err.no Git - linux-2.6/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *                Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <asm/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "netport.h"
  84 #include "xfrm.h"
  85 #include "netlabel.h"
  86 #include "audit.h"
  87
  88 #define XATTR_SELINUX_SUFFIX "selinux"
  89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  90
  91 #define NUM_SEL_MNT_OPTS 4
  92
  93 extern unsigned int policydb_loaded_version;
  94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  95 extern int selinux_compat_net;
  96 extern struct security_operations *security_ops;
  97
  98 /* SECMARK reference count */
  99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing = 0;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         selinux_enforcing = simple_strtol(str,NULL,0);
 107         return 1;
 108 }
 109 __setup("enforcing=", enforcing_setup);
 110 #endif
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 113 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 114
 115 static int __init selinux_enabled_setup(char *str)
 116 {
 117         selinux_enabled = simple_strtol(str, NULL, 0);
 118         return 1;
 119 }
 120 __setup("selinux=", selinux_enabled_setup);
 121 #else
 122 int selinux_enabled = 1;
 123 #endif
 124
 125 /* Original (dummy) security module. */
 126 static struct security_operations *original_ops = NULL;
 127
 128 /* Minimal support for a secondary security module,
 129    just to allow the use of the dummy or capability modules.
 130    The owlsm module can alternatively be used as a secondary
 131    module as long as CONFIG_OWLSM_FD is not enabled. */
 132 static struct security_operations *secondary_ops = NULL;
 133
 134 /* Lists of inode and superblock security structures initialized
 135    before the policy was loaded. */
 136 static LIST_HEAD(superblock_security_head);
 137 static DEFINE_SPINLOCK(sb_security_lock);
 138
 139 static struct kmem_cache *sel_inode_cache;
 140
 141 /**
 142  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 143  *
 144  * Description:
 145  * This function checks the SECMARK reference counter to see if any SECMARK
 146  * targets are currently configured, if the reference counter is greater than
 147  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 148  * enabled, false (0) if SECMARK is disabled.
 149  *
 150  */
 151 static int selinux_secmark_enabled(void)
 152 {
 153         return (atomic_read(&selinux_secmark_refcount) > 0);
 154 }
 155
 156 /* Allocate and free functions for each kind of security blob. */
 157
 158 static int task_alloc_security(struct task_struct *task)
 159 {
 160         struct task_security_struct *tsec;
 161
 162         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 163         if (!tsec)
 164                 return -ENOMEM;
 165
 166         tsec->osid = tsec->sid = SECINITSID_UNLABELED;
 167         task->security = tsec;
 168
 169         return 0;
 170 }
 171
 172 static void task_free_security(struct task_struct *task)
 173 {
 174         struct task_security_struct *tsec = task->security;
 175         task->security = NULL;
 176         kfree(tsec);
 177 }
 178
 179 static int inode_alloc_security(struct inode *inode)
 180 {
 181         struct task_security_struct *tsec = current->security;
 182         struct inode_security_struct *isec;
 183
 184         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 185         if (!isec)
 186                 return -ENOMEM;
 187
 188         mutex_init(&isec->lock);
 189         INIT_LIST_HEAD(&isec->list);
 190         isec->inode = inode;
 191         isec->sid = SECINITSID_UNLABELED;
 192         isec->sclass = SECCLASS_FILE;
 193         isec->task_sid = tsec->sid;
 194         inode->i_security = isec;
 195
 196         return 0;
 197 }
 198
 199 static void inode_free_security(struct inode *inode)
 200 {
 201         struct inode_security_struct *isec = inode->i_security;
 202         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 203
 204         spin_lock(&sbsec->isec_lock);
 205         if (!list_empty(&isec->list))
 206                 list_del_init(&isec->list);
 207         spin_unlock(&sbsec->isec_lock);
 208
 209         inode->i_security = NULL;
 210         kmem_cache_free(sel_inode_cache, isec);
 211 }
 212
 213 static int file_alloc_security(struct file *file)
 214 {
 215         struct task_security_struct *tsec = current->security;
 216         struct file_security_struct *fsec;
 217
 218         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 219         if (!fsec)
 220                 return -ENOMEM;
 221
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->peer_sid = SECINITSID_UNLABELED;
 279         ssec->sid = SECINITSID_UNLABELED;
 280         sk->sk_security = ssec;
 281
 282         selinux_netlbl_sk_security_reset(ssec, family);
 283
 284         return 0;
 285 }
 286
 287 static void sk_free_security(struct sock *sk)
 288 {
 289         struct sk_security_struct *ssec = sk->sk_security;
 290
 291         sk->sk_security = NULL;
 292         kfree(ssec);
 293 }
 294
 295 /* The security server must be initialized before
 296    any labeling or access decisions can be provided. */
 297 extern int ss_initialized;
 298
 299 /* The file system's label must be initialized prior to use. */
 300
 301 static char *labeling_behaviors[6] = {
 302         "uses xattr",
 303         "uses transition SIDs",
 304         "uses task SIDs",
 305         "uses genfs_contexts",
 306         "not configured for labeling",
 307         "uses mountpoint labeling",
 308 };
 309
 310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 311
 312 static inline int inode_doinit(struct inode *inode)
 313 {
 314         return inode_doinit_with_dentry(inode, NULL);
 315 }
 316
 317 enum {
 318         Opt_error = -1,
 319         Opt_context = 1,
 320         Opt_fscontext = 2,
 321         Opt_defcontext = 3,
 322         Opt_rootcontext = 4,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, CONTEXT_STR "%s"},
 327         {Opt_fscontext, FSCONTEXT_STR "%s"},
 328         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 329         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 330         {Opt_error, NULL},
 331 };
 332
 333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 334
 335 static int may_context_mount_sb_relabel(u32 sid,
 336                         struct superblock_security_struct *sbsec,
 337                         struct task_security_struct *tsec)
 338 {
 339         int rc;
 340
 341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 342                           FILESYSTEM__RELABELFROM, NULL);
 343         if (rc)
 344                 return rc;
 345
 346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELTO, NULL);
 348         return rc;
 349 }
 350
 351 static int may_context_mount_inode_relabel(u32 sid,
 352                         struct superblock_security_struct *sbsec,
 353                         struct task_security_struct *tsec)
 354 {
 355         int rc;
 356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELFROM, NULL);
 358         if (rc)
 359                 return rc;
 360
 361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__ASSOCIATE, NULL);
 363         return rc;
 364 }
 365
 366 static int sb_finish_set_opts(struct super_block *sb)
 367 {
 368         struct superblock_security_struct *sbsec = sb->s_security;
 369         struct dentry *root = sb->s_root;
 370         struct inode *root_inode = root->d_inode;
 371         int rc = 0;
 372
 373         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 374                 /* Make sure that the xattr handler exists and that no
 375                    error other than -ENODATA is returned by getxattr on
 376                    the root directory.  -ENODATA is ok, as this may be
 377                    the first boot of the SELinux kernel before we have
 378                    assigned xattr values to the filesystem. */
 379                 if (!root_inode->i_op->getxattr) {
 380                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 381                                "xattr support\n", sb->s_id, sb->s_type->name);
 382                         rc = -EOPNOTSUPP;
 383                         goto out;
 384                 }
 385                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 386                 if (rc < 0 && rc != -ENODATA) {
 387                         if (rc == -EOPNOTSUPP)
 388                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 389                                        "%s) has no security xattr handler\n",
 390                                        sb->s_id, sb->s_type->name);
 391                         else
 392                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 393                                        "%s) getxattr errno %d\n", sb->s_id,
 394                                        sb->s_type->name, -rc);
 395                         goto out;
 396                 }
 397         }
 398
 399         sbsec->initialized = 1;
 400
 401         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 402                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 403                        sb->s_id, sb->s_type->name);
 404         else
 405                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 406                        sb->s_id, sb->s_type->name,
 407                        labeling_behaviors[sbsec->behavior-1]);
 408
 409         /* Initialize the root inode. */
 410         rc = inode_doinit_with_dentry(root_inode, root);
 411
 412         /* Initialize any other inodes associated with the superblock, e.g.
 413            inodes created prior to initial policy load or inodes created
 414            during get_sb by a pseudo filesystem that directly
 415            populates itself. */
 416         spin_lock(&sbsec->isec_lock);
 417 next_inode:
 418         if (!list_empty(&sbsec->isec_head)) {
 419                 struct inode_security_struct *isec =
 420                                 list_entry(sbsec->isec_head.next,
 421                                            struct inode_security_struct, list);
 422                 struct inode *inode = isec->inode;
 423                 spin_unlock(&sbsec->isec_lock);
 424                 inode = igrab(inode);
 425                 if (inode) {
 426                         if (!IS_PRIVATE(inode))
 427                                 inode_doinit(inode);
 428                         iput(inode);
 429                 }
 430                 spin_lock(&sbsec->isec_lock);
 431                 list_del_init(&isec->list);
 432                 goto next_inode;
 433         }
 434         spin_unlock(&sbsec->isec_lock);
 435 out:
 436         return rc;
 437 }
 438
 439 /*
 440  * This function should allow an FS to ask what it's mount security
 441  * options were so it can use those later for submounts, displaying
 442  * mount options, or whatever.
 443  */
 444 static int selinux_get_mnt_opts(const struct super_block *sb,
 445                                 struct security_mnt_opts *opts)
 446 {
 447         int rc = 0, i;
 448         struct superblock_security_struct *sbsec = sb->s_security;
 449         char *context = NULL;
 450         u32 len;
 451         char tmp;
 452
 453         security_init_mnt_opts(opts);
 454
 455         if (!sbsec->initialized)
 456                 return -EINVAL;
 457
 458         if (!ss_initialized)
 459                 return -EINVAL;
 460
 461         /*
 462          * if we ever use sbsec flags for anything other than tracking mount
 463          * settings this is going to need a mask
 464          */
 465         tmp = sbsec->flags;
 466         /* count the number of mount options for this sb */
 467         for (i = 0; i < 8; i++) {
 468                 if (tmp & 0x01)
 469                         opts->num_mnt_opts++;
 470                 tmp >>= 1;
 471         }
 472
 473         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 474         if (!opts->mnt_opts) {
 475                 rc = -ENOMEM;
 476                 goto out_free;
 477         }
 478
 479         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 480         if (!opts->mnt_opts_flags) {
 481                 rc = -ENOMEM;
 482                 goto out_free;
 483         }
 484
 485         i = 0;
 486         if (sbsec->flags & FSCONTEXT_MNT) {
 487                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 488                 if (rc)
 489                         goto out_free;
 490                 opts->mnt_opts[i] = context;
 491                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 492         }
 493         if (sbsec->flags & CONTEXT_MNT) {
 494                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 495                 if (rc)
 496                         goto out_free;
 497                 opts->mnt_opts[i] = context;
 498                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 499         }
 500         if (sbsec->flags & DEFCONTEXT_MNT) {
 501                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 502                 if (rc)
 503                         goto out_free;
 504                 opts->mnt_opts[i] = context;
 505                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 506         }
 507         if (sbsec->flags & ROOTCONTEXT_MNT) {
 508                 struct inode *root = sbsec->sb->s_root->d_inode;
 509                 struct inode_security_struct *isec = root->i_security;
 510
 511                 rc = security_sid_to_context(isec->sid, &context, &len);
 512                 if (rc)
 513                         goto out_free;
 514                 opts->mnt_opts[i] = context;
 515                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 516         }
 517
 518         BUG_ON(i != opts->num_mnt_opts);
 519
 520         return 0;
 521
 522 out_free:
 523         security_free_mnt_opts(opts);
 524         return rc;
 525 }
 526
 527 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 528                       u32 old_sid, u32 new_sid)
 529 {
 530         /* check if the old mount command had the same options */
 531         if (sbsec->initialized)
 532                 if (!(sbsec->flags & flag) ||
 533                     (old_sid != new_sid))
 534                         return 1;
 535
 536         /* check if we were passed the same options twice,
 537          * aka someone passed context=a,context=b
 538          */
 539         if (!sbsec->initialized)
 540                 if (sbsec->flags & flag)
 541                         return 1;
 542         return 0;
 543 }
 544
 545 /*
 546  * Allow filesystems with binary mount data to explicitly set mount point
 547  * labeling information.
 548  */
 549 static int selinux_set_mnt_opts(struct super_block *sb,
 550                                 struct security_mnt_opts *opts)
 551 {
 552         int rc = 0, i;
 553         struct task_security_struct *tsec = current->security;
 554         struct superblock_security_struct *sbsec = sb->s_security;
 555         const char *name = sb->s_type->name;
 556         struct inode *inode = sbsec->sb->s_root->d_inode;
 557         struct inode_security_struct *root_isec = inode->i_security;
 558         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 559         u32 defcontext_sid = 0;
 560         char **mount_options = opts->mnt_opts;
 561         int *flags = opts->mnt_opts_flags;
 562         int num_opts = opts->num_mnt_opts;
 563
 564         mutex_lock(&sbsec->lock);
 565
 566         if (!ss_initialized) {
 567                 if (!num_opts) {
 568                         /* Defer initialization until selinux_complete_init,
 569                            after the initial policy is loaded and the security
 570                            server is ready to handle calls. */
 571                         spin_lock(&sb_security_lock);
 572                         if (list_empty(&sbsec->list))
 573                                 list_add(&sbsec->list, &superblock_security_head);
 574                         spin_unlock(&sb_security_lock);
 575                         goto out;
 576                 }
 577                 rc = -EINVAL;
 578                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 579                         "before the security server is initialized\n");
 580                 goto out;
 581         }
 582
 583         /*
 584          * Binary mount data FS will come through this function twice.  Once
 585          * from an explicit call and once from the generic calls from the vfs.
 586          * Since the generic VFS calls will not contain any security mount data
 587          * we need to skip the double mount verification.
 588          *
 589          * This does open a hole in which we will not notice if the first
 590          * mount using this sb set explict options and a second mount using
 591          * this sb does not set any security options.  (The first options
 592          * will be used for both mounts)
 593          */
 594         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 595             && (num_opts == 0))
 596                 goto out;
 597
 598         /*
 599          * parse the mount options, check if they are valid sids.
 600          * also check if someone is trying to mount the same sb more
 601          * than once with different security options.
 602          */
 603         for (i = 0; i < num_opts; i++) {
 604                 u32 sid;
 605                 rc = security_context_to_sid(mount_options[i],
 606                                              strlen(mount_options[i]), &sid);
 607                 if (rc) {
 608                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 609                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 610                                mount_options[i], sb->s_id, name, rc);
 611                         goto out;
 612                 }
 613                 switch (flags[i]) {
 614                 case FSCONTEXT_MNT:
 615                         fscontext_sid = sid;
 616
 617                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 618                                         fscontext_sid))
 619                                 goto out_double_mount;
 620
 621                         sbsec->flags |= FSCONTEXT_MNT;
 622                         break;
 623                 case CONTEXT_MNT:
 624                         context_sid = sid;
 625
 626                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 627                                         context_sid))
 628                                 goto out_double_mount;
 629
 630                         sbsec->flags |= CONTEXT_MNT;
 631                         break;
 632                 case ROOTCONTEXT_MNT:
 633                         rootcontext_sid = sid;
 634
 635                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 636                                         rootcontext_sid))
 637                                 goto out_double_mount;
 638
 639                         sbsec->flags |= ROOTCONTEXT_MNT;
 640
 641                         break;
 642                 case DEFCONTEXT_MNT:
 643                         defcontext_sid = sid;
 644
 645                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 646                                         defcontext_sid))
 647                                 goto out_double_mount;
 648
 649                         sbsec->flags |= DEFCONTEXT_MNT;
 650
 651                         break;
 652                 default:
 653                         rc = -EINVAL;
 654                         goto out;
 655                 }
 656         }
 657
 658         if (sbsec->initialized) {
 659                 /* previously mounted with options, but not on this attempt? */
 660                 if (sbsec->flags && !num_opts)
 661                         goto out_double_mount;
 662                 rc = 0;
 663                 goto out;
 664         }
 665
 666         if (strcmp(sb->s_type->name, "proc") == 0)
 667                 sbsec->proc = 1;
 668
 669         /* Determine the labeling behavior to use for this filesystem type. */
 670         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 671         if (rc) {
 672                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 673                        __func__, sb->s_type->name, rc);
 674                 goto out;
 675         }
 676
 677         /* sets the context of the superblock for the fs being mounted. */
 678         if (fscontext_sid) {
 679
 680                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 681                 if (rc)
 682                         goto out;
 683
 684                 sbsec->sid = fscontext_sid;
 685         }
 686
 687         /*
 688          * Switch to using mount point labeling behavior.
 689          * sets the label used on all file below the mountpoint, and will set
 690          * the superblock context if not already set.
