security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 407                 /* Special handling. Genfs but also in-core setxattr handler */
 408                 !strcmp(sb->s_type->name, "sysfs") ||
 409                 !strcmp(sb->s_type->name, "pstore") ||
 410                 !strcmp(sb->s_type->name, "debugfs") ||
 411                 !strcmp(sb->s_type->name, "rootfs");
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = d_backing_inode(root);
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450
 451         sbsec->flags |= SE_SBINITIALIZED;
 452         if (selinux_is_sblabel_mnt(sb))
 453                 sbsec->flags |= SBLABEL_MNT;
 454
 455         /* Initialize the root inode. */
 456         rc = inode_doinit_with_dentry(root_inode, root);
 457
 458         /* Initialize any other inodes associated with the superblock, e.g.
 459            inodes created prior to initial policy load or inodes created
 460            during get_sb by a pseudo filesystem that directly
 461            populates itself. */
 462         spin_lock(&sbsec->isec_lock);
 463 next_inode:
 464         if (!list_empty(&sbsec->isec_head)) {
 465                 struct inode_security_struct *isec =
 466                                 list_entry(sbsec->isec_head.next,
 467                                            struct inode_security_struct, list);
 468                 struct inode *inode = isec->inode;
 469                 list_del_init(&isec->list);
 470                 spin_unlock(&sbsec->isec_lock);
 471                 inode = igrab(inode);
 472                 if (inode) {
 473                         if (!IS_PRIVATE(inode))
 474                                 inode_doinit(inode);
 475                         iput(inode);
 476                 }
 477                 spin_lock(&sbsec->isec_lock);
 478                 goto next_inode;
 479         }
 480         spin_unlock(&sbsec->isec_lock);
 481 out:
 482         return rc;
 483 }
 484
 485 /*
 486  * This function should allow an FS to ask what it's mount security
 487  * options were so it can use those later for submounts, displaying
 488  * mount options, or whatever.
 489  */
 490 static int selinux_get_mnt_opts(const struct super_block *sb,
 491                                 struct security_mnt_opts *opts)
 492 {
 493         int rc = 0, i;
 494         struct superblock_security_struct *sbsec = sb->s_security;
 495         char *context = NULL;
 496         u32 len;
 497         char tmp;
 498
 499         security_init_mnt_opts(opts);
 500
 501         if (!(sbsec->flags & SE_SBINITIALIZED))
 502                 return -EINVAL;
 503
 504         if (!ss_initialized)
 505                 return -EINVAL;
 506
 507         /* make sure we always check enough bits to cover the mask */
 508         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 509
 510         tmp = sbsec->flags & SE_MNTMASK;
 511         /* count the number of mount options for this sb */
 512         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 513                 if (tmp & 0x01)
 514                         opts->num_mnt_opts++;
 515                 tmp >>= 1;
 516         }
 517         /* Check if the Label support flag is set */
 518         if (sbsec->flags & SBLABEL_MNT)
 519                 opts->num_mnt_opts++;
 520
 521         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 522         if (!opts->mnt_opts) {
 523                 rc = -ENOMEM;
 524                 goto out_free;
 525         }
 526
 527         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 528         if (!opts->mnt_opts_flags) {
 529                 rc = -ENOMEM;
 530                 goto out_free;
 531         }
 532
 533         i = 0;
 534         if (sbsec->flags & FSCONTEXT_MNT) {
 535                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 536                 if (rc)
 537                         goto out_free;
 538                 opts->mnt_opts[i] = context;
 539                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 540         }
 541         if (sbsec->flags & CONTEXT_MNT) {
 542                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 543                 if (rc)
 544                         goto out_free;
 545                 opts->mnt_opts[i] = context;
 546                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 547         }
 548         if (sbsec->flags & DEFCONTEXT_MNT) {
 549                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 550                 if (rc)
 551                         goto out_free;
 552                 opts->mnt_opts[i] = context;
 553                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 554         }
 555         if (sbsec->flags & ROOTCONTEXT_MNT) {
 556                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 557                 struct inode_security_struct *isec = root->i_security;
 558
 559                 rc = security_sid_to_context(isec->sid, &context, &len);
 560                 if (rc)
 561                         goto out_free;
 562                 opts->mnt_opts[i] = context;
 563                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 564         }
 565         if (sbsec->flags & SBLABEL_MNT) {
 566                 opts->mnt_opts[i] = NULL;
 567                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 568         }
 569
 570         BUG_ON(i != opts->num_mnt_opts);
 571
 572         return 0;
 573
 574 out_free:
 575         security_free_mnt_opts(opts);
 576         return rc;
 577 }
 578
 579 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 580                       u32 old_sid, u32 new_sid)
 581 {
 582         char mnt_flags = sbsec->flags & SE_MNTMASK;
 583
 584         /* check if the old mount command had the same options */
 585         if (sbsec->flags & SE_SBINITIALIZED)
 586                 if (!(sbsec->flags & flag) ||
 587                     (old_sid != new_sid))
 588                         return 1;
 589
 590         /* check if we were passed the same options twice,
 591          * aka someone passed context=a,context=b
 592          */
 593         if (!(sbsec->flags & SE_SBINITIALIZED))
 594                 if (mnt_flags & flag)
 595                         return 1;
 596         return 0;
 597 }
 598
 599 /*
 600  * Allow filesystems with binary mount data to explicitly set mount point
 601  * labeling information.
 602  */
 603 static int selinux_set_mnt_opts(struct super_block *sb,
 604                                 struct security_mnt_opts *opts,
 605                                 unsigned long kern_flags,
 606                                 unsigned long *set_kern_flags)
 607 {
 608         const struct cred *cred = current_cred();
 609         int rc = 0, i;
 610         struct superblock_security_struct *sbsec = sb->s_security;
 611         const char *name = sb->s_type->name;
 612         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 613         struct inode_security_struct *root_isec = inode->i_security;
 614         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 615         u32 defcontext_sid = 0;
 616         char **mount_options = opts->mnt_opts;
 617         int *flags = opts->mnt_opts_flags;
 618         int num_opts = opts->num_mnt_opts;
 619
 620         mutex_lock(&sbsec->lock);
 621
 622         if (!ss_initialized) {
 623                 if (!num_opts) {
 624                         /* Defer initialization until selinux_complete_init,
 625                            after the initial policy is loaded and the security
 626                            server is ready to handle calls. */
 627                         goto out;
 628                 }
 629                 rc = -EINVAL;
 630                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 631                         "before the security server is initialized\n");
 632                 goto out;
 633         }
 634         if (kern_flags && !set_kern_flags) {
 635                 /* Specifying internal flags without providing a place to
 636                  * place the results is not allowed */
 637                 rc = -EINVAL;
 638                 goto out;
 639         }
 640
 641         /*
 642          * Binary mount data FS will come through this function twice.  Once
 643          * from an explicit call and once from the generic calls from the vfs.
 644          * Since the generic VFS calls will not contain any security mount data
 645          * we need to skip the double mount verification.
 646          *
 647          * This does open a hole in which we will not notice if the first
 648          * mount using this sb set explict options and a second mount using
 649          * this sb does not set any security options.  (The first options
 650          * will be used for both mounts)
 651          */
 652         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 653             && (num_opts == 0))
 654                 goto out;
 655
 656         /*
 657          * parse the mount options, check if they are valid sids.
 658          * also check if someone is trying to mount the same sb more
 659          * than once with different security options.
 660          */
 661         for (i = 0; i < num_opts; i++) {
 662                 u32 sid;
 663
 664                 if (flags[i] == SBLABEL_MNT)
 665                         continue;
 666                 rc = security_context_to_sid(mount_options[i],
 667                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 668                 if (rc) {
 669                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 670                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 671                                mount_options[i], sb->s_id, name, rc);
 672                         goto out;
 673                 }
 674                 switch (flags[i]) {
 675                 case FSCONTEXT_MNT:
 676                         fscontext_sid = sid;
 677
 678                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 679                                         fscontext_sid))
 680                                 goto out_double_mount;
 681
 682                         sbsec->flags |= FSCONTEXT_MNT;
 683                         break;
 684                 case CONTEXT_MNT:
 685                         context_sid = sid;
 686
 687                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 688                                         context_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= CONTEXT_MNT;
 692                         break;
 693                 case ROOTCONTEXT_MNT:
 694                         rootcontext_sid = sid;
 695
 696                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 697                                         rootcontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= ROOTCONTEXT_MNT;
 701
 702                         break;
 703                 case DEFCONTEXT_MNT:
 704                         defcontext_sid = sid;
 705
 706                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 707                                         defcontext_sid))
 708                                 goto out_double_mount;
 709
 710                         sbsec->flags |= DEFCONTEXT_MNT;
 711
 712                         break;
 713                 default:
 714                         rc = -EINVAL;
 715                         goto out;
 716                 }
 717         }
 718
 719         if (sbsec->flags & SE_SBINITIALIZED) {
 720                 /* previously mounted with options, but not on this attempt? */
 721                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 722                         goto out_double_mount;
 723                 rc = 0;
 724                 goto out;
 725         }
 726
 727         if (strcmp(sb->s_type->name, "proc") == 0)
 728                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 729
 730         if (!strcmp(sb->s_type->name, "debugfs") ||
 731             !strcmp(sb->s_type->name, "sysfs") ||
 732             !strcmp(sb->s_type->name, "pstore"))
 733                 sbsec->flags |= SE_SBGENFS;
 734
 735         if (!sbsec->behavior) {
 736                 /*
 737                  * Determine the labeling behavior to use for this
 738                  * filesystem type.
 739                  */
 740                 rc = security_fs_use(sb);
 741                 if (rc) {
 742                         printk(KERN_WARNING
 743                                 "%s: security_fs_use(%s) returned %d\n",
 744                                         __func__, sb->s_type->name, rc);
 745                         goto out;
 746                 }
 747         }
 748         /* sets the context of the superblock for the fs being mounted. */
 749         if (fscontext_sid) {
 750                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 751                 if (rc)
 752                         goto out;
 753
 754                 sbsec->sid = fscontext_sid;
 755         }
 756
 757         /*
 758          * Switch to using mount point labeling behavior.
 759          * sets the label used on all file below the mountpoint, and will set
 760          * the superblock context if not already set.
