Pileus Git - ~andy/linux/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 extern struct security_operations *security_ops;
  98
  99 /* SECMARK reference count */
 100 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 101
 102 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 103 int selinux_enforcing;
 104
 105 static int __init enforcing_setup(char *str)
 106 {
 107         unsigned long enforcing;
 108         if (!strict_strtoul(str, 0, &enforcing))
 109                 selinux_enforcing = enforcing ? 1 : 0;
 110         return 1;
 111 }
 112 __setup("enforcing=", enforcing_setup);
 113 #endif
 114
 115 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 116 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 117
 118 static int __init selinux_enabled_setup(char *str)
 119 {
 120         unsigned long enabled;
 121         if (!strict_strtoul(str, 0, &enabled))
 122                 selinux_enabled = enabled ? 1 : 0;
 123         return 1;
 124 }
 125 __setup("selinux=", selinux_enabled_setup);
 126 #else
 127 int selinux_enabled = 1;
 128 #endif
 129
 130 static struct kmem_cache *sel_inode_cache;
 131
 132 /**
 133  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 134  *
 135  * Description:
 136  * This function checks the SECMARK reference counter to see if any SECMARK
 137  * targets are currently configured, if the reference counter is greater than
 138  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 139  * enabled, false (0) if SECMARK is disabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (atomic_read(&selinux_secmark_refcount) > 0);
 145 }
 146
 147 /*
 148  * initialise the security for the init task
 149  */
 150 static void cred_init_security(void)
 151 {
 152         struct cred *cred = (struct cred *) current->real_cred;
 153         struct task_security_struct *tsec;
 154
 155         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 156         if (!tsec)
 157                 panic("SELinux:  Failed to initialize initial task.\n");
 158
 159         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 160         cred->security = tsec;
 161 }
 162
 163 /*
 164  * get the security ID of a set of credentials
 165  */
 166 static inline u32 cred_sid(const struct cred *cred)
 167 {
 168         const struct task_security_struct *tsec;
 169
 170         tsec = cred->security;
 171         return tsec->sid;
 172 }
 173
 174 /*
 175  * get the objective security ID of a task
 176  */
 177 static inline u32 task_sid(const struct task_struct *task)
 178 {
 179         u32 sid;
 180
 181         rcu_read_lock();
 182         sid = cred_sid(__task_cred(task));
 183         rcu_read_unlock();
 184         return sid;
 185 }
 186
 187 /*
 188  * get the subjective security ID of the current task
 189  */
 190 static inline u32 current_sid(void)
 191 {
 192         const struct task_security_struct *tsec = current_security();
 193
 194         return tsec->sid;
 195 }
 196
 197 /* Allocate and free functions for each kind of security blob. */
 198
 199 static int inode_alloc_security(struct inode *inode)
 200 {
 201         struct inode_security_struct *isec;
 202         u32 sid = current_sid();
 203
 204         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 205         if (!isec)
 206                 return -ENOMEM;
 207
 208         mutex_init(&isec->lock);
 209         INIT_LIST_HEAD(&isec->list);
 210         isec->inode = inode;
 211         isec->sid = SECINITSID_UNLABELED;
 212         isec->sclass = SECCLASS_FILE;
 213         isec->task_sid = sid;
 214         inode->i_security = isec;
 215
 216         return 0;
 217 }
 218
 219 static void inode_free_security(struct inode *inode)
 220 {
 221         struct inode_security_struct *isec = inode->i_security;
 222         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 223
 224         spin_lock(&sbsec->isec_lock);
 225         if (!list_empty(&isec->list))
 226                 list_del_init(&isec->list);
 227         spin_unlock(&sbsec->isec_lock);
 228
 229         inode->i_security = NULL;
 230         kmem_cache_free(sel_inode_cache, isec);
 231 }
 232
 233 static int file_alloc_security(struct file *file)
 234 {
 235         struct file_security_struct *fsec;
 236         u32 sid = current_sid();
 237
 238         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 239         if (!fsec)
 240                 return -ENOMEM;
 241
 242         fsec->sid = sid;
 243         fsec->fown_sid = sid;
 244         file->f_security = fsec;
 245
 246         return 0;
 247 }
 248
 249 static void file_free_security(struct file *file)
 250 {
 251         struct file_security_struct *fsec = file->f_security;
 252         file->f_security = NULL;
 253         kfree(fsec);
 254 }
 255
 256 static int superblock_alloc_security(struct super_block *sb)
 257 {
 258         struct superblock_security_struct *sbsec;
 259
 260         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 261         if (!sbsec)
 262                 return -ENOMEM;
 263
 264         mutex_init(&sbsec->lock);
 265         INIT_LIST_HEAD(&sbsec->isec_head);
 266         spin_lock_init(&sbsec->isec_lock);
 267         sbsec->sb = sb;
 268         sbsec->sid = SECINITSID_UNLABELED;
 269         sbsec->def_sid = SECINITSID_FILE;
 270         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 271         sb->s_security = sbsec;
 272
 273         return 0;
 274 }
 275
 276 static void superblock_free_security(struct super_block *sb)
 277 {
 278         struct superblock_security_struct *sbsec = sb->s_security;
 279         sb->s_security = NULL;
 280         kfree(sbsec);
 281 }
 282
 283 /* The file system's label must be initialized prior to use. */
 284
 285 static const char *labeling_behaviors[6] = {
 286         "uses xattr",
 287         "uses transition SIDs",
 288         "uses task SIDs",
 289         "uses genfs_contexts",
 290         "not configured for labeling",
 291         "uses mountpoint labeling",
 292 };
 293
 294 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 295
 296 static inline int inode_doinit(struct inode *inode)
 297 {
 298         return inode_doinit_with_dentry(inode, NULL);
 299 }
 300
 301 enum {
 302         Opt_error = -1,
 303         Opt_context = 1,
 304         Opt_fscontext = 2,
 305         Opt_defcontext = 3,
 306         Opt_rootcontext = 4,
 307         Opt_labelsupport = 5,
 308         Opt_nextmntopt = 6,
 309 };
 310
 311 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 312
 313 static const match_table_t tokens = {
 314         {Opt_context, CONTEXT_STR "%s"},
 315         {Opt_fscontext, FSCONTEXT_STR "%s"},
 316         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 317         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 318         {Opt_labelsupport, LABELSUPP_STR},
 319         {Opt_error, NULL},
 320 };
 321
 322 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 323
 324 static int may_context_mount_sb_relabel(u32 sid,
 325                         struct superblock_security_struct *sbsec,
 326                         const struct cred *cred)
 327 {
 328         const struct task_security_struct *tsec = cred->security;
 329         int rc;
 330
 331         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 332                           FILESYSTEM__RELABELFROM, NULL);
 333         if (rc)
 334                 return rc;
 335
 336         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 337                           FILESYSTEM__RELABELTO, NULL);
 338         return rc;
 339 }
 340
 341 static int may_context_mount_inode_relabel(u32 sid,
 342                         struct superblock_security_struct *sbsec,
 343                         const struct cred *cred)
 344 {
 345         const struct task_security_struct *tsec = cred->security;
 346         int rc;
 347         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELFROM, NULL);
 349         if (rc)
 350                 return rc;
 351
 352         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 353                           FILESYSTEM__ASSOCIATE, NULL);
 354         return rc;
 355 }
 356
 357 static int sb_finish_set_opts(struct super_block *sb)
 358 {
 359         struct superblock_security_struct *sbsec = sb->s_security;
 360         struct dentry *root = sb->s_root;
 361         struct inode *root_inode = root->d_inode;
 362         int rc = 0;
 363
 364         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 365                 /* Make sure that the xattr handler exists and that no
 366                    error other than -ENODATA is returned by getxattr on
 367                    the root directory.  -ENODATA is ok, as this may be
 368                    the first boot of the SELinux kernel before we have
 369                    assigned xattr values to the filesystem. */
 370                 if (!root_inode->i_op->getxattr) {
 371                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 372                                "xattr support\n", sb->s_id, sb->s_type->name);
 373                         rc = -EOPNOTSUPP;
 374                         goto out;
 375                 }
 376                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 377                 if (rc < 0 && rc != -ENODATA) {
 378                         if (rc == -EOPNOTSUPP)
 379                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 380                                        "%s) has no security xattr handler\n",
 381                                        sb->s_id, sb->s_type->name);
 382                         else
 383                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 384                                        "%s) getxattr errno %d\n", sb->s_id,
 385                                        sb->s_type->name, -rc);
 386                         goto out;
 387                 }
 388         }
 389
 390         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 391
 392         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 393                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 394                        sb->s_id, sb->s_type->name);
 395         else
 396                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 397                        sb->s_id, sb->s_type->name,
 398                        labeling_behaviors[sbsec->behavior-1]);
 399
 400         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 401             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 402             sbsec->behavior == SECURITY_FS_USE_NONE ||
 403             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 404                 sbsec->flags &= ~SE_SBLABELSUPP;
 405
 406         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 407         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 408                 sbsec->flags |= SE_SBLABELSUPP;
 409
 410         /*
 411          * Special handling for rootfs. Is genfs but supports
 412          * setting SELinux context on in-core inodes.
 413          */
 414         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 415                 sbsec->flags |= SE_SBLABELSUPP;
 416
 417         /* Initialize the root inode. */
 418         rc = inode_doinit_with_dentry(root_inode, root);
 419
 420         /* Initialize any other inodes associated with the superblock, e.g.
 421            inodes created prior to initial policy load or inodes created
 422            during get_sb by a pseudo filesystem that directly
 423            populates itself. */
 424         spin_lock(&sbsec->isec_lock);
 425 next_inode:
 426         if (!list_empty(&sbsec->isec_head)) {
 427                 struct inode_security_struct *isec =
 428                                 list_entry(sbsec->isec_head.next,
 429                                            struct inode_security_struct, list);
 430                 struct inode *inode = isec->inode;
 431                 spin_unlock(&sbsec->isec_lock);
 432                 inode = igrab(inode);
 433                 if (inode) {
 434                         if (!IS_PRIVATE(inode))
 435                                 inode_doinit(inode);
 436                         iput(inode);
 437                 }
 438                 spin_lock(&sbsec->isec_lock);
 439                 list_del_init(&isec->list);
 440                 goto next_inode;
 441         }
 442         spin_unlock(&sbsec->isec_lock);
 443 out:
 444         return rc;
 445 }
 446
 447 /*
 448  * This function should allow an FS to ask what it's mount security
 449  * options were so it can use those later for submounts, displaying
 450  * mount options, or whatever.
 451  */
 452 static int selinux_get_mnt_opts(const struct super_block *sb,
 453                                 struct security_mnt_opts *opts)
 454 {
 455         int rc = 0, i;
 456         struct superblock_security_struct *sbsec = sb->s_security;
 457         char *context = NULL;
 458         u32 len;
 459         char tmp;
 460
 461         security_init_mnt_opts(opts);
 462
 463         if (!(sbsec->flags & SE_SBINITIALIZED))
 464                 return -EINVAL;
 465
 466         if (!ss_initialized)
 467                 return -EINVAL;
 468
 469         /* make sure we always check enough bits to cover the mask */
 470         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 471
 472         tmp = sbsec->flags & SE_MNTMASK;
 473         /* count the number of mount options for this sb */
 474         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 475                 if (tmp & 0x01)
 476                         opts->num_mnt_opts++;
 477                 tmp >>= 1;
 478         }
 479         /* Check if the Label support flag is set */
 480         if (sbsec->flags & SE_SBLABELSUPP)
 481                 opts->num_mnt_opts++;
 482
 483         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 484         if (!opts->mnt_opts) {
 485                 rc = -ENOMEM;
 486                 goto out_free;
 487         }
 488
 489         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 490         if (!opts->mnt_opts_flags) {
 491                 rc = -ENOMEM;
 492                 goto out_free;
 493         }
 494
 495         i = 0;
 496         if (sbsec->flags & FSCONTEXT_MNT) {
 497                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 498                 if (rc)
 499                         goto out_free;
 500                 opts->mnt_opts[i] = context;
 501                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 502         }
 503         if (sbsec->flags & CONTEXT_MNT) {
 504                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 505                 if (rc)
 506                         goto out_free;
 507                 opts->mnt_opts[i] = context;
 508                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 509         }
 510         if (sbsec->flags & DEFCONTEXT_MNT) {
 511                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 512                 if (rc)
 513                         goto out_free;
 514                 opts->mnt_opts[i] = context;
 515                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 516         }
 517         if (sbsec->flags & ROOTCONTEXT_MNT) {
 518                 struct inode *root = sbsec->sb->s_root->d_inode;
 519                 struct inode_security_struct *isec = root->i_security;
 520
 521                 rc = security_sid_to_context(isec->sid, &context, &len);
 522                 if (rc)
 523                         goto out_free;
 524                 opts->mnt_opts[i] = context;
 525                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 526         }
 527         if (sbsec->flags & SE_SBLABELSUPP) {
 528                 opts->mnt_opts[i] = NULL;
 529                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 530         }
 531
 532         BUG_ON(i != opts->num_mnt_opts);
 533
 534         return 0;
 535
 536 out_free:
 537         security_free_mnt_opts(opts);
 538         return rc;
 539 }
 540
 541 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 542                       u32 old_sid, u32 new_sid)
 543 {
 544         char mnt_flags = sbsec->flags & SE_MNTMASK;
 545
 546         /* check if the old mount command had the same options */
 547         if (sbsec->flags & SE_SBINITIALIZED)
 548                 if (!(sbsec->flags & flag) ||
 549                     (old_sid != new_sid))
 550                         return 1;
 551
 552         /* check if we were passed the same options twice,
 553          * aka someone passed context=a,context=b
 554          */
 555         if (!(sbsec->flags & SE_SBINITIALIZED))
 556                 if (mnt_flags & flag)
 557                         return 1;
 558         return 0;
 559 }
 560
 561 /*
 562  * Allow filesystems with binary mount data to explicitly set mount point
 563  * labeling information.
 564  */
 565 static int selinux_set_mnt_opts(struct super_block *sb,
 566                                 struct security_mnt_opts *opts)
 567 {
 568         const struct cred *cred = current_cred();
 569         int rc = 0, i;
 570         struct superblock_security_struct *sbsec = sb->s_security;
 571         const char *name = sb->s_type->name;
 572         struct inode *inode = sbsec->sb->s_root->d_inode;
 573         struct inode_security_struct *root_isec = inode->i_security;
 574         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 575         u32 defcontext_sid = 0;
 576         char **mount_options = opts->mnt_opts;
 577         int *flags = opts->mnt_opts_flags;
 578         int num_opts = opts->num_mnt_opts;
 579
 580         mutex_lock(&sbsec->lock);
 581
 582         if (!ss_initialized) {
 583                 if (!num_opts) {
 584                         /* Defer initialization until selinux_complete_init,
 585                            after the initial policy is loaded and the security
 586                            server is ready to handle calls. */
 587                         goto out;
 588                 }
 589                 rc = -EINVAL;
 590                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 591                         "before the security server is initialized\n");
 592                 goto out;
 593         }
 594
 595         /*
 596          * Binary mount data FS will come through this function twice.  Once
 597          * from an explicit call and once from the generic calls from the vfs.
 598          * Since the generic VFS calls will not contain any security mount data
 599          * we need to skip the double mount verification.
 600          *
 601          * This does open a hole in which we will not notice if the first
 602          * mount using this sb set explict options and a second mount using
 603          * this sb does not set any security options.  (The first options
 604          * will be used for both mounts)
 605          */
 606         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 607             && (num_opts == 0))
 608                 goto out;
 609
 610         /*
 611          * parse the mount options, check if they are valid sids.
 612          * also check if someone is trying to mount the same sb more
 613          * than once with different security options.
 614          */
 615         for (i = 0; i < num_opts; i++) {
 616                 u32 sid;
 617
 618                 if (flags[i] == SE_SBLABELSUPP)
 619                         continue;
 620                 rc = security_context_to_sid(mount_options[i],
 621                                              strlen(mount_options[i]), &sid);
 622                 if (rc) {
 623                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 624                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 625                                mount_options[i], sb->s_id, name, rc);
 626                         goto out;
 627                 }
 628                 switch (flags[i]) {
 629                 case FSCONTEXT_MNT:
 630                         fscontext_sid = sid;
 631
 632                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 633                                         fscontext_sid))
 634                                 goto out_double_mount;
 635
 636                         sbsec->flags |= FSCONTEXT_MNT;
 637                         break;
 638                 case CONTEXT_MNT:
 639                         context_sid = sid;
 640
 641                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 642                                         context_sid))
 643                                 goto out_double_mount;
 644
 645                         sbsec->flags |= CONTEXT_MNT;
 646                         break;
 647                 case ROOTCONTEXT_MNT:
 648                         rootcontext_sid = sid;
 649
 650                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 651                                         rootcontext_sid))
 652                                 goto out_double_mount;
 653
 654                         sbsec->flags |= ROOTCONTEXT_MNT;
 655
 656                         break;
 657                 case DEFCONTEXT_MNT:
 658                         defcontext_sid = sid;
 659
 660                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 661                                         defcontext_sid))
 662                                 goto out_double_mount;
 663
 664                         sbsec->flags |= DEFCONTEXT_MNT;
 665
 666                         break;
 667                 default:
 668                         rc = -EINVAL;
 669                         goto out;
 670                 }
 671         }
 672
 673         if (sbsec->flags & SE_SBINITIALIZED) {
 674                 /* previously mounted with options, but not on this attempt? */
 675                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 676                         goto out_double_mount;
 677                 rc = 0;
 678                 goto out;
 679         }
 680
 681         if (strcmp(sb->s_type->name, "proc") == 0)
 682                 sbsec->flags |= SE_SBPROC;
 683
 684         /* Determine the labeling behavior to use for this filesystem type. */
 685         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 686         if (rc) {
 687                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 688                        __func__, sb->s_type->name, rc);
 689                 goto out;
 690         }
 691
 692         /* sets the context of the superblock for the fs being mounted. */
 693         if (fscontext_sid) {
 694                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 695                 if (rc)
 696                         goto out;
 697
 698                 sbsec->sid = fscontext_sid;
 699         }
 700
 701         /*
 702          * Switch to using mount point labeling behavior.
 703          * sets the label used on all file below the mountpoint, and will set
 704          * the superblock context if not already set.