 691          */
 692         if (context_sid) {
 693                 if (!fscontext_sid) {
 694                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 695                         if (rc)
 696                                 goto out;
 697                         sbsec->sid = context_sid;
 698                 } else {
 699                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 700                         if (rc)
 701                                 goto out;
 702                 }
 703                 if (!rootcontext_sid)
 704                         rootcontext_sid = context_sid;
 705
 706                 sbsec->mntpoint_sid = context_sid;
 707                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 708         }
 709
 710         if (rootcontext_sid) {
 711                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 712                 if (rc)
 713                         goto out;
 714
 715                 root_isec->sid = rootcontext_sid;
 716                 root_isec->initialized = 1;
 717         }
 718
 719         if (defcontext_sid) {
 720                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 721                         rc = -EINVAL;
 722                         printk(KERN_WARNING "SELinux: defcontext option is "
 723                                "invalid for this filesystem type\n");
 724                         goto out;
 725                 }
 726
 727                 if (defcontext_sid != sbsec->def_sid) {
 728                         rc = may_context_mount_inode_relabel(defcontext_sid,
 729                                                              sbsec, tsec);
 730                         if (rc)
 731                                 goto out;
 732                 }
 733
 734                 sbsec->def_sid = defcontext_sid;
 735         }
 736
 737         rc = sb_finish_set_opts(sb);
 738 out:
 739         mutex_unlock(&sbsec->lock);
 740         return rc;
 741 out_double_mount:
 742         rc = -EINVAL;
 743         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 744                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 745         goto out;
 746 }
 747
 748 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 749                                         struct super_block *newsb)
 750 {
 751         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 752         struct superblock_security_struct *newsbsec = newsb->s_security;
 753
 754         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 755         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 756         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 757
 758         /* we can't error, we can't save the info, this shouldn't get called
 759          * this early in the boot process. */
 760         BUG_ON(!ss_initialized);
 761
 762         /* how can we clone if the old one wasn't set up?? */
 763         BUG_ON(!oldsbsec->initialized);
 764
 765         /* if fs is reusing a sb, just let its options stand... */
 766         if (newsbsec->initialized)
 767                 return;
 768
 769         mutex_lock(&newsbsec->lock);
 770
 771         newsbsec->flags = oldsbsec->flags;
 772
 773         newsbsec->sid = oldsbsec->sid;
 774         newsbsec->def_sid = oldsbsec->def_sid;
 775         newsbsec->behavior = oldsbsec->behavior;
 776
 777         if (set_context) {
 778                 u32 sid = oldsbsec->mntpoint_sid;
 779
 780                 if (!set_fscontext)
 781                         newsbsec->sid = sid;
 782                 if (!set_rootcontext) {
 783                         struct inode *newinode = newsb->s_root->d_inode;
 784                         struct inode_security_struct *newisec = newinode->i_security;
 785                         newisec->sid = sid;
 786                 }
 787                 newsbsec->mntpoint_sid = sid;
 788         }
 789         if (set_rootcontext) {
 790                 const struct inode *oldinode = oldsb->s_root->d_inode;
 791                 const struct inode_security_struct *oldisec = oldinode->i_security;
 792                 struct inode *newinode = newsb->s_root->d_inode;
 793                 struct inode_security_struct *newisec = newinode->i_security;
 794
 795                 newisec->sid = oldisec->sid;
 796         }
 797
 798         sb_finish_set_opts(newsb);
 799         mutex_unlock(&newsbsec->lock);
 800 }
 801
 802 static int selinux_parse_opts_str(char *options,
 803                                   struct security_mnt_opts *opts)
 804 {
 805         char *p;
 806         char *context = NULL, *defcontext = NULL;
 807         char *fscontext = NULL, *rootcontext = NULL;
 808         int rc, num_mnt_opts = 0;
 809
 810         opts->num_mnt_opts = 0;
 811
 812         /* Standard string-based options. */
 813         while ((p = strsep(&options, "|")) != NULL) {
 814                 int token;
 815                 substring_t args[MAX_OPT_ARGS];
 816
 817                 if (!*p)
 818                         continue;
 819
 820                 token = match_token(p, tokens, args);
 821
 822                 switch (token) {
 823                 case Opt_context:
 824                         if (context || defcontext) {
 825                                 rc = -EINVAL;
 826                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 827                                 goto out_err;
 828                         }
 829                         context = match_strdup(&args[0]);
 830                         if (!context) {
 831                                 rc = -ENOMEM;
 832                                 goto out_err;
 833                         }
 834                         break;
 835
 836                 case Opt_fscontext:
 837                         if (fscontext) {
 838                                 rc = -EINVAL;
 839                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 840                                 goto out_err;
 841                         }
 842                         fscontext = match_strdup(&args[0]);
 843                         if (!fscontext) {
 844                                 rc = -ENOMEM;
 845                                 goto out_err;
 846                         }
 847                         break;
 848
 849                 case Opt_rootcontext:
 850                         if (rootcontext) {
 851                                 rc = -EINVAL;
 852                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 853                                 goto out_err;
 854                         }
 855                         rootcontext = match_strdup(&args[0]);
 856                         if (!rootcontext) {
 857                                 rc = -ENOMEM;
 858                                 goto out_err;
 859                         }
 860                         break;
 861
 862                 case Opt_defcontext:
 863                         if (context || defcontext) {
 864                                 rc = -EINVAL;
 865                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 866                                 goto out_err;
 867                         }
 868                         defcontext = match_strdup(&args[0]);
 869                         if (!defcontext) {
 870                                 rc = -ENOMEM;
 871                                 goto out_err;
 872                         }
 873                         break;
 874
 875                 default:
 876                         rc = -EINVAL;
 877                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 878                         goto out_err;
 879
 880                 }
 881         }
 882
 883         rc = -ENOMEM;
 884         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 885         if (!opts->mnt_opts)
 886                 goto out_err;
 887
 888         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 889         if (!opts->mnt_opts_flags) {
 890                 kfree(opts->mnt_opts);
 891                 goto out_err;
 892         }
 893
 894         if (fscontext) {
 895                 opts->mnt_opts[num_mnt_opts] = fscontext;
 896                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 897         }
 898         if (context) {
 899                 opts->mnt_opts[num_mnt_opts] = context;
 900                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 901         }
 902         if (rootcontext) {
 903                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 904                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 905         }
 906         if (defcontext) {
 907                 opts->mnt_opts[num_mnt_opts] = defcontext;
 908                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 909         }
 910
 911         opts->num_mnt_opts = num_mnt_opts;
 912         return 0;
 913
 914 out_err:
 915         kfree(context);
 916         kfree(defcontext);
 917         kfree(fscontext);
 918         kfree(rootcontext);
 919         return rc;
 920 }
 921 /*
 922  * string mount options parsing and call set the sbsec
 923  */
 924 static int superblock_doinit(struct super_block *sb, void *data)
 925 {
 926         int rc = 0;
 927         char *options = data;
 928         struct security_mnt_opts opts;
 929
 930         security_init_mnt_opts(&opts);
 931
 932         if (!data)
 933                 goto out;
 934
 935         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 936
 937         rc = selinux_parse_opts_str(options, &opts);
 938         if (rc)
 939                 goto out_err;
 940
 941 out:
 942         rc = selinux_set_mnt_opts(sb, &opts);
 943
 944 out_err:
 945         security_free_mnt_opts(&opts);
 946         return rc;
 947 }
 948
 949 static inline u16 inode_mode_to_security_class(umode_t mode)
 950 {
 951         switch (mode & S_IFMT) {
 952         case S_IFSOCK:
 953                 return SECCLASS_SOCK_FILE;
 954         case S_IFLNK:
 955                 return SECCLASS_LNK_FILE;
 956         case S_IFREG:
 957                 return SECCLASS_FILE;
 958         case S_IFBLK:
 959                 return SECCLASS_BLK_FILE;
 960         case S_IFDIR:
 961                 return SECCLASS_DIR;
 962         case S_IFCHR:
 963                 return SECCLASS_CHR_FILE;
 964         case S_IFIFO:
 965                 return SECCLASS_FIFO_FILE;
 966
 967         }
 968
 969         return SECCLASS_FILE;
 970 }
 971
 972 static inline int default_protocol_stream(int protocol)
 973 {
 974         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 975 }
 976
 977 static inline int default_protocol_dgram(int protocol)
 978 {
 979         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 980 }
 981
 982 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 983 {
 984         switch (family) {
 985         case PF_UNIX:
 986                 switch (type) {
 987                 case SOCK_STREAM:
 988                 case SOCK_SEQPACKET:
 989                         return SECCLASS_UNIX_STREAM_SOCKET;
 990                 case SOCK_DGRAM:
 991                         return SECCLASS_UNIX_DGRAM_SOCKET;
 992                 }
 993                 break;
 994         case PF_INET:
 995         case PF_INET6:
 996                 switch (type) {
 997                 case SOCK_STREAM:
 998                         if (default_protocol_stream(protocol))
 999                                 return SECCLASS_TCP_SOCKET;
1000                         else
1001                                 return SECCLASS_RAWIP_SOCKET;
1002                 case SOCK_DGRAM:
1003                         if (default_protocol_dgram(protocol))
1004                                 return SECCLASS_UDP_SOCKET;
1005                         else
1006                                 return SECCLASS_RAWIP_SOCKET;
1007                 case SOCK_DCCP:
1008                         return SECCLASS_DCCP_SOCKET;
1009                 default:
1010                         return SECCLASS_RAWIP_SOCKET;
1011                 }
1012                 break;
1013         case PF_NETLINK:
1014                 switch (protocol) {
1015                 case NETLINK_ROUTE:
1016                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1017                 case NETLINK_FIREWALL:
1018                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1019                 case NETLINK_INET_DIAG:
1020                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1021                 case NETLINK_NFLOG:
1022                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1023                 case NETLINK_XFRM:
1024                         return SECCLASS_NETLINK_XFRM_SOCKET;
1025                 case NETLINK_SELINUX:
1026                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1027                 case NETLINK_AUDIT:
1028                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1029                 case NETLINK_IP6_FW:
1030                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1031                 case NETLINK_DNRTMSG:
1032                         return SECCLASS_NETLINK_DNRT_SOCKET;
1033                 case NETLINK_KOBJECT_UEVENT:
1034                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1035                 default:
1036                         return SECCLASS_NETLINK_SOCKET;
1037                 }
1038         case PF_PACKET:
1039                 return SECCLASS_PACKET_SOCKET;
1040         case PF_KEY:
1041                 return SECCLASS_KEY_SOCKET;
1042         case PF_APPLETALK:
1043                 return SECCLASS_APPLETALK_SOCKET;
1044         }
1045
1046         return SECCLASS_SOCKET;
1047 }
1048
1049 #ifdef CONFIG_PROC_FS
1050 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1051                                 u16 tclass,
1052                                 u32 *sid)
1053 {
1054         int buflen, rc;
1055         char *buffer, *path, *end;
1056
1057         buffer = (char*)__get_free_page(GFP_KERNEL);
1058         if (!buffer)
1059                 return -ENOMEM;
1060
1061         buflen = PAGE_SIZE;
1062         end = buffer+buflen;
1063         *--end = '\0';
1064         buflen--;
1065         path = end-1;
1066         *path = '/';
1067         while (de && de != de->parent) {
1068                 buflen -= de->namelen + 1;
1069                 if (buflen < 0)
1070                         break;
1071                 end -= de->namelen;
1072                 memcpy(end, de->name, de->namelen);
1073                 *--end = '/';
1074                 path = end;
1075                 de = de->parent;
1076         }
1077         rc = security_genfs_sid("proc", path, tclass, sid);
1078         free_page((unsigned long)buffer);
1079         return rc;
1080 }
1081 #else
1082 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1083                                 u16 tclass,
1084                                 u32 *sid)
1085 {
1086         return -EINVAL;
1087 }
1088 #endif
1089
1090 /* The inode's security attributes must be initialized before first use. */
1091 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1092 {
1093         struct superblock_security_struct *sbsec = NULL;
1094         struct inode_security_struct *isec = inode->i_security;
1095         u32 sid;
1096         struct dentry *dentry;
1097 #define INITCONTEXTLEN 255
1098         char *context = NULL;
1099         unsigned len = 0;
1100         int rc = 0;
1101
1102         if (isec->initialized)
1103                 goto out;
1104
1105         mutex_lock(&isec->lock);
1106         if (isec->initialized)
1107                 goto out_unlock;
1108
1109         sbsec = inode->i_sb->s_security;
1110         if (!sbsec->initialized) {
1111                 /* Defer initialization until selinux_complete_init,
1112                    after the initial policy is loaded and the security
1113                    server is ready to handle calls. */
1114                 spin_lock(&sbsec->isec_lock);
1115                 if (list_empty(&isec->list))
1116                         list_add(&isec->list, &sbsec->isec_head);
1117                 spin_unlock(&sbsec->isec_lock);
1118                 goto out_unlock;
1119         }
1120
1121         switch (sbsec->behavior) {
1122         case SECURITY_FS_USE_XATTR:
1123                 if (!inode->i_op->getxattr) {
1124                         isec->sid = sbsec->def_sid;
1125                         break;
1126                 }
1127
1128                 /* Need a dentry, since the xattr API requires one.
1129                    Life would be simpler if we could just pass the inode. */
1130                 if (opt_dentry) {
1131                         /* Called from d_instantiate or d_splice_alias. */
1132                         dentry = dget(opt_dentry);
1133                 } else {
1134                         /* Called from selinux_complete_init, try to find a dentry. */
1135                         dentry = d_find_alias(inode);
1136                 }
1137                 if (!dentry) {
1138                         printk(KERN_WARNING "SELinux: %s:  no dentry for dev=%s "
1139                                "ino=%ld\n", __func__, inode->i_sb->s_id,
1140                                inode->i_ino);
1141                         goto out_unlock;
1142                 }
1143
1144                 len = INITCONTEXTLEN;
1145                 context = kmalloc(len, GFP_NOFS);
1146                 if (!context) {
1147                         rc = -ENOMEM;
1148                         dput(dentry);
1149                         goto out_unlock;
1150                 }
1151                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1152                                            context, len);
1153                 if (rc == -ERANGE) {
1154                         /* Need a larger buffer.  Query for the right size. */
1155                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1156                                                    NULL, 0);
1157                         if (rc < 0) {
1158                                 dput(dentry);
1159                                 goto out_unlock;
1160                         }
1161                         kfree(context);
1162                         len = rc;
1163                         context = kmalloc(len, GFP_NOFS);
1164                         if (!context) {
1165                                 rc = -ENOMEM;
1166                                 dput(dentry);
1167                                 goto out_unlock;
1168                         }
1169                         rc = inode->i_op->getxattr(dentry,
1170                                                    XATTR_NAME_SELINUX,
1171                                                    context, len);
1172                 }
1173                 dput(dentry);
1174                 if (rc < 0) {
1175                         if (rc != -ENODATA) {
1176                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1177                                        "%d for dev=%s ino=%ld\n", __func__,
1178                                        -rc, inode->i_sb->s_id, inode->i_ino);
1179                                 kfree(context);
1180                                 goto out_unlock;
1181                         }
1182                         /* Map ENODATA to the default file SID */
1183                         sid = sbsec->def_sid;
1184                         rc = 0;
1185                 } else {
1186                         rc = security_context_to_sid_default(context, rc, &sid,
1187                                                              sbsec->def_sid,
1188                                                              GFP_NOFS);
1189                         if (rc) {
1190                                 printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1191                                        "returned %d for dev=%s ino=%ld\n",
1192                                        __func__, context, -rc,
1193                                        inode->i_sb->s_id, inode->i_ino);
1194                                 kfree(context);
1195                                 /* Leave with the unlabeled SID */
1196                                 rc = 0;
1197                                 break;
1198                         }
1199                 }
1200                 kfree(context);
1201                 isec->sid = sid;
1202                 break;
1203         case SECURITY_FS_USE_TASK:
1204                 isec->sid = isec->task_sid;
1205                 break;
1206         case SECURITY_FS_USE_TRANS:
1207                 /* Default to the fs SID. */
1208                 isec->sid = sbsec->sid;
1209
1210                 /* Try to obtain a transition SID. */
1211                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1212                 rc = security_transition_sid(isec->task_sid,
1213                                              sbsec->sid,
1214                                              isec->sclass,
1215                                              &sid);
1216                 if (rc)
1217                         goto out_unlock;
1218                 isec->sid = sid;
1219                 break;
1220         case SECURITY_FS_USE_MNTPOINT:
1221                 isec->sid = sbsec->mntpoint_sid;
1222                 break;
1223         default:
1224                 /* Default to the fs superblock SID. */
1225                 isec->sid = sbsec->sid;
1226
1227                 if (sbsec->proc) {
1228                         struct proc_inode *proci = PROC_I(inode);
1229                         if (proci->pde) {
1230                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1231                                 rc = selinux_proc_get_sid(proci->pde,
1232                                                           isec->sclass,
1233                                                           &sid);
1234                                 if (rc)
1235                                         goto out_unlock;
1236                                 isec->sid = sid;
1237                         }
1238                 }
1239                 break;
1240         }
1241
1242         isec->initialized = 1;
1243
1244 out_unlock:
1245         mutex_unlock(&isec->lock);
1246 out:
1247         if (isec->sclass == SECCLASS_FILE)
1248                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1249         return rc;
1250 }
1251
1252 /* Convert a Linux signal to an access vector. */
1253 static inline u32 signal_to_av(int sig)
1254 {
1255         u32 perm = 0;
1256
1257         switch (sig) {
1258         case SIGCHLD:
1259                 /* Commonly granted from child to parent. */
1260                 perm = PROCESS__SIGCHLD;
1261                 break;
1262         case SIGKILL:
1263                 /* Cannot be caught or ignored */
1264                 perm = PROCESS__SIGKILL;
1265                 break;
1266         case SIGSTOP:
1267                 /* Cannot be caught or ignored */
1268                 perm = PROCESS__SIGSTOP;
1269                 break;
1270         default:
1271                 /* All other signals. */
1272                 perm = PROCESS__SIGNAL;
1273                 break;
1274         }
1275
1276         return perm;
1277 }
1278
1279 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1280    fork check, ptrace check, etc. */
1281 static int task_has_perm(struct task_struct *tsk1,
1282                          struct task_struct *tsk2,
1283                          u32 perms)
1284 {
1285         struct task_security_struct *tsec1, *tsec2;
1286
1287         tsec1 = tsk1->security;
1288         tsec2 = tsk2->security;
1289         return avc_has_perm(tsec1->sid, tsec2->sid,
1290                             SECCLASS_PROCESS, perms, NULL);
1291 }
1292
1293 #if CAP_LAST_CAP > 63
1294 #error Fix SELinux to handle capabilities > 63.
1295 #endif
1296
1297 /* Check whether a task is allowed to use a capability. */
1298 static int task_has_capability(struct task_struct *tsk,
1299                                int cap)
1300 {
1301         struct task_security_struct *tsec;
1302         struct avc_audit_data ad;
1303         u16 sclass;
1304         u32 av = CAP_TO_MASK(cap);
1305
1306         tsec = tsk->security;
1307
1308         AVC_AUDIT_DATA_INIT(&ad,CAP);
1309         ad.tsk = tsk;
1310         ad.u.cap = cap;
1311
1312         switch (CAP_TO_INDEX(cap)) {
1313         case 0:
1314                 sclass = SECCLASS_CAPABILITY;
1315                 break;
1316         case 1:
1317                 sclass = SECCLASS_CAPABILITY2;
1318                 break;
1319         default:
1320                 printk(KERN_ERR
1321                        "SELinux:  out of range capability %d\n", cap);
1322                 BUG();
1323         }
1324         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1325 }
1326
1327 /* Check whether a task is allowed to use a system operation. */
1328 static int task_has_system(struct task_struct *tsk,
1329                            u32 perms)
1330 {
1331         struct task_security_struct *tsec;
1332
1333         tsec = tsk->security;
1334
1335         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1336                             SECCLASS_SYSTEM, perms, NULL);
1337 }
1338
1339 /* Check whether a task has a particular permission to an inode.
1340    The 'adp' parameter is optional and allows other audit
1341    data to be passed (e.g. the dentry). */
1342 static int inode_has_perm(struct task_struct *tsk,
1343                           struct inode *inode,
1344                           u32 perms,
1345                           struct avc_audit_data *adp)
1346 {
1347         struct task_security_struct *tsec;
1348         struct inode_security_struct *isec;
1349         struct avc_audit_data ad;
1350
1351         if (unlikely (IS_PRIVATE (inode)))
1352                 return 0;
1353
1354         tsec = tsk->security;
1355         isec = inode->i_security;
1356
1357         if (!adp) {
1358                 adp = &ad;
1359                 AVC_AUDIT_DATA_INIT(&ad, FS);
1360                 ad.u.fs.inode = inode;
1361         }
1362
1363         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1364 }
1365
1366 /* Same as inode_has_perm, but pass explicit audit data containing
1367    the dentry to help the auditing code to more easily generate the
1368    pathname if needed. */
1369 static inline int dentry_has_perm(struct task_struct *tsk,
1370                                   struct vfsmount *mnt,
1371                                   struct dentry *dentry,
1372                                   u32 av)
1373 {
1374         struct inode *inode = dentry->d_inode;
1375         struct avc_audit_data ad;
1376         AVC_AUDIT_DATA_INIT(&ad,FS);
1377         ad.u.fs.path.mnt = mnt;
1378         ad.u.fs.path.dentry = dentry;
1379         return inode_has_perm(tsk, inode, av, &ad);
1380 }
1381
1382 /* Check whether a task can use an open file descriptor to
1383    access an inode in a given way.  Check access to the
1384    descriptor itself, and then use dentry_has_perm to
1385    check a particular permission to the file.