 761          */
 762         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 763                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 764                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 765         }
 766
 767         if (context_sid) {
 768                 if (!fscontext_sid) {
 769                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 770                                                           cred);
 771                         if (rc)
 772                                 goto out;
 773                         sbsec->sid = context_sid;
 774                 } else {
 775                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 776                                                              cred);
 777                         if (rc)
 778                                 goto out;
 779                 }
 780                 if (!rootcontext_sid)
 781                         rootcontext_sid = context_sid;
 782
 783                 sbsec->mntpoint_sid = context_sid;
 784                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 785         }
 786
 787         if (rootcontext_sid) {
 788                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 789                                                      cred);
 790                 if (rc)
 791                         goto out;
 792
 793                 root_isec->sid = rootcontext_sid;
 794                 root_isec->initialized = 1;
 795         }
 796
 797         if (defcontext_sid) {
 798                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 799                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 800                         rc = -EINVAL;
 801                         printk(KERN_WARNING "SELinux: defcontext option is "
 802                                "invalid for this filesystem type\n");
 803                         goto out;
 804                 }
 805
 806                 if (defcontext_sid != sbsec->def_sid) {
 807                         rc = may_context_mount_inode_relabel(defcontext_sid,
 808                                                              sbsec, cred);
 809                         if (rc)
 810                                 goto out;
 811                 }
 812
 813                 sbsec->def_sid = defcontext_sid;
 814         }
 815
 816         rc = sb_finish_set_opts(sb);
 817 out:
 818         mutex_unlock(&sbsec->lock);
 819         return rc;
 820 out_double_mount:
 821         rc = -EINVAL;
 822         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 823                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 824         goto out;
 825 }
 826
 827 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 828                                     const struct super_block *newsb)
 829 {
 830         struct superblock_security_struct *old = oldsb->s_security;
 831         struct superblock_security_struct *new = newsb->s_security;
 832         char oldflags = old->flags & SE_MNTMASK;
 833         char newflags = new->flags & SE_MNTMASK;
 834
 835         if (oldflags != newflags)
 836                 goto mismatch;
 837         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 838                 goto mismatch;
 839         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 840                 goto mismatch;
 841         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 842                 goto mismatch;
 843         if (oldflags & ROOTCONTEXT_MNT) {
 844                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 845                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 846                 if (oldroot->sid != newroot->sid)
 847                         goto mismatch;
 848         }
 849         return 0;
 850 mismatch:
 851         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 852                             "different security settings for (dev %s, "
 853                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 854         return -EBUSY;
 855 }
 856
 857 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 858                                         struct super_block *newsb)
 859 {
 860         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 861         struct superblock_security_struct *newsbsec = newsb->s_security;
 862
 863         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 864         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 865         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 866
 867         /*
 868          * if the parent was able to be mounted it clearly had no special lsm
 869          * mount options.  thus we can safely deal with this superblock later
 870          */
 871         if (!ss_initialized)
 872                 return 0;
 873
 874         /* how can we clone if the old one wasn't set up?? */
 875         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 876
 877         /* if fs is reusing a sb, make sure that the contexts match */
 878         if (newsbsec->flags & SE_SBINITIALIZED)
 879                 return selinux_cmp_sb_context(oldsb, newsb);
 880
 881         mutex_lock(&newsbsec->lock);
 882
 883         newsbsec->flags = oldsbsec->flags;
 884
 885         newsbsec->sid = oldsbsec->sid;
 886         newsbsec->def_sid = oldsbsec->def_sid;
 887         newsbsec->behavior = oldsbsec->behavior;
 888
 889         if (set_context) {
 890                 u32 sid = oldsbsec->mntpoint_sid;
 891
 892                 if (!set_fscontext)
 893                         newsbsec->sid = sid;
 894                 if (!set_rootcontext) {
 895                         struct inode *newinode = d_backing_inode(newsb->s_root);
 896                         struct inode_security_struct *newisec = newinode->i_security;
 897                         newisec->sid = sid;
 898                 }
 899                 newsbsec->mntpoint_sid = sid;
 900         }
 901         if (set_rootcontext) {
 902                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 903                 const struct inode_security_struct *oldisec = oldinode->i_security;
 904                 struct inode *newinode = d_backing_inode(newsb->s_root);
 905                 struct inode_security_struct *newisec = newinode->i_security;
 906
 907                 newisec->sid = oldisec->sid;
 908         }
 909
 910         sb_finish_set_opts(newsb);
 911         mutex_unlock(&newsbsec->lock);
 912         return 0;
 913 }
 914
 915 static int selinux_parse_opts_str(char *options,
 916                                   struct security_mnt_opts *opts)
 917 {
 918         char *p;
 919         char *context = NULL, *defcontext = NULL;
 920         char *fscontext = NULL, *rootcontext = NULL;
 921         int rc, num_mnt_opts = 0;
 922
 923         opts->num_mnt_opts = 0;
 924
 925         /* Standard string-based options. */
 926         while ((p = strsep(&options, "|")) != NULL) {
 927                 int token;
 928                 substring_t args[MAX_OPT_ARGS];
 929
 930                 if (!*p)
 931                         continue;
 932
 933                 token = match_token(p, tokens, args);
 934
 935                 switch (token) {
 936                 case Opt_context:
 937                         if (context || defcontext) {
 938                                 rc = -EINVAL;
 939                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 940                                 goto out_err;
 941                         }
 942                         context = match_strdup(&args[0]);
 943                         if (!context) {
 944                                 rc = -ENOMEM;
 945                                 goto out_err;
 946                         }
 947                         break;
 948
 949                 case Opt_fscontext:
 950                         if (fscontext) {
 951                                 rc = -EINVAL;
 952                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 953                                 goto out_err;
 954                         }
 955                         fscontext = match_strdup(&args[0]);
 956                         if (!fscontext) {
 957                                 rc = -ENOMEM;
 958                                 goto out_err;
 959                         }
 960                         break;
 961
 962                 case Opt_rootcontext:
 963                         if (rootcontext) {
 964                                 rc = -EINVAL;
 965                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 966                                 goto out_err;
 967                         }
 968                         rootcontext = match_strdup(&args[0]);
 969                         if (!rootcontext) {
 970                                 rc = -ENOMEM;
 971                                 goto out_err;
 972                         }
 973                         break;
 974
 975                 case Opt_defcontext:
 976                         if (context || defcontext) {
 977                                 rc = -EINVAL;
 978                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 979                                 goto out_err;
 980                         }
 981                         defcontext = match_strdup(&args[0]);
 982                         if (!defcontext) {
 983                                 rc = -ENOMEM;
 984                                 goto out_err;
 985                         }
 986                         break;
 987                 case Opt_labelsupport:
 988                         break;
 989                 default:
 990                         rc = -EINVAL;
 991                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 992                         goto out_err;
 993
 994                 }
 995         }
 996
 997         rc = -ENOMEM;
 998         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 999         if (!opts->mnt_opts)
1000                 goto out_err;
1001
1002         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1003         if (!opts->mnt_opts_flags) {
1004                 kfree(opts->mnt_opts);
1005                 goto out_err;
1006         }
1007
1008         if (fscontext) {
1009                 opts->mnt_opts[num_mnt_opts] = fscontext;
1010                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1011         }
1012         if (context) {
1013                 opts->mnt_opts[num_mnt_opts] = context;
1014                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1015         }
1016         if (rootcontext) {
1017                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1018                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1019         }
1020         if (defcontext) {
1021                 opts->mnt_opts[num_mnt_opts] = defcontext;
1022                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1023         }
1024
1025         opts->num_mnt_opts = num_mnt_opts;
1026         return 0;
1027
1028 out_err:
1029         kfree(context);
1030         kfree(defcontext);
1031         kfree(fscontext);
1032         kfree(rootcontext);
1033         return rc;
1034 }
1035 /*
1036  * string mount options parsing and call set the sbsec
1037  */
1038 static int superblock_doinit(struct super_block *sb, void *data)
1039 {
1040         int rc = 0;
1041         char *options = data;
1042         struct security_mnt_opts opts;
1043
1044         security_init_mnt_opts(&opts);
1045
1046         if (!data)
1047                 goto out;
1048
1049         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1050
1051         rc = selinux_parse_opts_str(options, &opts);
1052         if (rc)
1053                 goto out_err;
1054
1055 out:
1056         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1057
1058 out_err:
1059         security_free_mnt_opts(&opts);
1060         return rc;
1061 }
1062
1063 static void selinux_write_opts(struct seq_file *m,
1064                                struct security_mnt_opts *opts)
1065 {
1066         int i;
1067         char *prefix;
1068
1069         for (i = 0; i < opts->num_mnt_opts; i++) {
1070                 char *has_comma;
1071
1072                 if (opts->mnt_opts[i])
1073                         has_comma = strchr(opts->mnt_opts[i], ',');
1074                 else
1075                         has_comma = NULL;
1076
1077                 switch (opts->mnt_opts_flags[i]) {
1078                 case CONTEXT_MNT:
1079                         prefix = CONTEXT_STR;
1080                         break;
1081                 case FSCONTEXT_MNT:
1082                         prefix = FSCONTEXT_STR;
1083                         break;
1084                 case ROOTCONTEXT_MNT:
1085                         prefix = ROOTCONTEXT_STR;
1086                         break;
1087                 case DEFCONTEXT_MNT:
1088                         prefix = DEFCONTEXT_STR;
1089                         break;
1090                 case SBLABEL_MNT:
1091                         seq_putc(m, ',');
1092                         seq_puts(m, LABELSUPP_STR);
1093                         continue;
1094                 default:
1095                         BUG();
1096                         return;
1097                 };
1098                 /* we need a comma before each option */
1099                 seq_putc(m, ',');
1100                 seq_puts(m, prefix);
1101                 if (has_comma)
1102                         seq_putc(m, '\"');
1103                 seq_puts(m, opts->mnt_opts[i]);
1104                 if (has_comma)
1105                         seq_putc(m, '\"');
1106         }
1107 }
1108
1109 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1110 {
1111         struct security_mnt_opts opts;
1112         int rc;
1113
1114         rc = selinux_get_mnt_opts(sb, &opts);
1115         if (rc) {
1116                 /* before policy load we may get EINVAL, don't show anything */
1117                 if (rc == -EINVAL)
1118                         rc = 0;
1119                 return rc;
1120         }
1121
1122         selinux_write_opts(m, &opts);
1123
1124         security_free_mnt_opts(&opts);
1125
1126         return rc;
1127 }
1128
1129 static inline u16 inode_mode_to_security_class(umode_t mode)
1130 {
1131         switch (mode & S_IFMT) {
1132         case S_IFSOCK:
1133                 return SECCLASS_SOCK_FILE;
1134         case S_IFLNK:
1135                 return SECCLASS_LNK_FILE;
1136         case S_IFREG:
1137                 return SECCLASS_FILE;
1138         case S_IFBLK:
1139                 return SECCLASS_BLK_FILE;
1140         case S_IFDIR:
1141                 return SECCLASS_DIR;
1142         case S_IFCHR:
1143                 return SECCLASS_CHR_FILE;
1144         case S_IFIFO:
1145                 return SECCLASS_FIFO_FILE;
1146
1147         }
1148
1149         return SECCLASS_FILE;
1150 }
1151
1152 static inline int default_protocol_stream(int protocol)
1153 {
1154         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1155 }
1156
1157 static inline int default_protocol_dgram(int protocol)
1158 {
1159         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1160 }
1161
1162 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1163 {
1164         switch (family) {
1165         case PF_UNIX:
1166                 switch (type) {
1167                 case SOCK_STREAM:
1168                 case SOCK_SEQPACKET:
1169                         return SECCLASS_UNIX_STREAM_SOCKET;
1170                 case SOCK_DGRAM:
1171                         return SECCLASS_UNIX_DGRAM_SOCKET;
1172                 }
1173                 break;
1174         case PF_INET:
1175         case PF_INET6:
1176                 switch (type) {
1177                 case SOCK_STREAM:
1178                         if (default_protocol_stream(protocol))
1179                                 return SECCLASS_TCP_SOCKET;
1180                         else
1181                                 return SECCLASS_RAWIP_SOCKET;
1182                 case SOCK_DGRAM:
1183                         if (default_protocol_dgram(protocol))
1184                                 return SECCLASS_UDP_SOCKET;
1185                         else
1186                                 return SECCLASS_RAWIP_SOCKET;
1187                 case SOCK_DCCP:
1188                         return SECCLASS_DCCP_SOCKET;
1189                 default:
1190                         return SECCLASS_RAWIP_SOCKET;
1191                 }
1192                 break;
1193         case PF_NETLINK:
1194                 switch (protocol) {
1195                 case NETLINK_ROUTE:
1196                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1197                 case NETLINK_SOCK_DIAG:
1198                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1199                 case NETLINK_NFLOG:
1200                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1201                 case NETLINK_XFRM:
1202                         return SECCLASS_NETLINK_XFRM_SOCKET;
1203                 case NETLINK_SELINUX:
1204                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1205                 case NETLINK_ISCSI:
1206                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1207                 case NETLINK_AUDIT:
1208                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1209                 case NETLINK_FIB_LOOKUP:
1210                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1211                 case NETLINK_CONNECTOR:
1212                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1213                 case NETLINK_NETFILTER:
1214                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1215                 case NETLINK_DNRTMSG:
1216                         return SECCLASS_NETLINK_DNRT_SOCKET;
1217                 case NETLINK_KOBJECT_UEVENT:
1218                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1219                 case NETLINK_GENERIC:
1220                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1221                 case NETLINK_SCSITRANSPORT:
1222                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1223                 case NETLINK_RDMA:
1224                         return SECCLASS_NETLINK_RDMA_SOCKET;
1225                 case NETLINK_CRYPTO:
1226                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1227                 default:
1228                         return SECCLASS_NETLINK_SOCKET;
1229                 }
1230         case PF_PACKET:
1231                 return SECCLASS_PACKET_SOCKET;
1232         case PF_KEY:
1233                 return SECCLASS_KEY_SOCKET;
1234         case PF_APPLETALK:
1235                 return SECCLASS_APPLETALK_SOCKET;
1236         }
1237
1238         return SECCLASS_SOCKET;
1239 }
1240
1241 static int selinux_genfs_get_sid(struct dentry *dentry,
1242                                  u16 tclass,
1243                                  u16 flags,
1244                                  u32 *sid)
1245 {
1246         int rc;
1247         struct super_block *sb = dentry->d_inode->i_sb;
1248         char *buffer, *path;
1249
1250         buffer = (char *)__get_free_page(GFP_KERNEL);
1251         if (!buffer)
1252                 return -ENOMEM;
1253
1254         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1255         if (IS_ERR(path))
1256                 rc = PTR_ERR(path);
1257         else {
1258                 if (flags & SE_SBPROC) {
1259                         /* each process gets a /proc/PID/ entry. Strip off the
1260                          * PID part to get a valid selinux labeling.
1261                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1262                         while (path[1] >= '0' && path[1] <= '9') {
1263                                 path[1] = '/';
1264                                 path++;
1265                         }
1266                 }
1267                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1268         }
1269         free_page((unsigned long)buffer);
1270         return rc;
1271 }
1272
1273 /* The inode's security attributes must be initialized before first use. */
1274 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1275 {
1276         struct superblock_security_struct *sbsec = NULL;
1277         struct inode_security_struct *isec = inode->i_security;
1278         u32 sid;
1279         struct dentry *dentry;
1280 #define INITCONTEXTLEN 255
1281         char *context = NULL;
1282         unsigned len = 0;
1283         int rc = 0;
1284
1285         if (isec->initialized)
1286                 goto out;
1287
1288         mutex_lock(&isec->lock);
1289         if (isec->initialized)
1290                 goto out_unlock;
1291
1292         sbsec = inode->i_sb->s_security;
1293         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1294                 /* Defer initialization until selinux_complete_init,
1295                    after the initial policy is loaded and the security
1296                    server is ready to handle calls. */
1297                 spin_lock(&sbsec->isec_lock);
1298                 if (list_empty(&isec->list))
1299                         list_add(&isec->list, &sbsec->isec_head);
1300                 spin_unlock(&sbsec->isec_lock);
1301                 goto out_unlock;
1302         }
1303
1304         switch (sbsec->behavior) {
1305         case SECURITY_FS_USE_NATIVE:
1306                 break;
1307         case SECURITY_FS_USE_XATTR:
1308                 if (!inode->i_op->getxattr) {
1309                         isec->sid = sbsec->def_sid;
1310                         break;
1311                 }
1312
1313                 /* Need a dentry, since the xattr API requires one.
1314                    Life would be simpler if we could just pass the inode. */
1315                 if (opt_dentry) {
1316                         /* Called from d_instantiate or d_splice_alias. */
1317                         dentry = dget(opt_dentry);
1318                 } else {
1319                         /* Called from selinux_complete_init, try to find a dentry. */
1320                         dentry = d_find_alias(inode);
1321                 }
1322                 if (!dentry) {
1323                         /*
1324                          * this is can be hit on boot when a file is accessed
1325                          * before the policy is loaded.  When we load policy we
1326                          * may find inodes that have no dentry on the
1327                          * sbsec->isec_head list.  No reason to complain as these
1328                          * will get fixed up the next time we go through
1329                          * inode_doinit with a dentry, before these inodes could
1330                          * be used again by userspace.
