Pileus Git - ~andy/linux/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 extern struct security_operations *security_ops;
  98
  99 /* SECMARK reference count */
 100 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 101
 102 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 103 int selinux_enforcing;
 104
 105 static int __init enforcing_setup(char *str)
 106 {
 107         unsigned long enforcing;
 108         if (!strict_strtoul(str, 0, &enforcing))
 109                 selinux_enforcing = enforcing ? 1 : 0;
 110         return 1;
 111 }
 112 __setup("enforcing=", enforcing_setup);
 113 #endif
 114
 115 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 116 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 117
 118 static int __init selinux_enabled_setup(char *str)
 119 {
 120         unsigned long enabled;
 121         if (!strict_strtoul(str, 0, &enabled))
 122                 selinux_enabled = enabled ? 1 : 0;
 123         return 1;
 124 }
 125 __setup("selinux=", selinux_enabled_setup);
 126 #else
 127 int selinux_enabled = 1;
 128 #endif
 129
 130 static struct kmem_cache *sel_inode_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (atomic_read(&selinux_secmark_refcount) > 0);
 145 }
 146
 147 /*
 148  * initialise the security for the init task
 149  */
 150 static void cred_init_security(void)
 151 {
 152         struct cred *cred = (struct cred *) current->real_cred;
 153         struct task_security_struct *tsec;
 154
 155         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 156         if (!tsec)
 157                 panic("SELinux:  Failed to initialize initial task.\n");
 158
 159         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 160         cred->security = tsec;
 161 }
 162
 163 /*
 164  * get the security ID of a set of credentials
 165  */
 166 static inline u32 cred_sid(const struct cred *cred)
 167 {
 168         const struct task_security_struct *tsec;
 169
 170         tsec = cred->security;
 171         return tsec->sid;
 172 }
 173
 174 /*
 175  * get the objective security ID of a task
 176  */
 177 static inline u32 task_sid(const struct task_struct *task)
 178 {
 179         u32 sid;
 180
 181         rcu_read_lock();
 182         sid = cred_sid(__task_cred(task));
 183         rcu_read_unlock();
 184         return sid;
 185 }
 186
 187 /*
 188  * get the subjective security ID of the current task
 189  */
 190 static inline u32 current_sid(void)
 191 {
 192         const struct task_security_struct *tsec = current_security();
 193
 194         return tsec->sid;
 195 }
 196
 197 /* Allocate and free functions for each kind of security blob. */
 198
 199 static int inode_alloc_security(struct inode *inode)
 200 {
 201         struct inode_security_struct *isec;
 202         u32 sid = current_sid();
 203
 204         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 205         if (!isec)
 206                 return -ENOMEM;
 207
 208         mutex_init(&isec->lock);
 209         INIT_LIST_HEAD(&isec->list);
 210         isec->inode = inode;
 211         isec->sid = SECINITSID_UNLABELED;
 212         isec->sclass = SECCLASS_FILE;
 213         isec->task_sid = sid;
 214         inode->i_security = isec;
 215
 216         return 0;
 217 }
 218
 219 static void inode_free_security(struct inode *inode)
 220 {
 221         struct inode_security_struct *isec = inode->i_security;
 222         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 223
 224         spin_lock(&sbsec->isec_lock);
 225         if (!list_empty(&isec->list))
 226                 list_del_init(&isec->list);
 227         spin_unlock(&sbsec->isec_lock);
 228
 229         inode->i_security = NULL;
 230         kmem_cache_free(sel_inode_cache, isec);
 231 }
 232
 233 static int file_alloc_security(struct file *file)
 234 {
 235         struct file_security_struct *fsec;
 236         u32 sid = current_sid();
 237
 238         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 239         if (!fsec)
 240                 return -ENOMEM;
 241
 242         fsec->sid = sid;
 243         fsec->fown_sid = sid;
 244         file->f_security = fsec;
 245
 246         return 0;
 247 }
 248
 249 static void file_free_security(struct file *file)
 250 {
 251         struct file_security_struct *fsec = file->f_security;
 252         file->f_security = NULL;
 253         kfree(fsec);
 254 }
 255
 256 static int superblock_alloc_security(struct super_block *sb)
 257 {
 258         struct superblock_security_struct *sbsec;
 259
 260         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 261         if (!sbsec)
 262                 return -ENOMEM;
 263
 264         mutex_init(&sbsec->lock);
 265         INIT_LIST_HEAD(&sbsec->isec_head);
 266         spin_lock_init(&sbsec->isec_lock);
 267         sbsec->sb = sb;
 268         sbsec->sid = SECINITSID_UNLABELED;
 269         sbsec->def_sid = SECINITSID_FILE;
 270         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 271         sb->s_security = sbsec;
 272
 273         return 0;
 274 }
 275
 276 static void superblock_free_security(struct super_block *sb)
 277 {
 278         struct superblock_security_struct *sbsec = sb->s_security;
 279         sb->s_security = NULL;
 280         kfree(sbsec);
 281 }
 282
 283 /* The file system's label must be initialized prior to use. */
 284
 285 static const char *labeling_behaviors[6] = {
 286         "uses xattr",
 287         "uses transition SIDs",
 288         "uses task SIDs",
 289         "uses genfs_contexts",
 290         "not configured for labeling",
 291         "uses mountpoint labeling",
 292 };
 293
 294 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 295
 296 static inline int inode_doinit(struct inode *inode)
 297 {
 298         return inode_doinit_with_dentry(inode, NULL);
 299 }
 300
 301 enum {
 302         Opt_error = -1,
 303         Opt_context = 1,
 304         Opt_fscontext = 2,
 305         Opt_defcontext = 3,
 306         Opt_rootcontext = 4,
 307         Opt_labelsupport = 5,
 308         Opt_nextmntopt = 6,
 309 };
 310
 311 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 312
 313 static const match_table_t tokens = {
 314         {Opt_context, CONTEXT_STR "%s"},
 315         {Opt_fscontext, FSCONTEXT_STR "%s"},
 316         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 317         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 318         {Opt_labelsupport, LABELSUPP_STR},
 319         {Opt_error, NULL},
 320 };
 321
 322 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 323
 324 static int may_context_mount_sb_relabel(u32 sid,
 325                         struct superblock_security_struct *sbsec,
 326                         const struct cred *cred)
 327 {
 328         const struct task_security_struct *tsec = cred->security;
 329         int rc;
 330
 331         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 332                           FILESYSTEM__RELABELFROM, NULL);
 333         if (rc)
 334                 return rc;
 335
 336         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 337                           FILESYSTEM__RELABELTO, NULL);
 338         return rc;
 339 }
 340
 341 static int may_context_mount_inode_relabel(u32 sid,
 342                         struct superblock_security_struct *sbsec,
 343                         const struct cred *cred)
 344 {
 345         const struct task_security_struct *tsec = cred->security;
 346         int rc;
 347         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELFROM, NULL);
 349         if (rc)
 350                 return rc;
 351
 352         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 353                           FILESYSTEM__ASSOCIATE, NULL);
 354         return rc;
 355 }
 356
 357 static int sb_finish_set_opts(struct super_block *sb)
 358 {
 359         struct superblock_security_struct *sbsec = sb->s_security;
 360         struct dentry *root = sb->s_root;
 361         struct inode *root_inode = root->d_inode;
 362         int rc = 0;
 363
 364         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 365                 /* Make sure that the xattr handler exists and that no
 366                    error other than -ENODATA is returned by getxattr on
 367                    the root directory.  -ENODATA is ok, as this may be
 368                    the first boot of the SELinux kernel before we have
 369                    assigned xattr values to the filesystem. */
 370                 if (!root_inode->i_op->getxattr) {
 371                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 372                                "xattr support\n", sb->s_id, sb->s_type->name);
 373                         rc = -EOPNOTSUPP;
 374                         goto out;
 375                 }
 376                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 377                 if (rc < 0 && rc != -ENODATA) {
 378                         if (rc == -EOPNOTSUPP)
 379                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 380                                        "%s) has no security xattr handler\n",
 381                                        sb->s_id, sb->s_type->name);
 382                         else
 383                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 384                                        "%s) getxattr errno %d\n", sb->s_id,
 385                                        sb->s_type->name, -rc);
 386                         goto out;
 387                 }
 388         }
 389
 390         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 391                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 392                        sb->s_id, sb->s_type->name);
 393         else
 394                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 395                        sb->s_id, sb->s_type->name,
 396                        labeling_behaviors[sbsec->behavior-1]);
 397
 398         sbsec->flags |= SE_SBINITIALIZED;
 399         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 400             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 401             sbsec->behavior == SECURITY_FS_USE_TASK)
 402                 sbsec->flags |= SBLABEL_MNT;
 403
 404         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 405         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 406                 sbsec->flags |= SBLABEL_MNT;
 407
 408         /*
 409          * Special handling for rootfs. Is genfs but supports
 410          * setting SELinux context on in-core inodes.
 411          */
 412         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 413                 sbsec->flags |= SBLABEL_MNT;
 414
 415         /* Initialize the root inode. */
 416         rc = inode_doinit_with_dentry(root_inode, root);
 417
 418         /* Initialize any other inodes associated with the superblock, e.g.
 419            inodes created prior to initial policy load or inodes created
 420            during get_sb by a pseudo filesystem that directly
 421            populates itself. */
 422         spin_lock(&sbsec->isec_lock);
 423 next_inode:
 424         if (!list_empty(&sbsec->isec_head)) {
 425                 struct inode_security_struct *isec =
 426                                 list_entry(sbsec->isec_head.next,
 427                                            struct inode_security_struct, list);
 428                 struct inode *inode = isec->inode;
 429                 spin_unlock(&sbsec->isec_lock);
 430                 inode = igrab(inode);
 431                 if (inode) {
 432                         if (!IS_PRIVATE(inode))
 433                                 inode_doinit(inode);
 434                         iput(inode);
 435                 }
 436                 spin_lock(&sbsec->isec_lock);
 437                 list_del_init(&isec->list);
 438                 goto next_inode;
 439         }
 440         spin_unlock(&sbsec->isec_lock);
 441 out:
 442         return rc;
 443 }
 444
 445 /*
 446  * This function should allow an FS to ask what it's mount security
 447  * options were so it can use those later for submounts, displaying
 448  * mount options, or whatever.
 449  */
 450 static int selinux_get_mnt_opts(const struct super_block *sb,
 451                                 struct security_mnt_opts *opts)
 452 {
 453         int rc = 0, i;
 454         struct superblock_security_struct *sbsec = sb->s_security;
 455         char *context = NULL;
 456         u32 len;
 457         char tmp;
 458
 459         security_init_mnt_opts(opts);
 460
 461         if (!(sbsec->flags & SE_SBINITIALIZED))
 462                 return -EINVAL;
 463
 464         if (!ss_initialized)
 465                 return -EINVAL;
 466
 467         /* make sure we always check enough bits to cover the mask */
 468         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 469
 470         tmp = sbsec->flags & SE_MNTMASK;
 471         /* count the number of mount options for this sb */
 472         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 473                 if (tmp & 0x01)
 474                         opts->num_mnt_opts++;
 475                 tmp >>= 1;
 476         }
 477         /* Check if the Label support flag is set */
 478         if (sbsec->flags & SBLABEL_MNT)
 479                 opts->num_mnt_opts++;
 480
 481         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 482         if (!opts->mnt_opts) {
 483                 rc = -ENOMEM;
 484                 goto out_free;
 485         }
 486
 487         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 488         if (!opts->mnt_opts_flags) {
 489                 rc = -ENOMEM;
 490                 goto out_free;
 491         }
 492
 493         i = 0;
 494         if (sbsec->flags & FSCONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 500         }
 501         if (sbsec->flags & CONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 507         }
 508         if (sbsec->flags & DEFCONTEXT_MNT) {
 509                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 510                 if (rc)
 511                         goto out_free;
 512                 opts->mnt_opts[i] = context;
 513                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 514         }
 515         if (sbsec->flags & ROOTCONTEXT_MNT) {
 516                 struct inode *root = sbsec->sb->s_root->d_inode;
 517                 struct inode_security_struct *isec = root->i_security;
 518
 519                 rc = security_sid_to_context(isec->sid, &context, &len);
 520                 if (rc)
 521                         goto out_free;
 522                 opts->mnt_opts[i] = context;
 523                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 524         }
 525         if (sbsec->flags & SBLABEL_MNT) {
 526                 opts->mnt_opts[i] = NULL;
 527                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 528         }
 529
 530         BUG_ON(i != opts->num_mnt_opts);
 531
 532         return 0;
 533
 534 out_free:
 535         security_free_mnt_opts(opts);
 536         return rc;
 537 }
 538
 539 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 540                       u32 old_sid, u32 new_sid)
 541 {
 542         char mnt_flags = sbsec->flags & SE_MNTMASK;
 543
 544         /* check if the old mount command had the same options */
 545         if (sbsec->flags & SE_SBINITIALIZED)
 546                 if (!(sbsec->flags & flag) ||
 547                     (old_sid != new_sid))
 548                         return 1;
 549
 550         /* check if we were passed the same options twice,
 551          * aka someone passed context=a,context=b
 552          */
 553         if (!(sbsec->flags & SE_SBINITIALIZED))
 554                 if (mnt_flags & flag)
 555                         return 1;
 556         return 0;
 557 }
 558
 559 /*
 560  * Allow filesystems with binary mount data to explicitly set mount point
 561  * labeling information.
 562  */
 563 static int selinux_set_mnt_opts(struct super_block *sb,
 564                                 struct security_mnt_opts *opts)
 565 {
 566         const struct cred *cred = current_cred();
 567         int rc = 0, i;
 568         struct superblock_security_struct *sbsec = sb->s_security;
 569         const char *name = sb->s_type->name;
 570         struct inode *inode = sbsec->sb->s_root->d_inode;
 571         struct inode_security_struct *root_isec = inode->i_security;
 572         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 573         u32 defcontext_sid = 0;
 574         char **mount_options = opts->mnt_opts;
 575         int *flags = opts->mnt_opts_flags;
 576         int num_opts = opts->num_mnt_opts;
 577
 578         mutex_lock(&sbsec->lock);
 579
 580         if (!ss_initialized) {
 581                 if (!num_opts) {
 582                         /* Defer initialization until selinux_complete_init,
 583                            after the initial policy is loaded and the security
 584                            server is ready to handle calls. */
 585                         goto out;
 586                 }
 587                 rc = -EINVAL;
 588                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 589                         "before the security server is initialized\n");
 590                 goto out;
 591         }
 592
 593         /*
 594          * Binary mount data FS will come through this function twice.  Once
 595          * from an explicit call and once from the generic calls from the vfs.
 596          * Since the generic VFS calls will not contain any security mount data
 597          * we need to skip the double mount verification.
 598          *
 599          * This does open a hole in which we will not notice if the first
 600          * mount using this sb set explict options and a second mount using
 601          * this sb does not set any security options.  (The first options
 602          * will be used for both mounts)
 603          */
 604         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 605             && (num_opts == 0))
 606                 goto out;
 607
 608         /*
 609          * parse the mount options, check if they are valid sids.
 610          * also check if someone is trying to mount the same sb more
 611          * than once with different security options.
 612          */
 613         for (i = 0; i < num_opts; i++) {
 614                 u32 sid;
 615
 616                 if (flags[i] == SBLABEL_MNT)
 617                         continue;
 618                 rc = security_context_to_sid(mount_options[i],
 619                                              strlen(mount_options[i]), &sid);
 620                 if (rc) {
 621                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 622                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 623                                mount_options[i], sb->s_id, name, rc);
 624                         goto out;
 625                 }
 626                 switch (flags[i]) {
 627                 case FSCONTEXT_MNT:
 628                         fscontext_sid = sid;
 629
 630                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 631                                         fscontext_sid))
 632                                 goto out_double_mount;
 633
 634                         sbsec->flags |= FSCONTEXT_MNT;
 635                         break;
 636                 case CONTEXT_MNT:
 637                         context_sid = sid;
 638
 639                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 640                                         context_sid))
 641                                 goto out_double_mount;
 642
 643                         sbsec->flags |= CONTEXT_MNT;
 644                         break;
 645                 case ROOTCONTEXT_MNT:
 646                         rootcontext_sid = sid;
 647
 648                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 649                                         rootcontext_sid))
 650                                 goto out_double_mount;
 651
 652                         sbsec->flags |= ROOTCONTEXT_MNT;
 653
 654                         break;
 655                 case DEFCONTEXT_MNT:
 656                         defcontext_sid = sid;
 657
 658                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 659                                         defcontext_sid))
 660                                 goto out_double_mount;
 661
 662                         sbsec->flags |= DEFCONTEXT_MNT;
 663
 664                         break;
 665                 default:
 666                         rc = -EINVAL;
 667                         goto out;
 668                 }
 669         }
 670
 671         if (sbsec->flags & SE_SBINITIALIZED) {
 672                 /* previously mounted with options, but not on this attempt? */
 673                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 674                         goto out_double_mount;
 675                 rc = 0;
 676                 goto out;
 677         }
 678
 679         if (strcmp(sb->s_type->name, "proc") == 0)
 680                 sbsec->flags |= SE_SBPROC;
 681
 682         /* Determine the labeling behavior to use for this filesystem type. */
 683         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 684         if (rc) {
 685                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 686                        __func__, sb->s_type->name, rc);
 687                 goto out;
 688         }
 689
 690         /* sets the context of the superblock for the fs being mounted. */
 691         if (fscontext_sid) {
 692                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 693                 if (rc)
 694                         goto out;
 695
 696                 sbsec->sid = fscontext_sid;
 697         }
 698
 699         /*
 700          * Switch to using mount point labeling behavior.
 701          * sets the label used on all file below the mountpoint, and will set
 702          * the superblock context if not already set.
