & PROT_WRITE))
3083                         av |= FILE__WRITE;
3084
3085                 if (prot & PROT_EXEC)
3086                         av |= FILE__EXECUTE;
3087
3088                 return file_has_perm(cred, file, av);
3089         }
3090
3091 error:
3092         return rc;
3093 }
3094
3095 static int selinux_mmap_addr(unsigned long addr)
3096 {
3097         int rc = 0;
3098         u32 sid = current_sid();
3099
3100         /*
3101          * notice that we are intentionally putting the SELinux check before
3102          * the secondary cap_file_mmap check.  This is such a likely attempt
3103          * at bad behaviour/exploit that we always want to get the AVC, even
3104          * if DAC would have also denied the operation.
3105          */
3106         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3107                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3108                                   MEMPROTECT__MMAP_ZERO, NULL);
3109                 if (rc)
3110                         return rc;
3111         }
3112
3113         /* do DAC check on address space usage */
3114         return cap_mmap_addr(addr);
3115 }
3116
3117 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3118                              unsigned long prot, unsigned long flags)
3119 {
3120         if (selinux_checkreqprot)
3121                 prot = reqprot;
3122
3123         return file_map_prot_check(file, prot,
3124                                    (flags & MAP_TYPE) == MAP_SHARED);
3125 }
3126
3127 static int selinux_file_mprotect(struct vm_area_struct *vma,
3128                                  unsigned long reqprot,
3129                                  unsigned long prot)
3130 {
3131         const struct cred *cred = current_cred();
3132
3133         if (selinux_checkreqprot)
3134                 prot = reqprot;
3135
3136         if (default_noexec &&
3137             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3138                 int rc = 0;
3139                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3140                     vma->vm_end <= vma->vm_mm->brk) {
3141                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3142                 } else if (!vma->vm_file &&
3143                            vma->vm_start <= vma->vm_mm->start_stack &&
3144                            vma->vm_end >= vma->vm_mm->start_stack) {
3145                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3146                 } else if (vma->vm_file && vma->anon_vma) {
3147                         /*
3148                          * We are making executable a file mapping that has
3149                          * had some COW done. Since pages might have been
3150                          * written, check ability to execute the possibly
3151                          * modified content.  This typically should only
3152                          * occur for text relocations.
3153                          */
3154                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3155                 }
3156                 if (rc)
3157                         return rc;
3158         }
3159
3160         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3161 }
3162
3163 static int selinux_file_lock(struct file *file, unsigned int cmd)
3164 {
3165         const struct cred *cred = current_cred();
3166
3167         return file_has_perm(cred, file, FILE__LOCK);
3168 }
3169
3170 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3171                               unsigned long arg)
3172 {
3173         const struct cred *cred = current_cred();
3174         int err = 0;
3175
3176         switch (cmd) {
3177         case F_SETFL:
3178                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3179                         err = file_has_perm(cred, file, FILE__WRITE);
3180                         break;
3181                 }
3182                 /* fall through */
3183         case F_SETOWN:
3184         case F_SETSIG:
3185         case F_GETFL:
3186         case F_GETOWN:
3187         case F_GETSIG:
3188         case F_GETOWNER_UIDS:
3189                 /* Just check FD__USE permission */
3190                 err = file_has_perm(cred, file, 0);
3191                 break;
3192         case F_GETLK:
3193         case F_SETLK:
3194         case F_SETLKW:
3195 #if BITS_PER_LONG == 32
3196         case F_GETLK64:
3197         case F_SETLK64:
3198         case F_SETLKW64:
3199 #endif
3200                 err = file_has_perm(cred, file, FILE__LOCK);
3201                 break;
3202         }
3203
3204         return err;
3205 }
3206
3207 static int selinux_file_set_fowner(struct file *file)
3208 {
3209         struct file_security_struct *fsec;
3210
3211         fsec = file->f_security;
3212         fsec->fown_sid = current_sid();
3213
3214         return 0;
3215 }
3216
3217 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3218                                        struct fown_struct *fown, int signum)
3219 {
3220         struct file *file;
3221         u32 sid = task_sid(tsk);
3222         u32 perm;
3223         struct file_security_struct *fsec;
3224
3225         /* struct fown_struct is never outside the context of a struct file */
3226         file = container_of(fown, struct file, f_owner);
3227
3228         fsec = file->f_security;
3229
3230         if (!signum)
3231                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3232         else
3233                 perm = signal_to_av(signum);
3234
3235         return avc_has_perm(fsec->fown_sid, sid,
3236                             SECCLASS_PROCESS, perm, NULL);
3237 }
3238
3239 static int selinux_file_receive(struct file *file)
3240 {
3241         const struct cred *cred = current_cred();
3242
3243         return file_has_perm(cred, file, file_to_av(file));
3244 }
3245
3246 static int selinux_file_open(struct file *file, const struct cred *cred)
3247 {
3248         struct file_security_struct *fsec;
3249         struct inode_security_struct *isec;
3250
3251         fsec = file->f_security;
3252         isec = file_inode(file)->i_security;
3253         /*
3254          * Save inode label and policy sequence number
3255          * at open-time so that selinux_file_permission
3256          * can determine whether revalidation is necessary.
3257          * Task label is already saved in the file security
3258          * struct as its SID.
3259          */
3260         fsec->isid = isec->sid;
3261         fsec->pseqno = avc_policy_seqno();
3262         /*
3263          * Since the inode label or policy seqno may have changed
3264          * between the selinux_inode_permission check and the saving
3265          * of state above, recheck that access is still permitted.
3266          * Otherwise, access might never be revalidated against the
3267          * new inode label or new policy.
3268          * This check is not redundant - do not remove.
3269          */
3270         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3271 }
3272
3273 /* task security operations */
3274
3275 static int selinux_task_create(unsigned long clone_flags)
3276 {
3277         return current_has_perm(current, PROCESS__FORK);
3278 }
3279
3280 /*
3281  * allocate the SELinux part of blank credentials
3282  */
3283 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3284 {
3285         struct task_security_struct *tsec;
3286
3287         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3288         if (!tsec)
3289                 return -ENOMEM;
3290
3291         cred->security = tsec;
3292         return 0;
3293 }
3294
3295 /*
3296  * detach and free the LSM part of a set of credentials
3297  */
3298 static void selinux_cred_free(struct cred *cred)
3299 {
3300         struct task_security_struct *tsec = cred->security;
3301
3302         /*
3303          * cred->security == NULL if security_cred_alloc_blank() or
3304          * security_prepare_creds() returned an error.
3305          */
3306         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3307         cred->security = (void *) 0x7UL;
3308         kfree(tsec);
3309 }
3310
3311 /*
3312  * prepare a new set of credentials for modification
3313  */
3314 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3315                                 gfp_t gfp)
3316 {
3317         const struct task_security_struct *old_tsec;
3318         struct task_security_struct *tsec;
3319
3320         old_tsec = old->security;
3321
3322         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3323         if (!tsec)
3324                 return -ENOMEM;
3325
3326         new->security = tsec;
3327         return 0;
3328 }
3329
3330 /*
3331  * transfer the SELinux data to a blank set of creds
3332  */
3333 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3334 {
3335         const struct task_security_struct *old_tsec = old->security;
3336         struct task_security_struct *tsec = new->security;
3337
3338         *tsec = *old_tsec;
3339 }
3340
3341 /*
3342  * set the security data for a kernel service
3343  * - all the creation contexts are set to unlabelled
3344  */
3345 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3346 {
3347         struct task_security_struct *tsec = new->security;
3348         u32 sid = current_sid();
3349         int ret;
3350
3351         ret = avc_has_perm(sid, secid,
3352                            SECCLASS_KERNEL_SERVICE,
3353                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3354                            NULL);
3355         if (ret == 0) {
3356                 tsec->sid = secid;
3357                 tsec->create_sid = 0;
3358                 tsec->keycreate_sid = 0;
3359                 tsec->sockcreate_sid = 0;
3360         }
3361         return ret;
3362 }
3363
3364 /*
3365  * set the file creation context in a security record to the same as the
3366  * objective context of the specified inode
3367  */
3368 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3369 {
3370         struct inode_security_struct *isec = inode->i_security;
3371         struct task_security_struct *tsec = new->security;
3372         u32 sid = current_sid();
3373         int ret;
3374
3375         ret = avc_has_perm(sid, isec->sid,
3376                            SECCLASS_KERNEL_SERVICE,
3377                            KERNEL_SERVICE__CREATE_FILES_AS,
3378                            NULL);
3379
3380         if (ret == 0)
3381                 tsec->create_sid = isec->sid;
3382         return ret;
3383 }
3384
3385 static int selinux_kernel_module_request(char *kmod_name)
3386 {
3387         u32 sid;
3388         struct common_audit_data ad;
3389
3390         sid = task_sid(current);
3391
3392         ad.type = LSM_AUDIT_DATA_KMOD;
3393         ad.u.kmod_name = kmod_name;
3394
3395         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3396                             SYSTEM__MODULE_REQUEST, &ad);
3397 }
3398
3399 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3400 {
3401         return current_has_perm(p, PROCESS__SETPGID);
3402 }
3403
3404 static int selinux_task_getpgid(struct task_struct *p)
3405 {
3406         return current_has_perm(p, PROCESS__GETPGID);
3407 }
3408
3409 static int selinux_task_getsid(struct task_struct *p)
3410 {
3411         return current_has_perm(p, PROCESS__GETSESSION);
3412 }
3413
3414 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3415 {
3416         *secid = task_sid(p);
3417 }
3418
3419 static int selinux_task_setnice(struct task_struct *p, int nice)
3420 {
3421         int rc;
3422
3423         rc = cap_task_setnice(p, nice);
3424         if (rc)
3425                 return rc;
3426
3427         return current_has_perm(p, PROCESS__SETSCHED);
3428 }
3429
3430 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3431 {
3432         int rc;
3433
3434         rc = cap_task_setioprio(p, ioprio);
3435         if (rc)
3436                 return rc;
3437
3438         return current_has_perm(p, PROCESS__SETSCHED);
3439 }
3440
3441 static int selinux_task_getioprio(struct task_struct *p)
3442 {
3443         return current_has_perm(p, PROCESS__GETSCHED);
3444 }
3445
3446 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3447                 struct rlimit *new_rlim)
3448 {
3449         struct rlimit *old_rlim = p->signal->rlim + resource;
3450
3451         /* Control the ability to change the hard limit (whether
3452            lowering or raising it), so that the hard limit can
3453            later be used as a safe reset point for the soft limit
3454            upon context transitions.  See selinux_bprm_committing_creds. */
3455         if (old_rlim->rlim_max != new_rlim->rlim_max)
