err.no Git - linux-2.6/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *                Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <asm/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "xfrm.h"
  84 #include "netlabel.h"
  85
  86 #define XATTR_SELINUX_SUFFIX "selinux"
  87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  88
  89 #define NUM_SEL_MNT_OPTS 4
  90
  91 extern unsigned int policydb_loaded_version;
  92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  93 extern int selinux_compat_net;
  94 extern struct security_operations *security_ops;
  95
  96 /* SECMARK reference count */
  97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 100 int selinux_enforcing = 0;
 101
 102 static int __init enforcing_setup(char *str)
 103 {
 104         selinux_enforcing = simple_strtol(str,NULL,0);
 105         return 1;
 106 }
 107 __setup("enforcing=", enforcing_setup);
 108 #endif
 109
 110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 112
 113 static int __init selinux_enabled_setup(char *str)
 114 {
 115         selinux_enabled = simple_strtol(str, NULL, 0);
 116         return 1;
 117 }
 118 __setup("selinux=", selinux_enabled_setup);
 119 #else
 120 int selinux_enabled = 1;
 121 #endif
 122
 123 /* Original (dummy) security module. */
 124 static struct security_operations *original_ops = NULL;
 125
 126 /* Minimal support for a secondary security module,
 127    just to allow the use of the dummy or capability modules.
 128    The owlsm module can alternatively be used as a secondary
 129    module as long as CONFIG_OWLSM_FD is not enabled. */
 130 static struct security_operations *secondary_ops = NULL;
 131
 132 /* Lists of inode and superblock security structures initialized
 133    before the policy was loaded. */
 134 static LIST_HEAD(superblock_security_head);
 135 static DEFINE_SPINLOCK(sb_security_lock);
 136
 137 static struct kmem_cache *sel_inode_cache;
 138
 139 /**
 140  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 141  *
 142  * Description:
 143  * This function checks the SECMARK reference counter to see if any SECMARK
 144  * targets are currently configured, if the reference counter is greater than
 145  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 146  * enabled, false (0) if SECMARK is disabled.
 147  *
 148  */
 149 static int selinux_secmark_enabled(void)
 150 {
 151         return (atomic_read(&selinux_secmark_refcount) > 0);
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_error = -1,
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 3,
 323         Opt_rootcontext = 4,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331         {Opt_error, NULL},
 332 };
 333
 334 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 335
 336 static int may_context_mount_sb_relabel(u32 sid,
 337                         struct superblock_security_struct *sbsec,
 338                         struct task_security_struct *tsec)
 339 {
 340         int rc;
 341
 342         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 343                           FILESYSTEM__RELABELFROM, NULL);
 344         if (rc)
 345                 return rc;
 346
 347         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELTO, NULL);
 349         return rc;
 350 }
 351
 352 static int may_context_mount_inode_relabel(u32 sid,
 353                         struct superblock_security_struct *sbsec,
 354                         struct task_security_struct *tsec)
 355 {
 356         int rc;
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__ASSOCIATE, NULL);
 364         return rc;
 365 }
 366
 367 static int sb_finish_set_opts(struct super_block *sb)
 368 {
 369         struct superblock_security_struct *sbsec = sb->s_security;
 370         struct dentry *root = sb->s_root;
 371         struct inode *root_inode = root->d_inode;
 372         int rc = 0;
 373
 374         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 375                 /* Make sure that the xattr handler exists and that no
 376                    error other than -ENODATA is returned by getxattr on
 377                    the root directory.  -ENODATA is ok, as this may be
 378                    the first boot of the SELinux kernel before we have
 379                    assigned xattr values to the filesystem. */
 380                 if (!root_inode->i_op->getxattr) {
 381                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 382                                "xattr support\n", sb->s_id, sb->s_type->name);
 383                         rc = -EOPNOTSUPP;
 384                         goto out;
 385                 }
 386                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 387                 if (rc < 0 && rc != -ENODATA) {
 388                         if (rc == -EOPNOTSUPP)
 389                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 390                                        "%s) has no security xattr handler\n",
 391                                        sb->s_id, sb->s_type->name);
 392                         else
 393                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 394                                        "%s) getxattr errno %d\n", sb->s_id,
 395                                        sb->s_type->name, -rc);
 396                         goto out;
 397                 }
 398         }
 399
 400         sbsec->initialized = 1;
 401
 402         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 404                        sb->s_id, sb->s_type->name);
 405         else
 406                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 407                        sb->s_id, sb->s_type->name,
 408                        labeling_behaviors[sbsec->behavior-1]);
 409
 410         /* Initialize the root inode. */
 411         rc = inode_doinit_with_dentry(root_inode, root);
 412
 413         /* Initialize any other inodes associated with the superblock, e.g.
 414            inodes created prior to initial policy load or inodes created
 415            during get_sb by a pseudo filesystem that directly
 416            populates itself. */
 417         spin_lock(&sbsec->isec_lock);
 418 next_inode:
 419         if (!list_empty(&sbsec->isec_head)) {
 420                 struct inode_security_struct *isec =
 421                                 list_entry(sbsec->isec_head.next,
 422                                            struct inode_security_struct, list);
 423                 struct inode *inode = isec->inode;
 424                 spin_unlock(&sbsec->isec_lock);
 425                 inode = igrab(inode);
 426                 if (inode) {
 427                         if (!IS_PRIVATE(inode))
 428                                 inode_doinit(inode);
 429                         iput(inode);
 430                 }
 431                 spin_lock(&sbsec->isec_lock);
 432                 list_del_init(&isec->list);
 433                 goto next_inode;
 434         }
 435         spin_unlock(&sbsec->isec_lock);
 436 out:
 437         return rc;
 438 }
 439
 440 /*
 441  * This function should allow an FS to ask what it's mount security
 442  * options were so it can use those later for submounts, displaying
 443  * mount options, or whatever.
 444  */
 445 static int selinux_get_mnt_opts(const struct super_block *sb,
 446                                 struct security_mnt_opts *opts)
 447 {
 448         int rc = 0, i;
 449         struct superblock_security_struct *sbsec = sb->s_security;
 450         char *context = NULL;
 451         u32 len;
 452         char tmp;
 453
 454         security_init_mnt_opts(opts);
 455
 456         if (!sbsec->initialized)
 457                 return -EINVAL;
 458
 459         if (!ss_initialized)
 460                 return -EINVAL;
 461
 462         /*
 463          * if we ever use sbsec flags for anything other than tracking mount
 464          * settings this is going to need a mask
 465          */
 466         tmp = sbsec->flags;
 467         /* count the number of mount options for this sb */
 468         for (i = 0; i < 8; i++) {
 469                 if (tmp & 0x01)
 470                         opts->num_mnt_opts++;
 471                 tmp >>= 1;
 472         }
 473
 474         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 475         if (!opts->mnt_opts) {
 476                 rc = -ENOMEM;
 477                 goto out_free;
 478         }
 479
 480         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 481         if (!opts->mnt_opts_flags) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         i = 0;
 487         if (sbsec->flags & FSCONTEXT_MNT) {
 488                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 489                 if (rc)
 490                         goto out_free;
 491                 opts->mnt_opts[i] = context;
 492                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 493         }
 494         if (sbsec->flags & CONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 500         }
 501         if (sbsec->flags & DEFCONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 507         }
 508         if (sbsec->flags & ROOTCONTEXT_MNT) {
 509                 struct inode *root = sbsec->sb->s_root->d_inode;
 510                 struct inode_security_struct *isec = root->i_security;
 511
 512                 rc = security_sid_to_context(isec->sid, &context, &len);
 513                 if (rc)
 514                         goto out_free;
 515                 opts->mnt_opts[i] = context;
 516                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 517         }
 518
 519         BUG_ON(i != opts->num_mnt_opts);
 520
 521         return 0;
 522
 523 out_free:
 524         security_free_mnt_opts(opts);
 525         return rc;
 526 }
 527
 528 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 529                       u32 old_sid, u32 new_sid)
 530 {
 531         /* check if the old mount command had the same options */
 532         if (sbsec->initialized)
 533                 if (!(sbsec->flags & flag) ||
 534                     (old_sid != new_sid))
 535                         return 1;
 536
 537         /* check if we were passed the same options twice,
 538          * aka someone passed context=a,context=b
 539          */
 540         if (!sbsec->initialized)
 541                 if (sbsec->flags & flag)
 542                         return 1;
 543         return 0;
 544 }
 545
 546 /*
 547  * Allow filesystems with binary mount data to explicitly set mount point
 548  * labeling information.
 549  */
 550 static int selinux_set_mnt_opts(struct super_block *sb,
 551                                 struct security_mnt_opts *opts)
 552 {
 553         int rc = 0, i;
 554         struct task_security_struct *tsec = current->security;
 555         struct superblock_security_struct *sbsec = sb->s_security;
 556         const char *name = sb->s_type->name;
 557         struct inode *inode = sbsec->sb->s_root->d_inode;
 558         struct inode_security_struct *root_isec = inode->i_security;
 559         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 560         u32 defcontext_sid = 0;
 561         char **mount_options = opts->mnt_opts;
 562         int *flags = opts->mnt_opts_flags;
 563         int num_opts = opts->num_mnt_opts;
 564
 565         mutex_lock(&sbsec->lock);
 566
 567         if (!ss_initialized) {
 568                 if (!num_opts) {
 569                         /* Defer initialization until selinux_complete_init,
 570                            after the initial policy is loaded and the security
 571                            server is ready to handle calls. */
 572                         spin_lock(&sb_security_lock);
 573                         if (list_empty(&sbsec->list))
 574                                 list_add(&sbsec->list, &superblock_security_head);
 575                         spin_unlock(&sb_security_lock);
 576                         goto out;
 577                 }
 578                 rc = -EINVAL;
 579                 printk(KERN_WARNING "Unable to set superblock options before "
 580                        "the security server is initialized\n");
 581                 goto out;
 582         }
 583
 584         /*
 585          * Binary mount data FS will come through this function twice.  Once
 586          * from an explicit call and once from the generic calls from the vfs.
 587          * Since the generic VFS calls will not contain any security mount data
 588          * we need to skip the double mount verification.
 589          *
 590          * This does open a hole in which we will not notice if the first
 591          * mount using this sb set explict options and a second mount using
 592          * this sb does not set any security options.  (The first options
 593          * will be used for both mounts)
 594          */
 595         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 596             && (num_opts == 0))
 597                 goto out;
 598
 599         /*
 600          * parse the mount options, check if they are valid sids.
 601          * also check if someone is trying to mount the same sb more
 602          * than once with different security options.
 603          */
 604         for (i = 0; i < num_opts; i++) {
 605                 u32 sid;
 606                 rc = security_context_to_sid(mount_options[i],
 607                                              strlen(mount_options[i]), &sid);
 608                 if (rc) {
 609                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 610                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 611                                mount_options[i], sb->s_id, name, rc);
 612                         goto out;
 613                 }
 614                 switch (flags[i]) {
 615                 case FSCONTEXT_MNT:
 616                         fscontext_sid = sid;
 617
 618                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 619                                         fscontext_sid))
 620                                 goto out_double_mount;
 621
 622                         sbsec->flags |= FSCONTEXT_MNT;
 623                         break;
 624                 case CONTEXT_MNT:
 625                         context_sid = sid;
 626
 627                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 628                                         context_sid))
 629                                 goto out_double_mount;
 630
 631                         sbsec->flags |= CONTEXT_MNT;
 632                         break;
 633                 case ROOTCONTEXT_MNT:
 634                         rootcontext_sid = sid;
 635
 636                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 637                                         rootcontext_sid))
 638                                 goto out_double_mount;
 639
 640                         sbsec->flags |= ROOTCONTEXT_MNT;
 641
 642                         break;
 643                 case DEFCONTEXT_MNT:
 644                         defcontext_sid = sid;
 645
 646                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 647                                         defcontext_sid))
 648                                 goto out_double_mount;
 649
 650                         sbsec->flags |= DEFCONTEXT_MNT;
 651
 652                         break;
 653                 default:
 654                         rc = -EINVAL;
 655                         goto out;
 656                 }
 657         }
 658
 659         if (sbsec->initialized) {
 660                 /* previously mounted with options, but not on this attempt? */
 661                 if (sbsec->flags && !num_opts)
 662                         goto out_double_mount;
 663                 rc = 0;
 664                 goto out;
 665         }
 666
 667         if (strcmp(sb->s_type->name, "proc") == 0)
 668                 sbsec->proc = 1;
 669
 670         /* Determine the labeling behavior to use for this filesystem type. */
 671         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 672         if (rc) {
 673                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 674                        __FUNCTION__, sb->s_type->name, rc);
 675                 goto out;
 676         }
 677
 678         /* sets the context of the superblock for the fs being mounted. */
 679         if (fscontext_sid) {
 680
 681                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 682                 if (rc)
 683                         goto out;
 684
 685                 sbsec->sid = fscontext_sid;
 686         }
 687
 688         /*
 689          * Switch to using mount point labeling behavior.
 690          * sets the label used on all file below the mountpoint, and will set
 691          * the superblock context if not already set.
 692          */
 693         if (context_sid) {
 694                 if (!fscontext_sid) {
 695                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 696                         if (rc)
 697                                 goto out;
 698                         sbsec->sid = context_sid;
 699                 } else {
 700                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 701                         if (rc)
 702                                 goto out;
 703                 }
 704                 if (!rootcontext_sid)
 705                         rootcontext_sid = context_sid;
 706
 707                 sbsec->mntpoint_sid = context_sid;
 708                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 709         }
 710
 711         if (rootcontext_sid) {
 712                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 713                 if (rc)
 714                         goto out;
 715
 716                 root_isec->sid = rootcontext_sid;
 717                 root_isec->initialized = 1;
 718         }
 719
 720         if (defcontext_sid) {
 721                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 722                         rc = -EINVAL;
 723                         printk(KERN_WARNING "SELinux: defcontext option is "
 724                                "invalid for this filesystem type\n");
 725                         goto out;
 726                 }
 727
 728                 if (defcontext_sid != sbsec->def_sid) {
 729                         rc = may_context_mount_inode_relabel(defcontext_sid,
 730                                                              sbsec, tsec);
 731                         if (rc)
 732                                 goto out;
 733                 }
 734
 735                 sbsec->def_sid = defcontext_sid;
 736         }
 737
 738         rc = sb_finish_set_opts(sb);
 739 out:
 740         mutex_unlock(&sbsec->lock);
 741         return rc;
 742 out_double_mount:
 743         rc = -EINVAL;
 744         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 745                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 746         goto out;
 747 }
 748
 749 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 750                                         struct super_block *newsb)
 751 {
 752         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 753         struct superblock_security_struct *newsbsec = newsb->s_security;
 754
 755         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 756         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 757         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 758
 759         /* we can't error, we can't save the info, this shouldn't get called
 760          * this early in the boot process. */
 761         BUG_ON(!ss_initialized);
 762
 763         /* how can we clone if the old one wasn't set up?? */
 764         BUG_ON(!oldsbsec->initialized);
 765
 766         /* if fs is reusing a sb, just let its options stand... */
 767         if (newsbsec->initialized)
 768                 return;
 769
 770         mutex_lock(&newsbsec->lock);
 771
 772         newsbsec->flags = oldsbsec->flags;
 773
 774         newsbsec->sid = oldsbsec->sid;
 775         newsbsec->def_sid = oldsbsec->def_sid;
 776         newsbsec->behavior = oldsbsec->behavior;
 777
 778         if (set_context) {
 779                 u32 sid = oldsbsec->mntpoint_sid;
 780
 781                 if (!set_fscontext)
 782                         newsbsec->sid = sid;
 783                 if (!set_rootcontext) {
 784                         struct inode *newinode = newsb->s_root->d_inode;
 785                         struct inode_security_struct *newisec = newinode->i_security;
 786                         newisec->sid = sid;
 787                 }
 788                 newsbsec->mntpoint_sid = sid;
 789         }
 790         if (set_rootcontext) {
 791                 const struct inode *oldinode = oldsb->s_root->d_inode;
 792                 const struct inode_security_struct *oldisec = oldinode->i_security;
 793                 struct inode *newinode = newsb->s_root->d_inode;
 794                 struct inode_security_struct *newisec = newinode->i_security;
 795
 796                 newisec->sid = oldisec->sid;
 797         }
 798
 799         sb_finish_set_opts(newsb);
 800         mutex_unlock(&newsbsec->lock);
 801 }
 802
 803 static int selinux_parse_opts_str(char *options,
 804                                   struct security_mnt_opts *opts)
 805 {
 806         char *p;
 807         char *context = NULL, *defcontext = NULL;
 808         char *fscontext = NULL, *rootcontext = NULL;
 809         int rc, num_mnt_opts = 0;
 810
 811         opts->num_mnt_opts = 0;
 812
 813         /* Standard string-based options. */
 814         while ((p = strsep(&options, "|")) != NULL) {
 815                 int token;
 816                 substring_t args[MAX_OPT_ARGS];
 817
 818                 if (!*p)
 819                         continue;
 820
 821                 token = match_token(p, tokens, args);
 822
 823                 switch (token) {
 824                 case Opt_context:
 825                         if (context || defcontext) {
 826                                 rc = -EINVAL;
 827                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 828                                 goto out_err;
 829                         }
 830                         context = match_strdup(&args[0]);
 831                         if (!context) {
 832                                 rc = -ENOMEM;
 833                                 goto out_err;
 834                         }
 835                         break;
 836
 837                 case Opt_fscontext:
 838                         if (fscontext) {
 839                                 rc = -EINVAL;
 840                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 841                                 goto out_err;
 842                         }
 843                         fscontext = match_strdup(&args[0]);
 844                         if (!fscontext) {
 845                                 rc = -ENOMEM;
 846                                 goto out_err;
 847                         }
 848                         break;
 849
 850                 case Opt_rootcontext:
 851                         if (rootcontext) {
 852                                 rc = -EINVAL;
 853                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 854                                 goto out_err;
 855                         }
 856                         rootcontext = match_strdup(&args[0]);
 857                         if (!rootcontext) {
 858                                 rc = -ENOMEM;
 859                                 goto out_err;
 860                         }
 861                         break;
 862
 863                 case Opt_defcontext:
 864                         if (context || defcontext) {
 865                                 rc = -EINVAL;
 866                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 867                                 goto out_err;
 868                         }
 869                         defcontext = match_strdup(&args[0]);
 870                         if (!defcontext) {
 871                                 rc = -ENOMEM;
 872                                 goto out_err;
 873                         }
 874                         break;
 875
 876                 default:
 877                         rc = -EINVAL;
 878                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 879                         goto out_err;
 880
 881                 }
 882         }
 883
 884         rc = -ENOMEM;
 885         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 886         if (!opts->mnt_opts)
 887                 goto out_err;
 888
 889         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 890         if (!opts->mnt_opts_flags) {
 891                 kfree(opts->mnt_opts);
 892                 goto out_err;
 893         }
 894
 895         if (fscontext) {
 896                 opts->mnt_opts[num_mnt_opts] = fscontext;
 897                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 898         }
 899         if (context) {
 900                 opts->mnt_opts[num_mnt_opts] = context;
 901                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 902         }
 903         if (rootcontext) {
 904                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 905                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 906         }
 907         if (defcontext) {
 908                 opts->mnt_opts[num_mnt_opts] = defcontext;
 909                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 910         }
 911
 912         opts->num_mnt_opts = num_mnt_opts;
 913         return 0;
 914
 915 out_err:
 916         kfree(context);
 917         kfree(defcontext);
 918         kfree(fscontext);
 919         kfree(rootcontext);
 920         return rc;
 921 }
 922 /*
 923  * string mount options parsing and call set the sbsec
 924  */
 925 static int superblock_doinit(struct super_block *sb, void *data)
 926 {
 927         int rc = 0;
 928         char *options = data;
 929         struct security_mnt_opts opts;
 930
 931         security_init_mnt_opts(&opts);
 932
 933         if (!data)
 934                 goto out;
 935
 936         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 937
 938         rc = selinux_parse_opts_str(options, &opts);
 939         if (rc)
 940                 goto out_err;
 941
 942 out:
 943         rc = selinux_set_mnt_opts(sb, &opts);