1331                          */
1332                         goto out_unlock;
1333                 }
1334
1335                 len = INITCONTEXTLEN;
1336                 context = kmalloc(len+1, GFP_NOFS);
1337                 if (!context) {
1338                         rc = -ENOMEM;
1339                         dput(dentry);
1340                         goto out_unlock;
1341                 }
1342                 context[len] = '\0';
1343                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1344                                            context, len);
1345                 if (rc == -ERANGE) {
1346                         kfree(context);
1347
1348                         /* Need a larger buffer.  Query for the right size. */
1349                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1350                                                    NULL, 0);
1351                         if (rc < 0) {
1352                                 dput(dentry);
1353                                 goto out_unlock;
1354                         }
1355                         len = rc;
1356                         context = kmalloc(len+1, GFP_NOFS);
1357                         if (!context) {
1358                                 rc = -ENOMEM;
1359                                 dput(dentry);
1360                                 goto out_unlock;
1361                         }
1362                         context[len] = '\0';
1363                         rc = inode->i_op->getxattr(dentry,
1364                                                    XATTR_NAME_SELINUX,
1365                                                    context, len);
1366                 }
1367                 dput(dentry);
1368                 if (rc < 0) {
1369                         if (rc != -ENODATA) {
1370                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1371                                        "%d for dev=%s ino=%ld\n", __func__,
1372                                        -rc, inode->i_sb->s_id, inode->i_ino);
1373                                 kfree(context);
1374                                 goto out_unlock;
1375                         }
1376                         /* Map ENODATA to the default file SID */
1377                         sid = sbsec->def_sid;
1378                         rc = 0;
1379                 } else {
1380                         rc = security_context_to_sid_default(context, rc, &sid,
1381                                                              sbsec->def_sid,
1382                                                              GFP_NOFS);
1383                         if (rc) {
1384                                 char *dev = inode->i_sb->s_id;
1385                                 unsigned long ino = inode->i_ino;
1386
1387                                 if (rc == -EINVAL) {
1388                                         if (printk_ratelimit())
1389                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1390                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1391                                                         "filesystem in question.\n", ino, dev, context);
1392                                 } else {
1393                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1394                                                "returned %d for dev=%s ino=%ld\n",
1395                                                __func__, context, -rc, dev, ino);
1396                                 }
1397                                 kfree(context);
1398                                 /* Leave with the unlabeled SID */
1399                                 rc = 0;
1400                                 break;
1401                         }
1402                 }
1403                 kfree(context);
1404                 isec->sid = sid;
1405                 break;
1406         case SECURITY_FS_USE_TASK:
1407                 isec->sid = isec->task_sid;
1408                 break;
1409         case SECURITY_FS_USE_TRANS:
1410                 /* Default to the fs SID. */
1411                 isec->sid = sbsec->sid;
1412
1413                 /* Try to obtain a transition SID. */
1414                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1415                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1416                                              isec->sclass, NULL, &sid);
1417                 if (rc)
1418                         goto out_unlock;
1419                 isec->sid = sid;
1420                 break;
1421         case SECURITY_FS_USE_MNTPOINT:
1422                 isec->sid = sbsec->mntpoint_sid;
1423                 break;
1424         default:
1425                 /* Default to the fs superblock SID. */
1426                 isec->sid = sbsec->sid;
1427
1428                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1429                         /* We must have a dentry to determine the label on
1430                          * procfs inodes */
1431                         if (opt_dentry)
1432                                 /* Called from d_instantiate or
1433                                  * d_splice_alias. */
1434                                 dentry = dget(opt_dentry);
1435                         else
1436                                 /* Called from selinux_complete_init, try to
1437                                  * find a dentry. */
1438                                 dentry = d_find_alias(inode);
1439                         /*
1440                          * This can be hit on boot when a file is accessed
1441                          * before the policy is loaded.  When we load policy we
1442                          * may find inodes that have no dentry on the
1443                          * sbsec->isec_head list.  No reason to complain as
1444                          * these will get fixed up the next time we go through
1445                          * inode_doinit() with a dentry, before these inodes
1446                          * could be used again by userspace.
1447                          */
1448                         if (!dentry)
1449                                 goto out_unlock;
1450                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1451                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1452                                                    sbsec->flags, &sid);
1453                         dput(dentry);
1454                         if (rc)
1455                                 goto out_unlock;
1456                         isec->sid = sid;
1457                 }
1458                 break;
1459         }
1460
1461         isec->initialized = 1;
1462
1463 out_unlock:
1464         mutex_unlock(&isec->lock);
1465 out:
1466         if (isec->sclass == SECCLASS_FILE)
1467                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1468         return rc;
1469 }
1470
1471 /* Convert a Linux signal to an access vector. */
1472 static inline u32 signal_to_av(int sig)
1473 {
1474         u32 perm = 0;
1475
1476         switch (sig) {
1477         case SIGCHLD:
1478                 /* Commonly granted from child to parent. */
1479                 perm = PROCESS__SIGCHLD;
1480                 break;
1481         case SIGKILL:
1482                 /* Cannot be caught or ignored */
1483                 perm = PROCESS__SIGKILL;
1484                 break;
1485         case SIGSTOP:
1486                 /* Cannot be caught or ignored */
1487                 perm = PROCESS__SIGSTOP;
1488                 break;
1489         default:
1490                 /* All other signals. */
1491                 perm = PROCESS__SIGNAL;
1492                 break;
1493         }
1494
1495         return perm;
1496 }
1497
1498 /*
1499  * Check permission between a pair of credentials
1500  * fork check, ptrace check, etc.
1501  */
1502 static int cred_has_perm(const struct cred *actor,
1503                          const struct cred *target,
1504                          u32 perms)
1505 {
1506         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1507
1508         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1509 }
1510
1511 /*
1512  * Check permission between a pair of tasks, e.g. signal checks,
1513  * fork check, ptrace check, etc.
1514  * tsk1 is the actor and tsk2 is the target
1515  * - this uses the default subjective creds of tsk1
1516  */
1517 static int task_has_perm(const struct task_struct *tsk1,
1518                          const struct task_struct *tsk2,
1519                          u32 perms)
1520 {
1521         const struct task_security_struct *__tsec1, *__tsec2;
1522         u32 sid1, sid2;
1523
1524         rcu_read_lock();
1525         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1526         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1527         rcu_read_unlock();
1528         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1529 }
1530
1531 /*
1532  * Check permission between current and another task, e.g. signal checks,
1533  * fork check, ptrace check, etc.
1534  * current is the actor and tsk2 is the target
1535  * - this uses current's subjective creds
1536  */
1537 static int current_has_perm(const struct task_struct *tsk,
1538                             u32 perms)
1539 {
1540         u32 sid, tsid;
1541
1542         sid = current_sid();
1543         tsid = task_sid(tsk);
1544         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1545 }
1546
1547 #if CAP_LAST_CAP > 63
1548 #error Fix SELinux to handle capabilities > 63.
1549 #endif
1550
1551 /* Check whether a task is allowed to use a capability. */
1552 static int cred_has_capability(const struct cred *cred,
1553                                int cap, int audit)
1554 {
1555         struct common_audit_data ad;
1556         struct av_decision avd;
1557         u16 sclass;
1558         u32 sid = cred_sid(cred);
1559         u32 av = CAP_TO_MASK(cap);
1560         int rc;
1561
1562         ad.type = LSM_AUDIT_DATA_CAP;
1563         ad.u.cap = cap;
1564
1565         switch (CAP_TO_INDEX(cap)) {
1566         case 0:
1567                 sclass = SECCLASS_CAPABILITY;
1568                 break;
1569         case 1:
1570                 sclass = SECCLASS_CAPABILITY2;
1571                 break;
1572         default:
1573                 printk(KERN_ERR
1574                        "SELinux:  out of range capability %d\n", cap);
1575                 BUG();
1576                 return -EINVAL;
1577         }
1578
1579         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1580         if (audit == SECURITY_CAP_AUDIT) {
1581                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1582                 if (rc2)
1583                         return rc2;
1584         }
1585         return rc;
1586 }
1587
1588 /* Check whether a task is allowed to use a system operation. */
1589 static int task_has_system(struct task_struct *tsk,
1590                            u32 perms)
1591 {
1592         u32 sid = task_sid(tsk);
1593
1594         return avc_has_perm(sid, SECINITSID_KERNEL,
1595                             SECCLASS_SYSTEM, perms, NULL);
1596 }
1597
1598 /* Check whether a task has a particular permission to an inode.
1599    The 'adp' parameter is optional and allows other audit
1600    data to be passed (e.g. the dentry). */
1601 static int inode_has_perm(const struct cred *cred,
1602                           struct inode *inode,
1603                           u32 perms,
1604                           struct common_audit_data *adp)
1605 {
1606         struct inode_security_struct *isec;
1607         u32 sid;
1608
1609         validate_creds(cred);
1610
1611         if (unlikely(IS_PRIVATE(inode)))
1612                 return 0;
1613
1614         sid = cred_sid(cred);
1615         isec = inode->i_security;
1616
1617         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1618 }
1619
1620 /* Same as inode_has_perm, but pass explicit audit data containing
1621    the dentry to help the auditing code to more easily generate the
1622    pathname if needed. */
1623 static inline int dentry_has_perm(const struct cred *cred,
1624                                   struct dentry *dentry,
1625                                   u32 av)
1626 {
1627         struct inode *inode = d_backing_inode(dentry);
1628         struct common_audit_data ad;
1629
1630         ad.type = LSM_AUDIT_DATA_DENTRY;
1631         ad.u.dentry = dentry;
1632         return inode_has_perm(cred, inode, av, &ad);
1633 }
1634
1635 /* Same as inode_has_perm, but pass explicit audit data containing
1636    the path to help the auditing code to more easily generate the
1637    pathname if needed. */
1638 static inline int path_has_perm(const struct cred *cred,
1639                                 const struct path *path,
1640                                 u32 av)
1641 {
1642         struct inode *inode = d_backing_inode(path->dentry);
1643         struct common_audit_data ad;
1644
1645         ad.type = LSM_AUDIT_DATA_PATH;
1646         ad.u.path = *path;
1647         return inode_has_perm(cred, inode, av, &ad);
1648 }
1649
1650 /* Same as path_has_perm, but uses the inode from the file struct. */
1651 static inline int file_path_has_perm(const struct cred *cred,
1652                                      struct file *file,
1653                                      u32 av)
1654 {
1655         struct common_audit_data ad;
1656
1657         ad.type = LSM_AUDIT_DATA_PATH;
1658         ad.u.path = file->f_path;
1659         return inode_has_perm(cred, file_inode(file), av, &ad);
1660 }
1661
1662 /* Check whether a task can use an open file descriptor to
1663    access an inode in a given way.  Check access to the
1664    descriptor itself, and then use dentry_has_perm to
1665    check a particular permission to the file.