1386    Access to the descriptor is implicitly granted if it
1387    has the same SID as the process.  If av is zero, then
1388    access to the file is not checked, e.g. for cases
1389    where only the descriptor is affected like seek. */
1390 static int file_has_perm(struct task_struct *tsk,
1391                                 struct file *file,
1392                                 u32 av)
1393 {
1394         struct task_security_struct *tsec = tsk->security;
1395         struct file_security_struct *fsec = file->f_security;
1396         struct inode *inode = file->f_path.dentry->d_inode;
1397         struct avc_audit_data ad;
1398         int rc;
1399
1400         AVC_AUDIT_DATA_INIT(&ad, FS);
1401         ad.u.fs.path = file->f_path;
1402
1403         if (tsec->sid != fsec->sid) {
1404                 rc = avc_has_perm(tsec->sid, fsec->sid,
1405                                   SECCLASS_FD,
1406                                   FD__USE,
1407                                   &ad);
1408                 if (rc)
1409                         return rc;
1410         }
1411
1412         /* av is zero if only checking access to the descriptor. */
1413         if (av)
1414                 return inode_has_perm(tsk, inode, av, &ad);
1415
1416         return 0;
1417 }
1418
1419 /* Check whether a task can create a file. */
1420 static int may_create(struct inode *dir,
1421                       struct dentry *dentry,
1422                       u16 tclass)
1423 {
1424         struct task_security_struct *tsec;
1425         struct inode_security_struct *dsec;
1426         struct superblock_security_struct *sbsec;
1427         u32 newsid;
1428         struct avc_audit_data ad;
1429         int rc;
1430
1431         tsec = current->security;
1432         dsec = dir->i_security;
1433         sbsec = dir->i_sb->s_security;
1434
1435         AVC_AUDIT_DATA_INIT(&ad, FS);
1436         ad.u.fs.path.dentry = dentry;
1437
1438         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1439                           DIR__ADD_NAME | DIR__SEARCH,
1440                           &ad);
1441         if (rc)
1442                 return rc;
1443
1444         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1445                 newsid = tsec->create_sid;
1446         } else {
1447                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1448                                              &newsid);
1449                 if (rc)
1450                         return rc;
1451         }
1452
1453         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1454         if (rc)
1455                 return rc;
1456
1457         return avc_has_perm(newsid, sbsec->sid,
1458                             SECCLASS_FILESYSTEM,
1459                             FILESYSTEM__ASSOCIATE, &ad);
1460 }
1461
1462 /* Check whether a task can create a key. */
1463 static int may_create_key(u32 ksid,
1464                           struct task_struct *ctx)
1465 {
1466         struct task_security_struct *tsec;
1467
1468         tsec = ctx->security;
1469
1470         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1471 }
1472
1473 #define MAY_LINK   0
1474 #define MAY_UNLINK 1
1475 #define MAY_RMDIR  2
1476
1477 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1478 static int may_link(struct inode *dir,
1479                     struct dentry *dentry,
1480                     int kind)
1481
1482 {
1483         struct task_security_struct *tsec;
1484         struct inode_security_struct *dsec, *isec;
1485         struct avc_audit_data ad;
1486         u32 av;
1487         int rc;
1488
1489         tsec = current->security;
1490         dsec = dir->i_security;
1491         isec = dentry->d_inode->i_security;
1492
1493         AVC_AUDIT_DATA_INIT(&ad, FS);
1494         ad.u.fs.path.dentry = dentry;
1495
1496         av = DIR__SEARCH;
1497         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1498         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1499         if (rc)
1500                 return rc;
1501
1502         switch (kind) {
1503         case MAY_LINK:
1504                 av = FILE__LINK;
1505                 break;
1506         case MAY_UNLINK:
1507                 av = FILE__UNLINK;
1508                 break;
1509         case MAY_RMDIR:
1510                 av = DIR__RMDIR;
1511                 break;
1512         default:
1513                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1514                         __func__, kind);
1515                 return 0;
1516         }
1517
1518         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1519         return rc;
1520 }
1521
1522 static inline int may_rename(struct inode *old_dir,
1523                              struct dentry *old_dentry,
1524                              struct inode *new_dir,
1525                              struct dentry *new_dentry)
1526 {
1527         struct task_security_struct *tsec;
1528         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1529         struct avc_audit_data ad;
1530         u32 av;
1531         int old_is_dir, new_is_dir;
1532         int rc;
1533
1534         tsec = current->security;
1535         old_dsec = old_dir->i_security;
1536         old_isec = old_dentry->d_inode->i_security;
1537         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1538         new_dsec = new_dir->i_security;
1539
1540         AVC_AUDIT_DATA_INIT(&ad, FS);
1541
1542         ad.u.fs.path.dentry = old_dentry;
1543         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1544                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1545         if (rc)
1546                 return rc;
1547         rc = avc_has_perm(tsec->sid, old_isec->sid,
1548                           old_isec->sclass, FILE__RENAME, &ad);
1549         if (rc)
1550                 return rc;
1551         if (old_is_dir && new_dir != old_dir) {
1552                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1553                                   old_isec->sclass, DIR__REPARENT, &ad);
1554                 if (rc)
1555                         return rc;
1556         }
1557
1558         ad.u.fs.path.dentry = new_dentry;
1559         av = DIR__ADD_NAME | DIR__SEARCH;
1560         if (new_dentry->d_inode)
1561                 av |= DIR__REMOVE_NAME;
1562         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1563         if (rc)
1564                 return rc;
1565         if (new_dentry->d_inode) {
1566                 new_isec = new_dentry->d_inode->i_security;
1567                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1568                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1569                                   new_isec->sclass,
1570                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1571                 if (rc)
1572                         return rc;
1573         }
1574
1575         return 0;
1576 }
1577
1578 /* Check whether a task can perform a filesystem operation. */
1579 static int superblock_has_perm(struct task_struct *tsk,
1580                                struct super_block *sb,
1581                                u32 perms,
1582                                struct avc_audit_data *ad)
1583 {
1584         struct task_security_struct *tsec;
1585         struct superblock_security_struct *sbsec;
1586
1587         tsec = tsk->security;
1588         sbsec = sb->s_security;
1589         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1590                             perms, ad);
1591 }
1592
1593 /* Convert a Linux mode and permission mask to an access vector. */
1594 static inline u32 file_mask_to_av(int mode, int mask)
1595 {
1596         u32 av = 0;
1597
1598         if ((mode & S_IFMT) != S_IFDIR) {
1599                 if (mask & MAY_EXEC)
1600                         av |= FILE__EXECUTE;
1601                 if (mask & MAY_READ)
1602                         av |= FILE__READ;
1603
1604                 if (mask & MAY_APPEND)
1605                         av |= FILE__APPEND;
1606                 else if (mask & MAY_WRITE)
1607                         av |= FILE__WRITE;
1608
1609         } else {
1610                 if (mask & MAY_EXEC)
1611                         av |= DIR__SEARCH;
1612                 if (mask & MAY_WRITE)
1613                         av |= DIR__WRITE;
1614                 if (mask & MAY_READ)
1615                         av |= DIR__READ;
1616         }
1617
1618         return av;
1619 }
1620
1621 /*
1622  * Convert a file mask to an access vector and include the correct open
1623  * open permission.
1624  */
1625 static inline u32 open_file_mask_to_av(int mode, int mask)
1626 {
1627         u32 av = file_mask_to_av(mode, mask);
1628
1629         if (selinux_policycap_openperm) {
1630                 /*
1631                  * lnk files and socks do not really have an 'open'
1632                  */
1633                 if (S_ISREG(mode))
1634                         av |= FILE__OPEN;
1635                 else if (S_ISCHR(mode))
1636                         av |= CHR_FILE__OPEN;
1637                 else if (S_ISBLK(mode))
1638                         av |= BLK_FILE__OPEN;
1639                 else if (S_ISFIFO(mode))
1640                         av |= FIFO_FILE__OPEN;
1641                 else if (S_ISDIR(mode))
1642                         av |= DIR__OPEN;
1643                 else
1644                         printk(KERN_ERR "SELinux: WARNING: inside %s with "
1645                                 "unknown mode:%x\n", __func__, mode);
1646         }
1647         return av;
1648 }
1649
1650 /* Convert a Linux file to an access vector. */
1651 static inline u32 file_to_av(struct file *file)
1652 {
1653         u32 av = 0;
1654
1655         if (file->f_mode & FMODE_READ)
1656                 av |= FILE__READ;
1657         if (file->f_mode & FMODE_WRITE) {
1658                 if (file->f_flags & O_APPEND)
1659                         av |= FILE__APPEND;
1660                 else
1661                         av |= FILE__WRITE;
1662         }
1663         if (!av) {
1664                 /*
1665                  * Special file opened with flags 3 for ioctl-only use.
1666                  */
1667                 av = FILE__IOCTL;
1668         }
1669
1670         return av;
1671 }
1672
1673 /* Hook functions begin here. */
1674
1675 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1676 {
1677         int rc;
1678
1679         rc = secondary_ops->ptrace(parent,child);
1680         if (rc)
1681                 return rc;
1682
1683         return task_has_perm(parent, child, PROCESS__PTRACE);
1684 }
1685
1686 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1687                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1688 {
1689         int error;
1690
1691         error = task_has_perm(current, target, PROCESS__GETCAP);
1692         if (error)
1693                 return error;
1694
1695         return secondary_ops->capget(target, effective, inheritable, permitted);
1696 }
1697
1698 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1699                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1700 {
1701         int error;
1702
1703         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1704         if (error)
1705                 return error;
1706
1707         return task_has_perm(current, target, PROCESS__SETCAP);
1708 }
1709
1710 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1711                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1712 {
1713         secondary_ops->capset_set(target, effective, inheritable, permitted);
1714 }
1715
1716 static int selinux_capable(struct task_struct *tsk, int cap)
1717 {
1718         int rc;
1719
1720         rc = secondary_ops->capable(tsk, cap);
1721         if (rc)
1722                 return rc;
1723
1724         return task_has_capability(tsk,cap);
1725 }
1726
1727 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1728 {
1729         int buflen, rc;
1730         char *buffer, *path, *end;
1731
1732         rc = -ENOMEM;
1733         buffer = (char*)__get_free_page(GFP_KERNEL);
1734         if (!buffer)
1735                 goto out;
1736
1737         buflen = PAGE_SIZE;
1738         end = buffer+buflen;
1739         *--end = '\0';
1740         buflen--;
1741         path = end-1;
1742         *path = '/';
1743         while (table) {
1744                 const char *name = table->procname;
1745                 size_t namelen = strlen(name);
1746                 buflen -= namelen + 1;
1747                 if (buflen < 0)
1748                         goto out_free;
1749                 end -= namelen;
1750                 memcpy(end, name, namelen);
1751                 *--end = '/';
1752                 path = end;
1753                 table = table->parent;
1754         }
1755         buflen -= 4;
1756         if (buflen < 0)
1757                 goto out_free;
1758         end -= 4;
1759         memcpy(end, "/sys", 4);
1760         path = end;
1761         rc = security_genfs_sid("proc", path, tclass, sid);
1762 out_free:
1763         free_page((unsigned long)buffer);
1764 out:
1765         return rc;
1766 }
1767
1768 static int selinux_sysctl(ctl_table *table, int op)
1769 {
1770         int error = 0;
1771         u32 av;
1772         struct task_security_struct *tsec;
1773         u32 tsid;
1774         int rc;
1775
1776         rc = secondary_ops->sysctl(table, op);
1777         if (rc)
1778                 return rc;
1779
1780         tsec = current->security;
1781
1782         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1783                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1784         if (rc) {
1785                 /* Default to the well-defined sysctl SID. */
1786                 tsid = SECINITSID_SYSCTL;
1787         }
1788
1789         /* The op values are "defined" in sysctl.c, thereby creating
1790          * a bad coupling between this module and sysctl.c */
1791         if(op == 001) {
1792                 error = avc_has_perm(tsec->sid, tsid,
1793                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1794         } else {
1795                 av = 0;
1796                 if (op & 004)
1797                         av |= FILE__READ;
1798                 if (op & 002)
1799                         av |= FILE__WRITE;
1800                 if (av)
1801                         error = avc_has_perm(tsec->sid, tsid,
1802                                              SECCLASS_FILE, av, NULL);
1803         }
1804
1805         return error;
1806 }
1807
1808 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1809 {
1810         int rc = 0;
1811
1812         if (!sb)
1813                 return 0;
1814
1815         switch (cmds) {
1816                 case Q_SYNC:
1817                 case Q_QUOTAON:
1818                 case Q_QUOTAOFF:
1819                 case Q_SETINFO:
1820                 case Q_SETQUOTA:
1821                         rc = superblock_has_perm(current,
1822                                                  sb,
1823                                                  FILESYSTEM__QUOTAMOD, NULL);
1824                         break;
1825                 case Q_GETFMT:
1826                 case Q_GETINFO:
1827                 case Q_GETQUOTA:
1828                         rc = superblock_has_perm(current,
1829                                                  sb,
1830                                                  FILESYSTEM__QUOTAGET, NULL);
1831                         break;
1832                 default:
1833                         rc = 0;  /* let the kernel handle invalid cmds */
1834                         break;
1835         }
1836         return rc;
1837 }
1838
1839 static int selinux_quota_on(struct dentry *dentry)
1840 {
1841         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1842 }
1843
1844 static int selinux_syslog(int type)
1845 {
1846         int rc;
1847
1848         rc = secondary_ops->syslog(type);
1849         if (rc)
1850                 return rc;
1851
1852         switch (type) {
1853                 case 3:         /* Read last kernel messages */
1854                 case 10:        /* Return size of the log buffer */
1855                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1856                         break;
1857                 case 6:         /* Disable logging to console */
1858                 case 7:         /* Enable logging to console */
1859                 case 8:         /* Set level of messages printed to console */
1860                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1861                         break;
1862                 case 0:         /* Close log */
1863                 case 1:         /* Open log */
1864                 case 2:         /* Read from log */
1865                 case 4:         /* Read/clear last kernel messages */
1866                 case 5:         /* Clear ring buffer */
1867                 default:
1868                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1869                         break;
1870         }
1871         return rc;
1872 }
1873
1874 /*
1875  * Check that a process has enough memory to allocate a new virtual
1876  * mapping. 0 means there is enough memory for the allocation to
1877  * succeed and -ENOMEM implies there is not.
1878  *
1879  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1880  * if the capability is granted, but __vm_enough_memory requires 1 if
1881  * the capability is granted.
1882  *
1883  * Do not audit the selinux permission check, as this is applied to all
1884  * processes that allocate mappings.
1885  */
1886 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1887 {
1888         int rc, cap_sys_admin = 0;
1889         struct task_security_struct *tsec = current->security;
1890
1891         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1892         if (rc == 0)
1893                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1894                                           SECCLASS_CAPABILITY,
1895                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1896                                           0,
1897                                           NULL);
1898
1899         if (rc == 0)
1900                 cap_sys_admin = 1;
1901
1902         return __vm_enough_memory(mm, pages, cap_sys_admin);
1903 }
1904
1905 /**
1906  * task_tracer_task - return the task that is tracing the given task
1907  * @task:               task to consider
1908  *
1909  * Returns NULL if noone is tracing @task, or the &struct task_struct
1910  * pointer to its tracer.
1911  *
1912  * Must be called under rcu_read_lock().
1913  */
1914 static struct task_struct *task_tracer_task(struct task_struct *task)
1915 {
1916         if (task->ptrace & PT_PTRACED)
1917                 return rcu_dereference(task->parent);
1918         return NULL;
1919 }
1920
1921 /* binprm security operations */
1922
1923 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1924 {
1925         struct bprm_security_struct *bsec;
1926
1927         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1928         if (!bsec)
1929                 return -ENOMEM;
1930
1931         bsec->sid = SECINITSID_UNLABELED;
1932         bsec->set = 0;
1933
1934         bprm->security = bsec;
1935         return 0;
1936 }
1937
1938 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1939 {
1940         struct task_security_struct *tsec;
1941         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1942         struct inode_security_struct *isec;
1943         struct bprm_security_struct *bsec;
1944         u32 newsid;
1945         struct avc_audit_data ad;
1946         int rc;
1947
1948         rc = secondary_ops->bprm_set_security(bprm);
1949         if (rc)
1950                 return rc;
1951
1952         bsec = bprm->security;
1953
1954         if (bsec->set)
1955                 return 0;
1956
1957         tsec = current->security;
1958         isec = inode->i_security;
1959
1960         /* Default to the current task SID. */
1961         bsec->sid = tsec->sid;
1962
1963         /* Reset fs, key, and sock SIDs on execve. */
1964         tsec->create_sid = 0;
1965         tsec->keycreate_sid = 0;
1966         tsec->sockcreate_sid = 0;
1967
1968         if (tsec->exec_sid) {
1969                 newsid = tsec->exec_sid;
1970                 /* Reset exec SID on execve. */
1971                 tsec->exec_sid = 0;
1972         } else {
1973                 /* Check for a default transition on this program. */
1974                 rc = security_transition_sid(tsec->sid, isec->sid,
1975                                              SECCLASS_PROCESS, &newsid);
1976                 if (rc)
1977                         return rc;
1978         }
1979
1980         AVC_AUDIT_DATA_INIT(&ad, FS);
1981         ad.u.fs.path = bprm->file->f_path;
1982
1983         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1984                 newsid = tsec->sid;
1985
1986         if (tsec->sid == newsid) {
1987                 rc = avc_has_perm(tsec->sid, isec->sid,
1988                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1989                 if (rc)
1990                         return rc;
1991         } else {
1992                 /* Check permissions for the transition. */
1993                 rc = avc_has_perm(tsec->sid, newsid,
1994                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1995                 if (rc)
1996                         return rc;
1997
1998                 rc = avc_has_perm(newsid, isec->sid,
1999                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2000                 if (rc)
2001                         return rc;
2002
2003                 /* Clear any possibly unsafe personality bits on exec: */
2004                 current->personality &= ~PER_CLEAR_ON_SETID;
2005
2006                 /* Set the security field to the new SID. */
2007                 bsec->sid = newsid;
2008         }
2009
2010         bsec->set = 1;
2011         return 0;
2012 }
2013
2014 static int selinux_bprm_check_security (struct linux_binprm *bprm)
2015 {
2016         return secondary_ops->bprm_check_security(bprm);
2017 }
2018
2019
2020 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
2021 {
2022         struct task_security_struct *tsec = current->security;
2023         int atsecure = 0;
2024
2025         if (tsec->osid != tsec->sid) {
2026                 /* Enable secure mode for SIDs transitions unless
2027                    the noatsecure permission is granted between
2028                    the two SIDs, i.e. ahp returns 0. */
2029                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2030                                          SECCLASS_PROCESS,
2031                                          PROCESS__NOATSECURE, NULL);
2032         }
2033
2034         return (atsecure || secondary_ops->bprm_secureexec(bprm));
2035 }
2036
2037 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2038 {
2039         kfree(bprm->security);
2040         bprm->security = NULL;
2041 }
2042
2043 extern struct vfsmount *selinuxfs_mount;
2044 extern struct dentry *selinux_null;
2045
2046 /* Derived from fs/exec.c:flush_old_files. */
2047 static inline void flush_unauthorized_files(struct files_struct * files)
2048 {
2049         struct avc_audit_data ad;
2050         struct file *file, *devnull = NULL;
2051         struct tty_struct *tty;
2052         struct fdtable *fdt;
2053         long j = -1;
2054         int drop_tty = 0;
2055
2056         mutex_lock(&tty_mutex);
2057         tty = get_current_tty();
2058         if (tty) {
2059                 file_list_lock();
2060                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2061                 if (file) {
2062                         /* Revalidate access to controlling tty.
2063                            Use inode_has_perm on the tty inode directly rather
2064                            than using file_has_perm, as this particular open
2065                            file may belong to another process and we are only
2066                            interested in the inode-based check here. */
2067                         struct inode *inode = file->f_path.dentry->d_inode;
2068                         if (inode_has_perm(current, inode,
2069                                            FILE__READ | FILE__WRITE, NULL)) {
2070                                 drop_tty = 1;
2071                         }
2072                 }
2073                 file_list_unlock();
2074         }
2075         mutex_unlock(&tty_mutex);
2076         /* Reset controlling tty. */
2077         if (drop_tty)
2078                 no_tty();
2079
2080         /* Revalidate access to inherited open files. */
2081
2082         AVC_AUDIT_DATA_INIT(&ad,FS);
2083
2084         spin_lock(&files->file_lock);
2085         for (;;) {
2086                 unsigned long set, i;
2087                 int fd;
2088
2089                 j++;
2090                 i = j * __NFDBITS;
2091                 fdt = files_fdtable(files);
2092                 if (i >= fdt->max_fds)
2093                         break;
2094                 set = fdt->open_fds->fds_bits[j];
2095                 if (!set)
2096                         continue;
2097                 spin_unlock(&files->file_lock);
2098                 for ( ; set ; i++,set >>= 1) {
2099                         if (set & 1) {
2100                                 file = fget(i);
2101                                 if (!file)
2102                                         continue;
2103                                 if (file_has_perm(current,
2104                                                   file,
2105                                                   file_to_av(file))) {
2106                                         sys_close(i);
2107                                         fd = get_unused_fd();
2108                                         if (fd != i) {
2109                                                 if (fd >= 0)
2110                                                         put_unused_fd(fd);
2111                                                 fput(file);
2112                                                 continue;
2113                                         }
2114                                         if (devnull) {
2115                                                 get_file(devnull);
2116                                         } else {
2117                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2118                                                 if (IS_ERR(devnull)) {
2119                                                         devnull = NULL;
2120                                                         put_unused_fd(fd);
2121                                                         fput(file);
2122                                                         continue;
2123                                                 }
2124                                         }
2125                                         fd_install(fd, devnull);
2126                                 }
2127                                 fput(file);
2128                         }
2129                 }
2130                 spin_lock(&files->file_lock);
2131
2132         }
2133         spin_unlock(&files->file_lock);
2134 }
2135
2136 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2137 {
2138         struct task_security_struct *tsec;
2139         struct bprm_security_struct *bsec;
2140         u32 sid;
2141         int rc;
2142
2143         secondary_ops->bprm_apply_creds(bprm, unsafe);
2144
2145         tsec = current->security;
2146
2147         bsec = bprm->security;
2148         sid = bsec->sid;
2149
2150         tsec->osid = tsec->sid;
2151         bsec->unsafe = 0;
2152         if (tsec->sid != sid) {
2153                 /* Check for shared state.  If not ok, leave SID
2154                    unchanged and kill. */
2155                 if (unsafe & LSM_UNSAFE_SHARE) {
2156                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2157                                         PROCESS__SHARE, NULL);
2158                         if (rc) {
2159                                 bsec->unsafe = 1;
2160                                 return;
2161                         }
2162                 }
2163
2164                 /* Check for ptracing, and update the task SID if ok.