 705          */
 706         if (context_sid) {
 707                 if (!fscontext_sid) {
 708                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 709                                                           cred);
 710                         if (rc)
 711                                 goto out;
 712                         sbsec->sid = context_sid;
 713                 } else {
 714                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 715                                                              cred);
 716                         if (rc)
 717                                 goto out;
 718                 }
 719                 if (!rootcontext_sid)
 720                         rootcontext_sid = context_sid;
 721
 722                 sbsec->mntpoint_sid = context_sid;
 723                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 724         }
 725
 726         if (rootcontext_sid) {
 727                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 728                                                      cred);
 729                 if (rc)
 730                         goto out;
 731
 732                 root_isec->sid = rootcontext_sid;
 733                 root_isec->initialized = 1;
 734         }
 735
 736         if (defcontext_sid) {
 737                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 738                         rc = -EINVAL;
 739                         printk(KERN_WARNING "SELinux: defcontext option is "
 740                                "invalid for this filesystem type\n");
 741                         goto out;
 742                 }
 743
 744                 if (defcontext_sid != sbsec->def_sid) {
 745                         rc = may_context_mount_inode_relabel(defcontext_sid,
 746                                                              sbsec, cred);
 747                         if (rc)
 748                                 goto out;
 749                 }
 750
 751                 sbsec->def_sid = defcontext_sid;
 752         }
 753
 754         rc = sb_finish_set_opts(sb);
 755 out:
 756         mutex_unlock(&sbsec->lock);
 757         return rc;
 758 out_double_mount:
 759         rc = -EINVAL;
 760         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 761                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 762         goto out;
 763 }
 764
 765 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 766                                     const struct super_block *newsb)
 767 {
 768         struct superblock_security_struct *old = oldsb->s_security;
 769         struct superblock_security_struct *new = newsb->s_security;
 770         char oldflags = old->flags & SE_MNTMASK;
 771         char newflags = new->flags & SE_MNTMASK;
 772
 773         if (oldflags != newflags)
 774                 goto mismatch;
 775         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 776                 goto mismatch;
 777         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 778                 goto mismatch;
 779         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 780                 goto mismatch;
 781         if (oldflags & ROOTCONTEXT_MNT) {
 782                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 783                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 784                 if (oldroot->sid != newroot->sid)
 785                         goto mismatch;
 786         }
 787         return 0;
 788 mismatch:
 789         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 790                             "different security settings for (dev %s, "
 791                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 792         return -EBUSY;
 793 }
 794
 795 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 796                                         struct super_block *newsb)
 797 {
 798         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 799         struct superblock_security_struct *newsbsec = newsb->s_security;
 800
 801         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 802         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 803         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 804
 805         /*
 806          * if the parent was able to be mounted it clearly had no special lsm
 807          * mount options.  thus we can safely deal with this superblock later
 808          */
 809         if (!ss_initialized)
 810                 return 0;
 811
 812         /* how can we clone if the old one wasn't set up?? */
 813         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 814
 815         /* if fs is reusing a sb, make sure that the contexts match */
 816         if (newsbsec->flags & SE_SBINITIALIZED)
 817                 return selinux_cmp_sb_context(oldsb, newsb);
 818
 819         mutex_lock(&newsbsec->lock);
 820
 821         newsbsec->flags = oldsbsec->flags;
 822
 823         newsbsec->sid = oldsbsec->sid;
 824         newsbsec->def_sid = oldsbsec->def_sid;
 825         newsbsec->behavior = oldsbsec->behavior;
 826
 827         if (set_context) {
 828                 u32 sid = oldsbsec->mntpoint_sid;
 829
 830                 if (!set_fscontext)
 831                         newsbsec->sid = sid;
 832                 if (!set_rootcontext) {
 833                         struct inode *newinode = newsb->s_root->d_inode;
 834                         struct inode_security_struct *newisec = newinode->i_security;
 835                         newisec->sid = sid;
 836                 }
 837                 newsbsec->mntpoint_sid = sid;
 838         }
 839         if (set_rootcontext) {
 840                 const struct inode *oldinode = oldsb->s_root->d_inode;
 841                 const struct inode_security_struct *oldisec = oldinode->i_security;
 842                 struct inode *newinode = newsb->s_root->d_inode;
 843                 struct inode_security_struct *newisec = newinode->i_security;
 844
 845                 newisec->sid = oldisec->sid;
 846         }
 847
 848         sb_finish_set_opts(newsb);
 849         mutex_unlock(&newsbsec->lock);
 850         return 0;
 851 }
 852
 853 static int selinux_parse_opts_str(char *options,
 854                                   struct security_mnt_opts *opts)
 855 {
 856         char *p;
 857         char *context = NULL, *defcontext = NULL;
 858         char *fscontext = NULL, *rootcontext = NULL;
 859         int rc, num_mnt_opts = 0;
 860
 861         opts->num_mnt_opts = 0;
 862
 863         /* Standard string-based options. */
 864         while ((p = strsep(&options, "|")) != NULL) {
 865                 int token;
 866                 substring_t args[MAX_OPT_ARGS];
 867
 868                 if (!*p)
 869                         continue;
 870
 871                 token = match_token(p, tokens, args);
 872
 873                 switch (token) {
 874                 case Opt_context:
 875                         if (context || defcontext) {
 876                                 rc = -EINVAL;
 877                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 878                                 goto out_err;
 879                         }
 880                         context = match_strdup(&args[0]);
 881                         if (!context) {
 882                                 rc = -ENOMEM;
 883                                 goto out_err;
 884                         }
 885                         break;
 886
 887                 case Opt_fscontext:
 888                         if (fscontext) {
 889                                 rc = -EINVAL;
 890                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 891                                 goto out_err;
 892                         }
 893                         fscontext = match_strdup(&args[0]);
 894                         if (!fscontext) {
 895                                 rc = -ENOMEM;
 896                                 goto out_err;
 897                         }
 898                         break;
 899
 900                 case Opt_rootcontext:
 901                         if (rootcontext) {
 902                                 rc = -EINVAL;
 903                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 904                                 goto out_err;
 905                         }
 906                         rootcontext = match_strdup(&args[0]);
 907                         if (!rootcontext) {
 908                                 rc = -ENOMEM;
 909                                 goto out_err;
 910                         }
 911                         break;
 912
 913                 case Opt_defcontext:
 914                         if (context || defcontext) {
 915                                 rc = -EINVAL;
 916                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 917                                 goto out_err;
 918                         }
 919                         defcontext = match_strdup(&args[0]);
 920                         if (!defcontext) {
 921                                 rc = -ENOMEM;
 922                                 goto out_err;
 923                         }
 924                         break;
 925                 case Opt_labelsupport:
 926                         break;
 927                 default:
 928                         rc = -EINVAL;
 929                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 930                         goto out_err;
 931
 932                 }
 933         }
 934
 935         rc = -ENOMEM;
 936         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 937         if (!opts->mnt_opts)
 938                 goto out_err;
 939
 940         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 941         if (!opts->mnt_opts_flags) {
 942                 kfree(opts->mnt_opts);
 943                 goto out_err;
 944         }
 945
 946         if (fscontext) {
 947                 opts->mnt_opts[num_mnt_opts] = fscontext;
 948                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 949         }
 950         if (context) {
 951                 opts->mnt_opts[num_mnt_opts] = context;
 952                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 953         }
 954         if (rootcontext) {
 955                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 956                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 957         }
 958         if (defcontext) {
 959                 opts->mnt_opts[num_mnt_opts] = defcontext;
 960                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 961         }
 962
 963         opts->num_mnt_opts = num_mnt_opts;
 964         return 0;
 965
 966 out_err:
 967         kfree(context);
 968         kfree(defcontext);
 969         kfree(fscontext);
 970         kfree(rootcontext);
 971         return rc;
 972 }
 973 /*
 974  * string mount options parsing and call set the sbsec
 975  */
 976 static int superblock_doinit(struct super_block *sb, void *data)
 977 {
 978         int rc = 0;
 979         char *options = data;
 980         struct security_mnt_opts opts;
 981
 982         security_init_mnt_opts(&opts);
 983
 984         if (!data)
 985                 goto out;
 986
 987         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 988
 989         rc = selinux_parse_opts_str(options, &opts);
 990         if (rc)
 991                 goto out_err;
 992
 993 out:
 994         rc = selinux_set_mnt_opts(sb, &opts);
 995
 996 out_err:
 997         security_free_mnt_opts(&opts);
 998         return rc;
 999 }
1000
1001 static void selinux_write_opts(struct seq_file *m,
1002                                struct security_mnt_opts *opts)
1003 {
1004         int i;
1005         char *prefix;
1006
1007         for (i = 0; i < opts->num_mnt_opts; i++) {
1008                 char *has_comma;
1009
1010                 if (opts->mnt_opts[i])
1011                         has_comma = strchr(opts->mnt_opts[i], ',');
1012                 else
1013                         has_comma = NULL;
1014
1015                 switch (opts->mnt_opts_flags[i]) {
1016                 case CONTEXT_MNT:
1017                         prefix = CONTEXT_STR;
1018                         break;
1019                 case FSCONTEXT_MNT:
1020                         prefix = FSCONTEXT_STR;
1021                         break;
1022                 case ROOTCONTEXT_MNT:
1023                         prefix = ROOTCONTEXT_STR;
1024                         break;
1025                 case DEFCONTEXT_MNT:
1026                         prefix = DEFCONTEXT_STR;
1027                         break;
1028                 case SE_SBLABELSUPP:
1029                         seq_putc(m, ',');
1030                         seq_puts(m, LABELSUPP_STR);
1031                         continue;
1032                 default:
1033                         BUG();
1034                         return;
1035                 };
1036                 /* we need a comma before each option */
1037                 seq_putc(m, ',');
1038                 seq_puts(m, prefix);
1039                 if (has_comma)
1040                         seq_putc(m, '\"');
1041                 seq_puts(m, opts->mnt_opts[i]);
1042                 if (has_comma)
1043                         seq_putc(m, '\"');
1044         }
1045 }
1046
1047 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1048 {
1049         struct security_mnt_opts opts;
1050         int rc;
1051
1052         rc = selinux_get_mnt_opts(sb, &opts);
1053         if (rc) {
1054                 /* before policy load we may get EINVAL, don't show anything */
1055                 if (rc == -EINVAL)
1056                         rc = 0;
1057                 return rc;
1058         }
1059
1060         selinux_write_opts(m, &opts);
1061
1062         security_free_mnt_opts(&opts);
1063
1064         return rc;
1065 }
1066
1067 static inline u16 inode_mode_to_security_class(umode_t mode)
1068 {
1069         switch (mode & S_IFMT) {
1070         case S_IFSOCK:
1071                 return SECCLASS_SOCK_FILE;
1072         case S_IFLNK:
1073                 return SECCLASS_LNK_FILE;
1074         case S_IFREG:
1075                 return SECCLASS_FILE;
1076         case S_IFBLK:
1077                 return SECCLASS_BLK_FILE;
1078         case S_IFDIR:
1079                 return SECCLASS_DIR;
1080         case S_IFCHR:
1081                 return SECCLASS_CHR_FILE;
1082         case S_IFIFO:
1083                 return SECCLASS_FIFO_FILE;
1084
1085         }
1086
1087         return SECCLASS_FILE;
1088 }
1089
1090 static inline int default_protocol_stream(int protocol)
1091 {
1092         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1093 }
1094
1095 static inline int default_protocol_dgram(int protocol)
1096 {
1097         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1098 }
1099
1100 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1101 {
1102         switch (family) {
1103         case PF_UNIX:
1104                 switch (type) {
1105                 case SOCK_STREAM:
1106                 case SOCK_SEQPACKET:
1107                         return SECCLASS_UNIX_STREAM_SOCKET;
1108                 case SOCK_DGRAM:
1109                         return SECCLASS_UNIX_DGRAM_SOCKET;
1110                 }
1111                 break;
1112         case PF_INET:
1113         case PF_INET6:
1114                 switch (type) {
1115                 case SOCK_STREAM:
1116                         if (default_protocol_stream(protocol))
1117                                 return SECCLASS_TCP_SOCKET;
1118                         else
1119                                 return SECCLASS_RAWIP_SOCKET;
1120                 case SOCK_DGRAM:
1121                         if (default_protocol_dgram(protocol))
1122                                 return SECCLASS_UDP_SOCKET;
1123                         else
1124                                 return SECCLASS_RAWIP_SOCKET;
1125                 case SOCK_DCCP:
1126                         return SECCLASS_DCCP_SOCKET;
1127                 default:
1128                         return SECCLASS_RAWIP_SOCKET;
1129                 }
1130                 break;
1131         case PF_NETLINK:
1132                 switch (protocol) {
1133                 case NETLINK_ROUTE:
1134                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1135                 case NETLINK_FIREWALL:
1136                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1137                 case NETLINK_SOCK_DIAG:
1138                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1139                 case NETLINK_NFLOG:
1140                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1141                 case NETLINK_XFRM:
1142                         return SECCLASS_NETLINK_XFRM_SOCKET;
1143                 case NETLINK_SELINUX:
1144                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1145                 case NETLINK_AUDIT:
1146                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1147                 case NETLINK_IP6_FW:
1148                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1149                 case NETLINK_DNRTMSG:
1150                         return SECCLASS_NETLINK_DNRT_SOCKET;
1151                 case NETLINK_KOBJECT_UEVENT:
1152                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1153                 default:
1154                         return SECCLASS_NETLINK_SOCKET;
1155                 }
1156         case PF_PACKET:
1157                 return SECCLASS_PACKET_SOCKET;
1158         case PF_KEY:
1159                 return SECCLASS_KEY_SOCKET;
1160         case PF_APPLETALK:
1161                 return SECCLASS_APPLETALK_SOCKET;
1162         }
1163
1164         return SECCLASS_SOCKET;
1165 }
1166
1167 #ifdef CONFIG_PROC_FS
1168 static int selinux_proc_get_sid(struct dentry *dentry,
1169                                 u16 tclass,
1170                                 u32 *sid)
1171 {
1172         int rc;
1173         char *buffer, *path;
1174
1175         buffer = (char *)__get_free_page(GFP_KERNEL);
1176         if (!buffer)
1177                 return -ENOMEM;
1178
1179         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1180         if (IS_ERR(path))
1181                 rc = PTR_ERR(path);
1182         else {
1183                 /* each process gets a /proc/PID/ entry. Strip off the
1184                  * PID part to get a valid selinux labeling.
1185                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1186                 while (path[1] >= '0' && path[1] <= '9') {
1187                         path[1] = '/';
1188                         path++;
1189                 }
1190                 rc = security_genfs_sid("proc", path, tclass, sid);
1191         }
1192         free_page((unsigned long)buffer);
1193         return rc;
1194 }
1195 #else
1196 static int selinux_proc_get_sid(struct dentry *dentry,
1197                                 u16 tclass,
1198                                 u32 *sid)
1199 {
1200         return -EINVAL;
1201 }
1202 #endif
1203
1204 /* The inode's security attributes must be initialized before first use. */
1205 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1206 {
1207         struct superblock_security_struct *sbsec = NULL;
1208         struct inode_security_struct *isec = inode->i_security;
1209         u32 sid;
1210         struct dentry *dentry;
1211 #define INITCONTEXTLEN 255
1212         char *context = NULL;
1213         unsigned len = 0;
1214         int rc = 0;
1215
1216         if (isec->initialized)
1217                 goto out;
1218
1219         mutex_lock(&isec->lock);
1220         if (isec->initialized)
1221                 goto out_unlock;
1222
1223         sbsec = inode->i_sb->s_security;
1224         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1225                 /* Defer initialization until selinux_complete_init,
1226                    after the initial policy is loaded and the security
1227                    server is ready to handle calls. */
1228                 spin_lock(&sbsec->isec_lock);
1229                 if (list_empty(&isec->list))
1230                         list_add(&isec->list, &sbsec->isec_head);
1231                 spin_unlock(&sbsec->isec_lock);
1232                 goto out_unlock;
1233         }
1234
1235         switch (sbsec->behavior) {
1236         case SECURITY_FS_USE_XATTR:
1237                 if (!inode->i_op->getxattr) {
1238                         isec->sid = sbsec->def_sid;
1239                         break;
1240                 }
1241
1242                 /* Need a dentry, since the xattr API requires one.
1243                    Life would be simpler if we could just pass the inode. */
1244                 if (opt_dentry) {
1245                         /* Called from d_instantiate or d_splice_alias. */
1246                         dentry = dget(opt_dentry);
1247                 } else {
1248                         /* Called from selinux_complete_init, try to find a dentry. */
1249                         dentry = d_find_alias(inode);
1250                 }
1251                 if (!dentry) {
1252                         /*
1253                          * this is can be hit on boot when a file is accessed
1254                          * before the policy is loaded.  When we load policy we
1255                          * may find inodes that have no dentry on the
1256                          * sbsec->isec_head list.  No reason to complain as these
1257                          * will get fixed up the next time we go through
1258                          * inode_doinit with a dentry, before these inodes could
1259                          * be used again by userspace.
1260                          */
1261                         goto out_unlock;
1262                 }
1263
1264                 len = INITCONTEXTLEN;
1265                 context = kmalloc(len+1, GFP_NOFS);
1266                 if (!context) {
1267                         rc = -ENOMEM;
1268                         dput(dentry);
1269                         goto out_unlock;
1270                 }
1271                 context[len] = '\0';
1272                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1273                                            context, len);
1274                 if (rc == -ERANGE) {
1275                         kfree(context);
1276
1277                         /* Need a larger buffer.  Query for the right size. */
1278                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1279                                                    NULL, 0);
1280                         if (rc < 0) {
1281                                 dput(dentry);
1282                                 goto out_unlock;
1283                         }
1284                         len = rc;
1285                         context = kmalloc(len+1, GFP_NOFS);
1286                         if (!context) {
1287                                 rc = -ENOMEM;
1288                                 dput(dentry);
1289                                 goto out_unlock;
1290                         }
1291                         context[len] = '\0';
1292                         rc = inode->i_op->getxattr(dentry,
1293                                                    XATTR_NAME_SELINUX,
1294                                                    context, len);
1295                 }
1296                 dput(dentry);
1297                 if (rc < 0) {
1298                         if (rc != -ENODATA) {
1299                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1300                                        "%d for dev=%s ino=%ld\n", __func__,
1301                                        -rc, inode->i_sb->s_id, inode->i_ino);
1302                                 kfree(context);
1303                                 goto out_unlock;
1304                         }
1305                         /* Map ENODATA to the default file SID */
1306                         sid = sbsec->def_sid;
1307                         rc = 0;
1308                 } else {
1309                         rc = security_context_to_sid_default(context, rc, &sid,
1310                                                              sbsec->def_sid,
1311                                                              GFP_NOFS);
1312                         if (rc) {
1313                                 char *dev = inode->i_sb->s_id;
1314                                 unsigned long ino = inode->i_ino;
1315
1316                                 if (rc == -EINVAL) {
1317                                         if (printk_ratelimit())
1318                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1319                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1320                                                         "filesystem in question.\n", ino, dev, context);
1321                                 } else {
1322                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1323                                                "returned %d for dev=%s ino=%ld\n",
1324                                                __func__, context, -rc, dev, ino);
1325                                 }
1326                                 kfree(context);
1327                                 /* Leave with the unlabeled SID */
1328                                 rc = 0;
1329                                 break;
1330                         }
1331                 }
1332                 kfree(context);
1333                 isec->sid = sid;
1334                 break;
1335         case SECURITY_FS_USE_TASK:
1336                 isec->sid = isec->task_sid;
1337                 break;
1338         case SECURITY_FS_USE_TRANS:
1339                 /* Default to the fs SID. */
1340                 isec->sid = sbsec->sid;
1341
1342                 /* Try to obtain a transition SID. */
1343                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1344                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1345                                              isec->sclass, NULL, &sid);
1346                 if (rc)
1347                         goto out_unlock;
1348                 isec->sid = sid;
1349                 break;
1350         case SECURITY_FS_USE_MNTPOINT:
1351                 isec->sid = sbsec->mntpoint_sid;
1352                 break;
1353         default:
1354                 /* Default to the fs superblock SID. */
1355                 isec->sid = sbsec->sid;
1356
1357                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1358                         if (opt_dentry) {
1359                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1360                                 rc = selinux_proc_get_sid(opt_dentry,
1361                                                           isec->sclass,
1362                                                           &sid);
1363                                 if (rc)
1364                                         goto out_unlock;
1365                                 isec->sid = sid;
1366                         }
1367                 }
1368                 break;
1369         }
1370
1371         isec->initialized = 1;
1372
1373 out_unlock:
1374         mutex_unlock(&isec->lock);
1375 out:
1376         if (isec->sclass == SECCLASS_FILE)
1377                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1378         return rc;
1379 }
1380
1381 /* Convert a Linux signal to an access vector. */
1382 static inline u32 signal_to_av(int sig)
1383 {
1384         u32 perm = 0;
1385
1386         switch (sig) {
1387         case SIGCHLD:
1388                 /* Commonly granted from child to parent. */
1389                 perm = PROCESS__SIGCHLD;
1390                 break;
1391         case SIGKILL:
1392                 /* Cannot be caught or ignored */
1393                 perm = PROCESS__SIGKILL;
1394                 break;
1395         case SIGSTOP:
1396                 /* Cannot be caught or ignored */
1397                 perm = PROCESS__SIGSTOP;
1398                 break;
1399         default:
1400                 /* All other signals. */
1401                 perm = PROCESS__SIGNAL;
1402                 break;
1403         }
1404
1405         return perm;
1406 }
1407
1408 /*
1409  * Check permission between a pair of credentials
1410  * fork check, ptrace check, etc.
1411  */
1412 static int cred_has_perm(const struct cred *actor,
1413                          const struct cred *target,
1414                          u32 perms)
1415 {
1416         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1417
1418         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1419 }
1420
1421 /*
1422  * Check permission between a pair of tasks, e.g. signal checks,
1423  * fork check, ptrace check, etc.
1424  * tsk1 is the actor and tsk2 is the target
1425  * - this uses the default subjective creds of tsk1
1426  */
1427 static int task_has_perm(const struct task_struct *tsk1,
1428                          const struct task_struct *tsk2,
1429                          u32 perms)
1430 {
1431         const struct task_security_struct *__tsec1, *__tsec2;
1432         u32 sid1, sid2;
1433
1434         rcu_read_lock();
1435         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1436         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1437         rcu_read_unlock();
1438         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1439 }
1440
1441 /*
1442  * Check permission between current and another task, e.g. signal checks,
1443  * fork check, ptrace check, etc.
1444  * current is the actor and tsk2 is the target
1445  * - this uses current's subjective creds
1446  */
1447 static int current_has_perm(const struct task_struct *tsk,
1448                             u32 perms)
1449 {
1450         u32 sid, tsid;
1451
1452         sid = current_sid();
1453         tsid = task_sid(tsk);
1454         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1455 }
1456
1457 #if CAP_LAST_CAP > 63
1458 #error Fix SELinux to handle capabilities > 63.
1459 #endif
1460
1461 /* Check whether a task is allowed to use a capability. */
1462 static int cred_has_capability(const struct cred *cred,
1463                                int cap, int audit)
1464 {
1465         struct common_audit_data ad;
1466         struct av_decision avd;
1467         u16 sclass;
1468         u32 sid = cred_sid(cred);
1469         u32 av = CAP_TO_MASK(cap);
1470         int rc;
1471
1472         ad.type = LSM_AUDIT_DATA_CAP;
1473         ad.u.cap = cap;
1474
1475         switch (CAP_TO_INDEX(cap)) {
1476         case 0:
1477                 sclass = SECCLASS_CAPABILITY;
1478                 break;
1479         case 1:
1480                 sclass = SECCLASS_CAPABILITY2;
1481                 break;
1482         default:
1483                 printk(KERN_ERR
1484                        "SELinux:  out of range capability %d\n", cap);
1485                 BUG();
1486                 return -EINVAL;
1487         }
1488
1489         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1490         if (audit == SECURITY_CAP_AUDIT) {
1491                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1492                 if (rc2)
1493                         return rc2;
1494         }
1495         return rc;
1496 }
1497
1498 /* Check whether a task is allowed to use a system operation. */
1499 static int task_has_system(struct task_struct *tsk,
1500                            u32 perms)
1501 {
1502         u32 sid = task_sid(tsk);
1503
1504         return avc_has_perm(sid, SECINITSID_KERNEL,
1505                             SECCLASS_SYSTEM, perms, NULL);
1506 }
1507
1508 /* Check whether a task has a particular permission to an inode.