 944
 945 out_err:
 946         security_free_mnt_opts(&opts);
 947         return rc;
 948 }
 949
 950 static inline u16 inode_mode_to_security_class(umode_t mode)
 951 {
 952         switch (mode & S_IFMT) {
 953         case S_IFSOCK:
 954                 return SECCLASS_SOCK_FILE;
 955         case S_IFLNK:
 956                 return SECCLASS_LNK_FILE;
 957         case S_IFREG:
 958                 return SECCLASS_FILE;
 959         case S_IFBLK:
 960                 return SECCLASS_BLK_FILE;
 961         case S_IFDIR:
 962                 return SECCLASS_DIR;
 963         case S_IFCHR:
 964                 return SECCLASS_CHR_FILE;
 965         case S_IFIFO:
 966                 return SECCLASS_FIFO_FILE;
 967
 968         }
 969
 970         return SECCLASS_FILE;
 971 }
 972
 973 static inline int default_protocol_stream(int protocol)
 974 {
 975         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 976 }
 977
 978 static inline int default_protocol_dgram(int protocol)
 979 {
 980         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 981 }
 982
 983 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 984 {
 985         switch (family) {
 986         case PF_UNIX:
 987                 switch (type) {
 988                 case SOCK_STREAM:
 989                 case SOCK_SEQPACKET:
 990                         return SECCLASS_UNIX_STREAM_SOCKET;
 991                 case SOCK_DGRAM:
 992                         return SECCLASS_UNIX_DGRAM_SOCKET;
 993                 }
 994                 break;
 995         case PF_INET:
 996         case PF_INET6:
 997                 switch (type) {
 998                 case SOCK_STREAM:
 999                         if (default_protocol_stream(protocol))
1000                                 return SECCLASS_TCP_SOCKET;
1001                         else
1002                                 return SECCLASS_RAWIP_SOCKET;
1003                 case SOCK_DGRAM:
1004                         if (default_protocol_dgram(protocol))
1005                                 return SECCLASS_UDP_SOCKET;
1006                         else
1007                                 return SECCLASS_RAWIP_SOCKET;
1008                 case SOCK_DCCP:
1009                         return SECCLASS_DCCP_SOCKET;
1010                 default:
1011                         return SECCLASS_RAWIP_SOCKET;
1012                 }
1013                 break;
1014         case PF_NETLINK:
1015                 switch (protocol) {
1016                 case NETLINK_ROUTE:
1017                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1018                 case NETLINK_FIREWALL:
1019                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1020                 case NETLINK_INET_DIAG:
1021                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1022                 case NETLINK_NFLOG:
1023                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1024                 case NETLINK_XFRM:
1025                         return SECCLASS_NETLINK_XFRM_SOCKET;
1026                 case NETLINK_SELINUX:
1027                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1028                 case NETLINK_AUDIT:
1029                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1030                 case NETLINK_IP6_FW:
1031                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1032                 case NETLINK_DNRTMSG:
1033                         return SECCLASS_NETLINK_DNRT_SOCKET;
1034                 case NETLINK_KOBJECT_UEVENT:
1035                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1036                 default:
1037                         return SECCLASS_NETLINK_SOCKET;
1038                 }
1039         case PF_PACKET:
1040                 return SECCLASS_PACKET_SOCKET;
1041         case PF_KEY:
1042                 return SECCLASS_KEY_SOCKET;
1043         case PF_APPLETALK:
1044                 return SECCLASS_APPLETALK_SOCKET;
1045         }
1046
1047         return SECCLASS_SOCKET;
1048 }
1049
1050 #ifdef CONFIG_PROC_FS
1051 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1052                                 u16 tclass,
1053                                 u32 *sid)
1054 {
1055         int buflen, rc;
1056         char *buffer, *path, *end;
1057
1058         buffer = (char*)__get_free_page(GFP_KERNEL);
1059         if (!buffer)
1060                 return -ENOMEM;
1061
1062         buflen = PAGE_SIZE;
1063         end = buffer+buflen;
1064         *--end = '\0';
1065         buflen--;
1066         path = end-1;
1067         *path = '/';
1068         while (de && de != de->parent) {
1069                 buflen -= de->namelen + 1;
1070                 if (buflen < 0)
1071                         break;
1072                 end -= de->namelen;
1073                 memcpy(end, de->name, de->namelen);
1074                 *--end = '/';
1075                 path = end;
1076                 de = de->parent;
1077         }
1078         rc = security_genfs_sid("proc", path, tclass, sid);
1079         free_page((unsigned long)buffer);
1080         return rc;
1081 }
1082 #else
1083 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1084                                 u16 tclass,
1085                                 u32 *sid)
1086 {
1087         return -EINVAL;
1088 }
1089 #endif
1090
1091 /* The inode's security attributes must be initialized before first use. */
1092 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1093 {
1094         struct superblock_security_struct *sbsec = NULL;
1095         struct inode_security_struct *isec = inode->i_security;
1096         u32 sid;
1097         struct dentry *dentry;
1098 #define INITCONTEXTLEN 255
1099         char *context = NULL;
1100         unsigned len = 0;
1101         int rc = 0;
1102
1103         if (isec->initialized)
1104                 goto out;
1105
1106         mutex_lock(&isec->lock);
1107         if (isec->initialized)
1108                 goto out_unlock;
1109
1110         sbsec = inode->i_sb->s_security;
1111         if (!sbsec->initialized) {
1112                 /* Defer initialization until selinux_complete_init,
1113                    after the initial policy is loaded and the security
1114                    server is ready to handle calls. */
1115                 spin_lock(&sbsec->isec_lock);
1116                 if (list_empty(&isec->list))
1117                         list_add(&isec->list, &sbsec->isec_head);
1118                 spin_unlock(&sbsec->isec_lock);
1119                 goto out_unlock;
1120         }
1121
1122         switch (sbsec->behavior) {
1123         case SECURITY_FS_USE_XATTR:
1124                 if (!inode->i_op->getxattr) {
1125                         isec->sid = sbsec->def_sid;
1126                         break;
1127                 }
1128
1129                 /* Need a dentry, since the xattr API requires one.
1130                    Life would be simpler if we could just pass the inode. */
1131                 if (opt_dentry) {
1132                         /* Called from d_instantiate or d_splice_alias. */
1133                         dentry = dget(opt_dentry);
1134                 } else {
1135                         /* Called from selinux_complete_init, try to find a dentry. */
1136                         dentry = d_find_alias(inode);
1137                 }
1138                 if (!dentry) {
1139                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
1140                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1141                                inode->i_ino);
1142                         goto out_unlock;
1143                 }
1144
1145                 len = INITCONTEXTLEN;
1146                 context = kmalloc(len, GFP_NOFS);
1147                 if (!context) {
1148                         rc = -ENOMEM;
1149                         dput(dentry);
1150                         goto out_unlock;
1151                 }
1152                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1153                                            context, len);
1154                 if (rc == -ERANGE) {
1155                         /* Need a larger buffer.  Query for the right size. */
1156                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1157                                                    NULL, 0);
1158                         if (rc < 0) {
1159                                 dput(dentry);
1160                                 goto out_unlock;
1161                         }
1162                         kfree(context);
1163                         len = rc;
1164                         context = kmalloc(len, GFP_NOFS);
1165                         if (!context) {
1166                                 rc = -ENOMEM;
1167                                 dput(dentry);
1168                                 goto out_unlock;
1169                         }
1170                         rc = inode->i_op->getxattr(dentry,
1171                                                    XATTR_NAME_SELINUX,
1172                                                    context, len);
1173                 }
1174                 dput(dentry);
1175                 if (rc < 0) {
1176                         if (rc != -ENODATA) {
1177                                 printk(KERN_WARNING "%s:  getxattr returned "
1178                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
1179                                        -rc, inode->i_sb->s_id, inode->i_ino);
1180                                 kfree(context);
1181                                 goto out_unlock;
1182                         }
1183                         /* Map ENODATA to the default file SID */
1184                         sid = sbsec->def_sid;
1185                         rc = 0;
1186                 } else {
1187                         rc = security_context_to_sid_default(context, rc, &sid,
1188                                                              sbsec->def_sid,
1189                                                              GFP_NOFS);
1190                         if (rc) {
1191                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
1192                                        "returned %d for dev=%s ino=%ld\n",
1193                                        __FUNCTION__, context, -rc,
1194                                        inode->i_sb->s_id, inode->i_ino);
1195                                 kfree(context);
1196                                 /* Leave with the unlabeled SID */
1197                                 rc = 0;
1198                                 break;
1199                         }
1200                 }
1201                 kfree(context);
1202                 isec->sid = sid;
1203                 break;
1204         case SECURITY_FS_USE_TASK:
1205                 isec->sid = isec->task_sid;
1206                 break;
1207         case SECURITY_FS_USE_TRANS:
1208                 /* Default to the fs SID. */
1209                 isec->sid = sbsec->sid;
1210
1211                 /* Try to obtain a transition SID. */
1212                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1213                 rc = security_transition_sid(isec->task_sid,
1214                                              sbsec->sid,
1215                                              isec->sclass,
1216                                              &sid);
1217                 if (rc)
1218                         goto out_unlock;
1219                 isec->sid = sid;
1220                 break;
1221         case SECURITY_FS_USE_MNTPOINT:
1222                 isec->sid = sbsec->mntpoint_sid;
1223                 break;
1224         default:
1225                 /* Default to the fs superblock SID. */
1226                 isec->sid = sbsec->sid;
1227
1228                 if (sbsec->proc) {
1229                         struct proc_inode *proci = PROC_I(inode);
1230                         if (proci->pde) {
1231                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1232                                 rc = selinux_proc_get_sid(proci->pde,
1233                                                           isec->sclass,
1234                                                           &sid);
1235                                 if (rc)
1236                                         goto out_unlock;
1237                                 isec->sid = sid;
1238                         }
1239                 }
1240                 break;
1241         }
1242
1243         isec->initialized = 1;
1244
1245 out_unlock:
1246         mutex_unlock(&isec->lock);
1247 out:
1248         if (isec->sclass == SECCLASS_FILE)
1249                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1250         return rc;
1251 }
1252
1253 /* Convert a Linux signal to an access vector. */
1254 static inline u32 signal_to_av(int sig)
1255 {
1256         u32 perm = 0;
1257
1258         switch (sig) {
1259         case SIGCHLD:
1260                 /* Commonly granted from child to parent. */
1261                 perm = PROCESS__SIGCHLD;
1262                 break;
1263         case SIGKILL:
1264                 /* Cannot be caught or ignored */
1265                 perm = PROCESS__SIGKILL;
1266                 break;
1267         case SIGSTOP:
1268                 /* Cannot be caught or ignored */
1269                 perm = PROCESS__SIGSTOP;
1270                 break;
1271         default:
1272                 /* All other signals. */
1273                 perm = PROCESS__SIGNAL;
1274                 break;
1275         }
1276
1277         return perm;
1278 }
1279
1280 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1281    fork check, ptrace check, etc. */
1282 static int task_has_perm(struct task_struct *tsk1,
1283                          struct task_struct *tsk2,
1284                          u32 perms)
1285 {
1286         struct task_security_struct *tsec1, *tsec2;
1287
1288         tsec1 = tsk1->security;
1289         tsec2 = tsk2->security;
1290         return avc_has_perm(tsec1->sid, tsec2->sid,
1291                             SECCLASS_PROCESS, perms, NULL);
1292 }
1293
1294 #if CAP_LAST_CAP > 63
1295 #error Fix SELinux to handle capabilities > 63.
1296 #endif
1297
1298 /* Check whether a task is allowed to use a capability. */
1299 static int task_has_capability(struct task_struct *tsk,
1300                                int cap)
1301 {
1302         struct task_security_struct *tsec;
1303         struct avc_audit_data ad;
1304         u16 sclass;
1305         u32 av = CAP_TO_MASK(cap);
1306
1307         tsec = tsk->security;
1308
1309         AVC_AUDIT_DATA_INIT(&ad,CAP);
1310         ad.tsk = tsk;
1311         ad.u.cap = cap;
1312
1313         switch (CAP_TO_INDEX(cap)) {
1314         case 0:
1315                 sclass = SECCLASS_CAPABILITY;
1316                 break;
1317         case 1:
1318                 sclass = SECCLASS_CAPABILITY2;
1319                 break;
1320         default:
1321                 printk(KERN_ERR
1322                        "SELinux:  out of range capability %d\n", cap);
1323                 BUG();
1324         }
1325         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1326 }
1327
1328 /* Check whether a task is allowed to use a system operation. */
1329 static int task_has_system(struct task_struct *tsk,
1330                            u32 perms)
1331 {
1332         struct task_security_struct *tsec;
1333
1334         tsec = tsk->security;
1335
1336         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1337                             SECCLASS_SYSTEM, perms, NULL);
1338 }
1339
1340 /* Check whether a task has a particular permission to an inode.
1341    The 'adp' parameter is optional and allows other audit
1342    data to be passed (e.g. the dentry). */
1343 static int inode_has_perm(struct task_struct *tsk,
1344                           struct inode *inode,
1345                           u32 perms,
1346                           struct avc_audit_data *adp)
1347 {
1348         struct task_security_struct *tsec;
1349         struct inode_security_struct *isec;
1350         struct avc_audit_data ad;
1351
1352         if (unlikely (IS_PRIVATE (inode)))
1353                 return 0;
1354
1355         tsec = tsk->security;
1356         isec = inode->i_security;
1357
1358         if (!adp) {
1359                 adp = &ad;
1360                 AVC_AUDIT_DATA_INIT(&ad, FS);
1361                 ad.u.fs.inode = inode;
1362         }
1363
1364         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1365 }
1366
1367 /* Same as inode_has_perm, but pass explicit audit data containing
1368    the dentry to help the auditing code to more easily generate the
1369    pathname if needed. */
1370 static inline int dentry_has_perm(struct task_struct *tsk,
1371                                   struct vfsmount *mnt,
1372                                   struct dentry *dentry,
1373                                   u32 av)
1374 {
1375         struct inode *inode = dentry->d_inode;
1376         struct avc_audit_data ad;
1377         AVC_AUDIT_DATA_INIT(&ad,FS);
1378         ad.u.fs.path.mnt = mnt;
1379         ad.u.fs.path.dentry = dentry;
1380         return inode_has_perm(tsk, inode, av, &ad);
1381 }
1382
1383 /* Check whether a task can use an open file descriptor to
1384    access an inode in a given way.  Check access to the
1385    descriptor itself, and then use dentry_has_perm to
1386    check a particular permission to the file.
1387    Access to the descriptor is implicitly granted if it
1388    has the same SID as the process.  If av is zero, then
1389    access to the file is not checked, e.g. for cases
1390    where only the descriptor is affected like seek. */
1391 static int file_has_perm(struct task_struct *tsk,
1392                                 struct file *file,
1393                                 u32 av)
1394 {
1395         struct task_security_struct *tsec = tsk->security;
1396         struct file_security_struct *fsec = file->f_security;
1397         struct inode *inode = file->f_path.dentry->d_inode;
1398         struct avc_audit_data ad;
1399         int rc;
1400
1401         AVC_AUDIT_DATA_INIT(&ad, FS);
1402         ad.u.fs.path = file->f_path;
1403
1404         if (tsec->sid != fsec->sid) {
1405                 rc = avc_has_perm(tsec->sid, fsec->sid,
1406                                   SECCLASS_FD,
1407                                   FD__USE,
1408                                   &ad);
1409                 if (rc)
1410                         return rc;
1411         }
1412
1413         /* av is zero if only checking access to the descriptor. */
1414         if (av)
1415                 return inode_has_perm(tsk, inode, av, &ad);
1416
1417         return 0;
1418 }
1419
1420 /* Check whether a task can create a file. */
1421 static int may_create(struct inode *dir,
1422                       struct dentry *dentry,
1423                       u16 tclass)
1424 {
1425         struct task_security_struct *tsec;
1426         struct inode_security_struct *dsec;
1427         struct superblock_security_struct *sbsec;
1428         u32 newsid;
1429         struct avc_audit_data ad;
1430         int rc;
1431
1432         tsec = current->security;
1433         dsec = dir->i_security;
1434         sbsec = dir->i_sb->s_security;
1435
1436         AVC_AUDIT_DATA_INIT(&ad, FS);
1437         ad.u.fs.path.dentry = dentry;
1438
1439         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1440                           DIR__ADD_NAME | DIR__SEARCH,
1441                           &ad);
1442         if (rc)
1443                 return rc;
1444
1445         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1446                 newsid = tsec->create_sid;
1447         } else {
1448                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1449                                              &newsid);
1450                 if (rc)
1451                         return rc;
1452         }
1453
1454         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1455         if (rc)
1456                 return rc;
1457
1458         return avc_has_perm(newsid, sbsec->sid,
1459                             SECCLASS_FILESYSTEM,
1460                             FILESYSTEM__ASSOCIATE, &ad);
1461 }
1462
1463 /* Check whether a task can create a key. */
1464 static int may_create_key(u32 ksid,
1465                           struct task_struct *ctx)
1466 {
1467         struct task_security_struct *tsec;
1468
1469         tsec = ctx->security;
1470
1471         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1472 }
1473
1474 #define MAY_LINK   0
1475 #define MAY_UNLINK 1
1476 #define MAY_RMDIR  2
1477
1478 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1479 static int may_link(struct inode *dir,
1480                     struct dentry *dentry,
1481                     int kind)
1482
1483 {
1484         struct task_security_struct *tsec;
1485         struct inode_security_struct *dsec, *isec;
1486         struct avc_audit_data ad;
1487         u32 av;
1488         int rc;
1489
1490         tsec = current->security;
1491         dsec = dir->i_security;
1492         isec = dentry->d_inode->i_security;
1493
1494         AVC_AUDIT_DATA_INIT(&ad, FS);
1495         ad.u.fs.path.dentry = dentry;
1496
1497         av = DIR__SEARCH;
1498         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1499         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1500         if (rc)
1501                 return rc;
1502
1503         switch (kind) {
1504         case MAY_LINK:
1505                 av = FILE__LINK;
1506                 break;
1507         case MAY_UNLINK:
1508                 av = FILE__UNLINK;
1509                 break;
1510         case MAY_RMDIR:
1511                 av = DIR__RMDIR;
1512                 break;
1513         default:
1514                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1515                 return 0;
1516         }
1517
1518         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1519         return rc;
1520 }
1521
1522 static inline int may_rename(struct inode *old_dir,
1523                              struct dentry *old_dentry,
1524                              struct inode *new_dir,
1525                              struct dentry *new_dentry)
1526 {
1527         struct task_security_struct *tsec;
1528         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1529         struct avc_audit_data ad;
1530         u32 av;
1531         int old_is_dir, new_is_dir;
1532         int rc;
1533
1534         tsec = current->security;
1535         old_dsec = old_dir->i_security;
1536         old_isec = old_dentry->d_inode->i_security;
1537         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1538         new_dsec = new_dir->i_security;
1539
1540         AVC_AUDIT_DATA_INIT(&ad, FS);
1541
1542         ad.u.fs.path.dentry = old_dentry;
1543         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1544                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1545         if (rc)
1546                 return rc;
1547         rc = avc_has_perm(tsec->sid, old_isec->sid,
1548                           old_isec->sclass, FILE__RENAME, &ad);
1549         if (rc)
1550                 return rc;
1551         if (old_is_dir && new_dir != old_dir) {
1552                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1553                                   old_isec->sclass, DIR__REPARENT, &ad);
1554                 if (rc)
1555                         return rc;
1556         }
1557
1558         ad.u.fs.path.dentry = new_dentry;
1559         av = DIR__ADD_NAME | DIR__SEARCH;
1560         if (new_dentry->d_inode)
1561                 av |= DIR__REMOVE_NAME;
1562         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1563         if (rc)
1564                 return rc;
1565         if (new_dentry->d_inode) {
1566                 new_isec = new_dentry->d_inode->i_security;
1567                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1568                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1569                                   new_isec->sclass,
1570                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1571                 if (rc)
1572                         return rc;
1573         }
1574
1575         return 0;
1576 }
1577
1578 /* Check whether a task can perform a filesystem operation. */
1579 static int superblock_has_perm(struct task_struct *tsk,
1580                                struct super_block *sb,
1581                                u32 perms,
1582                                struct avc_audit_data *ad)
1583 {
1584         struct task_security_struct *tsec;
1585         struct superblock_security_struct *sbsec;
1586
1587         tsec = tsk->security;
1588         sbsec = sb->s_security;
1589         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1590                             perms, ad);
1591 }
1592
1593 /* Convert a Linux mode and permission mask to an access vector. */
1594 static inline u32 file_mask_to_av(int mode, int mask)
1595 {
1596         u32 av = 0;
1597
1598         if ((mode & S_IFMT) != S_IFDIR) {
1599                 if (mask & MAY_EXEC)
1600                         av |= FILE__EXECUTE;
1601                 if (mask & MAY_READ)
1602                         av |= FILE__READ;
1603
1604                 if (mask & MAY_APPEND)
1605                         av |= FILE__APPEND;
1606                 else if (mask & MAY_WRITE)
1607                         av |= FILE__WRITE;
1608
1609         } else {
1610                 if (mask & MAY_EXEC)
1611                         av |= DIR__SEARCH;
1612                 if (mask & MAY_WRITE)
1613                         av |= DIR__WRITE;
1614                 if (mask & MAY_READ)
1615                         av |= DIR__READ;
1616         }
1617
1618         return av;
1619 }
1620
1621 /* Convert a Linux file to an access vector. */
1622 static inline u32 file_to_av(struct file *file)
1623 {
1624         u32 av = 0;
1625
1626         if (file->f_mode & FMODE_READ)
1627                 av |= FILE__READ;
1628         if (file->f_mode & FMODE_WRITE) {
1629                 if (file->f_flags & O_APPEND)
1630                         av |= FILE__APPEND;
1631                 else
1632                         av |= FILE__WRITE;
1633         }
1634         if (!av) {
1635                 /*
1636                  * Special file opened with flags 3 for ioctl-only use.