3456                 return current_has_perm(p, PROCESS__SETRLIMIT);
3457
3458         return 0;
3459 }
3460
3461 static int selinux_task_setscheduler(struct task_struct *p)
3462 {
3463         int rc;
3464
3465         rc = cap_task_setscheduler(p);
3466         if (rc)
3467                 return rc;
3468
3469         return current_has_perm(p, PROCESS__SETSCHED);
3470 }
3471
3472 static int selinux_task_getscheduler(struct task_struct *p)
3473 {
3474         return current_has_perm(p, PROCESS__GETSCHED);
3475 }
3476
3477 static int selinux_task_movememory(struct task_struct *p)
3478 {
3479         return current_has_perm(p, PROCESS__SETSCHED);
3480 }
3481
3482 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3483                                 int sig, u32 secid)
3484 {
3485         u32 perm;
3486         int rc;
3487
3488         if (!sig)
3489                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3490         else
3491                 perm = signal_to_av(sig);
3492         if (secid)
3493                 rc = avc_has_perm(secid, task_sid(p),
3494                                   SECCLASS_PROCESS, perm, NULL);
3495         else
3496                 rc = current_has_perm(p, perm);
3497         return rc;
3498 }
3499
3500 static int selinux_task_wait(struct task_struct *p)
3501 {
3502         return task_has_perm(p, current, PROCESS__SIGCHLD);
3503 }
3504
3505 static void selinux_task_to_inode(struct task_struct *p,
3506                                   struct inode *inode)
3507 {
3508         struct inode_security_struct *isec = inode->i_security;
3509         u32 sid = task_sid(p);
3510
3511         isec->sid = sid;
3512         isec->initialized = 1;
3513 }
3514
3515 /* Returns error only if unable to parse addresses */
3516 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3517                         struct common_audit_data *ad, u8 *proto)
3518 {
3519         int offset, ihlen, ret = -EINVAL;
3520         struct iphdr _iph, *ih;
3521
3522         offset = skb_network_offset(skb);
3523         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3524         if (ih == NULL)
3525                 goto out;
3526
3527         ihlen = ih->ihl * 4;
3528         if (ihlen < sizeof(_iph))
3529                 goto out;
3530
3531         ad->u.net->v4info.saddr = ih->saddr;
3532         ad->u.net->v4info.daddr = ih->daddr;
3533         ret = 0;
3534
3535         if (proto)
3536                 *proto = ih->protocol;
3537
3538         switch (ih->protocol) {
3539         case IPPROTO_TCP: {
3540                 struct tcphdr _tcph, *th;
3541
3542                 if (ntohs(ih->frag_off) & IP_OFFSET)
3543                         break;
3544
3545                 offset += ihlen;
3546                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3547                 if (th == NULL)
3548                         break;
3549
3550                 ad->u.net->sport = th->source;
3551                 ad->u.net->dport = th->dest;
3552                 break;
3553         }
3554
3555         case IPPROTO_UDP: {
3556                 struct udphdr _udph, *uh;
3557
3558                 if (ntohs(ih->frag_off) & IP_OFFSET)
3559                         break;
3560
3561                 offset += ihlen;
3562                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3563                 if (uh == NULL)
3564                         break;
3565
3566                 ad->u.net->sport = uh->source;
3567                 ad->u.net->dport = uh->dest;
3568                 break;
3569         }
3570
3571         case IPPROTO_DCCP: {
3572                 struct dccp_hdr _dccph, *dh;
3573
3574                 if (ntohs(ih->frag_off) & IP_OFFSET)
3575                         break;
3576
3577                 offset += ihlen;
3578                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3579                 if (dh == NULL)
3580                         break;
3581
3582                 ad->u.net->sport = dh->dccph_sport;
3583                 ad->u.net->dport = dh->dccph_dport;
3584                 break;
3585         }
3586
3587         default:
3588                 break;
3589         }
3590 out:
3591         return ret;
3592 }
3593
3594 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3595
3596 /* Returns error only if unable to parse addresses */
3597 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3598                         struct common_audit_data *ad, u8 *proto)
3599 {
3600         u8 nexthdr;
3601         int ret = -EINVAL, offset;
3602         struct ipv6hdr _ipv6h, *ip6;
3603         __be16 frag_off;
3604
3605         offset = skb_network_offset(skb);
3606         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3607         if (ip6 == NULL)
3608                 goto out;
3609
3610         ad->u.net->v6info.saddr = ip6->saddr;
3611         ad->u.net->v6info.daddr = ip6->daddr;
3612         ret = 0;
3613
3614         nexthdr = ip6->nexthdr;
3615         offset += sizeof(_ipv6h);
3616         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3617         if (offset < 0)
3618                 goto out;
3619
3620         if (proto)
3621                 *proto = nexthdr;
3622
3623         switch (nexthdr) {
3624         case IPPROTO_TCP: {
3625                 struct tcphdr _tcph, *th;
3626
3627                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3628                 if (th == NULL)
3629                         break;
3630
3631                 ad->u.net->sport = th->source;
3632                 ad->u.net->dport = th->dest;
3633                 break;
3634         }
3635
3636         case IPPROTO_UDP: {
3637                 struct udphdr _udph, *uh;
3638
3639                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3640                 if (uh == NULL)
3641                         break;
3642
3643                 ad->u.net->sport = uh->source;
3644                 ad->u.net->dport = uh->dest;
3645                 break;
3646         }
3647
3648         case IPPROTO_DCCP: {
3649                 struct dccp_hdr _dccph, *dh;
3650
3651                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3652                 if (dh == NULL)
3653                         break;
3654
3655                 ad->u.net->sport = dh->dccph_sport;
3656                 ad->u.net->dport = dh->dccph_dport;
3657                 break;
3658         }
3659
3660         /* includes fragments */
3661         default:
3662                 break;
3663         }
3664 out:
3665         return ret;
3666 }
3667
3668 #endif /* IPV6 */
3669
3670 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3671                              char **_addrp, int src, u8 *proto)
3672 {
3673         char *addrp;
3674         int ret;
3675
3676         switch (ad->u.net->family) {
3677         case PF_INET:
3678                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3679                 if (ret)
3680                         goto parse_error;
3681                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3682                                        &ad->u.net->v4info.daddr);
3683                 goto okay;
3684
3685 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3686         case PF_INET6:
3687                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3688                 if (ret)
3689                         goto parse_error;
3690                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3691                                        &ad->u.net->v6info.daddr);
3692                 goto okay;
3693 #endif  /* IPV6 */
3694         default:
3695                 addrp = NULL;
3696                 goto okay;
3697         }
3698
3699 parse_error:
3700         printk(KERN_WARNING
3701                "SELinux: failure in selinux_parse_skb(),"
3702                " unable to parse packet\n");
3703         return ret;
3704
3705 okay:
3706         if (_addrp)
3707                 *_addrp = addrp;
3708         return 0;
3709 }
3710
3711 /**
3712  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3713  * @skb: the packet
3714  * @family: protocol family
3715  * @sid: the packet's peer label SID
3716  *
3717  * Description:
3718  * Check the various different forms of network peer labeling and determine
3719  * the peer label/SID for the packet; most of the magic actually occurs in
3720  * the security server function security_net_peersid_cmp().  The function
3721  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3722  * or -EACCES if @sid is invalid due to inconsistencies with the different
3723  * peer labels.
3724  *
3725  */
3726 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3727 {
3728         int err;
3729         u32 xfrm_sid;
3730         u32 nlbl_sid;
3731         u32 nlbl_type;
3732
3733         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3734         if (unlikely(err))
3735                 return -EACCES;
3736         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3737         if (unlikely(err))
3738                 return -EACCES;
3739
3740         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3741         if (unlikely(err)) {
3742                 printk(KERN_WARNING
3743                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3744                        " unable to determine packet's peer label\n");
3745                 return -EACCES;
3746         }
3747
3748         return 0;
3749 }
3750
3751 /* socket security operations */
3752
3753 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3754                                  u16 secclass, u32 *socksid)
3755 {
3756         if (tsec->sockcreate_sid > SECSID_NULL) {
3757                 *socksid = tsec->sockcreate_sid;
3758                 return 0;
3759         }
3760
3761         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3762                                        socksid);
3763 }
3764
3765 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3766 {
3767         struct sk_security_struct *sksec = sk->sk_security;
3768         struct common_audit_data ad;
3769         struct lsm_network_audit net = {0,};
3770         u32 tsid = task_sid(task);
3771
3772         if (sksec->sid == SECINITSID_KERNEL)
3773                 return 0;
3774
3775         ad.type = LSM_AUDIT_DATA_NET;
3776         ad.u.net = &net;
3777         ad.u.net->sk = sk;
3778
3779         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3780 }
3781
3782 static int selinux_socket_create(int family, int type,
3783                                  int protocol, int kern)
3784 {
3785         const struct task_security_struct *tsec = current_security();
3786         u32 newsid;
3787         u16 secclass;
3788         int rc;
3789
3790         if (kern)
3791                 return 0;
3792
3793         secclass = socket_type_to_security_class(family, type, protocol);
3794         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3795         if (rc)
3796                 return rc;
3797
3798         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3799 }
3800
3801 static int selinux_socket_post_create(struct socket *sock, int family,
3802                                       int type, int protocol, int kern)
3803 {
3804         const struct task_security_struct *tsec = current_security();
3805         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3806         struct sk_security_struct *sksec;
3807         int err = 0;
3808
3809         isec->sclass = socket_type_to_security_class(family, type, protocol);
3810
3811         if (kern)
3812                 isec->sid = SECINITSID_KERNEL;
3813         else {
3814                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3815                 if (err)
3816                         return err;
3817         }
3818
3819         isec->initialized = 1;
3820
3821         if (sock->sk) {
3822                 sksec = sock->sk->sk_security;
3823                 sksec->sid = isec->sid;
3824                 sksec->sclass = isec->sclass;
3825                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3826         }
3827
3828         return err;
3829 }
3830
3831 /* Range of port numbers used to automatically bind.
3832    Need to determine whether we should perform a name_bind
3833    permission check between the socket and the port number. */
3834
3835 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3836 {
3837         struct sock *sk = sock->sk;
3838         u16 family;
3839         int err;
3840
3841         err = sock_has_perm(current, sk, SOCKET__BIND);
3842         if (err)
3843                 goto out;
3844
3845         /*
3846          * If PF_INET or PF_INET6, check name_bind permission for the port.