 703          */
 704         if (context_sid) {
 705                 if (!fscontext_sid) {
 706                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 707                                                           cred);
 708                         if (rc)
 709                                 goto out;
 710                         sbsec->sid = context_sid;
 711                 } else {
 712                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 713                                                              cred);
 714                         if (rc)
 715                                 goto out;
 716                 }
 717                 if (!rootcontext_sid)
 718                         rootcontext_sid = context_sid;
 719
 720                 sbsec->mntpoint_sid = context_sid;
 721                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 722         }
 723
 724         if (rootcontext_sid) {
 725                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 726                                                      cred);
 727                 if (rc)
 728                         goto out;
 729
 730                 root_isec->sid = rootcontext_sid;
 731                 root_isec->initialized = 1;
 732         }
 733
 734         if (defcontext_sid) {
 735                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 736                         rc = -EINVAL;
 737                         printk(KERN_WARNING "SELinux: defcontext option is "
 738                                "invalid for this filesystem type\n");
 739                         goto out;
 740                 }
 741
 742                 if (defcontext_sid != sbsec->def_sid) {
 743                         rc = may_context_mount_inode_relabel(defcontext_sid,
 744                                                              sbsec, cred);
 745                         if (rc)
 746                                 goto out;
 747                 }
 748
 749                 sbsec->def_sid = defcontext_sid;
 750         }
 751
 752         rc = sb_finish_set_opts(sb);
 753 out:
 754         mutex_unlock(&sbsec->lock);
 755         return rc;
 756 out_double_mount:
 757         rc = -EINVAL;
 758         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 759                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 760         goto out;
 761 }
 762
 763 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 764                                     const struct super_block *newsb)
 765 {
 766         struct superblock_security_struct *old = oldsb->s_security;
 767         struct superblock_security_struct *new = newsb->s_security;
 768         char oldflags = old->flags & SE_MNTMASK;
 769         char newflags = new->flags & SE_MNTMASK;
 770
 771         if (oldflags != newflags)
 772                 goto mismatch;
 773         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 774                 goto mismatch;
 775         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 776                 goto mismatch;
 777         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 778                 goto mismatch;
 779         if (oldflags & ROOTCONTEXT_MNT) {
 780                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 781                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 782                 if (oldroot->sid != newroot->sid)
 783                         goto mismatch;
 784         }
 785         return 0;
 786 mismatch:
 787         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 788                             "different security settings for (dev %s, "
 789                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 790         return -EBUSY;
 791 }
 792
 793 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 794                                         struct super_block *newsb)
 795 {
 796         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 797         struct superblock_security_struct *newsbsec = newsb->s_security;
 798
 799         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 800         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 801         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 802
 803         /*
 804          * if the parent was able to be mounted it clearly had no special lsm
 805          * mount options.  thus we can safely deal with this superblock later
 806          */
 807         if (!ss_initialized)
 808                 return 0;
 809
 810         /* how can we clone if the old one wasn't set up?? */
 811         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 812
 813         /* if fs is reusing a sb, make sure that the contexts match */
 814         if (newsbsec->flags & SE_SBINITIALIZED)
 815                 return selinux_cmp_sb_context(oldsb, newsb);
 816
 817         mutex_lock(&newsbsec->lock);
 818
 819         newsbsec->flags = oldsbsec->flags;
 820
 821         newsbsec->sid = oldsbsec->sid;
 822         newsbsec->def_sid = oldsbsec->def_sid;
 823         newsbsec->behavior = oldsbsec->behavior;
 824
 825         if (set_context) {
 826                 u32 sid = oldsbsec->mntpoint_sid;
 827
 828                 if (!set_fscontext)
 829                         newsbsec->sid = sid;
 830                 if (!set_rootcontext) {
 831                         struct inode *newinode = newsb->s_root->d_inode;
 832                         struct inode_security_struct *newisec = newinode->i_security;
 833                         newisec->sid = sid;
 834                 }
 835                 newsbsec->mntpoint_sid = sid;
 836         }
 837         if (set_rootcontext) {
 838                 const struct inode *oldinode = oldsb->s_root->d_inode;
 839                 const struct inode_security_struct *oldisec = oldinode->i_security;
 840                 struct inode *newinode = newsb->s_root->d_inode;
 841                 struct inode_security_struct *newisec = newinode->i_security;
 842
 843                 newisec->sid = oldisec->sid;
 844         }
 845
 846         sb_finish_set_opts(newsb);
 847         mutex_unlock(&newsbsec->lock);
 848         return 0;
 849 }
 850
 851 static int selinux_parse_opts_str(char *options,
 852                                   struct security_mnt_opts *opts)
 853 {
 854         char *p;
 855         char *context = NULL, *defcontext = NULL;
 856         char *fscontext = NULL, *rootcontext = NULL;
 857         int rc, num_mnt_opts = 0;
 858
 859         opts->num_mnt_opts = 0;
 860
 861         /* Standard string-based options. */
 862         while ((p = strsep(&options, "|")) != NULL) {
 863                 int token;
 864                 substring_t args[MAX_OPT_ARGS];
 865
 866                 if (!*p)
 867                         continue;
 868
 869                 token = match_token(p, tokens, args);
 870
 871                 switch (token) {
 872                 case Opt_context:
 873                         if (context || defcontext) {
 874                                 rc = -EINVAL;
 875                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 876                                 goto out_err;
 877                         }
 878                         context = match_strdup(&args[0]);
 879                         if (!context) {
 880                                 rc = -ENOMEM;
 881                                 goto out_err;
 882                         }
 883                         break;
 884
 885                 case Opt_fscontext:
 886                         if (fscontext) {
 887                                 rc = -EINVAL;
 888                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 889                                 goto out_err;
 890                         }
 891                         fscontext = match_strdup(&args[0]);
 892                         if (!fscontext) {
 893                                 rc = -ENOMEM;
 894                                 goto out_err;
 895                         }
 896                         break;
 897
 898                 case Opt_rootcontext:
 899                         if (rootcontext) {
 900                                 rc = -EINVAL;
 901                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 902                                 goto out_err;
 903                         }
 904                         rootcontext = match_strdup(&args[0]);
 905                         if (!rootcontext) {
 906                                 rc = -ENOMEM;
 907                                 goto out_err;
 908                         }
 909                         break;
 910
 911                 case Opt_defcontext:
 912                         if (context || defcontext) {
 913                                 rc = -EINVAL;
 914                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 915                                 goto out_err;
 916                         }
 917                         defcontext = match_strdup(&args[0]);
 918                         if (!defcontext) {
 919                                 rc = -ENOMEM;
 920                                 goto out_err;
 921                         }
 922                         break;
 923                 case Opt_labelsupport:
 924                         break;
 925                 default:
 926                         rc = -EINVAL;
 927                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 928                         goto out_err;
 929
 930                 }
 931         }
 932
 933         rc = -ENOMEM;
 934         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 935         if (!opts->mnt_opts)
 936                 goto out_err;
 937
 938         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 939         if (!opts->mnt_opts_flags) {
 940                 kfree(opts->mnt_opts);
 941                 goto out_err;
 942         }
 943
 944         if (fscontext) {
 945                 opts->mnt_opts[num_mnt_opts] = fscontext;
 946                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 947         }
 948         if (context) {
 949                 opts->mnt_opts[num_mnt_opts] = context;
 950                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 951         }
 952         if (rootcontext) {
 953                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 954                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 955         }
 956         if (defcontext) {
 957                 opts->mnt_opts[num_mnt_opts] = defcontext;
 958                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 959         }
 960
 961         opts->num_mnt_opts = num_mnt_opts;
 962         return 0;
 963
 964 out_err:
 965         kfree(context);
 966         kfree(defcontext);
 967         kfree(fscontext);
 968         kfree(rootcontext);
 969         return rc;
 970 }
 971 /*
 972  * string mount options parsing and call set the sbsec
 973  */
 974 static int superblock_doinit(struct super_block *sb, void *data)
 975 {
 976         int rc = 0;
 977         char *options = data;
 978         struct security_mnt_opts opts;
 979
 980         security_init_mnt_opts(&opts);
 981
 982         if (!data)
 983                 goto out;
 984
 985         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 986
 987         rc = selinux_parse_opts_str(options, &opts);
 988         if (rc)
 989                 goto out_err;
 990
 991 out:
 992         rc = selinux_set_mnt_opts(sb, &opts);
 993
 994 out_err:
 995         security_free_mnt_opts(&opts);
 996         return rc;
 997 }
 998
 999 static void selinux_write_opts(struct seq_file *m,
1000                                struct security_mnt_opts *opts)
1001 {
1002         int i;
1003         char *prefix;
1004
1005         for (i = 0; i < opts->num_mnt_opts; i++) {
1006                 char *has_comma;
1007
1008                 if (opts->mnt_opts[i])
1009                         has_comma = strchr(opts->mnt_opts[i], ',');
1010                 else
1011                         has_comma = NULL;
1012
1013                 switch (opts->mnt_opts_flags[i]) {
1014                 case CONTEXT_MNT:
1015                         prefix = CONTEXT_STR;
1016                         break;
1017                 case FSCONTEXT_MNT:
1018                         prefix = FSCONTEXT_STR;
1019                         break;
1020                 case ROOTCONTEXT_MNT:
1021                         prefix = ROOTCONTEXT_STR;
1022                         break;
1023                 case DEFCONTEXT_MNT:
1024                         prefix = DEFCONTEXT_STR;
1025                         break;
1026                 case SBLABEL_MNT:
1027                         seq_putc(m, ',');
1028                         seq_puts(m, LABELSUPP_STR);
1029                         continue;
1030                 default:
1031                         BUG();
1032                         return;
1033                 };
1034                 /* we need a comma before each option */
1035                 seq_putc(m, ',');
1036                 seq_puts(m, prefix);
1037                 if (has_comma)
1038                         seq_putc(m, '\"');
1039                 seq_puts(m, opts->mnt_opts[i]);
1040                 if (has_comma)
1041                         seq_putc(m, '\"');
1042         }
1043 }
1044
1045 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1046 {
1047         struct security_mnt_opts opts;
1048         int rc;
1049
1050         rc = selinux_get_mnt_opts(sb, &opts);
1051         if (rc) {
1052                 /* before policy load we may get EINVAL, don't show anything */
1053                 if (rc == -EINVAL)
1054                         rc = 0;
1055                 return rc;
1056         }
1057
1058         selinux_write_opts(m, &opts);
1059
1060         security_free_mnt_opts(&opts);
1061
1062         return rc;
1063 }
1064
1065 static inline u16 inode_mode_to_security_class(umode_t mode)
1066 {
1067         switch (mode & S_IFMT) {
1068         case S_IFSOCK:
1069                 return SECCLASS_SOCK_FILE;
1070         case S_IFLNK:
1071                 return SECCLASS_LNK_FILE;
1072         case S_IFREG:
1073                 return SECCLASS_FILE;
1074         case S_IFBLK:
1075                 return SECCLASS_BLK_FILE;
1076         case S_IFDIR:
1077                 return SECCLASS_DIR;
1078         case S_IFCHR:
1079                 return SECCLASS_CHR_FILE;
1080         case S_IFIFO:
1081                 return SECCLASS_FIFO_FILE;
1082
1083         }
1084
1085         return SECCLASS_FILE;
1086 }
1087
1088 static inline int default_protocol_stream(int protocol)
1089 {
1090         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1091 }
1092
1093 static inline int default_protocol_dgram(int protocol)
1094 {
1095         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1096 }
1097
1098 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1099 {
1100         switch (family) {
1101         case PF_UNIX:
1102                 switch (type) {
1103                 case SOCK_STREAM:
1104                 case SOCK_SEQPACKET:
1105                         return SECCLASS_UNIX_STREAM_SOCKET;
1106                 case SOCK_DGRAM:
1107                         return SECCLASS_UNIX_DGRAM_SOCKET;
1108                 }
1109                 break;
1110         case PF_INET:
1111         case PF_INET6:
1112                 switch (type) {
1113                 case SOCK_STREAM:
1114                         if (default_protocol_stream(protocol))
1115                                 return SECCLASS_TCP_SOCKET;
1116                         else
1117                                 return SECCLASS_RAWIP_SOCKET;
1118                 case SOCK_DGRAM:
1119                         if (default_protocol_dgram(protocol))
1120                                 return SECCLASS_UDP_SOCKET;
1121                         else
1122                                 return SECCLASS_RAWIP_SOCKET;
1123                 case SOCK_DCCP:
1124                         return SECCLASS_DCCP_SOCKET;
1125                 default:
1126                         return SECCLASS_RAWIP_SOCKET;
1127                 }
1128                 break;
1129         case PF_NETLINK:
1130                 switch (protocol) {
1131                 case NETLINK_ROUTE:
1132                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1133                 case NETLINK_FIREWALL:
1134                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1135                 case NETLINK_SOCK_DIAG:
1136                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1137                 case NETLINK_NFLOG:
1138                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1139                 case NETLINK_XFRM:
1140                         return SECCLASS_NETLINK_XFRM_SOCKET;
1141                 case NETLINK_SELINUX:
1142                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1143                 case NETLINK_AUDIT:
1144                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1145                 case NETLINK_IP6_FW:
1146                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1147                 case NETLINK_DNRTMSG:
1148                         return SECCLASS_NETLINK_DNRT_SOCKET;
1149                 case NETLINK_KOBJECT_UEVENT:
1150                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1151                 default:
1152                         return SECCLASS_NETLINK_SOCKET;
1153                 }
1154         case PF_PACKET:
1155                 return SECCLASS_PACKET_SOCKET;
1156         case PF_KEY:
1157                 return SECCLASS_KEY_SOCKET;
1158         case PF_APPLETALK:
1159                 return SECCLASS_APPLETALK_SOCKET;
1160         }
1161
1162         return SECCLASS_SOCKET;
1163 }
1164
1165 #ifdef CONFIG_PROC_FS
1166 static int selinux_proc_get_sid(struct dentry *dentry,
1167                                 u16 tclass,
1168                                 u32 *sid)
1169 {
1170         int rc;
1171         char *buffer, *path;
1172
1173         buffer = (char *)__get_free_page(GFP_KERNEL);
1174         if (!buffer)
1175                 return -ENOMEM;
1176
1177         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1178         if (IS_ERR(path))
1179                 rc = PTR_ERR(path);
1180         else {
1181                 /* each process gets a /proc/PID/ entry. Strip off the
1182                  * PID part to get a valid selinux labeling.
1183                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1184                 while (path[1] >= '0' && path[1] <= '9') {
1185                         path[1] = '/';
1186                         path++;
1187                 }
1188                 rc = security_genfs_sid("proc", path, tclass, sid);
1189         }
1190         free_page((unsigned long)buffer);
1191         return rc;
1192 }
1193 #else
1194 static int selinux_proc_get_sid(struct dentry *dentry,
1195                                 u16 tclass,
1196                                 u32 *sid)
1197 {
1198         return -EINVAL;
1199 }
1200 #endif
1201
1202 /* The inode's security attributes must be initialized before first use. */
1203 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1204 {
1205         struct superblock_security_struct *sbsec = NULL;
1206         struct inode_security_struct *isec = inode->i_security;
1207         u32 sid;
1208         struct dentry *dentry;
1209 #define INITCONTEXTLEN 255
1210         char *context = NULL;
1211         unsigned len = 0;
1212         int rc = 0;
1213
1214         if (isec->initialized)
1215                 goto out;
1216
1217         mutex_lock(&isec->lock);
1218         if (isec->initialized)
1219                 goto out_unlock;
1220
1221         sbsec = inode->i_sb->s_security;
1222         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1223                 /* Defer initialization until selinux_complete_init,
1224                    after the initial policy is loaded and the security
1225                    server is ready to handle calls. */
1226                 spin_lock(&sbsec->isec_lock);
1227                 if (list_empty(&isec->list))
1228                         list_add(&isec->list, &sbsec->isec_head);
1229                 spin_unlock(&sbsec->isec_lock);
1230                 goto out_unlock;
1231         }
1232
1233         switch (sbsec->behavior) {
1234         case SECURITY_FS_USE_XATTR:
1235                 if (!inode->i_op->getxattr) {
1236                         isec->sid = sbsec->def_sid;
1237                         break;
1238                 }
1239
1240                 /* Need a dentry, since the xattr API requires one.
1241                    Life would be simpler if we could just pass the inode. */
1242                 if (opt_dentry) {
1243                         /* Called from d_instantiate or d_splice_alias. */
1244                         dentry = dget(opt_dentry);
1245                 } else {
1246                         /* Called from selinux_complete_init, try to find a dentry. */
1247                         dentry = d_find_alias(inode);
1248                 }
1249                 if (!dentry) {
1250                         /*
1251                          * this is can be hit on boot when a file is accessed
1252                          * before the policy is loaded.  When we load policy we
1253                          * may find inodes that have no dentry on the
1254                          * sbsec->isec_head list.  No reason to complain as these
1255                          * will get fixed up the next time we go through
1256                          * inode_doinit with a dentry, before these inodes could
1257                          * be used again by userspace.
1258                          */
1259                         goto out_unlock;
1260                 }
1261
1262                 len = INITCONTEXTLEN;
1263                 context = kmalloc(len+1, GFP_NOFS);
1264                 if (!context) {
1265                         rc = -ENOMEM;
1266                         dput(dentry);
1267                         goto out_unlock;
1268                 }
1269                 context[len] = '\0';
1270                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1271                                            context, len);
1272                 if (rc == -ERANGE) {
1273                         kfree(context);
1274
1275                         /* Need a larger buffer.  Query for the right size. */
1276                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1277                                                    NULL, 0);
1278                         if (rc < 0) {
1279                                 dput(dentry);
1280                                 goto out_unlock;
1281                         }
1282                         len = rc;
1283                         context = kmalloc(len+1, GFP_NOFS);
1284                         if (!context) {
1285                                 rc = -ENOMEM;
1286                                 dput(dentry);
1287                                 goto out_unlock;
1288                         }
1289                         context[len] = '\0';
1290                         rc = inode->i_op->getxattr(dentry,
1291                                                    XATTR_NAME_SELINUX,
1292                                                    context, len);
1293                 }
1294                 dput(dentry);
1295                 if (rc < 0) {
1296                         if (rc != -ENODATA) {
1297                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1298                                        "%d for dev=%s ino=%ld\n", __func__,
1299                                        -rc, inode->i_sb->s_id, inode->i_ino);
1300                                 kfree(context);
1301                                 goto out_unlock;
1302                         }
1303                         /* Map ENODATA to the default file SID */
1304                         sid = sbsec->def_sid;
1305                         rc = 0;
1306                 } else {
1307                         rc = security_context_to_sid_default(context, rc, &sid,
1308                                                              sbsec->def_sid,
1309                                                              GFP_NOFS);
1310                         if (rc) {
1311                                 char *dev = inode->i_sb->s_id;
1312                                 unsigned long ino = inode->i_ino;
1313
1314                                 if (rc == -EINVAL) {
1315                                         if (printk_ratelimit())
1316                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1317                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1318                                                         "filesystem in question.\n", ino, dev, context);
1319                                 } else {
1320                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1321                                                "returned %d for dev=%s ino=%ld\n",
1322                                                __func__, context, -rc, dev, ino);
1323                                 }
1324                                 kfree(context);
1325                                 /* Leave with the unlabeled SID */
1326                                 rc = 0;
1327                                 break;
1328                         }
1329                 }
1330                 kfree(context);
1331                 isec->sid = sid;
1332                 break;
1333         case SECURITY_FS_USE_TASK:
1334                 isec->sid = isec->task_sid;
1335                 break;
1336         case SECURITY_FS_USE_TRANS:
1337                 /* Default to the fs SID. */
1338                 isec->sid = sbsec->sid;
1339
1340                 /* Try to obtain a transition SID. */
1341                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1342                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1343                                              isec->sclass, NULL, &sid);
1344                 if (rc)
1345                         goto out_unlock;
1346                 isec->sid = sid;
1347                 break;
1348         case SECURITY_FS_USE_MNTPOINT:
1349                 isec->sid = sbsec->mntpoint_sid;
1350                 break;
1351         default:
1352                 /* Default to the fs superblock SID. */
1353                 isec->sid = sbsec->sid;
1354
1355                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1356                         if (opt_dentry) {
1357                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358                                 rc = selinux_proc_get_sid(opt_dentry,
1359                                                           isec->sclass,
1360                                                           &sid);
1361                                 if (rc)
1362                                         goto out_unlock;
1363                                 isec->sid = sid;
1364                         }
1365                 }
1366                 break;
1367         }
1368
1369         isec->initialized = 1;
1370
1371 out_unlock:
1372         mutex_unlock(&isec->lock);
1373 out:
1374         if (isec->sclass == SECCLASS_FILE)
1375                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1376         return rc;
1377 }
1378
1379 /* Convert a Linux signal to an access vector. */
1380 static inline u32 signal_to_av(int sig)
1381 {
1382         u32 perm = 0;
1383
1384         switch (sig) {
1385         case SIGCHLD:
1386                 /* Commonly granted from child to parent. */
1387                 perm = PROCESS__SIGCHLD;
1388                 break;
1389         case SIGKILL:
1390                 /* Cannot be caught or ignored */
1391                 perm = PROCESS__SIGKILL;
1392                 break;
1393         case SIGSTOP:
1394                 /* Cannot be caught or ignored */
1395                 perm = PROCESS__SIGSTOP;
1396                 break;
1397         default:
1398                 /* All other signals. */
1399                 perm = PROCESS__SIGNAL;
1400                 break;
1401         }
1402
1403         return perm;
1404 }
1405
1406 /*
1407  * Check permission between a pair of credentials
1408  * fork check, ptrace check, etc.
1409  */
1410 static int cred_has_perm(const struct cred *actor,
1411                          const struct cred *target,
1412                          u32 perms)
1413 {
1414         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1415
1416         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1417 }
1418
1419 /*
1420  * Check permission between a pair of tasks, e.g. signal checks,
1421  * fork check, ptrace check, etc.
1422  * tsk1 is the actor and tsk2 is the target
1423  * - this uses the default subjective creds of tsk1
1424  */
1425 static int task_has_perm(const struct task_struct *tsk1,
1426                          const struct task_struct *tsk2,
1427                          u32 perms)
1428 {
1429         const struct task_security_struct *__tsec1, *__tsec2;
1430         u32 sid1, sid2;
1431
1432         rcu_read_lock();
1433         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1434         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1435         rcu_read_unlock();
1436         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1437 }
1438
1439 /*
1440  * Check permission between current and another task, e.g. signal checks,
1441  * fork check, ptrace check, etc.
1442  * current is the actor and tsk2 is the target
1443  * - this uses current's subjective creds
1444  */
1445 static int current_has_perm(const struct task_struct *tsk,
1446                             u32 perms)
1447 {
1448         u32 sid, tsid;
1449
1450         sid = current_sid();
1451         tsid = task_sid(tsk);
1452         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 #if CAP_LAST_CAP > 63
1456 #error Fix SELinux to handle capabilities > 63.
1457 #endif
1458
1459 /* Check whether a task is allowed to use a capability. */
1460 static int cred_has_capability(const struct cred *cred,
1461                                int cap, int audit)
1462 {
1463         struct common_audit_data ad;
1464         struct av_decision avd;
1465         u16 sclass;
1466         u32 sid = cred_sid(cred);
1467         u32 av = CAP_TO_MASK(cap);
1468         int rc;
1469
1470         ad.type = LSM_AUDIT_DATA_CAP;
1471         ad.u.cap = cap;
1472
1473         switch (CAP_TO_INDEX(cap)) {
1474         case 0:
1475                 sclass = SECCLASS_CAPABILITY;
1476                 break;
1477         case 1:
1478                 sclass = SECCLASS_CAPABILITY2;
1479                 break;
1480         default:
1481                 printk(KERN_ERR
1482                        "SELinux:  out of range capability %d\n", cap);
1483                 BUG();
1484                 return -EINVAL;
1485         }
1486
1487         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1488         if (audit == SECURITY_CAP_AUDIT) {
1489                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1490                 if (rc2)
1491                         return rc2;
1492         }
1493         return rc;
1494 }
1495
1496 /* Check whether a task is allowed to use a system operation. */
1497 static int task_has_system(struct task_struct *tsk,
1498                            u32 perms)
1499 {
1500         u32 sid = task_sid(tsk);
1501
1502         return avc_has_perm(sid, SECINITSID_KERNEL,
1503                             SECCLASS_SYSTEM, perms, NULL);
1504 }
1505
1506 /* Check whether a task has a particular permission to an inode.