1637                  */
1638                 av = FILE__IOCTL;
1639         }
1640
1641         return av;
1642 }
1643
1644 /* Hook functions begin here. */
1645
1646 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1647 {
1648         struct task_security_struct *psec = parent->security;
1649         struct task_security_struct *csec = child->security;
1650         int rc;
1651
1652         rc = secondary_ops->ptrace(parent,child);
1653         if (rc)
1654                 return rc;
1655
1656         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1657         /* Save the SID of the tracing process for later use in apply_creds. */
1658         if (!(child->ptrace & PT_PTRACED) && !rc)
1659                 csec->ptrace_sid = psec->sid;
1660         return rc;
1661 }
1662
1663 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1664                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1665 {
1666         int error;
1667
1668         error = task_has_perm(current, target, PROCESS__GETCAP);
1669         if (error)
1670                 return error;
1671
1672         return secondary_ops->capget(target, effective, inheritable, permitted);
1673 }
1674
1675 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1676                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1677 {
1678         int error;
1679
1680         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1681         if (error)
1682                 return error;
1683
1684         return task_has_perm(current, target, PROCESS__SETCAP);
1685 }
1686
1687 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1688                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1689 {
1690         secondary_ops->capset_set(target, effective, inheritable, permitted);
1691 }
1692
1693 static int selinux_capable(struct task_struct *tsk, int cap)
1694 {
1695         int rc;
1696
1697         rc = secondary_ops->capable(tsk, cap);
1698         if (rc)
1699                 return rc;
1700
1701         return task_has_capability(tsk,cap);
1702 }
1703
1704 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1705 {
1706         int buflen, rc;
1707         char *buffer, *path, *end;
1708
1709         rc = -ENOMEM;
1710         buffer = (char*)__get_free_page(GFP_KERNEL);
1711         if (!buffer)
1712                 goto out;
1713
1714         buflen = PAGE_SIZE;
1715         end = buffer+buflen;
1716         *--end = '\0';
1717         buflen--;
1718         path = end-1;
1719         *path = '/';
1720         while (table) {
1721                 const char *name = table->procname;
1722                 size_t namelen = strlen(name);
1723                 buflen -= namelen + 1;
1724                 if (buflen < 0)
1725                         goto out_free;
1726                 end -= namelen;
1727                 memcpy(end, name, namelen);
1728                 *--end = '/';
1729                 path = end;
1730                 table = table->parent;
1731         }
1732         buflen -= 4;
1733         if (buflen < 0)
1734                 goto out_free;
1735         end -= 4;
1736         memcpy(end, "/sys", 4);
1737         path = end;
1738         rc = security_genfs_sid("proc", path, tclass, sid);
1739 out_free:
1740         free_page((unsigned long)buffer);
1741 out:
1742         return rc;
1743 }
1744
1745 static int selinux_sysctl(ctl_table *table, int op)
1746 {
1747         int error = 0;
1748         u32 av;
1749         struct task_security_struct *tsec;
1750         u32 tsid;
1751         int rc;
1752
1753         rc = secondary_ops->sysctl(table, op);
1754         if (rc)
1755                 return rc;
1756
1757         tsec = current->security;
1758
1759         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1760                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1761         if (rc) {
1762                 /* Default to the well-defined sysctl SID. */
1763                 tsid = SECINITSID_SYSCTL;
1764         }
1765
1766         /* The op values are "defined" in sysctl.c, thereby creating
1767          * a bad coupling between this module and sysctl.c */
1768         if(op == 001) {
1769                 error = avc_has_perm(tsec->sid, tsid,
1770                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1771         } else {
1772                 av = 0;
1773                 if (op & 004)
1774                         av |= FILE__READ;
1775                 if (op & 002)
1776                         av |= FILE__WRITE;
1777                 if (av)
1778                         error = avc_has_perm(tsec->sid, tsid,
1779                                              SECCLASS_FILE, av, NULL);
1780         }
1781
1782         return error;
1783 }
1784
1785 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1786 {
1787         int rc = 0;
1788
1789         if (!sb)
1790                 return 0;
1791
1792         switch (cmds) {
1793                 case Q_SYNC:
1794                 case Q_QUOTAON:
1795                 case Q_QUOTAOFF:
1796                 case Q_SETINFO:
1797                 case Q_SETQUOTA:
1798                         rc = superblock_has_perm(current,
1799                                                  sb,
1800                                                  FILESYSTEM__QUOTAMOD, NULL);
1801                         break;
1802                 case Q_GETFMT:
1803                 case Q_GETINFO:
1804                 case Q_GETQUOTA:
1805                         rc = superblock_has_perm(current,
1806                                                  sb,
1807                                                  FILESYSTEM__QUOTAGET, NULL);
1808                         break;
1809                 default:
1810                         rc = 0;  /* let the kernel handle invalid cmds */
1811                         break;
1812         }
1813         return rc;
1814 }
1815
1816 static int selinux_quota_on(struct dentry *dentry)
1817 {
1818         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1819 }
1820
1821 static int selinux_syslog(int type)
1822 {
1823         int rc;
1824
1825         rc = secondary_ops->syslog(type);
1826         if (rc)
1827                 return rc;
1828
1829         switch (type) {
1830                 case 3:         /* Read last kernel messages */
1831                 case 10:        /* Return size of the log buffer */
1832                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1833                         break;
1834                 case 6:         /* Disable logging to console */
1835                 case 7:         /* Enable logging to console */
1836                 case 8:         /* Set level of messages printed to console */
1837                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1838                         break;
1839                 case 0:         /* Close log */
1840                 case 1:         /* Open log */
1841                 case 2:         /* Read from log */
1842                 case 4:         /* Read/clear last kernel messages */
1843                 case 5:         /* Clear ring buffer */
1844                 default:
1845                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1846                         break;
1847         }
1848         return rc;
1849 }
1850
1851 /*
1852  * Check that a process has enough memory to allocate a new virtual
1853  * mapping. 0 means there is enough memory for the allocation to
1854  * succeed and -ENOMEM implies there is not.
1855  *
1856  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1857  * if the capability is granted, but __vm_enough_memory requires 1 if
1858  * the capability is granted.
1859  *
1860  * Do not audit the selinux permission check, as this is applied to all
1861  * processes that allocate mappings.
1862  */
1863 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1864 {
1865         int rc, cap_sys_admin = 0;
1866         struct task_security_struct *tsec = current->security;
1867
1868         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1869         if (rc == 0)
1870                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1871                                           SECCLASS_CAPABILITY,
1872                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1873                                           0,
1874                                           NULL);
1875
1876         if (rc == 0)
1877                 cap_sys_admin = 1;
1878
1879         return __vm_enough_memory(mm, pages, cap_sys_admin);
1880 }
1881
1882 /* binprm security operations */
1883
1884 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1885 {
1886         struct bprm_security_struct *bsec;
1887
1888         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1889         if (!bsec)
1890                 return -ENOMEM;
1891
1892         bsec->bprm = bprm;
1893         bsec->sid = SECINITSID_UNLABELED;
1894         bsec->set = 0;
1895
1896         bprm->security = bsec;
1897         return 0;
1898 }
1899
1900 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1901 {
1902         struct task_security_struct *tsec;
1903         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1904         struct inode_security_struct *isec;
1905         struct bprm_security_struct *bsec;
1906         u32 newsid;
1907         struct avc_audit_data ad;
1908         int rc;
1909
1910         rc = secondary_ops->bprm_set_security(bprm);
1911         if (rc)
1912                 return rc;
1913
1914         bsec = bprm->security;
1915
1916         if (bsec->set)
1917                 return 0;
1918
1919         tsec = current->security;
1920         isec = inode->i_security;
1921
1922         /* Default to the current task SID. */
1923         bsec->sid = tsec->sid;
1924
1925         /* Reset fs, key, and sock SIDs on execve. */
1926         tsec->create_sid = 0;
1927         tsec->keycreate_sid = 0;
1928         tsec->sockcreate_sid = 0;
1929
1930         if (tsec->exec_sid) {
1931                 newsid = tsec->exec_sid;
1932                 /* Reset exec SID on execve. */
1933                 tsec->exec_sid = 0;
1934         } else {
1935                 /* Check for a default transition on this program. */
1936                 rc = security_transition_sid(tsec->sid, isec->sid,
1937                                              SECCLASS_PROCESS, &newsid);
1938                 if (rc)
1939                         return rc;
1940         }
1941
1942         AVC_AUDIT_DATA_INIT(&ad, FS);
1943         ad.u.fs.path = bprm->file->f_path;
1944
1945         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1946                 newsid = tsec->sid;
1947
1948         if (tsec->sid == newsid) {
1949                 rc = avc_has_perm(tsec->sid, isec->sid,
1950                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1951                 if (rc)
1952                         return rc;
1953         } else {
1954                 /* Check permissions for the transition. */
1955                 rc = avc_has_perm(tsec->sid, newsid,
1956                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1957                 if (rc)
1958                         return rc;
1959
1960                 rc = avc_has_perm(newsid, isec->sid,
1961                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1962                 if (rc)
1963                         return rc;
1964
1965                 /* Clear any possibly unsafe personality bits on exec: */
1966                 current->personality &= ~PER_CLEAR_ON_SETID;
1967
1968                 /* Set the security field to the new SID. */
1969                 bsec->sid = newsid;
1970         }
1971
1972         bsec->set = 1;
1973         return 0;
1974 }
1975
1976 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1977 {
1978         return secondary_ops->bprm_check_security(bprm);
1979 }
1980
1981
1982 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1983 {
1984         struct task_security_struct *tsec = current->security;
1985         int atsecure = 0;
1986
1987         if (tsec->osid != tsec->sid) {
1988                 /* Enable secure mode for SIDs transitions unless
1989                    the noatsecure permission is granted between
1990                    the two SIDs, i.e. ahp returns 0. */
1991                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1992                                          SECCLASS_PROCESS,
1993                                          PROCESS__NOATSECURE, NULL);
1994         }
1995
1996         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1997 }
1998
1999 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2000 {
2001         kfree(bprm->security);
2002         bprm->security = NULL;
2003 }
2004
2005 extern struct vfsmount *selinuxfs_mount;
2006 extern struct dentry *selinux_null;
2007
2008 /* Derived from fs/exec.c:flush_old_files. */
2009 static inline void flush_unauthorized_files(struct files_struct * files)
2010 {
2011         struct avc_audit_data ad;
2012         struct file *file, *devnull = NULL;
2013         struct tty_struct *tty;
2014         struct fdtable *fdt;
2015         long j = -1;
2016         int drop_tty = 0;
2017
2018         mutex_lock(&tty_mutex);
2019         tty = get_current_tty();
2020         if (tty) {
2021                 file_list_lock();
2022                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2023                 if (file) {
2024                         /* Revalidate access to controlling tty.
2025                            Use inode_has_perm on the tty inode directly rather
2026                            than using file_has_perm, as this particular open
2027                            file may belong to another process and we are only
2028                            interested in the inode-based check here. */
2029                         struct inode *inode = file->f_path.dentry->d_inode;
2030                         if (inode_has_perm(current, inode,
2031                                            FILE__READ | FILE__WRITE, NULL)) {
2032                                 drop_tty = 1;
2033                         }
2034                 }
2035                 file_list_unlock();
2036         }
2037         mutex_unlock(&tty_mutex);
2038         /* Reset controlling tty. */
2039         if (drop_tty)
2040                 no_tty();
2041
2042         /* Revalidate access to inherited open files. */
2043
2044         AVC_AUDIT_DATA_INIT(&ad,FS);
2045
2046         spin_lock(&files->file_lock);
2047         for (;;) {
2048                 unsigned long set, i;
2049                 int fd;
2050
2051                 j++;
2052                 i = j * __NFDBITS;
2053                 fdt = files_fdtable(files);
2054                 if (i >= fdt->max_fds)
2055                         break;
2056                 set = fdt->open_fds->fds_bits[j];
2057                 if (!set)
2058                         continue;
2059                 spin_unlock(&files->file_lock);
2060                 for ( ; set ; i++,set >>= 1) {
2061                         if (set & 1) {
2062                                 file = fget(i);
2063                                 if (!file)
2064                                         continue;
2065                                 if (file_has_perm(current,
2066                                                   file,
2067                                                   file_to_av(file))) {
2068                                         sys_close(i);
2069                                         fd = get_unused_fd();
2070                                         if (fd != i) {
2071                                                 if (fd >= 0)
2072                                                         put_unused_fd(fd);
2073                                                 fput(file);
2074                                                 continue;
2075                                         }
2076                                         if (devnull) {
2077                                                 get_file(devnull);
2078                                         } else {
2079                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2080                                                 if (IS_ERR(devnull)) {
2081                                                         devnull = NULL;
2082                                                         put_unused_fd(fd);
2083                                                         fput(file);
2084                                                         continue;
2085                                                 }
2086                                         }
2087                                         fd_install(fd, devnull);
2088                                 }
2089                                 fput(file);
2090                         }
2091                 }
2092                 spin_lock(&files->file_lock);
2093
2094         }
2095         spin_unlock(&files->file_lock);
2096 }
2097
2098 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2099 {
2100         struct task_security_struct *tsec;
2101         struct bprm_security_struct *bsec;
2102         u32 sid;
2103         int rc;
2104
2105         secondary_ops->bprm_apply_creds(bprm, unsafe);
2106
2107         tsec = current->security;
2108
2109         bsec = bprm->security;
2110         sid = bsec->sid;
2111
2112         tsec->osid = tsec->sid;
2113         bsec->unsafe = 0;
2114         if (tsec->sid != sid) {
2115                 /* Check for shared state.  If not ok, leave SID
2116                    unchanged and kill. */
2117                 if (unsafe & LSM_UNSAFE_SHARE) {
2118                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2119                                         PROCESS__SHARE, NULL);
2120                         if (rc) {
2121                                 bsec->unsafe = 1;
2122                                 return;
2123                         }
2124                 }
2125
2126                 /* Check for ptracing, and update the task SID if ok.
2127                    Otherwise, leave SID unchanged and kill. */
2128                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2129                         rc = avc_has_perm(tsec->ptrace_sid, sid,
2130                                           SECCLASS_PROCESS, PROCESS__PTRACE,
2131                                           NULL);
2132                         if (rc) {
2133                                 bsec->unsafe = 1;
2134                                 return;
2135                         }
2136                 }
2137                 tsec->sid = sid;
2138         }
2139 }
2140
2141 /*
2142  * called after apply_creds without the task lock held
2143  */
2144 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2145 {
2146         struct task_security_struct *tsec;
2147         struct rlimit *rlim, *initrlim;
2148         struct itimerval itimer;
2149         struct bprm_security_struct *bsec;
2150         int rc, i;
2151
2152         tsec = current->security;
2153         bsec = bprm->security;
2154
2155         if (bsec->unsafe) {
2156                 force_sig_specific(SIGKILL, current);
2157                 return;
2158         }
2159         if (tsec->osid == tsec->sid)
2160                 return;
2161
2162         /* Close files for which the new task SID is not authorized. */
2163         flush_unauthorized_files(current->files);
2164
2165         /* Check whether the new SID can inherit signal state
2166            from the old SID.  If not, clear itimers to avoid
2167            subsequent signal generation and flush and unblock
2168            signals. This must occur _after_ the task SID has
2169           been updated so that any kill done after the flush
2170           will be checked against the new SID. */
2171         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2172                           PROCESS__SIGINH, NULL);
2173         if (rc) {
2174                 memset(&itimer, 0, sizeof itimer);
2175                 for (i = 0; i < 3; i++)
2176                         do_setitimer(i, &itimer, NULL);
2177                 flush_signals(current);
2178                 spin_lock_irq(&current->sighand->siglock);
2179                 flush_signal_handlers(current, 1);
2180                 sigemptyset(&current->blocked);
2181                 recalc_sigpending();
2182                 spin_unlock_irq(&current->sighand->siglock);
2183         }
2184
2185         /* Always clear parent death signal on SID transitions. */
2186         current->pdeath_signal = 0;
2187
2188         /* Check whether the new SID can inherit resource limits
2189            from the old SID.  If not, reset all soft limits to
2190            the lower of the current task's hard limit and the init
2191            task's soft limit.  Note that the setting of hard limits
2192            (even to lower them) can be controlled by the setrlimit
2193            check. The inclusion of the init task's soft limit into
2194            the computation is to avoid resetting soft limits higher
2195            than the default soft limit for cases where the default
2196            is lower than the hard limit, e.g. RLIMIT_CORE or
2197            RLIMIT_STACK.*/
2198         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2199                           PROCESS__RLIMITINH, NULL);
2200         if (rc) {
2201                 for (i = 0; i < RLIM_NLIMITS; i++) {
2202                         rlim = current->signal->rlim + i;
2203                         initrlim = init_task.signal->rlim+i;
2204                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2205                 }
2206                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2207                         /*
2208                          * This will cause RLIMIT_CPU calculations
2209                          * to be refigured.