2165                    Otherwise, leave SID unchanged and kill. */
2166                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2167                         struct task_struct *tracer;
2168                         struct task_security_struct *sec;
2169                         u32 ptsid = 0;
2170
2171                         rcu_read_lock();
2172                         tracer = task_tracer_task(current);
2173                         if (likely(tracer != NULL)) {
2174                                 sec = tracer->security;
2175                                 ptsid = sec->sid;
2176                         }
2177                         rcu_read_unlock();
2178
2179                         if (ptsid != 0) {
2180                                 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2181                                                   PROCESS__PTRACE, NULL);
2182                                 if (rc) {
2183                                         bsec->unsafe = 1;
2184                                         return;
2185                                 }
2186                         }
2187                 }
2188                 tsec->sid = sid;
2189         }
2190 }
2191
2192 /*
2193  * called after apply_creds without the task lock held
2194  */
2195 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2196 {
2197         struct task_security_struct *tsec;
2198         struct rlimit *rlim, *initrlim;
2199         struct itimerval itimer;
2200         struct bprm_security_struct *bsec;
2201         int rc, i;
2202
2203         tsec = current->security;
2204         bsec = bprm->security;
2205
2206         if (bsec->unsafe) {
2207                 force_sig_specific(SIGKILL, current);
2208                 return;
2209         }
2210         if (tsec->osid == tsec->sid)
2211                 return;
2212
2213         /* Close files for which the new task SID is not authorized. */
2214         flush_unauthorized_files(current->files);
2215
2216         /* Check whether the new SID can inherit signal state
2217            from the old SID.  If not, clear itimers to avoid
2218            subsequent signal generation and flush and unblock
2219            signals. This must occur _after_ the task SID has
2220           been updated so that any kill done after the flush
2221           will be checked against the new SID. */
2222         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2223                           PROCESS__SIGINH, NULL);
2224         if (rc) {
2225                 memset(&itimer, 0, sizeof itimer);
2226                 for (i = 0; i < 3; i++)
2227                         do_setitimer(i, &itimer, NULL);
2228                 flush_signals(current);
2229                 spin_lock_irq(&current->sighand->siglock);
2230                 flush_signal_handlers(current, 1);
2231                 sigemptyset(&current->blocked);
2232                 recalc_sigpending();
2233                 spin_unlock_irq(&current->sighand->siglock);
2234         }
2235
2236         /* Always clear parent death signal on SID transitions. */
2237         current->pdeath_signal = 0;
2238
2239         /* Check whether the new SID can inherit resource limits
2240            from the old SID.  If not, reset all soft limits to
2241            the lower of the current task's hard limit and the init
2242            task's soft limit.  Note that the setting of hard limits
2243            (even to lower them) can be controlled by the setrlimit
2244            check. The inclusion of the init task's soft limit into
2245            the computation is to avoid resetting soft limits higher
2246            than the default soft limit for cases where the default
2247            is lower than the hard limit, e.g. RLIMIT_CORE or
2248            RLIMIT_STACK.*/
2249         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2250                           PROCESS__RLIMITINH, NULL);
2251         if (rc) {
2252                 for (i = 0; i < RLIM_NLIMITS; i++) {
2253                         rlim = current->signal->rlim + i;
2254                         initrlim = init_task.signal->rlim+i;
2255                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2256                 }
2257                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2258                         /*
2259                          * This will cause RLIMIT_CPU calculations
2260                          * to be refigured.
2261                          */
2262                         current->it_prof_expires = jiffies_to_cputime(1);
2263                 }
2264         }
2265
2266         /* Wake up the parent if it is waiting so that it can
2267            recheck wait permission to the new task SID. */
2268         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2269 }
2270
2271 /* superblock security operations */
2272
2273 static int selinux_sb_alloc_security(struct super_block *sb)
2274 {
2275         return superblock_alloc_security(sb);
2276 }
2277
2278 static void selinux_sb_free_security(struct super_block *sb)
2279 {
2280         superblock_free_security(sb);
2281 }
2282
2283 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2284 {
2285         if (plen > olen)
2286                 return 0;
2287
2288         return !memcmp(prefix, option, plen);
2289 }
2290
2291 static inline int selinux_option(char *option, int len)
2292 {
2293         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2294                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2295                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2296                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2297 }
2298
2299 static inline void take_option(char **to, char *from, int *first, int len)
2300 {
2301         if (!*first) {
2302                 **to = ',';
2303                 *to += 1;
2304         } else
2305                 *first = 0;
2306         memcpy(*to, from, len);
2307         *to += len;
2308 }
2309
2310 static inline void take_selinux_option(char **to, char *from, int *first,
2311                                        int len)
2312 {
2313         int current_size = 0;
2314
2315         if (!*first) {
2316                 **to = '|';
2317                 *to += 1;
2318         }
2319         else
2320                 *first = 0;
2321
2322         while (current_size < len) {
2323                 if (*from != '"') {
2324                         **to = *from;
2325                         *to += 1;
2326                 }
2327                 from += 1;
2328                 current_size += 1;
2329         }
2330 }
2331
2332 static int selinux_sb_copy_data(char *orig, char *copy)
2333 {
2334         int fnosec, fsec, rc = 0;
2335         char *in_save, *in_curr, *in_end;
2336         char *sec_curr, *nosec_save, *nosec;
2337         int open_quote = 0;
2338
2339         in_curr = orig;
2340         sec_curr = copy;
2341
2342         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2343         if (!nosec) {
2344                 rc = -ENOMEM;
2345                 goto out;
2346         }
2347
2348         nosec_save = nosec;
2349         fnosec = fsec = 1;
2350         in_save = in_end = orig;
2351
2352         do {
2353                 if (*in_end == '"')
2354                         open_quote = !open_quote;
2355                 if ((*in_end == ',' && open_quote == 0) ||
2356                                 *in_end == '\0') {
2357                         int len = in_end - in_curr;
2358
2359                         if (selinux_option(in_curr, len))
2360                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2361                         else
2362                                 take_option(&nosec, in_curr, &fnosec, len);
2363
2364                         in_curr = in_end + 1;
2365                 }
2366         } while (*in_end++);
2367
2368         strcpy(in_save, nosec_save);
2369         free_page((unsigned long)nosec_save);
2370 out:
2371         return rc;
2372 }
2373
2374 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2375 {
2376         struct avc_audit_data ad;
2377         int rc;
2378
2379         rc = superblock_doinit(sb, data);
2380         if (rc)
2381                 return rc;
2382
2383         AVC_AUDIT_DATA_INIT(&ad,FS);
2384         ad.u.fs.path.dentry = sb->s_root;
2385         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2386 }
2387
2388 static int selinux_sb_statfs(struct dentry *dentry)
2389 {
2390         struct avc_audit_data ad;
2391
2392         AVC_AUDIT_DATA_INIT(&ad,FS);
2393         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2394         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2395 }
2396
2397 static int selinux_mount(char * dev_name,
2398                          struct nameidata *nd,
2399                          char * type,
2400                          unsigned long flags,
2401                          void * data)
2402 {
2403         int rc;
2404
2405         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2406         if (rc)
2407                 return rc;
2408
2409         if (flags & MS_REMOUNT)
2410                 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2411                                            FILESYSTEM__REMOUNT, NULL);
2412         else
2413                 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2414                                        FILE__MOUNTON);
2415 }
2416
2417 static int selinux_umount(struct vfsmount *mnt, int flags)
2418 {
2419         int rc;
2420
2421         rc = secondary_ops->sb_umount(mnt, flags);
2422         if (rc)
2423                 return rc;
2424
2425         return superblock_has_perm(current,mnt->mnt_sb,
2426                                    FILESYSTEM__UNMOUNT,NULL);
2427 }
2428
2429 /* inode security operations */
2430
2431 static int selinux_inode_alloc_security(struct inode *inode)
2432 {
2433         return inode_alloc_security(inode);
2434 }
2435
2436 static void selinux_inode_free_security(struct inode *inode)
2437 {
2438         inode_free_security(inode);
2439 }
2440
2441 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2442                                        char **name, void **value,
2443                                        size_t *len)
2444 {
2445         struct task_security_struct *tsec;
2446         struct inode_security_struct *dsec;
2447         struct superblock_security_struct *sbsec;
2448         u32 newsid, clen;
2449         int rc;
2450         char *namep = NULL, *context;
2451
2452         tsec = current->security;
2453         dsec = dir->i_security;
2454         sbsec = dir->i_sb->s_security;
2455
2456         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2457                 newsid = tsec->create_sid;
2458         } else {
2459                 rc = security_transition_sid(tsec->sid, dsec->sid,
2460                                              inode_mode_to_security_class(inode->i_mode),
2461                                              &newsid);
2462                 if (rc) {
2463                         printk(KERN_WARNING "%s:  "
2464                                "security_transition_sid failed, rc=%d (dev=%s "
2465                                "ino=%ld)\n",
2466                                __func__,
2467                                -rc, inode->i_sb->s_id, inode->i_ino);
2468                         return rc;
2469                 }
2470         }
2471
2472         /* Possibly defer initialization to selinux_complete_init. */
2473         if (sbsec->initialized) {
2474                 struct inode_security_struct *isec = inode->i_security;
2475                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2476                 isec->sid = newsid;
2477                 isec->initialized = 1;
2478         }
2479
2480         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2481                 return -EOPNOTSUPP;
2482
2483         if (name) {
2484                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2485                 if (!namep)
2486                         return -ENOMEM;
2487                 *name = namep;
2488         }
2489
2490         if (value && len) {
2491                 rc = security_sid_to_context(newsid, &context, &clen);
2492                 if (rc) {
2493                         kfree(namep);
2494                         return rc;
2495                 }
2496                 *value = context;
2497                 *len = clen;
2498         }
2499
2500         return 0;
2501 }
2502
2503 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2504 {
2505         return may_create(dir, dentry, SECCLASS_FILE);
2506 }
2507
2508 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2509 {
2510         int rc;
2511
2512         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2513         if (rc)
2514                 return rc;
2515         return may_link(dir, old_dentry, MAY_LINK);
2516 }
2517
2518 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2519 {
2520         int rc;
2521
2522         rc = secondary_ops->inode_unlink(dir, dentry);
2523         if (rc)
2524                 return rc;
2525         return may_link(dir, dentry, MAY_UNLINK);
2526 }
2527
2528 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2529 {
2530         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2531 }
2532
2533 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2534 {
2535         return may_create(dir, dentry, SECCLASS_DIR);
2536 }
2537
2538 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2539 {
2540         return may_link(dir, dentry, MAY_RMDIR);
2541 }
2542
2543 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2544 {
2545         int rc;
2546
2547         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2548         if (rc)
2549                 return rc;
2550
2551         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2552 }
2553
2554 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2555                                 struct inode *new_inode, struct dentry *new_dentry)
2556 {
2557         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2558 }
2559
2560 static int selinux_inode_readlink(struct dentry *dentry)
2561 {
2562         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2563 }
2564
2565 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2566 {
2567         int rc;
2568
2569         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2570         if (rc)
2571                 return rc;
2572         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2573 }
2574
2575 static int selinux_inode_permission(struct inode *inode, int mask,
2576                                     struct nameidata *nd)
2577 {
2578         int rc;
2579
2580         rc = secondary_ops->inode_permission(inode, mask, nd);
2581         if (rc)
2582                 return rc;
2583
2584         if (!mask) {
2585                 /* No permission to check.  Existence test. */
2586                 return 0;
2587         }
2588
2589         return inode_has_perm(current, inode,
2590                                open_file_mask_to_av(inode->i_mode, mask), NULL);
2591 }
2592
2593 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2594 {
2595         int rc;
2596
2597         rc = secondary_ops->inode_setattr(dentry, iattr);
2598         if (rc)
2599                 return rc;
2600
2601         if (iattr->ia_valid & ATTR_FORCE)
2602                 return 0;
2603
2604         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2605                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2606                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2607
2608         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2609 }
2610
2611 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2612 {
2613         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2614 }
2615
2616 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2617 {
2618         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2619                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2620                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2621                         if (!capable(CAP_SETFCAP))
2622                                 return -EPERM;
2623                 } else if (!capable(CAP_SYS_ADMIN)) {
2624                         /* A different attribute in the security namespace.
2625                            Restrict to administrator. */
2626                         return -EPERM;
2627                 }
2628         }
2629
2630         /* Not an attribute we recognize, so just check the
2631            ordinary setattr permission. */
2632         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2633 }
2634
2635 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2636 {
2637         struct task_security_struct *tsec = current->security;
2638         struct inode *inode = dentry->d_inode;
2639         struct inode_security_struct *isec = inode->i_security;
2640         struct superblock_security_struct *sbsec;
2641         struct avc_audit_data ad;
2642         u32 newsid;
2643         int rc = 0;
2644
2645         if (strcmp(name, XATTR_NAME_SELINUX))
2646                 return selinux_inode_setotherxattr(dentry, name);
2647
2648         sbsec = inode->i_sb->s_security;
2649         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2650                 return -EOPNOTSUPP;
2651
2652         if (!is_owner_or_cap(inode))
2653                 return -EPERM;
2654
2655         AVC_AUDIT_DATA_INIT(&ad,FS);
2656         ad.u.fs.path.dentry = dentry;
2657
2658         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2659                           FILE__RELABELFROM, &ad);
2660         if (rc)
2661                 return rc;
2662
2663         rc = security_context_to_sid(value, size, &newsid);
2664         if (rc)
2665                 return rc;
2666
2667         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2668                           FILE__RELABELTO, &ad);
2669         if (rc)
2670                 return rc;
2671
2672         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2673                                           isec->sclass);
2674         if (rc)
2675                 return rc;
2676
2677         return avc_has_perm(newsid,
2678                             sbsec->sid,
2679                             SECCLASS_FILESYSTEM,
2680                             FILESYSTEM__ASSOCIATE,
2681                             &ad);
2682 }
2683
2684 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2685                                         void *value, size_t size, int flags)
2686 {
2687         struct inode *inode = dentry->d_inode;
2688         struct inode_security_struct *isec = inode->i_security;
2689         u32 newsid;
2690         int rc;
2691
2692         if (strcmp(name, XATTR_NAME_SELINUX)) {
2693                 /* Not an attribute we recognize, so nothing to do. */
2694                 return;
2695         }
2696
2697         rc = security_context_to_sid(value, size, &newsid);
2698         if (rc) {
2699                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2700                        "%s, rc=%d\n", __func__, (char *)value, -rc);
2701                 return;
2702         }
2703
2704         isec->sid = newsid;
2705         return;
2706 }
2707
2708 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2709 {
2710         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2711 }
2712
2713 static int selinux_inode_listxattr (struct dentry *dentry)
2714 {
2715         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2716 }
2717
2718 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2719 {
2720         if (strcmp(name, XATTR_NAME_SELINUX))
2721                 return selinux_inode_setotherxattr(dentry, name);
2722
2723         /* No one is allowed to remove a SELinux security label.
2724            You can change the label, but all data must be labeled. */
2725         return -EACCES;
2726 }
2727
2728 /*
2729  * Copy the in-core inode security context value to the user.  If the
2730  * getxattr() prior to this succeeded, check to see if we need to
2731  * canonicalize the value to be finally returned to the user.
2732  *
2733  * Permission check is handled by selinux_inode_getxattr hook.
2734  */
2735 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2736 {
2737         u32 size;
2738         int error;
2739         char *context = NULL;
2740         struct inode_security_struct *isec = inode->i_security;
2741
2742         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2743                 return -EOPNOTSUPP;
2744
2745         error = security_sid_to_context(isec->sid, &context, &size);
2746         if (error)
2747                 return error;
2748         error = size;
2749         if (alloc) {
2750                 *buffer = context;
2751                 goto out_nofree;
2752         }
2753         kfree(context);
2754 out_nofree:
2755         return error;
2756 }
2757
2758 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2759                                      const void *value, size_t size, int flags)
2760 {
2761         struct inode_security_struct *isec = inode->i_security;
2762         u32 newsid;
2763         int rc;
2764
2765         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2766                 return -EOPNOTSUPP;
2767
2768         if (!value || !size)
2769                 return -EACCES;
2770
2771         rc = security_context_to_sid((void*)value, size, &newsid);
2772         if (rc)
2773                 return rc;
2774
2775         isec->sid = newsid;
2776         return 0;
2777 }
2778
2779 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2780 {
2781         const int len = sizeof(XATTR_NAME_SELINUX);
2782         if (buffer && len <= buffer_size)
2783                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2784         return len;
2785 }
2786
2787 static int selinux_inode_need_killpriv(struct dentry *dentry)
2788 {
2789         return secondary_ops->inode_need_killpriv(dentry);
2790 }
2791
2792 static int selinux_inode_killpriv(struct dentry *dentry)
2793 {
2794         return secondary_ops->inode_killpriv(dentry);
2795 }
2796
2797 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2798 {
2799         struct inode_security_struct *isec = inode->i_security;
2800         *secid = isec->sid;
2801 }
2802
2803 /* file security operations */
2804
2805 static int selinux_revalidate_file_permission(struct file *file, int mask)
2806 {
2807         int rc;
2808         struct inode *inode = file->f_path.dentry->d_inode;
2809
2810         if (!mask) {
2811                 /* No permission to check.  Existence test. */
2812                 return 0;
2813         }
2814
2815         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2816         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2817                 mask |= MAY_APPEND;
2818
2819         rc = file_has_perm(current, file,
2820                            file_mask_to_av(inode->i_mode, mask));
2821         if (rc)
2822                 return rc;
2823
2824         return selinux_netlbl_inode_permission(inode, mask);
2825 }
2826
2827 static int selinux_file_permission(struct file *file, int mask)
2828 {
2829         struct inode *inode = file->f_path.dentry->d_inode;
2830         struct task_security_struct *tsec = current->security;
2831         struct file_security_struct *fsec = file->f_security;
2832         struct inode_security_struct *isec = inode->i_security;
2833
2834         if (!mask) {
2835                 /* No permission to check.  Existence test. */
2836                 return 0;
2837         }
2838
2839         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2840             && fsec->pseqno == avc_policy_seqno())
2841                 return selinux_netlbl_inode_permission(inode, mask);
2842
2843         return selinux_revalidate_file_permission(file, mask);
2844 }
2845
2846 static int selinux_file_alloc_security(struct file *file)
2847 {
2848         return file_alloc_security(file);
2849 }
2850
2851 static void selinux_file_free_security(struct file *file)
2852 {
2853         file_free_security(file);
2854 }
2855
2856 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2857                               unsigned long arg)
2858 {
2859         int error = 0;
2860
2861         switch (cmd) {
2862                 case FIONREAD:
2863                 /* fall through */
2864                 case FIBMAP:
2865                 /* fall through */
2866                 case FIGETBSZ:
2867                 /* fall through */
2868                 case EXT2_IOC_GETFLAGS:
2869                 /* fall through */
2870                 case EXT2_IOC_GETVERSION:
2871                         error = file_has_perm(current, file, FILE__GETATTR);
2872                         break;
2873
2874                 case EXT2_IOC_SETFLAGS:
2875                 /* fall through */
2876                 case EXT2_IOC_SETVERSION:
2877                         error = file_has_perm(current, file, FILE__SETATTR);
2878                         break;
2879
2880                 /* sys_ioctl() checks */
2881                 case FIONBIO:
2882                 /* fall through */
2883                 case FIOASYNC:
2884                         error = file_has_perm(current, file, 0);
2885                         break;
2886
2887                 case KDSKBENT:
2888                 case KDSKBSENT:
2889                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2890                         break;
2891
2892                 /* default case assumes that the command will go
2893                  * to the file's ioctl() function.
2894                  */
2895                 default:
2896                         error = file_has_perm(current, file, FILE__IOCTL);
2897
2898         }
2899         return error;
2900 }
2901
2902 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2903 {
2904 #ifndef CONFIG_PPC32
2905         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2906                 /*
2907                  * We are making executable an anonymous mapping or a
2908                  * private file mapping that will also be writable.
2909                  * This has an additional check.