1507    The 'adp' parameter is optional and allows other audit
1508    data to be passed (e.g. the dentry). */
1509 static int inode_has_perm(const struct cred *cred,
1510                           struct inode *inode,
1511                           u32 perms,
1512                           struct common_audit_data *adp,
1513                           unsigned flags)
1514 {
1515         struct inode_security_struct *isec;
1516         u32 sid;
1517
1518         validate_creds(cred);
1519
1520         if (unlikely(IS_PRIVATE(inode)))
1521                 return 0;
1522
1523         sid = cred_sid(cred);
1524         isec = inode->i_security;
1525
1526         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1527 }
1528
1529 /* Same as inode_has_perm, but pass explicit audit data containing
1530    the dentry to help the auditing code to more easily generate the
1531    pathname if needed. */
1532 static inline int dentry_has_perm(const struct cred *cred,
1533                                   struct dentry *dentry,
1534                                   u32 av)
1535 {
1536         struct inode *inode = dentry->d_inode;
1537         struct common_audit_data ad;
1538
1539         ad.type = LSM_AUDIT_DATA_DENTRY;
1540         ad.u.dentry = dentry;
1541         return inode_has_perm(cred, inode, av, &ad, 0);
1542 }
1543
1544 /* Same as inode_has_perm, but pass explicit audit data containing
1545    the path to help the auditing code to more easily generate the
1546    pathname if needed. */
1547 static inline int path_has_perm(const struct cred *cred,
1548                                 struct path *path,
1549                                 u32 av)
1550 {
1551         struct inode *inode = path->dentry->d_inode;
1552         struct common_audit_data ad;
1553
1554         ad.type = LSM_AUDIT_DATA_PATH;
1555         ad.u.path = *path;
1556         return inode_has_perm(cred, inode, av, &ad, 0);
1557 }
1558
1559 /* Check whether a task can use an open file descriptor to
1560    access an inode in a given way.  Check access to the
1561    descriptor itself, and then use dentry_has_perm to
1562    check a particular permission to the file.
1563    Access to the descriptor is implicitly granted if it
1564    has the same SID as the process.  If av is zero, then
1565    access to the file is not checked, e.g. for cases
1566    where only the descriptor is affected like seek. */
1567 static int file_has_perm(const struct cred *cred,
1568                          struct file *file,
1569                          u32 av)
1570 {
1571         struct file_security_struct *fsec = file->f_security;
1572         struct inode *inode = file_inode(file);
1573         struct common_audit_data ad;
1574         u32 sid = cred_sid(cred);
1575         int rc;
1576
1577         ad.type = LSM_AUDIT_DATA_PATH;
1578         ad.u.path = file->f_path;
1579
1580         if (sid != fsec->sid) {
1581                 rc = avc_has_perm(sid, fsec->sid,
1582                                   SECCLASS_FD,
1583                                   FD__USE,
1584                                   &ad);
1585                 if (rc)
1586                         goto out;
1587         }
1588
1589         /* av is zero if only checking access to the descriptor. */
1590         rc = 0;
1591         if (av)
1592                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1593
1594 out:
1595         return rc;
1596 }
1597
1598 /* Check whether a task can create a file. */
1599 static int may_create(struct inode *dir,
1600                       struct dentry *dentry,
1601                       u16 tclass)
1602 {
1603         const struct task_security_struct *tsec = current_security();
1604         struct inode_security_struct *dsec;
1605         struct superblock_security_struct *sbsec;
1606         u32 sid, newsid;
1607         struct common_audit_data ad;
1608         int rc;
1609
1610         dsec = dir->i_security;
1611         sbsec = dir->i_sb->s_security;
1612
1613         sid = tsec->sid;
1614         newsid = tsec->create_sid;
1615
1616         ad.type = LSM_AUDIT_DATA_DENTRY;
1617         ad.u.dentry = dentry;
1618
1619         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1620                           DIR__ADD_NAME | DIR__SEARCH,
1621                           &ad);
1622         if (rc)
1623                 return rc;
1624
1625         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1626                 rc = security_transition_sid(sid, dsec->sid, tclass,
1627                                              &dentry->d_name, &newsid);
1628                 if (rc)
1629                         return rc;
1630         }
1631
1632         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1633         if (rc)
1634                 return rc;
1635
1636         return avc_has_perm(newsid, sbsec->sid,
1637                             SECCLASS_FILESYSTEM,
1638                             FILESYSTEM__ASSOCIATE, &ad);
1639 }
1640
1641 /* Check whether a task can create a key. */
1642 static int may_create_key(u32 ksid,
1643                           struct task_struct *ctx)
1644 {
1645         u32 sid = task_sid(ctx);
1646
1647         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1648 }
1649
1650 #define MAY_LINK        0
1651 #define MAY_UNLINK      1
1652 #define MAY_RMDIR       2
1653
1654 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1655 static int may_link(struct inode *dir,
1656                     struct dentry *dentry,
1657                     int kind)
1658
1659 {
1660         struct inode_security_struct *dsec, *isec;
1661         struct common_audit_data ad;
1662         u32 sid = current_sid();
1663         u32 av;
1664         int rc;
1665
1666         dsec = dir->i_security;
1667         isec = dentry->d_inode->i_security;
1668
1669         ad.type = LSM_AUDIT_DATA_DENTRY;
1670         ad.u.dentry = dentry;
1671
1672         av = DIR__SEARCH;
1673         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1674         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1675         if (rc)
1676                 return rc;
1677
1678         switch (kind) {
1679         case MAY_LINK:
1680                 av = FILE__LINK;
1681                 break;
1682         case MAY_UNLINK:
1683                 av = FILE__UNLINK;
1684                 break;
1685         case MAY_RMDIR:
1686                 av = DIR__RMDIR;
1687                 break;
1688         default:
1689                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1690                         __func__, kind);
1691                 return 0;
1692         }
1693
1694         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1695         return rc;
1696 }
1697
1698 static inline int may_rename(struct inode *old_dir,
1699                              struct dentry *old_dentry,
1700                              struct inode *new_dir,
1701                              struct dentry *new_dentry)
1702 {
1703         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1704         struct common_audit_data ad;
1705         u32 sid = current_sid();
1706         u32 av;
1707         int old_is_dir, new_is_dir;
1708         int rc;
1709
1710         old_dsec = old_dir->i_security;
1711         old_isec = old_dentry->d_inode->i_security;
1712         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1713         new_dsec = new_dir->i_security;
1714
1715         ad.type = LSM_AUDIT_DATA_DENTRY;
1716
1717         ad.u.dentry = old_dentry;
1718         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1719                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1720         if (rc)
1721                 return rc;
1722         rc = avc_has_perm(sid, old_isec->sid,
1723                           old_isec->sclass, FILE__RENAME, &ad);
1724         if (rc)
1725                 return rc;
1726         if (old_is_dir && new_dir != old_dir) {
1727                 rc = avc_has_perm(sid, old_isec->sid,
1728                                   old_isec->sclass, DIR__REPARENT, &ad);
1729                 if (rc)
1730                         return rc;
1731         }
1732
1733         ad.u.dentry = new_dentry;
1734         av = DIR__ADD_NAME | DIR__SEARCH;
1735         if (new_dentry->d_inode)
1736                 av |= DIR__REMOVE_NAME;
1737         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1738         if (rc)
1739                 return rc;
1740         if (new_dentry->d_inode) {
1741                 new_isec = new_dentry->d_inode->i_security;
1742                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1743                 rc = avc_has_perm(sid, new_isec->sid,
1744                                   new_isec->sclass,
1745                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1746                 if (rc)
1747                         return rc;
1748         }
1749
1750         return 0;
1751 }
1752
1753 /* Check whether a task can perform a filesystem operation. */
1754 static int superblock_has_perm(const struct cred *cred,
1755                                struct super_block *sb,
1756                                u32 perms,
1757                                struct common_audit_data *ad)
1758 {
1759         struct superblock_security_struct *sbsec;
1760         u32 sid = cred_sid(cred);
1761
1762         sbsec = sb->s_security;
1763         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1764 }
1765
1766 /* Convert a Linux mode and permission mask to an access vector. */
1767 static inline u32 file_mask_to_av(int mode, int mask)
1768 {
1769         u32 av = 0;
1770
1771         if (!S_ISDIR(mode)) {
1772                 if (mask & MAY_EXEC)
1773                         av |= FILE__EXECUTE;
1774                 if (mask & MAY_READ)
1775                         av |= FILE__READ;
1776
1777                 if (mask & MAY_APPEND)
1778                         av |= FILE__APPEND;
1779                 else if (mask & MAY_WRITE)
1780                         av |= FILE__WRITE;
1781
1782         } else {
1783                 if (mask & MAY_EXEC)
1784                         av |= DIR__SEARCH;
1785                 if (mask & MAY_WRITE)
1786                         av |= DIR__WRITE;
1787                 if (mask & MAY_READ)
1788                         av |= DIR__READ;
1789         }
1790
1791         return av;
1792 }
1793
1794 /* Convert a Linux file to an access vector. */
1795 static inline u32 file_to_av(struct file *file)
1796 {
1797         u32 av = 0;
1798
1799         if (file->f_mode & FMODE_READ)
1800                 av |= FILE__READ;
1801         if (file->f_mode & FMODE_WRITE) {
1802                 if (file->f_flags & O_APPEND)
1803                         av |= FILE__APPEND;
1804                 else
1805                         av |= FILE__WRITE;
1806         }
1807         if (!av) {
1808                 /*
1809                  * Special file opened with flags 3 for ioctl-only use.
1810                  */
1811                 av = FILE__IOCTL;
1812         }
1813
1814         return av;
1815 }
1816
1817 /*
1818  * Convert a file to an access vector and include the correct open
1819  * open permission.
1820  */
1821 static inline u32 open_file_to_av(struct file *file)
1822 {
1823         u32 av = file_to_av(file);
1824
1825         if (selinux_policycap_openperm)
1826                 av |= FILE__OPEN;
1827
1828         return av;
1829 }
1830
1831 /* Hook functions begin here. */
1832
1833 static int selinux_ptrace_access_check(struct task_struct *child,
1834                                      unsigned int mode)
1835 {
1836         int rc;
1837
1838         rc = cap_ptrace_access_check(child, mode);
1839         if (rc)
1840                 return rc;
1841
1842         if (mode & PTRACE_MODE_READ) {
1843                 u32 sid = current_sid();
1844                 u32 csid = task_sid(child);
1845                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1846         }
1847
1848         return current_has_perm(child, PROCESS__PTRACE);
1849 }
1850
1851 static int selinux_ptrace_traceme(struct task_struct *parent)
1852 {
1853         int rc;
1854
1855         rc = cap_ptrace_traceme(parent);
1856         if (rc)
1857                 return rc;
1858
1859         return task_has_perm(parent, current, PROCESS__PTRACE);
1860 }
1861
1862 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1863                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1864 {
1865         int error;
1866
1867         error = current_has_perm(target, PROCESS__GETCAP);
1868         if (error)
1869                 return error;
1870
1871         return cap_capget(target, effective, inheritable, permitted);
1872 }
1873
1874 static int selinux_capset(struct cred *new, const struct cred *old,
1875                           const kernel_cap_t *effective,
1876                           const kernel_cap_t *inheritable,
1877                           const kernel_cap_t *permitted)
1878 {
1879         int error;
1880
1881         error = cap_capset(new, old,
1882                                       effective, inheritable, permitted);
1883         if (error)
1884                 return error;
1885
1886         return cred_has_perm(old, new, PROCESS__SETCAP);
1887 }
1888
1889 /*
1890  * (This comment used to live with the selinux_task_setuid hook,
1891  * which was removed).
1892  *
1893  * Since setuid only affects the current process, and since the SELinux
1894  * controls are not based on the Linux identity attributes, SELinux does not
1895  * need to control this operation.  However, SELinux does control the use of
1896  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1897  */
1898
1899 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1900                            int cap, int audit)
1901 {
1902         int rc;
1903
1904         rc = cap_capable(cred, ns, cap, audit);
1905         if (rc)
1906                 return rc;
1907
1908         return cred_has_capability(cred, cap, audit);
1909 }
1910
1911 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1912 {
1913         const struct cred *cred = current_cred();
1914         int rc = 0;
1915
1916         if (!sb)
1917                 return 0;
1918
1919         switch (cmds) {
1920         case Q_SYNC:
1921         case Q_QUOTAON:
1922         case Q_QUOTAOFF:
1923         case Q_SETINFO:
1924         case Q_SETQUOTA:
1925                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1926                 break;
1927         case Q_GETFMT:
1928         case Q_GETINFO:
1929         case Q_GETQUOTA:
1930                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1931                 break;
1932         default:
1933                 rc = 0;  /* let the kernel handle invalid cmds */
1934                 break;
1935         }
1936         return rc;
1937 }
1938
1939 static int selinux_quota_on(struct dentry *dentry)
1940 {
1941         const struct cred *cred = current_cred();
1942
1943         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1944 }
1945
1946 static int selinux_syslog(int type)
1947 {
1948         int rc;
1949
1950         switch (type) {
1951         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1952         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1953                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1954                 break;
1955         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1956         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1957         /* Set level of messages printed to console */
1958         case SYSLOG_ACTION_CONSOLE_LEVEL:
1959                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1960                 break;
1961         case SYSLOG_ACTION_CLOSE:       /* Close log */
1962         case SYSLOG_ACTION_OPEN:        /* Open log */
1963         case SYSLOG_ACTION_READ:        /* Read from log */
1964         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1965         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1966         default:
1967                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1968                 break;
1969         }
1970         return rc;
1971 }
1972
1973 /*
1974  * Check that a process has enough memory to allocate a new virtual
1975  * mapping. 0 means there is enough memory for the allocation to
1976  * succeed and -ENOMEM implies there is not.
1977  *
1978  * Do not audit the selinux permission check, as this is applied to all
1979  * processes that allocate mappings.
1980  */
1981 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1982 {
1983         int rc, cap_sys_admin = 0;
1984
1985         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1986                              SECURITY_CAP_NOAUDIT);
1987         if (rc == 0)
1988                 cap_sys_admin = 1;
1989
1990         return __vm_enough_memory(mm, pages, cap_sys_admin);
1991 }
1992
1993 /* binprm security operations */
1994
1995 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1996 {
1997         const struct task_security_struct *old_tsec;
1998         struct task_security_struct *new_tsec;
1999         struct inode_security_struct *isec;
2000         struct common_audit_data ad;
2001         struct inode *inode = file_inode(bprm->file);
2002         int rc;
2003
2004         rc = cap_bprm_set_creds(bprm);
2005         if (rc)
2006                 return rc;
2007
2008         /* SELinux context only depends on initial program or script and not
2009          * the script interpreter */
2010         if (bprm->cred_prepared)
2011                 return 0;
2012
2013         old_tsec = current_security();
2014         new_tsec = bprm->cred->security;
2015         isec = inode->i_security;
2016
2017         /* Default to the current task SID. */
2018         new_tsec->sid = old_tsec->sid;
2019         new_tsec->osid = old_tsec->sid;
2020
2021         /* Reset fs, key, and sock SIDs on execve. */
2022         new_tsec->create_sid = 0;
2023         new_tsec->keycreate_sid = 0;
2024         new_tsec->sockcreate_sid = 0;
2025
2026         if (old_tsec->exec_sid) {
2027                 new_tsec->sid = old_tsec->exec_sid;
2028                 /* Reset exec SID on execve. */
2029                 new_tsec->exec_sid = 0;
2030
2031                 /*
2032                  * Minimize confusion: if no_new_privs and a transition is
2033                  * explicitly requested, then fail the exec.
2034                  */
2035                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2036                         return -EPERM;
2037         } else {
2038                 /* Check for a default transition on this program. */
2039                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2040                                              SECCLASS_PROCESS, NULL,
2041                                              &new_tsec->sid);
2042                 if (rc)
2043                         return rc;
2044         }
2045
2046         ad.type = LSM_AUDIT_DATA_PATH;
2047         ad.u.path = bprm->file->f_path;
2048
2049         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2050             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2051                 new_tsec->sid = old_tsec->sid;
2052
2053         if (new_tsec->sid == old_tsec->sid) {
2054                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2055                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2056                 if (rc)
2057                         return rc;
2058         } else {
2059                 /* Check permissions for the transition. */
2060                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2061                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2062                 if (rc)
2063                         return rc;
2064
2065                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2066                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2067                 if (rc)
2068                         return rc;
2069
2070                 /* Check for shared state */
2071                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2072                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2073                                           SECCLASS_PROCESS, PROCESS__SHARE,
2074                                           NULL);
2075                         if (rc)
2076                                 return -EPERM;
2077                 }
2078
2079                 /* Make sure that anyone attempting to ptrace over a task that
2080                  * changes its SID has the appropriate permit */
2081                 if (bprm->unsafe &
2082                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2083                         struct task_struct *tracer;
2084                         struct task_security_struct *sec;
2085                         u32 ptsid = 0;
2086
2087                         rcu_read_lock();
2088                         tracer = ptrace_parent(current);
2089                         if (likely(tracer != NULL)) {
2090                                 sec = __task_cred(tracer)->security;
2091                                 ptsid = sec->sid;
2092                         }
2093                         rcu_read_unlock();
2094
2095                         if (ptsid != 0) {
2096                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2097                                                   SECCLASS_PROCESS,
2098                                                   PROCESS__PTRACE, NULL);
2099                                 if (rc)
2100                                         return -EPERM;
2101                         }
2102                 }
2103
2104                 /* Clear any possibly unsafe personality bits on exec: */
2105                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2106         }
2107
2108         return 0;
2109 }
2110
2111 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2112 {
2113         const struct task_security_struct *tsec = current_security();
2114         u32 sid, osid;
2115         int atsecure = 0;
2116
2117         sid = tsec->sid;
2118         osid = tsec->osid;
2119
2120         if (osid != sid) {
2121                 /* Enable secure mode for SIDs transitions unless
2122                    the noatsecure permission is granted between
2123                    the two SIDs, i.e. ahp returns 0. */
2124                 atsecure = avc_has_perm(osid, sid,
2125                                         SECCLASS_PROCESS,
2126                                         PROCESS__NOATSECURE, NULL);
2127         }
2128
2129         return (atsecure || cap_bprm_secureexec(bprm));
2130 }
2131
2132 static int match_file(const void *p, struct file *file, unsigned fd)
2133 {
2134         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2135 }
2136
2137 /* Derived from fs/exec.c:flush_old_files. */
2138 static inline void flush_unauthorized_files(const struct cred *cred,
2139                                             struct files_struct *files)
2140 {
2141         struct file *file, *devnull = NULL;
2142         struct tty_struct *tty;
2143         int drop_tty = 0;
2144         unsigned n;
2145
2146         tty = get_current_tty();
2147         if (tty) {
2148                 spin_lock(&tty_files_lock);
2149                 if (!list_empty(&tty->tty_files)) {
2150                         struct tty_file_private *file_priv;
2151
2152                         /* Revalidate access to controlling tty.
2153                            Use path_has_perm on the tty path directly rather
2154                            than using file_has_perm, as this particular open
2155                            file may belong to another process and we are only
2156                            interested in the inode-based check here. */
2157                         file_priv = list_first_entry(&tty->tty_files,
2158                                                 struct tty_file_private, list);
2159                         file = file_priv->file;
2160                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2161                                 drop_tty = 1;
2162                 }
2163                 spin_unlock(&tty_files_lock);
2164                 tty_kref_put(tty);
2165         }
2166         /* Reset controlling tty. */
2167         if (drop_tty)
2168                 no_tty();
2169
2170         /* Revalidate access to inherited open files. */
2171         n = iterate_fd(files, 0, match_file, cred);
2172         if (!n) /* none found? */
2173                 return;
2174
2175         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2176         if (IS_ERR(devnull))
2177                 devnull = NULL;
2178         /* replace all the matching ones with this */
2179         do {
2180                 replace_fd(n - 1, devnull, 0);
2181         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2182         if (devnull)
2183                 fput(devnull);
2184 }
2185
2186 /*
2187  * Prepare a process for imminent new credential changes due to exec
2188  */
2189 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2190 {
2191         struct task_security_struct *new_tsec;
2192         struct rlimit *rlim, *initrlim;
2193         int rc, i;
2194
2195         new_tsec = bprm->cred->security;
2196         if (new_tsec->sid == new_tsec->osid)
2197                 return;
2198
2199         /* Close files for which the new task SID is not authorized. */
2200         flush_unauthorized_files(bprm->cred, current->files);
2201
2202         /* Always clear parent death signal on SID transitions. */
2203         current->pdeath_signal = 0;
2204
2205         /* Check whether the new SID can inherit resource limits from the old
2206          * SID.  If not, reset all soft limits to the lower of the current
2207          * task's hard limit and the init task's soft limit.
2208          *
2209          * Note that the setting of hard limits (even to lower them) can be
2210          * controlled by the setrlimit check.  The inclusion of the init task's
2211          * soft limit into the computation is to avoid resetting soft limits
2212          * higher than the default soft limit for cases where the default is
2213          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2214          */
2215         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2216                           PROCESS__RLIMITINH, NULL);
2217         if (rc) {
2218                 /* protect against do_prlimit() */
2219                 task_lock(current);
2220                 for (i = 0; i < RLIM_NLIMITS; i++) {
2221                         rlim = current->signal->rlim + i;
2222                         initrlim = init_task.signal->rlim + i;
2223                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2224                 }
2225                 task_unlock(current);
2226                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2227         }
2228 }
2229
2230 /*
2231  * Clean up the process immediately after the installation of new credentials
2232  * due to exec
2233  */
2234 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2235 {
2236         const struct task_security_struct *tsec = current_security();
2237         struct itimerval itimer;
2238         u32 osid, sid;
2239         int rc, i;
2240
2241         osid = tsec->osid;
2242         sid = tsec->sid;
2243
2244         if (sid == osid)
2245                 return;
2246
2247         /* Check whether the new SID can inherit signal state from the old SID.