2210                          */
2211                         current->it_prof_expires = jiffies_to_cputime(1);
2212                 }
2213         }
2214
2215         /* Wake up the parent if it is waiting so that it can
2216            recheck wait permission to the new task SID. */
2217         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2218 }
2219
2220 /* superblock security operations */
2221
2222 static int selinux_sb_alloc_security(struct super_block *sb)
2223 {
2224         return superblock_alloc_security(sb);
2225 }
2226
2227 static void selinux_sb_free_security(struct super_block *sb)
2228 {
2229         superblock_free_security(sb);
2230 }
2231
2232 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2233 {
2234         if (plen > olen)
2235                 return 0;
2236
2237         return !memcmp(prefix, option, plen);
2238 }
2239
2240 static inline int selinux_option(char *option, int len)
2241 {
2242         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2243                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2244                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2245                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2246 }
2247
2248 static inline void take_option(char **to, char *from, int *first, int len)
2249 {
2250         if (!*first) {
2251                 **to = ',';
2252                 *to += 1;
2253         } else
2254                 *first = 0;
2255         memcpy(*to, from, len);
2256         *to += len;
2257 }
2258
2259 static inline void take_selinux_option(char **to, char *from, int *first,
2260                                        int len)
2261 {
2262         int current_size = 0;
2263
2264         if (!*first) {
2265                 **to = '|';
2266                 *to += 1;
2267         }
2268         else
2269                 *first = 0;
2270
2271         while (current_size < len) {
2272                 if (*from != '"') {
2273                         **to = *from;
2274                         *to += 1;
2275                 }
2276                 from += 1;
2277                 current_size += 1;
2278         }
2279 }
2280
2281 static int selinux_sb_copy_data(char *orig, char *copy)
2282 {
2283         int fnosec, fsec, rc = 0;
2284         char *in_save, *in_curr, *in_end;
2285         char *sec_curr, *nosec_save, *nosec;
2286         int open_quote = 0;
2287
2288         in_curr = orig;
2289         sec_curr = copy;
2290
2291         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2292         if (!nosec) {
2293                 rc = -ENOMEM;
2294                 goto out;
2295         }
2296
2297         nosec_save = nosec;
2298         fnosec = fsec = 1;
2299         in_save = in_end = orig;
2300
2301         do {
2302                 if (*in_end == '"')
2303                         open_quote = !open_quote;
2304                 if ((*in_end == ',' && open_quote == 0) ||
2305                                 *in_end == '\0') {
2306                         int len = in_end - in_curr;
2307
2308                         if (selinux_option(in_curr, len))
2309                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2310                         else
2311                                 take_option(&nosec, in_curr, &fnosec, len);
2312
2313                         in_curr = in_end + 1;
2314                 }
2315         } while (*in_end++);
2316
2317         strcpy(in_save, nosec_save);
2318         free_page((unsigned long)nosec_save);
2319 out:
2320         return rc;
2321 }
2322
2323 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2324 {
2325         struct avc_audit_data ad;
2326         int rc;
2327
2328         rc = superblock_doinit(sb, data);
2329         if (rc)
2330                 return rc;
2331
2332         AVC_AUDIT_DATA_INIT(&ad,FS);
2333         ad.u.fs.path.dentry = sb->s_root;
2334         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2335 }
2336
2337 static int selinux_sb_statfs(struct dentry *dentry)
2338 {
2339         struct avc_audit_data ad;
2340
2341         AVC_AUDIT_DATA_INIT(&ad,FS);
2342         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2343         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2344 }
2345
2346 static int selinux_mount(char * dev_name,
2347                          struct nameidata *nd,
2348                          char * type,
2349                          unsigned long flags,
2350                          void * data)
2351 {
2352         int rc;
2353
2354         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2355         if (rc)
2356                 return rc;
2357
2358         if (flags & MS_REMOUNT)
2359                 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2360                                            FILESYSTEM__REMOUNT, NULL);
2361         else
2362                 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2363                                        FILE__MOUNTON);
2364 }
2365
2366 static int selinux_umount(struct vfsmount *mnt, int flags)
2367 {
2368         int rc;
2369
2370         rc = secondary_ops->sb_umount(mnt, flags);
2371         if (rc)
2372                 return rc;
2373
2374         return superblock_has_perm(current,mnt->mnt_sb,
2375                                    FILESYSTEM__UNMOUNT,NULL);
2376 }
2377
2378 /* inode security operations */
2379
2380 static int selinux_inode_alloc_security(struct inode *inode)
2381 {
2382         return inode_alloc_security(inode);
2383 }
2384
2385 static void selinux_inode_free_security(struct inode *inode)
2386 {
2387         inode_free_security(inode);
2388 }
2389
2390 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2391                                        char **name, void **value,
2392                                        size_t *len)
2393 {
2394         struct task_security_struct *tsec;
2395         struct inode_security_struct *dsec;
2396         struct superblock_security_struct *sbsec;
2397         u32 newsid, clen;
2398         int rc;
2399         char *namep = NULL, *context;
2400
2401         tsec = current->security;
2402         dsec = dir->i_security;
2403         sbsec = dir->i_sb->s_security;
2404
2405         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2406                 newsid = tsec->create_sid;
2407         } else {
2408                 rc = security_transition_sid(tsec->sid, dsec->sid,
2409                                              inode_mode_to_security_class(inode->i_mode),
2410                                              &newsid);
2411                 if (rc) {
2412                         printk(KERN_WARNING "%s:  "
2413                                "security_transition_sid failed, rc=%d (dev=%s "
2414                                "ino=%ld)\n",
2415                                __FUNCTION__,
2416                                -rc, inode->i_sb->s_id, inode->i_ino);
2417                         return rc;
2418                 }
2419         }
2420
2421         /* Possibly defer initialization to selinux_complete_init. */
2422         if (sbsec->initialized) {
2423                 struct inode_security_struct *isec = inode->i_security;
2424                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2425                 isec->sid = newsid;
2426                 isec->initialized = 1;
2427         }
2428
2429         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2430                 return -EOPNOTSUPP;
2431
2432         if (name) {
2433                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2434                 if (!namep)
2435                         return -ENOMEM;
2436                 *name = namep;
2437         }
2438
2439         if (value && len) {
2440                 rc = security_sid_to_context(newsid, &context, &clen);
2441                 if (rc) {
2442                         kfree(namep);
2443                         return rc;
2444                 }
2445                 *value = context;
2446                 *len = clen;
2447         }
2448
2449         return 0;
2450 }
2451
2452 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2453 {
2454         return may_create(dir, dentry, SECCLASS_FILE);
2455 }
2456
2457 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2458 {
2459         int rc;
2460
2461         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2462         if (rc)
2463                 return rc;
2464         return may_link(dir, old_dentry, MAY_LINK);
2465 }
2466
2467 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2468 {
2469         int rc;
2470
2471         rc = secondary_ops->inode_unlink(dir, dentry);
2472         if (rc)
2473                 return rc;
2474         return may_link(dir, dentry, MAY_UNLINK);
2475 }
2476
2477 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2478 {
2479         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2480 }
2481
2482 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2483 {
2484         return may_create(dir, dentry, SECCLASS_DIR);
2485 }
2486
2487 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2488 {
2489         return may_link(dir, dentry, MAY_RMDIR);
2490 }
2491
2492 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2493 {
2494         int rc;
2495
2496         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2497         if (rc)
2498                 return rc;
2499
2500         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2501 }
2502
2503 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2504                                 struct inode *new_inode, struct dentry *new_dentry)
2505 {
2506         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2507 }
2508
2509 static int selinux_inode_readlink(struct dentry *dentry)
2510 {
2511         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2512 }
2513
2514 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2515 {
2516         int rc;
2517
2518         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2519         if (rc)
2520                 return rc;
2521         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2522 }
2523
2524 static int selinux_inode_permission(struct inode *inode, int mask,
2525                                     struct nameidata *nd)
2526 {
2527         int rc;
2528
2529         rc = secondary_ops->inode_permission(inode, mask, nd);
2530         if (rc)
2531                 return rc;
2532
2533         if (!mask) {
2534                 /* No permission to check.  Existence test. */
2535                 return 0;
2536         }
2537
2538         return inode_has_perm(current, inode,
2539                                file_mask_to_av(inode->i_mode, mask), NULL);
2540 }
2541
2542 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2543 {
2544         int rc;
2545
2546         rc = secondary_ops->inode_setattr(dentry, iattr);
2547         if (rc)
2548                 return rc;
2549
2550         if (iattr->ia_valid & ATTR_FORCE)
2551                 return 0;
2552
2553         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2554                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2555                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2556
2557         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2558 }
2559
2560 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2561 {
2562         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2563 }
2564
2565 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2566 {
2567         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2568                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2569                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2570                         if (!capable(CAP_SETFCAP))
2571                                 return -EPERM;
2572                 } else if (!capable(CAP_SYS_ADMIN)) {
2573                         /* A different attribute in the security namespace.
2574                            Restrict to administrator. */
2575                         return -EPERM;
2576                 }
2577         }
2578
2579         /* Not an attribute we recognize, so just check the
2580            ordinary setattr permission. */
2581         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2582 }
2583
2584 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2585 {
2586         struct task_security_struct *tsec = current->security;
2587         struct inode *inode = dentry->d_inode;
2588         struct inode_security_struct *isec = inode->i_security;
2589         struct superblock_security_struct *sbsec;
2590         struct avc_audit_data ad;
2591         u32 newsid;
2592         int rc = 0;
2593
2594         if (strcmp(name, XATTR_NAME_SELINUX))
2595                 return selinux_inode_setotherxattr(dentry, name);
2596
2597         sbsec = inode->i_sb->s_security;
2598         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2599                 return -EOPNOTSUPP;
2600
2601         if (!is_owner_or_cap(inode))
2602                 return -EPERM;
2603
2604         AVC_AUDIT_DATA_INIT(&ad,FS);
2605         ad.u.fs.path.dentry = dentry;
2606
2607         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2608                           FILE__RELABELFROM, &ad);
2609         if (rc)
2610                 return rc;
2611
2612         rc = security_context_to_sid(value, size, &newsid);
2613         if (rc)
2614                 return rc;
2615
2616         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2617                           FILE__RELABELTO, &ad);
2618         if (rc)
2619                 return rc;
2620
2621         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2622                                           isec->sclass);
2623         if (rc)
2624                 return rc;
2625
2626         return avc_has_perm(newsid,
2627                             sbsec->sid,
2628                             SECCLASS_FILESYSTEM,
2629                             FILESYSTEM__ASSOCIATE,
2630                             &ad);
2631 }
2632
2633 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2634                                         void *value, size_t size, int flags)
2635 {
2636         struct inode *inode = dentry->d_inode;
2637         struct inode_security_struct *isec = inode->i_security;
2638         u32 newsid;
2639         int rc;
2640
2641         if (strcmp(name, XATTR_NAME_SELINUX)) {
2642                 /* Not an attribute we recognize, so nothing to do. */
2643                 return;
2644         }
2645
2646         rc = security_context_to_sid(value, size, &newsid);
2647         if (rc) {
2648                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2649                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2650                 return;
2651         }
2652
2653         isec->sid = newsid;
2654         return;
2655 }
2656
2657 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2658 {
2659         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2660 }
2661
2662 static int selinux_inode_listxattr (struct dentry *dentry)
2663 {
2664         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2665 }
2666
2667 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2668 {
2669         if (strcmp(name, XATTR_NAME_SELINUX))
2670                 return selinux_inode_setotherxattr(dentry, name);
2671
2672         /* No one is allowed to remove a SELinux security label.
2673            You can change the label, but all data must be labeled. */
2674         return -EACCES;
2675 }
2676
2677 /*
2678  * Copy the in-core inode security context value to the user.  If the
2679  * getxattr() prior to this succeeded, check to see if we need to
2680  * canonicalize the value to be finally returned to the user.
2681  *
2682  * Permission check is handled by selinux_inode_getxattr hook.
2683  */
2684 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2685 {
2686         u32 size;
2687         int error;
2688         char *context = NULL;
2689         struct inode_security_struct *isec = inode->i_security;
2690
2691         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2692                 return -EOPNOTSUPP;
2693
2694         error = security_sid_to_context(isec->sid, &context, &size);
2695         if (error)
2696                 return error;
2697         error = size;
2698         if (alloc) {
2699                 *buffer = context;
2700                 goto out_nofree;
2701         }
2702         kfree(context);
2703 out_nofree:
2704         return error;
2705 }
2706
2707 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2708                                      const void *value, size_t size, int flags)
2709 {
2710         struct inode_security_struct *isec = inode->i_security;
2711         u32 newsid;
2712         int rc;
2713
2714         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2715                 return -EOPNOTSUPP;
2716
2717         if (!value || !size)
2718                 return -EACCES;
2719
2720         rc = security_context_to_sid((void*)value, size, &newsid);
2721         if (rc)
2722                 return rc;
2723
2724         isec->sid = newsid;
2725         return 0;
2726 }
2727
2728 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2729 {
2730         const int len = sizeof(XATTR_NAME_SELINUX);
2731         if (buffer && len <= buffer_size)
2732                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2733         return len;
2734 }
2735
2736 static int selinux_inode_need_killpriv(struct dentry *dentry)
2737 {
2738         return secondary_ops->inode_need_killpriv(dentry);
2739 }
2740
2741 static int selinux_inode_killpriv(struct dentry *dentry)
2742 {
2743         return secondary_ops->inode_killpriv(dentry);
2744 }
2745
2746 /* file security operations */
2747
2748 static int selinux_revalidate_file_permission(struct file *file, int mask)
2749 {
2750         int rc;
2751         struct inode *inode = file->f_path.dentry->d_inode;
2752
2753         if (!mask) {
2754                 /* No permission to check.  Existence test. */
2755                 return 0;
2756         }
2757
2758         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2759         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2760                 mask |= MAY_APPEND;
2761
2762         rc = file_has_perm(current, file,
2763                            file_mask_to_av(inode->i_mode, mask));
2764         if (rc)
2765                 return rc;
2766
2767         return selinux_netlbl_inode_permission(inode, mask);
2768 }
2769
2770 static int selinux_file_permission(struct file *file, int mask)
2771 {
2772         struct inode *inode = file->f_path.dentry->d_inode;
2773         struct task_security_struct *tsec = current->security;
2774         struct file_security_struct *fsec = file->f_security;
2775         struct inode_security_struct *isec = inode->i_security;
2776
2777         if (!mask) {
2778                 /* No permission to check.  Existence test. */
2779                 return 0;
2780         }
2781
2782         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2783             && fsec->pseqno == avc_policy_seqno())
2784                 return selinux_netlbl_inode_permission(inode, mask);
2785
2786         return selinux_revalidate_file_permission(file, mask);
2787 }
2788
2789 static int selinux_file_alloc_security(struct file *file)
2790 {
2791         return file_alloc_security(file);
2792 }
2793
2794 static void selinux_file_free_security(struct file *file)
2795 {
2796         file_free_security(file);
2797 }
2798
2799 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2800                               unsigned long arg)
2801 {
2802         int error = 0;
2803
2804         switch (cmd) {
2805                 case FIONREAD:
2806                 /* fall through */
2807                 case FIBMAP:
2808                 /* fall through */
2809                 case FIGETBSZ:
2810                 /* fall through */
2811                 case EXT2_IOC_GETFLAGS:
2812                 /* fall through */
2813                 case EXT2_IOC_GETVERSION:
2814                         error = file_has_perm(current, file, FILE__GETATTR);
2815                         break;
2816
2817                 case EXT2_IOC_SETFLAGS:
2818                 /* fall through */
2819                 case EXT2_IOC_SETVERSION:
2820                         error = file_has_perm(current, file, FILE__SETATTR);
2821                         break;
2822
2823                 /* sys_ioctl() checks */
2824                 case FIONBIO:
2825                 /* fall through */
2826                 case FIOASYNC:
2827                         error = file_has_perm(current, file, 0);
2828                         break;
2829
2830                 case KDSKBENT:
2831                 case KDSKBSENT:
2832                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2833                         break;
2834
2835                 /* default case assumes that the command will go
2836                  * to the file's ioctl() function.
2837                  */
2838                 default:
2839                         error = file_has_perm(current, file, FILE__IOCTL);
2840
2841         }
2842         return error;
2843 }
2844
2845 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2846 {
2847 #ifndef CONFIG_PPC32
2848         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2849                 /*
2850                  * We are making executable an anonymous mapping or a
2851                  * private file mapping that will also be writable.
2852                  * This has an additional check.
2853                  */
2854                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2855                 if (rc)
2856                         return rc;
2857         }
2858 #endif
2859
2860         if (file) {
2861                 /* read access is always possible with a mapping */
2862                 u32 av = FILE__READ;
2863
2864                 /* write access only matters if the mapping is shared */
2865                 if (shared && (prot & PROT_WRITE))
2866                         av |= FILE__WRITE;
2867
2868                 if (prot & PROT_EXEC)
2869                         av |= FILE__EXECUTE;
2870
2871                 return file_has_perm(current, file, av);
2872         }
2873         return 0;
2874 }
2875
2876 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2877                              unsigned long prot, unsigned long flags,
2878                              unsigned long addr, unsigned long addr_only)
2879 {
2880         int rc = 0;
2881         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2882
2883         if (addr < mmap_min_addr)
2884                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2885                                   MEMPROTECT__MMAP_ZERO, NULL);
2886         if (rc || addr_only)
2887                 return rc;
2888
2889         if (selinux_checkreqprot)
2890                 prot = reqprot;
2891
2892         return file_map_prot_check(file, prot,
2893                                    (flags & MAP_TYPE) == MAP_SHARED);
2894 }
2895
2896 static int selinux_file_mprotect(struct vm_area_struct *vma,
2897                                  unsigned long reqprot,
2898                                  unsigned long prot)
2899 {
2900         int rc;
2901
2902         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2903         if (rc)
2904                 return rc;
2905
2906         if (selinux_checkreqprot)
2907                 prot = reqprot;
2908
2909 #ifndef CONFIG_PPC32
2910         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2911                 rc = 0;
2912                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2913                     vma->vm_end <= vma->vm_mm->brk) {
2914                         rc = task_has_perm(current, current,
2915                                            PROCESS__EXECHEAP);
2916                 } else if (!vma->vm_file &&
2917                            vma->vm_start <= vma->vm_mm->start_stack &&
2918                            vma->vm_end >= vma->vm_mm->start_stack) {
2919                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2920                 } else if (vma->vm_file && vma->anon_vma) {
2921                         /*
2922                          * We are making executable a file mapping that has
2923                          * had some COW done. Since pages might have been
2924                          * written, check ability to execute the possibly
2925                          * modified content.  This typically should only
2926                          * occur for text relocations.