2910                  */
2911                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2912                 if (rc)
2913                         return rc;
2914         }
2915 #endif
2916
2917         if (file) {
2918                 /* read access is always possible with a mapping */
2919                 u32 av = FILE__READ;
2920
2921                 /* write access only matters if the mapping is shared */
2922                 if (shared && (prot & PROT_WRITE))
2923                         av |= FILE__WRITE;
2924
2925                 if (prot & PROT_EXEC)
2926                         av |= FILE__EXECUTE;
2927
2928                 return file_has_perm(current, file, av);
2929         }
2930         return 0;
2931 }
2932
2933 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2934                              unsigned long prot, unsigned long flags,
2935                              unsigned long addr, unsigned long addr_only)
2936 {
2937         int rc = 0;
2938         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2939
2940         if (addr < mmap_min_addr)
2941                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2942                                   MEMPROTECT__MMAP_ZERO, NULL);
2943         if (rc || addr_only)
2944                 return rc;
2945
2946         if (selinux_checkreqprot)
2947                 prot = reqprot;
2948
2949         return file_map_prot_check(file, prot,
2950                                    (flags & MAP_TYPE) == MAP_SHARED);
2951 }
2952
2953 static int selinux_file_mprotect(struct vm_area_struct *vma,
2954                                  unsigned long reqprot,
2955                                  unsigned long prot)
2956 {
2957         int rc;
2958
2959         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2960         if (rc)
2961                 return rc;
2962
2963         if (selinux_checkreqprot)
2964                 prot = reqprot;
2965
2966 #ifndef CONFIG_PPC32
2967         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2968                 rc = 0;
2969                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2970                     vma->vm_end <= vma->vm_mm->brk) {
2971                         rc = task_has_perm(current, current,
2972                                            PROCESS__EXECHEAP);
2973                 } else if (!vma->vm_file &&
2974                            vma->vm_start <= vma->vm_mm->start_stack &&
2975                            vma->vm_end >= vma->vm_mm->start_stack) {
2976                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2977                 } else if (vma->vm_file && vma->anon_vma) {
2978                         /*
2979                          * We are making executable a file mapping that has
2980                          * had some COW done. Since pages might have been
2981                          * written, check ability to execute the possibly
2982                          * modified content.  This typically should only
2983                          * occur for text relocations.
2984                          */
2985                         rc = file_has_perm(current, vma->vm_file,
2986                                            FILE__EXECMOD);
2987                 }
2988                 if (rc)
2989                         return rc;
2990         }
2991 #endif
2992
2993         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2994 }
2995
2996 static int selinux_file_lock(struct file *file, unsigned int cmd)
2997 {
2998         return file_has_perm(current, file, FILE__LOCK);
2999 }
3000
3001 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3002                               unsigned long arg)
3003 {
3004         int err = 0;
3005
3006         switch (cmd) {
3007                 case F_SETFL:
3008                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3009                                 err = -EINVAL;
3010                                 break;
3011                         }
3012
3013                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3014                                 err = file_has_perm(current, file,FILE__WRITE);
3015                                 break;
3016                         }
3017                         /* fall through */
3018                 case F_SETOWN:
3019                 case F_SETSIG:
3020                 case F_GETFL:
3021                 case F_GETOWN:
3022                 case F_GETSIG:
3023                         /* Just check FD__USE permission */
3024                         err = file_has_perm(current, file, 0);
3025                         break;
3026                 case F_GETLK:
3027                 case F_SETLK:
3028                 case F_SETLKW:
3029 #if BITS_PER_LONG == 32
3030                 case F_GETLK64:
3031                 case F_SETLK64:
3032                 case F_SETLKW64:
3033 #endif
3034                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3035                                 err = -EINVAL;
3036                                 break;
3037                         }
3038                         err = file_has_perm(current, file, FILE__LOCK);
3039                         break;
3040         }
3041
3042         return err;
3043 }
3044
3045 static int selinux_file_set_fowner(struct file *file)
3046 {
3047         struct task_security_struct *tsec;
3048         struct file_security_struct *fsec;
3049
3050         tsec = current->security;
3051         fsec = file->f_security;
3052         fsec->fown_sid = tsec->sid;
3053
3054         return 0;
3055 }
3056
3057 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3058                                        struct fown_struct *fown, int signum)
3059 {
3060         struct file *file;
3061         u32 perm;
3062         struct task_security_struct *tsec;
3063         struct file_security_struct *fsec;
3064
3065         /* struct fown_struct is never outside the context of a struct file */
3066         file = container_of(fown, struct file, f_owner);
3067
3068         tsec = tsk->security;
3069         fsec = file->f_security;
3070
3071         if (!signum)
3072                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3073         else
3074                 perm = signal_to_av(signum);
3075
3076         return avc_has_perm(fsec->fown_sid, tsec->sid,
3077                             SECCLASS_PROCESS, perm, NULL);
3078 }
3079
3080 static int selinux_file_receive(struct file *file)
3081 {
3082         return file_has_perm(current, file, file_to_av(file));
3083 }
3084
3085 static int selinux_dentry_open(struct file *file)
3086 {
3087         struct file_security_struct *fsec;
3088         struct inode *inode;
3089         struct inode_security_struct *isec;
3090         inode = file->f_path.dentry->d_inode;
3091         fsec = file->f_security;
3092         isec = inode->i_security;
3093         /*
3094          * Save inode label and policy sequence number
3095          * at open-time so that selinux_file_permission
3096          * can determine whether revalidation is necessary.
3097          * Task label is already saved in the file security
3098          * struct as its SID.
3099          */
3100         fsec->isid = isec->sid;
3101         fsec->pseqno = avc_policy_seqno();
3102         /*
3103          * Since the inode label or policy seqno may have changed
3104          * between the selinux_inode_permission check and the saving
3105          * of state above, recheck that access is still permitted.
3106          * Otherwise, access might never be revalidated against the
3107          * new inode label or new policy.
3108          * This check is not redundant - do not remove.
3109          */
3110         return inode_has_perm(current, inode, file_to_av(file), NULL);
3111 }
3112
3113 /* task security operations */
3114
3115 static int selinux_task_create(unsigned long clone_flags)
3116 {
3117         int rc;
3118
3119         rc = secondary_ops->task_create(clone_flags);
3120         if (rc)
3121                 return rc;
3122
3123         return task_has_perm(current, current, PROCESS__FORK);
3124 }
3125
3126 static int selinux_task_alloc_security(struct task_struct *tsk)
3127 {
3128         struct task_security_struct *tsec1, *tsec2;
3129         int rc;
3130
3131         tsec1 = current->security;
3132
3133         rc = task_alloc_security(tsk);
3134         if (rc)
3135                 return rc;
3136         tsec2 = tsk->security;
3137
3138         tsec2->osid = tsec1->osid;
3139         tsec2->sid = tsec1->sid;
3140
3141         /* Retain the exec, fs, key, and sock SIDs across fork */
3142         tsec2->exec_sid = tsec1->exec_sid;
3143         tsec2->create_sid = tsec1->create_sid;
3144         tsec2->keycreate_sid = tsec1->keycreate_sid;
3145         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3146
3147         return 0;
3148 }
3149
3150 static void selinux_task_free_security(struct task_struct *tsk)
3151 {
3152         task_free_security(tsk);
3153 }
3154
3155 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3156 {
3157         /* Since setuid only affects the current process, and
3158            since the SELinux controls are not based on the Linux
3159            identity attributes, SELinux does not need to control
3160            this operation.  However, SELinux does control the use
3161            of the CAP_SETUID and CAP_SETGID capabilities using the
3162            capable hook. */
3163         return 0;
3164 }
3165
3166 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3167 {
3168         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3169 }
3170
3171 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3172 {
3173         /* See the comment for setuid above. */
3174         return 0;
3175 }
3176
3177 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3178 {
3179         return task_has_perm(current, p, PROCESS__SETPGID);
3180 }
3181
3182 static int selinux_task_getpgid(struct task_struct *p)
3183 {
3184         return task_has_perm(current, p, PROCESS__GETPGID);
3185 }
3186
3187 static int selinux_task_getsid(struct task_struct *p)
3188 {
3189         return task_has_perm(current, p, PROCESS__GETSESSION);
3190 }
3191
3192 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3193 {
3194         struct task_security_struct *tsec = p->security;
3195         *secid = tsec->sid;
3196 }
3197
3198 static int selinux_task_setgroups(struct group_info *group_info)
3199 {
3200         /* See the comment for setuid above. */
3201         return 0;
3202 }
3203
3204 static int selinux_task_setnice(struct task_struct *p, int nice)
3205 {
3206         int rc;
3207
3208         rc = secondary_ops->task_setnice(p, nice);
3209         if (rc)
3210                 return rc;
3211
3212         return task_has_perm(current,p, PROCESS__SETSCHED);
3213 }
3214
3215 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3216 {
3217         int rc;
3218
3219         rc = secondary_ops->task_setioprio(p, ioprio);
3220         if (rc)
3221                 return rc;
3222
3223         return task_has_perm(current, p, PROCESS__SETSCHED);
3224 }
3225
3226 static int selinux_task_getioprio(struct task_struct *p)
3227 {
3228         return task_has_perm(current, p, PROCESS__GETSCHED);
3229 }
3230
3231 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3232 {
3233         struct rlimit *old_rlim = current->signal->rlim + resource;
3234         int rc;
3235
3236         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3237         if (rc)
3238                 return rc;
3239
3240         /* Control the ability to change the hard limit (whether
3241            lowering or raising it), so that the hard limit can
3242            later be used as a safe reset point for the soft limit
3243            upon context transitions. See selinux_bprm_apply_creds. */
3244         if (old_rlim->rlim_max != new_rlim->rlim_max)
3245                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3246
3247         return 0;
3248 }
3249
3250 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3251 {
3252         int rc;
3253
3254         rc = secondary_ops->task_setscheduler(p, policy, lp);
3255         if (rc)
3256                 return rc;
3257
3258         return task_has_perm(current, p, PROCESS__SETSCHED);
3259 }
3260
3261 static int selinux_task_getscheduler(struct task_struct *p)
3262 {
3263         return task_has_perm(current, p, PROCESS__GETSCHED);
3264 }
3265
3266 static int selinux_task_movememory(struct task_struct *p)
3267 {
3268         return task_has_perm(current, p, PROCESS__SETSCHED);
3269 }
3270
3271 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3272                                 int sig, u32 secid)
3273 {
3274         u32 perm;
3275         int rc;
3276         struct task_security_struct *tsec;
3277
3278         rc = secondary_ops->task_kill(p, info, sig, secid);
3279         if (rc)
3280                 return rc;
3281
3282         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3283                 return 0;
3284
3285         if (!sig)
3286                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3287         else
3288                 perm = signal_to_av(sig);
3289         tsec = p->security;
3290         if (secid)
3291                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3292         else
3293                 rc = task_has_perm(current, p, perm);
3294         return rc;
3295 }
3296
3297 static int selinux_task_prctl(int option,
3298                               unsigned long arg2,
3299                               unsigned long arg3,
3300                               unsigned long arg4,
3301                               unsigned long arg5)
3302 {
3303         /* The current prctl operations do not appear to require
3304            any SELinux controls since they merely observe or modify
3305            the state of the current process. */
3306         return 0;
3307 }
3308
3309 static int selinux_task_wait(struct task_struct *p)
3310 {
3311         return task_has_perm(p, current, PROCESS__SIGCHLD);
3312 }
3313
3314 static void selinux_task_reparent_to_init(struct task_struct *p)
3315 {
3316         struct task_security_struct *tsec;
3317
3318         secondary_ops->task_reparent_to_init(p);
3319
3320         tsec = p->security;
3321         tsec->osid = tsec->sid;
3322         tsec->sid = SECINITSID_KERNEL;
3323         return;
3324 }
3325
3326 static void selinux_task_to_inode(struct task_struct *p,
3327                                   struct inode *inode)
3328 {
3329         struct task_security_struct *tsec = p->security;
3330         struct inode_security_struct *isec = inode->i_security;
3331
3332         isec->sid = tsec->sid;
3333         isec->initialized = 1;
3334         return;
3335 }
3336
3337 /* Returns error only if unable to parse addresses */
3338 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3339                         struct avc_audit_data *ad, u8 *proto)
3340 {
3341         int offset, ihlen, ret = -EINVAL;
3342         struct iphdr _iph, *ih;
3343
3344         offset = skb_network_offset(skb);
3345         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3346         if (ih == NULL)
3347                 goto out;
3348
3349         ihlen = ih->ihl * 4;
3350         if (ihlen < sizeof(_iph))
3351                 goto out;
3352
3353         ad->u.net.v4info.saddr = ih->saddr;
3354         ad->u.net.v4info.daddr = ih->daddr;
3355         ret = 0;
3356
3357         if (proto)
3358                 *proto = ih->protocol;
3359
3360         switch (ih->protocol) {
3361         case IPPROTO_TCP: {
3362                 struct tcphdr _tcph, *th;
3363
3364                 if (ntohs(ih->frag_off) & IP_OFFSET)
3365                         break;
3366
3367                 offset += ihlen;
3368                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3369                 if (th == NULL)
3370                         break;
3371
3372                 ad->u.net.sport = th->source;
3373                 ad->u.net.dport = th->dest;
3374                 break;
3375         }
3376
3377         case IPPROTO_UDP: {
3378                 struct udphdr _udph, *uh;
3379
3380                 if (ntohs(ih->frag_off) & IP_OFFSET)
3381                         break;
3382
3383                 offset += ihlen;
3384                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3385                 if (uh == NULL)
3386                         break;
3387
3388                 ad->u.net.sport = uh->source;
3389                 ad->u.net.dport = uh->dest;
3390                 break;
3391         }
3392
3393         case IPPROTO_DCCP: {
3394                 struct dccp_hdr _dccph, *dh;
3395
3396                 if (ntohs(ih->frag_off) & IP_OFFSET)
3397                         break;
3398
3399                 offset += ihlen;
3400                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3401                 if (dh == NULL)
3402                         break;
3403
3404                 ad->u.net.sport = dh->dccph_sport;
3405                 ad->u.net.dport = dh->dccph_dport;
3406                 break;
3407         }
3408
3409         default:
3410                 break;
3411         }
3412 out:
3413         return ret;
3414 }
3415
3416 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3417
3418 /* Returns error only if unable to parse addresses */
3419 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3420                         struct avc_audit_data *ad, u8 *proto)
3421 {
3422         u8 nexthdr;
3423         int ret = -EINVAL, offset;
3424         struct ipv6hdr _ipv6h, *ip6;
3425
3426         offset = skb_network_offset(skb);
3427         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3428         if (ip6 == NULL)
3429                 goto out;
3430
3431         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3432         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3433         ret = 0;
3434
3435         nexthdr = ip6->nexthdr;
3436         offset += sizeof(_ipv6h);
3437         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3438         if (offset < 0)
3439                 goto out;
3440
3441         if (proto)
3442                 *proto = nexthdr;
3443
3444         switch (nexthdr) {
3445         case IPPROTO_TCP: {
3446                 struct tcphdr _tcph, *th;
3447
3448                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3449                 if (th == NULL)
3450                         break;
3451
3452                 ad->u.net.sport = th->source;
3453                 ad->u.net.dport = th->dest;
3454                 break;
3455         }
3456
3457         case IPPROTO_UDP: {
3458                 struct udphdr _udph, *uh;
3459
3460                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3461                 if (uh == NULL)
3462                         break;
3463
3464                 ad->u.net.sport = uh->source;
3465                 ad->u.net.dport = uh->dest;
3466                 break;
3467         }
3468
3469         case IPPROTO_DCCP: {
3470                 struct dccp_hdr _dccph, *dh;
3471
3472                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3473                 if (dh == NULL)
3474                         break;
3475
3476                 ad->u.net.sport = dh->dccph_sport;
3477                 ad->u.net.dport = dh->dccph_dport;
3478                 break;
3479         }
3480
3481         /* includes fragments */
3482         default:
3483                 break;
3484         }
3485 out:
3486         return ret;
3487 }
3488
3489 #endif /* IPV6 */
3490
3491 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3492                              char **addrp, int src, u8 *proto)
3493 {
3494         int ret = 0;
3495
3496         switch (ad->u.net.family) {
3497         case PF_INET:
3498                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3499                 if (ret || !addrp)
3500                         break;
3501                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3502                                         &ad->u.net.v4info.daddr);
3503                 break;
3504
3505 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3506         case PF_INET6:
3507                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3508                 if (ret || !addrp)
3509                         break;
3510                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3511                                         &ad->u.net.v6info.daddr);
3512                 break;
3513 #endif  /* IPV6 */
3514         default:
3515                 break;
3516         }
3517
3518         if (unlikely(ret))
3519                 printk(KERN_WARNING
3520                        "SELinux: failure in selinux_parse_skb(),"
3521                        " unable to parse packet\n");
3522
3523         return ret;
3524 }
3525
3526 /**
3527  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3528  * @skb: the packet
3529  * @family: protocol family
3530  * @sid: the packet's peer label SID
3531  *
3532  * Description:
3533  * Check the various different forms of network peer labeling and determine
3534  * the peer label/SID for the packet; most of the magic actually occurs in
3535  * the security server function security_net_peersid_cmp().  The function
3536  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3537  * or -EACCES if @sid is invalid due to inconsistencies with the different
3538  * peer labels.
3539  *
3540  */
3541 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3542 {
3543         int err;
3544         u32 xfrm_sid;
3545         u32 nlbl_sid;
3546         u32 nlbl_type;
3547
3548         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3549         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3550
3551         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3552         if (unlikely(err)) {
3553                 printk(KERN_WARNING
3554                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3555                        " unable to determine packet's peer label\n");
3556                 return -EACCES;
3557         }
3558
3559         return 0;
3560 }
3561
3562 /* socket security operations */
3563 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3564                            u32 perms)
3565 {
3566         struct inode_security_struct *isec;
3567         struct task_security_struct *tsec;
3568         struct avc_audit_data ad;
3569         int err = 0;
3570
3571         tsec = task->security;
3572         isec = SOCK_INODE(sock)->i_security;
3573
3574         if (isec->sid == SECINITSID_KERNEL)
3575                 goto out;
3576
3577         AVC_AUDIT_DATA_INIT(&ad,NET);
3578         ad.u.net.sk = sock->sk;
3579         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3580
3581 out:
3582         return err;
3583 }
3584
3585 static int selinux_socket_create(int family, int type,
3586                                  int protocol, int kern)
3587 {
3588         int err = 0;
3589         struct task_security_struct *tsec;
3590         u32 newsid;
3591
3592         if (kern)
3593                 goto out;
3594
3595         tsec = current->security;
3596         newsid = tsec->sockcreate_sid ? : tsec->sid;
3597         err = avc_has_perm(tsec->sid, newsid,
3598                            socket_type_to_security_class(family, type,
3599                            protocol), SOCKET__CREATE, NULL);
3600
3601 out:
3602         return err;
3603 }
3604
3605 static int selinux_socket_post_create(struct socket *sock, int family,
3606                                       int type, int protocol, int kern)
3607 {
3608         int err = 0;
3609         struct inode_security_struct *isec;
3610         struct task_security_struct *tsec;
3611         struct sk_security_struct *sksec;
3612         u32 newsid;
3613
3614         isec = SOCK_INODE(sock)->i_security;
3615
3616         tsec = current->security;
3617         newsid = tsec->sockcreate_sid ? : tsec->sid;
3618         isec->sclass = socket_type_to_security_class(family, type, protocol);
3619         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3620         isec->initialized = 1;
3621
3622         if (sock->sk) {
3623                 sksec = sock->sk->sk_security;
3624                 sksec->sid = isec->sid;
3625                 sksec->sclass = isec->sclass;
3626                 err = selinux_netlbl_socket_post_create(sock);
3627         }
3628
3629         return err;
3630 }
3631
3632 /* Range of port numbers used to automatically bind.
3633    Need to determine whether we should perform a name_bind
3634    permission check between the socket and the port number. */
3635
3636 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3637 {
3638         u16 family;
3639         int err;
3640
3641         err = socket_has_perm(current, sock, SOCKET__BIND);
3642         if (err)
3643                 goto out;
3644
3645         /*
3646          * If PF_INET or PF_INET6, check name_bind permission for the port.
3647          * Multiple address binding for SCTP is not supported yet: we just
3648          * check the first address now.