1666    Access to the descriptor is implicitly granted if it
1667    has the same SID as the process.  If av is zero, then
1668    access to the file is not checked, e.g. for cases
1669    where only the descriptor is affected like seek. */
1670 static int file_has_perm(const struct cred *cred,
1671                          struct file *file,
1672                          u32 av)
1673 {
1674         struct file_security_struct *fsec = file->f_security;
1675         struct inode *inode = file_inode(file);
1676         struct common_audit_data ad;
1677         u32 sid = cred_sid(cred);
1678         int rc;
1679
1680         ad.type = LSM_AUDIT_DATA_PATH;
1681         ad.u.path = file->f_path;
1682
1683         if (sid != fsec->sid) {
1684                 rc = avc_has_perm(sid, fsec->sid,
1685                                   SECCLASS_FD,
1686                                   FD__USE,
1687                                   &ad);
1688                 if (rc)
1689                         goto out;
1690         }
1691
1692         /* av is zero if only checking access to the descriptor. */
1693         rc = 0;
1694         if (av)
1695                 rc = inode_has_perm(cred, inode, av, &ad);
1696
1697 out:
1698         return rc;
1699 }
1700
1701 /* Check whether a task can create a file. */
1702 static int may_create(struct inode *dir,
1703                       struct dentry *dentry,
1704                       u16 tclass)
1705 {
1706         const struct task_security_struct *tsec = current_security();
1707         struct inode_security_struct *dsec;
1708         struct superblock_security_struct *sbsec;
1709         u32 sid, newsid;
1710         struct common_audit_data ad;
1711         int rc;
1712
1713         dsec = dir->i_security;
1714         sbsec = dir->i_sb->s_security;
1715
1716         sid = tsec->sid;
1717         newsid = tsec->create_sid;
1718
1719         ad.type = LSM_AUDIT_DATA_DENTRY;
1720         ad.u.dentry = dentry;
1721
1722         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1723                           DIR__ADD_NAME | DIR__SEARCH,
1724                           &ad);
1725         if (rc)
1726                 return rc;
1727
1728         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1729                 rc = security_transition_sid(sid, dsec->sid, tclass,
1730                                              &dentry->d_name, &newsid);
1731                 if (rc)
1732                         return rc;
1733         }
1734
1735         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1736         if (rc)
1737                 return rc;
1738
1739         return avc_has_perm(newsid, sbsec->sid,
1740                             SECCLASS_FILESYSTEM,
1741                             FILESYSTEM__ASSOCIATE, &ad);
1742 }
1743
1744 /* Check whether a task can create a key. */
1745 static int may_create_key(u32 ksid,
1746                           struct task_struct *ctx)
1747 {
1748         u32 sid = task_sid(ctx);
1749
1750         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1751 }
1752
1753 #define MAY_LINK        0
1754 #define MAY_UNLINK      1
1755 #define MAY_RMDIR       2
1756
1757 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1758 static int may_link(struct inode *dir,
1759                     struct dentry *dentry,
1760                     int kind)
1761
1762 {
1763         struct inode_security_struct *dsec, *isec;
1764         struct common_audit_data ad;
1765         u32 sid = current_sid();
1766         u32 av;
1767         int rc;
1768
1769         dsec = dir->i_security;
1770         isec = d_backing_inode(dentry)->i_security;
1771
1772         ad.type = LSM_AUDIT_DATA_DENTRY;
1773         ad.u.dentry = dentry;
1774
1775         av = DIR__SEARCH;
1776         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1777         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1778         if (rc)
1779                 return rc;
1780
1781         switch (kind) {
1782         case MAY_LINK:
1783                 av = FILE__LINK;
1784                 break;
1785         case MAY_UNLINK:
1786                 av = FILE__UNLINK;
1787                 break;
1788         case MAY_RMDIR:
1789                 av = DIR__RMDIR;
1790                 break;
1791         default:
1792                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1793                         __func__, kind);
1794                 return 0;
1795         }
1796
1797         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1798         return rc;
1799 }
1800
1801 static inline int may_rename(struct inode *old_dir,
1802                              struct dentry *old_dentry,
1803                              struct inode *new_dir,
1804                              struct dentry *new_dentry)
1805 {
1806         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1807         struct common_audit_data ad;
1808         u32 sid = current_sid();
1809         u32 av;
1810         int old_is_dir, new_is_dir;
1811         int rc;
1812
1813         old_dsec = old_dir->i_security;
1814         old_isec = d_backing_inode(old_dentry)->i_security;
1815         old_is_dir = d_is_dir(old_dentry);
1816         new_dsec = new_dir->i_security;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819
1820         ad.u.dentry = old_dentry;
1821         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1822                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1823         if (rc)
1824                 return rc;
1825         rc = avc_has_perm(sid, old_isec->sid,
1826                           old_isec->sclass, FILE__RENAME, &ad);
1827         if (rc)
1828                 return rc;
1829         if (old_is_dir && new_dir != old_dir) {
1830                 rc = avc_has_perm(sid, old_isec->sid,
1831                                   old_isec->sclass, DIR__REPARENT, &ad);
1832                 if (rc)
1833                         return rc;
1834         }
1835
1836         ad.u.dentry = new_dentry;
1837         av = DIR__ADD_NAME | DIR__SEARCH;
1838         if (d_is_positive(new_dentry))
1839                 av |= DIR__REMOVE_NAME;
1840         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1841         if (rc)
1842                 return rc;
1843         if (d_is_positive(new_dentry)) {
1844                 new_isec = d_backing_inode(new_dentry)->i_security;
1845                 new_is_dir = d_is_dir(new_dentry);
1846                 rc = avc_has_perm(sid, new_isec->sid,
1847                                   new_isec->sclass,
1848                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1849                 if (rc)
1850                         return rc;
1851         }
1852
1853         return 0;
1854 }
1855
1856 /* Check whether a task can perform a filesystem operation. */
1857 static int superblock_has_perm(const struct cred *cred,
1858                                struct super_block *sb,
1859                                u32 perms,
1860                                struct common_audit_data *ad)
1861 {
1862         struct superblock_security_struct *sbsec;
1863         u32 sid = cred_sid(cred);
1864
1865         sbsec = sb->s_security;
1866         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1867 }
1868
1869 /* Convert a Linux mode and permission mask to an access vector. */
1870 static inline u32 file_mask_to_av(int mode, int mask)
1871 {
1872         u32 av = 0;
1873
1874         if (!S_ISDIR(mode)) {
1875                 if (mask & MAY_EXEC)
1876                         av |= FILE__EXECUTE;
1877                 if (mask & MAY_READ)
1878                         av |= FILE__READ;
1879
1880                 if (mask & MAY_APPEND)
1881                         av |= FILE__APPEND;
1882                 else if (mask & MAY_WRITE)
1883                         av |= FILE__WRITE;
1884
1885         } else {
1886                 if (mask & MAY_EXEC)
1887                         av |= DIR__SEARCH;
1888                 if (mask & MAY_WRITE)
1889                         av |= DIR__WRITE;
1890                 if (mask & MAY_READ)
1891                         av |= DIR__READ;
1892         }
1893
1894         return av;
1895 }
1896
1897 /* Convert a Linux file to an access vector. */
1898 static inline u32 file_to_av(struct file *file)
1899 {
1900         u32 av = 0;
1901
1902         if (file->f_mode & FMODE_READ)
1903                 av |= FILE__READ;
1904         if (file->f_mode & FMODE_WRITE) {
1905                 if (file->f_flags & O_APPEND)
1906                         av |= FILE__APPEND;
1907                 else
1908                         av |= FILE__WRITE;
1909         }
1910         if (!av) {
1911                 /*
1912                  * Special file opened with flags 3 for ioctl-only use.
1913                  */
1914                 av = FILE__IOCTL;
1915         }
1916
1917         return av;
1918 }
1919
1920 /*
1921  * Convert a file to an access vector and include the correct open
1922  * open permission.
1923  */
1924 static inline u32 open_file_to_av(struct file *file)
1925 {
1926         u32 av = file_to_av(file);
1927
1928         if (selinux_policycap_openperm)
1929                 av |= FILE__OPEN;
1930
1931         return av;
1932 }
1933
1934 /* Hook functions begin here. */
1935
1936 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1937 {
1938         u32 mysid = current_sid();
1939         u32 mgrsid = task_sid(mgr);
1940
1941         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1942                             BINDER__SET_CONTEXT_MGR, NULL);
1943 }
1944
1945 static int selinux_binder_transaction(struct task_struct *from,
1946                                       struct task_struct *to)
1947 {
1948         u32 mysid = current_sid();
1949         u32 fromsid = task_sid(from);
1950         u32 tosid = task_sid(to);
1951         int rc;
1952
1953         if (mysid != fromsid) {
1954                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1955                                   BINDER__IMPERSONATE, NULL);
1956                 if (rc)
1957                         return rc;
1958         }
1959
1960         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1961                             NULL);
1962 }
1963
1964 static int selinux_binder_transfer_binder(struct task_struct *from,
1965                                           struct task_struct *to)
1966 {
1967         u32 fromsid = task_sid(from);
1968         u32 tosid = task_sid(to);
1969
1970         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1971                             NULL);
1972 }
1973
1974 static int selinux_binder_transfer_file(struct task_struct *from,
1975                                         struct task_struct *to,
1976                                         struct file *file)
1977 {
1978         u32 sid = task_sid(to);
1979         struct file_security_struct *fsec = file->f_security;
1980         struct inode *inode = d_backing_inode(file->f_path.dentry);
1981         struct inode_security_struct *isec = inode->i_security;
1982         struct common_audit_data ad;
1983         int rc;
1984
1985         ad.type = LSM_AUDIT_DATA_PATH;
1986         ad.u.path = file->f_path;
1987
1988         if (sid != fsec->sid) {
1989                 rc = avc_has_perm(sid, fsec->sid,
1990                                   SECCLASS_FD,
1991                                   FD__USE,
1992                                   &ad);
1993                 if (rc)
1994                         return rc;
1995         }
1996
1997         if (unlikely(IS_PRIVATE(inode)))
1998                 return 0;
1999
2000         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2001                             &ad);
2002 }
2003
2004 static int selinux_ptrace_access_check(struct task_struct *child,
2005                                      unsigned int mode)
2006 {
2007         if (mode & PTRACE_MODE_READ) {
2008                 u32 sid = current_sid();
2009                 u32 csid = task_sid(child);
2010                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2011         }
2012
2013         return current_has_perm(child, PROCESS__PTRACE);
2014 }
2015
2016 static int selinux_ptrace_traceme(struct task_struct *parent)
2017 {
2018         return task_has_perm(parent, current, PROCESS__PTRACE);
2019 }
2020
2021 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2022                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2023 {
2024         return current_has_perm(target, PROCESS__GETCAP);
2025 }
2026
2027 static int selinux_capset(struct cred *new, const struct cred *old,
2028                           const kernel_cap_t *effective,
2029                           const kernel_cap_t *inheritable,
2030                           const kernel_cap_t *permitted)
2031 {
2032         return cred_has_perm(old, new, PROCESS__SETCAP);
2033 }
2034
2035 /*
2036  * (This comment used to live with the selinux_task_setuid hook,
2037  * which was removed).
2038  *
2039  * Since setuid only affects the current process, and since the SELinux
2040  * controls are not based on the Linux identity attributes, SELinux does not
2041  * need to control this operation.  However, SELinux does control the use of
2042  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2043  */
2044
2045 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2046                            int cap, int audit)
2047 {
2048         return cred_has_capability(cred, cap, audit);
2049 }
2050
2051 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2052 {
2053         const struct cred *cred = current_cred();
2054         int rc = 0;
2055
2056         if (!sb)
2057                 return 0;
2058
2059         switch (cmds) {
2060         case Q_SYNC:
2061         case Q_QUOTAON:
2062         case Q_QUOTAOFF:
2063         case Q_SETINFO:
2064         case Q_SETQUOTA:
2065                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2066                 break;
2067         case Q_GETFMT:
2068         case Q_GETINFO:
2069         case Q_GETQUOTA:
2070                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2071                 break;
2072         default:
2073                 rc = 0;  /* let the kernel handle invalid cmds */
2074                 break;
2075         }
2076         return rc;
2077 }
2078
2079 static int selinux_quota_on(struct dentry *dentry)
2080 {
2081         const struct cred *cred = current_cred();
2082
2083         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2084 }
2085
2086 static int selinux_syslog(int type)
2087 {
2088         int rc;
2089
2090         switch (type) {
2091         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2092         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2093                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2094                 break;
2095         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2096         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2097         /* Set level of messages printed to console */
2098         case SYSLOG_ACTION_CONSOLE_LEVEL:
2099                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2100                 break;
2101         case SYSLOG_ACTION_CLOSE:       /* Close log */
2102         case SYSLOG_ACTION_OPEN:        /* Open log */
2103         case SYSLOG_ACTION_READ:        /* Read from log */
2104         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2105         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2106         default:
2107                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2108                 break;
2109         }
2110         return rc;
2111 }
2112
2113 /*
2114  * Check that a process has enough memory to allocate a new virtual
2115  * mapping. 0 means there is enough memory for the allocation to
2116  * succeed and -ENOMEM implies there is not.
2117  *
2118  * Do not audit the selinux permission check, as this is applied to all
2119  * processes that allocate mappings.
2120  */
2121 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2122 {
2123         int rc, cap_sys_admin = 0;
2124
2125         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2126                                         SECURITY_CAP_NOAUDIT);
2127         if (rc == 0)
2128                 cap_sys_admin = 1;
2129
2130         return cap_sys_admin;
2131 }
2132
2133 /* binprm security operations */
2134
2135 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2136                             const struct task_security_struct *old_tsec,
2137                             const struct task_security_struct *new_tsec)
2138 {
2139         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2140         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2141         int rc;
2142
2143         if (!nnp && !nosuid)
2144                 return 0; /* neither NNP nor nosuid */
2145
2146         if (new_tsec->sid == old_tsec->sid)
2147                 return 0; /* No change in credentials */
2148
2149         /*
2150          * The only transitions we permit under NNP or nosuid
2151          * are transitions to bounded SIDs, i.e. SIDs that are
2152          * guaranteed to only be allowed a subset of the permissions
2153          * of the current SID.
2154          */
2155         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2156         if (rc) {
2157                 /*
2158                  * On failure, preserve the errno values for NNP vs nosuid.
2159                  * NNP:  Operation not permitted for caller.
2160                  * nosuid:  Permission denied to file.
2161                  */
2162                 if (nnp)
2163                         return -EPERM;
2164                 else
2165                         return -EACCES;
2166         }
2167         return 0;
2168 }
2169
2170 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2171 {
2172         const struct task_security_struct *old_tsec;
2173         struct task_security_struct *new_tsec;
2174         struct inode_security_struct *isec;
2175         struct common_audit_data ad;
2176         struct inode *inode = file_inode(bprm->file);
2177         int rc;
2178
2179         /* SELinux context only depends on initial program or script and not
2180          * the script interpreter */
2181         if (bprm->cred_prepared)
2182                 return 0;
2183
2184         old_tsec = current_security();
2185         new_tsec = bprm->cred->security;
2186         isec = inode->i_security;
2187
2188         /* Default to the current task SID. */
2189         new_tsec->sid = old_tsec->sid;
2190         new_tsec->osid = old_tsec->sid;
2191
2192         /* Reset fs, key, and sock SIDs on execve. */
2193         new_tsec->create_sid = 0;
2194         new_tsec->keycreate_sid = 0;
2195         new_tsec->sockcreate_sid = 0;
2196
2197         if (old_tsec->exec_sid) {
2198                 new_tsec->sid = old_tsec->exec_sid;
2199                 /* Reset exec SID on execve. */
2200                 new_tsec->exec_sid = 0;
2201
2202                 /* Fail on NNP or nosuid if not an allowed transition. */
2203                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2204                 if (rc)
2205                         return rc;
2206         } else {
2207                 /* Check for a default transition on this program. */
2208                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2209                                              SECCLASS_PROCESS, NULL,
2210                                              &new_tsec->sid);
2211                 if (rc)
2212                         return rc;
2213
2214                 /*
2215                  * Fallback to old SID on NNP or nosuid if not an allowed
2216                  * transition.