2927                          */
2928                         rc = file_has_perm(current, vma->vm_file,
2929                                            FILE__EXECMOD);
2930                 }
2931                 if (rc)
2932                         return rc;
2933         }
2934 #endif
2935
2936         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2937 }
2938
2939 static int selinux_file_lock(struct file *file, unsigned int cmd)
2940 {
2941         return file_has_perm(current, file, FILE__LOCK);
2942 }
2943
2944 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2945                               unsigned long arg)
2946 {
2947         int err = 0;
2948
2949         switch (cmd) {
2950                 case F_SETFL:
2951                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2952                                 err = -EINVAL;
2953                                 break;
2954                         }
2955
2956                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2957                                 err = file_has_perm(current, file,FILE__WRITE);
2958                                 break;
2959                         }
2960                         /* fall through */
2961                 case F_SETOWN:
2962                 case F_SETSIG:
2963                 case F_GETFL:
2964                 case F_GETOWN:
2965                 case F_GETSIG:
2966                         /* Just check FD__USE permission */
2967                         err = file_has_perm(current, file, 0);
2968                         break;
2969                 case F_GETLK:
2970                 case F_SETLK:
2971                 case F_SETLKW:
2972 #if BITS_PER_LONG == 32
2973                 case F_GETLK64:
2974                 case F_SETLK64:
2975                 case F_SETLKW64:
2976 #endif
2977                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2978                                 err = -EINVAL;
2979                                 break;
2980                         }
2981                         err = file_has_perm(current, file, FILE__LOCK);
2982                         break;
2983         }
2984
2985         return err;
2986 }
2987
2988 static int selinux_file_set_fowner(struct file *file)
2989 {
2990         struct task_security_struct *tsec;
2991         struct file_security_struct *fsec;
2992
2993         tsec = current->security;
2994         fsec = file->f_security;
2995         fsec->fown_sid = tsec->sid;
2996
2997         return 0;
2998 }
2999
3000 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3001                                        struct fown_struct *fown, int signum)
3002 {
3003         struct file *file;
3004         u32 perm;
3005         struct task_security_struct *tsec;
3006         struct file_security_struct *fsec;
3007
3008         /* struct fown_struct is never outside the context of a struct file */
3009         file = container_of(fown, struct file, f_owner);
3010
3011         tsec = tsk->security;
3012         fsec = file->f_security;
3013
3014         if (!signum)
3015                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3016         else
3017                 perm = signal_to_av(signum);
3018
3019         return avc_has_perm(fsec->fown_sid, tsec->sid,
3020                             SECCLASS_PROCESS, perm, NULL);
3021 }
3022
3023 static int selinux_file_receive(struct file *file)
3024 {
3025         return file_has_perm(current, file, file_to_av(file));
3026 }
3027
3028 static int selinux_dentry_open(struct file *file)
3029 {
3030         struct file_security_struct *fsec;
3031         struct inode *inode;
3032         struct inode_security_struct *isec;
3033         inode = file->f_path.dentry->d_inode;
3034         fsec = file->f_security;
3035         isec = inode->i_security;
3036         /*
3037          * Save inode label and policy sequence number
3038          * at open-time so that selinux_file_permission
3039          * can determine whether revalidation is necessary.
3040          * Task label is already saved in the file security
3041          * struct as its SID.
3042          */
3043         fsec->isid = isec->sid;
3044         fsec->pseqno = avc_policy_seqno();
3045         /*
3046          * Since the inode label or policy seqno may have changed
3047          * between the selinux_inode_permission check and the saving
3048          * of state above, recheck that access is still permitted.
3049          * Otherwise, access might never be revalidated against the
3050          * new inode label or new policy.
3051          * This check is not redundant - do not remove.
3052          */
3053         return inode_has_perm(current, inode, file_to_av(file), NULL);
3054 }
3055
3056 /* task security operations */
3057
3058 static int selinux_task_create(unsigned long clone_flags)
3059 {
3060         int rc;
3061
3062         rc = secondary_ops->task_create(clone_flags);
3063         if (rc)
3064                 return rc;
3065
3066         return task_has_perm(current, current, PROCESS__FORK);
3067 }
3068
3069 static int selinux_task_alloc_security(struct task_struct *tsk)
3070 {
3071         struct task_security_struct *tsec1, *tsec2;
3072         int rc;
3073
3074         tsec1 = current->security;
3075
3076         rc = task_alloc_security(tsk);
3077         if (rc)
3078                 return rc;
3079         tsec2 = tsk->security;
3080
3081         tsec2->osid = tsec1->osid;
3082         tsec2->sid = tsec1->sid;
3083
3084         /* Retain the exec, fs, key, and sock SIDs across fork */
3085         tsec2->exec_sid = tsec1->exec_sid;
3086         tsec2->create_sid = tsec1->create_sid;
3087         tsec2->keycreate_sid = tsec1->keycreate_sid;
3088         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3089
3090         /* Retain ptracer SID across fork, if any.
3091            This will be reset by the ptrace hook upon any
3092            subsequent ptrace_attach operations. */
3093         tsec2->ptrace_sid = tsec1->ptrace_sid;
3094
3095         return 0;
3096 }
3097
3098 static void selinux_task_free_security(struct task_struct *tsk)
3099 {
3100         task_free_security(tsk);
3101 }
3102
3103 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3104 {
3105         /* Since setuid only affects the current process, and
3106            since the SELinux controls are not based on the Linux
3107            identity attributes, SELinux does not need to control
3108            this operation.  However, SELinux does control the use
3109            of the CAP_SETUID and CAP_SETGID capabilities using the
3110            capable hook. */
3111         return 0;
3112 }
3113
3114 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3115 {
3116         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3117 }
3118
3119 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3120 {
3121         /* See the comment for setuid above. */
3122         return 0;
3123 }
3124
3125 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3126 {
3127         return task_has_perm(current, p, PROCESS__SETPGID);
3128 }
3129
3130 static int selinux_task_getpgid(struct task_struct *p)
3131 {
3132         return task_has_perm(current, p, PROCESS__GETPGID);
3133 }
3134
3135 static int selinux_task_getsid(struct task_struct *p)
3136 {
3137         return task_has_perm(current, p, PROCESS__GETSESSION);
3138 }
3139
3140 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3141 {
3142         selinux_get_task_sid(p, secid);
3143 }
3144
3145 static int selinux_task_setgroups(struct group_info *group_info)
3146 {
3147         /* See the comment for setuid above. */
3148         return 0;
3149 }
3150
3151 static int selinux_task_setnice(struct task_struct *p, int nice)
3152 {
3153         int rc;
3154
3155         rc = secondary_ops->task_setnice(p, nice);
3156         if (rc)
3157                 return rc;
3158
3159         return task_has_perm(current,p, PROCESS__SETSCHED);
3160 }
3161
3162 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3163 {
3164         int rc;
3165
3166         rc = secondary_ops->task_setioprio(p, ioprio);
3167         if (rc)
3168                 return rc;
3169
3170         return task_has_perm(current, p, PROCESS__SETSCHED);
3171 }
3172
3173 static int selinux_task_getioprio(struct task_struct *p)
3174 {
3175         return task_has_perm(current, p, PROCESS__GETSCHED);
3176 }
3177
3178 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3179 {
3180         struct rlimit *old_rlim = current->signal->rlim + resource;
3181         int rc;
3182
3183         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3184         if (rc)
3185                 return rc;
3186
3187         /* Control the ability to change the hard limit (whether
3188            lowering or raising it), so that the hard limit can
3189            later be used as a safe reset point for the soft limit
3190            upon context transitions. See selinux_bprm_apply_creds. */
3191         if (old_rlim->rlim_max != new_rlim->rlim_max)
3192                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3193
3194         return 0;
3195 }
3196
3197 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3198 {
3199         int rc;
3200
3201         rc = secondary_ops->task_setscheduler(p, policy, lp);
3202         if (rc)
3203                 return rc;
3204
3205         return task_has_perm(current, p, PROCESS__SETSCHED);
3206 }
3207
3208 static int selinux_task_getscheduler(struct task_struct *p)
3209 {
3210         return task_has_perm(current, p, PROCESS__GETSCHED);
3211 }
3212
3213 static int selinux_task_movememory(struct task_struct *p)
3214 {
3215         return task_has_perm(current, p, PROCESS__SETSCHED);
3216 }
3217
3218 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3219                                 int sig, u32 secid)
3220 {
3221         u32 perm;
3222         int rc;
3223         struct task_security_struct *tsec;
3224
3225         rc = secondary_ops->task_kill(p, info, sig, secid);
3226         if (rc)
3227                 return rc;
3228
3229         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3230                 return 0;
3231
3232         if (!sig)
3233                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3234         else
3235                 perm = signal_to_av(sig);
3236         tsec = p->security;
3237         if (secid)
3238                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3239         else
3240                 rc = task_has_perm(current, p, perm);
3241         return rc;
3242 }
3243
3244 static int selinux_task_prctl(int option,
3245                               unsigned long arg2,
3246                               unsigned long arg3,
3247                               unsigned long arg4,
3248                               unsigned long arg5)
3249 {
3250         /* The current prctl operations do not appear to require
3251            any SELinux controls since they merely observe or modify
3252            the state of the current process. */
3253         return 0;
3254 }
3255
3256 static int selinux_task_wait(struct task_struct *p)
3257 {
3258         return task_has_perm(p, current, PROCESS__SIGCHLD);
3259 }
3260
3261 static void selinux_task_reparent_to_init(struct task_struct *p)
3262 {
3263         struct task_security_struct *tsec;
3264
3265         secondary_ops->task_reparent_to_init(p);
3266
3267         tsec = p->security;
3268         tsec->osid = tsec->sid;
3269         tsec->sid = SECINITSID_KERNEL;
3270         return;
3271 }
3272
3273 static void selinux_task_to_inode(struct task_struct *p,
3274                                   struct inode *inode)
3275 {
3276         struct task_security_struct *tsec = p->security;
3277         struct inode_security_struct *isec = inode->i_security;
3278
3279         isec->sid = tsec->sid;
3280         isec->initialized = 1;
3281         return;
3282 }
3283
3284 /* Returns error only if unable to parse addresses */
3285 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3286                         struct avc_audit_data *ad, u8 *proto)
3287 {
3288         int offset, ihlen, ret = -EINVAL;
3289         struct iphdr _iph, *ih;
3290
3291         offset = skb_network_offset(skb);
3292         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3293         if (ih == NULL)
3294                 goto out;
3295
3296         ihlen = ih->ihl * 4;
3297         if (ihlen < sizeof(_iph))
3298                 goto out;
3299
3300         ad->u.net.v4info.saddr = ih->saddr;
3301         ad->u.net.v4info.daddr = ih->daddr;
3302         ret = 0;
3303
3304         if (proto)
3305                 *proto = ih->protocol;
3306
3307         switch (ih->protocol) {
3308         case IPPROTO_TCP: {
3309                 struct tcphdr _tcph, *th;
3310
3311                 if (ntohs(ih->frag_off) & IP_OFFSET)
3312                         break;
3313
3314                 offset += ihlen;
3315                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3316                 if (th == NULL)
3317                         break;
3318
3319                 ad->u.net.sport = th->source;
3320                 ad->u.net.dport = th->dest;
3321                 break;
3322         }
3323
3324         case IPPROTO_UDP: {
3325                 struct udphdr _udph, *uh;
3326
3327                 if (ntohs(ih->frag_off) & IP_OFFSET)
3328                         break;
3329
3330                 offset += ihlen;
3331                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3332                 if (uh == NULL)
3333                         break;
3334
3335                 ad->u.net.sport = uh->source;
3336                 ad->u.net.dport = uh->dest;
3337                 break;
3338         }
3339
3340         case IPPROTO_DCCP: {
3341                 struct dccp_hdr _dccph, *dh;
3342
3343                 if (ntohs(ih->frag_off) & IP_OFFSET)
3344                         break;
3345
3346                 offset += ihlen;
3347                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3348                 if (dh == NULL)
3349                         break;
3350
3351                 ad->u.net.sport = dh->dccph_sport;
3352                 ad->u.net.dport = dh->dccph_dport;
3353                 break;
3354         }
3355
3356         default:
3357                 break;
3358         }
3359 out:
3360         return ret;
3361 }
3362
3363 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3364
3365 /* Returns error only if unable to parse addresses */
3366 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3367                         struct avc_audit_data *ad, u8 *proto)
3368 {
3369         u8 nexthdr;
3370         int ret = -EINVAL, offset;
3371         struct ipv6hdr _ipv6h, *ip6;
3372
3373         offset = skb_network_offset(skb);
3374         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3375         if (ip6 == NULL)
3376                 goto out;
3377
3378         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3379         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3380         ret = 0;
3381
3382         nexthdr = ip6->nexthdr;
3383         offset += sizeof(_ipv6h);
3384         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3385         if (offset < 0)
3386                 goto out;
3387
3388         if (proto)
3389                 *proto = nexthdr;
3390
3391         switch (nexthdr) {
3392         case IPPROTO_TCP: {
3393                 struct tcphdr _tcph, *th;
3394
3395                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3396                 if (th == NULL)
3397                         break;
3398
3399                 ad->u.net.sport = th->source;
3400                 ad->u.net.dport = th->dest;
3401                 break;
3402         }
3403
3404         case IPPROTO_UDP: {
3405                 struct udphdr _udph, *uh;
3406
3407                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3408                 if (uh == NULL)
3409                         break;
3410
3411                 ad->u.net.sport = uh->source;
3412                 ad->u.net.dport = uh->dest;
3413                 break;
3414         }
3415
3416         case IPPROTO_DCCP: {
3417                 struct dccp_hdr _dccph, *dh;
3418
3419                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3420                 if (dh == NULL)
3421                         break;
3422
3423                 ad->u.net.sport = dh->dccph_sport;
3424                 ad->u.net.dport = dh->dccph_dport;
3425                 break;
3426         }
3427
3428         /* includes fragments */
3429         default:
3430                 break;
3431         }
3432 out:
3433         return ret;
3434 }
3435
3436 #endif /* IPV6 */
3437
3438 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3439                              char **addrp, int src, u8 *proto)
3440 {
3441         int ret = 0;
3442
3443         switch (ad->u.net.family) {
3444         case PF_INET:
3445                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3446                 if (ret || !addrp)
3447                         break;
3448                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3449                                         &ad->u.net.v4info.daddr);
3450                 break;
3451
3452 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3453         case PF_INET6:
3454                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3455                 if (ret || !addrp)
3456                         break;
3457                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3458                                         &ad->u.net.v6info.daddr);
3459                 break;
3460 #endif  /* IPV6 */
3461         default:
3462                 break;
3463         }
3464
3465         if (unlikely(ret))
3466                 printk(KERN_WARNING
3467                        "SELinux: failure in selinux_parse_skb(),"
3468                        " unable to parse packet\n");
3469
3470         return ret;
3471 }
3472
3473 /**
3474  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3475  * @skb: the packet
3476  * @family: protocol family
3477  * @sid: the packet's peer label SID
3478  *
3479  * Description:
3480  * Check the various different forms of network peer labeling and determine
3481  * the peer label/SID for the packet; most of the magic actually occurs in
3482  * the security server function security_net_peersid_cmp().  The function
3483  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3484  * or -EACCES if @sid is invalid due to inconsistencies with the different
3485  * peer labels.
3486  *
3487  */
3488 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3489 {
3490         int err;
3491         u32 xfrm_sid;
3492         u32 nlbl_sid;
3493         u32 nlbl_type;
3494
3495         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3496         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3497
3498         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3499         if (unlikely(err)) {
3500                 printk(KERN_WARNING
3501                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3502                        " unable to determine packet's peer label\n");
3503                 return -EACCES;
3504         }
3505
3506         return 0;
3507 }
3508
3509 /* socket security operations */
3510 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3511                            u32 perms)
3512 {
3513         struct inode_security_struct *isec;
3514         struct task_security_struct *tsec;
3515         struct avc_audit_data ad;
3516         int err = 0;
3517
3518         tsec = task->security;
3519         isec = SOCK_INODE(sock)->i_security;
3520
3521         if (isec->sid == SECINITSID_KERNEL)
3522                 goto out;
3523
3524         AVC_AUDIT_DATA_INIT(&ad,NET);
3525         ad.u.net.sk = sock->sk;
3526         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3527
3528 out:
3529         return err;
3530 }
3531
3532 static int selinux_socket_create(int family, int type,
3533                                  int protocol, int kern)
3534 {
3535         int err = 0;
3536         struct task_security_struct *tsec;
3537         u32 newsid;
3538
3539         if (kern)
3540                 goto out;
3541
3542         tsec = current->security;
3543         newsid = tsec->sockcreate_sid ? : tsec->sid;
3544         err = avc_has_perm(tsec->sid, newsid,
3545                            socket_type_to_security_class(family, type,
3546                            protocol), SOCKET__CREATE, NULL);
3547
3548 out:
3549         return err;
3550 }
3551
3552 static int selinux_socket_post_create(struct socket *sock, int family,
3553                                       int type, int protocol, int kern)
3554 {
3555         int err = 0;
3556         struct inode_security_struct *isec;
3557         struct task_security_struct *tsec;
3558         struct sk_security_struct *sksec;
3559         u32 newsid;
3560
3561         isec = SOCK_INODE(sock)->i_security;
3562
3563         tsec = current->security;
3564         newsid = tsec->sockcreate_sid ? : tsec->sid;
3565         isec->sclass = socket_type_to_security_class(family, type, protocol);
3566         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3567         isec->initialized = 1;
3568
3569         if (sock->sk) {
3570                 sksec = sock->sk->sk_security;
3571                 sksec->sid = isec->sid;
3572                 sksec->sclass = isec->sclass;
3573                 err = selinux_netlbl_socket_post_create(sock);
3574         }
3575
3576         return err;
3577 }
3578
3579 /* Range of port numbers used to automatically bind.
3580    Need to determine whether we should perform a name_bind
3581    permission check between the socket and the port number. */
3582
3583 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3584 {
3585         u16 family;
3586         int err;
3587
3588         err = socket_has_perm(current, sock, SOCKET__BIND);
3589         if (err)
3590                 goto out;
3591
3592         /*
3593          * If PF_INET or PF_INET6, check name_bind permission for the port.
3594          * Multiple address binding for SCTP is not supported yet: we just
3595          * check the first address now.
3596          */
3597         family = sock->sk->sk_family;
3598         if (family == PF_INET || family == PF_INET6) {
3599                 char *addrp;
3600                 struct inode_security_struct *isec;
3601                 struct task_security_struct *tsec;
3602                 struct avc_audit_data ad;
3603                 struct sockaddr_in *addr4 = NULL;
3604                 struct sockaddr_in6 *addr6 = NULL;
3605                 unsigned short snum;
3606                 struct sock *sk = sock->sk;
3607                 u32 sid, node_perm, addrlen;
3608
3609                 tsec = current->security;
3610                 isec = SOCK_INODE(sock)->i_security;
3611
3612                 if (family == PF_INET) {
3613                         addr4 = (struct sockaddr_in *)address;
3614                         snum = ntohs(addr4->sin_port);
3615                         addrlen = sizeof(addr4->sin_addr.s_addr);
3616                         addrp = (char *)&addr4->sin_addr.s_addr;
3617                 } else {
3618                         addr6 = (struct sockaddr_in6 *)address;
3619                         snum = ntohs(addr6->sin6_port);
3620                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3621                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3622                 }
3623
3624                 if (snum) {
3625                         int low, high;
3626
3627                         inet_get_local_port_range(&low, &high);
3628
3629                         if (snum < max(PROT_SOCK, low) || snum > high) {
3630                                 err = security_port_sid(sk->sk_family,
3631                                                         sk->sk_type,
3632                                                         sk->sk_protocol, snum,
3633                                                         &sid);
3634                                 if (err)
3635                                         goto out;
3636                                 AVC_AUDIT_DATA_INIT(&ad,NET);
3637                                 ad.u.net.sport = htons(snum);
3638                                 ad.u.net.family = family;
3639                                 err = avc_has_perm(isec->sid, sid,
3640                                                    isec->sclass,
3641                                                    SOCKET__NAME_BIND, &ad);
3642                                 if (err)
3643                                         goto out;
3644                         }
3645                 }
3646
3647                 switch(isec->sclass) {
3648                 case SECCLASS_TCP_SOCKET:
3649                         node_perm = TCP_SOCKET__NODE_BIND;
3650                         break;
3651
3652                 case SECCLASS_UDP_SOCKET:
3653                         node_perm = UDP_SOCKET__NODE_BIND;
3654                         break;
3655
3656                 case SECCLASS_DCCP_SOCKET:
3657                         node_perm = DCCP_SOCKET__NODE_BIND;
3658                         break;
3659
3660                 default:
3661                         node_perm = RAWIP_SOCKET__NODE_BIND;
3662                         break;
3663                 }
3664
3665                 err = sel_netnode_sid(addrp, family, &sid);
3666                 if (err)
3667                         goto out;
3668
3669                 AVC_AUDIT_DATA_INIT(&ad,NET);
3670                 ad.u.net.sport = htons(snum);
3671                 ad.u.net.family = family;
3672
3673                 if (family == PF_INET)
3674                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3675                 else
3676                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3677
3678                 err = avc_has_perm(isec->sid, sid,
3679                                    isec->sclass, node_perm, &ad);
3680                 if (err)
3681                         goto out;
3682         }
3683 out:
3684         return err;
3685 }
3686
3687 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3688 {
3689         struct inode_security_struct *isec;
3690         int err;
3691
3692         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3693         if (err)
3694                 return err;
3695
3696         /*
3697          * If a TCP or DCCP socket, check name_connect permission for the port.