1509    The 'adp' parameter is optional and allows other audit
1510    data to be passed (e.g. the dentry). */
1511 static int inode_has_perm(const struct cred *cred,
1512                           struct inode *inode,
1513                           u32 perms,
1514                           struct common_audit_data *adp,
1515                           unsigned flags)
1516 {
1517         struct inode_security_struct *isec;
1518         u32 sid;
1519
1520         validate_creds(cred);
1521
1522         if (unlikely(IS_PRIVATE(inode)))
1523                 return 0;
1524
1525         sid = cred_sid(cred);
1526         isec = inode->i_security;
1527
1528         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1529 }
1530
1531 /* Same as inode_has_perm, but pass explicit audit data containing
1532    the dentry to help the auditing code to more easily generate the
1533    pathname if needed. */
1534 static inline int dentry_has_perm(const struct cred *cred,
1535                                   struct dentry *dentry,
1536                                   u32 av)
1537 {
1538         struct inode *inode = dentry->d_inode;
1539         struct common_audit_data ad;
1540
1541         ad.type = LSM_AUDIT_DATA_DENTRY;
1542         ad.u.dentry = dentry;
1543         return inode_has_perm(cred, inode, av, &ad, 0);
1544 }
1545
1546 /* Same as inode_has_perm, but pass explicit audit data containing
1547    the path to help the auditing code to more easily generate the
1548    pathname if needed. */
1549 static inline int path_has_perm(const struct cred *cred,
1550                                 struct path *path,
1551                                 u32 av)
1552 {
1553         struct inode *inode = path->dentry->d_inode;
1554         struct common_audit_data ad;
1555
1556         ad.type = LSM_AUDIT_DATA_PATH;
1557         ad.u.path = *path;
1558         return inode_has_perm(cred, inode, av, &ad, 0);
1559 }
1560
1561 /* Check whether a task can use an open file descriptor to
1562    access an inode in a given way.  Check access to the
1563    descriptor itself, and then use dentry_has_perm to
1564    check a particular permission to the file.
1565    Access to the descriptor is implicitly granted if it
1566    has the same SID as the process.  If av is zero, then
1567    access to the file is not checked, e.g. for cases
1568    where only the descriptor is affected like seek. */
1569 static int file_has_perm(const struct cred *cred,
1570                          struct file *file,
1571                          u32 av)
1572 {
1573         struct file_security_struct *fsec = file->f_security;
1574         struct inode *inode = file_inode(file);
1575         struct common_audit_data ad;
1576         u32 sid = cred_sid(cred);
1577         int rc;
1578
1579         ad.type = LSM_AUDIT_DATA_PATH;
1580         ad.u.path = file->f_path;
1581
1582         if (sid != fsec->sid) {
1583                 rc = avc_has_perm(sid, fsec->sid,
1584                                   SECCLASS_FD,
1585                                   FD__USE,
1586                                   &ad);
1587                 if (rc)
1588                         goto out;
1589         }
1590
1591         /* av is zero if only checking access to the descriptor. */
1592         rc = 0;
1593         if (av)
1594                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1595
1596 out:
1597         return rc;
1598 }
1599
1600 /* Check whether a task can create a file. */
1601 static int may_create(struct inode *dir,
1602                       struct dentry *dentry,
1603                       u16 tclass)
1604 {
1605         const struct task_security_struct *tsec = current_security();
1606         struct inode_security_struct *dsec;
1607         struct superblock_security_struct *sbsec;
1608         u32 sid, newsid;
1609         struct common_audit_data ad;
1610         int rc;
1611
1612         dsec = dir->i_security;
1613         sbsec = dir->i_sb->s_security;
1614
1615         sid = tsec->sid;
1616         newsid = tsec->create_sid;
1617
1618         ad.type = LSM_AUDIT_DATA_DENTRY;
1619         ad.u.dentry = dentry;
1620
1621         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1622                           DIR__ADD_NAME | DIR__SEARCH,
1623                           &ad);
1624         if (rc)
1625                 return rc;
1626
1627         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1628                 rc = security_transition_sid(sid, dsec->sid, tclass,
1629                                              &dentry->d_name, &newsid);
1630                 if (rc)
1631                         return rc;
1632         }
1633
1634         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1635         if (rc)
1636                 return rc;
1637
1638         return avc_has_perm(newsid, sbsec->sid,
1639                             SECCLASS_FILESYSTEM,
1640                             FILESYSTEM__ASSOCIATE, &ad);
1641 }
1642
1643 /* Check whether a task can create a key. */
1644 static int may_create_key(u32 ksid,
1645                           struct task_struct *ctx)
1646 {
1647         u32 sid = task_sid(ctx);
1648
1649         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1650 }
1651
1652 #define MAY_LINK        0
1653 #define MAY_UNLINK      1
1654 #define MAY_RMDIR       2
1655
1656 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1657 static int may_link(struct inode *dir,
1658                     struct dentry *dentry,
1659                     int kind)
1660
1661 {
1662         struct inode_security_struct *dsec, *isec;
1663         struct common_audit_data ad;
1664         u32 sid = current_sid();
1665         u32 av;
1666         int rc;
1667
1668         dsec = dir->i_security;
1669         isec = dentry->d_inode->i_security;
1670
1671         ad.type = LSM_AUDIT_DATA_DENTRY;
1672         ad.u.dentry = dentry;
1673
1674         av = DIR__SEARCH;
1675         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1676         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1677         if (rc)
1678                 return rc;
1679
1680         switch (kind) {
1681         case MAY_LINK:
1682                 av = FILE__LINK;
1683                 break;
1684         case MAY_UNLINK:
1685                 av = FILE__UNLINK;
1686                 break;
1687         case MAY_RMDIR:
1688                 av = DIR__RMDIR;
1689                 break;
1690         default:
1691                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1692                         __func__, kind);
1693                 return 0;
1694         }
1695
1696         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1697         return rc;
1698 }
1699
1700 static inline int may_rename(struct inode *old_dir,
1701                              struct dentry *old_dentry,
1702                              struct inode *new_dir,
1703                              struct dentry *new_dentry)
1704 {
1705         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1706         struct common_audit_data ad;
1707         u32 sid = current_sid();
1708         u32 av;
1709         int old_is_dir, new_is_dir;
1710         int rc;
1711
1712         old_dsec = old_dir->i_security;
1713         old_isec = old_dentry->d_inode->i_security;
1714         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1715         new_dsec = new_dir->i_security;
1716
1717         ad.type = LSM_AUDIT_DATA_DENTRY;
1718
1719         ad.u.dentry = old_dentry;
1720         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1721                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1722         if (rc)
1723                 return rc;
1724         rc = avc_has_perm(sid, old_isec->sid,
1725                           old_isec->sclass, FILE__RENAME, &ad);
1726         if (rc)
1727                 return rc;
1728         if (old_is_dir && new_dir != old_dir) {
1729                 rc = avc_has_perm(sid, old_isec->sid,
1730                                   old_isec->sclass, DIR__REPARENT, &ad);
1731                 if (rc)
1732                         return rc;
1733         }
1734
1735         ad.u.dentry = new_dentry;
1736         av = DIR__ADD_NAME | DIR__SEARCH;
1737         if (new_dentry->d_inode)
1738                 av |= DIR__REMOVE_NAME;
1739         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1740         if (rc)
1741                 return rc;
1742         if (new_dentry->d_inode) {
1743                 new_isec = new_dentry->d_inode->i_security;
1744                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1745                 rc = avc_has_perm(sid, new_isec->sid,
1746                                   new_isec->sclass,
1747                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1748                 if (rc)
1749                         return rc;
1750         }
1751
1752         return 0;
1753 }
1754
1755 /* Check whether a task can perform a filesystem operation. */
1756 static int superblock_has_perm(const struct cred *cred,
1757                                struct super_block *sb,
1758                                u32 perms,
1759                                struct common_audit_data *ad)
1760 {
1761         struct superblock_security_struct *sbsec;
1762         u32 sid = cred_sid(cred);
1763
1764         sbsec = sb->s_security;
1765         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1766 }
1767
1768 /* Convert a Linux mode and permission mask to an access vector. */
1769 static inline u32 file_mask_to_av(int mode, int mask)
1770 {
1771         u32 av = 0;
1772
1773         if (!S_ISDIR(mode)) {
1774                 if (mask & MAY_EXEC)
1775                         av |= FILE__EXECUTE;
1776                 if (mask & MAY_READ)
1777                         av |= FILE__READ;
1778
1779                 if (mask & MAY_APPEND)
1780                         av |= FILE__APPEND;
1781                 else if (mask & MAY_WRITE)
1782                         av |= FILE__WRITE;
1783
1784         } else {
1785                 if (mask & MAY_EXEC)
1786                         av |= DIR__SEARCH;
1787                 if (mask & MAY_WRITE)
1788                         av |= DIR__WRITE;
1789                 if (mask & MAY_READ)
1790                         av |= DIR__READ;
1791         }
1792
1793         return av;
1794 }
1795
1796 /* Convert a Linux file to an access vector. */
1797 static inline u32 file_to_av(struct file *file)
1798 {
1799         u32 av = 0;
1800
1801         if (file->f_mode & FMODE_READ)
1802                 av |= FILE__READ;
1803         if (file->f_mode & FMODE_WRITE) {
1804                 if (file->f_flags & O_APPEND)
1805                         av |= FILE__APPEND;
1806                 else
1807                         av |= FILE__WRITE;
1808         }
1809         if (!av) {
1810                 /*
1811                  * Special file opened with flags 3 for ioctl-only use.
1812                  */
1813                 av = FILE__IOCTL;
1814         }
1815
1816         return av;
1817 }
1818
1819 /*
1820  * Convert a file to an access vector and include the correct open
1821  * open permission.
1822  */
1823 static inline u32 open_file_to_av(struct file *file)
1824 {
1825         u32 av = file_to_av(file);
1826
1827         if (selinux_policycap_openperm)
1828                 av |= FILE__OPEN;
1829
1830         return av;
1831 }
1832
1833 /* Hook functions begin here. */
1834
1835 static int selinux_ptrace_access_check(struct task_struct *child,
1836                                      unsigned int mode)
1837 {
1838         int rc;
1839
1840         rc = cap_ptrace_access_check(child, mode);
1841         if (rc)
1842                 return rc;
1843
1844         if (mode & PTRACE_MODE_READ) {
1845                 u32 sid = current_sid();
1846                 u32 csid = task_sid(child);
1847                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1848         }
1849
1850         return current_has_perm(child, PROCESS__PTRACE);
1851 }
1852
1853 static int selinux_ptrace_traceme(struct task_struct *parent)
1854 {
1855         int rc;
1856
1857         rc = cap_ptrace_traceme(parent);
1858         if (rc)
1859                 return rc;
1860
1861         return task_has_perm(parent, current, PROCESS__PTRACE);
1862 }
1863
1864 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1865                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1866 {
1867         int error;
1868
1869         error = current_has_perm(target, PROCESS__GETCAP);
1870         if (error)
1871                 return error;
1872
1873         return cap_capget(target, effective, inheritable, permitted);
1874 }
1875
1876 static int selinux_capset(struct cred *new, const struct cred *old,
1877                           const kernel_cap_t *effective,
1878                           const kernel_cap_t *inheritable,
1879                           const kernel_cap_t *permitted)
1880 {
1881         int error;
1882
1883         error = cap_capset(new, old,
1884                                       effective, inheritable, permitted);
1885         if (error)
1886                 return error;
1887
1888         return cred_has_perm(old, new, PROCESS__SETCAP);
1889 }
1890
1891 /*
1892  * (This comment used to live with the selinux_task_setuid hook,
1893  * which was removed).
1894  *
1895  * Since setuid only affects the current process, and since the SELinux
1896  * controls are not based on the Linux identity attributes, SELinux does not
1897  * need to control this operation.  However, SELinux does control the use of
1898  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1899  */
1900
1901 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1902                            int cap, int audit)
1903 {
1904         int rc;
1905
1906         rc = cap_capable(cred, ns, cap, audit);
1907         if (rc)
1908                 return rc;
1909
1910         return cred_has_capability(cred, cap, audit);
1911 }
1912
1913 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1914 {
1915         const struct cred *cred = current_cred();
1916         int rc = 0;
1917
1918         if (!sb)
1919                 return 0;
1920
1921         switch (cmds) {
1922         case Q_SYNC:
1923         case Q_QUOTAON:
1924         case Q_QUOTAOFF:
1925         case Q_SETINFO:
1926         case Q_SETQUOTA:
1927                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1928                 break;
1929         case Q_GETFMT:
1930         case Q_GETINFO:
1931         case Q_GETQUOTA:
1932                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1933                 break;
1934         default:
1935                 rc = 0;  /* let the kernel handle invalid cmds */
1936                 break;
1937         }
1938         return rc;
1939 }
1940
1941 static int selinux_quota_on(struct dentry *dentry)
1942 {
1943         const struct cred *cred = current_cred();
1944
1945         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1946 }
1947
1948 static int selinux_syslog(int type)
1949 {
1950         int rc;
1951
1952         switch (type) {
1953         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1954         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1955                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1956                 break;
1957         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1958         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1959         /* Set level of messages printed to console */
1960         case SYSLOG_ACTION_CONSOLE_LEVEL:
1961                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1962                 break;
1963         case SYSLOG_ACTION_CLOSE:       /* Close log */
1964         case SYSLOG_ACTION_OPEN:        /* Open log */
1965         case SYSLOG_ACTION_READ:        /* Read from log */
1966         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1967         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1968         default:
1969                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1970                 break;
1971         }
1972         return rc;
1973 }
1974
1975 /*
1976  * Check that a process has enough memory to allocate a new virtual
1977  * mapping. 0 means there is enough memory for the allocation to
1978  * succeed and -ENOMEM implies there is not.
1979  *
1980  * Do not audit the selinux permission check, as this is applied to all
1981  * processes that allocate mappings.
1982  */
1983 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1984 {
1985         int rc, cap_sys_admin = 0;
1986
1987         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1988                              SECURITY_CAP_NOAUDIT);
1989         if (rc == 0)
1990                 cap_sys_admin = 1;
1991
1992         return __vm_enough_memory(mm, pages, cap_sys_admin);
1993 }
1994
1995 /* binprm security operations */
1996
1997 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1998 {
1999         const struct task_security_struct *old_tsec;
2000         struct task_security_struct *new_tsec;
2001         struct inode_security_struct *isec;
2002         struct common_audit_data ad;
2003         struct inode *inode = file_inode(bprm->file);
2004         int rc;
2005
2006         rc = cap_bprm_set_creds(bprm);
2007         if (rc)
2008                 return rc;
2009
2010         /* SELinux context only depends on initial program or script and not
2011          * the script interpreter */
2012         if (bprm->cred_prepared)
2013                 return 0;
2014
2015         old_tsec = current_security();
2016         new_tsec = bprm->cred->security;
2017         isec = inode->i_security;
2018
2019         /* Default to the current task SID. */
2020         new_tsec->sid = old_tsec->sid;
2021         new_tsec->osid = old_tsec->sid;
2022
2023         /* Reset fs, key, and sock SIDs on execve. */
2024         new_tsec->create_sid = 0;
2025         new_tsec->keycreate_sid = 0;
2026         new_tsec->sockcreate_sid = 0;
2027
2028         if (old_tsec->exec_sid) {
2029                 new_tsec->sid = old_tsec->exec_sid;
2030                 /* Reset exec SID on execve. */
2031                 new_tsec->exec_sid = 0;
2032
2033                 /*
2034                  * Minimize confusion: if no_new_privs and a transition is
2035                  * explicitly requested, then fail the exec.
2036                  */
2037                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2038                         return -EPERM;
2039         } else {
2040                 /* Check for a default transition on this program. */
2041                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2042                                              SECCLASS_PROCESS, NULL,
2043                                              &new_tsec->sid);
2044                 if (rc)
2045                         return rc;
2046         }
2047
2048         ad.type = LSM_AUDIT_DATA_PATH;
2049         ad.u.path = bprm->file->f_path;
2050
2051         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2052             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2053                 new_tsec->sid = old_tsec->sid;
2054
2055         if (new_tsec->sid == old_tsec->sid) {
2056                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2057                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2058                 if (rc)
2059                         return rc;
2060         } else {
2061                 /* Check permissions for the transition. */
2062                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2063                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2064                 if (rc)
2065                         return rc;
2066
2067                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2068                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2069                 if (rc)
2070                         return rc;
2071
2072                 /* Check for shared state */
2073                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2074                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2075                                           SECCLASS_PROCESS, PROCESS__SHARE,
2076                                           NULL);
2077                         if (rc)
2078                                 return -EPERM;
2079                 }
2080
2081                 /* Make sure that anyone attempting to ptrace over a task that
2082                  * changes its SID has the appropriate permit */
2083                 if (bprm->unsafe &
2084                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2085                         struct task_struct *tracer;
2086                         struct task_security_struct *sec;
2087                         u32 ptsid = 0;
2088
2089                         rcu_read_lock();
2090                         tracer = ptrace_parent(current);
2091                         if (likely(tracer != NULL)) {
2092                                 sec = __task_cred(tracer)->security;
2093                                 ptsid = sec->sid;
2094                         }
2095                         rcu_read_unlock();
2096
2097                         if (ptsid != 0) {
2098                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2099                                                   SECCLASS_PROCESS,
2100                                                   PROCESS__PTRACE, NULL);
2101                                 if (rc)
2102                                         return -EPERM;
2103                         }
2104                 }
2105
2106                 /* Clear any possibly unsafe personality bits on exec: */
2107                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2108         }
2109
2110         return 0;
2111 }
2112
2113 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2114 {
2115         const struct task_security_struct *tsec = current_security();
2116         u32 sid, osid;
2117         int atsecure = 0;
2118
2119         sid = tsec->sid;
2120         osid = tsec->osid;
2121
2122         if (osid != sid) {
2123                 /* Enable secure mode for SIDs transitions unless
2124                    the noatsecure permission is granted between
2125                    the two SIDs, i.e. ahp returns 0. */
2126                 atsecure = avc_has_perm(osid, sid,
2127                                         SECCLASS_PROCESS,
2128                                         PROCESS__NOATSECURE, NULL);
2129         }
2130
2131         return (atsecure || cap_bprm_secureexec(bprm));
2132 }
2133
2134 static int match_file(const void *p, struct file *file, unsigned fd)
2135 {
2136         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2137 }
2138
2139 /* Derived from fs/exec.c:flush_old_files. */
2140 static inline void flush_unauthorized_files(const struct cred *cred,
2141                                             struct files_struct *files)
2142 {
2143         struct file *file, *devnull = NULL;
2144         struct tty_struct *tty;
2145         int drop_tty = 0;
2146         unsigned n;
2147
2148         tty = get_current_tty();
2149         if (tty) {
2150                 spin_lock(&tty_files_lock);
2151                 if (!list_empty(&tty->tty_files)) {
2152                         struct tty_file_private *file_priv;
2153
2154                         /* Revalidate access to controlling tty.
2155                            Use path_has_perm on the tty path directly rather
2156                            than using file_has_perm, as this particular open
2157                            file may belong to another process and we are only
2158                            interested in the inode-based check here. */
2159                         file_priv = list_first_entry(&tty->tty_files,
2160                                                 struct tty_file_private, list);
2161                         file = file_priv->file;
2162                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2163                                 drop_tty = 1;
2164                 }
2165                 spin_unlock(&tty_files_lock);
2166                 tty_kref_put(tty);
2167         }
2168         /* Reset controlling tty. */
2169         if (drop_tty)
2170                 no_tty();
2171
2172         /* Revalidate access to inherited open files. */
2173         n = iterate_fd(files, 0, match_file, cred);
2174         if (!n) /* none found? */
2175                 return;
2176
2177         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2178         if (IS_ERR(devnull))
2179                 devnull = NULL;
2180         /* replace all the matching ones with this */
2181         do {
2182                 replace_fd(n - 1, devnull, 0);
2183         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2184         if (devnull)
2185                 fput(devnull);
2186 }
2187
2188 /*
2189  * Prepare a process for imminent new credential changes due to exec
2190  */
2191 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2192 {
2193         struct task_security_struct *new_tsec;
2194         struct rlimit *rlim, *initrlim;
2195         int rc, i;
2196
2197         new_tsec = bprm->cred->security;
2198         if (new_tsec->sid == new_tsec->osid)
2199                 return;
2200
2201         /* Close files for which the new task SID is not authorized. */
2202         flush_unauthorized_files(bprm->cred, current->files);
2203
2204         /* Always clear parent death signal on SID transitions. */
2205         current->pdeath_signal = 0;
2206
2207         /* Check whether the new SID can inherit resource limits from the old
2208          * SID.  If not, reset all soft limits to the lower of the current
2209          * task's hard limit and the init task's soft limit.
2210          *
2211          * Note that the setting of hard limits (even to lower them) can be
2212          * controlled by the setrlimit check.  The inclusion of the init task's
2213          * soft limit into the computation is to avoid resetting soft limits
2214          * higher than the default soft limit for cases where the default is
2215          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2216          */
2217         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2218                           PROCESS__RLIMITINH, NULL);
2219         if (rc) {
2220                 /* protect against do_prlimit() */
2221                 task_lock(current);
2222                 for (i = 0; i < RLIM_NLIMITS; i++) {
2223                         rlim = current->signal->rlim + i;
2224                         initrlim = init_task.signal->rlim + i;
2225                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2226                 }
2227                 task_unlock(current);
2228                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2229         }
2230 }
2231
2232 /*
2233  * Clean up the process immediately after the installation of new credentials
2234  * due to exec
2235  */
2236 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2237 {
2238         const struct task_security_struct *tsec = current_security();
2239         struct itimerval itimer;
2240         u32 osid, sid;
2241         int rc, i;
2242
2243         osid = tsec->osid;
2244         sid = tsec->sid;
2245
2246         if (sid == osid)
2247                 return;
2248
2249         /* Check whether the new SID can inherit signal state from the old SID.