2217                  */
2218                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2219                 if (rc)
2220                         new_tsec->sid = old_tsec->sid;
2221         }
2222
2223         ad.type = LSM_AUDIT_DATA_PATH;
2224         ad.u.path = bprm->file->f_path;
2225
2226         if (new_tsec->sid == old_tsec->sid) {
2227                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2228                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2229                 if (rc)
2230                         return rc;
2231         } else {
2232                 /* Check permissions for the transition. */
2233                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2234                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2235                 if (rc)
2236                         return rc;
2237
2238                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2239                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2240                 if (rc)
2241                         return rc;
2242
2243                 /* Check for shared state */
2244                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2245                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2246                                           SECCLASS_PROCESS, PROCESS__SHARE,
2247                                           NULL);
2248                         if (rc)
2249                                 return -EPERM;
2250                 }
2251
2252                 /* Make sure that anyone attempting to ptrace over a task that
2253                  * changes its SID has the appropriate permit */
2254                 if (bprm->unsafe &
2255                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2256                         struct task_struct *tracer;
2257                         struct task_security_struct *sec;
2258                         u32 ptsid = 0;
2259
2260                         rcu_read_lock();
2261                         tracer = ptrace_parent(current);
2262                         if (likely(tracer != NULL)) {
2263                                 sec = __task_cred(tracer)->security;
2264                                 ptsid = sec->sid;
2265                         }
2266                         rcu_read_unlock();
2267
2268                         if (ptsid != 0) {
2269                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2270                                                   SECCLASS_PROCESS,
2271                                                   PROCESS__PTRACE, NULL);
2272                                 if (rc)
2273                                         return -EPERM;
2274                         }
2275                 }
2276
2277                 /* Clear any possibly unsafe personality bits on exec: */
2278                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2279         }
2280
2281         return 0;
2282 }
2283
2284 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2285 {
2286         const struct task_security_struct *tsec = current_security();
2287         u32 sid, osid;
2288         int atsecure = 0;
2289
2290         sid = tsec->sid;
2291         osid = tsec->osid;
2292
2293         if (osid != sid) {
2294                 /* Enable secure mode for SIDs transitions unless
2295                    the noatsecure permission is granted between
2296                    the two SIDs, i.e. ahp returns 0. */
2297                 atsecure = avc_has_perm(osid, sid,
2298                                         SECCLASS_PROCESS,
2299                                         PROCESS__NOATSECURE, NULL);
2300         }
2301
2302         return !!atsecure;
2303 }
2304
2305 static int match_file(const void *p, struct file *file, unsigned fd)
2306 {
2307         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2308 }
2309
2310 /* Derived from fs/exec.c:flush_old_files. */
2311 static inline void flush_unauthorized_files(const struct cred *cred,
2312                                             struct files_struct *files)
2313 {
2314         struct file *file, *devnull = NULL;
2315         struct tty_struct *tty;
2316         int drop_tty = 0;
2317         unsigned n;
2318
2319         tty = get_current_tty();
2320         if (tty) {
2321                 spin_lock(&tty_files_lock);
2322                 if (!list_empty(&tty->tty_files)) {
2323                         struct tty_file_private *file_priv;
2324
2325                         /* Revalidate access to controlling tty.
2326                            Use file_path_has_perm on the tty path directly
2327                            rather than using file_has_perm, as this particular
2328                            open file may belong to another process and we are
2329                            only interested in the inode-based check here. */
2330                         file_priv = list_first_entry(&tty->tty_files,
2331                                                 struct tty_file_private, list);
2332                         file = file_priv->file;
2333                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2334                                 drop_tty = 1;
2335                 }
2336                 spin_unlock(&tty_files_lock);
2337                 tty_kref_put(tty);
2338         }
2339         /* Reset controlling tty. */
2340         if (drop_tty)
2341                 no_tty();
2342
2343         /* Revalidate access to inherited open files. */
2344         n = iterate_fd(files, 0, match_file, cred);
2345         if (!n) /* none found? */
2346                 return;
2347
2348         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2349         if (IS_ERR(devnull))
2350                 devnull = NULL;
2351         /* replace all the matching ones with this */
2352         do {
2353                 replace_fd(n - 1, devnull, 0);
2354         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2355         if (devnull)
2356                 fput(devnull);
2357 }
2358
2359 /*
2360  * Prepare a process for imminent new credential changes due to exec
2361  */
2362 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2363 {
2364         struct task_security_struct *new_tsec;
2365         struct rlimit *rlim, *initrlim;
2366         int rc, i;
2367
2368         new_tsec = bprm->cred->security;
2369         if (new_tsec->sid == new_tsec->osid)
2370                 return;
2371
2372         /* Close files for which the new task SID is not authorized. */
2373         flush_unauthorized_files(bprm->cred, current->files);
2374
2375         /* Always clear parent death signal on SID transitions. */
2376         current->pdeath_signal = 0;
2377
2378         /* Check whether the new SID can inherit resource limits from the old
2379          * SID.  If not, reset all soft limits to the lower of the current
2380          * task's hard limit and the init task's soft limit.
2381          *
2382          * Note that the setting of hard limits (even to lower them) can be
2383          * controlled by the setrlimit check.  The inclusion of the init task's
2384          * soft limit into the computation is to avoid resetting soft limits
2385          * higher than the default soft limit for cases where the default is
2386          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2387          */
2388         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2389                           PROCESS__RLIMITINH, NULL);
2390         if (rc) {
2391                 /* protect against do_prlimit() */
2392                 task_lock(current);
2393                 for (i = 0; i < RLIM_NLIMITS; i++) {
2394                         rlim = current->signal->rlim + i;
2395                         initrlim = init_task.signal->rlim + i;
2396                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2397                 }
2398                 task_unlock(current);
2399                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2400         }
2401 }
2402
2403 /*
2404  * Clean up the process immediately after the installation of new credentials
2405  * due to exec
2406  */
2407 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2408 {
2409         const struct task_security_struct *tsec = current_security();
2410         struct itimerval itimer;
2411         u32 osid, sid;
2412         int rc, i;
2413
2414         osid = tsec->osid;
2415         sid = tsec->sid;
2416
2417         if (sid == osid)
2418                 return;
2419
2420         /* Check whether the new SID can inherit signal state from the old SID.
2421          * If not, clear itimers to avoid subsequent signal generation and
2422          * flush and unblock signals.
2423          *
2424          * This must occur _after_ the task SID has been updated so that any
2425          * kill done after the flush will be checked against the new SID.
2426          */
2427         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2428         if (rc) {
2429                 memset(&itimer, 0, sizeof itimer);
2430                 for (i = 0; i < 3; i++)
2431                         do_setitimer(i, &itimer, NULL);
2432                 spin_lock_irq(&current->sighand->siglock);
2433                 if (!fatal_signal_pending(current)) {
2434                         flush_sigqueue(&current->pending);
2435                         flush_sigqueue(&current->signal->shared_pending);
2436                         flush_signal_handlers(current, 1);
2437                         sigemptyset(&current->blocked);
2438                         recalc_sigpending();
2439                 }
2440                 spin_unlock_irq(&current->sighand->siglock);
2441         }
2442
2443         /* Wake up the parent if it is waiting so that it can recheck
2444          * wait permission to the new task SID. */
2445         read_lock(&tasklist_lock);
2446         __wake_up_parent(current, current->real_parent);
2447         read_unlock(&tasklist_lock);
2448 }
2449
2450 /* superblock security operations */
2451
2452 static int selinux_sb_alloc_security(struct super_block *sb)
2453 {
2454         return superblock_alloc_security(sb);
2455 }
2456
2457 static void selinux_sb_free_security(struct super_block *sb)
2458 {
2459         superblock_free_security(sb);
2460 }
2461
2462 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2463 {
2464         if (plen > olen)
2465                 return 0;
2466
2467         return !memcmp(prefix, option, plen);
2468 }
2469
2470 static inline int selinux_option(char *option, int len)
2471 {
2472         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2473                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2474                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2475                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2476                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2477 }
2478
2479 static inline void take_option(char **to, char *from, int *first, int len)
2480 {
2481         if (!*first) {
2482                 **to = ',';
2483                 *to += 1;
2484         } else
2485                 *first = 0;
2486         memcpy(*to, from, len);
2487         *to += len;
2488 }
2489
2490 static inline void take_selinux_option(char **to, char *from, int *first,
2491                                        int len)
2492 {
2493         int current_size = 0;
2494
2495         if (!*first) {
2496                 **to = '|';
2497                 *to += 1;
2498         } else
2499                 *first = 0;
2500
2501         while (current_size < len) {
2502                 if (*from != '"') {
2503                         **to = *from;
2504                         *to += 1;
2505                 }
2506                 from += 1;
2507                 current_size += 1;
2508         }
2509 }
2510
2511 static int selinux_sb_copy_data(char *orig, char *copy)
2512 {
2513         int fnosec, fsec, rc = 0;
2514         char *in_save, *in_curr, *in_end;
2515         char *sec_curr, *nosec_save, *nosec;
2516         int open_quote = 0;
2517
2518         in_curr = orig;
2519         sec_curr = copy;
2520
2521         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2522         if (!nosec) {
2523                 rc = -ENOMEM;
2524                 goto out;
2525         }
2526
2527         nosec_save = nosec;
2528         fnosec = fsec = 1;
2529         in_save = in_end = orig;
2530
2531         do {
2532                 if (*in_end == '"')
2533                         open_quote = !open_quote;
2534                 if ((*in_end == ',' && open_quote == 0) ||
2535                                 *in_end == '\0') {
2536                         int len = in_end - in_curr;
2537
2538                         if (selinux_option(in_curr, len))
2539                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2540                         else
2541                                 take_option(&nosec, in_curr, &fnosec, len);
2542
2543                         in_curr = in_end + 1;
2544                 }
2545         } while (*in_end++);
2546
2547         strcpy(in_save, nosec_save);
2548         free_page((unsigned long)nosec_save);
2549 out:
2550         return rc;
2551 }
2552
2553 static int selinux_sb_remount(struct super_block *sb, void *data)
2554 {
2555         int rc, i, *flags;
2556         struct security_mnt_opts opts;
2557         char *secdata, **mount_options;
2558         struct superblock_security_struct *sbsec = sb->s_security;
2559
2560         if (!(sbsec->flags & SE_SBINITIALIZED))
2561                 return 0;
2562
2563         if (!data)
2564                 return 0;
2565
2566         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2567                 return 0;
2568
2569         security_init_mnt_opts(&opts);
2570         secdata = alloc_secdata();
2571         if (!secdata)
2572                 return -ENOMEM;
2573         rc = selinux_sb_copy_data(data, secdata);
2574         if (rc)
2575                 goto out_free_secdata;
2576
2577         rc = selinux_parse_opts_str(secdata, &opts);
2578         if (rc)
2579                 goto out_free_secdata;
2580
2581         mount_options = opts.mnt_opts;
2582         flags = opts.mnt_opts_flags;
2583
2584         for (i = 0; i < opts.num_mnt_opts; i++) {
2585                 u32 sid;
2586                 size_t len;
2587
2588                 if (flags[i] == SBLABEL_MNT)
2589                         continue;
2590                 len = strlen(mount_options[i]);
2591                 rc = security_context_to_sid(mount_options[i], len, &sid,
2592                                              GFP_KERNEL);
2593                 if (rc) {
2594                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2595                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2596                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2597                         goto out_free_opts;
2598                 }
2599                 rc = -EINVAL;
2600                 switch (flags[i]) {
2601                 case FSCONTEXT_MNT:
2602                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2603                                 goto out_bad_option;
2604                         break;
2605                 case CONTEXT_MNT:
2606                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2607                                 goto out_bad_option;
2608                         break;
2609                 case ROOTCONTEXT_MNT: {
2610                         struct inode_security_struct *root_isec;
2611                         root_isec = d_backing_inode(sb->s_root)->i_security;
2612
2613                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2614                                 goto out_bad_option;
2615                         break;
2616                 }
2617                 case DEFCONTEXT_MNT:
2618                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2619                                 goto out_bad_option;
2620                         break;
2621                 default:
2622                         goto out_free_opts;
2623                 }
2624         }
2625
2626         rc = 0;
2627 out_free_opts:
2628         security_free_mnt_opts(&opts);
2629 out_free_secdata:
2630         free_secdata(secdata);
2631         return rc;
2632 out_bad_option:
2633         printk(KERN_WARNING "SELinux: unable to change security options "
2634                "during remount (dev %s, type=%s)\n", sb->s_id,
2635                sb->s_type->name);
2636         goto out_free_opts;
2637 }
2638
2639 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2640 {
2641         const struct cred *cred = current_cred();
2642         struct common_audit_data ad;
2643         int rc;
2644
2645         rc = superblock_doinit(sb, data);
2646         if (rc)
2647                 return rc;
2648
2649         /* Allow all mounts performed by the kernel */
2650         if (flags & MS_KERNMOUNT)
2651                 return 0;
2652
2653         ad.type = LSM_AUDIT_DATA_DENTRY;
2654         ad.u.dentry = sb->s_root;