3698          */
3699         isec = SOCK_INODE(sock)->i_security;
3700         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3701             isec->sclass == SECCLASS_DCCP_SOCKET) {
3702                 struct sock *sk = sock->sk;
3703                 struct avc_audit_data ad;
3704                 struct sockaddr_in *addr4 = NULL;
3705                 struct sockaddr_in6 *addr6 = NULL;
3706                 unsigned short snum;
3707                 u32 sid, perm;
3708
3709                 if (sk->sk_family == PF_INET) {
3710                         addr4 = (struct sockaddr_in *)address;
3711                         if (addrlen < sizeof(struct sockaddr_in))
3712                                 return -EINVAL;
3713                         snum = ntohs(addr4->sin_port);
3714                 } else {
3715                         addr6 = (struct sockaddr_in6 *)address;
3716                         if (addrlen < SIN6_LEN_RFC2133)
3717                                 return -EINVAL;
3718                         snum = ntohs(addr6->sin6_port);
3719                 }
3720
3721                 err = security_port_sid(sk->sk_family, sk->sk_type,
3722                                         sk->sk_protocol, snum, &sid);
3723                 if (err)
3724                         goto out;
3725
3726                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3727                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3728
3729                 AVC_AUDIT_DATA_INIT(&ad,NET);
3730                 ad.u.net.dport = htons(snum);
3731                 ad.u.net.family = sk->sk_family;
3732                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3733                 if (err)
3734                         goto out;
3735         }
3736
3737 out:
3738         return err;
3739 }
3740
3741 static int selinux_socket_listen(struct socket *sock, int backlog)
3742 {
3743         return socket_has_perm(current, sock, SOCKET__LISTEN);
3744 }
3745
3746 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3747 {
3748         int err;
3749         struct inode_security_struct *isec;
3750         struct inode_security_struct *newisec;
3751
3752         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3753         if (err)
3754                 return err;
3755
3756         newisec = SOCK_INODE(newsock)->i_security;
3757
3758         isec = SOCK_INODE(sock)->i_security;
3759         newisec->sclass = isec->sclass;
3760         newisec->sid = isec->sid;
3761         newisec->initialized = 1;
3762
3763         return 0;
3764 }
3765
3766 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3767                                   int size)
3768 {
3769         int rc;
3770
3771         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3772         if (rc)
3773                 return rc;
3774
3775         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3776 }
3777
3778 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3779                                   int size, int flags)
3780 {
3781         return socket_has_perm(current, sock, SOCKET__READ);
3782 }
3783
3784 static int selinux_socket_getsockname(struct socket *sock)
3785 {
3786         return socket_has_perm(current, sock, SOCKET__GETATTR);
3787 }
3788
3789 static int selinux_socket_getpeername(struct socket *sock)
3790 {
3791         return socket_has_perm(current, sock, SOCKET__GETATTR);
3792 }
3793
3794 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3795 {
3796         int err;
3797
3798         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3799         if (err)
3800                 return err;
3801
3802         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3803 }
3804
3805 static int selinux_socket_getsockopt(struct socket *sock, int level,
3806                                      int optname)
3807 {
3808         return socket_has_perm(current, sock, SOCKET__GETOPT);
3809 }
3810
3811 static int selinux_socket_shutdown(struct socket *sock, int how)
3812 {
3813         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3814 }
3815
3816 static int selinux_socket_unix_stream_connect(struct socket *sock,
3817                                               struct socket *other,
3818                                               struct sock *newsk)
3819 {
3820         struct sk_security_struct *ssec;
3821         struct inode_security_struct *isec;
3822         struct inode_security_struct *other_isec;
3823         struct avc_audit_data ad;
3824         int err;
3825
3826         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3827         if (err)
3828                 return err;
3829
3830         isec = SOCK_INODE(sock)->i_security;
3831         other_isec = SOCK_INODE(other)->i_security;
3832
3833         AVC_AUDIT_DATA_INIT(&ad,NET);
3834         ad.u.net.sk = other->sk;
3835
3836         err = avc_has_perm(isec->sid, other_isec->sid,
3837                            isec->sclass,
3838                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3839         if (err)
3840                 return err;
3841
3842         /* connecting socket */
3843         ssec = sock->sk->sk_security;
3844         ssec->peer_sid = other_isec->sid;
3845
3846         /* server child socket */
3847         ssec = newsk->sk_security;
3848         ssec->peer_sid = isec->sid;
3849         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3850
3851         return err;
3852 }
3853
3854 static int selinux_socket_unix_may_send(struct socket *sock,
3855                                         struct socket *other)
3856 {
3857         struct inode_security_struct *isec;
3858         struct inode_security_struct *other_isec;
3859         struct avc_audit_data ad;
3860         int err;
3861
3862         isec = SOCK_INODE(sock)->i_security;
3863         other_isec = SOCK_INODE(other)->i_security;
3864
3865         AVC_AUDIT_DATA_INIT(&ad,NET);
3866         ad.u.net.sk = other->sk;
3867
3868         err = avc_has_perm(isec->sid, other_isec->sid,
3869                            isec->sclass, SOCKET__SENDTO, &ad);
3870         if (err)
3871                 return err;
3872
3873         return 0;
3874 }
3875
3876 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3877                                     u32 peer_sid,
3878                                     struct avc_audit_data *ad)
3879 {
3880         int err;
3881         u32 if_sid;
3882         u32 node_sid;
3883
3884         err = sel_netif_sid(ifindex, &if_sid);
3885         if (err)
3886                 return err;
3887         err = avc_has_perm(peer_sid, if_sid,
3888                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3889         if (err)
3890                 return err;
3891
3892         err = sel_netnode_sid(addrp, family, &node_sid);
3893         if (err)
3894                 return err;
3895         return avc_has_perm(peer_sid, node_sid,
3896                             SECCLASS_NODE, NODE__RECVFROM, ad);
3897 }
3898
3899 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3900                                                 struct sk_buff *skb,
3901                                                 struct avc_audit_data *ad,
3902                                                 u16 family,
3903                                                 char *addrp)
3904 {
3905         int err;
3906         struct sk_security_struct *sksec = sk->sk_security;
3907         u16 sk_class;
3908         u32 netif_perm, node_perm, recv_perm;
3909         u32 port_sid, node_sid, if_sid, sk_sid;
3910
3911         sk_sid = sksec->sid;
3912         sk_class = sksec->sclass;
3913
3914         switch (sk_class) {
3915         case SECCLASS_UDP_SOCKET:
3916                 netif_perm = NETIF__UDP_RECV;
3917                 node_perm = NODE__UDP_RECV;
3918                 recv_perm = UDP_SOCKET__RECV_MSG;
3919                 break;
3920         case SECCLASS_TCP_SOCKET:
3921                 netif_perm = NETIF__TCP_RECV;
3922                 node_perm = NODE__TCP_RECV;
3923                 recv_perm = TCP_SOCKET__RECV_MSG;
3924                 break;
3925         case SECCLASS_DCCP_SOCKET:
3926                 netif_perm = NETIF__DCCP_RECV;
3927                 node_perm = NODE__DCCP_RECV;
3928                 recv_perm = DCCP_SOCKET__RECV_MSG;
3929                 break;
3930         default:
3931                 netif_perm = NETIF__RAWIP_RECV;
3932                 node_perm = NODE__RAWIP_RECV;
3933                 recv_perm = 0;
3934                 break;
3935         }
3936
3937         err = sel_netif_sid(skb->iif, &if_sid);
3938         if (err)
3939                 return err;
3940         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3941         if (err)
3942                 return err;
3943
3944         err = sel_netnode_sid(addrp, family, &node_sid);
3945         if (err)
3946                 return err;
3947         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3948         if (err)
3949                 return err;
3950
3951         if (!recv_perm)
3952                 return 0;
3953         err = security_port_sid(sk->sk_family, sk->sk_type,
3954                                 sk->sk_protocol, ntohs(ad->u.net.sport),
3955                                 &port_sid);
3956         if (unlikely(err)) {
3957                 printk(KERN_WARNING
3958                        "SELinux: failure in"
3959                        " selinux_sock_rcv_skb_iptables_compat(),"
3960                        " network port label not found\n");
3961                 return err;
3962         }
3963         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3964 }
3965
3966 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3967                                        struct avc_audit_data *ad,
3968                                        u16 family, char *addrp)
3969 {
3970         int err;
3971         struct sk_security_struct *sksec = sk->sk_security;
3972         u32 peer_sid;
3973         u32 sk_sid = sksec->sid;
3974
3975         if (selinux_compat_net)
3976                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3977                                                            family, addrp);
3978         else
3979                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3980                                    PACKET__RECV, ad);
3981         if (err)
3982                 return err;
3983
3984         if (selinux_policycap_netpeer) {
3985                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3986                 if (err)
3987                         return err;
3988                 err = avc_has_perm(sk_sid, peer_sid,
3989                                    SECCLASS_PEER, PEER__RECV, ad);
3990         } else {
3991                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
3992                 if (err)
3993                         return err;
3994                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
3995         }
3996
3997         return err;
3998 }
3999
4000 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4001 {
4002         int err;
4003         struct sk_security_struct *sksec = sk->sk_security;
4004         u16 family = sk->sk_family;
4005         u32 sk_sid = sksec->sid;
4006         struct avc_audit_data ad;
4007         char *addrp;
4008
4009         if (family != PF_INET && family != PF_INET6)
4010                 return 0;
4011
4012         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4013         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4014                 family = PF_INET;
4015
4016         AVC_AUDIT_DATA_INIT(&ad, NET);
4017         ad.u.net.netif = skb->iif;
4018         ad.u.net.family = family;
4019         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4020         if (err)
4021                 return err;
4022
4023         /* If any sort of compatibility mode is enabled then handoff processing
4024          * to the selinux_sock_rcv_skb_compat() function to deal with the
4025          * special handling.  We do this in an attempt to keep this function
4026          * as fast and as clean as possible. */
4027         if (selinux_compat_net || !selinux_policycap_netpeer)
4028                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4029                                                    family, addrp);
4030
4031         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4032                 u32 peer_sid;
4033
4034                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4035                 if (err)
4036                         return err;
4037                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4038                                                peer_sid, &ad);
4039                 if (err)
4040                         return err;
4041                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4042                                    PEER__RECV, &ad);
4043         }
4044
4045         if (selinux_secmark_enabled()) {
4046                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4047                                    PACKET__RECV, &ad);
4048                 if (err)
4049                         return err;
4050         }
4051
4052         return err;
4053 }
4054
4055 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4056                                             int __user *optlen, unsigned len)
4057 {
4058         int err = 0;
4059         char *scontext;
4060         u32 scontext_len;
4061         struct sk_security_struct *ssec;
4062         struct inode_security_struct *isec;
4063         u32 peer_sid = SECSID_NULL;
4064
4065         isec = SOCK_INODE(sock)->i_security;
4066
4067         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4068             isec->sclass == SECCLASS_TCP_SOCKET) {
4069                 ssec = sock->sk->sk_security;
4070                 peer_sid = ssec->peer_sid;
4071         }
4072         if (peer_sid == SECSID_NULL) {
4073                 err = -ENOPROTOOPT;
4074                 goto out;
4075         }
4076
4077         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4078
4079         if (err)
4080                 goto out;
4081
4082         if (scontext_len > len) {
4083                 err = -ERANGE;
4084                 goto out_len;
4085         }
4086
4087         if (copy_to_user(optval, scontext, scontext_len))
4088                 err = -EFAULT;
4089
4090 out_len:
4091         if (put_user(scontext_len, optlen))
4092                 err = -EFAULT;
4093
4094         kfree(scontext);
4095 out:
4096         return err;
4097 }
4098
4099 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4100 {
4101         u32 peer_secid = SECSID_NULL;
4102         u16 family;
4103
4104         if (sock)
4105                 family = sock->sk->sk_family;
4106         else if (skb && skb->sk)
4107                 family = skb->sk->sk_family;
4108         else
4109                 goto out;
4110
4111         if (sock && family == PF_UNIX)
4112                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4113         else if (skb)
4114                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4115
4116 out:
4117         *secid = peer_secid;
4118         if (peer_secid == SECSID_NULL)
4119                 return -EINVAL;
4120         return 0;
4121 }
4122
4123 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4124 {
4125         return sk_alloc_security(sk, family, priority);
4126 }
4127
4128 static void selinux_sk_free_security(struct sock *sk)
4129 {
4130         sk_free_security(sk);
4131 }
4132
4133 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4134 {
4135         struct sk_security_struct *ssec = sk->sk_security;
4136         struct sk_security_struct *newssec = newsk->sk_security;
4137
4138         newssec->sid = ssec->sid;
4139         newssec->peer_sid = ssec->peer_sid;
4140         newssec->sclass = ssec->sclass;
4141
4142         selinux_netlbl_sk_security_clone(ssec, newssec);
4143 }
4144
4145 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4146 {
4147         if (!sk)
4148                 *secid = SECINITSID_ANY_SOCKET;
4149         else {
4150                 struct sk_security_struct *sksec = sk->sk_security;
4151
4152                 *secid = sksec->sid;
4153         }
4154 }
4155
4156 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4157 {
4158         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4159         struct sk_security_struct *sksec = sk->sk_security;
4160
4161         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4162             sk->sk_family == PF_UNIX)
4163                 isec->sid = sksec->sid;
4164         sksec->sclass = isec->sclass;
4165
4166         selinux_netlbl_sock_graft(sk, parent);
4167 }
4168
4169 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4170                                      struct request_sock *req)
4171 {
4172         struct sk_security_struct *sksec = sk->sk_security;
4173         int err;
4174         u32 newsid;
4175         u32 peersid;
4176
4177         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4178         if (err)
4179                 return err;
4180         if (peersid == SECSID_NULL) {
4181                 req->secid = sksec->sid;
4182                 req->peer_secid = SECSID_NULL;
4183                 return 0;
4184         }
4185
4186         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4187         if (err)
4188                 return err;
4189
4190         req->secid = newsid;
4191         req->peer_secid = peersid;
4192         return 0;
4193 }
4194
4195 static void selinux_inet_csk_clone(struct sock *newsk,
4196                                    const struct request_sock *req)
4197 {
4198         struct sk_security_struct *newsksec = newsk->sk_security;
4199
4200         newsksec->sid = req->secid;
4201         newsksec->peer_sid = req->peer_secid;
4202         /* NOTE: Ideally, we should also get the isec->sid for the
4203            new socket in sync, but we don't have the isec available yet.
4204            So we will wait until sock_graft to do it, by which
4205            time it will have been created and available. */
4206
4207         /* We don't need to take any sort of lock here as we are the only
4208          * thread with access to newsksec */
4209         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4210 }
4211
4212 static void selinux_inet_conn_established(struct sock *sk,
4213                                 struct sk_buff *skb)
4214 {
4215         struct sk_security_struct *sksec = sk->sk_security;
4216
4217         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4218 }
4219
4220 static void selinux_req_classify_flow(const struct request_sock *req,
4221                                       struct flowi *fl)
4222 {
4223         fl->secid = req->secid;
4224 }
4225
4226 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4227 {
4228         int err = 0;
4229         u32 perm;
4230         struct nlmsghdr *nlh;
4231         struct socket *sock = sk->sk_socket;
4232         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4233
4234         if (skb->len < NLMSG_SPACE(0)) {
4235                 err = -EINVAL;
4236                 goto out;
4237         }
4238         nlh = nlmsg_hdr(skb);
4239
4240         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4241         if (err) {
4242                 if (err == -EINVAL) {
4243                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4244                                   "SELinux:  unrecognized netlink message"
4245                                   " type=%hu for sclass=%hu\n",
4246                                   nlh->nlmsg_type, isec->sclass);
4247                         if (!selinux_enforcing)
4248                                 err = 0;
4249                 }
4250
4251                 /* Ignore */
4252                 if (err == -ENOENT)
4253                         err = 0;
4254                 goto out;
4255         }
4256
4257         err = socket_has_perm(current, sock, perm);
4258 out:
4259         return err;
4260 }
4261
4262 #ifdef CONFIG_NETFILTER
4263
4264 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4265                                        u16 family)
4266 {
4267         char *addrp;
4268         u32 peer_sid;
4269         struct avc_audit_data ad;
4270         u8 secmark_active;
4271         u8 peerlbl_active;
4272
4273         if (!selinux_policycap_netpeer)
4274                 return NF_ACCEPT;
4275
4276         secmark_active = selinux_secmark_enabled();
4277         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4278         if (!secmark_active && !peerlbl_active)
4279                 return NF_ACCEPT;
4280
4281         AVC_AUDIT_DATA_INIT(&ad, NET);
4282         ad.u.net.netif = ifindex;
4283         ad.u.net.family = family;
4284         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4285                 return NF_DROP;
4286
4287         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4288                 return NF_DROP;
4289
4290         if (peerlbl_active)
4291                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4292                                              peer_sid, &ad) != 0)
4293                         return NF_DROP;
4294
4295         if (secmark_active)
4296                 if (avc_has_perm(peer_sid, skb->secmark,
4297                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4298                         return NF_DROP;
4299
4300         return NF_ACCEPT;
4301 }
4302
4303 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4304                                          struct sk_buff *skb,
4305                                          const struct net_device *in,
4306                                          const struct net_device *out,
4307                                          int (*okfn)(struct sk_buff *))
4308 {
4309         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4310 }
4311
4312 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4313 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4314                                          struct sk_buff *skb,
4315                                          const struct net_device *in,
4316                                          const struct net_device *out,
4317                                          int (*okfn)(struct sk_buff *))
4318 {
4319         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4320 }
4321 #endif  /* IPV6 */
4322
4323 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4324                                                 int ifindex,
4325                                                 struct avc_audit_data *ad,
4326                                                 u16 family, char *addrp)
4327 {
4328         int err;
4329         struct sk_security_struct *sksec = sk->sk_security;
4330         u16 sk_class;
4331         u32 netif_perm, node_perm, send_perm;
4332         u32 port_sid, node_sid, if_sid, sk_sid;
4333
4334         sk_sid = sksec->sid;
4335         sk_class = sksec->sclass;
4336
4337         switch (sk_class) {
4338         case SECCLASS_UDP_SOCKET:
4339                 netif_perm = NETIF__UDP_SEND;
4340                 node_perm = NODE__UDP_SEND;
4341                 send_perm = UDP_SOCKET__SEND_MSG;
4342                 break;
4343         case SECCLASS_TCP_SOCKET:
4344                 netif_perm = NETIF__TCP_SEND;
4345                 node_perm = NODE__TCP_SEND;
4346                 send_perm = TCP_SOCKET__SEND_MSG;
4347                 break;
4348         case SECCLASS_DCCP_SOCKET:
4349                 netif_perm = NETIF__DCCP_SEND;
4350                 node_perm = NODE__DCCP_SEND;
4351                 send_perm = DCCP_SOCKET__SEND_MSG;
4352                 break;
4353         default:
4354                 netif_perm = NETIF__RAWIP_SEND;
4355                 node_perm = NODE__RAWIP_SEND;
4356                 send_perm = 0;
4357                 break;
4358         }
4359
4360         err = sel_netif_sid(ifindex, &if_sid);
4361         if (err)
4362                 return err;
4363         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4364                 return err;
4365
4366         err = sel_netnode_sid(addrp, family, &node_sid);
4367         if (err)
4368                 return err;
4369         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4370         if (err)
4371                 return err;
4372
4373         if (send_perm != 0)
4374                 return 0;
4375
4376         err = security_port_sid(sk->sk_family, sk->sk_type,
4377                                 sk->sk_protocol, ntohs(ad->u.net.dport),
4378                                 &port_sid);
4379         if (unlikely(err)) {
4380                 printk(KERN_WARNING
4381                        "SELinux: failure in"
4382                        " selinux_ip_postroute_iptables_compat(),"
4383                        " network port label not found\n");
4384                 return err;
4385         }
4386         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4387 }
4388
4389 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4390                                                 int ifindex,
4391                                                 struct avc_audit_data *ad,
4392                                                 u16 family,
4393                                                 char *addrp,
4394                                                 u8 proto)
4395 {
4396         struct sock *sk = skb->sk;
4397         struct sk_security_struct *sksec;
4398
4399         if (sk == NULL)
4400                 return NF_ACCEPT;
4401         sksec = sk->sk_security;
4402
4403         if (selinux_compat_net) {
4404                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4405                                                          ad, family, addrp))
4406                         return NF_DROP;
4407         } else {
4408                 if (avc_has_perm(sksec->sid, skb->secmark,
4409                                  SECCLASS_PACKET, PACKET__SEND, ad))
4410                         return NF_DROP;
4411         }
4412
4413         if (selinux_policycap_netpeer)
4414                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4415                         return NF_DROP;
4416
4417         return NF_ACCEPT;
4418 }
4419
4420 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4421                                          u16 family)
4422 {
4423         u32 secmark_perm;
4424         u32 peer_sid;
4425         struct sock *sk;
4426         struct avc_audit_data ad;
4427         char *addrp;
4428         u8 proto;
4429         u8 secmark_active;
4430         u8 peerlbl_active;
4431
4432         AVC_AUDIT_DATA_INIT(&ad, NET);
4433         ad.u.net.netif = ifindex;
4434         ad.u.net.family = family;
4435         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4436                 return NF_DROP;
4437
4438         /* If any sort of compatibility mode is enabled then handoff processing
4439          * to the selinux_ip_postroute_compat() function to deal with the
4440          * special handling.  We do this in an attempt to keep this function
4441          * as fast and as clean as possible. */
4442         if (selinux_compat_net || !selinux_policycap_netpeer)
4443                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4444                                                    family, addrp, proto);
4445
4446         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4447          * packet transformation so allow the packet to pass without any checks
4448          * since we'll have another chance to perform access control checks
4449          * when the packet is on it's final way out.