2250          * If not, clear itimers to avoid subsequent signal generation and
2251          * flush and unblock signals.
2252          *
2253          * This must occur _after_ the task SID has been updated so that any
2254          * kill done after the flush will be checked against the new SID.
2255          */
2256         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2257         if (rc) {
2258                 memset(&itimer, 0, sizeof itimer);
2259                 for (i = 0; i < 3; i++)
2260                         do_setitimer(i, &itimer, NULL);
2261                 spin_lock_irq(&current->sighand->siglock);
2262                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2263                         __flush_signals(current);
2264                         flush_signal_handlers(current, 1);
2265                         sigemptyset(&current->blocked);
2266                 }
2267                 spin_unlock_irq(&current->sighand->siglock);
2268         }
2269
2270         /* Wake up the parent if it is waiting so that it can recheck
2271          * wait permission to the new task SID. */
2272         read_lock(&tasklist_lock);
2273         __wake_up_parent(current, current->real_parent);
2274         read_unlock(&tasklist_lock);
2275 }
2276
2277 /* superblock security operations */
2278
2279 static int selinux_sb_alloc_security(struct super_block *sb)
2280 {
2281         return superblock_alloc_security(sb);
2282 }
2283
2284 static void selinux_sb_free_security(struct super_block *sb)
2285 {
2286         superblock_free_security(sb);
2287 }
2288
2289 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2290 {
2291         if (plen > olen)
2292                 return 0;
2293
2294         return !memcmp(prefix, option, plen);
2295 }
2296
2297 static inline int selinux_option(char *option, int len)
2298 {
2299         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2300                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2301                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2302                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2303                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2304 }
2305
2306 static inline void take_option(char **to, char *from, int *first, int len)
2307 {
2308         if (!*first) {
2309                 **to = ',';
2310                 *to += 1;
2311         } else
2312                 *first = 0;
2313         memcpy(*to, from, len);
2314         *to += len;
2315 }
2316
2317 static inline void take_selinux_option(char **to, char *from, int *first,
2318                                        int len)
2319 {
2320         int current_size = 0;
2321
2322         if (!*first) {
2323                 **to = '|';
2324                 *to += 1;
2325         } else
2326                 *first = 0;
2327
2328         while (current_size < len) {
2329                 if (*from != '"') {
2330                         **to = *from;
2331                         *to += 1;
2332                 }
2333                 from += 1;
2334                 current_size += 1;
2335         }
2336 }
2337
2338 static int selinux_sb_copy_data(char *orig, char *copy)
2339 {
2340         int fnosec, fsec, rc = 0;
2341         char *in_save, *in_curr, *in_end;
2342         char *sec_curr, *nosec_save, *nosec;
2343         int open_quote = 0;
2344
2345         in_curr = orig;
2346         sec_curr = copy;
2347
2348         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2349         if (!nosec) {
2350                 rc = -ENOMEM;
2351                 goto out;
2352         }
2353
2354         nosec_save = nosec;
2355         fnosec = fsec = 1;
2356         in_save = in_end = orig;
2357
2358         do {
2359                 if (*in_end == '"')
2360                         open_quote = !open_quote;
2361                 if ((*in_end == ',' && open_quote == 0) ||
2362                                 *in_end == '\0') {
2363                         int len = in_end - in_curr;
2364
2365                         if (selinux_option(in_curr, len))
2366                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2367                         else
2368                                 take_option(&nosec, in_curr, &fnosec, len);
2369
2370                         in_curr = in_end + 1;
2371                 }
2372         } while (*in_end++);
2373
2374         strcpy(in_save, nosec_save);
2375         free_page((unsigned long)nosec_save);
2376 out:
2377         return rc;
2378 }
2379
2380 static int selinux_sb_remount(struct super_block *sb, void *data)
2381 {
2382         int rc, i, *flags;
2383         struct security_mnt_opts opts;
2384         char *secdata, **mount_options;
2385         struct superblock_security_struct *sbsec = sb->s_security;
2386
2387         if (!(sbsec->flags & SE_SBINITIALIZED))
2388                 return 0;
2389
2390         if (!data)
2391                 return 0;
2392
2393         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2394                 return 0;
2395
2396         security_init_mnt_opts(&opts);
2397         secdata = alloc_secdata();
2398         if (!secdata)
2399                 return -ENOMEM;
2400         rc = selinux_sb_copy_data(data, secdata);
2401         if (rc)
2402                 goto out_free_secdata;
2403
2404         rc = selinux_parse_opts_str(secdata, &opts);
2405         if (rc)
2406                 goto out_free_secdata;
2407
2408         mount_options = opts.mnt_opts;
2409         flags = opts.mnt_opts_flags;
2410
2411         for (i = 0; i < opts.num_mnt_opts; i++) {
2412                 u32 sid;
2413                 size_t len;
2414
2415                 if (flags[i] == SE_SBLABELSUPP)
2416                         continue;
2417                 len = strlen(mount_options[i]);
2418                 rc = security_context_to_sid(mount_options[i], len, &sid);
2419                 if (rc) {
2420                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2421                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2422                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2423                         goto out_free_opts;
2424                 }
2425                 rc = -EINVAL;
2426                 switch (flags[i]) {
2427                 case FSCONTEXT_MNT:
2428                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2429                                 goto out_bad_option;
2430                         break;
2431                 case CONTEXT_MNT:
2432                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2433                                 goto out_bad_option;
2434                         break;
2435                 case ROOTCONTEXT_MNT: {
2436                         struct inode_security_struct *root_isec;
2437                         root_isec = sb->s_root->d_inode->i_security;
2438
2439                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2440                                 goto out_bad_option;
2441                         break;
2442                 }
2443                 case DEFCONTEXT_MNT:
2444                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2445                                 goto out_bad_option;
2446                         break;
2447                 default:
2448                         goto out_free_opts;
2449                 }
2450         }
2451
2452         rc = 0;
2453 out_free_opts:
2454         security_free_mnt_opts(&opts);
2455 out_free_secdata:
2456         free_secdata(secdata);
2457         return rc;
2458 out_bad_option:
2459         printk(KERN_WARNING "SELinux: unable to change security options "
2460                "during remount (dev %s, type=%s)\n", sb->s_id,
2461                sb->s_type->name);
2462         goto out_free_opts;
2463 }
2464
2465 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2466 {
2467         const struct cred *cred = current_cred();
2468         struct common_audit_data ad;
2469         int rc;
2470
2471         rc = superblock_doinit(sb, data);
2472         if (rc)
2473                 return rc;
2474
2475         /* Allow all mounts performed by the kernel */
2476         if (flags & MS_KERNMOUNT)
2477                 return 0;
2478
2479         ad.type = LSM_AUDIT_DATA_DENTRY;
2480         ad.u.dentry = sb->s_root;
2481         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2482 }
2483
2484 static int selinux_sb_statfs(struct dentry *dentry)
2485 {
2486         const struct cred *cred = current_cred();
2487         struct common_audit_data ad;
2488
2489         ad.type = LSM_AUDIT_DATA_DENTRY;
2490         ad.u.dentry = dentry->d_sb->s_root;
2491         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2492 }
2493
2494 static int selinux_mount(const char *dev_name,
2495                          struct path *path,
2496                          const char *type,
2497                          unsigned long flags,
2498                          void *data)
2499 {
2500         const struct cred *cred = current_cred();
2501
2502         if (flags & MS_REMOUNT)
2503                 return superblock_has_perm(cred, path->dentry->d_sb,
2504                                            FILESYSTEM__REMOUNT, NULL);
2505         else
2506                 return path_has_perm(cred, path, FILE__MOUNTON);
2507 }
2508
2509 static int selinux_umount(struct vfsmount *mnt, int flags)
2510 {
2511         const struct cred *cred = current_cred();
2512
2513         return superblock_has_perm(cred, mnt->mnt_sb,
2514                                    FILESYSTEM__UNMOUNT, NULL);
2515 }
2516
2517 /* inode security operations */
2518
2519 static int selinux_inode_alloc_security(struct inode *inode)
2520 {
2521         return inode_alloc_security(inode);
2522 }
2523
2524 static void selinux_inode_free_security(struct inode *inode)
2525 {
2526         inode_free_security(inode);
2527 }
2528
2529 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2530                                        const struct qstr *qstr, char **name,
2531                                        void **value, size_t *len)
2532 {
2533         const struct task_security_struct *tsec = current_security();
2534         struct inode_security_struct *dsec;
2535         struct superblock_security_struct *sbsec;
2536         u32 sid, newsid, clen;
2537         int rc;
2538         char *namep = NULL, *context;
2539
2540         dsec = dir->i_security;
2541         sbsec = dir->i_sb->s_security;
2542
2543         sid = tsec->sid;
2544         newsid = tsec->create_sid;
2545
2546         if ((sbsec->flags & SE_SBINITIALIZED) &&
2547             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2548                 newsid = sbsec->mntpoint_sid;
2549         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2550                 rc = security_transition_sid(sid, dsec->sid,
2551                                              inode_mode_to_security_class(inode->i_mode),
2552                                              qstr, &newsid);
2553                 if (rc) {
2554                         printk(KERN_WARNING "%s:  "
2555                                "security_transition_sid failed, rc=%d (dev=%s "
2556                                "ino=%ld)\n",
2557                                __func__,
2558                                -rc, inode->i_sb->s_id, inode->i_ino);
2559                         return rc;
2560                 }
2561         }
2562
2563         /* Possibly defer initialization to selinux_complete_init. */
2564         if (sbsec->flags & SE_SBINITIALIZED) {
2565                 struct inode_security_struct *isec = inode->i_security;
2566                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2567                 isec->sid = newsid;
2568                 isec->initialized = 1;
2569         }
2570
2571         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2572                 return -EOPNOTSUPP;
2573
2574         if (name) {
2575                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2576                 if (!namep)
2577                         return -ENOMEM;
2578                 *name = namep;
2579         }
2580
2581         if (value && len) {
2582                 rc = security_sid_to_context_force(newsid, &context, &clen);
2583                 if (rc) {
2584                         kfree(namep);
2585                         return rc;
2586                 }
2587                 *value = context;
2588                 *len = clen;
2589         }
2590
2591         return 0;
2592 }
2593
2594 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2595 {
2596         return may_create(dir, dentry, SECCLASS_FILE);
2597 }
2598
2599 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2600 {
2601         return may_link(dir, old_dentry, MAY_LINK);
2602 }
2603
2604 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2605 {
2606         return may_link(dir, dentry, MAY_UNLINK);
2607 }
2608
2609 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2610 {
2611         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2612 }
2613
2614 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2615 {
2616         return may_create(dir, dentry, SECCLASS_DIR);
2617 }
2618
2619 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2620 {
2621         return may_link(dir, dentry, MAY_RMDIR);
2622 }
2623
2624 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2625 {
2626         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2627 }
2628
2629 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2630                                 struct inode *new_inode, struct dentry *new_dentry)
2631 {
2632         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2633 }
2634
2635 static int selinux_inode_readlink(struct dentry *dentry)
2636 {
2637         const struct cred *cred = current_cred();
2638
2639         return dentry_has_perm(cred, dentry, FILE__READ);
2640 }
2641
2642 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2643 {
2644         const struct cred *cred = current_cred();
2645
2646         return dentry_has_perm(cred, dentry, FILE__READ);
2647 }
2648
2649 static noinline int audit_inode_permission(struct inode *inode,
2650                                            u32 perms, u32 audited, u32 denied,
2651                                            unsigned flags)
2652 {
2653         struct common_audit_data ad;
2654         struct inode_security_struct *isec = inode->i_security;
2655         int rc;
2656
2657         ad.type = LSM_AUDIT_DATA_INODE;
2658         ad.u.inode = inode;
2659
2660         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2661                             audited, denied, &ad, flags);
2662         if (rc)
2663                 return rc;
2664         return 0;
2665 }
2666
2667 static int selinux_inode_permission(struct inode *inode, int mask)
2668 {
2669         const struct cred *cred = current_cred();
2670         u32 perms;
2671         bool from_access;
2672         unsigned flags = mask & MAY_NOT_BLOCK;
2673         struct inode_security_struct *isec;
2674         u32 sid;
2675         struct av_decision avd;
2676         int rc, rc2;
2677         u32 audited, denied;
2678
2679         from_access = mask & MAY_ACCESS;
2680         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2681
2682         /* No permission to check.  Existence test. */
2683         if (!mask)
2684                 return 0;
2685
2686         validate_creds(cred);
2687
2688         if (unlikely(IS_PRIVATE(inode)))
2689                 return 0;
2690
2691         perms = file_mask_to_av(inode->i_mode, mask);
2692
2693         sid = cred_sid(cred);
2694         isec = inode->i_security;
2695
2696         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2697         audited = avc_audit_required(perms, &avd, rc,
2698                                      from_access ? FILE__AUDIT_ACCESS : 0,
2699                                      &denied);
2700         if (likely(!audited))
2701                 return rc;
2702
2703         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2704         if (rc2)
2705                 return rc2;
2706         return rc;
2707 }
2708
2709 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2710 {
2711         const struct cred *cred = current_cred();
2712         unsigned int ia_valid = iattr->ia_valid;
2713         __u32 av = FILE__WRITE;
2714
2715         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2716         if (ia_valid & ATTR_FORCE) {
2717                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2718                               ATTR_FORCE);
2719                 if (!ia_valid)
2720                         return 0;
2721         }
2722
2723         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2724                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2725                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2726
2727         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2728                 av |= FILE__OPEN;
2729
2730         return dentry_has_perm(cred, dentry, av);
2731 }
2732
2733 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2734 {
2735         const struct cred *cred = current_cred();
2736         struct path path;
2737
2738         path.dentry = dentry;
2739         path.mnt = mnt;
2740
2741         return path_has_perm(cred, &path, FILE__GETATTR);
2742 }
2743
2744 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2745 {
2746         const struct cred *cred = current_cred();
2747
2748         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2749                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2750                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2751                         if (!capable(CAP_SETFCAP))
2752                                 return -EPERM;
2753                 } else if (!capable(CAP_SYS_ADMIN)) {
2754                         /* A different attribute in the security namespace.
2755                            Restrict to administrator. */
2756                         return -EPERM;
2757                 }
2758         }
2759
2760         /* Not an attribute we recognize, so just check the
2761            ordinary setattr permission. */
2762         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2763 }
2764
2765 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2766                                   const void *value, size_t size, int flags)
2767 {
2768         struct inode *inode = dentry->d_inode;
2769         struct inode_security_struct *isec = inode->i_security;
2770         struct superblock_security_struct *sbsec;
2771         struct common_audit_data ad;
2772         u32 newsid, sid = current_sid();
2773         int rc = 0;
2774
2775         if (strcmp(name, XATTR_NAME_SELINUX))
2776                 return selinux_inode_setotherxattr(dentry, name);
2777
2778         sbsec = inode->i_sb->s_security;
2779         if (!(sbsec->flags & SE_SBLABELSUPP))
2780                 return -EOPNOTSUPP;
2781
2782         if (!inode_owner_or_capable(inode))
2783                 return -EPERM;
2784
2785         ad.type = LSM_AUDIT_DATA_DENTRY;
2786         ad.u.dentry = dentry;
2787
2788         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2789                           FILE__RELABELFROM, &ad);
2790         if (rc)
2791                 return rc;
2792
2793         rc = security_context_to_sid(value, size, &newsid);
2794         if (rc == -EINVAL) {
2795                 if (!capable(CAP_MAC_ADMIN)) {
2796                         struct audit_buffer *ab;
2797                         size_t audit_size;
2798                         const char *str;
2799
2800                         /* We strip a nul only if it is at the end, otherwise the
2801                          * context contains a nul and we should audit that */
2802                         if (value) {
2803                                 str = value;
2804                                 if (str[size - 1] == '\0')
2805                                         audit_size = size - 1;
2806                                 else
2807                                         audit_size = size;
2808                         } else {
2809                                 str = "";
2810                                 audit_size = 0;
2811                         }
2812                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2813                         audit_log_format(ab, "op=setxattr invalid_context=");
2814                         audit_log_n_untrustedstring(ab, value, audit_size);
2815                         audit_log_end(ab);
2816
2817                         return rc;
2818                 }
2819                 rc = security_context_to_sid_force(value, size, &newsid);
2820         }
2821         if (rc)
2822                 return rc;
2823
2824         rc = avc_has_perm(sid, newsid, isec->sclass,
2825                           FILE__RELABELTO, &ad);
2826         if (rc)
2827                 return rc;
2828
2829         rc = security_validate_transition(isec->sid, newsid, sid,
2830                                           isec->sclass);
2831         if (rc)
2832                 return rc;
2833
2834         return avc_has_perm(newsid,
2835                             sbsec->sid,
2836                             SECCLASS_FILESYSTEM,
2837                             FILESYSTEM__ASSOCIATE,
2838                             &ad);
2839 }
2840
2841 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2842                                         const void *value, size_t size,
2843                                         int flags)
2844 {
2845         struct inode *inode = dentry->d_inode;
2846         struct inode_security_struct *isec = inode->i_security;
2847         u32 newsid;
2848         int rc;
2849
2850         if (strcmp(name, XATTR_NAME_SELINUX)) {
2851                 /* Not an attribute we recognize, so nothing to do. */
2852                 return;
2853         }
2854
2855         rc = security_context_to_sid_force(value, size, &newsid);
2856         if (rc) {
2857                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2858                        "for (%s, %lu), rc=%d\n",
2859                        inode->i_sb->s_id, inode->i_ino, -rc);
2860                 return;
2861         }
2862
2863         isec->sid = newsid;
2864         return;
2865 }
2866
2867 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2868 {
2869         const struct cred *cred = current_cred();
2870
2871         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2872 }
2873
2874 static int selinux_inode_listxattr(struct dentry *dentry)
2875 {
2876         const struct cred *cred = current_cred();
2877
2878         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2879 }
2880
2881 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2882 {
2883         if (strcmp(name, XATTR_NAME_SELINUX))
2884                 return selinux_inode_setotherxattr(dentry, name);
2885
2886         /* No one is allowed to remove a SELinux security label.
2887            You can change the label, but all data must be labeled. */
2888         return -EACCES;
2889 }
2890
2891 /*
2892  * Copy the inode security context value to the user.
2893  *
2894  * Permission check is handled by selinux_inode_getxattr hook.
2895  */
2896 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2897 {
2898         u32 size;
2899         int error;
2900         char *context = NULL;
2901         struct inode_security_struct *isec = inode->i_security;
2902
2903         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2904                 return -EOPNOTSUPP;
2905
2906         /*
2907          * If the caller has CAP_MAC_ADMIN, then get the raw context
2908          * value even if it is not defined by current policy; otherwise,
2909          * use the in-core value under current policy.
2910          * Use the non-auditing forms of the permission checks since
2911          * getxattr may be called by unprivileged processes commonly
2912          * and lack of permission just means that we fall back to the
2913          * in-core context value, not a denial.
2914          */
2915         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2916                                 SECURITY_CAP_NOAUDIT);
2917         if (!error)
2918                 error = security_sid_to_context_force(isec->sid, &context,
2919                                                       &size);
2920         else
2921                 error = security_sid_to_context(isec->sid, &context, &size);
2922         if (error)
2923                 return error;
2924         error = size;
2925         if (alloc) {
2926                 *buffer = context;
2927                 goto out_nofree;
2928         }
2929         kfree(context);
2930 out_nofree:
2931         return error;
2932 }
2933
2934 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2935                                      const void *value, size_t size, int flags)
2936 {
2937         struct inode_security_struct *isec = inode->i_security;
2938         u32 newsid;
2939         int rc;
2940
2941         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2942                 return -EOPNOTSUPP;
2943
2944         if (!value || !size)
2945                 return -EACCES;
2946
2947         rc = security_context_to_sid((void *)value, size, &newsid);
2948         if (rc)
2949                 return rc;
2950
2951         isec->sid = newsid;
2952         isec->initialized = 1;
2953         return 0;
2954 }
2955
2956 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2957 {
2958         const int len = sizeof(XATTR_NAME_SELINUX);
2959         if (buffer && len <= buffer_size)
2960                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2961         return len;
2962 }
2963
2964 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2965 {
2966         struct inode_security_struct *isec = inode->i_security;
2967         *secid = isec->sid;
2968 }
2969
2970 /* file security operations */
2971
2972 static int selinux_revalidate_file_permission(struct file *file, int mask)
2973 {
2974         const struct cred *cred = current_cred();
2975         struct inode *inode = file_inode(file);
2976
2977         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2978         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2979                 mask |= MAY_APPEND;
2980
2981         return file_has_perm(cred, file,
2982                              file_mask_to_av(inode->i_mode, mask));
2983 }
2984
2985 static int selinux_file_permission(struct file *file, int mask)
2986 {
2987         struct inode *inode = file_inode(file);
2988         struct file_security_struct *fsec = file->f_security;
2989         struct inode_security_struct *isec = inode->i_security;
2990         u32 sid = current_sid();
2991
2992         if (!mask)
2993                 /* No permission to check.  Existence test. */
2994                 return 0;
2995
2996         if (sid == fsec->sid && fsec->isid == isec->sid &&
2997             fsec->pseqno == avc_policy_seqno())
2998                 /* No change since file_open check. */
2999                 return 0;
3000
3001         return selinux_revalidate_file_permission(file, mask);
3002 }
3003
3004 static int selinux_file_alloc_security(struct file *file)
3005 {
3006         return file_alloc_security(file);
3007 }
3008
3009 static void selinux_file_free_security(struct file *file)
3010 {
3011         file_free_security(file);
3012 }
3013
3014 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3015                               unsigned long arg)
3016 {
3017         const struct cred *cred = current_cred();
3018         int error = 0;
3019
3020         switch (cmd) {
3021         case FIONREAD:
3022         /* fall through */
3023         case FIBMAP:
3024         /* fall through */
3025         case FIGETBSZ:
3026         /* fall through */
3027         case FS_IOC_GETFLAGS:
3028         /* fall through */
3029         case FS_IOC_GETVERSION:
3030                 error = file_has_perm(cred, file, FILE__GETATTR);
3031                 break;
3032
3033         case FS_IOC_SETFLAGS:
3034         /* fall through */
3035         case FS_IOC_SETVERSION:
3036                 error = file_has_perm(cred, file, FILE__SETATTR);
3037                 break;
3038
3039         /* sys_ioctl() checks */
3040         case FIONBIO:
3041         /* fall through */
3042         case FIOASYNC:
3043                 error = file_has_perm(cred, file, 0);
3044                 break;
3045
3046         case KDSKBENT:
3047         case KDSKBSENT:
3048                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3049                                             SECURITY_CAP_AUDIT);
3050                 break;
3051
3052         /* default case assumes that the command will go
3053          * to the file's ioctl() function.