2655         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2656 }
2657
2658 static int selinux_sb_statfs(struct dentry *dentry)
2659 {
2660         const struct cred *cred = current_cred();
2661         struct common_audit_data ad;
2662
2663         ad.type = LSM_AUDIT_DATA_DENTRY;
2664         ad.u.dentry = dentry->d_sb->s_root;
2665         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2666 }
2667
2668 static int selinux_mount(const char *dev_name,
2669                          struct path *path,
2670                          const char *type,
2671                          unsigned long flags,
2672                          void *data)
2673 {
2674         const struct cred *cred = current_cred();
2675
2676         if (flags & MS_REMOUNT)
2677                 return superblock_has_perm(cred, path->dentry->d_sb,
2678                                            FILESYSTEM__REMOUNT, NULL);
2679         else
2680                 return path_has_perm(cred, path, FILE__MOUNTON);
2681 }
2682
2683 static int selinux_umount(struct vfsmount *mnt, int flags)
2684 {
2685         const struct cred *cred = current_cred();
2686
2687         return superblock_has_perm(cred, mnt->mnt_sb,
2688                                    FILESYSTEM__UNMOUNT, NULL);
2689 }
2690
2691 /* inode security operations */
2692
2693 static int selinux_inode_alloc_security(struct inode *inode)
2694 {
2695         return inode_alloc_security(inode);
2696 }
2697
2698 static void selinux_inode_free_security(struct inode *inode)
2699 {
2700         inode_free_security(inode);
2701 }
2702
2703 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2704                                         struct qstr *name, void **ctx,
2705                                         u32 *ctxlen)
2706 {
2707         const struct cred *cred = current_cred();
2708         struct task_security_struct *tsec;
2709         struct inode_security_struct *dsec;
2710         struct superblock_security_struct *sbsec;
2711         struct inode *dir = d_backing_inode(dentry->d_parent);
2712         u32 newsid;
2713         int rc;
2714
2715         tsec = cred->security;
2716         dsec = dir->i_security;
2717         sbsec = dir->i_sb->s_security;
2718
2719         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2720                 newsid = tsec->create_sid;
2721         } else {
2722                 rc = security_transition_sid(tsec->sid, dsec->sid,
2723                                              inode_mode_to_security_class(mode),
2724                                              name,
2725                                              &newsid);
2726                 if (rc) {
2727                         printk(KERN_WARNING
2728                                 "%s: security_transition_sid failed, rc=%d\n",
2729                                __func__, -rc);
2730                         return rc;
2731                 }
2732         }
2733
2734         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2735 }
2736
2737 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2738                                        const struct qstr *qstr,
2739                                        const char **name,
2740                                        void **value, size_t *len)
2741 {
2742         const struct task_security_struct *tsec = current_security();
2743         struct inode_security_struct *dsec;
2744         struct superblock_security_struct *sbsec;
2745         u32 sid, newsid, clen;
2746         int rc;
2747         char *context;
2748
2749         dsec = dir->i_security;
2750         sbsec = dir->i_sb->s_security;
2751
2752         sid = tsec->sid;
2753         newsid = tsec->create_sid;
2754
2755         if ((sbsec->flags & SE_SBINITIALIZED) &&
2756             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2757                 newsid = sbsec->mntpoint_sid;
2758         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2759                 rc = security_transition_sid(sid, dsec->sid,
2760                                              inode_mode_to_security_class(inode->i_mode),
2761                                              qstr, &newsid);
2762                 if (rc) {
2763                         printk(KERN_WARNING "%s:  "
2764                                "security_transition_sid failed, rc=%d (dev=%s "
2765                                "ino=%ld)\n",
2766                                __func__,
2767                                -rc, inode->i_sb->s_id, inode->i_ino);
2768                         return rc;
2769                 }
2770         }
2771
2772         /* Possibly defer initialization to selinux_complete_init. */
2773         if (sbsec->flags & SE_SBINITIALIZED) {
2774                 struct inode_security_struct *isec = inode->i_security;
2775                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2776                 isec->sid = newsid;
2777                 isec->initialized = 1;
2778         }
2779
2780         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2781                 return -EOPNOTSUPP;
2782
2783         if (name)
2784                 *name = XATTR_SELINUX_SUFFIX;
2785
2786         if (value && len) {
2787                 rc = security_sid_to_context_force(newsid, &context, &clen);
2788                 if (rc)
2789                         return rc;
2790                 *value = context;
2791                 *len = clen;
2792         }
2793
2794         return 0;
2795 }
2796
2797 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2798 {
2799         return may_create(dir, dentry, SECCLASS_FILE);
2800 }
2801
2802 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2803 {
2804         return may_link(dir, old_dentry, MAY_LINK);
2805 }
2806
2807 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2808 {
2809         return may_link(dir, dentry, MAY_UNLINK);
2810 }
2811
2812 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2813 {
2814         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2815 }
2816
2817 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2818 {
2819         return may_create(dir, dentry, SECCLASS_DIR);
2820 }
2821
2822 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2823 {
2824         return may_link(dir, dentry, MAY_RMDIR);
2825 }
2826
2827 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2828 {
2829         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2830 }
2831
2832 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2833                                 struct inode *new_inode, struct dentry *new_dentry)
2834 {
2835         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2836 }
2837
2838 static int selinux_inode_readlink(struct dentry *dentry)
2839 {
2840         const struct cred *cred = current_cred();
2841
2842         return dentry_has_perm(cred, dentry, FILE__READ);
2843 }
2844
2845 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2846 {
2847         const struct cred *cred = current_cred();
2848
2849         return dentry_has_perm(cred, dentry, FILE__READ);
2850 }
2851
2852 static noinline int audit_inode_permission(struct inode *inode,
2853                                            u32 perms, u32 audited, u32 denied,
2854                                            int result,
2855                                            unsigned flags)
2856 {
2857         struct common_audit_data ad;
2858         struct inode_security_struct *isec = inode->i_security;
2859         int rc;
2860
2861         ad.type = LSM_AUDIT_DATA_INODE;
2862         ad.u.inode = inode;
2863
2864         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2865                             audited, denied, result, &ad, flags);
2866         if (rc)
2867                 return rc;
2868         return 0;
2869 }
2870
2871 static int selinux_inode_permission(struct inode *inode, int mask)
2872 {
2873         const struct cred *cred = current_cred();
2874         u32 perms;
2875         bool from_access;
2876         unsigned flags = mask & MAY_NOT_BLOCK;
2877         struct inode_security_struct *isec;
2878         u32 sid;
2879         struct av_decision avd;
2880         int rc, rc2;
2881         u32 audited, denied;
2882
2883         from_access = mask & MAY_ACCESS;
2884         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2885
2886         /* No permission to check.  Existence test. */
2887         if (!mask)
2888                 return 0;
2889
2890         validate_creds(cred);
2891
2892         if (unlikely(IS_PRIVATE(inode)))
2893                 return 0;
2894
2895         perms = file_mask_to_av(inode->i_mode, mask);
2896
2897         sid = cred_sid(cred);
2898         isec = inode->i_security;
2899
2900         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2901         audited = avc_audit_required(perms, &avd, rc,
2902                                      from_access ? FILE__AUDIT_ACCESS : 0,
2903                                      &denied);
2904         if (likely(!audited))
2905                 return rc;
2906
2907         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2908         if (rc2)
2909                 return rc2;
2910         return rc;
2911 }
2912
2913 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2914 {
2915         const struct cred *cred = current_cred();
2916         unsigned int ia_valid = iattr->ia_valid;
2917         __u32 av = FILE__WRITE;
2918
2919         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2920         if (ia_valid & ATTR_FORCE) {
2921                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2922                               ATTR_FORCE);
2923                 if (!ia_valid)
2924                         return 0;
2925         }
2926
2927         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2928                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2929                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2930
2931         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2932                 av |= FILE__OPEN;
2933
2934         return dentry_has_perm(cred, dentry, av);
2935 }
2936
2937 static int selinux_inode_getattr(const struct path *path)
2938 {
2939         return path_has_perm(current_cred(), path, FILE__GETATTR);
2940 }
2941
2942 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2943 {
2944         const struct cred *cred = current_cred();
2945
2946         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2947                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2948                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2949                         if (!capable(CAP_SETFCAP))
2950                                 return -EPERM;
2951                 } else if (!capable(CAP_SYS_ADMIN)) {
2952                         /* A different attribute in the security namespace.
2953                            Restrict to administrator. */
2954                         return -EPERM;
2955                 }
2956         }
2957
2958         /* Not an attribute we recognize, so just check the
2959            ordinary setattr permission. */
2960         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2961 }
2962
2963 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2964                                   const void *value, size_t size, int flags)
2965 {
2966         struct inode *inode = d_backing_inode(dentry);
2967         struct inode_security_struct *isec = inode->i_security;
2968         struct superblock_security_struct *sbsec;
2969         struct common_audit_data ad;
2970         u32 newsid, sid = current_sid();
2971         int rc = 0;
2972
2973         if (strcmp(name, XATTR_NAME_SELINUX))
2974                 return selinux_inode_setotherxattr(dentry, name);
2975
2976         sbsec = inode->i_sb->s_security;
2977         if (!(sbsec->flags & SBLABEL_MNT))
2978                 return -EOPNOTSUPP;
2979
2980         if (!inode_owner_or_capable(inode))
2981                 return -EPERM;
2982
2983         ad.type = LSM_AUDIT_DATA_DENTRY;
2984         ad.u.dentry = dentry;
2985
2986         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2987                           FILE__RELABELFROM, &ad);
2988         if (rc)
2989                 return rc;
2990
2991         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2992         if (rc == -EINVAL) {
2993                 if (!capable(CAP_MAC_ADMIN)) {
2994                         struct audit_buffer *ab;
2995                         size_t audit_size;
2996                         const char *str;
2997
2998                         /* We strip a nul only if it is at the end, otherwise the
2999                          * context contains a nul and we should audit that */
3000                         if (value) {
3001                                 str = value;
3002                                 if (str[size - 1] == '\0')
3003                                         audit_size = size - 1;
3004                                 else
3005                                         audit_size = size;
3006                         } else {
3007                                 str = "";
3008                                 audit_size = 0;
3009                         }
3010                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3011                         audit_log_format(ab, "op=setxattr invalid_context=");
3012                         audit_log_n_untrustedstring(ab, value, audit_size);
3013                         audit_log_end(ab);
3014
3015                         return rc;
3016                 }
3017                 rc = security_context_to_sid_force(value, size, &newsid);
3018         }
3019         if (rc)
3020                 return rc;
3021
3022         rc = avc_has_perm(sid, newsid, isec->sclass,
3023                           FILE__RELABELTO, &ad);
3024         if (rc)
3025                 return rc;
3026
3027         rc = security_validate_transition(isec->sid, newsid, sid,
3028                                           isec->sclass);
3029         if (rc)
3030                 return rc;
3031
3032         return avc_has_perm(newsid,
3033                             sbsec->sid,
3034                             SECCLASS_FILESYSTEM,
3035                             FILESYSTEM__ASSOCIATE,
3036                             &ad);
3037 }
3038
3039 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3040                                         const void *value, size_t size,
3041                                         int flags)
3042 {
3043         struct inode *inode = d_backing_inode(dentry);
3044         struct inode_security_struct *isec = inode->i_security;
3045         u32 newsid;
3046         int rc;
3047
3048         if (strcmp(name, XATTR_NAME_SELINUX)) {
3049                 /* Not an attribute we recognize, so nothing to do. */
3050                 return;
3051         }
3052
3053         rc = security_context_to_sid_force(value, size, &newsid);
3054         if (rc) {
3055                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3056                        "for (%s, %lu), rc=%d\n",
3057                        inode->i_sb->s_id, inode->i_ino, -rc);
3058                 return;
3059         }
3060
3061         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3062         isec->sid = newsid;
3063         isec->initialized = 1;
3064
3065         return;
3066 }
3067
3068 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3069 {
3070         const struct cred *cred = current_cred();
3071
3072         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3073 }
3074
3075 static int selinux_inode_listxattr(struct dentry *dentry)
3076 {
3077         const struct cred *cred = current_cred();
3078
3079         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3080 }
3081
3082 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3083 {
3084         if (strcmp(name, XATTR_NAME_SELINUX))
3085                 return selinux_inode_setotherxattr(dentry, name);
3086
3087         /* No one is allowed to remove a SELinux security label.
3088            You can change the label, but all data must be labeled. */
3089         return -EACCES;
3090 }
3091
3092 /*
3093  * Copy the inode security context value to the user.
3094  *
3095  * Permission check is handled by selinux_inode_getxattr hook.
3096  */
3097 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3098 {
3099         u32 size;
3100         int error;
3101         char *context = NULL;
3102         struct inode_security_struct *isec = inode->i_security;
3103
3104         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3105                 return -EOPNOTSUPP;
3106
3107         /*
3108          * If the caller has CAP_MAC_ADMIN, then get the raw context
3109          * value even if it is not defined by current policy; otherwise,
3110          * use the in-core value under current policy.
3111          * Use the non-auditing forms of the permission checks since
3112          * getxattr may be called by unprivileged processes commonly
3113          * and lack of permission just means that we fall back to the
3114          * in-core context value, not a denial.