4450          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4451          *       is NULL, in this case go ahead and apply access control. */
4452         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4453                 return NF_ACCEPT;
4454
4455         secmark_active = selinux_secmark_enabled();
4456         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4457         if (!secmark_active && !peerlbl_active)
4458                 return NF_ACCEPT;
4459
4460         /* if the packet is locally generated (skb->sk != NULL) then use the
4461          * socket's label as the peer label, otherwise the packet is being
4462          * forwarded through this system and we need to fetch the peer label
4463          * directly from the packet */
4464         sk = skb->sk;
4465         if (sk) {
4466                 struct sk_security_struct *sksec = sk->sk_security;
4467                 peer_sid = sksec->sid;
4468                 secmark_perm = PACKET__SEND;
4469         } else {
4470                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4471                                 return NF_DROP;
4472                 secmark_perm = PACKET__FORWARD_OUT;
4473         }
4474
4475         if (secmark_active)
4476                 if (avc_has_perm(peer_sid, skb->secmark,
4477                                  SECCLASS_PACKET, secmark_perm, &ad))
4478                         return NF_DROP;
4479
4480         if (peerlbl_active) {
4481                 u32 if_sid;
4482                 u32 node_sid;
4483
4484                 if (sel_netif_sid(ifindex, &if_sid))
4485                         return NF_DROP;
4486                 if (avc_has_perm(peer_sid, if_sid,
4487                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4488                         return NF_DROP;
4489
4490                 if (sel_netnode_sid(addrp, family, &node_sid))
4491                         return NF_DROP;
4492                 if (avc_has_perm(peer_sid, node_sid,
4493                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4494                         return NF_DROP;
4495         }
4496
4497         return NF_ACCEPT;
4498 }
4499
4500 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4501                                            struct sk_buff *skb,
4502                                            const struct net_device *in,
4503                                            const struct net_device *out,
4504                                            int (*okfn)(struct sk_buff *))
4505 {
4506         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4507 }
4508
4509 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4510 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4511                                            struct sk_buff *skb,
4512                                            const struct net_device *in,
4513                                            const struct net_device *out,
4514                                            int (*okfn)(struct sk_buff *))
4515 {
4516         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4517 }
4518 #endif  /* IPV6 */
4519
4520 #endif  /* CONFIG_NETFILTER */
4521
4522 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4523 {
4524         int err;
4525
4526         err = secondary_ops->netlink_send(sk, skb);
4527         if (err)
4528                 return err;
4529
4530         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4531                 err = selinux_nlmsg_perm(sk, skb);
4532
4533         return err;
4534 }
4535
4536 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4537 {
4538         int err;
4539         struct avc_audit_data ad;
4540
4541         err = secondary_ops->netlink_recv(skb, capability);
4542         if (err)
4543                 return err;
4544
4545         AVC_AUDIT_DATA_INIT(&ad, CAP);
4546         ad.u.cap = capability;
4547
4548         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4549                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4550 }
4551
4552 static int ipc_alloc_security(struct task_struct *task,
4553                               struct kern_ipc_perm *perm,
4554                               u16 sclass)
4555 {
4556         struct task_security_struct *tsec = task->security;
4557         struct ipc_security_struct *isec;
4558
4559         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4560         if (!isec)
4561                 return -ENOMEM;
4562
4563         isec->sclass = sclass;
4564         isec->ipc_perm = perm;
4565         isec->sid = tsec->sid;
4566         perm->security = isec;
4567
4568         return 0;
4569 }
4570
4571 static void ipc_free_security(struct kern_ipc_perm *perm)
4572 {
4573         struct ipc_security_struct *isec = perm->security;
4574         perm->security = NULL;
4575         kfree(isec);
4576 }
4577
4578 static int msg_msg_alloc_security(struct msg_msg *msg)
4579 {
4580         struct msg_security_struct *msec;
4581
4582         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4583         if (!msec)
4584                 return -ENOMEM;
4585
4586         msec->msg = msg;
4587         msec->sid = SECINITSID_UNLABELED;
4588         msg->security = msec;
4589
4590         return 0;
4591 }
4592
4593 static void msg_msg_free_security(struct msg_msg *msg)
4594 {
4595         struct msg_security_struct *msec = msg->security;
4596
4597         msg->security = NULL;
4598         kfree(msec);
4599 }
4600
4601 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4602                         u32 perms)
4603 {
4604         struct task_security_struct *tsec;
4605         struct ipc_security_struct *isec;
4606         struct avc_audit_data ad;
4607
4608         tsec = current->security;
4609         isec = ipc_perms->security;
4610
4611         AVC_AUDIT_DATA_INIT(&ad, IPC);
4612         ad.u.ipc_id = ipc_perms->key;
4613
4614         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4615 }
4616
4617 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4618 {
4619         return msg_msg_alloc_security(msg);
4620 }
4621
4622 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4623 {
4624         msg_msg_free_security(msg);
4625 }
4626
4627 /* message queue security operations */
4628 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4629 {
4630         struct task_security_struct *tsec;
4631         struct ipc_security_struct *isec;
4632         struct avc_audit_data ad;
4633         int rc;
4634
4635         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4636         if (rc)
4637                 return rc;
4638
4639         tsec = current->security;
4640         isec = msq->q_perm.security;
4641
4642         AVC_AUDIT_DATA_INIT(&ad, IPC);
4643         ad.u.ipc_id = msq->q_perm.key;
4644
4645         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4646                           MSGQ__CREATE, &ad);
4647         if (rc) {
4648                 ipc_free_security(&msq->q_perm);
4649                 return rc;
4650         }
4651         return 0;
4652 }
4653
4654 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4655 {
4656         ipc_free_security(&msq->q_perm);
4657 }
4658
4659 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4660 {
4661         struct task_security_struct *tsec;
4662         struct ipc_security_struct *isec;
4663         struct avc_audit_data ad;
4664
4665         tsec = current->security;
4666         isec = msq->q_perm.security;
4667
4668         AVC_AUDIT_DATA_INIT(&ad, IPC);
4669         ad.u.ipc_id = msq->q_perm.key;
4670
4671         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4672                             MSGQ__ASSOCIATE, &ad);
4673 }
4674
4675 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4676 {
4677         int err;
4678         int perms;
4679
4680         switch(cmd) {
4681         case IPC_INFO:
4682         case MSG_INFO:
4683                 /* No specific object, just general system-wide information. */
4684                 return task_has_system(current, SYSTEM__IPC_INFO);
4685         case IPC_STAT:
4686         case MSG_STAT:
4687                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4688                 break;
4689         case IPC_SET:
4690                 perms = MSGQ__SETATTR;
4691                 break;
4692         case IPC_RMID:
4693                 perms = MSGQ__DESTROY;
4694                 break;
4695         default:
4696                 return 0;
4697         }
4698
4699         err = ipc_has_perm(&msq->q_perm, perms);
4700         return err;
4701 }
4702
4703 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4704 {
4705         struct task_security_struct *tsec;
4706         struct ipc_security_struct *isec;
4707         struct msg_security_struct *msec;
4708         struct avc_audit_data ad;
4709         int rc;
4710
4711         tsec = current->security;
4712         isec = msq->q_perm.security;
4713         msec = msg->security;
4714
4715         /*
4716          * First time through, need to assign label to the message
4717          */
4718         if (msec->sid == SECINITSID_UNLABELED) {
4719                 /*
4720                  * Compute new sid based on current process and
4721                  * message queue this message will be stored in
4722                  */
4723                 rc = security_transition_sid(tsec->sid,
4724                                              isec->sid,
4725                                              SECCLASS_MSG,
4726                                              &msec->sid);
4727                 if (rc)
4728                         return rc;
4729         }
4730
4731         AVC_AUDIT_DATA_INIT(&ad, IPC);
4732         ad.u.ipc_id = msq->q_perm.key;
4733
4734         /* Can this process write to the queue? */
4735         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4736                           MSGQ__WRITE, &ad);
4737         if (!rc)
4738                 /* Can this process send the message */
4739                 rc = avc_has_perm(tsec->sid, msec->sid,
4740                                   SECCLASS_MSG, MSG__SEND, &ad);
4741         if (!rc)
4742                 /* Can the message be put in the queue? */
4743                 rc = avc_has_perm(msec->sid, isec->sid,
4744                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4745
4746         return rc;
4747 }
4748
4749 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4750                                     struct task_struct *target,
4751                                     long type, int mode)
4752 {
4753         struct task_security_struct *tsec;
4754         struct ipc_security_struct *isec;
4755         struct msg_security_struct *msec;
4756         struct avc_audit_data ad;
4757         int rc;
4758
4759         tsec = target->security;
4760         isec = msq->q_perm.security;
4761         msec = msg->security;
4762
4763         AVC_AUDIT_DATA_INIT(&ad, IPC);
4764         ad.u.ipc_id = msq->q_perm.key;
4765
4766         rc = avc_has_perm(tsec->sid, isec->sid,
4767                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4768         if (!rc)
4769                 rc = avc_has_perm(tsec->sid, msec->sid,
4770                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4771         return rc;
4772 }
4773
4774 /* Shared Memory security operations */
4775 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4776 {
4777         struct task_security_struct *tsec;
4778         struct ipc_security_struct *isec;
4779         struct avc_audit_data ad;
4780         int rc;
4781
4782         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4783         if (rc)
4784                 return rc;
4785
4786         tsec = current->security;
4787         isec = shp->shm_perm.security;
4788
4789         AVC_AUDIT_DATA_INIT(&ad, IPC);
4790         ad.u.ipc_id = shp->shm_perm.key;
4791
4792         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4793                           SHM__CREATE, &ad);
4794         if (rc) {
4795                 ipc_free_security(&shp->shm_perm);
4796                 return rc;
4797         }
4798         return 0;
4799 }
4800
4801 static void selinux_shm_free_security(struct shmid_kernel *shp)
4802 {
4803         ipc_free_security(&shp->shm_perm);
4804 }
4805
4806 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4807 {
4808         struct task_security_struct *tsec;
4809         struct ipc_security_struct *isec;
4810         struct avc_audit_data ad;
4811
4812         tsec = current->security;
4813         isec = shp->shm_perm.security;
4814
4815         AVC_AUDIT_DATA_INIT(&ad, IPC);
4816         ad.u.ipc_id = shp->shm_perm.key;
4817
4818         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4819                             SHM__ASSOCIATE, &ad);
4820 }
4821
4822 /* Note, at this point, shp is locked down */
4823 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4824 {
4825         int perms;
4826         int err;
4827
4828         switch(cmd) {
4829         case IPC_INFO:
4830         case SHM_INFO:
4831                 /* No specific object, just general system-wide information. */
4832                 return task_has_system(current, SYSTEM__IPC_INFO);
4833         case IPC_STAT:
4834         case SHM_STAT:
4835                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4836                 break;
4837         case IPC_SET:
4838                 perms = SHM__SETATTR;
4839                 break;
4840         case SHM_LOCK:
4841         case SHM_UNLOCK:
4842                 perms = SHM__LOCK;
4843                 break;
4844         case IPC_RMID:
4845                 perms = SHM__DESTROY;
4846                 break;
4847         default:
4848                 return 0;
4849         }
4850
4851         err = ipc_has_perm(&shp->shm_perm, perms);
4852         return err;
4853 }
4854
4855 static int selinux_shm_shmat(struct shmid_kernel *shp,
4856                              char __user *shmaddr, int shmflg)
4857 {
4858         u32 perms;
4859         int rc;
4860
4861         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4862         if (rc)
4863                 return rc;
4864
4865         if (shmflg & SHM_RDONLY)
4866                 perms = SHM__READ;
4867         else
4868                 perms = SHM__READ | SHM__WRITE;
4869
4870         return ipc_has_perm(&shp->shm_perm, perms);
4871 }
4872
4873 /* Semaphore security operations */
4874 static int selinux_sem_alloc_security(struct sem_array *sma)
4875 {
4876         struct task_security_struct *tsec;
4877         struct ipc_security_struct *isec;
4878         struct avc_audit_data ad;
4879         int rc;
4880
4881         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4882         if (rc)
4883                 return rc;
4884
4885         tsec = current->security;
4886         isec = sma->sem_perm.security;
4887
4888         AVC_AUDIT_DATA_INIT(&ad, IPC);
4889         ad.u.ipc_id = sma->sem_perm.key;
4890
4891         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4892                           SEM__CREATE, &ad);
4893         if (rc) {
4894                 ipc_free_security(&sma->sem_perm);
4895                 return rc;
4896         }
4897         return 0;
4898 }
4899
4900 static void selinux_sem_free_security(struct sem_array *sma)
4901 {
4902         ipc_free_security(&sma->sem_perm);
4903 }
4904
4905 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4906 {
4907         struct task_security_struct *tsec;
4908         struct ipc_security_struct *isec;
4909         struct avc_audit_data ad;
4910
4911         tsec = current->security;
4912         isec = sma->sem_perm.security;
4913
4914         AVC_AUDIT_DATA_INIT(&ad, IPC);
4915         ad.u.ipc_id = sma->sem_perm.key;
4916
4917         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4918                             SEM__ASSOCIATE, &ad);
4919 }
4920
4921 /* Note, at this point, sma is locked down */
4922 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4923 {
4924         int err;
4925         u32 perms;
4926
4927         switch(cmd) {
4928         case IPC_INFO:
4929         case SEM_INFO:
4930                 /* No specific object, just general system-wide information. */
4931                 return task_has_system(current, SYSTEM__IPC_INFO);
4932         case GETPID:
4933         case GETNCNT:
4934         case GETZCNT:
4935                 perms = SEM__GETATTR;
4936                 break;
4937         case GETVAL:
4938         case GETALL:
4939                 perms = SEM__READ;
4940                 break;
4941         case SETVAL:
4942         case SETALL:
4943                 perms = SEM__WRITE;
4944                 break;
4945         case IPC_RMID:
4946                 perms = SEM__DESTROY;
4947                 break;
4948         case IPC_SET:
4949                 perms = SEM__SETATTR;
4950                 break;
4951         case IPC_STAT:
4952         case SEM_STAT:
4953                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4954                 break;
4955         default:
4956                 return 0;
4957         }
4958
4959         err = ipc_has_perm(&sma->sem_perm, perms);
4960         return err;
4961 }
4962
4963 static int selinux_sem_semop(struct sem_array *sma,
4964                              struct sembuf *sops, unsigned nsops, int alter)
4965 {
4966         u32 perms;
4967
4968         if (alter)
4969                 perms = SEM__READ | SEM__WRITE;
4970         else
4971                 perms = SEM__READ;
4972
4973         return ipc_has_perm(&sma->sem_perm, perms);
4974 }
4975
4976 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4977 {
4978         u32 av = 0;
4979
4980         av = 0;
4981         if (flag & S_IRUGO)
4982                 av |= IPC__UNIX_READ;
4983         if (flag & S_IWUGO)
4984                 av |= IPC__UNIX_WRITE;
4985
4986         if (av == 0)
4987                 return 0;
4988
4989         return ipc_has_perm(ipcp, av);
4990 }
4991
4992 /* module stacking operations */
4993 static int selinux_register_security (const char *name, struct security_operations *ops)
4994 {
4995         if (secondary_ops != original_ops) {
4996                 printk(KERN_ERR "%s:  There is already a secondary security "
4997                        "module registered.\n", __FUNCTION__);
4998                 return -EINVAL;
4999         }
5000
5001         secondary_ops = ops;
5002
5003         printk(KERN_INFO "%s:  Registering secondary module %s\n",
5004                __FUNCTION__,
5005                name);
5006
5007         return 0;
5008 }
5009
5010 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5011 {
5012         if (inode)
5013                 inode_doinit_with_dentry(inode, dentry);
5014 }
5015
5016 static int selinux_getprocattr(struct task_struct *p,
5017                                char *name, char **value)
5018 {
5019         struct task_security_struct *tsec;
5020         u32 sid;
5021         int error;
5022         unsigned len;
5023
5024         if (current != p) {
5025                 error = task_has_perm(current, p, PROCESS__GETATTR);
5026                 if (error)
5027                         return error;
5028         }
5029
5030         tsec = p->security;
5031
5032         if (!strcmp(name, "current"))
5033                 sid = tsec->sid;
5034         else if (!strcmp(name, "prev"))
5035                 sid = tsec->osid;
5036         else if (!strcmp(name, "exec"))
5037                 sid = tsec->exec_sid;
5038         else if (!strcmp(name, "fscreate"))
5039                 sid = tsec->create_sid;
5040         else if (!strcmp(name, "keycreate"))
5041                 sid = tsec->keycreate_sid;
5042         else if (!strcmp(name, "sockcreate"))
5043                 sid = tsec->sockcreate_sid;
5044         else
5045                 return -EINVAL;
5046
5047         if (!sid)
5048                 return 0;
5049
5050         error = security_sid_to_context(sid, value, &len);
5051         if (error)
5052                 return error;
5053         return len;
5054 }
5055
5056 static int selinux_setprocattr(struct task_struct *p,
5057                                char *name, void *value, size_t size)
5058 {
5059         struct task_security_struct *tsec;
5060         u32 sid = 0;
5061         int error;
5062         char *str = value;
5063
5064         if (current != p) {
5065                 /* SELinux only allows a process to change its own
5066                    security attributes. */
5067                 return -EACCES;
5068         }
5069
5070         /*
5071          * Basic control over ability to set these attributes at all.