2248          * If not, clear itimers to avoid subsequent signal generation and
2249          * flush and unblock signals.
2250          *
2251          * This must occur _after_ the task SID has been updated so that any
2252          * kill done after the flush will be checked against the new SID.
2253          */
2254         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2255         if (rc) {
2256                 memset(&itimer, 0, sizeof itimer);
2257                 for (i = 0; i < 3; i++)
2258                         do_setitimer(i, &itimer, NULL);
2259                 spin_lock_irq(&current->sighand->siglock);
2260                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2261                         __flush_signals(current);
2262                         flush_signal_handlers(current, 1);
2263                         sigemptyset(&current->blocked);
2264                 }
2265                 spin_unlock_irq(&current->sighand->siglock);
2266         }
2267
2268         /* Wake up the parent if it is waiting so that it can recheck
2269          * wait permission to the new task SID. */
2270         read_lock(&tasklist_lock);
2271         __wake_up_parent(current, current->real_parent);
2272         read_unlock(&tasklist_lock);
2273 }
2274
2275 /* superblock security operations */
2276
2277 static int selinux_sb_alloc_security(struct super_block *sb)
2278 {
2279         return superblock_alloc_security(sb);
2280 }
2281
2282 static void selinux_sb_free_security(struct super_block *sb)
2283 {
2284         superblock_free_security(sb);
2285 }
2286
2287 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2288 {
2289         if (plen > olen)
2290                 return 0;
2291
2292         return !memcmp(prefix, option, plen);
2293 }
2294
2295 static inline int selinux_option(char *option, int len)
2296 {
2297         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2298                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2299                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2300                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2301                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2302 }
2303
2304 static inline void take_option(char **to, char *from, int *first, int len)
2305 {
2306         if (!*first) {
2307                 **to = ',';
2308                 *to += 1;
2309         } else
2310                 *first = 0;
2311         memcpy(*to, from, len);
2312         *to += len;
2313 }
2314
2315 static inline void take_selinux_option(char **to, char *from, int *first,
2316                                        int len)
2317 {
2318         int current_size = 0;
2319
2320         if (!*first) {
2321                 **to = '|';
2322                 *to += 1;
2323         } else
2324                 *first = 0;
2325
2326         while (current_size < len) {
2327                 if (*from != '"') {
2328                         **to = *from;
2329                         *to += 1;
2330                 }
2331                 from += 1;
2332                 current_size += 1;
2333         }
2334 }
2335
2336 static int selinux_sb_copy_data(char *orig, char *copy)
2337 {
2338         int fnosec, fsec, rc = 0;
2339         char *in_save, *in_curr, *in_end;
2340         char *sec_curr, *nosec_save, *nosec;
2341         int open_quote = 0;
2342
2343         in_curr = orig;
2344         sec_curr = copy;
2345
2346         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2347         if (!nosec) {
2348                 rc = -ENOMEM;
2349                 goto out;
2350         }
2351
2352         nosec_save = nosec;
2353         fnosec = fsec = 1;
2354         in_save = in_end = orig;
2355
2356         do {
2357                 if (*in_end == '"')
2358                         open_quote = !open_quote;
2359                 if ((*in_end == ',' && open_quote == 0) ||
2360                                 *in_end == '\0') {
2361                         int len = in_end - in_curr;
2362
2363                         if (selinux_option(in_curr, len))
2364                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2365                         else
2366                                 take_option(&nosec, in_curr, &fnosec, len);
2367
2368                         in_curr = in_end + 1;
2369                 }
2370         } while (*in_end++);
2371
2372         strcpy(in_save, nosec_save);
2373         free_page((unsigned long)nosec_save);
2374 out:
2375         return rc;
2376 }
2377
2378 static int selinux_sb_remount(struct super_block *sb, void *data)
2379 {
2380         int rc, i, *flags;
2381         struct security_mnt_opts opts;
2382         char *secdata, **mount_options;
2383         struct superblock_security_struct *sbsec = sb->s_security;
2384
2385         if (!(sbsec->flags & SE_SBINITIALIZED))
2386                 return 0;
2387
2388         if (!data)
2389                 return 0;
2390
2391         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2392                 return 0;
2393
2394         security_init_mnt_opts(&opts);
2395         secdata = alloc_secdata();
2396         if (!secdata)
2397                 return -ENOMEM;
2398         rc = selinux_sb_copy_data(data, secdata);
2399         if (rc)
2400                 goto out_free_secdata;
2401
2402         rc = selinux_parse_opts_str(secdata, &opts);
2403         if (rc)
2404                 goto out_free_secdata;
2405
2406         mount_options = opts.mnt_opts;
2407         flags = opts.mnt_opts_flags;
2408
2409         for (i = 0; i < opts.num_mnt_opts; i++) {
2410                 u32 sid;
2411                 size_t len;
2412
2413                 if (flags[i] == SBLABEL_MNT)
2414                         continue;
2415                 len = strlen(mount_options[i]);
2416                 rc = security_context_to_sid(mount_options[i], len, &sid);
2417                 if (rc) {
2418                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2419                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2420                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2421                         goto out_free_opts;
2422                 }
2423                 rc = -EINVAL;
2424                 switch (flags[i]) {
2425                 case FSCONTEXT_MNT:
2426                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2427                                 goto out_bad_option;
2428                         break;
2429                 case CONTEXT_MNT:
2430                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2431                                 goto out_bad_option;
2432                         break;
2433                 case ROOTCONTEXT_MNT: {
2434                         struct inode_security_struct *root_isec;
2435                         root_isec = sb->s_root->d_inode->i_security;
2436
2437                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2438                                 goto out_bad_option;
2439                         break;
2440                 }
2441                 case DEFCONTEXT_MNT:
2442                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2443                                 goto out_bad_option;
2444                         break;
2445                 default:
2446                         goto out_free_opts;
2447                 }
2448         }
2449
2450         rc = 0;
2451 out_free_opts:
2452         security_free_mnt_opts(&opts);
2453 out_free_secdata:
2454         free_secdata(secdata);
2455         return rc;
2456 out_bad_option:
2457         printk(KERN_WARNING "SELinux: unable to change security options "
2458                "during remount (dev %s, type=%s)\n", sb->s_id,
2459                sb->s_type->name);
2460         goto out_free_opts;
2461 }
2462
2463 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2464 {
2465         const struct cred *cred = current_cred();
2466         struct common_audit_data ad;
2467         int rc;
2468
2469         rc = superblock_doinit(sb, data);
2470         if (rc)
2471                 return rc;
2472
2473         /* Allow all mounts performed by the kernel */
2474         if (flags & MS_KERNMOUNT)
2475                 return 0;
2476
2477         ad.type = LSM_AUDIT_DATA_DENTRY;
2478         ad.u.dentry = sb->s_root;
2479         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2480 }
2481
2482 static int selinux_sb_statfs(struct dentry *dentry)
2483 {
2484         const struct cred *cred = current_cred();
2485         struct common_audit_data ad;
2486
2487         ad.type = LSM_AUDIT_DATA_DENTRY;
2488         ad.u.dentry = dentry->d_sb->s_root;
2489         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2490 }
2491
2492 static int selinux_mount(const char *dev_name,
2493                          struct path *path,
2494                          const char *type,
2495                          unsigned long flags,
2496                          void *data)
2497 {
2498         const struct cred *cred = current_cred();
2499
2500         if (flags & MS_REMOUNT)
2501                 return superblock_has_perm(cred, path->dentry->d_sb,
2502                                            FILESYSTEM__REMOUNT, NULL);
2503         else
2504                 return path_has_perm(cred, path, FILE__MOUNTON);
2505 }
2506
2507 static int selinux_umount(struct vfsmount *mnt, int flags)
2508 {
2509         const struct cred *cred = current_cred();
2510
2511         return superblock_has_perm(cred, mnt->mnt_sb,
2512                                    FILESYSTEM__UNMOUNT, NULL);
2513 }
2514
2515 /* inode security operations */
2516
2517 static int selinux_inode_alloc_security(struct inode *inode)
2518 {
2519         return inode_alloc_security(inode);
2520 }
2521
2522 static void selinux_inode_free_security(struct inode *inode)
2523 {
2524         inode_free_security(inode);
2525 }
2526
2527 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2528                                        const struct qstr *qstr, char **name,
2529                                        void **value, size_t *len)
2530 {
2531         const struct task_security_struct *tsec = current_security();
2532         struct inode_security_struct *dsec;
2533         struct superblock_security_struct *sbsec;
2534         u32 sid, newsid, clen;
2535         int rc;
2536         char *namep = NULL, *context;
2537
2538         dsec = dir->i_security;
2539         sbsec = dir->i_sb->s_security;
2540
2541         sid = tsec->sid;
2542         newsid = tsec->create_sid;
2543
2544         if ((sbsec->flags & SE_SBINITIALIZED) &&
2545             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2546                 newsid = sbsec->mntpoint_sid;
2547         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2548                 rc = security_transition_sid(sid, dsec->sid,
2549                                              inode_mode_to_security_class(inode->i_mode),
2550                                              qstr, &newsid);
2551                 if (rc) {
2552                         printk(KERN_WARNING "%s:  "
2553                                "security_transition_sid failed, rc=%d (dev=%s "
2554                                "ino=%ld)\n",
2555                                __func__,
2556                                -rc, inode->i_sb->s_id, inode->i_ino);
2557                         return rc;
2558                 }
2559         }
2560
2561         /* Possibly defer initialization to selinux_complete_init. */
2562         if (sbsec->flags & SE_SBINITIALIZED) {
2563                 struct inode_security_struct *isec = inode->i_security;
2564                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2565                 isec->sid = newsid;
2566                 isec->initialized = 1;
2567         }
2568
2569         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2570                 return -EOPNOTSUPP;
2571
2572         if (name) {
2573                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2574                 if (!namep)
2575                         return -ENOMEM;
2576                 *name = namep;
2577         }
2578
2579         if (value && len) {
2580                 rc = security_sid_to_context_force(newsid, &context, &clen);
2581                 if (rc) {
2582                         kfree(namep);
2583                         return rc;
2584                 }
2585                 *value = context;
2586                 *len = clen;
2587         }
2588
2589         return 0;
2590 }
2591
2592 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2593 {
2594         return may_create(dir, dentry, SECCLASS_FILE);
2595 }
2596
2597 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2598 {
2599         return may_link(dir, old_dentry, MAY_LINK);
2600 }
2601
2602 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2603 {
2604         return may_link(dir, dentry, MAY_UNLINK);
2605 }
2606
2607 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2608 {
2609         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2610 }
2611
2612 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2613 {
2614         return may_create(dir, dentry, SECCLASS_DIR);
2615 }
2616
2617 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2618 {
2619         return may_link(dir, dentry, MAY_RMDIR);
2620 }
2621
2622 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2623 {
2624         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2625 }
2626
2627 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2628                                 struct inode *new_inode, struct dentry *new_dentry)
2629 {
2630         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2631 }
2632
2633 static int selinux_inode_readlink(struct dentry *dentry)
2634 {
2635         const struct cred *cred = current_cred();
2636
2637         return dentry_has_perm(cred, dentry, FILE__READ);
2638 }
2639
2640 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2641 {
2642         const struct cred *cred = current_cred();
2643
2644         return dentry_has_perm(cred, dentry, FILE__READ);
2645 }
2646
2647 static noinline int audit_inode_permission(struct inode *inode,
2648                                            u32 perms, u32 audited, u32 denied,
2649                                            unsigned flags)
2650 {
2651         struct common_audit_data ad;
2652         struct inode_security_struct *isec = inode->i_security;
2653         int rc;
2654
2655         ad.type = LSM_AUDIT_DATA_INODE;
2656         ad.u.inode = inode;
2657
2658         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2659                             audited, denied, &ad, flags);
2660         if (rc)
2661                 return rc;
2662         return 0;
2663 }
2664
2665 static int selinux_inode_permission(struct inode *inode, int mask)
2666 {
2667         const struct cred *cred = current_cred();
2668         u32 perms;
2669         bool from_access;
2670         unsigned flags = mask & MAY_NOT_BLOCK;
2671         struct inode_security_struct *isec;
2672         u32 sid;
2673         struct av_decision avd;
2674         int rc, rc2;
2675         u32 audited, denied;
2676
2677         from_access = mask & MAY_ACCESS;
2678         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2679
2680         /* No permission to check.  Existence test. */
2681         if (!mask)
2682                 return 0;
2683
2684         validate_creds(cred);
2685
2686         if (unlikely(IS_PRIVATE(inode)))
2687                 return 0;
2688
2689         perms = file_mask_to_av(inode->i_mode, mask);
2690
2691         sid = cred_sid(cred);
2692         isec = inode->i_security;
2693
2694         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2695         audited = avc_audit_required(perms, &avd, rc,
2696                                      from_access ? FILE__AUDIT_ACCESS : 0,
2697                                      &denied);
2698         if (likely(!audited))
2699                 return rc;
2700
2701         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2702         if (rc2)
2703                 return rc2;
2704         return rc;
2705 }
2706
2707 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2708 {
2709         const struct cred *cred = current_cred();
2710         unsigned int ia_valid = iattr->ia_valid;
2711         __u32 av = FILE__WRITE;
2712
2713         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2714         if (ia_valid & ATTR_FORCE) {
2715                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2716                               ATTR_FORCE);
2717                 if (!ia_valid)
2718                         return 0;
2719         }
2720
2721         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2722                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2723                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2724
2725         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2726                 av |= FILE__OPEN;
2727
2728         return dentry_has_perm(cred, dentry, av);
2729 }
2730
2731 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2732 {
2733         const struct cred *cred = current_cred();
2734         struct path path;
2735
2736         path.dentry = dentry;
2737         path.mnt = mnt;
2738
2739         return path_has_perm(cred, &path, FILE__GETATTR);
2740 }
2741
2742 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2743 {
2744         const struct cred *cred = current_cred();
2745
2746         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2747                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2748                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2749                         if (!capable(CAP_SETFCAP))
2750                                 return -EPERM;
2751                 } else if (!capable(CAP_SYS_ADMIN)) {
2752                         /* A different attribute in the security namespace.
2753                            Restrict to administrator. */
2754                         return -EPERM;
2755                 }
2756         }
2757
2758         /* Not an attribute we recognize, so just check the
2759            ordinary setattr permission. */
2760         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2761 }
2762
2763 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2764                                   const void *value, size_t size, int flags)
2765 {
2766         struct inode *inode = dentry->d_inode;
2767         struct inode_security_struct *isec = inode->i_security;
2768         struct superblock_security_struct *sbsec;
2769         struct common_audit_data ad;
2770         u32 newsid, sid = current_sid();
2771         int rc = 0;
2772
2773         if (strcmp(name, XATTR_NAME_SELINUX))
2774                 return selinux_inode_setotherxattr(dentry, name);
2775
2776         sbsec = inode->i_sb->s_security;
2777         if (!(sbsec->flags & SBLABEL_MNT))
2778                 return -EOPNOTSUPP;
2779
2780         if (!inode_owner_or_capable(inode))
2781                 return -EPERM;
2782
2783         ad.type = LSM_AUDIT_DATA_DENTRY;
2784         ad.u.dentry = dentry;
2785
2786         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2787                           FILE__RELABELFROM, &ad);
2788         if (rc)
2789                 return rc;
2790
2791         rc = security_context_to_sid(value, size, &newsid);
2792         if (rc == -EINVAL) {
2793                 if (!capable(CAP_MAC_ADMIN)) {
2794                         struct audit_buffer *ab;
2795                         size_t audit_size;
2796                         const char *str;
2797
2798                         /* We strip a nul only if it is at the end, otherwise the
2799                          * context contains a nul and we should audit that */
2800                         if (value) {
2801                                 str = value;
2802                                 if (str[size - 1] == '\0')
2803                                         audit_size = size - 1;
2804                                 else
2805                                         audit_size = size;
2806                         } else {
2807                                 str = "";
2808                                 audit_size = 0;
2809                         }
2810                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2811                         audit_log_format(ab, "op=setxattr invalid_context=");
2812                         audit_log_n_untrustedstring(ab, value, audit_size);
2813                         audit_log_end(ab);
2814
2815                         return rc;
2816                 }
2817                 rc = security_context_to_sid_force(value, size, &newsid);
2818         }
2819         if (rc)
2820                 return rc;
2821
2822         rc = avc_has_perm(sid, newsid, isec->sclass,
2823                           FILE__RELABELTO, &ad);
2824         if (rc)
2825                 return rc;
2826
2827         rc = security_validate_transition(isec->sid, newsid, sid,
2828                                           isec->sclass);
2829         if (rc)
2830                 return rc;
2831
2832         return avc_has_perm(newsid,
2833                             sbsec->sid,
2834                             SECCLASS_FILESYSTEM,
2835                             FILESYSTEM__ASSOCIATE,
2836                             &ad);
2837 }
2838
2839 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2840                                         const void *value, size_t size,
2841                                         int flags)
2842 {
2843         struct inode *inode = dentry->d_inode;
2844         struct inode_security_struct *isec = inode->i_security;
2845         u32 newsid;
2846         int rc;
2847
2848         if (strcmp(name, XATTR_NAME_SELINUX)) {
2849                 /* Not an attribute we recognize, so nothing to do. */
2850                 return;
2851         }
2852
2853         rc = security_context_to_sid_force(value, size, &newsid);
2854         if (rc) {
2855                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2856                        "for (%s, %lu), rc=%d\n",
2857                        inode->i_sb->s_id, inode->i_ino, -rc);
2858                 return;
2859         }
2860
2861         isec->sid = newsid;
2862         return;
2863 }
2864
2865 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2866 {
2867         const struct cred *cred = current_cred();
2868
2869         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2870 }
2871
2872 static int selinux_inode_listxattr(struct dentry *dentry)
2873 {
2874         const struct cred *cred = current_cred();
2875
2876         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2877 }
2878
2879 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2880 {
2881         if (strcmp(name, XATTR_NAME_SELINUX))
2882                 return selinux_inode_setotherxattr(dentry, name);
2883
2884         /* No one is allowed to remove a SELinux security label.
2885            You can change the label, but all data must be labeled. */
2886         return -EACCES;
2887 }
2888
2889 /*
2890  * Copy the inode security context value to the user.
2891  *
2892  * Permission check is handled by selinux_inode_getxattr hook.
2893  */
2894 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2895 {
2896         u32 size;
2897         int error;
2898         char *context = NULL;
2899         struct inode_security_struct *isec = inode->i_security;
2900
2901         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2902                 return -EOPNOTSUPP;
2903
2904         /*
2905          * If the caller has CAP_MAC_ADMIN, then get the raw context
2906          * value even if it is not defined by current policy; otherwise,
2907          * use the in-core value under current policy.
2908          * Use the non-auditing forms of the permission checks since
2909          * getxattr may be called by unprivileged processes commonly
2910          * and lack of permission just means that we fall back to the
2911          * in-core context value, not a denial.
2912          */
2913         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2914                                 SECURITY_CAP_NOAUDIT);
2915         if (!error)
2916                 error = security_sid_to_context_force(isec->sid, &context,
2917                                                       &size);
2918         else
2919                 error = security_sid_to_context(isec->sid, &context, &size);
2920         if (error)
2921                 return error;
2922         error = size;
2923         if (alloc) {
2924                 *buffer = context;
2925                 goto out_nofree;
2926         }
2927         kfree(context);
2928 out_nofree:
2929         return error;
2930 }
2931
2932 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2933                                      const void *value, size_t size, int flags)
2934 {
2935         struct inode_security_struct *isec = inode->i_security;
2936         u32 newsid;
2937         int rc;
2938
2939         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2940                 return -EOPNOTSUPP;
2941
2942         if (!value || !size)
2943                 return -EACCES;
2944
2945         rc = security_context_to_sid((void *)value, size, &newsid);
2946         if (rc)
2947                 return rc;
2948
2949         isec->sid = newsid;
2950         isec->initialized = 1;
2951         return 0;
2952 }
2953
2954 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2955 {
2956         const int len = sizeof(XATTR_NAME_SELINUX);
2957         if (buffer && len <= buffer_size)
2958                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2959         return len;
2960 }
2961
2962 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2963 {
2964         struct inode_security_struct *isec = inode->i_security;
2965         *secid = isec->sid;
2966 }
2967
2968 /* file security operations */
2969
2970 static int selinux_revalidate_file_permission(struct file *file, int mask)
2971 {
2972         const struct cred *cred = current_cred();
2973         struct inode *inode = file_inode(file);
2974
2975         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2976         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2977                 mask |= MAY_APPEND;
2978
2979         return file_has_perm(cred, file,
2980                              file_mask_to_av(inode->i_mode, mask));
2981 }
2982
2983 static int selinux_file_permission(struct file *file, int mask)
2984 {
2985         struct inode *inode = file_inode(file);
2986         struct file_security_struct *fsec = file->f_security;
2987         struct inode_security_struct *isec = inode->i_security;
2988         u32 sid = current_sid();
2989
2990         if (!mask)
2991                 /* No permission to check.  Existence test. */
2992                 return 0;
2993
2994         if (sid == fsec->sid && fsec->isid == isec->sid &&
2995             fsec->pseqno == avc_policy_seqno())
2996                 /* No change since file_open check. */
2997                 return 0;
2998
2999         return selinux_revalidate_file_permission(file, mask);
3000 }
3001
3002 static int selinux_file_alloc_security(struct file *file)
3003 {
3004         return file_alloc_security(file);
3005 }
3006
3007 static void selinux_file_free_security(struct file *file)
3008 {
3009         file_free_security(file);
3010 }
3011
3012 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3013                               unsigned long arg)
3014 {
3015         const struct cred *cred = current_cred();
3016         int error = 0;
3017
3018         switch (cmd) {
3019         case FIONREAD:
3020         /* fall through */
3021         case FIBMAP:
3022         /* fall through */
3023         case FIGETBSZ:
3024         /* fall through */
3025         case FS_IOC_GETFLAGS:
3026         /* fall through */
3027         case FS_IOC_GETVERSION:
3028                 error = file_has_perm(cred, file, FILE__GETATTR);
3029                 break;
3030
3031         case FS_IOC_SETFLAGS:
3032         /* fall through */
3033         case FS_IOC_SETVERSION:
3034                 error = file_has_perm(cred, file, FILE__SETATTR);
3035                 break;
3036
3037         /* sys_ioctl() checks */
3038         case FIONBIO:
3039         /* fall through */
3040         case FIOASYNC:
3041                 error = file_has_perm(cred, file, 0);
3042                 break;
3043
3044         case KDSKBENT:
3045         case KDSKBSENT:
3046                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3047                                             SECURITY_CAP_AUDIT);
3048                 break;
3049
3050         /* default case assumes that the command will go
3051          * to the file's ioctl() function.