3115          */
3116         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3117                             SECURITY_CAP_NOAUDIT);
3118         if (!error)
3119                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3120                                             SECURITY_CAP_NOAUDIT);
3121         if (!error)
3122                 error = security_sid_to_context_force(isec->sid, &context,
3123                                                       &size);
3124         else
3125                 error = security_sid_to_context(isec->sid, &context, &size);
3126         if (error)
3127                 return error;
3128         error = size;
3129         if (alloc) {
3130                 *buffer = context;
3131                 goto out_nofree;
3132         }
3133         kfree(context);
3134 out_nofree:
3135         return error;
3136 }
3137
3138 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3139                                      const void *value, size_t size, int flags)
3140 {
3141         struct inode_security_struct *isec = inode->i_security;
3142         u32 newsid;
3143         int rc;
3144
3145         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3146                 return -EOPNOTSUPP;
3147
3148         if (!value || !size)
3149                 return -EACCES;
3150
3151         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3152         if (rc)
3153                 return rc;
3154
3155         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3156         isec->sid = newsid;
3157         isec->initialized = 1;
3158         return 0;
3159 }
3160
3161 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3162 {
3163         const int len = sizeof(XATTR_NAME_SELINUX);
3164         if (buffer && len <= buffer_size)
3165                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3166         return len;
3167 }
3168
3169 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3170 {
3171         struct inode_security_struct *isec = inode->i_security;
3172         *secid = isec->sid;
3173 }
3174
3175 /* file security operations */
3176
3177 static int selinux_revalidate_file_permission(struct file *file, int mask)
3178 {
3179         const struct cred *cred = current_cred();
3180         struct inode *inode = file_inode(file);
3181
3182         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3183         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3184                 mask |= MAY_APPEND;
3185
3186         return file_has_perm(cred, file,
3187                              file_mask_to_av(inode->i_mode, mask));
3188 }
3189
3190 static int selinux_file_permission(struct file *file, int mask)
3191 {
3192         struct inode *inode = file_inode(file);
3193         struct file_security_struct *fsec = file->f_security;
3194         struct inode_security_struct *isec = inode->i_security;
3195         u32 sid = current_sid();
3196
3197         if (!mask)
3198                 /* No permission to check.  Existence test. */
3199                 return 0;
3200
3201         if (sid == fsec->sid && fsec->isid == isec->sid &&
3202             fsec->pseqno == avc_policy_seqno())
3203                 /* No change since file_open check. */
3204                 return 0;
3205
3206         return selinux_revalidate_file_permission(file, mask);
3207 }
3208
3209 static int selinux_file_alloc_security(struct file *file)
3210 {
3211         return file_alloc_security(file);
3212 }
3213
3214 static void selinux_file_free_security(struct file *file)
3215 {
3216         file_free_security(file);
3217 }
3218
3219 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3220                               unsigned long arg)
3221 {
3222         const struct cred *cred = current_cred();
3223         int error = 0;
3224
3225         switch (cmd) {
3226         case FIONREAD:
3227         /* fall through */
3228         case FIBMAP:
3229         /* fall through */
3230         case FIGETBSZ:
3231         /* fall through */
3232         case FS_IOC_GETFLAGS:
3233         /* fall through */
3234         case FS_IOC_GETVERSION:
3235                 error = file_has_perm(cred, file, FILE__GETATTR);
3236                 break;
3237
3238         case FS_IOC_SETFLAGS:
3239         /* fall through */
3240         case FS_IOC_SETVERSION:
3241                 error = file_has_perm(cred, file, FILE__SETATTR);
3242                 break;
3243
3244         /* sys_ioctl() checks */
3245         case FIONBIO:
3246         /* fall through */
3247         case FIOASYNC:
3248                 error = file_has_perm(cred, file, 0);
3249                 break;
3250
3251         case KDSKBENT:
3252         case KDSKBSENT:
3253                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3254                                             SECURITY_CAP_AUDIT);
3255                 break;
3256
3257         /* default case assumes that the command will go
3258          * to the file's ioctl() function.
3259          */
3260         default:
3261                 error = file_has_perm(cred, file, FILE__IOCTL);
3262         }
3263         return error;
3264 }
3265
3266 static int default_noexec;
3267
3268 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3269 {
3270         const struct cred *cred = current_cred();
3271         int rc = 0;
3272
3273         if (default_noexec &&
3274             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3275                                    (!shared && (prot & PROT_WRITE)))) {
3276                 /*
3277                  * We are making executable an anonymous mapping or a
3278                  * private file mapping that will also be writable.
3279                  * This has an additional check.
3280                  */
3281                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3282                 if (rc)
3283                         goto error;
3284         }
3285
3286         if (file) {
3287                 /* read access is always possible with a mapping */
3288                 u32 av = FILE__READ;
3289
3290                 /* write access only matters if the mapping is shared */
3291                 if (shared && (prot & PROT_WRITE))
3292                         av |= FILE__WRITE;
3293
3294                 if (prot & PROT_EXEC)
3295                         av |= FILE__EXECUTE;
3296
3297                 return file_has_perm(cred, file, av);
3298         }
3299
3300 error:
3301         return rc;
3302 }
3303
3304 static int selinux_mmap_addr(unsigned long addr)
3305 {
3306         int rc = 0;
3307
3308         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3309                 u32 sid = current_sid();
3310                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3311                                   MEMPROTECT__MMAP_ZERO, NULL);
3312         }
3313
3314         return rc;
3315 }
3316
3317 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3318                              unsigned long prot, unsigned long flags)
3319 {
3320         if (selinux_checkreqprot)
3321                 prot = reqprot;
3322
3323         return file_map_prot_check(file, prot,
3324                                    (flags & MAP_TYPE) == MAP_SHARED);
3325 }
3326
3327 static int selinux_file_mprotect(struct vm_area_struct *vma,
3328                                  unsigned long reqprot,
3329                                  unsigned long prot)
3330 {
3331         const struct cred *cred = current_cred();
3332
3333         if (selinux_checkreqprot)
3334                 prot = reqprot;
3335
3336         if (default_noexec &&
3337             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3338                 int rc = 0;
3339                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3340                     vma->vm_end <= vma->vm_mm->brk) {
3341                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3342                 } else if (!vma->vm_file &&
3343                            vma->vm_start <= vma->vm_mm->start_stack &&
3344                            vma->vm_end >= vma->vm_mm->start_stack) {
3345                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3346                 } else if (vma->vm_file && vma->anon_vma) {
3347                         /*
3348                          * We are making executable a file mapping that has
3349                          * had some COW done. Since pages might have been
3350                          * written, check ability to execute the possibly
3351                          * modified content.  This typically should only
3352                          * occur for text relocations.
3353                          */
3354                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3355                 }
3356                 if (rc)
3357                         return rc;
3358         }
3359
3360         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3361 }
3362
3363 static int selinux_file_lock(struct file *file, unsigned int cmd)
3364 {
3365         const struct cred *cred = current_cred();
3366
3367         return file_has_perm(cred, file, FILE__LOCK);
3368 }
3369
3370 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3371                               unsigned long arg)
3372 {
3373         const struct cred *cred = current_cred();
3374         int err = 0;
3375
3376         switch (cmd) {
3377         case F_SETFL:
3378                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3379                         err = file_has_perm(cred, file, FILE__WRITE);
3380                         break;
3381                 }
3382                 /* fall through */
3383         case F_SETOWN:
3384         case F_SETSIG:
3385         case F_GETFL:
3386         case F_GETOWN:
3387         case F_GETSIG:
3388         case F_GETOWNER_UIDS:
3389                 /* Just check FD__USE permission */
3390                 err = file_has_perm(cred, file, 0);
3391                 break;
3392         case F_GETLK:
3393         case F_SETLK:
3394         case F_SETLKW:
3395         case F_OFD_GETLK:
3396         case F_OFD_SETLK:
3397         case F_OFD_SETLKW:
3398 #if BITS_PER_LONG == 32
3399         case F_GETLK64:
3400         case F_SETLK64:
3401         case F_SETLKW64:
3402 #endif
3403                 err = file_has_perm(cred, file, FILE__LOCK);
3404                 break;
3405         }
3406
3407         return err;
3408 }
3409
3410 static void selinux_file_set_fowner(struct file *file)
3411 {
3412         struct file_security_struct *fsec;
3413
3414         fsec = file->f_security;
3415         fsec->fown_sid = current_sid();
3416 }
3417
3418 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3419                                        struct fown_struct *fown, int signum)
3420 {
3421         struct file *file;
3422         u32 sid = task_sid(tsk);
3423         u32 perm;
3424         struct file_security_struct *fsec;
3425
3426         /* struct fown_struct is never outside the context of a struct file */
3427         file = container_of(fown, struct file, f_owner);
3428
3429         fsec = file->f_security;
3430
3431         if (!signum)
3432                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3433         else
3434                 perm = signal_to_av(signum);
3435
3436         return avc_has_perm(fsec->fown_sid, sid,
3437                             SECCLASS_PROCESS, perm, NULL);
3438 }
3439
3440 static int selinux_file_receive(struct file *file)
3441 {
3442         const struct cred *cred = current_cred();
3443
3444         return file_has_perm(cred, file, file_to_av(file));
3445 }
3446
3447 static int selinux_file_open(struct file *file, const struct cred *cred)
3448 {
3449         struct file_security_struct *fsec;
3450         struct inode_security_struct *isec;
3451
3452         fsec = file->f_security;
3453         isec = file_inode(file)->i_security;
3454         /*
3455          * Save inode label and policy sequence number
3456          * at open-time so that selinux_file_permission
3457          * can determine whether revalidation is necessary.
3458          * Task label is already saved in the file security
3459          * struct as its SID.
3460          */
3461         fsec->isid = isec->sid;
3462         fsec->pseqno = avc_policy_seqno();
3463         /*
3464          * Since the inode label or policy seqno may have changed
3465          * between the selinux_inode_permission check and the saving
3466          * of state above, recheck that access is still permitted.
3467          * Otherwise, access might never be revalidated against the
3468          * new inode label or new policy.
3469          * This check is not redundant - do not remove.
3470          */
3471         return file_path_has_perm(cred, file, open_file_to_av(file));
3472 }
3473
3474 /* task security operations */
3475
3476 static int selinux_task_create(unsigned long clone_flags)
3477 {
3478         return current_has_perm(current, PROCESS__FORK);
3479 }
3480
3481 /*
3482  * allocate the SELinux part of blank credentials
3483  */
3484 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3485 {
3486         struct task_security_struct *tsec;
3487
3488         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3489         if (!tsec)
3490                 return -ENOMEM;
3491
3492         cred->security = tsec;
3493         return 0;
3494 }
3495
3496 /*
3497  * detach and free the LSM part of a set of credentials
3498  */
3499 static void selinux_cred_free(struct cred *cred)
3500 {
3501         struct task_security_struct *tsec = cred->security;
3502
3503         /*
3504          * cred->security == NULL if security_cred_alloc_blank() or
3505          * security_prepare_creds() returned an error.