3847          * Multiple address binding for SCTP is not supported yet: we just
3848          * check the first address now.
3849          */
3850         family = sk->sk_family;
3851         if (family == PF_INET || family == PF_INET6) {
3852                 char *addrp;
3853                 struct sk_security_struct *sksec = sk->sk_security;
3854                 struct common_audit_data ad;
3855                 struct lsm_network_audit net = {0,};
3856                 struct sockaddr_in *addr4 = NULL;
3857                 struct sockaddr_in6 *addr6 = NULL;
3858                 unsigned short snum;
3859                 u32 sid, node_perm;
3860
3861                 if (family == PF_INET) {
3862                         addr4 = (struct sockaddr_in *)address;
3863                         snum = ntohs(addr4->sin_port);
3864                         addrp = (char *)&addr4->sin_addr.s_addr;
3865                 } else {
3866                         addr6 = (struct sockaddr_in6 *)address;
3867                         snum = ntohs(addr6->sin6_port);
3868                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3869                 }
3870
3871                 if (snum) {
3872                         int low, high;
3873
3874                         inet_get_local_port_range(&low, &high);
3875
3876                         if (snum < max(PROT_SOCK, low) || snum > high) {
3877                                 err = sel_netport_sid(sk->sk_protocol,
3878                                                       snum, &sid);
3879                                 if (err)
3880                                         goto out;
3881                                 ad.type = LSM_AUDIT_DATA_NET;
3882                                 ad.u.net = &net;
3883                                 ad.u.net->sport = htons(snum);
3884                                 ad.u.net->family = family;
3885                                 err = avc_has_perm(sksec->sid, sid,
3886                                                    sksec->sclass,
3887                                                    SOCKET__NAME_BIND, &ad);
3888                                 if (err)
3889                                         goto out;
3890                         }
3891                 }
3892
3893                 switch (sksec->sclass) {
3894                 case SECCLASS_TCP_SOCKET:
3895                         node_perm = TCP_SOCKET__NODE_BIND;
3896                         break;
3897
3898                 case SECCLASS_UDP_SOCKET:
3899                         node_perm = UDP_SOCKET__NODE_BIND;
3900                         break;
3901
3902                 case SECCLASS_DCCP_SOCKET:
3903                         node_perm = DCCP_SOCKET__NODE_BIND;
3904                         break;
3905
3906                 default:
3907                         node_perm = RAWIP_SOCKET__NODE_BIND;
3908                         break;
3909                 }
3910
3911                 err = sel_netnode_sid(addrp, family, &sid);
3912                 if (err)
3913                         goto out;
3914
3915                 ad.type = LSM_AUDIT_DATA_NET;
3916                 ad.u.net = &net;
3917                 ad.u.net->sport = htons(snum);
3918                 ad.u.net->family = family;
3919
3920                 if (family == PF_INET)
3921                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3922                 else
3923                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3924
3925                 err = avc_has_perm(sksec->sid, sid,
3926                                    sksec->sclass, node_perm, &ad);
3927                 if (err)
3928                         goto out;
3929         }
3930 out:
3931         return err;
3932 }
3933
3934 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3935 {
3936         struct sock *sk = sock->sk;
3937         struct sk_security_struct *sksec = sk->sk_security;
3938         int err;
3939
3940         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3941         if (err)
3942                 return err;
3943
3944         /*
3945          * If a TCP or DCCP socket, check name_connect permission for the port.
3946          */
3947         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3948             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3949                 struct common_audit_data ad;
3950                 struct lsm_network_audit net = {0,};
3951                 struct sockaddr_in *addr4 = NULL;
3952                 struct sockaddr_in6 *addr6 = NULL;
3953                 unsigned short snum;
3954                 u32 sid, perm;
3955
3956                 if (sk->sk_family == PF_INET) {
3957                         addr4 = (struct sockaddr_in *)address;
3958                         if (addrlen < sizeof(struct sockaddr_in))
3959                                 return -EINVAL;
3960                         snum = ntohs(addr4->sin_port);
3961                 } else {
3962                         addr6 = (struct sockaddr_in6 *)address;
3963                         if (addrlen < SIN6_LEN_RFC2133)
3964                                 return -EINVAL;
3965                         snum = ntohs(addr6->sin6_port);
3966                 }
3967
3968                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3969                 if (err)
3970                         goto out;
3971
3972                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3973                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3974
3975                 ad.type = LSM_AUDIT_DATA_NET;
3976                 ad.u.net = &net;
3977                 ad.u.net->dport = htons(snum);
3978                 ad.u.net->family = sk->sk_family;
3979                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3980                 if (err)
3981                         goto out;
3982         }
3983
3984         err = selinux_netlbl_socket_connect(sk, address);
3985
3986 out:
3987         return err;
3988 }
3989
3990 static int selinux_socket_listen(struct socket *sock, int backlog)
3991 {
3992         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3993 }
3994
3995 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3996 {
3997         int err;
3998         struct inode_security_struct *isec;
3999         struct inode_security_struct *newisec;
4000
4001         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4002         if (err)
4003                 return err;
4004
4005         newisec = SOCK_INODE(newsock)->i_security;
4006
4007         isec = SOCK_INODE(sock)->i_security;
4008         newisec->sclass = isec->sclass;
4009         newisec->sid = isec->sid;
4010         newisec->initialized = 1;
4011
4012         return 0;
4013 }
4014
4015 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4016                                   int size)
4017 {
4018         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4019 }
4020
4021 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4022                                   int size, int flags)
4023 {
4024         return sock_has_perm(current, sock->sk, SOCKET__READ);
4025 }
4026
4027 static int selinux_socket_getsockname(struct socket *sock)
4028 {
4029         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4030 }
4031
4032 static int selinux_socket_getpeername(struct socket *sock)
4033 {
4034         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4035 }
4036
4037 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4038 {
4039         int err;
4040
4041         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4042         if (err)
4043                 return err;
4044
4045         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4046 }
4047
4048 static int selinux_socket_getsockopt(struct socket *sock, int level,
4049                                      int optname)
4050 {
4051         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4052 }
4053
4054 static int selinux_socket_shutdown(struct socket *sock, int how)
4055 {
4056         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4057 }
4058
4059 static int selinux_socket_unix_stream_connect(struct sock *sock,
4060                                               struct sock *other,
4061                                               struct sock *newsk)
4062 {
4063         struct sk_security_struct *sksec_sock = sock->sk_security;
4064         struct sk_security_struct *sksec_other = other->sk_security;
4065         struct sk_security_struct *sksec_new = newsk->sk_security;
4066         struct common_audit_data ad;
4067         struct lsm_network_audit net = {0,};
4068         int err;
4069
4070         ad.type = LSM_AUDIT_DATA_NET;
4071         ad.u.net = &net;
4072         ad.u.net->sk = other;
4073
4074         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4075                            sksec_other->sclass,
4076                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4077         if (err)
4078                 return err;
4079
4080         /* server child socket */
4081         sksec_new->peer_sid = sksec_sock->sid;
4082         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4083                                     &sksec_new->sid);
4084         if (err)
4085                 return err;
4086
4087         /* connecting socket */
4088         sksec_sock->peer_sid = sksec_new->sid;
4089
4090         return 0;
4091 }
4092
4093 static int selinux_socket_unix_may_send(struct socket *sock,
4094                                         struct socket *other)
4095 {
4096         struct sk_security_struct *ssec = sock->sk->sk_security;
4097         struct sk_security_struct *osec = other->sk->sk_security;
4098         struct common_audit_data ad;
4099         struct lsm_network_audit net = {0,};
4100
4101         ad.type = LSM_AUDIT_DATA_NET;
4102         ad.u.net = &net;
4103         ad.u.net->sk = other->sk;
4104
4105         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4106                             &ad);
4107 }
4108
4109 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4110                                     u32 peer_sid,
4111                                     struct common_audit_data *ad)
4112 {
4113         int err;
4114         u32 if_sid;
4115         u32 node_sid;
4116
4117         err = sel_netif_sid(ifindex, &if_sid);
4118         if (err)
4119                 return err;
4120         err = avc_has_perm(peer_sid, if_sid,
4121                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4122         if (err)
4123                 return err;
4124
4125         err = sel_netnode_sid(addrp, family, &node_sid);
4126         if (err)
4127                 return err;
4128         return avc_has_perm(peer_sid, node_sid,
4129                             SECCLASS_NODE, NODE__RECVFROM, ad);
4130 }
4131
4132 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4133                                        u16 family)
4134 {
4135         int err = 0;
4136         struct sk_security_struct *sksec = sk->sk_security;
4137         u32 sk_sid = sksec->sid;
4138         struct common_audit_data ad;
4139         struct lsm_network_audit net = {0,};
4140         char *addrp;
4141
4142         ad.type = LSM_AUDIT_DATA_NET;
4143         ad.u.net = &net;
4144         ad.u.net->netif = skb->skb_iif;
4145         ad.u.net->family = family;
4146         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4147         if (err)
4148                 return err;
4149
4150         if (selinux_secmark_enabled()) {
4151                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4152                                    PACKET__RECV, &ad);
4153                 if (err)
4154                         return err;
4155         }
4156
4157         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4158         if (err)
4159                 return err;
4160         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4161
4162         return err;
4163 }
4164
4165 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4166 {
4167         int err;
4168         struct sk_security_struct *sksec = sk->sk_security;
4169         u16 family = sk->sk_family;
4170         u32 sk_sid = sksec->sid;
4171         struct common_audit_data ad;
4172         struct lsm_network_audit net = {0,};
4173         char *addrp;
4174         u8 secmark_active;
4175         u8 peerlbl_active;
4176
4177         if (family != PF_INET && family != PF_INET6)
4178                 return 0;
4179
4180         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4181         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4182                 family = PF_INET;
4183
4184         /* If any sort of compatibility mode is enabled then handoff processing
4185          * to the selinux_sock_rcv_skb_compat() function to deal with the
4186          * special handling.  We do this in an attempt to keep this function
4187          * as fast and as clean as possible. */
4188         if (!selinux_policycap_netpeer)