3052          */
3053         default:
3054                 error = file_has_perm(cred, file, FILE__IOCTL);
3055         }
3056         return error;
3057 }
3058
3059 static int default_noexec;
3060
3061 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3062 {
3063         const struct cred *cred = current_cred();
3064         int rc = 0;
3065
3066         if (default_noexec &&
3067             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3068                 /*
3069                  * We are making executable an anonymous mapping or a
3070                  * private file mapping that will also be writable.
3071                  * This has an additional check.
3072                  */
3073                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3074                 if (rc)
3075                         goto error;
3076         }
3077
3078         if (file) {
3079                 /* read access is always possible with a mapping */
3080                 u32 av = FILE__READ;
3081
3082                 /* write access only matters if the mapping is shared */
3083                 if (shared && (prot & PROT_WRITE))
3084                         av |= FILE__WRITE;
3085
3086                 if (prot & PROT_EXEC)
3087                         av |= FILE__EXECUTE;
3088
3089                 return file_has_perm(cred, file, av);
3090         }
3091
3092 error:
3093         return rc;
3094 }
3095
3096 static int selinux_mmap_addr(unsigned long addr)
3097 {
3098         int rc = 0;
3099         u32 sid = current_sid();
3100
3101         /*
3102          * notice that we are intentionally putting the SELinux check before
3103          * the secondary cap_file_mmap check.  This is such a likely attempt
3104          * at bad behaviour/exploit that we always want to get the AVC, even
3105          * if DAC would have also denied the operation.
3106          */
3107         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3108                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3109                                   MEMPROTECT__MMAP_ZERO, NULL);
3110                 if (rc)
3111                         return rc;
3112         }
3113
3114         /* do DAC check on address space usage */
3115         return cap_mmap_addr(addr);
3116 }
3117
3118 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3119                              unsigned long prot, unsigned long flags)
3120 {
3121         if (selinux_checkreqprot)
3122                 prot = reqprot;
3123
3124         return file_map_prot_check(file, prot,
3125                                    (flags & MAP_TYPE) == MAP_SHARED);
3126 }
3127
3128 static int selinux_file_mprotect(struct vm_area_struct *vma,
3129                                  unsigned long reqprot,
3130                                  unsigned long prot)
3131 {
3132         const struct cred *cred = current_cred();
3133
3134         if (selinux_checkreqprot)
3135                 prot = reqprot;
3136
3137         if (default_noexec &&
3138             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3139                 int rc = 0;
3140                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3141                     vma->vm_end <= vma->vm_mm->brk) {
3142                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3143                 } else if (!vma->vm_file &&
3144                            vma->vm_start <= vma->vm_mm->start_stack &&
3145                            vma->vm_end >= vma->vm_mm->start_stack) {
3146                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3147                 } else if (vma->vm_file && vma->anon_vma) {
3148                         /*
3149                          * We are making executable a file mapping that has
3150                          * had some COW done. Since pages might have been
3151                          * written, check ability to execute the possibly
3152                          * modified content.  This typically should only
3153                          * occur for text relocations.
3154                          */
3155                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3156                 }
3157                 if (rc)
3158                         return rc;
3159         }
3160
3161         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3162 }
3163
3164 static int selinux_file_lock(struct file *file, unsigned int cmd)
3165 {
3166         const struct cred *cred = current_cred();
3167
3168         return file_has_perm(cred, file, FILE__LOCK);
3169 }
3170
3171 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3172                               unsigned long arg)
3173 {
3174         const struct cred *cred = current_cred();
3175         int err = 0;
3176
3177         switch (cmd) {
3178         case F_SETFL:
3179                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3180                         err = file_has_perm(cred, file, FILE__WRITE);
3181                         break;
3182                 }
3183                 /* fall through */
3184         case F_SETOWN:
3185         case F_SETSIG:
3186         case F_GETFL:
3187         case F_GETOWN:
3188         case F_GETSIG:
3189         case F_GETOWNER_UIDS:
3190                 /* Just check FD__USE permission */
3191                 err = file_has_perm(cred, file, 0);
3192                 break;
3193         case F_GETLK:
3194         case F_SETLK:
3195         case F_SETLKW:
3196 #if BITS_PER_LONG == 32
3197         case F_GETLK64:
3198         case F_SETLK64:
3199         case F_SETLKW64:
3200 #endif
3201                 err = file_has_perm(cred, file, FILE__LOCK);
3202                 break;
3203         }
3204
3205         return err;
3206 }
3207
3208 static int selinux_file_set_fowner(struct file *file)
3209 {
3210         struct file_security_struct *fsec;
3211
3212         fsec = file->f_security;
3213         fsec->fown_sid = current_sid();
3214
3215         return 0;
3216 }
3217
3218 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3219                                        struct fown_struct *fown, int signum)
3220 {
3221         struct file *file;
3222         u32 sid = task_sid(tsk);
3223         u32 perm;
3224         struct file_security_struct *fsec;
3225
3226         /* struct fown_struct is never outside the context of a struct file */
3227         file = container_of(fown, struct file, f_owner);
3228
3229         fsec = file->f_security;
3230
3231         if (!signum)
3232                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3233         else
3234                 perm = signal_to_av(signum);
3235
3236         return avc_has_perm(fsec->fown_sid, sid,
3237                             SECCLASS_PROCESS, perm, NULL);
3238 }
3239
3240 static int selinux_file_receive(struct file *file)
3241 {
3242         const struct cred *cred = current_cred();
3243
3244         return file_has_perm(cred, file, file_to_av(file));
3245 }
3246
3247 static int selinux_file_open(struct file *file, const struct cred *cred)
3248 {
3249         struct file_security_struct *fsec;
3250         struct inode_security_struct *isec;
3251
3252         fsec = file->f_security;
3253         isec = file_inode(file)->i_security;
3254         /*
3255          * Save inode label and policy sequence number
3256          * at open-time so that selinux_file_permission
3257          * can determine whether revalidation is necessary.
3258          * Task label is already saved in the file security
3259          * struct as its SID.
3260          */
3261         fsec->isid = isec->sid;
3262         fsec->pseqno = avc_policy_seqno();
3263         /*
3264          * Since the inode label or policy seqno may have changed
3265          * between the selinux_inode_permission check and the saving
3266          * of state above, recheck that access is still permitted.
3267          * Otherwise, access might never be revalidated against the
3268          * new inode label or new policy.
3269          * This check is not redundant - do not remove.
3270          */
3271         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3272 }
3273
3274 /* task security operations */
3275
3276 static int selinux_task_create(unsigned long clone_flags)
3277 {
3278         return current_has_perm(current, PROCESS__FORK);
3279 }
3280
3281 /*
3282  * allocate the SELinux part of blank credentials
3283  */
3284 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3285 {
3286         struct task_security_struct *tsec;
3287
3288         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3289         if (!tsec)
3290                 return -ENOMEM;
3291
3292         cred->security = tsec;
3293         return 0;
3294 }
3295
3296 /*
3297  * detach and free the LSM part of a set of credentials
3298  */
3299 static void selinux_cred_free(struct cred *cred)
3300 {
3301         struct task_security_struct *tsec = cred->security;
3302
3303         /*
3304          * cred->security == NULL if security_cred_alloc_blank() or
3305          * security_prepare_creds() returned an error.
3306          */
3307         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3308         cred->security = (void *) 0x7UL;
3309         kfree(tsec);
3310 }
3311
3312 /*
3313  * prepare a new set of credentials for modification
3314  */
3315 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3316                                 gfp_t gfp)
3317 {
3318         const struct task_security_struct *old_tsec;
3319         struct task_security_struct *tsec;
3320
3321         old_tsec = old->security;
3322
3323         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3324         if (!tsec)
3325                 return -ENOMEM;
3326
3327         new->security = tsec;
3328         return 0;
3329 }
3330
3331 /*
3332  * transfer the SELinux data to a blank set of creds
3333  */
3334 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3335 {
3336         const struct task_security_struct *old_tsec = old->security;
3337         struct task_security_struct *tsec = new->security;
3338
3339         *tsec = *old_tsec;
3340 }
3341
3342 /*
3343  * set the security data for a kernel service
3344  * - all the creation contexts are set to unlabelled
3345  */
3346 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3347 {
3348         struct task_security_struct *tsec = new->security;
3349         u32 sid = current_sid();
3350         int ret;
3351
3352         ret = avc_has_perm(sid, secid,
3353                            SECCLASS_KERNEL_SERVICE,
3354                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3355                            NULL);
3356         if (ret == 0) {
3357                 tsec->sid = secid;
3358                 tsec->create_sid = 0;
3359                 tsec->keycreate_sid = 0;
3360                 tsec->sockcreate_sid = 0;
3361         }
3362         return ret;
3363 }
3364
3365 /*
3366  * set the file creation context in a security record to the same as the
3367  * objective context of the specified inode
3368  */
3369 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3370 {
3371         struct inode_security_struct *isec = inode->i_security;
3372         struct task_security_struct *tsec = new->security;
3373         u32 sid = current_sid();
3374         int ret;
3375
3376         ret = avc_has_perm(sid, isec->sid,
3377                            SECCLASS_KERNEL_SERVICE,
3378                            KERNEL_SERVICE__CREATE_FILES_AS,
3379                            NULL);
3380
3381         if (ret == 0)
3382                 tsec->create_sid = isec->sid;
3383         return ret;
3384 }
3385
3386 static int selinux_kernel_module_request(char *kmod_name)
3387 {
3388         u32 sid;
3389         struct common_audit_data ad;
3390
3391         sid = task_sid(current);
3392
3393         ad.type = LSM_AUDIT_DATA_KMOD;
3394         ad.u.kmod_name = kmod_name;
3395
3396         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3397                             SYSTEM__MODULE_REQUEST, &ad);
3398 }
3399
3400 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3401 {
3402         return current_has_perm(p, PROCESS__SETPGID);
3403 }
3404
3405 static int selinux_task_getpgid(struct task_struct *p)
3406 {
3407         return current_has_perm(p, PROCESS__GETPGID);
3408 }
3409
3410 static int selinux_task_getsid(struct task_struct *p)
3411 {
3412         return current_has_perm(p, PROCESS__GETSESSION);
3413 }
3414
3415 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3416 {
3417         *secid = task_sid(p);
3418 }
3419
3420 static int selinux_task_setnice(struct task_struct *p, int nice)
3421 {
3422         int rc;
3423
3424         rc = cap_task_setnice(p, nice);
3425         if (rc)
3426                 return rc;
3427
3428         return current_has_perm(p, PROCESS__SETSCHED);
3429 }
3430
3431 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3432 {
3433         int rc;
3434
3435         rc = cap_task_setioprio(p, ioprio);
3436         if (rc)
3437                 return rc;
3438
3439         return current_has_perm(p, PROCESS__SETSCHED);
3440 }
3441
3442 static int selinux_task_getioprio(struct task_struct *p)
3443 {
3444         return current_has_perm(p, PROCESS__GETSCHED);
3445 }
3446
3447 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3448                 struct rlimit *new_rlim)
3449 {
3450         struct rlimit *old_rlim = p->signal->rlim + resource;
3451
3452         /* Control the ability to change the hard limit (whether
3453            lowering or raising it), so that the hard limit can
3454            later be used as a safe reset point for the soft limit
3455            upon context transitions.  See selinux_bprm_committing_creds. */
3456         if (old_rlim->rlim_max != new_rlim->rlim_max)
3457                 return current_has_perm(p, PROCESS__SETRLIMIT);
3458
3459         return 0;
3460 }
3461
3462 static int selinux_task_setscheduler(struct task_struct *p)
3463 {
3464         int rc;
3465
3466         rc = cap_task_setscheduler(p);
3467         if (rc)
3468                 return rc;
3469
3470         return current_has_perm(p, PROCESS__SETSCHED);
3471 }
3472
3473 static int selinux_task_getscheduler(struct task_struct *p)
3474 {
3475         return current_has_perm(p, PROCESS__GETSCHED);
3476 }
3477
3478 static int selinux_task_movememory(struct task_struct *p)
3479 {
3480         return current_has_perm(p, PROCESS__SETSCHED);
3481 }
3482
3483 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3484                                 int sig, u32 secid)
3485 {
3486         u32 perm;
3487         int rc;
3488
3489         if (!sig)
3490                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3491         else
3492                 perm = signal_to_av(sig);
3493         if (secid)
3494                 rc = avc_has_perm(secid, task_sid(p),
3495                                   SECCLASS_PROCESS, perm, NULL);
3496         else
3497                 rc = current_has_perm(p, perm);
3498         return rc;
3499 }
3500
3501 static int selinux_task_wait(struct task_struct *p)
3502 {
3503         return task_has_perm(p, current, PROCESS__SIGCHLD);
3504 }
3505
3506 static void selinux_task_to_inode(struct task_struct *p,
3507                                   struct inode *inode)
3508 {
3509         struct inode_security_struct *isec = inode->i_security;
3510         u32 sid = task_sid(p);
3511
3512         isec->sid = sid;
3513         isec->initialized = 1;
3514 }
3515
3516 /* Returns error only if unable to parse addresses */
3517 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3518                         struct common_audit_data *ad, u8 *proto)
3519 {
3520         int offset, ihlen, ret = -EINVAL;
3521         struct iphdr _iph, *ih;
3522
3523         offset = skb_network_offset(skb);
3524         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3525         if (ih == NULL)
3526                 goto out;
3527
3528         ihlen = ih->ihl * 4;
3529         if (ihlen < sizeof(_iph))
3530                 goto out;
3531
3532         ad->u.net->v4info.saddr = ih->saddr;
3533         ad->u.net->v4info.daddr = ih->daddr;
3534         ret = 0;
3535
3536         if (proto)
3537                 *proto = ih->protocol;
3538
3539         switch (ih->protocol) {
3540         case IPPROTO_TCP: {
3541                 struct tcphdr _tcph, *th;
3542
3543                 if (ntohs(ih->frag_off) & IP_OFFSET)
3544                         break;
3545
3546                 offset += ihlen;
3547                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3548                 if (th == NULL)
3549                         break;
3550
3551                 ad->u.net->sport = th->source;
3552                 ad->u.net->dport = th->dest;
3553                 break;
3554         }
3555
3556         case IPPROTO_UDP: {
3557                 struct udphdr _udph, *uh;
3558
3559                 if (ntohs(ih->frag_off) & IP_OFFSET)
3560                         break;
3561
3562                 offset += ihlen;
3563                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3564                 if (uh == NULL)
3565                         break;
3566
3567                 ad->u.net->sport = uh->source;
3568                 ad->u.net->dport = uh->dest;
3569                 break;
3570         }
3571
3572         case IPPROTO_DCCP: {
3573                 struct dccp_hdr _dccph, *dh;
3574
3575                 if (ntohs(ih->frag_off) & IP_OFFSET)
3576                         break;
3577
3578                 offset += ihlen;
3579                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3580                 if (dh == NULL)
3581                         break;
3582
3583                 ad->u.net->sport = dh->dccph_sport;
3584                 ad->u.net->dport = dh->dccph_dport;
3585                 break;
3586         }
3587
3588         default:
3589                 break;
3590         }
3591 out:
3592         return ret;
3593 }
3594
3595 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3596
3597 /* Returns error only if unable to parse addresses */
3598 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3599                         struct common_audit_data *ad, u8 *proto)
3600 {
3601         u8 nexthdr;
3602         int ret = -EINVAL, offset;
3603         struct ipv6hdr _ipv6h, *ip6;
3604         __be16 frag_off;
3605
3606         offset = skb_network_offset(skb);
3607         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3608         if (ip6 == NULL)
3609                 goto out;
3610
3611         ad->u.net->v6info.saddr = ip6->saddr;
3612         ad->u.net->v6info.daddr = ip6->daddr;
3613         ret = 0;
3614
3615         nexthdr = ip6->nexthdr;
3616         offset += sizeof(_ipv6h);
3617         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3618         if (offset < 0)
3619                 goto out;
3620
3621         if (proto)
3622                 *proto = nexthdr;
3623
3624         switch (nexthdr) {
3625         case IPPROTO_TCP: {
3626                 struct tcphdr _tcph, *th;
3627
3628                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3629                 if (th == NULL)
3630                         break;
3631
3632                 ad->u.net->sport = th->source;
3633                 ad->u.net->dport = th->dest;
3634                 break;
3635         }
3636
3637         case IPPROTO_UDP: {
3638                 struct udphdr _udph, *uh;
3639
3640                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3641                 if (uh == NULL)
3642                         break;
3643
3644                 ad->u.net->sport = uh->source;
3645                 ad->u.net->dport = uh->dest;
3646                 break;
3647         }
3648
3649         case IPPROTO_DCCP: {
3650                 struct dccp_hdr _dccph, *dh;
3651
3652                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3653                 if (dh == NULL)
3654                         break;
3655
3656                 ad->u.net->sport = dh->dccph_sport;
3657                 ad->u.net->dport = dh->dccph_dport;
3658                 break;
3659         }
3660
3661         /* includes fragments */
3662         default:
3663                 break;
3664         }
3665 out:
3666         return ret;
3667 }
3668
3669 #endif /* IPV6 */
3670
3671 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3672                              char **_addrp, int src, u8 *proto)
3673 {
3674         char *addrp;
3675         int ret;
3676
3677         switch (ad->u.net->family) {
3678         case PF_INET:
3679                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3680                 if (ret)
3681                         goto parse_error;
3682                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3683                                        &ad->u.net->v4info.daddr);
3684                 goto okay;
3685
3686 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3687         case PF_INET6:
3688                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3689                 if (ret)
3690                         goto parse_error;
3691                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3692                                        &ad->u.net->v6info.daddr);
3693                 goto okay;
3694 #endif  /* IPV6 */
3695         default:
3696                 addrp = NULL;
3697                 goto okay;
3698         }
3699
3700 parse_error:
3701         printk(KERN_WARNING
3702                "SELinux: failure in selinux_parse_skb(),"
3703                " unable to parse packet\n");
3704         return ret;
3705
3706 okay:
3707         if (_addrp)
3708                 *_addrp = addrp;
3709         return 0;
3710 }
3711
3712 /**
3713  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3714  * @skb: the packet
3715  * @family: protocol family
3716  * @sid: the packet's peer label SID
3717  *
3718  * Description:
3719  * Check the various different forms of network peer labeling and determine
3720  * the peer label/SID for the packet; most of the magic actually occurs in
3721  * the security server function security_net_peersid_cmp().  The function
3722  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3723  * or -EACCES if @sid is invalid due to inconsistencies with the different
3724  * peer labels.