3054          */
3055         default:
3056                 error = file_has_perm(cred, file, FILE__IOCTL);
3057         }
3058         return error;
3059 }
3060
3061 static int default_noexec;
3062
3063 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3064 {
3065         const struct cred *cred = current_cred();
3066         int rc = 0;
3067
3068         if (default_noexec &&
3069             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3070                 /*
3071                  * We are making executable an anonymous mapping or a
3072                  * private file mapping that will also be writable.
3073                  * This has an additional check.
3074                  */
3075                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3076                 if (rc)
3077                         goto error;
3078         }
3079
3080         if (file) {
3081                 /* read access is always possible with a mapping */
3082                 u32 av = FILE__READ;
3083
3084                 /* write access only matters if the mapping is shared */
3085                 if (shared && (prot & PROT_WRITE))
3086                         av |= FILE__WRITE;
3087
3088                 if (prot & PROT_EXEC)
3089                         av |= FILE__EXECUTE;
3090
3091                 return file_has_perm(cred, file, av);
3092         }
3093
3094 error:
3095         return rc;
3096 }
3097
3098 static int selinux_mmap_addr(unsigned long addr)
3099 {
3100         int rc = 0;
3101         u32 sid = current_sid();
3102
3103         /*
3104          * notice that we are intentionally putting the SELinux check before
3105          * the secondary cap_file_mmap check.  This is such a likely attempt
3106          * at bad behaviour/exploit that we always want to get the AVC, even
3107          * if DAC would have also denied the operation.
3108          */
3109         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3110                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3111                                   MEMPROTECT__MMAP_ZERO, NULL);
3112                 if (rc)
3113                         return rc;
3114         }
3115
3116         /* do DAC check on address space usage */
3117         return cap_mmap_addr(addr);
3118 }
3119
3120 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3121                              unsigned long prot, unsigned long flags)
3122 {
3123         if (selinux_checkreqprot)
3124                 prot = reqprot;
3125
3126         return file_map_prot_check(file, prot,
3127                                    (flags & MAP_TYPE) == MAP_SHARED);
3128 }
3129
3130 static int selinux_file_mprotect(struct vm_area_struct *vma,
3131                                  unsigned long reqprot,
3132                                  unsigned long prot)
3133 {
3134         const struct cred *cred = current_cred();
3135
3136         if (selinux_checkreqprot)
3137                 prot = reqprot;
3138
3139         if (default_noexec &&
3140             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3141                 int rc = 0;
3142                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3143                     vma->vm_end <= vma->vm_mm->brk) {
3144                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3145                 } else if (!vma->vm_file &&
3146                            vma->vm_start <= vma->vm_mm->start_stack &&
3147                            vma->vm_end >= vma->vm_mm->start_stack) {
3148                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3149                 } else if (vma->vm_file && vma->anon_vma) {
3150                         /*
3151                          * We are making executable a file mapping that has
3152                          * had some COW done. Since pages might have been
3153                          * written, check ability to execute the possibly
3154                          * modified content.  This typically should only
3155                          * occur for text relocations.
3156                          */
3157                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3158                 }
3159                 if (rc)
3160                         return rc;
3161         }
3162
3163         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3164 }
3165
3166 static int selinux_file_lock(struct file *file, unsigned int cmd)
3167 {
3168         const struct cred *cred = current_cred();
3169
3170         return file_has_perm(cred, file, FILE__LOCK);
3171 }
3172
3173 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3174                               unsigned long arg)
3175 {
3176         const struct cred *cred = current_cred();
3177         int err = 0;
3178
3179         switch (cmd) {
3180         case F_SETFL:
3181                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3182                         err = file_has_perm(cred, file, FILE__WRITE);
3183                         break;
3184                 }
3185                 /* fall through */
3186         case F_SETOWN:
3187         case F_SETSIG:
3188         case F_GETFL:
3189         case F_GETOWN:
3190         case F_GETSIG:
3191         case F_GETOWNER_UIDS:
3192                 /* Just check FD__USE permission */
3193                 err = file_has_perm(cred, file, 0);
3194                 break;
3195         case F_GETLK:
3196         case F_SETLK:
3197         case F_SETLKW:
3198 #if BITS_PER_LONG == 32
3199         case F_GETLK64:
3200         case F_SETLK64:
3201         case F_SETLKW64:
3202 #endif
3203                 err = file_has_perm(cred, file, FILE__LOCK);
3204                 break;
3205         }
3206
3207         return err;
3208 }
3209
3210 static int selinux_file_set_fowner(struct file *file)
3211 {
3212         struct file_security_struct *fsec;
3213
3214         fsec = file->f_security;
3215         fsec->fown_sid = current_sid();
3216
3217         return 0;
3218 }
3219
3220 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3221                                        struct fown_struct *fown, int signum)
3222 {
3223         struct file *file;
3224         u32 sid = task_sid(tsk);
3225         u32 perm;
3226         struct file_security_struct *fsec;
3227
3228         /* struct fown_struct is never outside the context of a struct file */
3229         file = container_of(fown, struct file, f_owner);
3230
3231         fsec = file->f_security;
3232
3233         if (!signum)
3234                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3235         else
3236                 perm = signal_to_av(signum);
3237
3238         return avc_has_perm(fsec->fown_sid, sid,
3239                             SECCLASS_PROCESS, perm, NULL);
3240 }
3241
3242 static int selinux_file_receive(struct file *file)
3243 {
3244         const struct cred *cred = current_cred();
3245
3246         return file_has_perm(cred, file, file_to_av(file));
3247 }
3248
3249 static int selinux_file_open(struct file *file, const struct cred *cred)
3250 {
3251         struct file_security_struct *fsec;
3252         struct inode_security_struct *isec;
3253
3254         fsec = file->f_security;
3255         isec = file_inode(file)->i_security;
3256         /*
3257          * Save inode label and policy sequence number
3258          * at open-time so that selinux_file_permission
3259          * can determine whether revalidation is necessary.
3260          * Task label is already saved in the file security
3261          * struct as its SID.
3262          */
3263         fsec->isid = isec->sid;
3264         fsec->pseqno = avc_policy_seqno();
3265         /*
3266          * Since the inode label or policy seqno may have changed
3267          * between the selinux_inode_permission check and the saving
3268          * of state above, recheck that access is still permitted.
3269          * Otherwise, access might never be revalidated against the
3270          * new inode label or new policy.
3271          * This check is not redundant - do not remove.
3272          */
3273         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3274 }
3275
3276 /* task security operations */
3277
3278 static int selinux_task_create(unsigned long clone_flags)
3279 {
3280         return current_has_perm(current, PROCESS__FORK);
3281 }
3282
3283 /*
3284  * allocate the SELinux part of blank credentials
3285  */
3286 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3287 {
3288         struct task_security_struct *tsec;
3289
3290         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3291         if (!tsec)
3292                 return -ENOMEM;
3293
3294         cred->security = tsec;
3295         return 0;
3296 }
3297
3298 /*
3299  * detach and free the LSM part of a set of credentials
3300  */
3301 static void selinux_cred_free(struct cred *cred)
3302 {
3303         struct task_security_struct *tsec = cred->security;
3304
3305         /*
3306          * cred->security == NULL if security_cred_alloc_blank() or
3307          * security_prepare_creds() returned an error.
3308          */
3309         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3310         cred->security = (void *) 0x7UL;
3311         kfree(tsec);
3312 }
3313
3314 /*
3315  * prepare a new set of credentials for modification
3316  */
3317 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3318                                 gfp_t gfp)
3319 {
3320         const struct task_security_struct *old_tsec;
3321         struct task_security_struct *tsec;
3322
3323         old_tsec = old->security;
3324
3325         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3326         if (!tsec)
3327                 return -ENOMEM;
3328
3329         new->security = tsec;
3330         return 0;
3331 }
3332
3333 /*
3334  * transfer the SELinux data to a blank set of creds
3335  */
3336 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3337 {
3338         const struct task_security_struct *old_tsec = old->security;
3339         struct task_security_struct *tsec = new->security;
3340
3341         *tsec = *old_tsec;
3342 }
3343
3344 /*
3345  * set the security data for a kernel service
3346  * - all the creation contexts are set to unlabelled
3347  */
3348 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3349 {
3350         struct task_security_struct *tsec = new->security;
3351         u32 sid = current_sid();
3352         int ret;
3353
3354         ret = avc_has_perm(sid, secid,
3355                            SECCLASS_KERNEL_SERVICE,
3356                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3357                            NULL);
3358         if (ret == 0) {
3359                 tsec->sid = secid;
3360                 tsec->create_sid = 0;
3361                 tsec->keycreate_sid = 0;
3362                 tsec->sockcreate_sid = 0;
3363         }
3364         return ret;
3365 }
3366
3367 /*
3368  * set the file creation context in a security record to the same as the
3369  * objective context of the specified inode
3370  */
3371 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3372 {
3373         struct inode_security_struct *isec = inode->i_security;
3374         struct task_security_struct *tsec = new->security;
3375         u32 sid = current_sid();
3376         int ret;
3377
3378         ret = avc_has_perm(sid, isec->sid,
3379                            SECCLASS_KERNEL_SERVICE,
3380                            KERNEL_SERVICE__CREATE_FILES_AS,
3381                            NULL);
3382
3383         if (ret == 0)
3384                 tsec->create_sid = isec->sid;
3385         return ret;
3386 }
3387
3388 static int selinux_kernel_module_request(char *kmod_name)
3389 {
3390         u32 sid;
3391         struct common_audit_data ad;
3392
3393         sid = task_sid(current);
3394
3395         ad.type = LSM_AUDIT_DATA_KMOD;
3396         ad.u.kmod_name = kmod_name;
3397
3398         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3399                             SYSTEM__MODULE_REQUEST, &ad);
3400 }
3401
3402 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3403 {
3404         return current_has_perm(p, PROCESS__SETPGID);
3405 }
3406
3407 static int selinux_task_getpgid(struct task_struct *p)
3408 {
3409         return current_has_perm(p, PROCESS__GETPGID);
3410 }
3411
3412 static int selinux_task_getsid(struct task_struct *p)
3413 {
3414         return current_has_perm(p, PROCESS__GETSESSION);
3415 }
3416
3417 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3418 {
3419         *secid = task_sid(p);
3420 }
3421
3422 static int selinux_task_setnice(struct task_struct *p, int nice)
3423 {
3424         int rc;
3425
3426         rc = cap_task_setnice(p, nice);
3427         if (rc)
3428                 return rc;
3429
3430         return current_has_perm(p, PROCESS__SETSCHED);
3431 }
3432
3433 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3434 {
3435         int rc;
3436
3437         rc = cap_task_setioprio(p, ioprio);
3438         if (rc)
3439                 return rc;
3440
3441         return current_has_perm(p, PROCESS__SETSCHED);
3442 }
3443
3444 static int selinux_task_getioprio(struct task_struct *p)
3445 {
3446         return current_has_perm(p, PROCESS__GETSCHED);
3447 }
3448
3449 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3450                 struct rlimit *new_rlim)
3451 {
3452         struct rlimit *old_rlim = p->signal->rlim + resource;
3453
3454         /* Control the ability to change the hard limit (whether
3455            lowering or raising it), so that the hard limit can
3456            later be used as a safe reset point for the soft limit
3457            upon context transitions.  See selinux_bprm_committing_creds. */
3458         if (old_rlim->rlim_max != new_rlim->rlim_max)
3459                 return current_has_perm(p, PROCESS__SETRLIMIT);
3460
3461         return 0;
3462 }
3463
3464 static int selinux_task_setscheduler(struct task_struct *p)
3465 {
3466         int rc;
3467
3468         rc = cap_task_setscheduler(p);
3469         if (rc)
3470                 return rc;
3471
3472         return current_has_perm(p, PROCESS__SETSCHED);
3473 }
3474
3475 static int selinux_task_getscheduler(struct task_struct *p)
3476 {
3477         return current_has_perm(p, PROCESS__GETSCHED);
3478 }
3479
3480 static int selinux_task_movememory(struct task_struct *p)
3481 {
3482         return current_has_perm(p, PROCESS__SETSCHED);
3483 }
3484
3485 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3486                                 int sig, u32 secid)
3487 {
3488         u32 perm;
3489         int rc;
3490
3491         if (!sig)
3492                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3493         else
3494                 perm = signal_to_av(sig);
3495         if (secid)
3496                 rc = avc_has_perm(secid, task_sid(p),
3497                                   SECCLASS_PROCESS, perm, NULL);
3498         else
3499                 rc = current_has_perm(p, perm);
3500         return rc;
3501 }
3502
3503 static int selinux_task_wait(struct task_struct *p)
3504 {
3505         return task_has_perm(p, current, PROCESS__SIGCHLD);
3506 }
3507
3508 static void selinux_task_to_inode(struct task_struct *p,
3509                                   struct inode *inode)
3510 {
3511         struct inode_security_struct *isec = inode->i_security;
3512         u32 sid = task_sid(p);
3513
3514         isec->sid = sid;
3515         isec->initialized = 1;
3516 }
3517
3518 /* Returns error only if unable to parse addresses */
3519 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3520                         struct common_audit_data *ad, u8 *proto)
3521 {
3522         int offset, ihlen, ret = -EINVAL;
3523         struct iphdr _iph, *ih;
3524
3525         offset = skb_network_offset(skb);
3526         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3527         if (ih == NULL)
3528                 goto out;
3529
3530         ihlen = ih->ihl * 4;
3531         if (ihlen < sizeof(_iph))
3532                 goto out;
3533
3534         ad->u.net->v4info.saddr = ih->saddr;
3535         ad->u.net->v4info.daddr = ih->daddr;
3536         ret = 0;
3537
3538         if (proto)
3539                 *proto = ih->protocol;
3540
3541         switch (ih->protocol) {
3542         case IPPROTO_TCP: {
3543                 struct tcphdr _tcph, *th;
3544
3545                 if (ntohs(ih->frag_off) & IP_OFFSET)
3546                         break;
3547
3548                 offset += ihlen;
3549                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3550                 if (th == NULL)
3551                         break;
3552
3553                 ad->u.net->sport = th->source;
3554                 ad->u.net->dport = th->dest;
3555                 break;
3556         }
3557
3558         case IPPROTO_UDP: {
3559                 struct udphdr _udph, *uh;
3560
3561                 if (ntohs(ih->frag_off) & IP_OFFSET)
3562                         break;
3563
3564                 offset += ihlen;
3565                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3566                 if (uh == NULL)
3567                         break;
3568
3569                 ad->u.net->sport = uh->source;
3570                 ad->u.net->dport = uh->dest;
3571                 break;
3572         }
3573
3574         case IPPROTO_DCCP: {
3575                 struct dccp_hdr _dccph, *dh;
3576
3577                 if (ntohs(ih->frag_off) & IP_OFFSET)
3578                         break;
3579
3580                 offset += ihlen;
3581                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3582                 if (dh == NULL)
3583                         break;
3584
3585                 ad->u.net->sport = dh->dccph_sport;
3586                 ad->u.net->dport = dh->dccph_dport;
3587                 break;
3588         }
3589
3590         default:
3591                 break;
3592         }
3593 out:
3594         return ret;
3595 }
3596
3597 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3598
3599 /* Returns error only if unable to parse addresses */
3600 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3601                         struct common_audit_data *ad, u8 *proto)
3602 {
3603         u8 nexthdr;
3604         int ret = -EINVAL, offset;
3605         struct ipv6hdr _ipv6h, *ip6;
3606         __be16 frag_off;
3607
3608         offset = skb_network_offset(skb);
3609         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3610         if (ip6 == NULL)
3611                 goto out;
3612
3613         ad->u.net->v6info.saddr = ip6->saddr;
3614         ad->u.net->v6info.daddr = ip6->daddr;
3615         ret = 0;
3616
3617         nexthdr = ip6->nexthdr;
3618         offset += sizeof(_ipv6h);
3619         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3620         if (offset < 0)
3621                 goto out;
3622
3623         if (proto)
3624                 *proto = nexthdr;
3625
3626         switch (nexthdr) {
3627         case IPPROTO_TCP: {
3628                 struct tcphdr _tcph, *th;
3629
3630                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3631                 if (th == NULL)
3632                         break;
3633
3634                 ad->u.net->sport = th->source;
3635                 ad->u.net->dport = th->dest;
3636                 break;
3637         }
3638
3639         case IPPROTO_UDP: {
3640                 struct udphdr _udph, *uh;
3641
3642                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3643                 if (uh == NULL)
3644                         break;
3645
3646                 ad->u.net->sport = uh->source;
3647                 ad->u.net->dport = uh->dest;
3648                 break;
3649         }
3650
3651         case IPPROTO_DCCP: {
3652                 struct dccp_hdr _dccph, *dh;
3653
3654                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3655                 if (dh == NULL)
3656                         break;
3657
3658                 ad->u.net->sport = dh->dccph_sport;
3659                 ad->u.net->dport = dh->dccph_dport;
3660                 break;
3661         }
3662
3663         /* includes fragments */
3664         default:
3665                 break;
3666         }
3667 out:
3668         return ret;
3669 }
3670
3671 #endif /* IPV6 */
3672
3673 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3674                              char **_addrp, int src, u8 *proto)
3675 {
3676         char *addrp;
3677         int ret;
3678
3679         switch (ad->u.net->family) {
3680         case PF_INET:
3681                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3682                 if (ret)
3683                         goto parse_error;
3684                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3685                                        &ad->u.net->v4info.daddr);
3686                 goto okay;
3687
3688 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3689         case PF_INET6:
3690                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3691                 if (ret)
3692                         goto parse_error;
3693                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3694                                        &ad->u.net->v6info.daddr);
3695                 goto okay;
3696 #endif  /* IPV6 */
3697         default:
3698                 addrp = NULL;
3699                 goto okay;
3700         }
3701
3702 parse_error:
3703         printk(KERN_WARNING
3704                "SELinux: failure in selinux_parse_skb(),"
3705                " unable to parse packet\n");
3706         return ret;
3707
3708 okay:
3709         if (_addrp)
3710                 *_addrp = addrp;
3711         return 0;
3712 }
3713
3714 /**
3715  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3716  * @skb: the packet
3717  * @family: protocol family
3718  * @sid: the packet's peer label SID
3719  *
3720  * Description:
3721  * Check the various different forms of network peer labeling and determine
3722  * the peer label/SID for the packet; most of the magic actually occurs in
3723  * the security server function security_net_peersid_cmp().  The function
3724  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3725  * or -EACCES if @sid is invalid due to inconsistencies with the different
3726  * peer labels.