4189                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4190
4191         secmark_active = selinux_secmark_enabled();
4192         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4193         if (!secmark_active && !peerlbl_active)
4194                 return 0;
4195
4196         ad.type = LSM_AUDIT_DATA_NET;
4197         ad.u.net = &net;
4198         ad.u.net->netif = skb->skb_iif;
4199         ad.u.net->family = family;
4200         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4201         if (err)
4202                 return err;
4203
4204         if (peerlbl_active) {
4205                 u32 peer_sid;
4206
4207                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4208                 if (err)
4209                         return err;
4210                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4211                                                peer_sid, &ad);
4212                 if (err) {
4213                         selinux_netlbl_err(skb, err, 0);
4214                         return err;
4215                 }
4216                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4217                                    PEER__RECV, &ad);
4218                 if (err)
4219                         selinux_netlbl_err(skb, err, 0);
4220         }
4221
4222         if (secmark_active) {
4223                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4224                                    PACKET__RECV, &ad);
4225                 if (err)
4226                         return err;
4227         }
4228
4229         return err;
4230 }
4231
4232 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4233                                             int __user *optlen, unsigned len)
4234 {
4235         int err = 0;
4236         char *scontext;
4237         u32 scontext_len;
4238         struct sk_security_struct *sksec = sock->sk->sk_security;
4239         u32 peer_sid = SECSID_NULL;
4240
4241         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4242             sksec->sclass == SECCLASS_TCP_SOCKET)
4243                 peer_sid = sksec->peer_sid;
4244         if (peer_sid == SECSID_NULL)
4245                 return -ENOPROTOOPT;
4246
4247         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4248         if (err)
4249                 return err;
4250
4251         if (scontext_len > len) {
4252                 err = -ERANGE;
4253                 goto out_len;
4254         }
4255
4256         if (copy_to_user(optval, scontext, scontext_len))
4257                 err = -EFAULT;
4258
4259 out_len:
4260         if (put_user(scontext_len, optlen))
4261                 err = -EFAULT;
4262         kfree(scontext);
4263         return err;
4264 }
4265
4266 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4267 {
4268         u32 peer_secid = SECSID_NULL;
4269         u16 family;
4270
4271         if (skb && skb->protocol == htons(ETH_P_IP))
4272                 family = PF_INET;
4273         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4274                 family = PF_INET6;
4275         else if (sock)
4276                 family = sock->sk->sk_family;
4277         else
4278                 goto out;
4279
4280         if (sock && family == PF_UNIX)
4281                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4282         else if (skb)
4283                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4284
4285 out:
4286         *secid = peer_secid;
4287         if (peer_secid == SECSID_NULL)
4288                 return -EINVAL;
4289         return 0;
4290 }
4291
4292 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4293 {
4294         struct sk_security_struct *sksec;
4295
4296         sksec = kzalloc(sizeof(*sksec), priority);
4297         if (!sksec)
4298                 return -ENOMEM;
4299
4300         sksec->peer_sid = SECINITSID_UNLABELED;
4301         sksec->sid = SECINITSID_UNLABELED;
4302         selinux_netlbl_sk_security_reset(sksec);
4303         sk->sk_security = sksec;
4304
4305         return 0;
4306 }
4307
4308 static void selinux_sk_free_security(struct sock *sk)
4309 {
4310         struct sk_security_struct *sksec = sk->sk_security;
4311
4312         sk->sk_security = NULL;
4313         selinux_netlbl_sk_security_free(sksec);
4314         kfree(sksec);
4315 }
4316
4317 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4318 {
4319         struct sk_security_struct *sksec = sk->sk_security;
4320         struct sk_security_struct *newsksec = newsk->sk_security;
4321
4322         newsksec->sid = sksec->sid;
4323         newsksec->peer_sid = sksec->peer_sid;
4324         newsksec->sclass = sksec->sclass;
4325
4326         selinux_netlbl_sk_security_reset(newsksec);
4327 }
4328
4329 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4330 {
4331         if (!sk)
4332                 *secid = SECINITSID_ANY_SOCKET;
4333         else {
4334                 struct sk_security_struct *sksec = sk->sk_security;
4335
4336                 *secid = sksec->sid;
4337         }
4338 }
4339
4340 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4341 {
4342         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4343         struct sk_security_struct *sksec = sk->sk_security;
4344
4345         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4346             sk->sk_family == PF_UNIX)
4347                 isec->sid = sksec->sid;
4348         sksec->sclass = isec->sclass;
4349 }
4350
4351 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4352                                      struct request_sock *req)
4353 {
4354         struct sk_security_struct *sksec = sk->sk_security;
4355         int err;
4356         u16 family = sk->sk_family;
4357         u32 newsid;
4358         u32 peersid;
4359
4360         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4361         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4362                 family = PF_INET;
4363
4364         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4365         if (err)
4366                 return err;
4367         if (peersid == SECSID_NULL) {
4368                 req->secid = sksec->sid;
4369                 req->peer_secid = SECSID_NULL;
4370         } else {
4371                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4372                 if (err)
4373                         return err;
4374                 req->secid = newsid;
4375                 req->peer_secid = peersid;
4376         }
4377
4378         return selinux_netlbl_inet_conn_request(req, family);
4379 }
4380
4381 static void selinux_inet_csk_clone(struct sock *newsk,
4382                                    const struct request_sock *req)
4383 {
4384         struct sk_security_struct *newsksec = newsk->sk_security;
4385
4386         newsksec->sid = req->secid;
4387         newsksec->peer_sid = req->peer_secid;
4388         /* NOTE: Ideally, we should also get the isec->sid for the
4389            new socket in sync, but we don't have the isec available yet.
4390            So we will wait until sock_graft to do it, by which
4391            time it will have been created and available. */
4392
4393         /* We don't need to take any sort of lock here as we are the only
4394          * thread with access to newsksec */
4395         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4396 }
4397
4398 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4399 {
4400         u16 family = sk->sk_family;
4401         struct sk_security_struct *sksec = sk->sk_security;
4402
4403         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4404         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4405                 family = PF_INET;
4406
4407         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4408 }
4409
4410 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4411 {
4412         skb_set_owner_w(skb, sk);
4413 }
4414
4415 static int selinux_secmark_relabel_packet(u32 sid)
4416 {
4417         const struct task_security_struct *__tsec;
4418         u32 tsid;
4419
4420         __tsec = current_security();
4421         tsid = __tsec->sid;
4422
4423         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4424 }
4425
4426 static void selinux_secmark_refcount_inc(void)
4427 {
4428         atomic_inc(&selinux_secmark_refcount);
4429 }
4430
4431 static void selinux_secmark_refcount_dec(void)
4432 {
4433         atomic_dec(&selinux_secmark_refcount);
4434 }
4435
4436 static void selinux_req_classify_flow(const struct request_sock *req,
4437                                       struct flowi *fl)
4438 {
4439         fl->flowi_secid = req->secid;
4440 }
4441
4442 static int selinux_tun_dev_alloc_security(void **security)
4443 {
4444         struct tun_security_struct *tunsec;
4445
4446         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4447         if (!tunsec)
4448                 return -ENOMEM;
4449         tunsec->sid = current_sid();
4450
4451         *security = tunsec;
4452         return 0;
4453 }
4454
4455 static void selinux_tun_dev_free_security(void *security)
4456 {
4457         kfree(security);
4458 }
4459
4460 static int selinux_tun_dev_create(void)
4461 {
4462         u32 sid = current_sid();
4463
4464         /* we aren't taking into account the "sockcreate" SID since the socket
4465          * that is being created here is not a socket in the traditional sense,
4466          * instead it is a private sock, accessible only to the kernel, and
4467          * representing a wide range of network traffic spanning multiple
4468          * connections unlike traditional sockets - check the TUN driver to
4469          * get a better understanding of why this socket is special */
4470
4471         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4472                             NULL);
4473 }
4474
4475 static int selinux_tun_dev_attach_queue(void *security)
4476 {
4477         struct tun_security_struct *tunsec = security;
4478
4479         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4480                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4481 }
4482
4483 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4484 {
4485         struct tun_security_struct *tunsec = security;
4486         struct sk_security_struct *sksec = sk->sk_security;
4487
4488         /* we don't currently perform any NetLabel based labeling here and it
4489          * isn't clear that we would want to do so anyway; while we could apply
4490          * labeling without the support of the TUN user the resulting labeled
4491          * traffic from the other end of the connection would almost certainly
4492          * cause confusion to the TUN user that had no idea network labeling
4493          * protocols were being used */
4494
4495         sksec->sid = tunsec->sid;
4496         sksec->sclass = SECCLASS_TUN_SOCKET;
4497
4498         return 0;
4499 }
4500
4501 static int selinux_tun_dev_open(void *security)
4502 {
4503         struct tun_security_struct *tunsec = security;
4504         u32 sid = current_sid();
4505         int err;
4506
4507         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4508                            TUN_SOCKET__RELABELFROM, NULL);
4509         if (err)
4510                 return err;
4511         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4512                            TUN_SOCKET__RELABELTO, NULL);
4513         if (err)
4514                 return err;
4515         tunsec->sid = sid;
4516
4517         return 0;
4518 }
4519
4520 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4521 {
4522         int err = 0;
4523         u32 perm;
4524         struct nlmsghdr *nlh;
4525         struct sk_security_struct *sksec = sk->sk_security;
4526
4527         if (skb->len < NLMSG_HDRLEN) {
4528                 err = -EINVAL;
4529                 goto out;
4530         }
4531         nlh = nlmsg_hdr(skb);
4532
4533         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4534         if (err) {
4535                 if (err == -EINVAL) {
4536                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4537                                   "SELinux:  unrecognized netlink message"
4538                                   " type=%hu for sclass=%hu\n",
4539                                   nlh->nlmsg_type, sksec->sclass);
4540                         if (!selinux_enforcing || security_get_allow_unknown())
4541                                 err = 0;
4542                 }
4543
4544                 /* Ignore */
4545                 if (err == -ENOENT)
4546                         err = 0;
4547                 goto out;
4548         }
4549
4550         err = sock_has_perm(current, sk, perm);
4551 out:
4552         return err;
4553 }
4554
4555 #ifdef CONFIG_NETFILTER
4556
4557 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4558                                        u16 family)
4559 {
4560         int err;
4561         char *addrp;
4562         u32 peer_sid;
4563         struct common_audit_data ad;
4564         struct lsm_network_audit net = {0,};