3725  *
3726  */
3727 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3728 {
3729         int err;
3730         u32 xfrm_sid;
3731         u32 nlbl_sid;
3732         u32 nlbl_type;
3733
3734         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3735         if (unlikely(err))
3736                 return -EACCES;
3737         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3738         if (unlikely(err))
3739                 return -EACCES;
3740
3741         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3742         if (unlikely(err)) {
3743                 printk(KERN_WARNING
3744                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3745                        " unable to determine packet's peer label\n");
3746                 return -EACCES;
3747         }
3748
3749         return 0;
3750 }
3751
3752 /* socket security operations */
3753
3754 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3755                                  u16 secclass, u32 *socksid)
3756 {
3757         if (tsec->sockcreate_sid > SECSID_NULL) {
3758                 *socksid = tsec->sockcreate_sid;
3759                 return 0;
3760         }
3761
3762         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3763                                        socksid);
3764 }
3765
3766 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3767 {
3768         struct sk_security_struct *sksec = sk->sk_security;
3769         struct common_audit_data ad;
3770         struct lsm_network_audit net = {0,};
3771         u32 tsid = task_sid(task);
3772
3773         if (sksec->sid == SECINITSID_KERNEL)
3774                 return 0;
3775
3776         ad.type = LSM_AUDIT_DATA_NET;
3777         ad.u.net = &net;
3778         ad.u.net->sk = sk;
3779
3780         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3781 }
3782
3783 static int selinux_socket_create(int family, int type,
3784                                  int protocol, int kern)
3785 {
3786         const struct task_security_struct *tsec = current_security();
3787         u32 newsid;
3788         u16 secclass;
3789         int rc;
3790
3791         if (kern)
3792                 return 0;
3793
3794         secclass = socket_type_to_security_class(family, type, protocol);
3795         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3796         if (rc)
3797                 return rc;
3798
3799         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3800 }
3801
3802 static int selinux_socket_post_create(struct socket *sock, int family,
3803                                       int type, int protocol, int kern)
3804 {
3805         const struct task_security_struct *tsec = current_security();
3806         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3807         struct sk_security_struct *sksec;
3808         int err = 0;
3809
3810         isec->sclass = socket_type_to_security_class(family, type, protocol);
3811
3812         if (kern)
3813                 isec->sid = SECINITSID_KERNEL;
3814         else {
3815                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3816                 if (err)
3817                         return err;
3818         }
3819
3820         isec->initialized = 1;
3821
3822         if (sock->sk) {
3823                 sksec = sock->sk->sk_security;
3824                 sksec->sid = isec->sid;
3825                 sksec->sclass = isec->sclass;
3826                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3827         }
3828
3829         return err;
3830 }
3831
3832 /* Range of port numbers used to automatically bind.
3833    Need to determine whether we should perform a name_bind
3834    permission check between the socket and the port number. */
3835
3836 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3837 {
3838         struct sock *sk = sock->sk;
3839         u16 family;
3840         int err;
3841
3842         err = sock_has_perm(current, sk, SOCKET__BIND);
3843         if (err)
3844                 goto out;
3845
3846         /*
3847          * If PF_INET or PF_INET6, check name_bind permission for the port.
3848          * Multiple address binding for SCTP is not supported yet: we just
3849          * check the first address now.
3850          */
3851         family = sk->sk_family;
3852         if (family == PF_INET || family == PF_INET6) {
3853                 char *addrp;
3854                 struct sk_security_struct *sksec = sk->sk_security;
3855                 struct common_audit_data ad;
3856                 struct lsm_network_audit net = {0,};
3857                 struct sockaddr_in *addr4 = NULL;
3858                 struct sockaddr_in6 *addr6 = NULL;
3859                 unsigned short snum;
3860                 u32 sid, node_perm;
3861
3862                 if (family == PF_INET) {
3863                         addr4 = (struct sockaddr_in *)address;
3864                         snum = ntohs(addr4->sin_port);
3865                         addrp = (char *)&addr4->sin_addr.s_addr;
3866                 } else {
3867                         addr6 = (struct sockaddr_in6 *)address;
3868                         snum = ntohs(addr6->sin6_port);
3869                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3870                 }
3871
3872                 if (snum) {
3873                         int low, high;
3874
3875                         inet_get_local_port_range(&low, &high);
3876
3877                         if (snum < max(PROT_SOCK, low) || snum > high) {
3878                                 err = sel_netport_sid(sk->sk_protocol,
3879                                                       snum, &sid);
3880                                 if (err)
3881                                         goto out;
3882                                 ad.type = LSM_AUDIT_DATA_NET;
3883                                 ad.u.net = &net;
3884                                 ad.u.net->sport = htons(snum);
3885                                 ad.u.net->family = family;
3886                                 err = avc_has_perm(sksec->sid, sid,
3887                                                    sksec->sclass,
3888                                                    SOCKET__NAME_BIND, &ad);
3889                                 if (err)
3890                                         goto out;
3891                         }
3892                 }
3893
3894                 switch (sksec->sclass) {
3895                 case SECCLASS_TCP_SOCKET:
3896                         node_perm = TCP_SOCKET__NODE_BIND;
3897                         break;
3898
3899                 case SECCLASS_UDP_SOCKET:
3900                         node_perm = UDP_SOCKET__NODE_BIND;
3901                         break;
3902
3903                 case SECCLASS_DCCP_SOCKET:
3904                         node_perm = DCCP_SOCKET__NODE_BIND;
3905                         break;
3906
3907                 default:
3908                         node_perm = RAWIP_SOCKET__NODE_BIND;
3909                         break;
3910                 }
3911
3912                 err = sel_netnode_sid(addrp, family, &sid);
3913                 if (err)
3914                         goto out;
3915
3916                 ad.type = LSM_AUDIT_DATA_NET;
3917                 ad.u.net = &net;
3918                 ad.u.net->sport = htons(snum);
3919                 ad.u.net->family = family;
3920
3921                 if (family == PF_INET)
3922                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3923                 else
3924                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3925
3926                 err = avc_has_perm(sksec->sid, sid,
3927                                    sksec->sclass, node_perm, &ad);
3928                 if (err)
3929                         goto out;
3930         }
3931 out:
3932         return err;
3933 }
3934
3935 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3936 {
3937         struct sock *sk = sock->sk;
3938         struct sk_security_struct *sksec = sk->sk_security;
3939         int err;
3940
3941         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3942         if (err)
3943                 return err;
3944
3945         /*
3946          * If a TCP or DCCP socket, check name_connect permission for the port.
3947          */
3948         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3949             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3950                 struct common_audit_data ad;
3951                 struct lsm_network_audit net = {0,};
3952                 struct sockaddr_in *addr4 = NULL;
3953                 struct sockaddr_in6 *addr6 = NULL;
3954                 unsigned short snum;
3955                 u32 sid, perm;
3956
3957                 if (sk->sk_family == PF_INET) {
3958                         addr4 = (struct sockaddr_in *)address;
3959                         if (addrlen < sizeof(struct sockaddr_in))
3960                                 return -EINVAL;
3961                         snum = ntohs(addr4->sin_port);
3962                 } else {
3963                         addr6 = (struct sockaddr_in6 *)address;
3964                         if (addrlen < SIN6_LEN_RFC2133)
3965                                 return -EINVAL;
3966                         snum = ntohs(addr6->sin6_port);
3967                 }
3968
3969                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3970                 if (err)
3971                         goto out;
3972
3973                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3974                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3975
3976                 ad.type = LSM_AUDIT_DATA_NET;
3977                 ad.u.net = &net;
3978                 ad.u.net->dport = htons(snum);
3979                 ad.u.net->family = sk->sk_family;
3980                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3981                 if (err)
3982                         goto out;
3983         }
3984
3985         err = selinux_netlbl_socket_connect(sk, address);
3986
3987 out:
3988         return err;
3989 }
3990
3991 static int selinux_socket_listen(struct socket *sock, int backlog)
3992 {
3993         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3994 }
3995
3996 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3997 {
3998         int err;
3999         struct inode_security_struct *isec;
4000         struct inode_security_struct *newisec;
4001
4002         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4003         if (err)
4004                 return err;
4005
4006         newisec = SOCK_INODE(newsock)->i_security;
4007
4008         isec = SOCK_INODE(sock)->i_security;
4009         newisec->sclass = isec->sclass;
4010         newisec->sid = isec->sid;
4011         newisec->initialized = 1;
4012
4013         return 0;
4014 }
4015
4016 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4017                                   int size)
4018 {
4019         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4020 }
4021
4022 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4023                                   int size, int flags)
4024 {
4025         return sock_has_perm(current, sock->sk, SOCKET__READ);
4026 }
4027
4028 static int selinux_socket_getsockname(struct socket *sock)
4029 {
4030         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4031 }
4032
4033 static int selinux_socket_getpeername(struct socket *sock)
4034 {
4035         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4036 }
4037
4038 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4039 {
4040         int err;
4041
4042         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4043         if (err)
4044                 return err;
4045
4046         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4047 }
4048
4049 static int selinux_socket_getsockopt(struct socket *sock, int level,
4050                                      int optname)
4051 {
4052         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4053 }
4054
4055 static int selinux_socket_shutdown(struct socket *sock, int how)
4056 {
4057         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4058 }
4059
4060 static int selinux_socket_unix_stream_connect(struct sock *sock,
4061                                               struct sock *other,
4062                                               struct sock *newsk)
4063 {
4064         struct sk_security_struct *sksec_sock = sock->sk_security;
4065         struct sk_security_struct *sksec_other = other->sk_security;
4066         struct sk_security_struct *sksec_new = newsk->sk_security;
4067         struct common_audit_data ad;
4068         struct lsm_network_audit net = {0,};
4069         int err;
4070
4071         ad.type = LSM_AUDIT_DATA_NET;
4072         ad.u.net = &net;
4073         ad.u.net->sk = other;
4074
4075         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4076                            sksec_other->sclass,
4077                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4078         if (err)
4079                 return err;
4080
4081         /* server child socket */
4082         sksec_new->peer_sid = sksec_sock->sid;
4083         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4084                                     &sksec_new->sid);
4085         if (err)
4086                 return err;
4087
4088         /* connecting socket */
4089         sksec_sock->peer_sid = sksec_new->sid;
4090
4091         return 0;
4092 }
4093
4094 static int selinux_socket_unix_may_send(struct socket *sock,
4095                                         struct socket *other)
4096 {
4097         struct sk_security_struct *ssec = sock->sk->sk_security;
4098         struct sk_security_struct *osec = other->sk->sk_security;
4099         struct common_audit_data ad;
4100         struct lsm_network_audit net = {0,};
4101
4102         ad.type = LSM_AUDIT_DATA_NET;
4103         ad.u.net = &net;
4104         ad.u.net->sk = other->sk;
4105
4106         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4107                             &ad);
4108 }
4109
4110 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4111                                     u32 peer_sid,
4112                                     struct common_audit_data *ad)
4113 {
4114         int err;
4115         u32 if_sid;
4116         u32 node_sid;
4117
4118         err = sel_netif_sid(ifindex, &if_sid);
4119         if (err)
4120                 return err;
4121         err = avc_has_perm(peer_sid, if_sid,
4122                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4123         if (err)
4124                 return err;
4125
4126         err = sel_netnode_sid(addrp, family, &node_sid);
4127         if (err)
4128                 return err;
4129         return avc_has_perm(peer_sid, node_sid,
4130                             SECCLASS_NODE, NODE__RECVFROM, ad);
4131 }
4132
4133 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4134                                        u16 family)
4135 {
4136         int err = 0;
4137         struct sk_security_struct *sksec = sk->sk_security;
4138         u32 sk_sid = sksec->sid;
4139         struct common_audit_data ad;
4140         struct lsm_network_audit net = {0,};
4141         char *addrp;
4142
4143         ad.type = LSM_AUDIT_DATA_NET;
4144         ad.u.net = &net;
4145         ad.u.net->netif = skb->skb_iif;
4146         ad.u.net->family = family;
4147         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4148         if (err)
4149                 return err;
4150
4151         if (selinux_secmark_enabled()) {
4152                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4153                                    PACKET__RECV, &ad);
4154                 if (err)
4155                         return err;
4156         }
4157
4158         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4159         if (err)
4160                 return err;
4161         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4162
4163         return err;
4164 }
4165
4166 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4167 {
4168         int err;
4169         struct sk_security_struct *sksec = sk->sk_security;
4170         u16 family = sk->sk_family;
4171         u32 sk_sid = sksec->sid;
4172         struct common_audit_data ad;
4173         struct lsm_network_audit net = {0,};
4174         char *addrp;
4175         u8 secmark_active;
4176         u8 peerlbl_active;
4177
4178         if (family != PF_INET && family != PF_INET6)
4179                 return 0;
4180
4181         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4182         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4183                 family = PF_INET;
4184
4185         /* If any sort of compatibility mode is enabled then handoff processing
4186          * to the selinux_sock_rcv_skb_compat() function to deal with the
4187          * special handling.  We do this in an attempt to keep this function
4188          * as fast and as clean as possible. */
4189         if (!selinux_policycap_netpeer)
4190                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4191
4192         secmark_active = selinux_secmark_enabled();
4193         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4194         if (!secmark_active && !peerlbl_active)
4195                 return 0;
4196
4197         ad.type = LSM_AUDIT_DATA_NET;
4198         ad.u.net = &net;
4199         ad.u.net->netif = skb->skb_iif;
4200         ad.u.net->family = family;
4201         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4202         if (err)
4203                 return err;
4204
4205         if (peerlbl_active) {
4206                 u32 peer_sid;
4207
4208                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4209                 if (err)
4210                         return err;
4211                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4212                                                peer_sid, &ad);
4213                 if (err) {
4214                         selinux_netlbl_err(skb, err, 0);
4215                         return err;
4216                 }
4217                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4218                                    PEER__RECV, &ad);
4219                 if (err)
4220                         selinux_netlbl_err(skb, err, 0);
4221         }
4222
4223         if (secmark_active) {
4224                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4225                                    PACKET__RECV, &ad);
4226                 if (err)
4227                         return err;
4228         }
4229
4230         return err;
4231 }
4232
4233 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4234                                             int __user *optlen, unsigned len)
4235 {
4236         int err = 0;
4237         char *scontext;
4238         u32 scontext_len;
4239         struct sk_security_struct *sksec = sock->sk->sk_security;
4240         u32 peer_sid = SECSID_NULL;
4241
4242         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4243             sksec->sclass == SECCLASS_TCP_SOCKET)
4244                 peer_sid = sksec->peer_sid;
4245         if (peer_sid == SECSID_NULL)
4246                 return -ENOPROTOOPT;
4247
4248         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4249         if (err)
4250                 return err;
4251
4252         if (scontext_len > len) {
4253                 err = -ERANGE;
4254                 goto out_len;
4255         }
4256
4257         if (copy_to_user(optval, scontext, scontext_len))
4258                 err = -EFAULT;
4259
4260 out_len:
4261         if (put_user(scontext_len, optlen))
4262                 err = -EFAULT;
4263         kfree(scontext);
4264         return err;
4265 }
4266
4267 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4268 {
4269         u32 peer_secid = SECSID_NULL;
4270         u16 family;
4271
4272         if (skb && skb->protocol == htons(ETH_P_IP))
4273                 family = PF_INET;
4274         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4275                 family = PF_INET6;
4276         else if (sock)
4277                 family = sock->sk->sk_family;
4278         else
4279                 goto out;
4280
4281         if (sock && family == PF_UNIX)
4282                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4283         else if (skb)
4284                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4285
4286 out:
4287         *secid = peer_secid;
4288         if (peer_secid == SECSID_NULL)
4289                 return -EINVAL;
4290         return 0;
4291 }
4292
4293 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4294 {
4295         struct sk_security_struct *sksec;
4296
4297         sksec = kzalloc(sizeof(*sksec), priority);
4298         if (!sksec)
4299                 return -ENOMEM;
4300
4301         sksec->peer_sid = SECINITSID_UNLABELED;
4302         sksec->sid = SECINITSID_UNLABELED;
4303         selinux_netlbl_sk_security_reset(sksec);
4304         sk->sk_security = sksec;
4305
4306         return 0;
4307 }
4308
4309 static void selinux_sk_free_security(struct sock *sk)
4310 {
4311         struct sk_security_struct *sksec = sk->sk_security;
4312
4313         sk->sk_security = NULL;
4314         selinux_netlbl_sk_security_free(sksec);
4315         kfree(sksec);
4316 }
4317
4318 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4319 {
4320         struct sk_security_struct *sksec = sk->sk_security;
4321         struct sk_security_struct *newsksec = newsk->sk_security;
4322
4323         newsksec->sid = sksec->sid;
4324         newsksec->peer_sid = sksec->peer_sid;
4325         newsksec->sclass = sksec->sclass;
4326
4327         selinux_netlbl_sk_security_reset(newsksec);
4328 }
4329
4330 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4331 {
4332         if (!sk)
4333                 *secid = SECINITSID_ANY_SOCKET;
4334         else {
4335                 struct sk_security_struct *sksec = sk->sk_security;
4336
4337                 *secid = sksec->sid;
4338         }
4339 }
4340
4341 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4342 {
4343         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4344         struct sk_security_struct *sksec = sk->sk_security;
4345
4346         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4347             sk->sk_family == PF_UNIX)
4348                 isec->sid = sksec->sid;
4349         sksec->sclass = isec->sclass;
4350 }
4351
4352 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4353                                      struct request_sock *req)
4354 {
4355         struct sk_security_struct *sksec = sk->sk_security;
4356         int err;
4357         u16 family = sk->sk_family;
4358         u32 newsid;
4359         u32 peersid;
4360
4361         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4362         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4363                 family = PF_INET;
4364
4365         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4366         if (err)
4367                 return err;
4368         if (peersid == SECSID_NULL) {
4369                 req->secid = sksec->sid;
4370                 req->peer_secid = SECSID_NULL;
4371         } else {
4372                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4373                 if (err)
4374                         return err;
4375                 req->secid = newsid;
4376                 req->peer_secid = peersid;
4377         }
4378
4379         return selinux_netlbl_inet_conn_request(req, family);
4380 }
4381
4382 static void selinux_inet_csk_clone(struct sock *newsk,
4383                                    const struct request_sock *req)
4384 {
4385         struct sk_security_struct *newsksec = newsk->sk_security;
4386
4387         newsksec->sid = req->secid;
4388         newsksec->peer_sid = req->peer_secid;
4389         /* NOTE: Ideally, we should also get the isec->sid for the
4390            new socket in sync, but we don't have the isec available yet.