3649          */
3650         family = sock->sk->sk_family;
3651         if (family == PF_INET || family == PF_INET6) {
3652                 char *addrp;
3653                 struct inode_security_struct *isec;
3654                 struct task_security_struct *tsec;
3655                 struct avc_audit_data ad;
3656                 struct sockaddr_in *addr4 = NULL;
3657                 struct sockaddr_in6 *addr6 = NULL;
3658                 unsigned short snum;
3659                 struct sock *sk = sock->sk;
3660                 u32 sid, node_perm, addrlen;
3661
3662                 tsec = current->security;
3663                 isec = SOCK_INODE(sock)->i_security;
3664
3665                 if (family == PF_INET) {
3666                         addr4 = (struct sockaddr_in *)address;
3667                         snum = ntohs(addr4->sin_port);
3668                         addrlen = sizeof(addr4->sin_addr.s_addr);
3669                         addrp = (char *)&addr4->sin_addr.s_addr;
3670                 } else {
3671                         addr6 = (struct sockaddr_in6 *)address;
3672                         snum = ntohs(addr6->sin6_port);
3673                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3674                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3675                 }
3676
3677                 if (snum) {
3678                         int low, high;
3679
3680                         inet_get_local_port_range(&low, &high);
3681
3682                         if (snum < max(PROT_SOCK, low) || snum > high) {
3683                                 err = sel_netport_sid(sk->sk_protocol,
3684                                                       snum, &sid);
3685                                 if (err)
3686                                         goto out;
3687                                 AVC_AUDIT_DATA_INIT(&ad,NET);
3688                                 ad.u.net.sport = htons(snum);
3689                                 ad.u.net.family = family;
3690                                 err = avc_has_perm(isec->sid, sid,
3691                                                    isec->sclass,
3692                                                    SOCKET__NAME_BIND, &ad);
3693                                 if (err)
3694                                         goto out;
3695                         }
3696                 }
3697
3698                 switch(isec->sclass) {
3699                 case SECCLASS_TCP_SOCKET:
3700                         node_perm = TCP_SOCKET__NODE_BIND;
3701                         break;
3702
3703                 case SECCLASS_UDP_SOCKET:
3704                         node_perm = UDP_SOCKET__NODE_BIND;
3705                         break;
3706
3707                 case SECCLASS_DCCP_SOCKET:
3708                         node_perm = DCCP_SOCKET__NODE_BIND;
3709                         break;
3710
3711                 default:
3712                         node_perm = RAWIP_SOCKET__NODE_BIND;
3713                         break;
3714                 }
3715
3716                 err = sel_netnode_sid(addrp, family, &sid);
3717                 if (err)
3718                         goto out;
3719
3720                 AVC_AUDIT_DATA_INIT(&ad,NET);
3721                 ad.u.net.sport = htons(snum);
3722                 ad.u.net.family = family;
3723
3724                 if (family == PF_INET)
3725                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3726                 else
3727                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3728
3729                 err = avc_has_perm(isec->sid, sid,
3730                                    isec->sclass, node_perm, &ad);
3731                 if (err)
3732                         goto out;
3733         }
3734 out:
3735         return err;
3736 }
3737
3738 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3739 {
3740         struct inode_security_struct *isec;
3741         int err;
3742
3743         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3744         if (err)
3745                 return err;
3746
3747         /*
3748          * If a TCP or DCCP socket, check name_connect permission for the port.
3749          */
3750         isec = SOCK_INODE(sock)->i_security;
3751         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3752             isec->sclass == SECCLASS_DCCP_SOCKET) {
3753                 struct sock *sk = sock->sk;
3754                 struct avc_audit_data ad;
3755                 struct sockaddr_in *addr4 = NULL;
3756                 struct sockaddr_in6 *addr6 = NULL;
3757                 unsigned short snum;
3758                 u32 sid, perm;
3759
3760                 if (sk->sk_family == PF_INET) {
3761                         addr4 = (struct sockaddr_in *)address;
3762                         if (addrlen < sizeof(struct sockaddr_in))
3763                                 return -EINVAL;
3764                         snum = ntohs(addr4->sin_port);
3765                 } else {
3766                         addr6 = (struct sockaddr_in6 *)address;
3767                         if (addrlen < SIN6_LEN_RFC2133)
3768                                 return -EINVAL;
3769                         snum = ntohs(addr6->sin6_port);
3770                 }
3771
3772                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3773                 if (err)
3774                         goto out;
3775
3776                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3777                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3778
3779                 AVC_AUDIT_DATA_INIT(&ad,NET);
3780                 ad.u.net.dport = htons(snum);
3781                 ad.u.net.family = sk->sk_family;
3782                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3783                 if (err)
3784                         goto out;
3785         }
3786
3787 out:
3788         return err;
3789 }
3790
3791 static int selinux_socket_listen(struct socket *sock, int backlog)
3792 {
3793         return socket_has_perm(current, sock, SOCKET__LISTEN);
3794 }
3795
3796 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3797 {
3798         int err;
3799         struct inode_security_struct *isec;
3800         struct inode_security_struct *newisec;
3801
3802         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3803         if (err)
3804                 return err;
3805
3806         newisec = SOCK_INODE(newsock)->i_security;
3807
3808         isec = SOCK_INODE(sock)->i_security;
3809         newisec->sclass = isec->sclass;
3810         newisec->sid = isec->sid;
3811         newisec->initialized = 1;
3812
3813         return 0;
3814 }
3815
3816 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3817                                   int size)
3818 {
3819         int rc;
3820
3821         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3822         if (rc)
3823                 return rc;
3824
3825         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3826 }
3827
3828 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3829                                   int size, int flags)
3830 {
3831         return socket_has_perm(current, sock, SOCKET__READ);
3832 }
3833
3834 static int selinux_socket_getsockname(struct socket *sock)
3835 {
3836         return socket_has_perm(current, sock, SOCKET__GETATTR);
3837 }
3838
3839 static int selinux_socket_getpeername(struct socket *sock)
3840 {
3841         return socket_has_perm(current, sock, SOCKET__GETATTR);
3842 }
3843
3844 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3845 {
3846         int err;
3847
3848         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3849         if (err)
3850                 return err;
3851
3852         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3853 }
3854
3855 static int selinux_socket_getsockopt(struct socket *sock, int level,
3856                                      int optname)
3857 {
3858         return socket_has_perm(current, sock, SOCKET__GETOPT);
3859 }
3860
3861 static int selinux_socket_shutdown(struct socket *sock, int how)
3862 {
3863         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3864 }
3865
3866 static int selinux_socket_unix_stream_connect(struct socket *sock,
3867                                               struct socket *other,
3868                                               struct sock *newsk)
3869 {
3870         struct sk_security_struct *ssec;
3871         struct inode_security_struct *isec;
3872         struct inode_security_struct *other_isec;
3873         struct avc_audit_data ad;
3874         int err;
3875
3876         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3877         if (err)
3878                 return err;
3879
3880         isec = SOCK_INODE(sock)->i_security;
3881         other_isec = SOCK_INODE(other)->i_security;
3882
3883         AVC_AUDIT_DATA_INIT(&ad,NET);
3884         ad.u.net.sk = other->sk;
3885
3886         err = avc_has_perm(isec->sid, other_isec->sid,
3887                            isec->sclass,
3888                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3889         if (err)
3890                 return err;
3891
3892         /* connecting socket */
3893         ssec = sock->sk->sk_security;
3894         ssec->peer_sid = other_isec->sid;
3895
3896         /* server child socket */
3897         ssec = newsk->sk_security;
3898         ssec->peer_sid = isec->sid;
3899         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3900
3901         return err;
3902 }
3903
3904 static int selinux_socket_unix_may_send(struct socket *sock,
3905                                         struct socket *other)
3906 {
3907         struct inode_security_struct *isec;
3908         struct inode_security_struct *other_isec;
3909         struct avc_audit_data ad;
3910         int err;
3911
3912         isec = SOCK_INODE(sock)->i_security;
3913         other_isec = SOCK_INODE(other)->i_security;
3914
3915         AVC_AUDIT_DATA_INIT(&ad,NET);
3916         ad.u.net.sk = other->sk;
3917
3918         err = avc_has_perm(isec->sid, other_isec->sid,
3919                            isec->sclass, SOCKET__SENDTO, &ad);
3920         if (err)
3921                 return err;
3922
3923         return 0;
3924 }
3925
3926 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3927                                     u32 peer_sid,
3928                                     struct avc_audit_data *ad)
3929 {
3930         int err;
3931         u32 if_sid;
3932         u32 node_sid;
3933
3934         err = sel_netif_sid(ifindex, &if_sid);
3935         if (err)
3936                 return err;
3937         err = avc_has_perm(peer_sid, if_sid,
3938                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3939         if (err)
3940                 return err;
3941
3942         err = sel_netnode_sid(addrp, family, &node_sid);
3943         if (err)
3944                 return err;
3945         return avc_has_perm(peer_sid, node_sid,
3946                             SECCLASS_NODE, NODE__RECVFROM, ad);
3947 }
3948
3949 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3950                                                 struct sk_buff *skb,
3951                                                 struct avc_audit_data *ad,
3952                                                 u16 family,
3953                                                 char *addrp)
3954 {
3955         int err;
3956         struct sk_security_struct *sksec = sk->sk_security;
3957         u16 sk_class;
3958         u32 netif_perm, node_perm, recv_perm;
3959         u32 port_sid, node_sid, if_sid, sk_sid;
3960
3961         sk_sid = sksec->sid;
3962         sk_class = sksec->sclass;
3963
3964         switch (sk_class) {
3965         case SECCLASS_UDP_SOCKET:
3966                 netif_perm = NETIF__UDP_RECV;
3967                 node_perm = NODE__UDP_RECV;
3968                 recv_perm = UDP_SOCKET__RECV_MSG;
3969                 break;
3970         case SECCLASS_TCP_SOCKET:
3971                 netif_perm = NETIF__TCP_RECV;
3972                 node_perm = NODE__TCP_RECV;
3973                 recv_perm = TCP_SOCKET__RECV_MSG;
3974                 break;
3975         case SECCLASS_DCCP_SOCKET:
3976                 netif_perm = NETIF__DCCP_RECV;
3977                 node_perm = NODE__DCCP_RECV;
3978                 recv_perm = DCCP_SOCKET__RECV_MSG;
3979                 break;
3980         default:
3981                 netif_perm = NETIF__RAWIP_RECV;
3982                 node_perm = NODE__RAWIP_RECV;
3983                 recv_perm = 0;
3984                 break;
3985         }
3986
3987         err = sel_netif_sid(skb->iif, &if_sid);
3988         if (err)
3989                 return err;
3990         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3991         if (err)
3992                 return err;
3993
3994         err = sel_netnode_sid(addrp, family, &node_sid);
3995         if (err)
3996                 return err;
3997         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3998         if (err)
3999                 return err;
4000
4001         if (!recv_perm)
4002                 return 0;
4003         err = sel_netport_sid(sk->sk_protocol,
4004                               ntohs(ad->u.net.sport), &port_sid);
4005         if (unlikely(err)) {
4006                 printk(KERN_WARNING
4007                        "SELinux: failure in"
4008                        " selinux_sock_rcv_skb_iptables_compat(),"
4009                        " network port label not found\n");
4010                 return err;
4011         }
4012         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4013 }
4014
4015 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4016                                        struct avc_audit_data *ad,
4017                                        u16 family, char *addrp)
4018 {
4019         int err;
4020         struct sk_security_struct *sksec = sk->sk_security;
4021         u32 peer_sid;
4022         u32 sk_sid = sksec->sid;
4023
4024         if (selinux_compat_net)
4025                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4026                                                            family, addrp);
4027         else
4028                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4029                                    PACKET__RECV, ad);
4030         if (err)
4031                 return err;
4032
4033         if (selinux_policycap_netpeer) {
4034                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4035                 if (err)
4036                         return err;
4037                 err = avc_has_perm(sk_sid, peer_sid,
4038                                    SECCLASS_PEER, PEER__RECV, ad);
4039         } else {
4040                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4041                 if (err)
4042                         return err;
4043                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4044         }
4045
4046         return err;
4047 }
4048
4049 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4050 {
4051         int err;
4052         struct sk_security_struct *sksec = sk->sk_security;
4053         u16 family = sk->sk_family;
4054         u32 sk_sid = sksec->sid;
4055         struct avc_audit_data ad;
4056         char *addrp;
4057
4058         if (family != PF_INET && family != PF_INET6)
4059                 return 0;
4060
4061         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4062         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4063                 family = PF_INET;
4064
4065         AVC_AUDIT_DATA_INIT(&ad, NET);
4066         ad.u.net.netif = skb->iif;
4067         ad.u.net.family = family;
4068         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4069         if (err)
4070                 return err;
4071
4072         /* If any sort of compatibility mode is enabled then handoff processing
4073          * to the selinux_sock_rcv_skb_compat() function to deal with the
4074          * special handling.  We do this in an attempt to keep this function
4075          * as fast and as clean as possible. */
4076         if (selinux_compat_net || !selinux_policycap_netpeer)
4077                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4078                                                    family, addrp);
4079
4080         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4081                 u32 peer_sid;
4082
4083                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4084                 if (err)
4085                         return err;
4086                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4087                                                peer_sid, &ad);
4088                 if (err)
4089                         return err;
4090                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4091                                    PEER__RECV, &ad);
4092         }
4093
4094         if (selinux_secmark_enabled()) {
4095                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4096                                    PACKET__RECV, &ad);
4097                 if (err)
4098                         return err;
4099         }
4100
4101         return err;
4102 }
4103
4104 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4105                                             int __user *optlen, unsigned len)
4106 {
4107         int err = 0;
4108         char *scontext;
4109         u32 scontext_len;
4110         struct sk_security_struct *ssec;
4111         struct inode_security_struct *isec;
4112         u32 peer_sid = SECSID_NULL;
4113
4114         isec = SOCK_INODE(sock)->i_security;
4115
4116         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4117             isec->sclass == SECCLASS_TCP_SOCKET) {
4118                 ssec = sock->sk->sk_security;
4119                 peer_sid = ssec->peer_sid;
4120         }
4121         if (peer_sid == SECSID_NULL) {
4122                 err = -ENOPROTOOPT;
4123                 goto out;
4124         }
4125
4126         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4127
4128         if (err)
4129                 goto out;
4130
4131         if (scontext_len > len) {
4132                 err = -ERANGE;
4133                 goto out_len;
4134         }
4135
4136         if (copy_to_user(optval, scontext, scontext_len))
4137                 err = -EFAULT;
4138
4139 out_len:
4140         if (put_user(scontext_len, optlen))
4141                 err = -EFAULT;
4142
4143         kfree(scontext);
4144 out:
4145         return err;
4146 }
4147
4148 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4149 {
4150         u32 peer_secid = SECSID_NULL;
4151         u16 family;
4152
4153         if (sock)
4154                 family = sock->sk->sk_family;
4155         else if (skb && skb->sk)
4156                 family = skb->sk->sk_family;
4157         else
4158                 goto out;
4159
4160         if (sock && family == PF_UNIX)
4161                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4162         else if (skb)
4163                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4164
4165 out:
4166         *secid = peer_secid;
4167         if (peer_secid == SECSID_NULL)
4168                 return -EINVAL;
4169         return 0;
4170 }
4171
4172 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4173 {
4174         return sk_alloc_security(sk, family, priority);
4175 }
4176
4177 static void selinux_sk_free_security(struct sock *sk)
4178 {
4179         sk_free_security(sk);
4180 }
4181
4182 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4183 {
4184         struct sk_security_struct *ssec = sk->sk_security;
4185         struct sk_security_struct *newssec = newsk->sk_security;
4186
4187         newssec->sid = ssec->sid;
4188         newssec->peer_sid = ssec->peer_sid;
4189         newssec->sclass = ssec->sclass;
4190
4191         selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4192 }
4193
4194 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4195 {
4196         if (!sk)
4197                 *secid = SECINITSID_ANY_SOCKET;
4198         else {
4199                 struct sk_security_struct *sksec = sk->sk_security;
4200
4201                 *secid = sksec->sid;
4202         }
4203 }
4204
4205 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4206 {
4207         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4208         struct sk_security_struct *sksec = sk->sk_security;
4209
4210         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4211             sk->sk_family == PF_UNIX)
4212                 isec->sid = sksec->sid;
4213         sksec->sclass = isec->sclass;
4214
4215         selinux_netlbl_sock_graft(sk, parent);
4216 }
4217
4218 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4219                                      struct request_sock *req)
4220 {
4221         struct sk_security_struct *sksec = sk->sk_security;
4222         int err;
4223         u32 newsid;
4224         u32 peersid;
4225
4226         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4227         if (err)
4228                 return err;
4229         if (peersid == SECSID_NULL) {
4230                 req->secid = sksec->sid;
4231                 req->peer_secid = SECSID_NULL;
4232                 return 0;
4233         }
4234
4235         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4236         if (err)
4237                 return err;
4238
4239         req->secid = newsid;
4240         req->peer_secid = peersid;
4241         return 0;
4242 }
4243
4244 static void selinux_inet_csk_clone(struct sock *newsk,
4245                                    const struct request_sock *req)
4246 {
4247         struct sk_security_struct *newsksec = newsk->sk_security;
4248
4249         newsksec->sid = req->secid;
4250         newsksec->peer_sid = req->peer_secid;
4251         /* NOTE: Ideally, we should also get the isec->sid for the
4252            new socket in sync, but we don't have the isec available yet.
4253            So we will wait until sock_graft to do it, by which
4254            time it will have been created and available. */
4255
4256         /* We don't need to take any sort of lock here as we are the only
4257          * thread with access to newsksec */
4258         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4259 }
4260
4261 static void selinux_inet_conn_established(struct sock *sk,
4262                                 struct sk_buff *skb)
4263 {
4264         struct sk_security_struct *sksec = sk->sk_security;
4265
4266         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4267 }
4268
4269 static void selinux_req_classify_flow(const struct request_sock *req,
4270                                       struct flowi *fl)
4271 {
4272         fl->secid = req->secid;
4273 }
4274
4275 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4276 {
4277         int err = 0;
4278         u32 perm;
4279         struct nlmsghdr *nlh;
4280         struct socket *sock = sk->sk_socket;
4281         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4282
4283         if (skb->len < NLMSG_SPACE(0)) {
4284                 err = -EINVAL;
4285                 goto out;
4286         }
4287         nlh = nlmsg_hdr(skb);
4288
4289         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4290         if (err) {
4291                 if (err == -EINVAL) {
4292                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4293                                   "SELinux:  unrecognized netlink message"
4294                                   " type=%hu for sclass=%hu\n",
4295                                   nlh->nlmsg_type, isec->sclass);
4296                         if (!selinux_enforcing)
4297                                 err = 0;
4298                 }
4299
4300                 /* Ignore */
4301                 if (err == -ENOENT)
4302                         err = 0;
4303                 goto out;
4304         }
4305
4306         err = socket_has_perm(current, sock, perm);
4307 out:
4308         return err;
4309 }
4310
4311 #ifdef CONFIG_NETFILTER
4312
4313 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4314                                        u16 family)
4315 {
4316         char *addrp;
4317         u32 peer_sid;
4318         struct avc_audit_data ad;
4319         u8 secmark_active;
4320         u8 peerlbl_active;
4321
4322         if (!selinux_policycap_netpeer)
4323                 return NF_ACCEPT;
4324
4325         secmark_active = selinux_secmark_enabled();
4326         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4327         if (!secmark_active && !peerlbl_active)
4328                 return NF_ACCEPT;
4329
4330         AVC_AUDIT_DATA_INIT(&ad, NET);
4331         ad.u.net.netif = ifindex;
4332         ad.u.net.family = family;
4333         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4334                 return NF_DROP;
4335
4336         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4337                 return NF_DROP;
4338
4339         if (peerlbl_active)
4340                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4341                                              peer_sid, &ad) != 0)
4342                         return NF_DROP;
4343
4344         if (secmark_active)
4345                 if (avc_has_perm(peer_sid, skb->secmark,
4346                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4347                         return NF_DROP;
4348
4349         return NF_ACCEPT;
4350 }
4351
4352 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4353                                          struct sk_buff *skb,
4354                                          const struct net_device *in,
4355                                          const struct net_device *out,
4356                                          int (*okfn)(struct sk_buff *))
4357 {
4358         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4359 }
4360
4361 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4362 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4363                                          struct sk_buff *skb,
4364                                          const struct net_device *in,
4365                                          const struct net_device *out,
4366                                          int (*okfn)(struct sk_buff *))
4367 {
4368         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4369 }
4370 #endif  /* IPV6 */
4371
4372 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4373                                                 int ifindex,
4374                                                 struct avc_audit_data *ad,
4375                                                 u16 family, char *addrp)
4376 {
4377         int err;
4378         struct sk_security_struct *sksec = sk->sk_security;
4379         u16 sk_class;
4380         u32 netif_perm, node_perm, send_perm;
4381         u32 port_sid, node_sid, if_sid, sk_sid;
4382
4383         sk_sid = sksec->sid;
4384         sk_class = sksec->sclass;
4385
4386         switch (sk_class) {
4387         case SECCLASS_UDP_SOCKET:
4388                 netif_perm = NETIF__UDP_SEND;
4389                 node_perm = NODE__UDP_SEND;
4390                 send_perm = UDP_SOCKET__SEND_MSG;
4391                 break;
4392         case SECCLASS_TCP_SOCKET:
4393                 netif_perm = NETIF__TCP_SEND;
4394                 node_perm = NODE__TCP_SEND;
4395                 send_perm = TCP_SOCKET__SEND_MSG;
4396                 break;
4397         case SECCLASS_DCCP_SOCKET:
4398                 netif_perm = NETIF__DCCP_SEND;
4399                 node_perm = NODE__DCCP_SEND;
4400                 send_perm = DCCP_SOCKET__SEND_MSG;
4401                 break;
4402         default:
4403                 netif_perm = NETIF__RAWIP_SEND;
4404                 node_perm = NODE__RAWIP_SEND;
4405                 send_perm = 0;
4406                 break;
4407         }
4408
4409         err = sel_netif_sid(ifindex, &if_sid);
4410         if (err)
4411                 return err;
4412         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4413                 return err;
4414
4415         err = sel_netnode_sid(addrp, family, &node_sid);
4416         if (err)
4417                 return err;
4418         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4419         if (err)
4420                 return err;
4421
4422         if (send_perm != 0)
4423                 return 0;
4424
4425         err = sel_netport_sid(sk->sk_protocol,
4426                               ntohs(ad->u.net.dport), &port_sid);
4427         if (unlikely(err)) {
4428                 printk(KERN_WARNING
4429                        "SELinux: failure in"
4430                        " selinux_ip_postroute_iptables_compat(),"
4431                        " network port label not found\n");
4432                 return err;
4433         }
4434         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4435 }
4436
4437 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4438                                                 int ifindex,
4439                                                 struct avc_audit_data *ad,
4440                                                 u16 family,
4441                                                 char *addrp,
4442                                                 u8 proto)
4443 {
4444         struct sock *sk = skb->sk;
4445         struct sk_security_struct *sksec;
4446
4447         if (sk == NULL)
4448                 return NF_ACCEPT;
4449         sksec = sk->sk_security;
4450
4451         if (selinux_compat_net) {
4452                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4453                                                          ad, family, addrp))
4454                         return NF_DROP;
4455         } else {
4456                 if (avc_has_perm(sksec->sid, skb->secmark,
4457                                  SECCLASS_PACKET, PACKET__SEND, ad))
4458                         return NF_DROP;
4459         }
4460
4461         if (selinux_policycap_netpeer)
4462                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4463                         return NF_DROP;
4464
4465         return NF_ACCEPT;
4466 }
4467
4468 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4469                                          u16 family)
4470 {
4471         u32 secmark_perm;
4472         u32 peer_sid;
4473         struct sock *sk;
4474         struct avc_audit_data ad;
4475         char *addrp;
4476         u8 proto;
4477         u8 secmark_active;
4478         u8 peerlbl_active;
4479
4480         AVC_AUDIT_DATA_INIT(&ad, NET);
4481         ad.u.net.netif = ifindex;
4482         ad.u.net.family = family;
4483         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4484                 return NF_DROP;
4485
4486         /* If any sort of compatibility mode is enabled then handoff processing
4487          * to the selinux_ip_postroute_compat() function to deal with the
4488          * special handling.  We do this in an attempt to keep this function
4489          * as fast and as clean as possible. */
4490         if (selinux_compat_net || !selinux_policycap_netpeer)
4491                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4492                                                    family, addrp, proto);
4493
4494         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4495          * packet transformation so allow the packet to pass without any checks
4496          * since we'll have another chance to perform access control checks
4497          * when the packet is on it's final way out.