4565         u8 secmark_active;
4566         u8 netlbl_active;
4567         u8 peerlbl_active;
4568
4569         if (!selinux_policycap_netpeer)
4570                 return NF_ACCEPT;
4571
4572         secmark_active = selinux_secmark_enabled();
4573         netlbl_active = netlbl_enabled();
4574         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4575         if (!secmark_active && !peerlbl_active)
4576                 return NF_ACCEPT;
4577
4578         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4579                 return NF_DROP;
4580
4581         ad.type = LSM_AUDIT_DATA_NET;
4582         ad.u.net = &net;
4583         ad.u.net->netif = ifindex;
4584         ad.u.net->family = family;
4585         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4586                 return NF_DROP;
4587
4588         if (peerlbl_active) {
4589                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4590                                                peer_sid, &ad);
4591                 if (err) {
4592                         selinux_netlbl_err(skb, err, 1);
4593                         return NF_DROP;
4594                 }
4595         }
4596
4597         if (secmark_active)
4598                 if (avc_has_perm(peer_sid, skb->secmark,
4599                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4600                         return NF_DROP;
4601
4602         if (netlbl_active)
4603                 /* we do this in the FORWARD path and not the POST_ROUTING
4604                  * path because we want to make sure we apply the necessary
4605                  * labeling before IPsec is applied so we can leverage AH
4606                  * protection */
4607                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4608                         return NF_DROP;
4609
4610         return NF_ACCEPT;
4611 }
4612
4613 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4614                                          struct sk_buff *skb,
4615                                          const struct net_device *in,
4616                                          const struct net_device *out,
4617                                          int (*okfn)(struct sk_buff *))
4618 {
4619         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4620 }
4621
4622 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4623 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4624                                          struct sk_buff *skb,
4625                                          const struct net_device *in,
4626                                          const struct net_device *out,
4627                                          int (*okfn)(struct sk_buff *))
4628 {
4629         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4630 }
4631 #endif  /* IPV6 */
4632
4633 static unsigned int selinux_ip_output(struct sk_buff *skb,
4634                                       u16 family)
4635 {
4636         u32 sid;
4637
4638         if (!netlbl_enabled())
4639                 return NF_ACCEPT;
4640
4641         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4642          * because we want to make sure we apply the necessary labeling
4643          * before IPsec is applied so we can leverage AH protection */
4644         if (skb->sk) {
4645                 struct sk_security_struct *sksec = skb->sk->sk_security;
4646                 sid = sksec->sid;
4647         } else
4648                 sid = SECINITSID_KERNEL;
4649         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4650                 return NF_DROP;
4651
4652         return NF_ACCEPT;
4653 }
4654
4655 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4656                                         struct sk_buff *skb,
4657                                         const struct net_device *in,
4658                                         const struct net_device *out,
4659                                         int (*okfn)(struct sk_buff *))
4660 {
4661         return selinux_ip_output(skb, PF_INET);
4662 }
4663
4664 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4665                                                 int ifindex,
4666                                                 u16 family)
4667 {
4668         struct sock *sk = skb->sk;
4669         struct sk_security_struct *sksec;
4670         struct common_audit_data ad;
4671         struct lsm_network_audit net = {0,};
4672         char *addrp;
4673         u8 proto;
4674
4675         if (sk == NULL)
4676                 return NF_ACCEPT;
4677         sksec = sk->sk_security;
4678
4679         ad.type = LSM_AUDIT_DATA_NET;
4680         ad.u.net = &net;
4681         ad.u.net->netif = ifindex;
4682         ad.u.net->family = family;
4683         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4684                 return NF_DROP;
4685
4686         if (selinux_secmark_enabled())
4687                 if (avc_has_perm(sksec->sid, skb->secmark,
4688                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4689                         return NF_DROP_ERR(-ECONNREFUSED);
4690
4691         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4692                 return NF_DROP_ERR(-ECONNREFUSED);
4693
4694         return NF_ACCEPT;
4695 }
4696
4697 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4698                                          u16 family)
4699 {
4700         u32 secmark_perm;
4701         u32 peer_sid;
4702         struct sock *sk;
4703         struct common_audit_data ad;
4704         struct lsm_network_audit net = {0,};
4705         char *addrp;
4706         u8 secmark_active;
4707         u8 peerlbl_active;
4708
4709         /* If any sort of compatibility mode is enabled then handoff processing
4710          * to the selinux_ip_postroute_compat() function to deal with the
4711          * special handling.  We do this in an attempt to keep this function
4712          * as fast and as clean as possible. */
4713         if (!selinux_policycap_netpeer)
4714                 return selinux_ip_postroute_compat(skb, ifindex, family);
4715 #ifdef CONFIG_XFRM
4716         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4717          * packet transformation so allow the packet to pass without any checks
4718          * since we'll have another chance to perform access control checks
4719          * when the packet is on it's final way out.
4720          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4721          *       is NULL, in this case go ahead and apply access control. */
4722         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4723                 return NF_ACCEPT;
4724 #endif
4725         secmark_active = selinux_secmark_enabled();
4726         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4727         if (!secmark_active && !peerlbl_active)
4728                 return NF_ACCEPT;
4729
4730         /* if the packet is being forwarded then get the peer label from the
4731          * packet itself; otherwise check to see if it is from a local
4732          * application or the kernel, if from an application get the peer label
4733          * from the sending socket, otherwise use the kernel's sid */
4734         sk = skb->sk;
4735         if (sk == NULL) {
4736                 if (skb->skb_iif) {
4737                         secmark_perm = PACKET__FORWARD_OUT;
4738                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4739                                 return NF_DROP;
4740                 } else {
4741                         secmark_perm = PACKET__SEND;
4742                         peer_sid = SECINITSID_KERNEL;
4743                 }
4744         } else {
4745                 struct sk_security_struct *sksec = sk->sk_security;
4746                 peer_sid = sksec->sid;
4747                 secmark_perm = PACKET__SEND;
4748         }
4749
4750         ad.type = LSM_AUDIT_DATA_NET;
4751         ad.u.net = &net;
4752         ad.u.net->netif = ifindex;
4753         ad.u.net->family = family;
4754         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4755                 return NF_DROP;
4756
4757         if (secmark_active)
4758                 if (avc_has_perm(peer_sid, skb->secmark,
4759                                  SECCLASS_PACKET, secmark_perm, &ad))
4760                         return NF_DROP_ERR(-ECONNREFUSED);
4761
4762         if (peerlbl_active) {
4763                 u32 if_sid;
4764                 u32 node_sid;
4765
4766                 if (sel_netif_sid(ifindex, &if_sid))
4767                         return NF_DROP;
4768                 if (avc_has_perm(peer_sid, if_sid,
4769                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4770                         return NF_DROP_ERR(-ECONNREFUSED);
4771
4772                 if (sel_netnode_sid(addrp, family, &node_sid))
4773                         return NF_DROP;
4774                 if (avc_has_perm(peer_sid, node_sid,
4775                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4776                         return NF_DROP_ERR(-ECONNREFUSED);
4777         }
4778
4779         return NF_ACCEPT;
4780 }
4781
4782 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4783                                            struct sk_buff *skb,
4784                                            const struct net_device *in,
4785                                            const struct net_device *out,
4786                                            int (*okfn)(struct sk_buff *))
4787 {
4788         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4789 }
4790
4791 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4792 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4793                                            struct sk_buff *skb,
4794                                            const struct net_device *in,
4795                                            const struct net_device *out,
4796                                            int (*okfn)(struct sk_buff *))
4797 {
4798         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4799 }
4800 #endif  /* IPV6 */
4801
4802 #endif  /* CONFIG_NETFILTER */
4803
4804 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4805 {
4806         int err;
4807
4808         err = cap_netlink_send(sk, skb);
4809         if (err)
4810                 return err;
4811
4812         return selinux_nlmsg_perm(sk, skb);
4813 }
4814
4815 static int ipc_alloc_security(struct task_struct *task,
4816                               struct kern_ipc_perm *perm,
4817                               u16 sclass)
4818 {
4819         struct ipc_security_struct *isec;
4820         u32 sid;
4821
4822         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4823         if (!isec)
4824                 return -ENOMEM;
4825
4826         sid = task_sid(task);
4827         isec->sclass = sclass;
4828         isec->sid = sid;
4829         perm->security = isec;
4830
4831         return 0;
4832 }
4833
4834 static void ipc_free_security(struct kern_ipc_perm *perm)
4835 {
4836         struct ipc_security_struct *isec = perm->security;
4837         perm->security = NULL;
4838         kfree(isec);
4839 }
4840
4841 static int msg_msg_alloc_security(struct msg_msg *msg)
4842 {
4843         struct msg_security_struct *msec;
4844
4845         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4846         if (!msec)
4847                 return -ENOMEM;
4848
4849         msec->sid = SECINITSID_UNLABELED;
4850         msg->security = msec;
4851
4852         return 0;
4853 }
4854
4855 static void msg_msg_free_security(struct msg_msg *msg)
4856 {
4857         struct msg_security_struct *msec = msg->security;
4858
4859         msg->security = NULL;
4860         kfree(msec);
4861 }
4862
4863 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4864                         u32 perms)
4865 {
4866         struct ipc_security_struct *isec;
4867         struct common_audit_data ad;
4868         u32 sid = current_sid();
4869
4870         isec = ipc_perms->security;
4871
4872         ad.type = LSM_AUDIT_DATA_IPC;
4873         ad.u.ipc_id = ipc_perms->key;
4874
4875         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4876 }
4877
4878 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4879 {
4880         return msg_msg_alloc_security(msg);
4881 }
4882
4883 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4884 {
4885         msg_msg_free_security(msg);
4886 }
4887
4888 /* message queue security operations */
4889 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4890 {
4891         struct ipc_security_struct *isec;
4892         struct common_audit_data ad;
4893         u32 sid = current_sid();
4894         int rc;
4895
4896         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4897         if (rc)
4898                 return rc;
4899
4900         isec = msq->q_perm.security;
4901
4902         ad.type = LSM_AUDIT_DATA_IPC;
4903         ad.u.ipc_id = msq->q_perm.key;
4904