4391            So we will wait until sock_graft to do it, by which
4392            time it will have been created and available. */
4393
4394         /* We don't need to take any sort of lock here as we are the only
4395          * thread with access to newsksec */
4396         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4397 }
4398
4399 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4400 {
4401         u16 family = sk->sk_family;
4402         struct sk_security_struct *sksec = sk->sk_security;
4403
4404         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4405         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4406                 family = PF_INET;
4407
4408         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4409 }
4410
4411 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4412 {
4413         skb_set_owner_w(skb, sk);
4414 }
4415
4416 static int selinux_secmark_relabel_packet(u32 sid)
4417 {
4418         const struct task_security_struct *__tsec;
4419         u32 tsid;
4420
4421         __tsec = current_security();
4422         tsid = __tsec->sid;
4423
4424         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4425 }
4426
4427 static void selinux_secmark_refcount_inc(void)
4428 {
4429         atomic_inc(&selinux_secmark_refcount);
4430 }
4431
4432 static void selinux_secmark_refcount_dec(void)
4433 {
4434         atomic_dec(&selinux_secmark_refcount);
4435 }
4436
4437 static void selinux_req_classify_flow(const struct request_sock *req,
4438                                       struct flowi *fl)
4439 {
4440         fl->flowi_secid = req->secid;
4441 }
4442
4443 static int selinux_tun_dev_alloc_security(void **security)
4444 {
4445         struct tun_security_struct *tunsec;
4446
4447         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4448         if (!tunsec)
4449                 return -ENOMEM;
4450         tunsec->sid = current_sid();
4451
4452         *security = tunsec;
4453         return 0;
4454 }
4455
4456 static void selinux_tun_dev_free_security(void *security)
4457 {
4458         kfree(security);
4459 }
4460
4461 static int selinux_tun_dev_create(void)
4462 {
4463         u32 sid = current_sid();
4464
4465         /* we aren't taking into account the "sockcreate" SID since the socket
4466          * that is being created here is not a socket in the traditional sense,
4467          * instead it is a private sock, accessible only to the kernel, and
4468          * representing a wide range of network traffic spanning multiple
4469          * connections unlike traditional sockets - check the TUN driver to
4470          * get a better understanding of why this socket is special */
4471
4472         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4473                             NULL);
4474 }
4475
4476 static int selinux_tun_dev_attach_queue(void *security)
4477 {
4478         struct tun_security_struct *tunsec = security;
4479
4480         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4481                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4482 }
4483
4484 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4485 {
4486         struct tun_security_struct *tunsec = security;
4487         struct sk_security_struct *sksec = sk->sk_security;
4488
4489         /* we don't currently perform any NetLabel based labeling here and it
4490          * isn't clear that we would want to do so anyway; while we could apply
4491          * labeling without the support of the TUN user the resulting labeled
4492          * traffic from the other end of the connection would almost certainly
4493          * cause confusion to the TUN user that had no idea network labeling
4494          * protocols were being used */
4495
4496         sksec->sid = tunsec->sid;
4497         sksec->sclass = SECCLASS_TUN_SOCKET;
4498
4499         return 0;
4500 }
4501
4502 static int selinux_tun_dev_open(void *security)
4503 {
4504         struct tun_security_struct *tunsec = security;
4505         u32 sid = current_sid();
4506         int err;
4507
4508         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4509                            TUN_SOCKET__RELABELFROM, NULL);
4510         if (err)
4511                 return err;
4512         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4513                            TUN_SOCKET__RELABELTO, NULL);
4514         if (err)
4515                 return err;
4516         tunsec->sid = sid;
4517
4518         return 0;
4519 }
4520
4521 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4522 {
4523         int err = 0;
4524         u32 perm;
4525         struct nlmsghdr *nlh;
4526         struct sk_security_struct *sksec = sk->sk_security;
4527
4528         if (skb->len < NLMSG_HDRLEN) {
4529                 err = -EINVAL;
4530                 goto out;
4531         }
4532         nlh = nlmsg_hdr(skb);
4533
4534         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4535         if (err) {
4536                 if (err == -EINVAL) {
4537                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4538                                   "SELinux:  unrecognized netlink message"
4539                                   " type=%hu for sclass=%hu\n",
4540                                   nlh->nlmsg_type, sksec->sclass);
4541                         if (!selinux_enforcing || security_get_allow_unknown())
4542                                 err = 0;
4543                 }
4544
4545                 /* Ignore */
4546                 if (err == -ENOENT)
4547                         err = 0;
4548                 goto out;
4549         }
4550
4551         err = sock_has_perm(current, sk, perm);
4552 out:
4553         return err;
4554 }
4555
4556 #ifdef CONFIG_NETFILTER
4557
4558 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4559                                        u16 family)
4560 {
4561         int err;
4562         char *addrp;
4563         u32 peer_sid;
4564         struct common_audit_data ad;
4565         struct lsm_network_audit net = {0,};
4566         u8 secmark_active;
4567         u8 netlbl_active;
4568         u8 peerlbl_active;
4569
4570         if (!selinux_policycap_netpeer)
4571                 return NF_ACCEPT;
4572
4573         secmark_active = selinux_secmark_enabled();
4574         netlbl_active = netlbl_enabled();
4575         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4576         if (!secmark_active && !peerlbl_active)
4577                 return NF_ACCEPT;
4578
4579         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4580                 return NF_DROP;
4581
4582         ad.type = LSM_AUDIT_DATA_NET;
4583         ad.u.net = &net;
4584         ad.u.net->netif = ifindex;
4585         ad.u.net->family = family;
4586         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4587                 return NF_DROP;
4588
4589         if (peerlbl_active) {
4590                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4591                                                peer_sid, &ad);
4592                 if (err) {
4593                         selinux_netlbl_err(skb, err, 1);
4594                         return NF_DROP;
4595                 }
4596         }
4597
4598         if (secmark_active)
4599                 if (avc_has_perm(peer_sid, skb->secmark,
4600                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4601                         return NF_DROP;
4602
4603         if (netlbl_active)
4604                 /* we do this in the FORWARD path and not the POST_ROUTING
4605                  * path because we want to make sure we apply the necessary
4606                  * labeling before IPsec is applied so we can leverage AH
4607                  * protection */
4608                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4609                         return NF_DROP;
4610
4611         return NF_ACCEPT;
4612 }
4613
4614 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4615                                          struct sk_buff *skb,
4616                                          const struct net_device *in,
4617                                          const struct net_device *out,
4618                                          int (*okfn)(struct sk_buff *))
4619 {
4620         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4621 }
4622
4623 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4624 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4625                                          struct sk_buff *skb,
4626                                          const struct net_device *in,
4627                                          const struct net_device *out,
4628                                          int (*okfn)(struct sk_buff *))
4629 {
4630         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4631 }
4632 #endif  /* IPV6 */
4633
4634 static unsigned int selinux_ip_output(struct sk_buff *skb,
4635                                       u16 family)
4636 {
4637         u32 sid;
4638
4639         if (!netlbl_enabled())
4640                 return NF_ACCEPT;
4641
4642         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4643          * because we want to make sure we apply the necessary labeling
4644          * before IPsec is applied so we can leverage AH protection */
4645         if (skb->sk) {
4646                 struct sk_security_struct *sksec = skb->sk->sk_security;
4647                 sid = sksec->sid;
4648         } else
4649                 sid = SECINITSID_KERNEL;
4650         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4651                 return NF_DROP;
4652
4653         return NF_ACCEPT;
4654 }
4655
4656 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4657                                         struct sk_buff *skb,
4658                                         const struct net_device *in,
4659                                         const struct net_device *out,
4660                                         int (*okfn)(struct sk_buff *))
4661 {
4662         return selinux_ip_output(skb, PF_INET);
4663 }
4664
4665 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4666                                                 int ifindex,
4667                                                 u16 family)
4668 {
4669         struct sock *sk = skb->sk;
4670         struct sk_security_struct *sksec;
4671         struct common_audit_data ad;
4672         struct lsm_network_audit net = {0,};
4673         char *addrp;
4674         u8 proto;
4675
4676         if (sk == NULL)
4677                 return NF_ACCEPT;
4678         sksec = sk->sk_security;
4679
4680         ad.type = LSM_AUDIT_DATA_NET;
4681         ad.u.net = &net;
4682         ad.u.net->netif = ifindex;
4683         ad.u.net->family = family;
4684         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4685                 return NF_DROP;
4686
4687         if (selinux_secmark_enabled())
4688                 if (avc_has_perm(sksec->sid, skb->secmark,
4689                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4690                         return NF_DROP_ERR(-ECONNREFUSED);
4691
4692         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4693                 return NF_DROP_ERR(-ECONNREFUSED);
4694
4695         return NF_ACCEPT;
4696 }
4697
4698 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4699                                          u16 family)
4700 {
4701         u32 secmark_perm;
4702         u32 peer_sid;
4703         struct sock *sk;
4704         struct common_audit_data ad;
4705         struct lsm_network_audit net = {0,};
4706         char *addrp;
4707         u8 secmark_active;
4708         u8 peerlbl_active;
4709
4710         /* If any sort of compatibility mode is enabled then handoff processing
4711          * to the selinux_ip_postroute_compat() function to deal with the
4712          * special handling.  We do this in an attempt to keep this function
4713          * as fast and as clean as possible. */
4714         if (!selinux_policycap_netpeer)
4715                 return selinux_ip_postroute_compat(skb, ifindex, family);
4716 #ifdef CONFIG_XFRM
4717         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4718          * packet transformation so allow the packet to pass without any checks
4719          * since we'll have another chance to perform access control checks
4720          * when the packet is on it's final way out.
4721          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4722          *       is NULL, in this case go ahead and apply access control. */
4723         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4724                 return NF_ACCEPT;
4725 #endif
4726         secmark_active = selinux_secmark_enabled();
4727         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4728         if (!secmark_active && !peerlbl_active)
4729                 return NF_ACCEPT;
4730
4731         /* if the packet is being forwarded then get the peer label from the
4732          * packet itself; otherwise check to see if it is from a local
4733          * application or the kernel, if from an application get the peer label
4734          * from the sending socket, otherwise use the kernel's sid */
4735         sk = skb->sk;
4736         if (sk == NULL) {
4737                 if (skb->skb_iif) {
4738                         secmark_perm = PACKET__FORWARD_OUT;
4739                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4740                                 return NF_DROP;
4741                 } else {
4742                         secmark_perm = PACKET__SEND;
4743                         peer_sid = SECINITSID_KERNEL;
4744                 }
4745         } else {
4746                 struct sk_security_struct *sksec = sk->sk_security;
4747                 peer_sid = sksec->sid;
4748                 secmark_perm = PACKET__SEND;
4749         }
4750
4751         ad.type = LSM_AUDIT_DATA_NET;
4752         ad.u.net = &net;
4753         ad.u.net->netif = ifindex;
4754         ad.u.net->family = family;
4755         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4756                 return NF_DROP;
4757
4758         if (secmark_active)
4759                 if (avc_has_perm(peer_sid, skb->secmark,
4760                                  SECCLASS_PACKET, secmark_perm, &ad))
4761                         return NF_DROP_ERR(-ECONNREFUSED);
4762
4763         if (peerlbl_active) {
4764                 u32 if_sid;
4765                 u32 node_sid;
4766
4767                 if (sel_netif_sid(ifindex, &if_sid))
4768                         return NF_DROP;
4769                 if (avc_has_perm(peer_sid, if_sid,
4770                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4771                         return NF_DROP_ERR(-ECONNREFUSED);
4772
4773                 if (sel_netnode_sid(addrp, family, &node_sid))
4774                         return NF_DROP;
4775                 if (avc_has_perm(peer_sid, node_sid,
4776                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4777                         return NF_DROP_ERR(-ECONNREFUSED);
4778         }
4779
4780         return NF_ACCEPT;
4781 }
4782
4783 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4784                                            struct sk_buff *skb,
4785                                            const struct net_device *in,
4786                                            const struct net_device *out,
4787                                            int (*okfn)(struct sk_buff *))
4788 {
4789         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4790 }
4791
4792 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4793 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4794                                            struct sk_buff *skb,
4795                                            const struct net_device *in,
4796                                            const struct net_device *out,
4797                                            int (*okfn)(struct sk_buff *))
4798 {
4799         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4800 }
4801 #endif  /* IPV6 */
4802
4803 #endif  /* CONFIG_NETFILTER */
4804
4805 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4806 {
4807         int err;
4808
4809         err = cap_netlink_send(sk, skb);
4810         if (err)
4811                 return err;
4812
4813         return selinux_nlmsg_perm(sk, skb);
4814 }
4815
4816 static int ipc_alloc_security(struct task_struct *task,
4817                               struct kern_ipc_perm *perm,
4818                               u16 sclass)
4819 {
4820         struct ipc_security_struct *isec;
4821         u32 sid;
4822
4823         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4824         if (!isec)
4825                 return -ENOMEM;
4826
4827         sid = task_sid(task);
4828         isec->sclass = sclass;
4829         isec->sid = sid;
4830         perm->security = isec;
4831
4832         return 0;
4833 }
4834
4835 static void ipc_free_security(struct kern_ipc_perm *perm)
4836 {
4837         struct ipc_security_struct *isec = perm->security;
4838         perm->security = NULL;
4839         kfree(isec);
4840 }
4841
4842 static int msg_msg_alloc_security(struct msg_msg *msg)
4843 {
4844         struct msg_security_struct *msec;
4845
4846         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4847         if (!msec)
4848                 return -ENOMEM;
4849
4850         msec->sid = SECINITSID_UNLABELED;
4851         msg->security = msec;
4852
4853         return 0;
4854 }
4855
4856 static void msg_msg_free_security(struct msg_msg *msg)
4857 {
4858         struct msg_security_struct *msec = msg->security;
4859
4860         msg->security = NULL;
4861         kfree(msec);
4862 }
4863
4864 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4865                         u32 perms)
4866 {
4867         struct ipc_security_struct *isec;
4868         struct common_audit_data ad;
4869         u32 sid = current_sid();
4870
4871         isec = ipc_perms->security;
4872
4873         ad.type = LSM_AUDIT_DATA_IPC;
4874         ad.u.ipc_id = ipc_perms->key;
4875
4876         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4877 }
4878
4879 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4880 {
4881         return msg_msg_alloc_security(msg);
4882 }
4883
4884 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4885 {
4886         msg_msg_free_security(msg);
4887 }
4888
4889 /* message queue security operations */
4890 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4891 {
4892         struct ipc_security_struct *isec;
4893         struct common_audit_data ad;
4894         u32 sid = current_sid();
4895         int rc;
4896
4897         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4898         if (rc)
4899                 return rc;
4900
4901         isec = msq->q_perm.security;
4902
4903         ad.type = LSM_AUDIT_DATA_IPC;
4904         ad.u.ipc_id = msq->q_perm.key;
4905
4906         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4907                           MSGQ__CREATE, &ad);
4908         if (rc) {
4909                 ipc_free_security(&msq->q_perm);
4910                 return rc;
4911         }
4912         return 0;
4913 }
4914
4915 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4916 {
4917         ipc_free_security(&msq->q_perm);
4918 }
4919
4920 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4921 {
4922         struct ipc_security_struct *isec;
4923         struct common_audit_data ad;
4924         u32 sid = current_sid();
4925
4926         isec = msq->q_perm.security;
4927
4928         ad.type = LSM_AUDIT_DATA_IPC;
4929         ad.u.ipc_id = msq->q_perm.key;
4930
4931         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4932                             MSGQ__ASSOCIATE, &ad);
4933 }
4934
4935 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4936 {
4937         int err;
4938         int perms;
4939
4940         switch (cmd) {
4941         case IPC_INFO:
4942         case MSG_INFO:
4943                 /* No specific object, just general system-wide information. */
4944                 return task_has_system(current, SYSTEM__IPC_INFO);
4945         case IPC_STAT:
4946         case MSG_STAT:
4947                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4948                 break;
4949         case IPC_SET:
4950                 perms = MSGQ__SETATTR;
4951                 break;
4952         case IPC_RMID:
4953                 perms = MSGQ__DESTROY;
4954                 break;
4955         default:
4956                 return 0;
4957         }
4958
4959         err = ipc_has_perm(&msq->q_perm, perms);
4960         return err;
4961 }
4962
4963 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4964 {
4965         struct ipc_security_struct *isec;
4966         struct msg_security_struct *msec;
4967         struct common_audit_data ad;
4968         u32 sid = current_sid();
4969         int rc;
4970
4971         isec = msq->q_perm.security;
4972         msec = msg->security;
4973
4974         /*
4975          * First time through, need to assign label to the message
4976          */
4977         if (msec->sid == SECINITSID_UNLABELED) {
4978                 /*
4979                  * Compute new sid based on current process and
4980                  * message queue this message will be stored in
4981                  */
4982                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4983                                              NULL, &msec->sid);
4984                 if (rc)
4985                         return rc;
4986         }
4987
4988         ad.type = LSM_AUDIT_DATA_IPC;
4989         ad.u.ipc_id = msq->q_perm.key;
4990
4991         /* Can this process write to the queue? */
4992         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4993                           MSGQ__WRITE, &ad);
4994         if (!rc)
4995                 /* Can this process send the message */
4996                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4997                                   MSG__SEND, &ad);
4998         if (!rc)
4999                 /* Can the message be put in the queue? */
5000                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5001                                   MSGQ__ENQUEUE, &ad);
5002
5003         return rc;
5004 }
5005
5006 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5007                                     struct task_struct *target,
5008                                     long type, int mode)
5009 {
5010         struct ipc_security_struct *isec;
5011         struct msg_security_struct *msec;
5012         struct common_audit_data ad;
5013         u32 sid = task_sid(target);
5014         int rc;
5015
5016         isec = msq->q_perm.security;
5017         msec = msg->security;
5018
5019         ad.type = LSM_AUDIT_DATA_IPC;
5020         ad.u.ipc_id = msq->q_perm.key;
5021
5022         rc = avc_has_perm(sid, isec->sid,
5023                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5024         if (!rc)
5025                 rc = avc_has_perm(sid, msec->sid,
5026                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5027         return rc;
5028 }
5029
5030 /* Shared Memory security operations */
5031 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5032 {
5033         struct ipc_security_struct *isec;
5034         struct common_audit_data ad;
5035         u32 sid = current_sid();
5036         int rc;
5037
5038         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5039         if (rc)
5040                 return rc;
5041
5042         isec = shp->shm_perm.security;
5043
5044         ad.type = LSM_AUDIT_DATA_IPC;
5045         ad.u.ipc_id = shp->shm_perm.key;
5046
5047         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5048                           SHM__CREATE, &ad);
5049         if (rc) {
5050                 ipc_free_security(&shp->shm_perm);
5051                 return rc;
5052         }
5053         return 0;
5054 }
5055
5056 static void selinux_shm_free_security(struct shmid_kernel *shp)
5057 {
5058         ipc_free_security(&shp->shm_perm);
5059 }
5060
5061 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5062 {
5063         struct ipc_security_struct *isec;
5064         struct common_audit_data ad;
5065         u32 sid = current_sid();
5066
5067         isec = shp->shm_perm.security;
5068
5069         ad.type = LSM_AUDIT_DATA_IPC;
5070         ad.u.ipc_id = shp->shm_perm.key;
5071
5072         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5073                             SHM__ASSOCIATE, &ad);
5074 }
5075
5076 /* Note, at this point, shp is locked down */
5077 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5078 {
5079         int perms;
5080         int err;
5081
5082         switch (cmd) {
5083         case IPC_INFO:
5084         case SHM_INFO:
5085                 /* No specific object, just general system-wide information. */
5086                 return task_has_system(current, SYSTEM__IPC_INFO);
5087         case IPC_STAT:
5088         case SHM_STAT:
5089                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5090                 break;
5091         case IPC_SET:
5092                 perms = SHM__SETATTR;
5093                 break;
5094         case SHM_LOCK:
5095         case SHM_UNLOCK:
5096                 perms = SHM__LOCK;
5097                 break;
5098         case IPC_RMID:
5099                 perms = SHM__DESTROY;
5100                 break;
5101         default:
5102                 return 0;
5103         }
5104
5105         err = ipc_has_perm(&shp->shm_perm, perms);
5106         return err;
5107 }
5108
5109 static int selinux_shm_shmat(struct shmid_kernel *shp,
5110                              char __user *shmaddr, int shmflg)
5111 {
5112         u32 perms;
5113
5114         if (shmflg & SHM_RDONLY)
5115                 perms = SHM__READ;
5116         else
5117                 perms = SHM__READ | SHM__WRITE;
5118
5119         return ipc_has_perm(&shp->shm_perm, perms);
5120 }
5121
5122 /* Semaphore security operations */
5123 static int selinux_sem_alloc_security(struct sem_array *sma)
5124 {
5125         struct ipc_security_struct *isec;
5126         struct common_audit_data ad;
5127         u32 sid = current_sid();
5128         int rc;
5129
5130         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5131         if (rc)
5132                 return rc;
5133
5134         isec = sma->sem_perm.security;
5135
5136         ad.type = LSM_AUDIT_DATA_IPC;
5137         ad.u.ipc_id = sma->sem_perm.key;
5138
5139         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5140                           SEM__CREATE, &ad);
5141         if (rc) {
5142                 ipc_free_security(&sma->sem_perm);
5143                 return rc;
5144         }
5145         return 0;
5146 }
5147
5148 static void selinux_sem_free_security(struct sem_array *sma)
5149 {
5150         ipc_free_security(&sma->sem_perm);
5151 }
5152
5153 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5154 {
5155         struct ipc_security_struct *isec;
5156         struct common_audit_data ad;
5157         u32 sid = current_sid();
5158
5159         isec = sma->sem_perm.security;
5160
5161         ad.type = LSM_AUDIT_DATA_IPC;
5162         ad.u.ipc_id = sma->sem_perm.key;
5163
5164         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5165                             SEM__ASSOCIATE, &ad);
5166 }
5167
5168 /* Note, at this point, sma is locked down */
5169 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5170 {
5171         int err;
5172         u32 perms;
5173
5174         switch (cmd) {
5175         case IPC_INFO:
5176         case SEM_INFO:
5177                 /* No specific object, just general system-wide information. */
5178                 return task_has_system(current, SYSTEM__IPC_INFO);
5179         case GETPID:
5180         case GETNCNT:
5181         case GETZCNT:
5182                 perms = SEM__GETATTR;
5183                 break;
5184         case GETVAL:
5185         case GETALL:
5186                 perms = SEM__READ;
5187                 break;
5188         case SETVAL:
5189         case SETALL:
5190                 perms = SEM__WRITE;
5191                 break;
5192         case IPC_RMID:
5193                 perms = SEM__DESTROY;
5194                 break;
5195         case IPC_SET:
5196                 perms = SEM__SETATTR;
5197                 break;
5198         case IPC_STAT:
5199         case SEM_STAT:
5200                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5201                 break;
5202         default:
5203                 return 0;
5204         }
5205
5206         err = ipc_has_perm(&sma->sem_perm, perms);
5207         return err;
5208 }
5209
5210 static int selinux_sem_semop(struct sem_array *sma,
5211                              struct sembuf *sops, unsigned nsops, int alter)
5212 {
5213         u32 perms;
5214
5215         if (alter)
5216                 perms = SEM__READ | SEM__WRITE;
5217         else
5218                 perms = SEM__READ;
5219
5220         return ipc_has_perm(&sma->sem_perm, perms);
5221 }
5222
5223 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5224 {
5225         u32 av = 0;
5226
5227         av = 0;
5228         if (flag & S_IRUGO)
5229                 av |= IPC__UNIX_READ;
5230         if (flag & S_IWUGO)
5231                 av |= IPC__UNIX_WRITE;
5232
5233         if (av == 0)
5234                 return 0;
5235
5236         return ipc_has_perm(ipcp, av);
5237 }
5238
5239 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5240 {
5241         struct ipc_security_struct *isec = ipcp->security;
5242         *secid = isec->sid;
5243 }
5244
5245 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5246 {
5247         if (inode)
5248                 inode_doinit_with_dentry(inode, dentry);
5249 }
5250
5251 static int selinux_getprocattr(struct task_struct *p,
5252                                char *name, char **value)
5253 {
5254         const struct task_security_struct *__tsec;
5255         u32 sid;
5256         int error;
5257         unsigned len;
5258
5259         if (current != p) {
5260                 error = current_has_perm(p, PROCESS__GETATTR);
5261                 if (error)
5262                         return error;
5263         }
5264
5265         rcu_read_lock();
5266         __tsec = __task_cred(p)->security;
5267
5268         if (!strcmp(name, "current"))
5269                 sid = __tsec->sid;
5270         else if (!strcmp(name, "prev"))
5271                 sid = __tsec->osid;
5272         else if (!strcmp(name, "exec"))
5273                 sid = __tsec->exec_sid;
5274         else if (!strcmp(name, "fscreate"))
5275                 sid = __tsec->create_sid;
5276         else if (!strcmp(name, "keycreate"))
5277                 sid = __tsec->keycreate_sid;
5278         else if (!strcmp(name, "sockcreate"))
5279                 sid = __tsec->sockcreate_sid;
5280         else
5281                 goto invalid;
5282         rcu_read_unlock();
5283
5284         if (!sid)
5285                 return 0;
5286
5287         error = security_sid_to_context(sid, value, &len);
5288         if (error)
5289                 return error;
5290         return len;
5291
5292 invalid:
5293         rcu_read_unlock();
5294         return -EINVAL;
5295 }
5296
5297 static int selinux_setprocattr(struct task_struct *p,
5298                                char *name, void *value, size_t size)
5299 {
5300         struct task_security_struct *tsec;
5301         struct task_struct *tracer;
5302         struct cred *new;
5303         u32 sid = 0, ptsid;
5304         int error;
5305         char *str = value;
5306
5307         if (current != p) {
5308                 /* SELinux only allows a process to change its own
5309                    security attributes. */
5310                 return -EACCES;
5311         }
5312
5313         /*
5314          * Basic control over ability to set these attributes at all.