3727  *
3728  */
3729 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3730 {
3731         int err;
3732         u32 xfrm_sid;
3733         u32 nlbl_sid;
3734         u32 nlbl_type;
3735
3736         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3737         if (unlikely(err))
3738                 return -EACCES;
3739         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3740         if (unlikely(err))
3741                 return -EACCES;
3742
3743         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3744         if (unlikely(err)) {
3745                 printk(KERN_WARNING
3746                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3747                        " unable to determine packet's peer label\n");
3748                 return -EACCES;
3749         }
3750
3751         return 0;
3752 }
3753
3754 /* socket security operations */
3755
3756 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3757                                  u16 secclass, u32 *socksid)
3758 {
3759         if (tsec->sockcreate_sid > SECSID_NULL) {
3760                 *socksid = tsec->sockcreate_sid;
3761                 return 0;
3762         }
3763
3764         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3765                                        socksid);
3766 }
3767
3768 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3769 {
3770         struct sk_security_struct *sksec = sk->sk_security;
3771         struct common_audit_data ad;
3772         struct lsm_network_audit net = {0,};
3773         u32 tsid = task_sid(task);
3774
3775         if (sksec->sid == SECINITSID_KERNEL)
3776                 return 0;
3777
3778         ad.type = LSM_AUDIT_DATA_NET;
3779         ad.u.net = &net;
3780         ad.u.net->sk = sk;
3781
3782         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3783 }
3784
3785 static int selinux_socket_create(int family, int type,
3786                                  int protocol, int kern)
3787 {
3788         const struct task_security_struct *tsec = current_security();
3789         u32 newsid;
3790         u16 secclass;
3791         int rc;
3792
3793         if (kern)
3794                 return 0;
3795
3796         secclass = socket_type_to_security_class(family, type, protocol);
3797         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3798         if (rc)
3799                 return rc;
3800
3801         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3802 }
3803
3804 static int selinux_socket_post_create(struct socket *sock, int family,
3805                                       int type, int protocol, int kern)
3806 {
3807         const struct task_security_struct *tsec = current_security();
3808         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3809         struct sk_security_struct *sksec;
3810         int err = 0;
3811
3812         isec->sclass = socket_type_to_security_class(family, type, protocol);
3813
3814         if (kern)
3815                 isec->sid = SECINITSID_KERNEL;
3816         else {
3817                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3818                 if (err)
3819                         return err;
3820         }
3821
3822         isec->initialized = 1;
3823
3824         if (sock->sk) {
3825                 sksec = sock->sk->sk_security;
3826                 sksec->sid = isec->sid;
3827                 sksec->sclass = isec->sclass;
3828                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3829         }
3830
3831         return err;
3832 }
3833
3834 /* Range of port numbers used to automatically bind.
3835    Need to determine whether we should perform a name_bind
3836    permission check between the socket and the port number. */
3837
3838 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3839 {
3840         struct sock *sk = sock->sk;
3841         u16 family;
3842         int err;
3843
3844         err = sock_has_perm(current, sk, SOCKET__BIND);
3845         if (err)
3846                 goto out;
3847
3848         /*
3849          * If PF_INET or PF_INET6, check name_bind permission for the port.
3850          * Multiple address binding for SCTP is not supported yet: we just
3851          * check the first address now.
3852          */
3853         family = sk->sk_family;
3854         if (family == PF_INET || family == PF_INET6) {
3855                 char *addrp;
3856                 struct sk_security_struct *sksec = sk->sk_security;
3857                 struct common_audit_data ad;
3858                 struct lsm_network_audit net = {0,};
3859                 struct sockaddr_in *addr4 = NULL;
3860                 struct sockaddr_in6 *addr6 = NULL;
3861                 unsigned short snum;
3862                 u32 sid, node_perm;
3863
3864                 if (family == PF_INET) {
3865                         addr4 = (struct sockaddr_in *)address;
3866                         snum = ntohs(addr4->sin_port);
3867                         addrp = (char *)&addr4->sin_addr.s_addr;
3868                 } else {
3869                         addr6 = (struct sockaddr_in6 *)address;
3870                         snum = ntohs(addr6->sin6_port);
3871                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3872                 }
3873
3874                 if (snum) {
3875                         int low, high;
3876
3877                         inet_get_local_port_range(&low, &high);
3878
3879                         if (snum < max(PROT_SOCK, low) || snum > high) {
3880                                 err = sel_netport_sid(sk->sk_protocol,
3881                                                       snum, &sid);
3882                                 if (err)
3883                                         goto out;
3884                                 ad.type = LSM_AUDIT_DATA_NET;
3885                                 ad.u.net = &net;
3886                                 ad.u.net->sport = htons(snum);
3887                                 ad.u.net->family = family;
3888                                 err = avc_has_perm(sksec->sid, sid,
3889                                                    sksec->sclass,
3890                                                    SOCKET__NAME_BIND, &ad);
3891                                 if (err)
3892                                         goto out;
3893                         }
3894                 }
3895
3896                 switch (sksec->sclass) {
3897                 case SECCLASS_TCP_SOCKET:
3898                         node_perm = TCP_SOCKET__NODE_BIND;
3899                         break;
3900
3901                 case SECCLASS_UDP_SOCKET:
3902                         node_perm = UDP_SOCKET__NODE_BIND;
3903                         break;
3904
3905                 case SECCLASS_DCCP_SOCKET:
3906                         node_perm = DCCP_SOCKET__NODE_BIND;
3907                         break;
3908
3909                 default:
3910                         node_perm = RAWIP_SOCKET__NODE_BIND;
3911                         break;
3912                 }
3913
3914                 err = sel_netnode_sid(addrp, family, &sid);
3915                 if (err)
3916                         goto out;
3917
3918                 ad.type = LSM_AUDIT_DATA_NET;
3919                 ad.u.net = &net;
3920                 ad.u.net->sport = htons(snum);
3921                 ad.u.net->family = family;
3922
3923                 if (family == PF_INET)
3924                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3925                 else
3926                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3927
3928                 err = avc_has_perm(sksec->sid, sid,
3929                                    sksec->sclass, node_perm, &ad);
3930                 if (err)
3931                         goto out;
3932         }
3933 out:
3934         return err;
3935 }
3936
3937 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3938 {
3939         struct sock *sk = sock->sk;
3940         struct sk_security_struct *sksec = sk->sk_security;
3941         int err;
3942
3943         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3944         if (err)
3945                 return err;
3946
3947         /*
3948          * If a TCP or DCCP socket, check name_connect permission for the port.
3949          */
3950         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3951             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3952                 struct common_audit_data ad;
3953                 struct lsm_network_audit net = {0,};
3954                 struct sockaddr_in *addr4 = NULL;
3955                 struct sockaddr_in6 *addr6 = NULL;
3956                 unsigned short snum;
3957                 u32 sid, perm;
3958
3959                 if (sk->sk_family == PF_INET) {
3960                         addr4 = (struct sockaddr_in *)address;
3961                         if (addrlen < sizeof(struct sockaddr_in))
3962                                 return -EINVAL;
3963                         snum = ntohs(addr4->sin_port);
3964                 } else {
3965                         addr6 = (struct sockaddr_in6 *)address;
3966                         if (addrlen < SIN6_LEN_RFC2133)
3967                                 return -EINVAL;
3968                         snum = ntohs(addr6->sin6_port);
3969                 }
3970
3971                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3972                 if (err)
3973                         goto out;
3974
3975                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3976                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3977
3978                 ad.type = LSM_AUDIT_DATA_NET;
3979                 ad.u.net = &net;
3980                 ad.u.net->dport = htons(snum);
3981                 ad.u.net->family = sk->sk_family;
3982                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3983                 if (err)
3984                         goto out;
3985         }
3986
3987         err = selinux_netlbl_socket_connect(sk, address);
3988
3989 out:
3990         return err;
3991 }
3992
3993 static int selinux_socket_listen(struct socket *sock, int backlog)
3994 {
3995         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3996 }
3997
3998 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3999 {
4000         int err;
4001         struct inode_security_struct *isec;
4002         struct inode_security_struct *newisec;
4003
4004         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4005         if (err)
4006                 return err;
4007
4008         newisec = SOCK_INODE(newsock)->i_security;
4009
4010         isec = SOCK_INODE(sock)->i_security;
4011         newisec->sclass = isec->sclass;
4012         newisec->sid = isec->sid;
4013         newisec->initialized = 1;
4014
4015         return 0;
4016 }
4017
4018 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4019                                   int size)
4020 {
4021         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4022 }
4023
4024 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4025                                   int size, int flags)
4026 {
4027         return sock_has_perm(current, sock->sk, SOCKET__READ);
4028 }
4029
4030 static int selinux_socket_getsockname(struct socket *sock)
4031 {
4032         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4033 }
4034
4035 static int selinux_socket_getpeername(struct socket *sock)
4036 {
4037         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4038 }
4039
4040 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4041 {
4042         int err;
4043
4044         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4045         if (err)
4046                 return err;
4047
4048         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4049 }
4050
4051 static int selinux_socket_getsockopt(struct socket *sock, int level,
4052                                      int optname)
4053 {
4054         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4055 }
4056
4057 static int selinux_socket_shutdown(struct socket *sock, int how)
4058 {
4059         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4060 }
4061
4062 static int selinux_socket_unix_stream_connect(struct sock *sock,
4063                                               struct sock *other,
4064                                               struct sock *newsk)
4065 {
4066         struct sk_security_struct *sksec_sock = sock->sk_security;
4067         struct sk_security_struct *sksec_other = other->sk_security;
4068         struct sk_security_struct *sksec_new = newsk->sk_security;
4069         struct common_audit_data ad;
4070         struct lsm_network_audit net = {0,};
4071         int err;
4072
4073         ad.type = LSM_AUDIT_DATA_NET;
4074         ad.u.net = &net;
4075         ad.u.net->sk = other;
4076
4077         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4078                            sksec_other->sclass,
4079                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4080         if (err)
4081                 return err;
4082
4083         /* server child socket */
4084         sksec_new->peer_sid = sksec_sock->sid;
4085         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4086                                     &sksec_new->sid);
4087         if (err)
4088                 return err;
4089
4090         /* connecting socket */
4091         sksec_sock->peer_sid = sksec_new->sid;
4092
4093         return 0;
4094 }
4095
4096 static int selinux_socket_unix_may_send(struct socket *sock,
4097                                         struct socket *other)
4098 {
4099         struct sk_security_struct *ssec = sock->sk->sk_security;
4100         struct sk_security_struct *osec = other->sk->sk_security;
4101         struct common_audit_data ad;
4102         struct lsm_network_audit net = {0,};
4103
4104         ad.type = LSM_AUDIT_DATA_NET;
4105         ad.u.net = &net;
4106         ad.u.net->sk = other->sk;
4107
4108         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4109                             &ad);
4110 }
4111
4112 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4113                                     u32 peer_sid,
4114                                     struct common_audit_data *ad)
4115 {
4116         int err;
4117         u32 if_sid;
4118         u32 node_sid;
4119
4120         err = sel_netif_sid(ifindex, &if_sid);
4121         if (err)
4122                 return err;
4123         err = avc_has_perm(peer_sid, if_sid,
4124                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4125         if (err)
4126                 return err;
4127
4128         err = sel_netnode_sid(addrp, family, &node_sid);
4129         if (err)
4130                 return err;
4131         return avc_has_perm(peer_sid, node_sid,
4132                             SECCLASS_NODE, NODE__RECVFROM, ad);
4133 }
4134
4135 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4136                                        u16 family)
4137 {
4138         int err = 0;
4139         struct sk_security_struct *sksec = sk->sk_security;
4140         u32 sk_sid = sksec->sid;
4141         struct common_audit_data ad;
4142         struct lsm_network_audit net = {0,};
4143         char *addrp;
4144
4145         ad.type = LSM_AUDIT_DATA_NET;
4146         ad.u.net = &net;
4147         ad.u.net->netif = skb->skb_iif;
4148         ad.u.net->family = family;
4149         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4150         if (err)
4151                 return err;
4152
4153         if (selinux_secmark_enabled()) {
4154                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4155                                    PACKET__RECV, &ad);
4156                 if (err)
4157                         return err;
4158         }
4159
4160         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4161         if (err)
4162                 return err;
4163         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4164
4165         return err;
4166 }
4167
4168 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4169 {
4170         int err;
4171         struct sk_security_struct *sksec = sk->sk_security;
4172         u16 family = sk->sk_family;
4173         u32 sk_sid = sksec->sid;
4174         struct common_audit_data ad;
4175         struct lsm_network_audit net = {0,};
4176         char *addrp;
4177         u8 secmark_active;
4178         u8 peerlbl_active;
4179
4180         if (family != PF_INET && family != PF_INET6)
4181                 return 0;
4182
4183         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4184         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4185                 family = PF_INET;
4186
4187         /* If any sort of compatibility mode is enabled then handoff processing
4188          * to the selinux_sock_rcv_skb_compat() function to deal with the
4189          * special handling.  We do this in an attempt to keep this function
4190          * as fast and as clean as possible. */
4191         if (!selinux_policycap_netpeer)
4192                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4193
4194         secmark_active = selinux_secmark_enabled();
4195         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4196         if (!secmark_active && !peerlbl_active)
4197                 return 0;
4198
4199         ad.type = LSM_AUDIT_DATA_NET;
4200         ad.u.net = &net;
4201         ad.u.net->netif = skb->skb_iif;
4202         ad.u.net->family = family;
4203         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4204         if (err)
4205                 return err;
4206
4207         if (peerlbl_active) {
4208                 u32 peer_sid;
4209
4210                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4211                 if (err)
4212                         return err;
4213                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4214                                                peer_sid, &ad);
4215                 if (err) {
4216                         selinux_netlbl_err(skb, err, 0);
4217                         return err;
4218                 }
4219                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4220                                    PEER__RECV, &ad);
4221                 if (err)
4222                         selinux_netlbl_err(skb, err, 0);
4223         }
4224
4225         if (secmark_active) {
4226                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4227                                    PACKET__RECV, &ad);
4228                 if (err)
4229                         return err;
4230         }
4231
4232         return err;
4233 }
4234
4235 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4236                                             int __user *optlen, unsigned len)
4237 {
4238         int err = 0;
4239         char *scontext;
4240         u32 scontext_len;
4241         struct sk_security_struct *sksec = sock->sk->sk_security;
4242         u32 peer_sid = SECSID_NULL;
4243
4244         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4245             sksec->sclass == SECCLASS_TCP_SOCKET)
4246                 peer_sid = sksec->peer_sid;
4247         if (peer_sid == SECSID_NULL)
4248                 return -ENOPROTOOPT;
4249
4250         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4251         if (err)
4252                 return err;
4253
4254         if (scontext_len > len) {
4255                 err = -ERANGE;
4256                 goto out_len;
4257         }
4258
4259         if (copy_to_user(optval, scontext, scontext_len))
4260                 err = -EFAULT;
4261
4262 out_len:
4263         if (put_user(scontext_len, optlen))
4264                 err = -EFAULT;
4265         kfree(scontext);
4266         return err;
4267 }
4268
4269 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4270 {
4271         u32 peer_secid = SECSID_NULL;
4272         u16 family;
4273
4274         if (skb && skb->protocol == htons(ETH_P_IP))
4275                 family = PF_INET;
4276         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4277                 family = PF_INET6;
4278         else if (sock)
4279                 family = sock->sk->sk_family;
4280         else
4281                 goto out;
4282
4283         if (sock && family == PF_UNIX)
4284                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4285         else if (skb)
4286                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4287
4288 out:
4289         *secid = peer_secid;
4290         if (peer_secid == SECSID_NULL)
4291                 return -EINVAL;
4292         return 0;
4293 }
4294
4295 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4296 {
4297         struct sk_security_struct *sksec;
4298
4299         sksec = kzalloc(sizeof(*sksec), priority);
4300         if (!sksec)
4301                 return -ENOMEM;
4302
4303         sksec->peer_sid = SECINITSID_UNLABELED;
4304         sksec->sid = SECINITSID_UNLABELED;
4305         selinux_netlbl_sk_security_reset(sksec);
4306         sk->sk_security = sksec;
4307
4308         return 0;
4309 }
4310
4311 static void selinux_sk_free_security(struct sock *sk)
4312 {
4313         struct sk_security_struct *sksec = sk->sk_security;
4314
4315         sk->sk_security = NULL;
4316         selinux_netlbl_sk_security_free(sksec);
4317         kfree(sksec);
4318 }
4319
4320 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4321 {
4322         struct sk_security_struct *sksec = sk->sk_security;
4323         struct sk_security_struct *newsksec = newsk->sk_security;
4324
4325         newsksec->sid = sksec->sid;
4326         newsksec->peer_sid = sksec->peer_sid;
4327         newsksec->sclass = sksec->sclass;
4328
4329         selinux_netlbl_sk_security_reset(newsksec);
4330 }
4331
4332 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4333 {
4334         if (!sk)
4335                 *secid = SECINITSID_ANY_SOCKET;
4336         else {
4337                 struct sk_security_struct *sksec = sk->sk_security;
4338
4339                 *secid = sksec->sid;
4340         }
4341 }
4342
4343 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4344 {
4345         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4346         struct sk_security_struct *sksec = sk->sk_security;
4347
4348         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4349             sk->sk_family == PF_UNIX)
4350                 isec->sid = sksec->sid;
4351         sksec->sclass = isec->sclass;
4352 }
4353
4354 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4355                                      struct request_sock *req)
4356 {
4357         struct sk_security_struct *sksec = sk->sk_security;
4358         int err;
4359         u16 family = sk->sk_family;
4360         u32 newsid;
4361         u32 peersid;
4362
4363         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4364         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4365                 family = PF_INET;
4366
4367         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4368         if (err)
4369                 return err;
4370         if (peersid == SECSID_NULL) {
4371                 req->secid = sksec->sid;
4372                 req->peer_secid = SECSID_NULL;
4373         } else {
4374                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4375                 if (err)
4376                         return err;
4377                 req->secid = newsid;
4378                 req->peer_secid = peersid;
4379         }
4380
4381         return selinux_netlbl_inet_conn_request(req, family);
4382 }
4383
4384 static void selinux_inet_csk_clone(struct sock *newsk,
4385                                    const struct request_sock *req)
4386 {
4387         struct sk_security_struct *newsksec = newsk->sk_security;
4388
4389         newsksec->sid = req->secid;
4390         newsksec->peer_sid = req->peer_secid;
4391         /* NOTE: Ideally, we should also get the isec->sid for the
4392            new socket in sync, but we don't have the isec available yet.