4905         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4906                           MSGQ__CREATE, &ad);
4907         if (rc) {
4908                 ipc_free_security(&msq->q_perm);
4909                 return rc;
4910         }
4911         return 0;
4912 }
4913
4914 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4915 {
4916         ipc_free_security(&msq->q_perm);
4917 }
4918
4919 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4920 {
4921         struct ipc_security_struct *isec;
4922         struct common_audit_data ad;
4923         u32 sid = current_sid();
4924
4925         isec = msq->q_perm.security;
4926
4927         ad.type = LSM_AUDIT_DATA_IPC;
4928         ad.u.ipc_id = msq->q_perm.key;
4929
4930         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4931                             MSGQ__ASSOCIATE, &ad);
4932 }
4933
4934 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4935 {
4936         int err;
4937         int perms;
4938
4939         switch (cmd) {
4940         case IPC_INFO:
4941         case MSG_INFO:
4942                 /* No specific object, just general system-wide information. */
4943                 return task_has_system(current, SYSTEM__IPC_INFO);
4944         case IPC_STAT:
4945         case MSG_STAT:
4946                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4947                 break;
4948         case IPC_SET:
4949                 perms = MSGQ__SETATTR;
4950                 break;
4951         case IPC_RMID:
4952                 perms = MSGQ__DESTROY;
4953                 break;
4954         default:
4955                 return 0;
4956         }
4957
4958         err = ipc_has_perm(&msq->q_perm, perms);
4959         return err;
4960 }
4961
4962 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4963 {
4964         struct ipc_security_struct *isec;
4965         struct msg_security_struct *msec;
4966         struct common_audit_data ad;
4967         u32 sid = current_sid();
4968         int rc;
4969
4970         isec = msq->q_perm.security;
4971         msec = msg->security;
4972
4973         /*
4974          * First time through, need to assign label to the message
4975          */
4976         if (msec->sid == SECINITSID_UNLABELED) {
4977                 /*
4978                  * Compute new sid based on current process and
4979                  * message queue this message will be stored in
4980                  */
4981                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4982                                              NULL, &msec->sid);
4983                 if (rc)
4984                         return rc;
4985         }
4986
4987         ad.type = LSM_AUDIT_DATA_IPC;
4988         ad.u.ipc_id = msq->q_perm.key;
4989
4990         /* Can this process write to the queue? */
4991         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4992                           MSGQ__WRITE, &ad);
4993         if (!rc)
4994                 /* Can this process send the message */
4995                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4996                                   MSG__SEND, &ad);
4997         if (!rc)
4998                 /* Can the message be put in the queue? */
4999                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5000                                   MSGQ__ENQUEUE, &ad);
5001
5002         return rc;
5003 }
5004
5005 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5006                                     struct task_struct *target,
5007                                     long type, int mode)
5008 {
5009         struct ipc_security_struct *isec;
5010         struct msg_security_struct *msec;
5011         struct common_audit_data ad;
5012         u32 sid = task_sid(target);
5013         int rc;
5014
5015         isec = msq->q_perm.security;
5016         msec = msg->security;
5017
5018         ad.type = LSM_AUDIT_DATA_IPC;
5019         ad.u.ipc_id = msq->q_perm.key;
5020
5021         rc = avc_has_perm(sid, isec->sid,
5022                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5023         if (!rc)
5024                 rc = avc_has_perm(sid, msec->sid,
5025                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5026         return rc;
5027 }
5028
5029 /* Shared Memory security operations */
5030 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5031 {
5032         struct ipc_security_struct *isec;
5033         struct common_audit_data ad;
5034         u32 sid = current_sid();
5035         int rc;
5036
5037         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5038         if (rc)
5039                 return rc;
5040
5041         isec = shp->shm_perm.security;
5042
5043         ad.type = LSM_AUDIT_DATA_IPC;
5044         ad.u.ipc_id = shp->shm_perm.key;
5045
5046         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5047                           SHM__CREATE, &ad);
5048         if (rc) {
5049                 ipc_free_security(&shp->shm_perm);
5050                 return rc;
5051         }
5052         return 0;
5053 }
5054
5055 static void selinux_shm_free_security(struct shmid_kernel *shp)
5056 {
5057         ipc_free_security(&shp->shm_perm);
5058 }
5059
5060 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5061 {
5062         struct ipc_security_struct *isec;
5063         struct common_audit_data ad;
5064         u32 sid = current_sid();
5065
5066         isec = shp->shm_perm.security;
5067
5068         ad.type = LSM_AUDIT_DATA_IPC;
5069         ad.u.ipc_id = shp->shm_perm.key;
5070
5071         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5072                             SHM__ASSOCIATE, &ad);
5073 }
5074
5075 /* Note, at this point, shp is locked down */
5076 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5077 {
5078         int perms;
5079         int err;
5080
5081         switch (cmd) {
5082         case IPC_INFO:
5083         case SHM_INFO:
5084                 /* No specific object, just general system-wide information. */
5085                 return task_has_system(current, SYSTEM__IPC_INFO);
5086         case IPC_STAT:
5087         case SHM_STAT:
5088                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5089                 break;
5090         case IPC_SET:
5091                 perms = SHM__SETATTR;
5092                 break;
5093         case SHM_LOCK:
5094         case SHM_UNLOCK:
5095                 perms = SHM__LOCK;
5096                 break;
5097         case IPC_RMID:
5098                 perms = SHM__DESTROY;
5099                 break;
5100         default:
5101                 return 0;
5102         }
5103
5104         err = ipc_has_perm(&shp->shm_perm, perms);
5105         return err;
5106 }
5107
5108 static int selinux_shm_shmat(struct shmid_kernel *shp,
5109                              char __user *shmaddr, int shmflg)
5110 {
5111         u32 perms;
5112
5113         if (shmflg & SHM_RDONLY)
5114                 perms = SHM__READ;
5115         else
5116                 perms = SHM__READ | SHM__WRITE;
5117
5118         return ipc_has_perm(&shp->shm_perm, perms);
5119 }
5120
5121 /* Semaphore security operations */
5122 static int selinux_sem_alloc_security(struct sem_array *sma)
5123 {
5124         struct ipc_security_struct *isec;
5125         struct common_audit_data ad;
5126         u32 sid = current_sid();
5127         int rc;
5128
5129         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5130         if (rc)
5131                 return rc;
5132
5133         isec = sma->sem_perm.security;
5134
5135         ad.type = LSM_AUDIT_DATA_IPC;
5136         ad.u.ipc_id = sma->sem_perm.key;
5137
5138         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5139                           SEM__CREATE, &ad);
5140         if (rc) {
5141                 ipc_free_security(&sma->sem_perm);
5142                 return rc;
5143         }
5144         return 0;
5145 }
5146
5147 static void selinux_sem_free_security(struct sem_array *sma)
5148 {
5149         ipc_free_security(&sma->sem_perm);
5150 }
5151
5152 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5153 {
5154         struct ipc_security_struct *isec;
5155         struct common_audit_data ad;
5156         u32 sid = current_sid();
5157
5158         isec = sma->sem_perm.security;
5159
5160         ad.type = LSM_AUDIT_DATA_IPC;
5161         ad.u.ipc_id = sma->sem_perm.key;
5162
5163         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5164                             SEM__ASSOCIATE, &ad);
5165 }
5166
5167 /* Note, at this point, sma is locked down */
5168 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5169 {
5170         int err;
5171         u32 perms;
5172
5173         switch (cmd) {
5174         case IPC_INFO:
5175         case SEM_INFO:
5176                 /* No specific object, just general system-wide information. */
5177                 return task_has_system(current, SYSTEM__IPC_INFO);
5178         case GETPID:
5179         case GETNCNT:
5180         case GETZCNT:
5181                 perms = SEM__GETATTR;
5182                 break;
5183         case GETVAL:
5184         case GETALL:
5185                 perms = SEM__READ;
5186                 break;
5187         case SETVAL:
5188         case SETALL:
5189                 perms = SEM__WRITE;
5190                 break;
5191         case IPC_RMID:
5192                 perms = SEM__DESTROY;
5193                 break;
5194         case IPC_SET:
5195                 perms = SEM__SETATTR;
5196                 break;
5197         case IPC_STAT:
5198         case SEM_STAT:
5199                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5200                 break;
5201         default:
5202                 return 0;
5203         }
5204
5205         err = ipc_has_perm(&sma->sem_perm, perms);
5206         return err;
5207 }
5208
5209 static int selinux_sem_semop(struct sem_array *sma,
5210                              struct sembuf *sops, unsigned nsops, int alter)
5211 {
5212         u32 perms;
5213
5214         if (alter)
5215                 perms = SEM__READ | SEM__WRITE;
5216         else
5217                 perms = SEM__READ;
5218
5219         return ipc_has_perm(&sma->sem_perm, perms);
5220 }
5221
5222 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5223 {
5224         u32 av = 0;
5225
5226         av = 0;
5227         if (flag & S_IRUGO)
5228                 av |= IPC__UNIX_READ;
5229         if (flag & S_IWUGO)
5230                 av |= IPC__UNIX_WRITE;
5231
5232         if (av == 0)
5233                 return 0;
5234
5235         return ipc_has_perm(ipcp, av);
5236 }
5237
5238 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5239 {
5240         struct ipc_security_struct *isec = ipcp->security;
5241         *secid = isec->sid;
5242 }
5243
5244 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5245 {
5246         if (inode)
5247                 inode_doinit_with_dentry(inode, dentry);
5248 }
5249
5250 static int selinux_getprocattr(struct task_struct *p,
5251                                char *name, char **value)
5252 {
5253         const struct task_security_struct *__tsec;
5254         u32 sid;
5255         int error;
5256         unsigned len;
5257
5258         if (current != p) {
5259                 error = current_has_perm(p, PROCESS__GETATTR);
5260                 if (error)
5261                         return error;
5262         }
5263
5264         rcu_read_lock();
5265         __tsec = __task_cred(p)->security;
5266
5267         if (!strcmp(name, "current"))
5268                 sid = __tsec->sid;
5269         else if (!strcmp(name, "prev"))
5270                 sid = __tsec->osid;
5271         else if (!strcmp(name, "exec"))
5272                 sid = __tsec->exec_sid;
5273         else if (!strcmp(name, "fscreate"))
5274                 sid = __tsec->create_sid;
5275         else if (!strcmp(name, "keycreate"))
5276                 sid = __tsec->keycreate_sid;
5277         else if (!strcmp(name, "sockcreate"))
5278                 sid = __tsec->sockcreate_sid;
5279         else
5280                 goto invalid;
5281         rcu_read_unlock();
5282
5283         if (!sid)
5284                 return 0;
5285
5286         error = security_sid_to_context(sid, value, &len);
5287         if (error)
5288                 return error;
5289         return len;
5290
5291 invalid:
5292         rcu_read_unlock();
5293         return -EINVAL;
5294 }
5295
5296 static int selinux_setprocattr(struct task_struct *p,
5297                                char *name, void *value, size_t size)
5298 {
5299         struct task_security_struct *tsec;
5300         struct task_struct *tracer;
5301         struct cred *new;
5302         u32 sid = 0, ptsid;
5303         int error;
5304         char *str = value;
5305
5306         if (current != p) {
5307                 /* SELinux only allows a process to change its own
5308                    security attributes. */
5309                 return -EACCES;
5310         }
5311
5312         /*
5313          * Basic control over ability to set these attributes at all.