4498          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4499          *       is NULL, in this case go ahead and apply access control. */
4500         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4501                 return NF_ACCEPT;
4502
4503         secmark_active = selinux_secmark_enabled();
4504         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4505         if (!secmark_active && !peerlbl_active)
4506                 return NF_ACCEPT;
4507
4508         /* if the packet is locally generated (skb->sk != NULL) then use the
4509          * socket's label as the peer label, otherwise the packet is being
4510          * forwarded through this system and we need to fetch the peer label
4511          * directly from the packet */
4512         sk = skb->sk;
4513         if (sk) {
4514                 struct sk_security_struct *sksec = sk->sk_security;
4515                 peer_sid = sksec->sid;
4516                 secmark_perm = PACKET__SEND;
4517         } else {
4518                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4519                                 return NF_DROP;
4520                 secmark_perm = PACKET__FORWARD_OUT;
4521         }
4522
4523         if (secmark_active)
4524                 if (avc_has_perm(peer_sid, skb->secmark,
4525                                  SECCLASS_PACKET, secmark_perm, &ad))
4526                         return NF_DROP;
4527
4528         if (peerlbl_active) {
4529                 u32 if_sid;
4530                 u32 node_sid;
4531
4532                 if (sel_netif_sid(ifindex, &if_sid))
4533                         return NF_DROP;
4534                 if (avc_has_perm(peer_sid, if_sid,
4535                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4536                         return NF_DROP;
4537
4538                 if (sel_netnode_sid(addrp, family, &node_sid))
4539                         return NF_DROP;
4540                 if (avc_has_perm(peer_sid, node_sid,
4541                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4542                         return NF_DROP;
4543         }
4544
4545         return NF_ACCEPT;
4546 }
4547
4548 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4549                                            struct sk_buff *skb,
4550                                            const struct net_device *in,
4551                                            const struct net_device *out,
4552                                            int (*okfn)(struct sk_buff *))
4553 {
4554         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4555 }
4556
4557 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4558 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4559                                            struct sk_buff *skb,
4560                                            const struct net_device *in,
4561                                            const struct net_device *out,
4562                                            int (*okfn)(struct sk_buff *))
4563 {
4564         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4565 }
4566 #endif  /* IPV6 */
4567
4568 #endif  /* CONFIG_NETFILTER */
4569
4570 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4571 {
4572         int err;
4573
4574         err = secondary_ops->netlink_send(sk, skb);
4575         if (err)
4576                 return err;
4577
4578         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4579                 err = selinux_nlmsg_perm(sk, skb);
4580
4581         return err;
4582 }
4583
4584 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4585 {
4586         int err;
4587         struct avc_audit_data ad;
4588
4589         err = secondary_ops->netlink_recv(skb, capability);
4590         if (err)
4591                 return err;
4592
4593         AVC_AUDIT_DATA_INIT(&ad, CAP);
4594         ad.u.cap = capability;
4595
4596         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4597                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4598 }
4599
4600 static int ipc_alloc_security(struct task_struct *task,
4601                               struct kern_ipc_perm *perm,
4602                               u16 sclass)
4603 {
4604         struct task_security_struct *tsec = task->security;
4605         struct ipc_security_struct *isec;
4606
4607         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4608         if (!isec)
4609                 return -ENOMEM;
4610
4611         isec->sclass = sclass;
4612         isec->sid = tsec->sid;
4613         perm->security = isec;
4614
4615         return 0;
4616 }
4617
4618 static void ipc_free_security(struct kern_ipc_perm *perm)
4619 {
4620         struct ipc_security_struct *isec = perm->security;
4621         perm->security = NULL;
4622         kfree(isec);
4623 }
4624
4625 static int msg_msg_alloc_security(struct msg_msg *msg)
4626 {
4627         struct msg_security_struct *msec;
4628
4629         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4630         if (!msec)
4631                 return -ENOMEM;
4632
4633         msec->sid = SECINITSID_UNLABELED;
4634         msg->security = msec;
4635
4636         return 0;
4637 }
4638
4639 static void msg_msg_free_security(struct msg_msg *msg)
4640 {
4641         struct msg_security_struct *msec = msg->security;
4642
4643         msg->security = NULL;
4644         kfree(msec);
4645 }
4646
4647 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4648                         u32 perms)
4649 {
4650         struct task_security_struct *tsec;
4651         struct ipc_security_struct *isec;
4652         struct avc_audit_data ad;
4653
4654         tsec = current->security;
4655         isec = ipc_perms->security;
4656
4657         AVC_AUDIT_DATA_INIT(&ad, IPC);
4658         ad.u.ipc_id = ipc_perms->key;
4659
4660         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4661 }
4662
4663 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4664 {
4665         return msg_msg_alloc_security(msg);
4666 }
4667
4668 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4669 {
4670         msg_msg_free_security(msg);
4671 }
4672
4673 /* message queue security operations */
4674 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4675 {
4676         struct task_security_struct *tsec;
4677         struct ipc_security_struct *isec;
4678         struct avc_audit_data ad;
4679         int rc;
4680
4681         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4682         if (rc)
4683                 return rc;
4684
4685         tsec = current->security;
4686         isec = msq->q_perm.security;
4687
4688         AVC_AUDIT_DATA_INIT(&ad, IPC);
4689         ad.u.ipc_id = msq->q_perm.key;
4690
4691         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4692                           MSGQ__CREATE, &ad);
4693         if (rc) {
4694                 ipc_free_security(&msq->q_perm);
4695                 return rc;
4696         }
4697         return 0;
4698 }
4699
4700 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4701 {
4702         ipc_free_security(&msq->q_perm);
4703 }
4704
4705 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4706 {
4707         struct task_security_struct *tsec;
4708         struct ipc_security_struct *isec;
4709         struct avc_audit_data ad;
4710
4711         tsec = current->security;
4712         isec = msq->q_perm.security;
4713
4714         AVC_AUDIT_DATA_INIT(&ad, IPC);
4715         ad.u.ipc_id = msq->q_perm.key;
4716
4717         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4718                             MSGQ__ASSOCIATE, &ad);
4719 }
4720
4721 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4722 {
4723         int err;
4724         int perms;
4725
4726         switch(cmd) {
4727         case IPC_INFO:
4728         case MSG_INFO:
4729                 /* No specific object, just general system-wide information. */
4730                 return task_has_system(current, SYSTEM__IPC_INFO);
4731         case IPC_STAT:
4732         case MSG_STAT:
4733                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4734                 break;
4735         case IPC_SET:
4736                 perms = MSGQ__SETATTR;
4737                 break;
4738         case IPC_RMID:
4739                 perms = MSGQ__DESTROY;
4740                 break;
4741         default:
4742                 return 0;
4743         }
4744
4745         err = ipc_has_perm(&msq->q_perm, perms);
4746         return err;
4747 }
4748
4749 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4750 {
4751         struct task_security_struct *tsec;
4752         struct ipc_security_struct *isec;
4753         struct msg_security_struct *msec;
4754         struct avc_audit_data ad;
4755         int rc;
4756
4757         tsec = current->security;
4758         isec = msq->q_perm.security;
4759         msec = msg->security;
4760
4761         /*
4762          * First time through, need to assign label to the message
4763          */
4764         if (msec->sid == SECINITSID_UNLABELED) {
4765                 /*
4766                  * Compute new sid based on current process and
4767                  * message queue this message will be stored in
4768                  */
4769                 rc = security_transition_sid(tsec->sid,
4770                                              isec->sid,
4771                                              SECCLASS_MSG,
4772                                              &msec->sid);
4773                 if (rc)
4774                         return rc;
4775         }
4776
4777         AVC_AUDIT_DATA_INIT(&ad, IPC);
4778         ad.u.ipc_id = msq->q_perm.key;
4779
4780         /* Can this process write to the queue? */
4781         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4782                           MSGQ__WRITE, &ad);
4783         if (!rc)
4784                 /* Can this process send the message */
4785                 rc = avc_has_perm(tsec->sid, msec->sid,
4786                                   SECCLASS_MSG, MSG__SEND, &ad);
4787         if (!rc)
4788                 /* Can the message be put in the queue? */
4789                 rc = avc_has_perm(msec->sid, isec->sid,
4790                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4791
4792         return rc;
4793 }
4794
4795 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4796                                     struct task_struct *target,
4797                                     long type, int mode)
4798 {
4799         struct task_security_struct *tsec;
4800         struct ipc_security_struct *isec;
4801         struct msg_security_struct *msec;
4802         struct avc_audit_data ad;
4803         int rc;
4804
4805         tsec = target->security;
4806         isec = msq->q_perm.security;
4807         msec = msg->security;
4808
4809         AVC_AUDIT_DATA_INIT(&ad, IPC);
4810         ad.u.ipc_id = msq->q_perm.key;
4811
4812         rc = avc_has_perm(tsec->sid, isec->sid,
4813                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4814         if (!rc)
4815                 rc = avc_has_perm(tsec->sid, msec->sid,
4816                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4817         return rc;
4818 }
4819
4820 /* Shared Memory security operations */
4821 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4822 {
4823         struct task_security_struct *tsec;
4824         struct ipc_security_struct *isec;
4825         struct avc_audit_data ad;
4826         int rc;
4827
4828         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4829         if (rc)
4830                 return rc;
4831
4832         tsec = current->security;
4833         isec = shp->shm_perm.security;
4834
4835         AVC_AUDIT_DATA_INIT(&ad, IPC);
4836         ad.u.ipc_id = shp->shm_perm.key;
4837
4838         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4839                           SHM__CREATE, &ad);
4840         if (rc) {
4841                 ipc_free_security(&shp->shm_perm);
4842                 return rc;
4843         }
4844         return 0;
4845 }
4846
4847 static void selinux_shm_free_security(struct shmid_kernel *shp)
4848 {
4849         ipc_free_security(&shp->shm_perm);
4850 }
4851
4852 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4853 {
4854         struct task_security_struct *tsec;
4855         struct ipc_security_struct *isec;
4856         struct avc_audit_data ad;
4857
4858         tsec = current->security;
4859         isec = shp->shm_perm.security;
4860
4861         AVC_AUDIT_DATA_INIT(&ad, IPC);
4862         ad.u.ipc_id = shp->shm_perm.key;
4863
4864         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4865                             SHM__ASSOCIATE, &ad);
4866 }
4867
4868 /* Note, at this point, shp is locked down */
4869 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4870 {
4871         int perms;
4872         int err;
4873
4874         switch(cmd) {
4875         case IPC_INFO:
4876         case SHM_INFO:
4877                 /* No specific object, just general system-wide information. */
4878                 return task_has_system(current, SYSTEM__IPC_INFO);
4879         case IPC_STAT:
4880         case SHM_STAT:
4881                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4882                 break;
4883         case IPC_SET:
4884                 perms = SHM__SETATTR;
4885                 break;
4886         case SHM_LOCK:
4887         case SHM_UNLOCK:
4888                 perms = SHM__LOCK;
4889                 break;
4890         case IPC_RMID:
4891                 perms = SHM__DESTROY;
4892                 break;
4893         default:
4894                 return 0;
4895         }
4896
4897         err = ipc_has_perm(&shp->shm_perm, perms);
4898         return err;
4899 }
4900
4901 static int selinux_shm_shmat(struct shmid_kernel *shp,
4902                              char __user *shmaddr, int shmflg)
4903 {
4904         u32 perms;
4905         int rc;
4906
4907         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4908         if (rc)
4909                 return rc;
4910
4911         if (shmflg & SHM_RDONLY)
4912                 perms = SHM__READ;
4913         else
4914                 perms = SHM__READ | SHM__WRITE;
4915
4916         return ipc_has_perm(&shp->shm_perm, perms);
4917 }
4918
4919 /* Semaphore security operations */
4920 static int selinux_sem_alloc_security(struct sem_array *sma)
4921 {
4922         struct task_security_struct *tsec;
4923         struct ipc_security_struct *isec;
4924         struct avc_audit_data ad;
4925         int rc;
4926
4927         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4928         if (rc)
4929                 return rc;
4930
4931         tsec = current->security;
4932         isec = sma->sem_perm.security;
4933
4934         AVC_AUDIT_DATA_INIT(&ad, IPC);
4935         ad.u.ipc_id = sma->sem_perm.key;
4936
4937         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4938                           SEM__CREATE, &ad);
4939         if (rc) {
4940                 ipc_free_security(&sma->sem_perm);
4941                 return rc;
4942         }
4943         return 0;
4944 }
4945
4946 static void selinux_sem_free_security(struct sem_array *sma)
4947 {
4948         ipc_free_security(&sma->sem_perm);
4949 }
4950
4951 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4952 {
4953         struct task_security_struct *tsec;
4954         struct ipc_security_struct *isec;
4955         struct avc_audit_data ad;
4956
4957         tsec = current->security;
4958         isec = sma->sem_perm.security;
4959
4960         AVC_AUDIT_DATA_INIT(&ad, IPC);
4961         ad.u.ipc_id = sma->sem_perm.key;
4962
4963         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4964                             SEM__ASSOCIATE, &ad);
4965 }
4966
4967 /* Note, at this point, sma is locked down */
4968 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4969 {
4970         int err;
4971         u32 perms;
4972
4973         switch(cmd) {
4974         case IPC_INFO:
4975         case SEM_INFO:
4976                 /* No specific object, just general system-wide information. */
4977                 return task_has_system(current, SYSTEM__IPC_INFO);
4978         case GETPID:
4979         case GETNCNT:
4980         case GETZCNT:
4981                 perms = SEM__GETATTR;
4982                 break;
4983         case GETVAL:
4984         case GETALL:
4985                 perms = SEM__READ;
4986                 break;
4987         case SETVAL:
4988         case SETALL:
4989                 perms = SEM__WRITE;
4990                 break;
4991         case IPC_RMID:
4992                 perms = SEM__DESTROY;
4993                 break;
4994         case IPC_SET:
4995                 perms = SEM__SETATTR;
4996                 break;
4997         case IPC_STAT:
4998         case SEM_STAT:
4999                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5000                 break;
5001         default:
5002                 return 0;
5003         }
5004
5005         err = ipc_has_perm(&sma->sem_perm, perms);
5006         return err;
5007 }
5008
5009 static int selinux_sem_semop(struct sem_array *sma,
5010                              struct sembuf *sops, unsigned nsops, int alter)
5011 {
5012         u32 perms;
5013
5014         if (alter)
5015                 perms = SEM__READ | SEM__WRITE;
5016         else
5017                 perms = SEM__READ;
5018
5019         return ipc_has_perm(&sma->sem_perm, perms);
5020 }
5021
5022 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5023 {
5024         u32 av = 0;
5025
5026         av = 0;
5027         if (flag & S_IRUGO)
5028                 av |= IPC__UNIX_READ;
5029         if (flag & S_IWUGO)
5030                 av |= IPC__UNIX_WRITE;
5031
5032         if (av == 0)
5033                 return 0;
5034
5035         return ipc_has_perm(ipcp, av);
5036 }
5037
5038 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5039 {
5040         struct ipc_security_struct *isec = ipcp->security;
5041         *secid = isec->sid;
5042 }
5043
5044 /* module stacking operations */
5045 static int selinux_register_security (const char *name, struct security_operations *ops)
5046 {
5047         if (secondary_ops != original_ops) {
5048                 printk(KERN_ERR "%s:  There is already a secondary security "
5049                        "module registered.\n", __func__);
5050                 return -EINVAL;
5051         }
5052
5053         secondary_ops = ops;
5054
5055         printk(KERN_INFO "%s:  Registering secondary module %s\n",
5056                __func__,
5057                name);
5058
5059         return 0;
5060 }
5061
5062 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5063 {
5064         if (inode)
5065                 inode_doinit_with_dentry(inode, dentry);
5066 }
5067
5068 static int selinux_getprocattr(struct task_struct *p,
5069                                char *name, char **value)
5070 {
5071         struct task_security_struct *tsec;
5072         u32 sid;
5073         int error;
5074         unsigned len;
5075
5076         if (current != p) {
5077                 error = task_has_perm(current, p, PROCESS__GETATTR);
5078                 if (error)
5079                         return error;
5080         }
5081
5082         tsec = p->security;
5083
5084         if (!strcmp(name, "current"))
5085                 sid = tsec->sid;
5086         else if (!strcmp(name, "prev"))
5087                 sid = tsec->osid;
5088         else if (!strcmp(name, "exec"))
5089                 sid = tsec->exec_sid;
5090         else if (!strcmp(name, "fscreate"))
5091                 sid = tsec->create_sid;
5092         else if (!strcmp(name, "keycreate"))
5093                 sid = tsec->keycreate_sid;
5094         else if (!strcmp(name, "sockcreate"))
5095                 sid = tsec->sockcreate_sid;
5096         else
5097                 return -EINVAL;
5098
5099         if (!sid)
5100                 return 0;
5101
5102         error = security_sid_to_context(sid, value, &len);
5103         if (error)
5104                 return error;
5105         return len;
5106 }
5107
5108 static int selinux_setprocattr(struct task_struct *p,
5109                                char *name, void *value, size_t size)
5110 {
5111         struct task_security_struct *tsec;
5112         struct task_struct *tracer;
5113         u32 sid = 0;
5114         int error;
5115         char *str = value;
5116
5117         if (current != p) {
5118                 /* SELinux only allows a process to change its own
5119                    security attributes. */
5120                 return -EACCES;
5121         }
5122
5123         /*
5124          * Basic control over ability to set these attributes at all.