4393            So we will wait until sock_graft to do it, by which
4394            time it will have been created and available. */
4395
4396         /* We don't need to take any sort of lock here as we are the only
4397          * thread with access to newsksec */
4398         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4399 }
4400
4401 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4402 {
4403         u16 family = sk->sk_family;
4404         struct sk_security_struct *sksec = sk->sk_security;
4405
4406         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4407         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4408                 family = PF_INET;
4409
4410         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4411 }
4412
4413 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4414 {
4415         skb_set_owner_w(skb, sk);
4416 }
4417
4418 static int selinux_secmark_relabel_packet(u32 sid)
4419 {
4420         const struct task_security_struct *__tsec;
4421         u32 tsid;
4422
4423         __tsec = current_security();
4424         tsid = __tsec->sid;
4425
4426         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4427 }
4428
4429 static void selinux_secmark_refcount_inc(void)
4430 {
4431         atomic_inc(&selinux_secmark_refcount);
4432 }
4433
4434 static void selinux_secmark_refcount_dec(void)
4435 {
4436         atomic_dec(&selinux_secmark_refcount);
4437 }
4438
4439 static void selinux_req_classify_flow(const struct request_sock *req,
4440                                       struct flowi *fl)
4441 {
4442         fl->flowi_secid = req->secid;
4443 }
4444
4445 static int selinux_tun_dev_alloc_security(void **security)
4446 {
4447         struct tun_security_struct *tunsec;
4448
4449         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4450         if (!tunsec)
4451                 return -ENOMEM;
4452         tunsec->sid = current_sid();
4453
4454         *security = tunsec;
4455         return 0;
4456 }
4457
4458 static void selinux_tun_dev_free_security(void *security)
4459 {
4460         kfree(security);
4461 }
4462
4463 static int selinux_tun_dev_create(void)
4464 {
4465         u32 sid = current_sid();
4466
4467         /* we aren't taking into account the "sockcreate" SID since the socket
4468          * that is being created here is not a socket in the traditional sense,
4469          * instead it is a private sock, accessible only to the kernel, and
4470          * representing a wide range of network traffic spanning multiple
4471          * connections unlike traditional sockets - check the TUN driver to
4472          * get a better understanding of why this socket is special */
4473
4474         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4475                             NULL);
4476 }
4477
4478 static int selinux_tun_dev_attach_queue(void *security)
4479 {
4480         struct tun_security_struct *tunsec = security;
4481
4482         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4483                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4484 }
4485
4486 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4487 {
4488         struct tun_security_struct *tunsec = security;
4489         struct sk_security_struct *sksec = sk->sk_security;
4490
4491         /* we don't currently perform any NetLabel based labeling here and it
4492          * isn't clear that we would want to do so anyway; while we could apply
4493          * labeling without the support of the TUN user the resulting labeled
4494          * traffic from the other end of the connection would almost certainly
4495          * cause confusion to the TUN user that had no idea network labeling
4496          * protocols were being used */
4497
4498         sksec->sid = tunsec->sid;
4499         sksec->sclass = SECCLASS_TUN_SOCKET;
4500
4501         return 0;
4502 }
4503
4504 static int selinux_tun_dev_open(void *security)
4505 {
4506         struct tun_security_struct *tunsec = security;
4507         u32 sid = current_sid();
4508         int err;
4509
4510         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4511                            TUN_SOCKET__RELABELFROM, NULL);
4512         if (err)
4513                 return err;
4514         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4515                            TUN_SOCKET__RELABELTO, NULL);
4516         if (err)
4517                 return err;
4518         tunsec->sid = sid;
4519
4520         return 0;
4521 }
4522
4523 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4524 {
4525         int err = 0;
4526         u32 perm;
4527         struct nlmsghdr *nlh;
4528         struct sk_security_struct *sksec = sk->sk_security;
4529
4530         if (skb->len < NLMSG_HDRLEN) {
4531                 err = -EINVAL;
4532                 goto out;
4533         }
4534         nlh = nlmsg_hdr(skb);
4535
4536         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4537         if (err) {
4538                 if (err == -EINVAL) {
4539                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4540                                   "SELinux:  unrecognized netlink message"
4541                                   " type=%hu for sclass=%hu\n",
4542                                   nlh->nlmsg_type, sksec->sclass);
4543                         if (!selinux_enforcing || security_get_allow_unknown())
4544                                 err = 0;
4545                 }
4546
4547                 /* Ignore */
4548                 if (err == -ENOENT)
4549                         err = 0;
4550                 goto out;
4551         }
4552
4553         err = sock_has_perm(current, sk, perm);
4554 out:
4555         return err;
4556 }
4557
4558 #ifdef CONFIG_NETFILTER
4559
4560 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4561                                        u16 family)
4562 {
4563         int err;
4564         char *addrp;
4565         u32 peer_sid;
4566         struct common_audit_data ad;
4567         struct lsm_network_audit net = {0,};
4568         u8 secmark_active;
4569         u8 netlbl_active;
4570         u8 peerlbl_active;
4571
4572         if (!selinux_policycap_netpeer)
4573                 return NF_ACCEPT;
4574
4575         secmark_active = selinux_secmark_enabled();
4576         netlbl_active = netlbl_enabled();
4577         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4578         if (!secmark_active && !peerlbl_active)
4579                 return NF_ACCEPT;
4580
4581         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4582                 return NF_DROP;
4583
4584         ad.type = LSM_AUDIT_DATA_NET;
4585         ad.u.net = &net;
4586         ad.u.net->netif = ifindex;
4587         ad.u.net->family = family;
4588         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4589                 return NF_DROP;
4590
4591         if (peerlbl_active) {
4592                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4593                                                peer_sid, &ad);
4594                 if (err) {
4595                         selinux_netlbl_err(skb, err, 1);
4596                         return NF_DROP;
4597                 }
4598         }
4599
4600         if (secmark_active)
4601                 if (avc_has_perm(peer_sid, skb->secmark,
4602                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4603                         return NF_DROP;
4604
4605         if (netlbl_active)
4606                 /* we do this in the FORWARD path and not the POST_ROUTING
4607                  * path because we want to make sure we apply the necessary
4608                  * labeling before IPsec is applied so we can leverage AH
4609                  * protection */
4610                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4611                         return NF_DROP;
4612
4613         return NF_ACCEPT;
4614 }
4615
4616 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4617                                          struct sk_buff *skb,
4618                                          const struct net_device *in,
4619                                          const struct net_device *out,
4620                                          int (*okfn)(struct sk_buff *))
4621 {
4622         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4623 }
4624
4625 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4626 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4627                                          struct sk_buff *skb,
4628                                          const struct net_device *in,
4629                                          const struct net_device *out,
4630                                          int (*okfn)(struct sk_buff *))
4631 {
4632         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4633 }
4634 #endif  /* IPV6 */
4635
4636 static unsigned int selinux_ip_output(struct sk_buff *skb,
4637                                       u16 family)
4638 {
4639         u32 sid;
4640
4641         if (!netlbl_enabled())
4642                 return NF_ACCEPT;
4643
4644         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4645          * because we want to make sure we apply the necessary labeling
4646          * before IPsec is applied so we can leverage AH protection */
4647         if (skb->sk) {
4648                 struct sk_security_struct *sksec = skb->sk->sk_security;
4649                 sid = sksec->sid;
4650         } else
4651                 sid = SECINITSID_KERNEL;
4652         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4653                 return NF_DROP;
4654
4655         return NF_ACCEPT;
4656 }
4657
4658 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4659                                         struct sk_buff *skb,
4660                                         const struct net_device *in,
4661                                         const struct net_device *out,
4662                                         int (*okfn)(struct sk_buff *))
4663 {
4664         return selinux_ip_output(skb, PF_INET);
4665 }
4666
4667 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4668                                                 int ifindex,
4669                                                 u16 family)
4670 {
4671         struct sock *sk = skb->sk;
4672         struct sk_security_struct *sksec;
4673         struct common_audit_data ad;
4674         struct lsm_network_audit net = {0,};
4675         char *addrp;
4676         u8 proto;
4677
4678         if (sk == NULL)
4679                 return NF_ACCEPT;
4680         sksec = sk->sk_security;
4681
4682         ad.type = LSM_AUDIT_DATA_NET;
4683         ad.u.net = &net;
4684         ad.u.net->netif = ifindex;
4685         ad.u.net->family = family;
4686         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4687                 return NF_DROP;
4688
4689         if (selinux_secmark_enabled())
4690                 if (avc_has_perm(sksec->sid, skb->secmark,
4691                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4692                         return NF_DROP_ERR(-ECONNREFUSED);
4693
4694         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4695                 return NF_DROP_ERR(-ECONNREFUSED);
4696
4697         return NF_ACCEPT;
4698 }
4699
4700 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4701                                          u16 family)
4702 {
4703         u32 secmark_perm;
4704         u32 peer_sid;
4705         struct sock *sk;
4706         struct common_audit_data ad;
4707         struct lsm_network_audit net = {0,};
4708         char *addrp;
4709         u8 secmark_active;
4710         u8 peerlbl_active;
4711
4712         /* If any sort of compatibility mode is enabled then handoff processing
4713          * to the selinux_ip_postroute_compat() function to deal with the
4714          * special handling.  We do this in an attempt to keep this function
4715          * as fast and as clean as possible. */
4716         if (!selinux_policycap_netpeer)
4717                 return selinux_ip_postroute_compat(skb, ifindex, family);
4718 #ifdef CONFIG_XFRM
4719         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4720          * packet transformation so allow the packet to pass without any checks
4721          * since we'll have another chance to perform access control checks
4722          * when the packet is on it's final way out.
4723          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4724          *       is NULL, in this case go ahead and apply access control. */
4725         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4726                 return NF_ACCEPT;
4727 #endif
4728         secmark_active = selinux_secmark_enabled();
4729         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4730         if (!secmark_active && !peerlbl_active)
4731                 return NF_ACCEPT;
4732
4733         /* if the packet is being forwarded then get the peer label from the
4734          * packet itself; otherwise check to see if it is from a local
4735          * application or the kernel, if from an application get the peer label
4736          * from the sending socket, otherwise use the kernel's sid */
4737         sk = skb->sk;
4738         if (sk == NULL) {
4739                 if (skb->skb_iif) {
4740                         secmark_perm = PACKET__FORWARD_OUT;
4741                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4742                                 return NF_DROP;
4743                 } else {
4744                         secmark_perm = PACKET__SEND;
4745                         peer_sid = SECINITSID_KERNEL;
4746                 }
4747         } else {
4748                 struct sk_security_struct *sksec = sk->sk_security;
4749                 peer_sid = sksec->sid;
4750                 secmark_perm = PACKET__SEND;
4751         }
4752
4753         ad.type = LSM_AUDIT_DATA_NET;
4754         ad.u.net = &net;
4755         ad.u.net->netif = ifindex;
4756         ad.u.net->family = family;
4757         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4758                 return NF_DROP;
4759
4760         if (secmark_active)
4761                 if (avc_has_perm(peer_sid, skb->secmark,
4762                                  SECCLASS_PACKET, secmark_perm, &ad))
4763                         return NF_DROP_ERR(-ECONNREFUSED);
4764
4765         if (peerlbl_active) {
4766                 u32 if_sid;
4767                 u32 node_sid;
4768
4769                 if (sel_netif_sid(ifindex, &if_sid))
4770                         return NF_DROP;
4771                 if (avc_has_perm(peer_sid, if_sid,
4772                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4773                         return NF_DROP_ERR(-ECONNREFUSED);
4774
4775                 if (sel_netnode_sid(addrp, family, &node_sid))
4776                         return NF_DROP;
4777                 if (avc_has_perm(peer_sid, node_sid,
4778                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4779                         return NF_DROP_ERR(-ECONNREFUSED);
4780         }
4781
4782         return NF_ACCEPT;
4783 }
4784
4785 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4786                                            struct sk_buff *skb,
4787                                            const struct net_device *in,
4788                                            const struct net_device *out,
4789                                            int (*okfn)(struct sk_buff *))
4790 {
4791         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4792 }
4793
4794 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4795 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4796                                            struct sk_buff *skb,
4797                                            const struct net_device *in,
4798                                            const struct net_device *out,
4799                                            int (*okfn)(struct sk_buff *))
4800 {
4801         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4802 }
4803 #endif  /* IPV6 */
4804
4805 #endif  /* CONFIG_NETFILTER */
4806
4807 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4808 {
4809         int err;
4810
4811         err = cap_netlink_send(sk, skb);
4812         if (err)
4813                 return err;
4814
4815         return selinux_nlmsg_perm(sk, skb);
4816 }
4817
4818 static int ipc_alloc_security(struct task_struct *task,
4819                               struct kern_ipc_perm *perm,
4820                               u16 sclass)
4821 {
4822         struct ipc_security_struct *isec;
4823         u32 sid;
4824
4825         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4826         if (!isec)
4827                 return -ENOMEM;
4828
4829         sid = task_sid(task);
4830         isec->sclass = sclass;
4831         isec->sid = sid;
4832         perm->security = isec;
4833
4834         return 0;
4835 }
4836
4837 static void ipc_free_security(struct kern_ipc_perm *perm)
4838 {
4839         struct ipc_security_struct *isec = perm->security;
4840         perm->security = NULL;
4841         kfree(isec);
4842 }
4843
4844 static int msg_msg_alloc_security(struct msg_msg *msg)
4845 {
4846         struct msg_security_struct *msec;
4847
4848         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4849         if (!msec)
4850                 return -ENOMEM;
4851
4852         msec->sid = SECINITSID_UNLABELED;
4853         msg->security = msec;
4854
4855         return 0;
4856 }
4857
4858 static void msg_msg_free_security(struct msg_msg *msg)
4859 {
4860         struct msg_security_struct *msec = msg->security;
4861
4862         msg->security = NULL;
4863         kfree(msec);
4864 }
4865
4866 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4867                         u32 perms)
4868 {
4869         struct ipc_security_struct *isec;
4870         struct common_audit_data ad;
4871         u32 sid = current_sid();
4872
4873         isec = ipc_perms->security;
4874
4875         ad.type = LSM_AUDIT_DATA_IPC;
4876         ad.u.ipc_id = ipc_perms->key;
4877
4878         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4879 }
4880
4881 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4882 {
4883         return msg_msg_alloc_security(msg);
4884 }
4885
4886 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4887 {
4888         msg_msg_free_security(msg);
4889 }
4890
4891 /* message queue security operations */
4892 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4893 {
4894         struct ipc_security_struct *isec;
4895         struct common_audit_data ad;
4896         u32 sid = current_sid();
4897         int rc;
4898
4899         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4900         if (rc)
4901                 return rc;
4902
4903         isec = msq->q_perm.security;
4904
4905         ad.type = LSM_AUDIT_DATA_IPC;
4906         ad.u.ipc_id = msq->q_perm.key;
4907
4908         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4909                           MSGQ__CREATE, &ad);
4910         if (rc) {
4911                 ipc_free_security(&msq->q_perm);
4912                 return rc;
4913         }
4914         return 0;
4915 }
4916
4917 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4918 {
4919         ipc_free_security(&msq->q_perm);
4920 }
4921
4922 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4923 {
4924         struct ipc_security_struct *isec;
4925         struct common_audit_data ad;
4926         u32 sid = current_sid();
4927
4928         isec = msq->q_perm.security;
4929
4930         ad.type = LSM_AUDIT_DATA_IPC;
4931         ad.u.ipc_id = msq->q_perm.key;
4932
4933         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4934                             MSGQ__ASSOCIATE, &ad);
4935 }
4936
4937 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4938 {
4939         int err;
4940         int perms;
4941
4942         switch (cmd) {
4943         case IPC_INFO:
4944         case MSG_INFO:
4945                 /* No specific object, just general system-wide information. */
4946                 return task_has_system(current, SYSTEM__IPC_INFO);
4947         case IPC_STAT:
4948         case MSG_STAT:
4949                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4950                 break;
4951         case IPC_SET:
4952                 perms = MSGQ__SETATTR;
4953                 break;
4954         case IPC_RMID:
4955                 perms = MSGQ__DESTROY;
4956                 break;
4957         default:
4958                 return 0;
4959         }
4960
4961         err = ipc_has_perm(&msq->q_perm, perms);
4962         return err;
4963 }
4964
4965 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4966 {
4967         struct ipc_security_struct *isec;
4968         struct msg_security_struct *msec;
4969         struct common_audit_data ad;
4970         u32 sid = current_sid();
4971         int rc;
4972
4973         isec = msq->q_perm.security;
4974         msec = msg->security;
4975
4976         /*
4977          * First time through, need to assign label to the message
4978          */
4979         if (msec->sid == SECINITSID_UNLABELED) {
4980                 /*
4981                  * Compute new sid based on current process and
4982                  * message queue this message will be stored in
4983                  */
4984                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4985                                              NULL, &msec->sid);
4986                 if (rc)
4987                         return rc;
4988         }
4989
4990         ad.type = LSM_AUDIT_DATA_IPC;
4991         ad.u.ipc_id = msq->q_perm.key;
4992
4993         /* Can this process write to the queue? */
4994         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4995                           MSGQ__WRITE, &ad);
4996         if (!rc)
4997                 /* Can this process send the message */
4998                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4999                                   MSG__SEND, &ad);
5000         if (!rc)
5001                 /* Can the message be put in the queue? */
5002                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5003                                   MSGQ__ENQUEUE, &ad);
5004
5005         return rc;
5006 }
5007
5008 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5009                                     struct task_struct *target,
5010                                     long type, int mode)
5011 {
5012         struct ipc_security_struct *isec;
5013         struct msg_security_struct *msec;
5014         struct common_audit_data ad;
5015         u32 sid = task_sid(target);
5016         int rc;
5017
5018         isec = msq->q_perm.security;
5019         msec = msg->security;
5020
5021         ad.type = LSM_AUDIT_DATA_IPC;
5022         ad.u.ipc_id = msq->q_perm.key;
5023
5024         rc = avc_has_perm(sid, isec->sid,
5025                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5026         if (!rc)
5027                 rc = avc_has_perm(sid, msec->sid,
5028                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5029         return rc;
5030 }
5031
5032 /* Shared Memory security operations */
5033 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5034 {
5035         struct ipc_security_struct *isec;
5036         struct common_audit_data ad;
5037         u32 sid = current_sid();
5038         int rc;
5039
5040         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5041         if (rc)
5042                 return rc;
5043
5044         isec = shp->shm_perm.security;
5045
5046         ad.type = LSM_AUDIT_DATA_IPC;
5047         ad.u.ipc_id = shp->shm_perm.key;
5048
5049         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5050                           SHM__CREATE, &ad);
5051         if (rc) {
5052                 ipc_free_security(&shp->shm_perm);
5053                 return rc;
5054         }
5055         return 0;
5056 }
5057
5058 static void selinux_shm_free_security(struct shmid_kernel *shp)
5059 {
5060         ipc_free_security(&shp->shm_perm);
5061 }
5062
5063 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5064 {
5065         struct ipc_security_struct *isec;
5066         struct common_audit_data ad;
5067         u32 sid = current_sid();
5068
5069         isec = shp->shm_perm.security;
5070
5071         ad.type = LSM_AUDIT_DATA_IPC;
5072         ad.u.ipc_id = shp->shm_perm.key;
5073
5074         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5075                             SHM__ASSOCIATE, &ad);
5076 }
5077
5078 /* Note, at this point, shp is locked down */
5079 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5080 {
5081         int perms;
5082         int err;
5083
5084         switch (cmd) {
5085         case IPC_INFO:
5086         case SHM_INFO:
5087                 /* No specific object, just general system-wide information. */
5088                 return task_has_system(current, SYSTEM__IPC_INFO);
5089         case IPC_STAT:
5090         case SHM_STAT:
5091                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5092                 break;
5093         case IPC_SET:
5094                 perms = SHM__SETATTR;
5095                 break;
5096         case SHM_LOCK:
5097         case SHM_UNLOCK:
5098                 perms = SHM__LOCK;
5099                 break;
5100         case IPC_RMID:
5101                 perms = SHM__DESTROY;
5102                 break;
5103         default:
5104                 return 0;
5105         }
5106
5107         err = ipc_has_perm(&shp->shm_perm, perms);
5108         return err;
5109 }
5110
5111 static int selinux_shm_shmat(struct shmid_kernel *shp,
5112                              char __user *shmaddr, int shmflg)
5113 {
5114         u32 perms;
5115
5116         if (shmflg & SHM_RDONLY)
5117                 perms = SHM__READ;
5118         else
5119                 perms = SHM__READ | SHM__WRITE;
5120
5121         return ipc_has_perm(&shp->shm_perm, perms);
5122 }
5123
5124 /* Semaphore security operations */
5125 static int selinux_sem_alloc_security(struct sem_array *sma)
5126 {
5127         struct ipc_security_struct *isec;
5128         struct common_audit_data ad;
5129         u32 sid = current_sid();
5130         int rc;
5131
5132         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5133         if (rc)
5134                 return rc;
5135
5136         isec = sma->sem_perm.security;
5137
5138         ad.type = LSM_AUDIT_DATA_IPC;
5139         ad.u.ipc_id = sma->sem_perm.key;
5140
5141         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5142                           SEM__CREATE, &ad);
5143         if (rc) {
5144                 ipc_free_security(&sma->sem_perm);
5145                 return rc;
5146         }
5147         return 0;
5148 }
5149
5150 static void selinux_sem_free_security(struct sem_array *sma)
5151 {
5152         ipc_free_security(&sma->sem_perm);
5153 }
5154
5155 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5156 {
5157         struct ipc_security_struct *isec;
5158         struct common_audit_data ad;
5159         u32 sid = current_sid();
5160
5161         isec = sma->sem_perm.security;
5162
5163         ad.type = LSM_AUDIT_DATA_IPC;
5164         ad.u.ipc_id = sma->sem_perm.key;
5165
5166         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5167                             SEM__ASSOCIATE, &ad);
5168 }
5169
5170 /* Note, at this point, sma is locked down */
5171 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5172 {
5173         int err;
5174         u32 perms;
5175
5176         switch (cmd) {
5177         case IPC_INFO:
5178         case SEM_INFO:
5179                 /* No specific object, just general system-wide information. */
5180                 return task_has_system(current, SYSTEM__IPC_INFO);
5181         case GETPID:
5182         case GETNCNT:
5183         case GETZCNT:
5184                 perms = SEM__GETATTR;
5185                 break;
5186         case GETVAL:
5187         case GETALL:
5188                 perms = SEM__READ;
5189                 break;
5190         case SETVAL:
5191         case SETALL:
5192                 perms = SEM__WRITE;
5193                 break;
5194         case IPC_RMID:
5195                 perms = SEM__DESTROY;
5196                 break;
5197         case IPC_SET:
5198                 perms = SEM__SETATTR;
5199                 break;
5200         case IPC_STAT:
5201         case SEM_STAT:
5202                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5203                 break;
5204         default:
5205                 return 0;
5206         }
5207
5208         err = ipc_has_perm(&sma->sem_perm, perms);
5209         return err;
5210 }
5211
5212 static int selinux_sem_semop(struct sem_array *sma,
5213                              struct sembuf *sops, unsigned nsops, int alter)
5214 {
5215         u32 perms;
5216
5217         if (alter)
5218                 perms = SEM__READ | SEM__WRITE;
5219         else
5220                 perms = SEM__READ;
5221
5222         return ipc_has_perm(&sma->sem_perm, perms);
5223 }
5224
5225 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5226 {
5227         u32 av = 0;
5228
5229         av = 0;
5230         if (flag & S_IRUGO)
5231                 av |= IPC__UNIX_READ;
5232         if (flag & S_IWUGO)
5233                 av |= IPC__UNIX_WRITE;
5234
5235         if (av == 0)
5236                 return 0;
5237
5238         return ipc_has_perm(ipcp, av);
5239 }
5240
5241 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5242 {
5243         struct ipc_security_struct *isec = ipcp->security;
5244         *secid = isec->sid;
5245 }
5246
5247 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5248 {
5249         if (inode)
5250                 inode_doinit_with_dentry(inode, dentry);
5251 }
5252
5253 static int selinux_getprocattr(struct task_struct *p,
5254                                char *name, char **value)
5255 {
5256         const struct task_security_struct *__tsec;
5257         u32 sid;
5258         int error;
5259         unsigned len;
5260
5261         if (current != p) {
5262                 error = current_has_perm(p, PROCESS__GETATTR);
5263                 if (error)
5264                         return error;
5265         }
5266
5267         rcu_read_lock();
5268         __tsec = __task_cred(p)->security;
5269
5270         if (!strcmp(name, "current"))
5271                 sid = __tsec->sid;
5272         else if (!strcmp(name, "prev"))
5273                 sid = __tsec->osid;
5274         else if (!strcmp(name, "exec"))
5275                 sid = __tsec->exec_sid;
5276         else if (!strcmp(name, "fscreate"))
5277                 sid = __tsec->create_sid;
5278         else if (!strcmp(name, "keycreate"))
5279                 sid = __tsec->keycreate_sid;
5280         else if (!strcmp(name, "sockcreate"))
5281                 sid = __tsec->sockcreate_sid;
5282         else
5283                 goto invalid;
5284         rcu_read_unlock();
5285
5286         if (!sid)
5287                 return 0;
5288
5289         error = security_sid_to_context(sid, value, &len);
5290         if (error)
5291                 return error;
5292         return len;
5293
5294 invalid:
5295         rcu_read_unlock();
5296         return -EINVAL;
5297 }
5298
5299 static int selinux_setprocattr(struct task_struct *p,
5300                                char *name, void *value, size_t size)
5301 {
5302         struct task_security_struct *tsec;
5303         struct task_struct *tracer;
5304         struct cred *new;
5305         u32 sid = 0, ptsid;
5306         int error;
5307         char *str = value;
5308
5309         if (current != p) {
5310                 /* SELinux only allows a process to change its own
5311                    security attributes. */
5312                 return -EACCES;
5313         }
5314
5315         /*
5316          * Basic control over ability to set these attributes at all.