5314          * current == p, but we'll pass them separately in case the
5315          * above restriction is ever removed.
5316          */
5317         if (!strcmp(name, "exec"))
5318                 error = current_has_perm(p, PROCESS__SETEXEC);
5319         else if (!strcmp(name, "fscreate"))
5320                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5321         else if (!strcmp(name, "keycreate"))
5322                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5323         else if (!strcmp(name, "sockcreate"))
5324                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5325         else if (!strcmp(name, "current"))
5326                 error = current_has_perm(p, PROCESS__SETCURRENT);
5327         else
5328                 error = -EINVAL;
5329         if (error)
5330                 return error;
5331
5332         /* Obtain a SID for the context, if one was specified. */
5333         if (size && str[1] && str[1] != '\n') {
5334                 if (str[size-1] == '\n') {
5335                         str[size-1] = 0;
5336                         size--;
5337                 }
5338                 error = security_context_to_sid(value, size, &sid);
5339                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5340                         if (!capable(CAP_MAC_ADMIN)) {
5341                                 struct audit_buffer *ab;
5342                                 size_t audit_size;
5343
5344                                 /* We strip a nul only if it is at the end, otherwise the
5345                                  * context contains a nul and we should audit that */
5346                                 if (str[size - 1] == '\0')
5347                                         audit_size = size - 1;
5348                                 else
5349                                         audit_size = size;
5350                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5351                                 audit_log_format(ab, "op=fscreate invalid_context=");
5352                                 audit_log_n_untrustedstring(ab, value, audit_size);
5353                                 audit_log_end(ab);
5354
5355                                 return error;
5356                         }
5357                         error = security_context_to_sid_force(value, size,
5358                                                               &sid);
5359                 }
5360                 if (error)
5361                         return error;
5362         }
5363
5364         new = prepare_creds();
5365         if (!new)
5366                 return -ENOMEM;
5367
5368         /* Permission checking based on the specified context is
5369            performed during the actual operation (execve,
5370            open/mkdir/...), when we know the full context of the
5371            operation.  See selinux_bprm_set_creds for the execve
5372            checks and may_create for the file creation checks. The
5373            operation will then fail if the context is not permitted. */
5374         tsec = new->security;
5375         if (!strcmp(name, "exec")) {
5376                 tsec->exec_sid = sid;
5377         } else if (!strcmp(name, "fscreate")) {
5378                 tsec->create_sid = sid;
5379         } else if (!strcmp(name, "keycreate")) {
5380                 error = may_create_key(sid, p);
5381                 if (error)
5382                         goto abort_change;
5383                 tsec->keycreate_sid = sid;
5384         } else if (!strcmp(name, "sockcreate")) {
5385                 tsec->sockcreate_sid = sid;
5386         } else if (!strcmp(name, "current")) {
5387                 error = -EINVAL;
5388                 if (sid == 0)
5389                         goto abort_change;
5390
5391                 /* Only allow single threaded processes to change context */
5392                 error = -EPERM;
5393                 if (!current_is_single_threaded()) {
5394                         error = security_bounded_transition(tsec->sid, sid);
5395                         if (error)
5396                                 goto abort_change;
5397                 }
5398
5399                 /* Check permissions for the transition. */
5400                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5401                                      PROCESS__DYNTRANSITION, NULL);
5402                 if (error)
5403                         goto abort_change;
5404
5405                 /* Check for ptracing, and update the task SID if ok.
5406                    Otherwise, leave SID unchanged and fail. */
5407                 ptsid = 0;
5408                 task_lock(p);
5409                 tracer = ptrace_parent(p);
5410                 if (tracer)
5411                         ptsid = task_sid(tracer);
5412                 task_unlock(p);
5413
5414                 if (tracer) {
5415                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5416                                              PROCESS__PTRACE, NULL);
5417                         if (error)
5418                                 goto abort_change;
5419                 }
5420
5421                 tsec->sid = sid;
5422         } else {
5423                 error = -EINVAL;
5424                 goto abort_change;
5425         }
5426
5427         commit_creds(new);
5428         return size;
5429
5430 abort_change:
5431         abort_creds(new);
5432         return error;
5433 }
5434
5435 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5436 {
5437         return security_sid_to_context(secid, secdata, seclen);
5438 }
5439
5440 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5441 {
5442         return security_context_to_sid(secdata, seclen, secid);
5443 }
5444
5445 static void selinux_release_secctx(char *secdata, u32 seclen)
5446 {
5447         kfree(secdata);
5448 }
5449
5450 /*
5451  *      called with inode->i_mutex locked
5452  */
5453 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5454 {
5455         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5456 }
5457
5458 /*
5459  *      called with inode->i_mutex locked
5460  */
5461 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5462 {
5463         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5464 }
5465
5466 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5467 {
5468         int len = 0;
5469         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5470                                                 ctx, true);
5471         if (len < 0)
5472                 return len;
5473         *ctxlen = len;
5474         return 0;
5475 }
5476 #ifdef CONFIG_KEYS
5477
5478 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5479                              unsigned long flags)
5480 {
5481         const struct task_security_struct *tsec;
5482         struct key_security_struct *ksec;
5483
5484         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5485         if (!ksec)
5486                 return -ENOMEM;
5487
5488         tsec = cred->security;
5489         if (tsec->keycreate_sid)
5490                 ksec->sid = tsec->keycreate_sid;
5491         else
5492                 ksec->sid = tsec->sid;
5493
5494         k->security = ksec;
5495         return 0;
5496 }
5497
5498 static void selinux_key_free(struct key *k)
5499 {
5500         struct key_security_struct *ksec = k->security;
5501
5502         k->security = NULL;
5503         kfree(ksec);
5504 }
5505
5506 static int selinux_key_permission(key_ref_t key_ref,
5507                                   const struct cred *cred,
5508                                   key_perm_t perm)
5509 {
5510         struct key *key;
5511         struct key_security_struct *ksec;
5512         u32 sid;
5513
5514         /* if no specific permissions are requested, we skip the
5515            permission check. No serious, additional covert channels
5516            appear to be created. */
5517         if (perm == 0)
5518                 return 0;
5519
5520         sid = cred_sid(cred);
5521
5522         key = key_ref_to_ptr(key_ref);
5523         ksec = key->security;
5524
5525         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5526 }
5527
5528 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5529 {
5530         struct key_security_struct *ksec = key->security;
5531         char *context = NULL;
5532         unsigned len;
5533         int rc;
5534
5535         rc = security_sid_to_context(ksec->sid, &context, &len);
5536         if (!rc)
5537                 rc = len;
5538         *_buffer = context;
5539         return rc;
5540 }
5541
5542 #endif
5543
5544 static struct security_operations selinux_ops = {
5545         .name =                         "selinux",
5546
5547         .ptrace_access_check =          selinux_ptrace_access_check,
5548         .ptrace_traceme =               selinux_ptrace_traceme,
5549         .capget =                       selinux_capget,
5550         .capset =                       selinux_capset,
5551         .capable =                      selinux_capable,
5552         .quotactl =                     selinux_quotactl,
5553         .quota_on =                     selinux_quota_on,
5554         .syslog =                       selinux_syslog,
5555         .vm_enough_memory =             selinux_vm_enough_memory,
5556
5557         .netlink_send =                 selinux_netlink_send,
5558
5559         .bprm_set_creds =               selinux_bprm_set_creds,
5560         .bprm_committing_creds =        selinux_bprm_committing_creds,
5561         .bprm_committed_creds =         selinux_bprm_committed_creds,
5562         .bprm_secureexec =              selinux_bprm_secureexec,
5563
5564         .sb_alloc_security =            selinux_sb_alloc_security,
5565         .sb_free_security =             selinux_sb_free_security,
5566         .sb_copy_data =                 selinux_sb_copy_data,
5567         .sb_remount =                   selinux_sb_remount,
5568         .sb_kern_mount =                selinux_sb_kern_mount,
5569         .sb_show_options =              selinux_sb_show_options,
5570         .sb_statfs =                    selinux_sb_statfs,
5571         .sb_mount =                     selinux_mount,
5572         .sb_umount =                    selinux_umount,
5573         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5574         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5575         .sb_parse_opts_str =            selinux_parse_opts_str,
5576
5577
5578         .inode_alloc_security =         selinux_inode_alloc_security,
5579         .inode_free_security =          selinux_inode_free_security,
5580         .inode_init_security =          selinux_inode_init_security,
5581         .inode_create =                 selinux_inode_create,
5582         .inode_link =                   selinux_inode_link,
5583         .inode_unlink =                 selinux_inode_unlink,
5584         .inode_symlink =                selinux_inode_symlink,
5585         .inode_mkdir =                  selinux_inode_mkdir,
5586         .inode_rmdir =                  selinux_inode_rmdir,
5587         .inode_mknod =                  selinux_inode_mknod,
5588         .inode_rename =                 selinux_inode_rename,
5589         .inode_readlink =               selinux_inode_readlink,
5590         .inode_follow_link =            selinux_inode_follow_link,
5591         .inode_permission =             selinux_inode_permission,
5592         .inode_setattr =                selinux_inode_setattr,
5593         .inode_getattr =                selinux_inode_getattr,
5594         .inode_setxattr =               selinux_inode_setxattr,
5595         .inode_post_setxattr =          selinux_inode_post_setxattr,
5596         .inode_getxattr =               selinux_inode_getxattr,
5597         .inode_listxattr =              selinux_inode_listxattr,
5598         .inode_removexattr =            selinux_inode_removexattr,
5599         .inode_getsecurity =            selinux_inode_getsecurity,
5600         .inode_setsecurity =            selinux_inode_setsecurity,
5601         .inode_listsecurity =           selinux_inode_listsecurity,
5602         .inode_getsecid =               selinux_inode_getsecid,
5603
5604         .file_permission =              selinux_file_permission,
5605         .file_alloc_security =          selinux_file_alloc_security,
5606         .file_free_security =           selinux_file_free_security,
5607         .file_ioctl =                   selinux_file_ioctl,
5608         .mmap_file =                    selinux_mmap_file,
5609         .mmap_addr =                    selinux_mmap_addr,
5610         .file_mprotect =                selinux_file_mprotect,
5611         .file_lock =                    selinux_file_lock,
5612         .file_fcntl =                   selinux_file_fcntl,
5613         .file_set_fowner =              selinux_file_set_fowner,
5614         .file_send_sigiotask =          selinux_file_send_sigiotask,
5615         .file_receive =                 selinux_file_receive,
5616
5617         .file_open =                    selinux_file_open,
5618
5619         .task_create =                  selinux_task_create,
5620         .cred_alloc_blank =             selinux_cred_alloc_blank,
5621         .cred_free =                    selinux_cred_free,