5315          * current == p, but we'll pass them separately in case the
5316          * above restriction is ever removed.
5317          */
5318         if (!strcmp(name, "exec"))
5319                 error = current_has_perm(p, PROCESS__SETEXEC);
5320         else if (!strcmp(name, "fscreate"))
5321                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5322         else if (!strcmp(name, "keycreate"))
5323                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5324         else if (!strcmp(name, "sockcreate"))
5325                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5326         else if (!strcmp(name, "current"))
5327                 error = current_has_perm(p, PROCESS__SETCURRENT);
5328         else
5329                 error = -EINVAL;
5330         if (error)
5331                 return error;
5332
5333         /* Obtain a SID for the context, if one was specified. */
5334         if (size && str[1] && str[1] != '\n') {
5335                 if (str[size-1] == '\n') {
5336                         str[size-1] = 0;
5337                         size--;
5338                 }
5339                 error = security_context_to_sid(value, size, &sid);
5340                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5341                         if (!capable(CAP_MAC_ADMIN)) {
5342                                 struct audit_buffer *ab;
5343                                 size_t audit_size;
5344
5345                                 /* We strip a nul only if it is at the end, otherwise the
5346                                  * context contains a nul and we should audit that */
5347                                 if (str[size - 1] == '\0')
5348                                         audit_size = size - 1;
5349                                 else
5350                                         audit_size = size;
5351                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5352                                 audit_log_format(ab, "op=fscreate invalid_context=");
5353                                 audit_log_n_untrustedstring(ab, value, audit_size);
5354                                 audit_log_end(ab);
5355
5356                                 return error;
5357                         }
5358                         error = security_context_to_sid_force(value, size,
5359                                                               &sid);
5360                 }
5361                 if (error)
5362                         return error;
5363         }
5364
5365         new = prepare_creds();
5366         if (!new)
5367                 return -ENOMEM;
5368
5369         /* Permission checking based on the specified context is
5370            performed during the actual operation (execve,
5371            open/mkdir/...), when we know the full context of the
5372            operation.  See selinux_bprm_set_creds for the execve
5373            checks and may_create for the file creation checks. The
5374            operation will then fail if the context is not permitted. */
5375         tsec = new->security;
5376         if (!strcmp(name, "exec")) {
5377                 tsec->exec_sid = sid;
5378         } else if (!strcmp(name, "fscreate")) {
5379                 tsec->create_sid = sid;
5380         } else if (!strcmp(name, "keycreate")) {
5381                 error = may_create_key(sid, p);
5382                 if (error)
5383                         goto abort_change;
5384                 tsec->keycreate_sid = sid;
5385         } else if (!strcmp(name, "sockcreate")) {
5386                 tsec->sockcreate_sid = sid;
5387         } else if (!strcmp(name, "current")) {
5388                 error = -EINVAL;
5389                 if (sid == 0)
5390                         goto abort_change;
5391
5392                 /* Only allow single threaded processes to change context */
5393                 error = -EPERM;
5394                 if (!current_is_single_threaded()) {
5395                         error = security_bounded_transition(tsec->sid, sid);
5396                         if (error)
5397                                 goto abort_change;
5398                 }
5399
5400                 /* Check permissions for the transition. */
5401                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5402                                      PROCESS__DYNTRANSITION, NULL);
5403                 if (error)
5404                         goto abort_change;
5405
5406                 /* Check for ptracing, and update the task SID if ok.
5407                    Otherwise, leave SID unchanged and fail. */
5408                 ptsid = 0;
5409                 task_lock(p);
5410                 tracer = ptrace_parent(p);
5411                 if (tracer)
5412                         ptsid = task_sid(tracer);
5413                 task_unlock(p);
5414
5415                 if (tracer) {
5416                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5417                                              PROCESS__PTRACE, NULL);
5418                         if (error)
5419                                 goto abort_change;
5420                 }
5421
5422                 tsec->sid = sid;
5423         } else {
5424                 error = -EINVAL;
5425                 goto abort_change;
5426         }
5427
5428         commit_creds(new);
5429         return size;
5430
5431 abort_change:
5432         abort_creds(new);
5433         return error;
5434 }
5435
5436 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5437 {
5438         return security_sid_to_context(secid, secdata, seclen);
5439 }
5440
5441 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5442 {
5443         return security_context_to_sid(secdata, seclen, secid);
5444 }
5445
5446 static void selinux_release_secctx(char *secdata, u32 seclen)
5447 {
5448         kfree(secdata);
5449 }
5450
5451 /*
5452  *      called with inode->i_mutex locked
5453  */
5454 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5455 {
5456         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5457 }
5458
5459 /*
5460  *      called with inode->i_mutex locked
5461  */
5462 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5463 {
5464         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5465 }
5466
5467 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5468 {
5469         int len = 0;
5470         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5471                                                 ctx, true);
5472         if (len < 0)
5473                 return len;
5474         *ctxlen = len;
5475         return 0;
5476 }
5477 #ifdef CONFIG_KEYS
5478
5479 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5480                              unsigned long flags)
5481 {
5482         const struct task_security_struct *tsec;
5483         struct key_security_struct *ksec;
5484
5485         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5486         if (!ksec)
5487                 return -ENOMEM;
5488
5489         tsec = cred->security;
5490         if (tsec->keycreate_sid)
5491                 ksec->sid = tsec->keycreate_sid;
5492         else
5493                 ksec->sid = tsec->sid;
5494
5495         k->security = ksec;
5496         return 0;
5497 }
5498
5499 static void selinux_key_free(struct key *k)
5500 {
5501         struct key_security_struct *ksec = k->security;
5502
5503         k->security = NULL;
5504         kfree(ksec);
5505 }
5506
5507 static int selinux_key_permission(key_ref_t key_ref,
5508                                   const struct cred *cred,
5509                                   key_perm_t perm)
5510 {
5511         struct key *key;
5512         struct key_security_struct *ksec;
5513         u32 sid;
5514
5515         /* if no specific permissions are requested, we skip the
5516            permission check. No serious, additional covert channels
5517            appear to be created. */
5518         if (perm == 0)
5519                 return 0;
5520
5521         sid = cred_sid(cred);
5522
5523         key = key_ref_to_ptr(key_ref);
5524         ksec = key->security;
5525
5526         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5527 }
5528
5529 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5530 {
5531         struct key_security_struct *ksec = key->security;
5532         char *context = NULL;
5533         unsigned len;
5534         int rc;
5535
5536         rc = security_sid_to_context(ksec->sid, &context, &len);
5537         if (!rc)
5538                 rc = len;
5539         *_buffer = context;
5540         return rc;
5541 }
5542
5543 #endif
5544
5545 static struct security_operations selinux_ops = {
5546         .name =                         "selinux",
5547
5548         .ptrace_access_check =          selinux_ptrace_access_check,
5549         .ptrace_traceme =               selinux_ptrace_traceme,
5550         .capget =                       selinux_capget,
5551         .capset =                       selinux_capset,
5552         .capable =                      selinux_capable,
5553         .quotactl =                     selinux_quotactl,
5554         .quota_on =                     selinux_quota_on,
5555         .syslog =                       selinux_syslog,
5556         .vm_enough_memory =             selinux_vm_enough_memory,
5557
5558         .netlink_send =                 selinux_netlink_send,
5559
5560         .bprm_set_creds =               selinux_bprm_set_creds,
5561         .bprm_committing_creds =        selinux_bprm_committing_creds,
5562         .bprm_committed_creds =         selinux_bprm_committed_creds,
5563         .bprm_secureexec =              selinux_bprm_secureexec,
5564
5565         .sb_alloc_security =            selinux_sb_alloc_security,
5566         .sb_free_security =             selinux_sb_free_security,
5567         .sb_copy_data =                 selinux_sb_copy_data,
5568         .sb_remount =                   selinux_sb_remount,
5569         .sb_kern_mount =                selinux_sb_kern_mount,
5570         .sb_show_options =              selinux_sb_show_options,
5571         .sb_statfs =                    selinux_sb_statfs,
5572         .sb_mount =                     selinux_mount,
5573         .sb_umount =                    selinux_umount,
5574         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5575         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5576         .sb_parse_opts_str =            selinux_parse_opts_str,
5577
5578
5579         .inode_alloc_security =         selinux_inode_alloc_security,
5580         .inode_free_security =          selinux_inode_free_security,
5581         .inode_init_security =          selinux_inode_init_security,
5582         .inode_create =                 selinux_inode_create,
5583         .inode_link =                   selinux_inode_link,
5584         .inode_unlink =                 selinux_inode_unlink,
5585         .inode_symlink =                selinux_inode_symlink,
5586         .inode_mkdir =                  selinux_inode_mkdir,
5587         .inode_rmdir =                  selinux_inode_rmdir,
5588         .inode_mknod =                  selinux_inode_mknod,
5589         .inode_rename =                 selinux_inode_rename,
5590         .inode_readlink =               selinux_inode_readlink,
5591         .inode_follow_link =            selinux_inode_follow_link,
5592         .inode_permission =             selinux_inode_permission,
5593         .inode_setattr =                selinux_inode_setattr,
5594         .inode_getattr =                selinux_inode_getattr,
5595         .inode_setxattr =               selinux_inode_setxattr,
5596         .inode_post_setxattr =          selinux_inode_post_setxattr,
5597         .inode_getxattr =               selinux_inode_getxattr,
5598         .inode_listxattr =              selinux_inode_listxattr,
5599         .inode_removexattr =            selinux_inode_removexattr,
5600         .inode_getsecurity =            selinux_inode_getsecurity,
5601         .inode_setsecurity =            selinux_inode_setsecurity,
5602         .inode_listsecurity =           selinux_inode_listsecurity,
5603         .inode_getsecid =               selinux_inode_getsecid,
5604
5605         .file_permission =              selinux_file_permission,
5606         .file_alloc_security =          selinux_file_alloc_security,
5607         .file_free_security =           selinux_file_free_security,
5608         .file_ioctl =                   selinux_file_ioctl,
5609         .mmap_file =                    selinux_mmap_file,
5610         .mmap_addr =                    selinux_mmap_addr,
5611         .file_mprotect =                selinux_file_mprotect,
5612         .file_lock =                    selinux_file_lock,
5613         .file_fcntl =                   selinux_file_fcntl,
5614         .file_set_fowner =              selinux_file_set_fowner,
5615         .file_send_sigiotask =          selinux_file_send_sigiotask,
5616         .file_receive =                 selinux_file_receive,
5617
5618         .file_open =                    selinux_file_open,
5619
5620         .task_create =                  selinux_task_create,
5621         .cred_alloc_blank =             selinux_cred_alloc_blank,
5622         .cred_free =                    selinux_cred_free,
5623         .cred_prepare =                 selinux_cred_prepare,
5624         .cred_transfer =                selinux_cred_transfer,
5625         .kernel_act_as =                selinux_kernel_act_as,
5626         .kernel_create_files_as =       selinux_kernel_create_files_as,
5627         .kernel_module_request =        selinux_kernel_module_request,
5628         .task_setpgid =                 selinux_task_setpgid,
5629         .task_getpgid =                 selinux_task_getpgid,
5630         .task_getsid =                  selinux_task_getsid,
5631         .task_getsecid =                selinux_task_getsecid,
5632         .task_setnice =                 selinux_task_setnice,
5633         .task_setioprio =               selinux_task_setioprio,
5634         .task_getioprio =               selinux_task_getioprio,
5635         .task_setrlimit =               selinux_task_setrlimit,
5636         .task_setscheduler =            selinux_task_setscheduler,
5637         .task_getscheduler =            selinux_task_getscheduler,
5638         .task_movememory =              selinux_task_movememory,
5639         .task_kill =                    selinux_task_kill,
5640         .task_wait =                    selinux_task_wait,
5641         .task_to_inode =                selinux_task_to_inode,
5642
5643         .ipc_permission =               selinux_ipc_permission,
5644         .ipc_getsecid =                 selinux_ipc_getsecid,
5645
5646         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5647         .msg_msg_free_security =        selinux_msg_msg_free_security,
5648
5649         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5650         .msg_queue_free_security =      selinux_msg_queue_free_security,
5651         .msg_queue_associate =          selinux_msg_queue_associate,
5652         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5653         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5654         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5655
5656         .shm_alloc_security =           selinux_shm_alloc_security,
5657         .shm_free_security =            selinux_shm_free_security,
5658         .shm_associate =                selinux_shm_associate,
5659         .shm_shmctl =                   selinux_shm_shmctl,
5660         .shm_shmat =                    selinux_shm_shmat,
5661
5662         .sem_alloc_security =           selinux_sem_alloc_security,
5663         .sem_free_security =            selinux_sem_free_security,
5664         .sem_associate =                selinux_sem_associate,
5665         .sem_semctl =                   selinux_sem_semctl,
5666         .sem_semop =                    selinux_sem_semop,
5667
5668         .d_instantiate =                selinux_d_instantiate,
5669
5670         .getprocattr =                  selinux_getprocattr,
5671         .setprocattr =                  selinux_setprocattr,
5672
5673         .secid_to_secctx =              selinux_secid_to_secctx,
5674         .secctx_to_secid =              selinux_secctx_to_secid,
5675         .release_secctx =               selinux_release_secctx,
5676         .inode_notifysecctx =           selinux_inode_notifysecctx,
5677         .inode_setsecctx =              selinux_inode_setsecctx,
5678         .inode_getsecctx =              selinux_inode_getsecctx,
5679
5680         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5681         .unix_may_send =                selinux_socket_unix_may_send,
5682
5683         .socket_create =                selinux_socket_create,
5684         .socket_post_create =           selinux_socket_post_create,
5685         .socket_bind =                  selinux_socket_bind,
5686         .socket_connect =               selinux_socket_connect,
5687         .socket_listen =                selinux_socket_listen,
5688         .socket_accept =                selinux_socket_accept,
5689         .socket_sendmsg =               selinux_socket_sendmsg,
5690         .socket_recvmsg =               selinux_socket_recvmsg,
5691         .socket_getsockname =           selinux_socket_getsockname,
5692         .socket_getpeername =           selinux_socket_getpeername,
5693         .socket_getsockopt =            selinux_socket_getsockopt,
5694         .socket_setsockopt =            selinux_socket_setsockopt,
5695         .socket_shutdown =              selinux_socket_shutdown,
5696         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5697         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5698         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5699         .sk_alloc_security =            selinux_sk_alloc_security,
5700         .sk_free_security =             selinux_sk_free_security,
5701         .sk_clone_security =            selinux_sk_clone_security,
5702         .sk_getsecid =                  selinux_sk_getsecid,
5703         .sock_graft =                   selinux_sock_graft,
5704         .inet_conn_request =            selinux_inet_conn_request,
5705         .inet_csk_clone =               selinux_inet_csk_clone,
5706         .inet_conn_established =        selinux_inet_conn_established,
5707         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5708         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5709         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5710         .req_classify_flow =            selinux_req_classify_flow,
5711         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5712         .tun_dev_free_security =        selinux_tun_dev_free_security,
5713         .tun_dev_create =               selinux_tun_dev_create,
5714         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5715         .tun_dev_attach =               selinux_tun_dev_attach,
5716         .tun_dev_open =                 selinux_tun_dev_open,
5717         .skb_owned_by =                 selinux_skb_owned_by,
5718
5719 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5720         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5721         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5722         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5723         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5724         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5725         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5726         .xfrm_state_free_security =     selinux_xfrm_state_free,
5727         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5728         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5729         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5730         .xfrm_decode_session =          selinux_xfrm_decode_session,
5731 #endif
5732
5733 #ifdef CONFIG_KEYS
5734         .key_alloc =                    selinux_key_alloc,
5735         .key_free =                     selinux_key_free,
5736         .key_permission =               selinux_key_permission,
5737         .key_getsecurity =              selinux_key_getsecurity,
5738 #endif
5739
5740 #ifdef CONFIG_AUDIT
5741         .audit_rule_init =              selinux_audit_rule_init,
5742         .audit_rule_known =             selinux_audit_rule_known,
5743         .audit_rule_match =             selinux_audit_rule_match,
5744         .audit_rule_free =              selinux_audit_rule_free,
5745 #endif
5746 };
5747
5748 static __init int selinux_init(void)
5749 {
5750         if (!security_module_enable(&selinux_ops)) {
5751                 selinux_enabled = 0;
5752                 return 0;
5753         }
5754
5755         if (!selinux_enabled) {
5756                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5757                 return 0;
5758         }
5759
5760         printk(KERN_INFO "SELinux:  Initializing.\n");
5761
5762         /* Set the security state for the initial task. */
5763         cred_init_security();
5764
5765         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5766
5767         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5768                                             sizeof(struct inode_security_struct),
5769                                             0, SLAB_PANIC, NULL);
5770         avc_init();
5771
5772         if (register_security(&selinux_ops))
5773                 panic("SELinux: Unable to register with kernel.\n");
5774
5775         if (selinux_enforcing)
5776                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5777         else
5778                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5779
5780         return 0;
5781 }
5782
5783 static void delayed_superblock_init(struct super_block *sb, void *unused)
5784 {
5785         superblock_doinit(sb, NULL);
5786 }
5787
5788 void selinux_complete_init(void)
5789 {
5790         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5791
5792         /* Set up any superblocks initialized prior to the policy load. */
5793         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5794         iterate_supers(delayed_superblock_init, NULL);
5795 }
5796
5797 /* SELinux requires early initialization in order to label
5798    all processes and objects when they are created. */
5799 security_initcall(selinux_init);
5800
5801 #if defined(CONFIG_NETFILTER)
5802
5803 static struct nf_hook_ops selinux_ipv4_ops[] = {
5804         {
5805                 .hook =         selinux_ipv4_postroute,
5806                 .owner =        THIS_MODULE,
5807                 .pf =           NFPROTO_IPV4,
5808                 .hooknum =      NF_INET_POST_ROUTING,
5809                 .priority =     NF_IP_PRI_SELINUX_LAST,
5810         },
5811         {
5812                 .hook =         selinux_ipv4_forward,
5813                 .owner =        THIS_MODULE,
5814                 .pf =           NFPROTO_IPV4,
5815                 .hooknum =      NF_INET_FORWARD,
5816                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5817         },
5818         {
5819                 .hook =         selinux_ipv4_output,
5820                 .owner =        THIS_MODULE,
5821                 .pf =           NFPROTO_IPV4,
5822                 .hooknum =      NF_INET_LOCAL_OUT,
5823                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5824         }
5825 };
5826
5827 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5828
5829 static struct nf_hook_ops selinux_ipv6_ops[] = {
5830         {
5831                 .hook =         selinux_ipv6_postroute,
5832                 .owner =        THIS_MODULE,
5833                 .pf =           NFPROTO_IPV6,
5834                 .hooknum =      NF_INET_POST_ROUTING,
5835                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5836         },
5837         {
5838                 .hook =         selinux_ipv6_forward,
5839                 .owner =        THIS_MODULE,
5840                 .pf =           NFPROTO_IPV6,
5841                 .hooknum =      NF_INET_FORWARD,
5842                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5843         }
5844 };
5845
5846 #endif  /* IPV6 */
5847
5848 static int __init selinux_nf_ip_init(void)
5849 {
5850         int err = 0;
5851
5852         if (!selinux_enabled)
5853                 goto out;
5854
5855         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5856
5857         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5858         if (err)
5859                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5860
5861 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5862         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5863         if (err)
5864                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5865 #endif  /* IPV6 */
5866
5867 out:
5868         return err;
5869 }
5870
5871 __initcall(selinux_nf_ip_init);
5872
5873 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5874 static void selinux_nf_ip_exit(void)
5875 {
5876         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5877
5878         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5879 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5880         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5881 #endif  /* IPV6 */
5882 }
5883 #endif
5884
5885 #else /* CONFIG_NETFILTER */
5886
5887 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5888 #define selinux_nf_ip_exit()
5889 #endif
5890
5891 #endif /* CONFIG_NETFILTER */
5892
5893 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5894 static int selinux_disabled;
5895
5896 int selinux_disable(void)
5897 {
5898         if (ss_initialized) {
5899                 /* Not permitted after initial policy load. */
5900                 return -EINVAL;
5901         }
5902
5903         if (selinux_disabled) {
5904                 /* Only do this once. */
5905                 return -EINVAL;
5906         }
5907
5908         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5909
5910         selinux_disabled = 1;
5911         selinux_enabled = 0;
5912
5913         reset_security_ops();
5914
5915         /* Try to destroy the avc node cache */
5916         avc_disable();
5917
5918         /* Unregister netfilter hooks. */
5919         selinux_nf_ip_exit();
5920
5921         /* Unregister selinuxfs. */
5922         exit_sel_fs();
5923
5924         return 0;
5925 }
5926 #endif