5072          * current == p, but we'll pass them separately in case the
5073          * above restriction is ever removed.
5074          */
5075         if (!strcmp(name, "exec"))
5076                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5077         else if (!strcmp(name, "fscreate"))
5078                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5079         else if (!strcmp(name, "keycreate"))
5080                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5081         else if (!strcmp(name, "sockcreate"))
5082                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5083         else if (!strcmp(name, "current"))
5084                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5085         else
5086                 error = -EINVAL;
5087         if (error)
5088                 return error;
5089
5090         /* Obtain a SID for the context, if one was specified. */
5091         if (size && str[1] && str[1] != '\n') {
5092                 if (str[size-1] == '\n') {
5093                         str[size-1] = 0;
5094                         size--;
5095                 }
5096                 error = security_context_to_sid(value, size, &sid);
5097                 if (error)
5098                         return error;
5099         }
5100
5101         /* Permission checking based on the specified context is
5102            performed during the actual operation (execve,
5103            open/mkdir/...), when we know the full context of the
5104            operation.  See selinux_bprm_set_security for the execve
5105            checks and may_create for the file creation checks. The
5106            operation will then fail if the context is not permitted. */
5107         tsec = p->security;
5108         if (!strcmp(name, "exec"))
5109                 tsec->exec_sid = sid;
5110         else if (!strcmp(name, "fscreate"))
5111                 tsec->create_sid = sid;
5112         else if (!strcmp(name, "keycreate")) {
5113                 error = may_create_key(sid, p);
5114                 if (error)
5115                         return error;
5116                 tsec->keycreate_sid = sid;
5117         } else if (!strcmp(name, "sockcreate"))
5118                 tsec->sockcreate_sid = sid;
5119         else if (!strcmp(name, "current")) {
5120                 struct av_decision avd;
5121
5122                 if (sid == 0)
5123                         return -EINVAL;
5124
5125                 /* Only allow single threaded processes to change context */
5126                 if (atomic_read(&p->mm->mm_users) != 1) {
5127                         struct task_struct *g, *t;
5128                         struct mm_struct *mm = p->mm;
5129                         read_lock(&tasklist_lock);
5130                         do_each_thread(g, t)
5131                                 if (t->mm == mm && t != p) {
5132                                         read_unlock(&tasklist_lock);
5133                                         return -EPERM;
5134                                 }
5135                         while_each_thread(g, t);
5136                         read_unlock(&tasklist_lock);
5137                 }
5138
5139                 /* Check permissions for the transition. */
5140                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5141                                      PROCESS__DYNTRANSITION, NULL);
5142                 if (error)
5143                         return error;
5144
5145                 /* Check for ptracing, and update the task SID if ok.
5146                    Otherwise, leave SID unchanged and fail. */
5147                 task_lock(p);
5148                 if (p->ptrace & PT_PTRACED) {
5149                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5150                                                      SECCLASS_PROCESS,
5151                                                      PROCESS__PTRACE, 0, &avd);
5152                         if (!error)
5153                                 tsec->sid = sid;
5154                         task_unlock(p);
5155                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5156                                   PROCESS__PTRACE, &avd, error, NULL);
5157                         if (error)
5158                                 return error;
5159                 } else {
5160                         tsec->sid = sid;
5161                         task_unlock(p);
5162                 }
5163         }
5164         else
5165                 return -EINVAL;
5166
5167         return size;
5168 }
5169
5170 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5171 {
5172         return security_sid_to_context(secid, secdata, seclen);
5173 }
5174
5175 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5176 {
5177         return security_context_to_sid(secdata, seclen, secid);
5178 }
5179
5180 static void selinux_release_secctx(char *secdata, u32 seclen)
5181 {
5182         kfree(secdata);
5183 }
5184
5185 #ifdef CONFIG_KEYS
5186
5187 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5188                              unsigned long flags)
5189 {
5190         struct task_security_struct *tsec = tsk->security;
5191         struct key_security_struct *ksec;
5192
5193         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5194         if (!ksec)
5195                 return -ENOMEM;
5196
5197         ksec->obj = k;
5198         if (tsec->keycreate_sid)
5199                 ksec->sid = tsec->keycreate_sid;
5200         else
5201                 ksec->sid = tsec->sid;
5202         k->security = ksec;
5203
5204         return 0;
5205 }
5206
5207 static void selinux_key_free(struct key *k)
5208 {
5209         struct key_security_struct *ksec = k->security;
5210
5211         k->security = NULL;
5212         kfree(ksec);
5213 }
5214
5215 static int selinux_key_permission(key_ref_t key_ref,
5216                             struct task_struct *ctx,
5217                             key_perm_t perm)
5218 {
5219         struct key *key;
5220         struct task_security_struct *tsec;
5221         struct key_security_struct *ksec;
5222
5223         key = key_ref_to_ptr(key_ref);
5224
5225         tsec = ctx->security;
5226         ksec = key->security;
5227
5228         /* if no specific permissions are requested, we skip the
5229            permission check. No serious, additional covert channels
5230            appear to be created. */
5231         if (perm == 0)
5232                 return 0;
5233
5234         return avc_has_perm(tsec->sid, ksec->sid,
5235                             SECCLASS_KEY, perm, NULL);
5236 }
5237
5238 #endif
5239
5240 static struct security_operations selinux_ops = {
5241         .ptrace =                       selinux_ptrace,
5242         .capget =                       selinux_capget,
5243         .capset_check =                 selinux_capset_check,
5244         .capset_set =                   selinux_capset_set,
5245         .sysctl =                       selinux_sysctl,
5246         .capable =                      selinux_capable,
5247         .quotactl =                     selinux_quotactl,
5248         .quota_on =                     selinux_quota_on,
5249         .syslog =                       selinux_syslog,
5250         .vm_enough_memory =             selinux_vm_enough_memory,
5251
5252         .netlink_send =                 selinux_netlink_send,
5253         .netlink_recv =                 selinux_netlink_recv,
5254
5255         .bprm_alloc_security =          selinux_bprm_alloc_security,
5256         .bprm_free_security =           selinux_bprm_free_security,
5257         .bprm_apply_creds =             selinux_bprm_apply_creds,
5258         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5259         .bprm_set_security =            selinux_bprm_set_security,
5260         .bprm_check_security =          selinux_bprm_check_security,
5261         .bprm_secureexec =              selinux_bprm_secureexec,
5262
5263         .sb_alloc_security =            selinux_sb_alloc_security,
5264         .sb_free_security =             selinux_sb_free_security,
5265         .sb_copy_data =                 selinux_sb_copy_data,
5266         .sb_kern_mount =                selinux_sb_kern_mount,
5267         .sb_statfs =                    selinux_sb_statfs,
5268         .sb_mount =                     selinux_mount,
5269         .sb_umount =                    selinux_umount,
5270         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5271         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5272         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5273         .sb_parse_opts_str =            selinux_parse_opts_str,
5274
5275
5276         .inode_alloc_security =         selinux_inode_alloc_security,
5277         .inode_free_security =          selinux_inode_free_security,
5278         .inode_init_security =          selinux_inode_init_security,
5279         .inode_create =                 selinux_inode_create,
5280         .inode_link =                   selinux_inode_link,
5281         .inode_unlink =                 selinux_inode_unlink,
5282         .inode_symlink =                selinux_inode_symlink,
5283         .inode_mkdir =                  selinux_inode_mkdir,
5284         .inode_rmdir =                  selinux_inode_rmdir,
5285         .inode_mknod =                  selinux_inode_mknod,
5286         .inode_rename =                 selinux_inode_rename,
5287         .inode_readlink =               selinux_inode_readlink,
5288         .inode_follow_link =            selinux_inode_follow_link,
5289         .inode_permission =             selinux_inode_permission,
5290         .inode_setattr =                selinux_inode_setattr,
5291         .inode_getattr =                selinux_inode_getattr,
5292         .inode_setxattr =               selinux_inode_setxattr,
5293         .inode_post_setxattr =          selinux_inode_post_setxattr,
5294         .inode_getxattr =               selinux_inode_getxattr,
5295         .inode_listxattr =              selinux_inode_listxattr,
5296         .inode_removexattr =            selinux_inode_removexattr,
5297         .inode_getsecurity =            selinux_inode_getsecurity,
5298         .inode_setsecurity =            selinux_inode_setsecurity,
5299         .inode_listsecurity =           selinux_inode_listsecurity,
5300         .inode_need_killpriv =          selinux_inode_need_killpriv,
5301         .inode_killpriv =               selinux_inode_killpriv,
5302
5303         .file_permission =              selinux_file_permission,
5304         .file_alloc_security =          selinux_file_alloc_security,
5305         .file_free_security =           selinux_file_free_security,
5306         .file_ioctl =                   selinux_file_ioctl,
5307         .file_mmap =                    selinux_file_mmap,
5308         .file_mprotect =                selinux_file_mprotect,
5309         .file_lock =                    selinux_file_lock,
5310         .file_fcntl =                   selinux_file_fcntl,
5311         .file_set_fowner =              selinux_file_set_fowner,
5312         .file_send_sigiotask =          selinux_file_send_sigiotask,
5313         .file_receive =                 selinux_file_receive,
5314
5315         .dentry_open =                  selinux_dentry_open,
5316
5317         .task_create =                  selinux_task_create,
5318         .task_alloc_security =          selinux_task_alloc_security,
5319         .task_free_security =           selinux_task_free_security,
5320         .task_setuid =                  selinux_task_setuid,
5321         .task_post_setuid =             selinux_task_post_setuid,
5322         .task_setgid =                  selinux_task_setgid,
5323         .task_setpgid =                 selinux_task_setpgid,
5324         .task_getpgid =                 selinux_task_getpgid,
5325         .task_getsid =                  selinux_task_getsid,
5326         .task_getsecid =                selinux_task_getsecid,
5327         .task_setgroups =               selinux_task_setgroups,
5328         .task_setnice =                 selinux_task_setnice,
5329         .task_setioprio =               selinux_task_setioprio,
5330         .task_getioprio =               selinux_task_getioprio,
5331         .task_setrlimit =               selinux_task_setrlimit,
5332         .task_setscheduler =            selinux_task_setscheduler,
5333         .task_getscheduler =            selinux_task_getscheduler,
5334         .task_movememory =              selinux_task_movememory,
5335         .task_kill =                    selinux_task_kill,
5336         .task_wait =                    selinux_task_wait,
5337         .task_prctl =                   selinux_task_prctl,
5338         .task_reparent_to_init =        selinux_task_reparent_to_init,
5339         .task_to_inode =                selinux_task_to_inode,
5340
5341         .ipc_permission =               selinux_ipc_permission,
5342
5343         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5344         .msg_msg_free_security =        selinux_msg_msg_free_security,
5345
5346         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5347         .msg_queue_free_security =      selinux_msg_queue_free_security,
5348         .msg_queue_associate =          selinux_msg_queue_associate,
5349         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5350         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5351         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5352
5353         .shm_alloc_security =           selinux_shm_alloc_security,
5354         .shm_free_security =            selinux_shm_free_security,
5355         .shm_associate =                selinux_shm_associate,
5356         .shm_shmctl =                   selinux_shm_shmctl,
5357         .shm_shmat =                    selinux_shm_shmat,
5358
5359         .sem_alloc_security =           selinux_sem_alloc_security,
5360         .sem_free_security =            selinux_sem_free_security,
5361         .sem_associate =                selinux_sem_associate,
5362         .sem_semctl =                   selinux_sem_semctl,
5363         .sem_semop =                    selinux_sem_semop,
5364
5365         .register_security =            selinux_register_security,
5366
5367         .d_instantiate =                selinux_d_instantiate,
5368
5369         .getprocattr =                  selinux_getprocattr,
5370         .setprocattr =                  selinux_setprocattr,
5371
5372         .secid_to_secctx =              selinux_secid_to_secctx,
5373         .secctx_to_secid =              selinux_secctx_to_secid,
5374         .release_secctx =               selinux_release_secctx,
5375
5376         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5377         .unix_may_send =                selinux_socket_unix_may_send,
5378
5379         .socket_create =                selinux_socket_create,
5380         .socket_post_create =           selinux_socket_post_create,
5381         .socket_bind =                  selinux_socket_bind,
5382         .socket_connect =               selinux_socket_connect,
5383         .socket_listen =                selinux_socket_listen,
5384         .socket_accept =                selinux_socket_accept,
5385         .socket_sendmsg =               selinux_socket_sendmsg,
5386         .socket_recvmsg =               selinux_socket_recvmsg,
5387         .socket_getsockname =           selinux_socket_getsockname,
5388         .socket_getpeername =           selinux_socket_getpeername,
5389         .socket_getsockopt =            selinux_socket_getsockopt,
5390         .socket_setsockopt =            selinux_socket_setsockopt,
5391         .socket_shutdown =              selinux_socket_shutdown,
5392         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5393         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5394         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5395         .sk_alloc_security =            selinux_sk_alloc_security,
5396         .sk_free_security =             selinux_sk_free_security,
5397         .sk_clone_security =            selinux_sk_clone_security,
5398         .sk_getsecid =                  selinux_sk_getsecid,
5399         .sock_graft =                   selinux_sock_graft,
5400         .inet_conn_request =            selinux_inet_conn_request,
5401         .inet_csk_clone =               selinux_inet_csk_clone,
5402         .inet_conn_established =        selinux_inet_conn_established,
5403         .req_classify_flow =            selinux_req_classify_flow,
5404
5405 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5406         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5407         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5408         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5409         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5410         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5411         .xfrm_state_free_security =     selinux_xfrm_state_free,
5412         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5413         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5414         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5415         .xfrm_decode_session =          selinux_xfrm_decode_session,
5416 #endif
5417
5418 #ifdef CONFIG_KEYS
5419         .key_alloc =                    selinux_key_alloc,
5420         .key_free =                     selinux_key_free,
5421         .key_permission =               selinux_key_permission,
5422 #endif
5423 };
5424
5425 static __init int selinux_init(void)
5426 {
5427         struct task_security_struct *tsec;
5428
5429         if (!selinux_enabled) {
5430                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5431                 return 0;
5432         }
5433
5434         printk(KERN_INFO "SELinux:  Initializing.\n");
5435
5436         /* Set the security state for the initial task. */
5437         if (task_alloc_security(current))
5438                 panic("SELinux:  Failed to initialize initial task.\n");
5439         tsec = current->security;
5440         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5441
5442         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5443                                             sizeof(struct inode_security_struct),
5444                                             0, SLAB_PANIC, NULL);
5445         avc_init();
5446
5447         original_ops = secondary_ops = security_ops;
5448         if (!secondary_ops)
5449                 panic ("SELinux: No initial security operations\n");
5450         if (register_security (&selinux_ops))
5451                 panic("SELinux: Unable to register with kernel.\n");
5452
5453         if (selinux_enforcing) {
5454                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5455         } else {
5456                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5457         }
5458
5459 #ifdef CONFIG_KEYS
5460         /* Add security information to initial keyrings */
5461         selinux_key_alloc(&root_user_keyring, current,
5462                           KEY_ALLOC_NOT_IN_QUOTA);
5463         selinux_key_alloc(&root_session_keyring, current,
5464                           KEY_ALLOC_NOT_IN_QUOTA);
5465 #endif
5466
5467         return 0;
5468 }
5469
5470 void selinux_complete_init(void)
5471 {
5472         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5473
5474         /* Set up any superblocks initialized prior to the policy load. */
5475         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5476         spin_lock(&sb_lock);
5477         spin_lock(&sb_security_lock);
5478 next_sb:
5479         if (!list_empty(&superblock_security_head)) {
5480                 struct superblock_security_struct *sbsec =
5481                                 list_entry(superblock_security_head.next,
5482                                            struct superblock_security_struct,
5483                                            list);
5484                 struct super_block *sb = sbsec->sb;
5485                 sb->s_count++;
5486                 spin_unlock(&sb_security_lock);
5487                 spin_unlock(&sb_lock);
5488                 down_read(&sb->s_umount);
5489                 if (sb->s_root)
5490                         superblock_doinit(sb, NULL);
5491                 drop_super(sb);
5492                 spin_lock(&sb_lock);
5493                 spin_lock(&sb_security_lock);
5494                 list_del_init(&sbsec->list);
5495                 goto next_sb;
5496         }
5497         spin_unlock(&sb_security_lock);
5498         spin_unlock(&sb_lock);
5499 }
5500
5501 /* SELinux requires early initialization in order to label
5502    all processes and objects when they are created. */
5503 security_initcall(selinux_init);
5504
5505 #if defined(CONFIG_NETFILTER)
5506
5507 static struct nf_hook_ops selinux_ipv4_ops[] = {
5508         {
5509                 .hook =         selinux_ipv4_postroute,
5510                 .owner =        THIS_MODULE,
5511                 .pf =           PF_INET,
5512                 .hooknum =      NF_INET_POST_ROUTING,
5513                 .priority =     NF_IP_PRI_SELINUX_LAST,
5514         },
5515         {
5516                 .hook =         selinux_ipv4_forward,
5517                 .owner =        THIS_MODULE,
5518                 .pf =           PF_INET,
5519                 .hooknum =      NF_INET_FORWARD,
5520                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5521         }
5522 };
5523
5524 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5525
5526 static struct nf_hook_ops selinux_ipv6_ops[] = {
5527         {
5528                 .hook =         selinux_ipv6_postroute,
5529                 .owner =        THIS_MODULE,
5530                 .pf =           PF_INET6,
5531                 .hooknum =      NF_INET_POST_ROUTING,
5532                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5533         },
5534         {
5535                 .hook =         selinux_ipv6_forward,
5536                 .owner =        THIS_MODULE,
5537                 .pf =           PF_INET6,
5538                 .hooknum =      NF_INET_FORWARD,
5539                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5540         }
5541 };
5542
5543 #endif  /* IPV6 */
5544
5545 static int __init selinux_nf_ip_init(void)
5546 {
5547         int err = 0;
5548         u32 iter;
5549
5550         if (!selinux_enabled)
5551                 goto out;
5552
5553         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5554
5555         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5556                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5557                 if (err)
5558                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5559                               err);
5560         }
5561
5562 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5563         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5564                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5565                 if (err)
5566                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5567                               err);
5568         }
5569 #endif  /* IPV6 */
5570
5571 out:
5572         return err;
5573 }
5574
5575 __initcall(selinux_nf_ip_init);
5576
5577 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5578 static void selinux_nf_ip_exit(void)
5579 {
5580         u32 iter;
5581
5582         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5583
5584         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5585                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5586 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5587         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5588                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5589 #endif  /* IPV6 */
5590 }
5591 #endif
5592
5593 #else /* CONFIG_NETFILTER */
5594
5595 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5596 #define selinux_nf_ip_exit()
5597 #endif
5598
5599 #endif /* CONFIG_NETFILTER */
5600
5601 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5602 int selinux_disable(void)
5603 {
5604         extern void exit_sel_fs(void);
5605         static int selinux_disabled = 0;
5606
5607         if (ss_initialized) {
5608                 /* Not permitted after initial policy load. */
5609                 return -EINVAL;
5610         }
5611
5612         if (selinux_disabled) {
5613                 /* Only do this once. */
5614                 return -EINVAL;
5615         }
5616
5617         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5618
5619         selinux_disabled = 1;
5620         selinux_enabled = 0;
5621
5622         /* Reset security_ops to the secondary module, dummy or capability. */
5623         security_ops = secondary_ops;
5624
5625         /* Unregister netfilter hooks. */
5626         selinux_nf_ip_exit();
5627
5628         /* Unregister selinuxfs. */
5629         exit_sel_fs();
5630
5631         return 0;
5632 }
5633 #endif
5634
5635