5317          * current == p, but we'll pass them separately in case the
5318          * above restriction is ever removed.
5319          */
5320         if (!strcmp(name, "exec"))
5321                 error = current_has_perm(p, PROCESS__SETEXEC);
5322         else if (!strcmp(name, "fscreate"))
5323                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5324         else if (!strcmp(name, "keycreate"))
5325                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5326         else if (!strcmp(name, "sockcreate"))
5327                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5328         else if (!strcmp(name, "current"))
5329                 error = current_has_perm(p, PROCESS__SETCURRENT);
5330         else
5331                 error = -EINVAL;
5332         if (error)
5333                 return error;
5334
5335         /* Obtain a SID for the context, if one was specified. */
5336         if (size && str[1] && str[1] != '\n') {
5337                 if (str[size-1] == '\n') {
5338                         str[size-1] = 0;
5339                         size--;
5340                 }
5341                 error = security_context_to_sid(value, size, &sid);
5342                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5343                         if (!capable(CAP_MAC_ADMIN)) {
5344                                 struct audit_buffer *ab;
5345                                 size_t audit_size;
5346
5347                                 /* We strip a nul only if it is at the end, otherwise the
5348                                  * context contains a nul and we should audit that */
5349                                 if (str[size - 1] == '\0')
5350                                         audit_size = size - 1;
5351                                 else
5352                                         audit_size = size;
5353                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5354                                 audit_log_format(ab, "op=fscreate invalid_context=");
5355                                 audit_log_n_untrustedstring(ab, value, audit_size);
5356                                 audit_log_end(ab);
5357
5358                                 return error;
5359                         }
5360                         error = security_context_to_sid_force(value, size,
5361                                                               &sid);
5362                 }
5363                 if (error)
5364                         return error;
5365         }
5366
5367         new = prepare_creds();
5368         if (!new)
5369                 return -ENOMEM;
5370
5371         /* Permission checking based on the specified context is
5372            performed during the actual operation (execve,
5373            open/mkdir/...), when we know the full context of the
5374            operation.  See selinux_bprm_set_creds for the execve
5375            checks and may_create for the file creation checks. The
5376            operation will then fail if the context is not permitted. */
5377         tsec = new->security;
5378         if (!strcmp(name, "exec")) {
5379                 tsec->exec_sid = sid;
5380         } else if (!strcmp(name, "fscreate")) {
5381                 tsec->create_sid = sid;
5382         } else if (!strcmp(name, "keycreate")) {
5383                 error = may_create_key(sid, p);
5384                 if (error)
5385                         goto abort_change;
5386                 tsec->keycreate_sid = sid;
5387         } else if (!strcmp(name, "sockcreate")) {
5388                 tsec->sockcreate_sid = sid;
5389         } else if (!strcmp(name, "current")) {
5390                 error = -EINVAL;
5391                 if (sid == 0)
5392                         goto abort_change;
5393
5394                 /* Only allow single threaded processes to change context */
5395                 error = -EPERM;
5396                 if (!current_is_single_threaded()) {
5397                         error = security_bounded_transition(tsec->sid, sid);
5398                         if (error)
5399                                 goto abort_change;
5400                 }
5401
5402                 /* Check permissions for the transition. */
5403                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5404                                      PROCESS__DYNTRANSITION, NULL);
5405                 if (error)
5406                         goto abort_change;
5407
5408                 /* Check for ptracing, and update the task SID if ok.
5409                    Otherwise, leave SID unchanged and fail. */
5410                 ptsid = 0;
5411                 task_lock(p);
5412                 tracer = ptrace_parent(p);
5413                 if (tracer)
5414                         ptsid = task_sid(tracer);
5415                 task_unlock(p);
5416
5417                 if (tracer) {
5418                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5419                                              PROCESS__PTRACE, NULL);
5420                         if (error)
5421                                 goto abort_change;
5422                 }
5423
5424                 tsec->sid = sid;
5425         } else {
5426                 error = -EINVAL;
5427                 goto abort_change;
5428         }
5429
5430         commit_creds(new);
5431         return size;
5432
5433 abort_change:
5434         abort_creds(new);
5435         return error;
5436 }
5437
5438 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5439 {
5440         return security_sid_to_context(secid, secdata, seclen);
5441 }
5442
5443 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5444 {
5445         return security_context_to_sid(secdata, seclen, secid);
5446 }
5447
5448 static void selinux_release_secctx(char *secdata, u32 seclen)
5449 {
5450         kfree(secdata);
5451 }
5452
5453 /*
5454  *      called with inode->i_mutex locked
5455  */
5456 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5457 {
5458         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5459 }
5460
5461 /*
5462  *      called with inode->i_mutex locked
5463  */
5464 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5465 {
5466         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5467 }
5468
5469 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5470 {
5471         int len = 0;
5472         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5473                                                 ctx, true);
5474         if (len < 0)
5475                 return len;
5476         *ctxlen = len;
5477         return 0;
5478 }
5479 #ifdef CONFIG_KEYS
5480
5481 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5482                              unsigned long flags)
5483 {
5484         const struct task_security_struct *tsec;
5485         struct key_security_struct *ksec;
5486
5487         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5488         if (!ksec)
5489                 return -ENOMEM;
5490
5491         tsec = cred->security;
5492         if (tsec->keycreate_sid)
5493                 ksec->sid = tsec->keycreate_sid;
5494         else
5495                 ksec->sid = tsec->sid;
5496
5497         k->security = ksec;
5498         return 0;
5499 }
5500
5501 static void selinux_key_free(struct key *k)
5502 {
5503         struct key_security_struct *ksec = k->security;
5504
5505         k->security = NULL;
5506         kfree(ksec);
5507 }
5508
5509 static int selinux_key_permission(key_ref_t key_ref,
5510                                   const struct cred *cred,
5511                                   key_perm_t perm)
5512 {
5513         struct key *key;
5514         struct key_security_struct *ksec;
5515         u32 sid;
5516
5517         /* if no specific permissions are requested, we skip the
5518            permission check. No serious, additional covert channels
5519            appear to be created. */
5520         if (perm == 0)
5521                 return 0;
5522
5523         sid = cred_sid(cred);
5524
5525         key = key_ref_to_ptr(key_ref);
5526         ksec = key->security;
5527
5528         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5529 }
5530
5531 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5532 {
5533         struct key_security_struct *ksec = key->security;
5534         char *context = NULL;
5535         unsigned len;
5536         int rc;
5537
5538         rc = security_sid_to_context(ksec->sid, &context, &len);
5539         if (!rc)
5540                 rc = len;
5541         *_buffer = context;
5542         return rc;
5543 }
5544
5545 #endif
5546
5547 static struct security_operations selinux_ops = {
5548         .name =                         "selinux",
5549
5550         .ptrace_access_check =          selinux_ptrace_access_check,
5551         .ptrace_traceme =               selinux_ptrace_traceme,
5552         .capget =                       selinux_capget,
5553         .capset =                       selinux_capset,
5554         .capable =                      selinux_capable,
5555         .quotactl =                     selinux_quotactl,
5556         .quota_on =                     selinux_quota_on,
5557         .syslog =                       selinux_syslog,
5558         .vm_enough_memory =             selinux_vm_enough_memory,
5559
5560         .netlink_send =                 selinux_netlink_send,
5561
5562         .bprm_set_creds =               selinux_bprm_set_creds,
5563         .bprm_committing_creds =        selinux_bprm_committing_creds,
5564         .bprm_committed_creds =         selinux_bprm_committed_creds,
5565         .bprm_secureexec =              selinux_bprm_secureexec,
5566
5567         .sb_alloc_security =            selinux_sb_alloc_security,
5568         .sb_free_security =             selinux_sb_free_security,
5569         .sb_copy_data =                 selinux_sb_copy_data,
5570         .sb_remount =                   selinux_sb_remount,
5571         .sb_kern_mount =                selinux_sb_kern_mount,
5572         .sb_show_options =              selinux_sb_show_options,
5573         .sb_statfs =                    selinux_sb_statfs,
5574         .sb_mount =                     selinux_mount,
5575         .sb_umount =                    selinux_umount,
5576         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5577         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5578         .sb_parse_opts_str =            selinux_parse_opts_str,
5579
5580
5581         .inode_alloc_security =         selinux_inode_alloc_security,
5582         .inode_free_security =          selinux_inode_free_security,
5583         .inode_init_security =          selinux_inode_init_security,
5584         .inode_create =                 selinux_inode_create,
5585         .inode_link =                   selinux_inode_link,
5586         .inode_unlink =                 selinux_inode_unlink,
5587         .inode_symlink =                selinux_inode_symlink,
5588         .inode_mkdir =                  selinux_inode_mkdir,
5589         .inode_rmdir =                  selinux_inode_rmdir,
5590         .inode_mknod =                  selinux_inode_mknod,
5591         .inode_rename =                 selinux_inode_rename,
5592         .inode_readlink =               selinux_inode_readlink,
5593         .inode_follow_link =            selinux_inode_follow_link,
5594         .inode_permission =             selinux_inode_permission,
5595         .inode_setattr =                selinux_inode_setattr,
5596         .inode_getattr =                selinux_inode_getattr,
5597         .inode_setxattr =               selinux_inode_setxattr,
5598         .inode_post_setxattr =          selinux_inode_post_setxattr,
5599         .inode_getxattr =               selinux_inode_getxattr,
5600         .inode_listxattr =              selinux_inode_listxattr,
5601         .inode_removexattr =            selinux_inode_removexattr,
5602         .inode_getsecurity =            selinux_inode_getsecurity,
5603         .inode_setsecurity =            selinux_inode_setsecurity,
5604         .inode_listsecurity =           selinux_inode_listsecurity,
5605         .inode_getsecid =               selinux_inode_getsecid,
5606
5607         .file_permission =              selinux_file_permission,
5608         .file_alloc_security =          selinux_file_alloc_security,
5609         .file_free_security =           selinux_file_free_security,
5610         .file_ioctl =                   selinux_file_ioctl,
5611         .mmap_file =                    selinux_mmap_file,
5612         .mmap_addr =                    selinux_mmap_addr,
5613         .file_mprotect =                selinux_file_mprotect,
5614         .file_lock =                    selinux_file_lock,
5615         .file_fcntl =                   selinux_file_fcntl,
5616         .file_set_fowner =              selinux_file_set_fowner,
5617         .file_send_sigiotask =          selinux_file_send_sigiotask,
5618         .file_receive =                 selinux_file_receive,
5619
5620         .file_open =                    selinux_file_open,
5621
5622         .task_create =                  selinux_task_create,
5623         .cred_alloc_blank =             selinux_cred_alloc_blank,
5624         .cred_free =                    selinux_cred_free,
5625         .cred_prepare =                 selinux_cred_prepare,
5626         .cred_transfer =                selinux_cred_transfer,
5627         .kernel_act_as =                selinux_kernel_act_as,
5628         .kernel_create_files_as =       selinux_kernel_create_files_as,
5629         .kernel_module_request =        selinux_kernel_module_request,
5630         .task_setpgid =                 selinux_task_setpgid,
5631         .task_getpgid =                 selinux_task_getpgid,
5632         .task_getsid =                  selinux_task_getsid,
5633         .task_getsecid =                selinux_task_getsecid,
5634         .task_setnice =                 selinux_task_setnice,
5635         .task_setioprio =               selinux_task_setioprio,
5636         .task_getioprio =               selinux_task_getioprio,
5637         .task_setrlimit =               selinux_task_setrlimit,
5638         .task_setscheduler =            selinux_task_setscheduler,
5639         .task_getscheduler =            selinux_task_getscheduler,
5640         .task_movememory =              selinux_task_movememory,
5641         .task_kill =                    selinux_task_kill,
5642         .task_wait =                    selinux_task_wait,
5643         .task_to_inode =                selinux_task_to_inode,
5644
5645         .ipc_permission =               selinux_ipc_permission,
5646         .ipc_getsecid =                 selinux_ipc_getsecid,
5647
5648         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5649         .msg_msg_free_security =        selinux_msg_msg_free_security,
5650
5651         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5652         .msg_queue_free_security =      selinux_msg_queue_free_security,
5653         .msg_queue_associate =          selinux_msg_queue_associate,
5654         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5655         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5656         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5657
5658         .shm_alloc_security =           selinux_shm_alloc_security,
5659         .shm_free_security =            selinux_shm_free_security,
5660         .shm_associate =                selinux_shm_associate,
5661         .shm_shmctl =                   selinux_shm_shmctl,
5662         .shm_shmat =                    selinux_shm_shmat,
5663
5664         .sem_alloc_security =           selinux_sem_alloc_security,
5665         .sem_free_security =            selinux_sem_free_security,
5666         .sem_associate =                selinux_sem_associate,
5667         .sem_semctl =                   selinux_sem_semctl,
5668         .sem_semop =                    selinux_sem_semop,
5669
5670         .d_instantiate =                selinux_d_instantiate,
5671
5672         .getprocattr =                  selinux_getprocattr,
5673         .setprocattr =                  selinux_setprocattr,
5674
5675         .secid_to_secctx =              selinux_secid_to_secctx,
5676         .secctx_to_secid =              selinux_secctx_to_secid,
5677         .release_secctx =               selinux_release_secctx,
5678         .inode_notifysecctx =           selinux_inode_notifysecctx,
5679         .inode_setsecctx =              selinux_inode_setsecctx,
5680         .inode_getsecctx =              selinux_inode_getsecctx,
5681
5682         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5683         .unix_may_send =                selinux_socket_unix_may_send,
5684
5685         .socket_create =                selinux_socket_create,
5686         .socket_post_create =           selinux_socket_post_create,
5687         .socket_bind =                  selinux_socket_bind,
5688         .socket_connect =               selinux_socket_connect,
5689         .socket_listen =                selinux_socket_listen,
5690         .socket_accept =                selinux_socket_accept,
5691         .socket_sendmsg =               selinux_socket_sendmsg,
5692         .socket_recvmsg =               selinux_socket_recvmsg,
5693         .socket_getsockname =           selinux_socket_getsockname,
5694         .socket_getpeername =           selinux_socket_getpeername,
5695         .socket_getsockopt =            selinux_socket_getsockopt,
5696         .socket_setsockopt =            selinux_socket_setsockopt,
5697         .socket_shutdown =              selinux_socket_shutdown,
5698         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5699         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5700         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5701         .sk_alloc_security =            selinux_sk_alloc_security,
5702         .sk_free_security =             selinux_sk_free_security,
5703         .sk_clone_security =            selinux_sk_clone_security,
5704         .sk_getsecid =                  selinux_sk_getsecid,
5705         .sock_graft =                   selinux_sock_graft,
5706         .inet_conn_request =            selinux_inet_conn_request,
5707         .inet_csk_clone =               selinux_inet_csk_clone,
5708         .inet_conn_established =        selinux_inet_conn_established,
5709         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5710         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5711         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5712         .req_classify_flow =            selinux_req_classify_flow,
5713         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5714         .tun_dev_free_security =        selinux_tun_dev_free_security,
5715         .tun_dev_create =               selinux_tun_dev_create,
5716         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5717         .tun_dev_attach =               selinux_tun_dev_attach,
5718         .tun_dev_open =                 selinux_tun_dev_open,
5719         .skb_owned_by =                 selinux_skb_owned_by,
5720
5721 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5722         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5723         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5724         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5725         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5726         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5727         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5728         .xfrm_state_free_security =     selinux_xfrm_state_free,
5729         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5730         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5731         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5732         .xfrm_decode_session =          selinux_xfrm_decode_session,
5733 #endif
5734
5735 #ifdef CONFIG_KEYS
5736         .key_alloc =                    selinux_key_alloc,
5737         .key_free =                     selinux_key_free,
5738         .key_permission =               selinux_key_permission,
5739         .key_getsecurity =              selinux_key_getsecurity,
5740 #endif
5741
5742 #ifdef CONFIG_AUDIT
5743         .audit_rule_init =              selinux_audit_rule_init,
5744         .audit_rule_known =             selinux_audit_rule_known,
5745         .audit_rule_match =             selinux_audit_rule_match,
5746         .audit_rule_free =              selinux_audit_rule_free,
5747 #endif
5748 };
5749
5750 static __init int selinux_init(void)
5751 {
5752         if (!security_module_enable(&selinux_ops)) {
5753                 selinux_enabled = 0;
5754                 return 0;
5755         }
5756
5757         if (!selinux_enabled) {
5758                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5759                 return 0;
5760         }
5761
5762         printk(KERN_INFO "SELinux:  Initializing.\n");
5763
5764         /* Set the security state for the initial task. */
5765         cred_init_security();
5766
5767         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5768
5769         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5770                                             sizeof(struct inode_security_struct),
5771                                             0, SLAB_PANIC, NULL);
5772         avc_init();
5773
5774         if (register_security(&selinux_ops))
5775                 panic("SELinux: Unable to register with kernel.\n");
5776
5777         if (selinux_enforcing)
5778                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5779         else
5780                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5781
5782         return 0;
5783 }
5784
5785 static void delayed_superblock_init(struct super_block *sb, void *unused)
5786 {
5787         superblock_doinit(sb, NULL);
5788 }
5789
5790 void selinux_complete_init(void)
5791 {
5792         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5793
5794         /* Set up any superblocks initialized prior to the policy load. */
5795         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5796         iterate_supers(delayed_superblock_init, NULL);
5797 }
5798
5799 /* SELinux requires early initialization in order to label
5800    all processes and objects when they are created. */
5801 security_initcall(selinux_init);
5802
5803 #if defined(CONFIG_NETFILTER)
5804
5805 static struct nf_hook_ops selinux_ipv4_ops[] = {
5806         {
5807                 .hook =         selinux_ipv4_postroute,
5808                 .owner =        THIS_MODULE,
5809                 .pf =           NFPROTO_IPV4,
5810                 .hooknum =      NF_INET_POST_ROUTING,
5811                 .priority =     NF_IP_PRI_SELINUX_LAST,
5812         },
5813         {
5814                 .hook =         selinux_ipv4_forward,
5815                 .owner =        THIS_MODULE,
5816                 .pf =           NFPROTO_IPV4,
5817                 .hooknum =      NF_INET_FORWARD,
5818                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5819         },
5820         {
5821                 .hook =         selinux_ipv4_output,
5822                 .owner =        THIS_MODULE,
5823                 .pf =           NFPROTO_IPV4,
5824                 .hooknum =      NF_INET_LOCAL_OUT,
5825                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5826         }
5827 };
5828
5829 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5830
5831 static struct nf_hook_ops selinux_ipv6_ops[] = {
5832         {
5833                 .hook =         selinux_ipv6_postroute,
5834                 .owner =        THIS_MODULE,
5835                 .pf =           NFPROTO_IPV6,
5836                 .hooknum =      NF_INET_POST_ROUTING,
5837                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5838         },
5839         {
5840                 .hook =         selinux_ipv6_forward,
5841                 .owner =        THIS_MODULE,
5842                 .pf =           NFPROTO_IPV6,
5843                 .hooknum =      NF_INET_FORWARD,
5844                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5845         }
5846 };
5847
5848 #endif  /* IPV6 */
5849
5850 static int __init selinux_nf_ip_init(void)
5851 {
5852         int err = 0;
5853
5854         if (!selinux_enabled)
5855                 goto out;
5856
5857         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5858
5859         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5860         if (err)
5861                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5862
5863 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5864         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5865         if (err)
5866                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5867 #endif  /* IPV6 */
5868
5869 out:
5870         return err;
5871 }
5872
5873 __initcall(selinux_nf_ip_init);
5874
5875 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5876 static void selinux_nf_ip_exit(void)
5877 {
5878         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5879
5880         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5881 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5882         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5883 #endif  /* IPV6 */
5884 }
5885 #endif
5886
5887 #else /* CONFIG_NETFILTER */
5888
5889 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5890 #define selinux_nf_ip_exit()
5891 #endif
5892
5893 #endif /* CONFIG_NETFILTER */
5894
5895 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5896 static int selinux_disabled;
5897
5898 int selinux_disable(void)
5899 {
5900         if (ss_initialized) {
5901                 /* Not permitted after initial policy load. */
5902                 return -EINVAL;
5903         }
5904
5905         if (selinux_disabled) {
5906                 /* Only do this once. */
5907                 return -EINVAL;
5908         }
5909
5910         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5911
5912         selinux_disabled = 1;
5913         selinux_enabled = 0;
5914
5915         reset_security_ops();
5916
5917         /* Try to destroy the avc node cache */
5918         avc_disable();
5919
5920         /* Unregister netfilter hooks. */
5921         selinux_nf_ip_exit();
5922
5923         /* Unregister selinuxfs. */
5924         exit_sel_fs();
5925
5926         return 0;
5927 }
5928 #endif