5125          * current == p, but we'll pass them separately in case the
5126          * above restriction is ever removed.
5127          */
5128         if (!strcmp(name, "exec"))
5129                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5130         else if (!strcmp(name, "fscreate"))
5131                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5132         else if (!strcmp(name, "keycreate"))
5133                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5134         else if (!strcmp(name, "sockcreate"))
5135                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5136         else if (!strcmp(name, "current"))
5137                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5138         else
5139                 error = -EINVAL;
5140         if (error)
5141                 return error;
5142
5143         /* Obtain a SID for the context, if one was specified. */
5144         if (size && str[1] && str[1] != '\n') {
5145                 if (str[size-1] == '\n') {
5146                         str[size-1] = 0;
5147                         size--;
5148                 }
5149                 error = security_context_to_sid(value, size, &sid);
5150                 if (error)
5151                         return error;
5152         }
5153
5154         /* Permission checking based on the specified context is
5155            performed during the actual operation (execve,
5156            open/mkdir/...), when we know the full context of the
5157            operation.  See selinux_bprm_set_security for the execve
5158            checks and may_create for the file creation checks. The
5159            operation will then fail if the context is not permitted. */
5160         tsec = p->security;
5161         if (!strcmp(name, "exec"))
5162                 tsec->exec_sid = sid;
5163         else if (!strcmp(name, "fscreate"))
5164                 tsec->create_sid = sid;
5165         else if (!strcmp(name, "keycreate")) {
5166                 error = may_create_key(sid, p);
5167                 if (error)
5168                         return error;
5169                 tsec->keycreate_sid = sid;
5170         } else if (!strcmp(name, "sockcreate"))
5171                 tsec->sockcreate_sid = sid;
5172         else if (!strcmp(name, "current")) {
5173                 struct av_decision avd;
5174
5175                 if (sid == 0)
5176                         return -EINVAL;
5177
5178                 /* Only allow single threaded processes to change context */
5179                 if (atomic_read(&p->mm->mm_users) != 1) {
5180                         struct task_struct *g, *t;
5181                         struct mm_struct *mm = p->mm;
5182                         read_lock(&tasklist_lock);
5183                         do_each_thread(g, t)
5184                                 if (t->mm == mm && t != p) {
5185                                         read_unlock(&tasklist_lock);
5186                                         return -EPERM;
5187                                 }
5188                         while_each_thread(g, t);
5189                         read_unlock(&tasklist_lock);
5190                 }
5191
5192                 /* Check permissions for the transition. */
5193                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5194                                      PROCESS__DYNTRANSITION, NULL);
5195                 if (error)
5196                         return error;
5197
5198                 /* Check for ptracing, and update the task SID if ok.
5199                    Otherwise, leave SID unchanged and fail. */
5200                 task_lock(p);
5201                 rcu_read_lock();
5202                 tracer = task_tracer_task(p);
5203                 if (tracer != NULL) {
5204                         struct task_security_struct *ptsec = tracer->security;
5205                         u32 ptsid = ptsec->sid;
5206                         rcu_read_unlock();
5207                         error = avc_has_perm_noaudit(ptsid, sid,
5208                                                      SECCLASS_PROCESS,
5209                                                      PROCESS__PTRACE, 0, &avd);
5210                         if (!error)
5211                                 tsec->sid = sid;
5212                         task_unlock(p);
5213                         avc_audit(ptsid, sid, SECCLASS_PROCESS,
5214                                   PROCESS__PTRACE, &avd, error, NULL);
5215                         if (error)
5216                                 return error;
5217                 } else {
5218                         rcu_read_unlock();
5219                         tsec->sid = sid;
5220                         task_unlock(p);
5221                 }
5222         }
5223         else
5224                 return -EINVAL;
5225
5226         return size;
5227 }
5228
5229 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5230 {
5231         return security_sid_to_context(secid, secdata, seclen);
5232 }
5233
5234 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5235 {
5236         return security_context_to_sid(secdata, seclen, secid);
5237 }
5238
5239 static void selinux_release_secctx(char *secdata, u32 seclen)
5240 {
5241         kfree(secdata);
5242 }
5243
5244 #ifdef CONFIG_KEYS
5245
5246 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5247                              unsigned long flags)
5248 {
5249         struct task_security_struct *tsec = tsk->security;
5250         struct key_security_struct *ksec;
5251
5252         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5253         if (!ksec)
5254                 return -ENOMEM;
5255
5256         if (tsec->keycreate_sid)
5257                 ksec->sid = tsec->keycreate_sid;
5258         else
5259                 ksec->sid = tsec->sid;
5260         k->security = ksec;
5261
5262         return 0;
5263 }
5264
5265 static void selinux_key_free(struct key *k)
5266 {
5267         struct key_security_struct *ksec = k->security;
5268
5269         k->security = NULL;
5270         kfree(ksec);
5271 }
5272
5273 static int selinux_key_permission(key_ref_t key_ref,
5274                             struct task_struct *ctx,
5275                             key_perm_t perm)
5276 {
5277         struct key *key;
5278         struct task_security_struct *tsec;
5279         struct key_security_struct *ksec;
5280
5281         key = key_ref_to_ptr(key_ref);
5282
5283         tsec = ctx->security;
5284         ksec = key->security;
5285
5286         /* if no specific permissions are requested, we skip the
5287            permission check. No serious, additional covert channels
5288            appear to be created. */
5289         if (perm == 0)
5290                 return 0;
5291
5292         return avc_has_perm(tsec->sid, ksec->sid,
5293                             SECCLASS_KEY, perm, NULL);
5294 }
5295
5296 #endif
5297
5298 static struct security_operations selinux_ops = {
5299         .name =                         "selinux",
5300
5301         .ptrace =                       selinux_ptrace,
5302         .capget =                       selinux_capget,
5303         .capset_check =                 selinux_capset_check,
5304         .capset_set =                   selinux_capset_set,
5305         .sysctl =                       selinux_sysctl,
5306         .capable =                      selinux_capable,
5307         .quotactl =                     selinux_quotactl,
5308         .quota_on =                     selinux_quota_on,
5309         .syslog =                       selinux_syslog,
5310         .vm_enough_memory =             selinux_vm_enough_memory,
5311
5312         .netlink_send =                 selinux_netlink_send,
5313         .netlink_recv =                 selinux_netlink_recv,
5314
5315         .bprm_alloc_security =          selinux_bprm_alloc_security,
5316         .bprm_free_security =           selinux_bprm_free_security,
5317         .bprm_apply_creds =             selinux_bprm_apply_creds,
5318         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5319         .bprm_set_security =            selinux_bprm_set_security,
5320         .bprm_check_security =          selinux_bprm_check_security,
5321         .bprm_secureexec =              selinux_bprm_secureexec,
5322
5323         .sb_alloc_security =            selinux_sb_alloc_security,
5324         .sb_free_security =             selinux_sb_free_security,
5325         .sb_copy_data =                 selinux_sb_copy_data,
5326         .sb_kern_mount =                selinux_sb_kern_mount,
5327         .sb_statfs =                    selinux_sb_statfs,
5328         .sb_mount =                     selinux_mount,
5329         .sb_umount =                    selinux_umount,
5330         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5331         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5332         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5333         .sb_parse_opts_str =            selinux_parse_opts_str,
5334
5335
5336         .inode_alloc_security =         selinux_inode_alloc_security,
5337         .inode_free_security =          selinux_inode_free_security,
5338         .inode_init_security =          selinux_inode_init_security,
5339         .inode_create =                 selinux_inode_create,
5340         .inode_link =                   selinux_inode_link,
5341         .inode_unlink =                 selinux_inode_unlink,
5342         .inode_symlink =                selinux_inode_symlink,
5343         .inode_mkdir =                  selinux_inode_mkdir,
5344         .inode_rmdir =                  selinux_inode_rmdir,
5345         .inode_mknod =                  selinux_inode_mknod,
5346         .inode_rename =                 selinux_inode_rename,
5347         .inode_readlink =               selinux_inode_readlink,
5348         .inode_follow_link =            selinux_inode_follow_link,
5349         .inode_permission =             selinux_inode_permission,
5350         .inode_setattr =                selinux_inode_setattr,
5351         .inode_getattr =                selinux_inode_getattr,
5352         .inode_setxattr =               selinux_inode_setxattr,
5353         .inode_post_setxattr =          selinux_inode_post_setxattr,
5354         .inode_getxattr =               selinux_inode_getxattr,
5355         .inode_listxattr =              selinux_inode_listxattr,
5356         .inode_removexattr =            selinux_inode_removexattr,
5357         .inode_getsecurity =            selinux_inode_getsecurity,
5358         .inode_setsecurity =            selinux_inode_setsecurity,
5359         .inode_listsecurity =           selinux_inode_listsecurity,
5360         .inode_need_killpriv =          selinux_inode_need_killpriv,
5361         .inode_killpriv =               selinux_inode_killpriv,
5362         .inode_getsecid =               selinux_inode_getsecid,
5363
5364         .file_permission =              selinux_file_permission,
5365         .file_alloc_security =          selinux_file_alloc_security,
5366         .file_free_security =           selinux_file_free_security,
5367         .file_ioctl =                   selinux_file_ioctl,
5368         .file_mmap =                    selinux_file_mmap,
5369         .file_mprotect =                selinux_file_mprotect,
5370         .file_lock =                    selinux_file_lock,
5371         .file_fcntl =                   selinux_file_fcntl,
5372         .file_set_fowner =              selinux_file_set_fowner,
5373         .file_send_sigiotask =          selinux_file_send_sigiotask,
5374         .file_receive =                 selinux_file_receive,
5375
5376         .dentry_open =                  selinux_dentry_open,
5377
5378         .task_create =                  selinux_task_create,
5379         .task_alloc_security =          selinux_task_alloc_security,
5380         .task_free_security =           selinux_task_free_security,
5381         .task_setuid =                  selinux_task_setuid,
5382         .task_post_setuid =             selinux_task_post_setuid,
5383         .task_setgid =                  selinux_task_setgid,
5384         .task_setpgid =                 selinux_task_setpgid,
5385         .task_getpgid =                 selinux_task_getpgid,
5386         .task_getsid =                  selinux_task_getsid,
5387         .task_getsecid =                selinux_task_getsecid,
5388         .task_setgroups =               selinux_task_setgroups,
5389         .task_setnice =                 selinux_task_setnice,
5390         .task_setioprio =               selinux_task_setioprio,
5391         .task_getioprio =               selinux_task_getioprio,
5392         .task_setrlimit =               selinux_task_setrlimit,
5393         .task_setscheduler =            selinux_task_setscheduler,
5394         .task_getscheduler =            selinux_task_getscheduler,
5395         .task_movememory =              selinux_task_movememory,
5396         .task_kill =                    selinux_task_kill,
5397         .task_wait =                    selinux_task_wait,
5398         .task_prctl =                   selinux_task_prctl,
5399         .task_reparent_to_init =        selinux_task_reparent_to_init,
5400         .task_to_inode =                selinux_task_to_inode,
5401
5402         .ipc_permission =               selinux_ipc_permission,
5403         .ipc_getsecid =                 selinux_ipc_getsecid,
5404
5405         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5406         .msg_msg_free_security =        selinux_msg_msg_free_security,
5407
5408         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5409         .msg_queue_free_security =      selinux_msg_queue_free_security,
5410         .msg_queue_associate =          selinux_msg_queue_associate,
5411         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5412         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5413         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5414
5415         .shm_alloc_security =           selinux_shm_alloc_security,
5416         .shm_free_security =            selinux_shm_free_security,
5417         .shm_associate =                selinux_shm_associate,
5418         .shm_shmctl =                   selinux_shm_shmctl,
5419         .shm_shmat =                    selinux_shm_shmat,
5420
5421         .sem_alloc_security =           selinux_sem_alloc_security,
5422         .sem_free_security =            selinux_sem_free_security,
5423         .sem_associate =                selinux_sem_associate,
5424         .sem_semctl =                   selinux_sem_semctl,
5425         .sem_semop =                    selinux_sem_semop,
5426
5427         .register_security =            selinux_register_security,
5428
5429         .d_instantiate =                selinux_d_instantiate,
5430
5431         .getprocattr =                  selinux_getprocattr,
5432         .setprocattr =                  selinux_setprocattr,
5433
5434         .secid_to_secctx =              selinux_secid_to_secctx,
5435         .secctx_to_secid =              selinux_secctx_to_secid,
5436         .release_secctx =               selinux_release_secctx,
5437
5438         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5439         .unix_may_send =                selinux_socket_unix_may_send,
5440
5441         .socket_create =                selinux_socket_create,
5442         .socket_post_create =           selinux_socket_post_create,
5443         .socket_bind =                  selinux_socket_bind,
5444         .socket_connect =               selinux_socket_connect,
5445         .socket_listen =                selinux_socket_listen,
5446         .socket_accept =                selinux_socket_accept,
5447         .socket_sendmsg =               selinux_socket_sendmsg,
5448         .socket_recvmsg =               selinux_socket_recvmsg,
5449         .socket_getsockname =           selinux_socket_getsockname,
5450         .socket_getpeername =           selinux_socket_getpeername,
5451         .socket_getsockopt =            selinux_socket_getsockopt,
5452         .socket_setsockopt =            selinux_socket_setsockopt,
5453         .socket_shutdown =              selinux_socket_shutdown,
5454         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5455         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5456         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5457         .sk_alloc_security =            selinux_sk_alloc_security,
5458         .sk_free_security =             selinux_sk_free_security,
5459         .sk_clone_security =            selinux_sk_clone_security,
5460         .sk_getsecid =                  selinux_sk_getsecid,
5461         .sock_graft =                   selinux_sock_graft,
5462         .inet_conn_request =            selinux_inet_conn_request,
5463         .inet_csk_clone =               selinux_inet_csk_clone,
5464         .inet_conn_established =        selinux_inet_conn_established,
5465         .req_classify_flow =            selinux_req_classify_flow,
5466
5467 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5468         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5469         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5470         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5471         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5472         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5473         .xfrm_state_free_security =     selinux_xfrm_state_free,
5474         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5475         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5476         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5477         .xfrm_decode_session =          selinux_xfrm_decode_session,
5478 #endif
5479
5480 #ifdef CONFIG_KEYS
5481         .key_alloc =                    selinux_key_alloc,
5482         .key_free =                     selinux_key_free,
5483         .key_permission =               selinux_key_permission,
5484 #endif
5485
5486 #ifdef CONFIG_AUDIT
5487         .audit_rule_init =              selinux_audit_rule_init,
5488         .audit_rule_known =             selinux_audit_rule_known,
5489         .audit_rule_match =             selinux_audit_rule_match,
5490         .audit_rule_free =              selinux_audit_rule_free,
5491 #endif
5492 };
5493
5494 static __init int selinux_init(void)
5495 {
5496         struct task_security_struct *tsec;
5497
5498         if (!security_module_enable(&selinux_ops)) {
5499                 selinux_enabled = 0;
5500                 return 0;
5501         }
5502
5503         if (!selinux_enabled) {
5504                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5505                 return 0;
5506         }
5507
5508         printk(KERN_INFO "SELinux:  Initializing.\n");
5509
5510         /* Set the security state for the initial task. */
5511         if (task_alloc_security(current))
5512                 panic("SELinux:  Failed to initialize initial task.\n");
5513         tsec = current->security;
5514         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5515
5516         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5517                                             sizeof(struct inode_security_struct),
5518                                             0, SLAB_PANIC, NULL);
5519         avc_init();
5520
5521         original_ops = secondary_ops = security_ops;
5522         if (!secondary_ops)
5523                 panic ("SELinux: No initial security operations\n");
5524         if (register_security (&selinux_ops))
5525                 panic("SELinux: Unable to register with kernel.\n");
5526
5527         if (selinux_enforcing) {
5528                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5529         } else {
5530                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5531         }
5532
5533 #ifdef CONFIG_KEYS
5534         /* Add security information to initial keyrings */
5535         selinux_key_alloc(&root_user_keyring, current,
5536                           KEY_ALLOC_NOT_IN_QUOTA);
5537         selinux_key_alloc(&root_session_keyring, current,
5538                           KEY_ALLOC_NOT_IN_QUOTA);
5539 #endif
5540
5541         return 0;
5542 }
5543
5544 void selinux_complete_init(void)
5545 {
5546         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5547
5548         /* Set up any superblocks initialized prior to the policy load. */
5549         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5550         spin_lock(&sb_lock);
5551         spin_lock(&sb_security_lock);
5552 next_sb:
5553         if (!list_empty(&superblock_security_head)) {
5554                 struct superblock_security_struct *sbsec =
5555                                 list_entry(superblock_security_head.next,
5556                                            struct superblock_security_struct,
5557                                            list);
5558                 struct super_block *sb = sbsec->sb;
5559                 sb->s_count++;
5560                 spin_unlock(&sb_security_lock);
5561                 spin_unlock(&sb_lock);
5562                 down_read(&sb->s_umount);
5563                 if (sb->s_root)
5564                         superblock_doinit(sb, NULL);
5565                 drop_super(sb);
5566                 spin_lock(&sb_lock);
5567                 spin_lock(&sb_security_lock);
5568                 list_del_init(&sbsec->list);
5569                 goto next_sb;
5570         }
5571         spin_unlock(&sb_security_lock);
5572         spin_unlock(&sb_lock);
5573 }
5574
5575 /* SELinux requires early initialization in order to label
5576    all processes and objects when they are created. */
5577 security_initcall(selinux_init);
5578
5579 #if defined(CONFIG_NETFILTER)
5580
5581 static struct nf_hook_ops selinux_ipv4_ops[] = {
5582         {
5583                 .hook =         selinux_ipv4_postroute,
5584                 .owner =        THIS_MODULE,
5585                 .pf =           PF_INET,
5586                 .hooknum =      NF_INET_POST_ROUTING,
5587                 .priority =     NF_IP_PRI_SELINUX_LAST,
5588         },
5589         {
5590                 .hook =         selinux_ipv4_forward,
5591                 .owner =        THIS_MODULE,
5592                 .pf =           PF_INET,
5593                 .hooknum =      NF_INET_FORWARD,
5594                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5595         }
5596 };
5597
5598 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5599
5600 static struct nf_hook_ops selinux_ipv6_ops[] = {
5601         {
5602                 .hook =         selinux_ipv6_postroute,
5603                 .owner =        THIS_MODULE,
5604                 .pf =           PF_INET6,
5605                 .hooknum =      NF_INET_POST_ROUTING,
5606                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5607         },
5608         {
5609                 .hook =         selinux_ipv6_forward,
5610                 .owner =        THIS_MODULE,
5611                 .pf =           PF_INET6,
5612                 .hooknum =      NF_INET_FORWARD,
5613                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5614         }
5615 };
5616
5617 #endif  /* IPV6 */
5618
5619 static int __init selinux_nf_ip_init(void)
5620 {
5621         int err = 0;
5622         u32 iter;
5623
5624         if (!selinux_enabled)
5625                 goto out;
5626
5627         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5628
5629         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5630                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5631                 if (err)
5632                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5633                               err);
5634         }
5635
5636 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5637         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5638                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5639                 if (err)
5640                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5641                               err);
5642         }
5643 #endif  /* IPV6 */
5644
5645 out:
5646         return err;
5647 }
5648
5649 __initcall(selinux_nf_ip_init);
5650
5651 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5652 static void selinux_nf_ip_exit(void)
5653 {
5654         u32 iter;
5655
5656         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5657
5658         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5659                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5660 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5661         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5662                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5663 #endif  /* IPV6 */
5664 }
5665 #endif
5666
5667 #else /* CONFIG_NETFILTER */
5668
5669 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5670 #define selinux_nf_ip_exit()
5671 #endif
5672
5673 #endif /* CONFIG_NETFILTER */
5674
5675 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5676 int selinux_disable(void)
5677 {
5678         extern void exit_sel_fs(void);
5679         static int selinux_disabled = 0;
5680
5681         if (ss_initialized) {
5682                 /* Not permitted after initial policy load. */
5683                 return -EINVAL;
5684         }
5685
5686         if (selinux_disabled) {
5687                 /* Only do this once. */
5688                 return -EINVAL;
5689         }
5690
5691         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5692
5693         selinux_disabled = 1;
5694         selinux_enabled = 0;
5695
5696         /* Reset security_ops to the secondary module, dummy or capability. */
5697         security_ops = secondary_ops;
5698
5699         /* Unregister netfilter hooks. */
5700         selinux_nf_ip_exit();
5701
5702         /* Unregister selinuxfs. */
5703         exit_sel_fs();
5704
5705         return 0;
5706 }
5707 #endif