5622         .cred_prepare =                 selinux_cred_prepare,
5623         .cred_transfer =                selinux_cred_transfer,
5624         .kernel_act_as =                selinux_kernel_act_as,
5625         .kernel_create_files_as =       selinux_kernel_create_files_as,
5626         .kernel_module_request =        selinux_kernel_module_request,
5627         .task_setpgid =                 selinux_task_setpgid,
5628         .task_getpgid =                 selinux_task_getpgid,
5629         .task_getsid =                  selinux_task_getsid,
5630         .task_getsecid =                selinux_task_getsecid,
5631         .task_setnice =                 selinux_task_setnice,
5632         .task_setioprio =               selinux_task_setioprio,
5633         .task_getioprio =               selinux_task_getioprio,
5634         .task_setrlimit =               selinux_task_setrlimit,
5635         .task_setscheduler =            selinux_task_setscheduler,
5636         .task_getscheduler =            selinux_task_getscheduler,
5637         .task_movememory =              selinux_task_movememory,
5638         .task_kill =                    selinux_task_kill,
5639         .task_wait =                    selinux_task_wait,
5640         .task_to_inode =                selinux_task_to_inode,
5641
5642         .ipc_permission =               selinux_ipc_permission,
5643         .ipc_getsecid =                 selinux_ipc_getsecid,
5644
5645         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5646         .msg_msg_free_security =        selinux_msg_msg_free_security,
5647
5648         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5649         .msg_queue_free_security =      selinux_msg_queue_free_security,
5650         .msg_queue_associate =          selinux_msg_queue_associate,
5651         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5652         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5653         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5654
5655         .shm_alloc_security =           selinux_shm_alloc_security,
5656         .shm_free_security =            selinux_shm_free_security,
5657         .shm_associate =                selinux_shm_associate,
5658         .shm_shmctl =                   selinux_shm_shmctl,
5659         .shm_shmat =                    selinux_shm_shmat,
5660
5661         .sem_alloc_security =           selinux_sem_alloc_security,
5662         .sem_free_security =            selinux_sem_free_security,
5663         .sem_associate =                selinux_sem_associate,
5664         .sem_semctl =                   selinux_sem_semctl,
5665         .sem_semop =                    selinux_sem_semop,
5666
5667         .d_instantiate =                selinux_d_instantiate,
5668
5669         .getprocattr =                  selinux_getprocattr,
5670         .setprocattr =                  selinux_setprocattr,
5671
5672         .secid_to_secctx =              selinux_secid_to_secctx,
5673         .secctx_to_secid =              selinux_secctx_to_secid,
5674         .release_secctx =               selinux_release_secctx,
5675         .inode_notifysecctx =           selinux_inode_notifysecctx,
5676         .inode_setsecctx =              selinux_inode_setsecctx,
5677         .inode_getsecctx =              selinux_inode_getsecctx,
5678
5679         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5680         .unix_may_send =                selinux_socket_unix_may_send,
5681
5682         .socket_create =                selinux_socket_create,
5683         .socket_post_create =           selinux_socket_post_create,
5684         .socket_bind =                  selinux_socket_bind,
5685         .socket_connect =               selinux_socket_connect,
5686         .socket_listen =                selinux_socket_listen,
5687         .socket_accept =                selinux_socket_accept,
5688         .socket_sendmsg =               selinux_socket_sendmsg,
5689         .socket_recvmsg =               selinux_socket_recvmsg,
5690         .socket_getsockname =           selinux_socket_getsockname,
5691         .socket_getpeername =           selinux_socket_getpeername,
5692         .socket_getsockopt =            selinux_socket_getsockopt,
5693         .socket_setsockopt =            selinux_socket_setsockopt,
5694         .socket_shutdown =              selinux_socket_shutdown,
5695         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5696         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5697         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5698         .sk_alloc_security =            selinux_sk_alloc_security,
5699         .sk_free_security =             selinux_sk_free_security,
5700         .sk_clone_security =            selinux_sk_clone_security,
5701         .sk_getsecid =                  selinux_sk_getsecid,
5702         .sock_graft =                   selinux_sock_graft,
5703         .inet_conn_request =            selinux_inet_conn_request,
5704         .inet_csk_clone =               selinux_inet_csk_clone,
5705         .inet_conn_established =        selinux_inet_conn_established,
5706         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5707         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5708         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5709         .req_classify_flow =            selinux_req_classify_flow,
5710         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5711         .tun_dev_free_security =        selinux_tun_dev_free_security,
5712         .tun_dev_create =               selinux_tun_dev_create,
5713         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5714         .tun_dev_attach =               selinux_tun_dev_attach,
5715         .tun_dev_open =                 selinux_tun_dev_open,
5716         .skb_owned_by =                 selinux_skb_owned_by,
5717
5718 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5719         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5720         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5721         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5722         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5723         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5724         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5725         .xfrm_state_free_security =     selinux_xfrm_state_free,
5726         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5727         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5728         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5729         .xfrm_decode_session =          selinux_xfrm_decode_session,
5730 #endif
5731
5732 #ifdef CONFIG_KEYS
5733         .key_alloc =                    selinux_key_alloc,
5734         .key_free =                     selinux_key_free,
5735         .key_permission =               selinux_key_permission,
5736         .key_getsecurity =              selinux_key_getsecurity,
5737 #endif
5738
5739 #ifdef CONFIG_AUDIT
5740         .audit_rule_init =              selinux_audit_rule_init,
5741         .audit_rule_known =             selinux_audit_rule_known,
5742         .audit_rule_match =             selinux_audit_rule_match,
5743         .audit_rule_free =              selinux_audit_rule_free,
5744 #endif
5745 };
5746
5747 static __init int selinux_init(void)
5748 {
5749         if (!security_module_enable(&selinux_ops)) {
5750                 selinux_enabled = 0;
5751                 return 0;
5752         }
5753
5754         if (!selinux_enabled) {
5755                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5756                 return 0;
5757         }
5758
5759         printk(KERN_INFO "SELinux:  Initializing.\n");
5760
5761         /* Set the security state for the initial task. */
5762         cred_init_security();
5763
5764         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5765
5766         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5767                                             sizeof(struct inode_security_struct),
5768                                             0, SLAB_PANIC, NULL);
5769         avc_init();
5770
5771         if (register_security(&selinux_ops))
5772                 panic("SELinux: Unable to register with kernel.\n");
5773
5774         if (selinux_enforcing)
5775                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5776         else
5777                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5778
5779         return 0;
5780 }
5781
5782 static void delayed_superblock_init(struct super_block *sb, void *unused)
5783 {
5784         superblock_doinit(sb, NULL);
5785 }
5786
5787 void selinux_complete_init(void)
5788 {
5789         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5790
5791         /* Set up any superblocks initialized prior to the policy load. */
5792         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5793         iterate_supers(delayed_superblock_init, NULL);
5794 }
5795
5796 /* SELinux requires early initialization in order to label
5797    all processes and objects when they are created. */
5798 security_initcall(selinux_init);
5799
5800 #if defined(CONFIG_NETFILTER)
5801
5802 static struct nf_hook_ops selinux_ipv4_ops[] = {
5803         {
5804                 .hook =         selinux_ipv4_postroute,
5805                 .owner =        THIS_MODULE,
5806                 .pf =           NFPROTO_IPV4,
5807                 .hooknum =      NF_INET_POST_ROUTING,
5808                 .priority =     NF_IP_PRI_SELINUX_LAST,
5809         },
5810         {
5811                 .hook =         selinux_ipv4_forward,
5812                 .owner =        THIS_MODULE,
5813                 .pf =           NFPROTO_IPV4,
5814                 .hooknum =      NF_INET_FORWARD,
5815                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5816         },
5817         {
5818                 .hook =         selinux_ipv4_output,
5819                 .owner =        THIS_MODULE,
5820                 .pf =           NFPROTO_IPV4,
5821                 .hooknum =      NF_INET_LOCAL_OUT,
5822                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5823         }
5824 };
5825
5826 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5827
5828 static struct nf_hook_ops selinux_ipv6_ops[] = {
5829         {
5830                 .hook =         selinux_ipv6_postroute,
5831                 .owner =        THIS_MODULE,
5832                 .pf =           NFPROTO_IPV6,
5833                 .hooknum =      NF_INET_POST_ROUTING,
5834                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5835         },
5836         {
5837                 .hook =         selinux_ipv6_forward,
5838                 .owner =        THIS_MODULE,
5839                 .pf =           NFPROTO_IPV6,
5840                 .hooknum =      NF_INET_FORWARD,
5841                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5842         }
5843 };
5844
5845 #endif  /* IPV6 */
5846
5847 static int __init selinux_nf_ip_init(void)
5848 {
5849         int err = 0;
5850
5851         if (!selinux_enabled)
5852                 goto out;
5853
5854         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5855
5856         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5857         if (err)
5858                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5859
5860 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5861         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5862         if (err)
5863                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5864 #endif  /* IPV6 */
5865
5866 out:
5867         return err;
5868 }
5869
5870 __initcall(selinux_nf_ip_init);
5871
5872 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5873 static void selinux_nf_ip_exit(void)
5874 {
5875         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5876
5877         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5878 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5879         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5880 #endif  /* IPV6 */
5881 }
5882 #endif
5883
5884 #else /* CONFIG_NETFILTER */
5885
5886 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5887 #define selinux_nf_ip_exit()
5888 #endif
5889
5890 #endif /* CONFIG_NETFILTER */
5891
5892 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5893 static int selinux_disabled;
5894
5895 int selinux_disable(void)
5896 {
5897         if (ss_initialized) {
5898                 /* Not permitted after initial policy load. */
5899                 return -EINVAL;
5900         }
5901
5902         if (selinux_disabled) {
5903                 /* Only do this once. */
5904                 return -EINVAL;
5905         }
5906
5907         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5908
5909         selinux_disabled = 1;
5910         selinux_enabled = 0;
5911
5912         reset_security_ops();
5913
5914         /* Try to destroy the avc node cache */
5915         avc_disable();
5916
5917         /* Unregister netfilter hooks. */
5918         selinux_nf_ip_exit();
5919
5920         /* Unregister selinuxfs. */
5921         exit_sel_fs();
5922
5923         return 0;
5924 }
5925 #endif