3506          */
3507         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3508         cred->security = (void *) 0x7UL;
3509         kfree(tsec);
3510 }
3511
3512 /*
3513  * prepare a new set of credentials for modification
3514  */
3515 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3516                                 gfp_t gfp)
3517 {
3518         const struct task_security_struct *old_tsec;
3519         struct task_security_struct *tsec;
3520
3521         old_tsec = old->security;
3522
3523         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3524         if (!tsec)
3525                 return -ENOMEM;
3526
3527         new->security = tsec;
3528         return 0;
3529 }
3530
3531 /*
3532  * transfer the SELinux data to a blank set of creds
3533  */
3534 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3535 {
3536         const struct task_security_struct *old_tsec = old->security;
3537         struct task_security_struct *tsec = new->security;
3538
3539         *tsec = *old_tsec;
3540 }
3541
3542 /*
3543  * set the security data for a kernel service
3544  * - all the creation contexts are set to unlabelled
3545  */
3546 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3547 {
3548         struct task_security_struct *tsec = new->security;
3549         u32 sid = current_sid();
3550         int ret;
3551
3552         ret = avc_has_perm(sid, secid,
3553                            SECCLASS_KERNEL_SERVICE,
3554                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3555                            NULL);
3556         if (ret == 0) {
3557                 tsec->sid = secid;
3558                 tsec->create_sid = 0;
3559                 tsec->keycreate_sid = 0;
3560                 tsec->sockcreate_sid = 0;
3561         }
3562         return ret;
3563 }
3564
3565 /*
3566  * set the file creation context in a security record to the same as the
3567  * objective context of the specified inode
3568  */
3569 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3570 {
3571         struct inode_security_struct *isec = inode->i_security;
3572         struct task_security_struct *tsec = new->security;
3573         u32 sid = current_sid();
3574         int ret;
3575
3576         ret = avc_has_perm(sid, isec->sid,
3577                            SECCLASS_KERNEL_SERVICE,
3578                            KERNEL_SERVICE__CREATE_FILES_AS,
3579                            NULL);
3580
3581         if (ret == 0)
3582                 tsec->create_sid = isec->sid;
3583         return ret;
3584 }
3585
3586 static int selinux_kernel_module_request(char *kmod_name)
3587 {
3588         u32 sid;
3589         struct common_audit_data ad;
3590
3591         sid = task_sid(current);
3592
3593         ad.type = LSM_AUDIT_DATA_KMOD;
3594         ad.u.kmod_name = kmod_name;
3595
3596         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3597                             SYSTEM__MODULE_REQUEST, &ad);
3598 }
3599
3600 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3601 {
3602         return current_has_perm(p, PROCESS__SETPGID);
3603 }
3604
3605 static int selinux_task_getpgid(struct task_struct *p)
3606 {
3607         return current_has_perm(p, PROCESS__GETPGID);
3608 }
3609
3610 static int selinux_task_getsid(struct task_struct *p)
3611 {
3612         return current_has_perm(p, PROCESS__GETSESSION);
3613 }
3614
3615 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3616 {
3617         *secid = task_sid(p);
3618 }
3619
3620 static int selinux_task_setnice(struct task_struct *p, int nice)
3621 {
3622         return current_has_perm(p, PROCESS__SETSCHED);
3623 }
3624
3625 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3626 {
3627         return current_has_perm(p, PROCESS__SETSCHED);
3628 }
3629
3630 static int selinux_task_getioprio(struct task_struct *p)
3631 {
3632         return current_has_perm(p, PROCESS__GETSCHED);
3633 }
3634
3635 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3636                 struct rlimit *new_rlim)
3637 {
3638         struct rlimit *old_rlim = p->signal->rlim + resource;
3639
3640         /* Control the ability to change the hard limit (whether
3641            lowering or raising it), so that the hard limit can
3642            later be used as a safe reset point for the soft limit
3643            upon context transitions.  See selinux_bprm_committing_creds. */
3644         if (old_rlim->rlim_max != new_rlim->rlim_max)
3645                 return current_has_perm(p, PROCESS__SETRLIMIT);
3646
3647         return 0;
3648 }
3649
3650 static int selinux_task_setscheduler(struct task_struct *p)
3651 {
3652         return current_has_perm(p, PROCESS__SETSCHED);
3653 }
3654
3655 static int selinux_task_getscheduler(struct task_struct *p)
3656 {
3657         return current_has_perm(p, PROCESS__GETSCHED);
3658 }
3659
3660 static int selinux_task_movememory(struct task_struct *p)
3661 {
3662         return current_has_perm(p, PROCESS__SETSCHED);
3663 }
3664
3665 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3666                                 int sig, u32 secid)
3667 {
3668         u32 perm;
3669         int rc;
3670
3671         if (!sig)
3672                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3673         else
3674                 perm = signal_to_av(sig);
3675         if (secid)
3676                 rc = avc_has_perm(secid, task_sid(p),
3677                                   SECCLASS_PROCESS, perm, NULL);
3678         else
3679                 rc = current_has_perm(p, perm);
3680         return rc;
3681 }
3682
3683 static int selinux_task_wait(struct task_struct *p)
3684 {
3685         return task_has_perm(p, current, PROCESS__SIGCHLD);
3686 }
3687
3688 static void selinux_task_to_inode(struct task_struct *p,
3689                                   struct inode *inode)
3690 {
3691         struct inode_security_struct *isec = inode->i_security;
3692         u32 sid = task_sid(p);
3693
3694         isec->sid = sid;
3695         isec->initialized = 1;
3696 }
3697
3698 /* Returns error only if unable to parse addresses */
3699 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3700                         struct common_audit_data *ad, u8 *proto)
3701 {
3702         int offset, ihlen, ret = -EINVAL;
3703         struct iphdr _iph, *ih;
3704
3705         offset = skb_network_offset(skb);
3706         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3707         if (ih == NULL)
3708                 goto out;
3709
3710         ihlen = ih->ihl * 4;
3711         if (ihlen < sizeof(_iph))
3712                 goto out;
3713
3714         ad->u.net->v4info.saddr = ih->saddr;
3715         ad->u.net->v4info.daddr = ih->daddr;
3716         ret = 0;
3717
3718         if (proto)
3719                 *proto = ih->protocol;
3720
3721         switch (ih->protocol) {
3722         case IPPROTO_TCP: {
3723                 struct tcphdr _tcph, *th;
3724
3725                 if (ntohs(ih->frag_off) & IP_OFFSET)
3726                         break;
3727
3728                 offset += ihlen;
3729                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3730                 if (th == NULL)
3731                         break;
3732
3733                 ad->u.net->sport = th->source;
3734                 ad->u.net->dport = th->dest;
3735                 break;
3736         }
3737
3738         case IPPROTO_UDP: {
3739                 struct udphdr _udph, *uh;
3740
3741                 if (ntohs(ih->frag_off) & IP_OFFSET)
3742                         break;
3743
3744                 offset += ihlen;
3745                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3746                 if (uh == NULL)
3747                         break;
3748
3749                 ad->u.net->sport = uh->source;
3750                 ad->u.net->dport = uh->dest;
3751                 break;
3752         }
3753
3754         case IPPROTO_DCCP: {
3755                 struct dccp_hdr _dccph, *dh;
3756
3757                 if (ntohs(ih->frag_off) & IP_OFFSET)
3758                         break;
3759
3760                 offset += ihlen;
3761                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3762                 if (dh == NULL)
3763                         break;
3764
3765                 ad->u.net->sport = dh->dccph_sport;
3766                 ad->u.net->dport = dh->dccph_dport;
3767                 break;
3768         }
3769
3770         default:
3771                 break;
3772         }
3773 out:
3774         return ret;
3775 }
3776
3777 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3778
3779 /* Returns error only if unable to parse addresses */
3780 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3781                         struct common_audit_data *ad, u8 *proto)
3782 {
3783         u8 nexthdr;
3784         int ret = -EINVAL, offset;
3785         struct ipv6hdr _ipv6h, *ip6;
3786         __be16 frag_off;
3787
3788         offset = skb_network_offset(skb);
3789         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3790         if (ip6 == NULL)
3791                 goto out;
3792
3793         ad->u.net->v6info.saddr = ip6->saddr;
3794         ad->u.net->v6info.daddr = ip6->daddr;
3795         ret = 0;
3796
3797         nexthdr = ip6->nexthdr;
3798         offset += sizeof(_ipv6h);
3799         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3800         if (offset < 0)
3801                 goto out;
3802
3803         if (proto)
3804                 *proto = nexthdr;
3805
3806         switch (nexthdr) {
3807         case IPPROTO_TCP: {
3808                 struct tcphdr _tcph, *th;
3809
3810                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3811                 if (th == NULL)
3812                         break;
3813
3814                 ad->u.net->sport = th->source;
3815                 ad->u.net->dport = th->dest;
3816                 break;
3817         }
3818
3819         case IPPROTO_UDP: {
3820                 struct udphdr _udph, *uh;
3821
3822                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3823                 if (uh == NULL)
3824                         break;
3825
3826                 ad->u.net->sport = uh->source;
3827                 ad->u.net->dport = uh->dest;
3828                 break;
3829         }
3830
3831         case IPPROTO_DCCP: {
3832                 struct dccp_hdr _dccph, *dh;
3833
3834                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3835                 if (dh == NULL)
3836                         break;
3837
3838                 ad->u.net->sport = dh->dccph_sport;
3839                 ad->u.net->dport = dh->dccph_dport;
3840                 break;
3841         }
3842
3843         /* includes fragments */
3844         default:
3845                 break;
3846         }
3847 out:
3848         return ret;
3849 }
3850
3851 #endif /* IPV6 */
3852
3853 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3854                              char **_addrp, int src, u8 *proto)
3855 {
3856         char *addrp;
3857         int ret;
3858
3859         switch (ad->u.net->family) {
3860         case PF_INET:
3861                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3862                 if (ret)
3863                         goto parse_error;
3864                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3865                                        &ad->u.net->v4info.daddr);
3866                 goto okay;
3867
3868 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3869         case PF_INET6:
3870                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3871                 if (ret)
3872                         goto parse_error;
3873                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3874                                        &ad->u.net->v6info.daddr);
3875                 goto okay;
3876 #endif  /* IPV6 */
3877         default:
3878                 addrp = NULL;
3879                 goto okay;
3880         }
3881
3882 parse_error:
3883         printk(KERN_WARNING
3884                "SELinux: failure in selinux_parse_skb(),"
3885                " unable to parse packet\n");
3886         return ret;
3887
3888 okay:
3889         if (_addrp)
3890                 *_addrp = addrp;
3891         return 0;
3892 }
3893
3894 /**
3895  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3896  * @skb: the packet
3897  * @family: protocol family
3898  * @sid: the packet's peer label SID
3899  *
3900  * Description:
3901  * Check the various different forms of network peer labeling and determine
3902  * the peer label/SID for the packet; most of the magic actually occurs in
3903  * the security server function security_net_peersid_cmp().  The function
3904  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3905  * or -EACCES if @sid is invalid due to inconsistencies with the different
3906  * peer labels.
3907  *
3908  */
3909 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3910 {
3911         int err;
3912         u32 xfrm_sid;
3913         u32 nlbl_sid;
3914         u32 nlbl_type;
3915
3916         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3917         if (unlikely(err))
3918                 return -EACCES;
3919         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3920         if (unlikely(err))
3921                 return -EACCES;
3922
3923         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3924         if (unlikely(err)) {
3925                 printk(KERN_WARNING
3926                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3927                        " unable to determine packet's peer label\n");
3928                 return -EACCES;
3929         }
3930
3931         return 0;
3932 }
3933
3934 /**
3935  * selinux_conn_sid - Determine the child socket label for a connection
3936  * @sk_sid: the parent socket's SID
3937  * @skb_sid: the packet's SID
3938  * @conn_sid: the resulting connection SID
3939  *
3940  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3941  * combined with the MLS information from @skb_sid in order to create
3942  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3943  * of @sk_sid.  Returns zero on success, negative values on failure.
3944  *
3945  */
3946 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3947 {
3948         int err = 0;
3949
3950         if (skb_sid != SECSID_NULL)
3951                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3952         else
3953                 *conn_sid = sk_sid;
3954
3955         return err;
3956 }
3957
3958 /* socket security operations */
3959
3960 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3961                                  u16 secclass, u32 *socksid)
3962 {
3963         if (tsec->sockcreate_sid > SECSID_NULL) {
3964                 *socksid = tsec->sockcreate_sid;
3965                 return 0;
3966         }
3967
3968         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3969                                        socksid);
3970 }
3971
3972 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3973 {
3974         struct sk_security_struct *sksec = sk->sk_security;
3975         struct common_audit_data ad;
3976         struct lsm_network_audit net = {0,};
3977         u32 tsid = task_sid(task);
3978
3979         if (sksec->sid == SECINITSID_KERNEL)
3980                 return 0;
3981
3982         ad.type = LSM_AUDIT_DATA_NET;
3983         ad.u.net = &net;
3984         ad.u.net->sk = sk;
3985
3986         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3987 }
3988
3989 static int selinux_socket_create(int family, int type,
3990                                  int protocol, int kern)
3991 {
3992         const struct task_security_struct *tsec = current_security();
3993         u32 newsid;
3994         u16 secclass;
3995         int rc;
3996
3997         if (kern)
3998                 return 0;
3999
4000         secclass = socket_type_to_security_class(family, type, protocol);
4001         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4002         if (rc)
4003                 return rc;
4004
4005         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4006 }
4007
4008 static int selinux_socket_post_create(struct socket *sock, int family,
4009                                       int type, int protocol, int kern)
4010 {
4011         const struct task_security_struct *tsec = current_security();
4012         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4013         struct sk_security_struct *sksec;
4014         int err = 0;
4015
4016         isec->sclass = socket_type_to_security_class(family, type, protocol);
4017
4018         if (kern)
4019                 isec->sid = SECINITSID_KERNEL;
4020         else {
4021                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4022                 if (err)
4023                         return err;
4024         }
4025
4026         isec->initialized = 1;
4027
4028         if (sock->sk) {
4029                 sksec = sock->sk->sk_security;
4030                 sksec->sid = isec->sid;
4031                 sksec->sclass = isec->sclass;
4032                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4033         }
4034
4035         return err;
4036 }
4037
4038 /* Range of port numbers used to automatically bind.
4039    Need to determine whether we should perform a name_bind
4040    permission check between the socket and the port number. */
4041
4042 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4043 {
4044         struct sock *sk = sock->sk;
4045         u16 family;
4046         int err;
4047
4048         err = sock_has_perm(current, sk, SOCKET__BIND);
4049         if (err)
4050                 goto out;
4051
4052         /*
4053          * If PF_INET or PF_INET6, check name_bind permission for the port.
4054          * Multiple address binding for SCTP is not supported yet: we just
4055          * check the first address now.
4056          */
4057         family = sk->sk_family;
4058         if (family == PF_INET || family == PF_INET6) {
4059                 char *addrp;
4060                 struct sk_security_struct *sksec = sk->sk_security;
4061                 struct common_audit_data ad;
4062                 struct lsm_network_audit net = {0,};
4063                 struct sockaddr_in *addr4 = NULL;
4064                 struct sockaddr_in6 *addr6 = NULL;
4065                 unsigned short snum;
4066                 u32 sid, node_perm;
4067
4068                 if (family == PF_INET) {
4069                         addr4 = (struct sockaddr_in *)address;
4070                         snum = ntohs(addr4->sin_port);
4071                         addrp = (char *)&addr4->sin_addr.s_addr;
4072                 } else {
4073                         addr6 = (struct sockaddr_in6 *)address;
4074                         snum = ntohs(addr6->sin6_port);
4075                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4076                 }
4077
4078                 if (snum) {
4079                         int low, high;
4080
4081                         inet_get_local_port_range(sock_net(sk), &low, &high);
4082
4083                         if (snum < max(PROT_SOCK, low) || snum > high) {
4084                                 err = sel_netport_sid(sk->sk_protocol,
4085                                                       snum, &sid);
4086                                 if (err)
4087                                         goto out;
4088                                 ad.type = LSM_AUDIT_DATA_NET;
4089                                 ad.u.net = &net;
4090                                 ad.u.net->sport = htons(snum);
4091                                 ad.u.net->family = family;
4092                                 err = avc_has_perm(sksec->sid, sid,
4093                                                    sksec->sclass,
4094                                                    SOCKET__NAME_BIND, &ad);
4095                                 if (err)
4096                                         goto out;
4097                         }
4098                 }
4099
4100                 switch (sksec->sclass) {
4101                 case SECCLASS_TCP_SOCKET:
4102                         node_perm = TCP_SOCKET__NODE_BIND;
4103                         break;
4104
4105                 case SECCLASS_UDP_SOCKET:
4106                         node_perm = UDP_SOCKET__NODE_BIND;
4107                         break;
4108
4109                 case SECCLASS_DCCP_SOCKET:
4110                         node_perm = DCCP_SOCKET__NODE_BIND;
4111                         break;
4112
4113                 default:
4114                         node_perm = RAWIP_SOCKET__NODE_BIND;
4115                         break;
4116                 }
4117
4118                 err = sel_netnode_sid(addrp, family, &sid);
4119                 if (err)
4120                         goto out;
4121
4122                 ad.type = LSM_AUDIT_DATA_NET;
4123                 ad.u.net = &net;
4124                 ad.u.net->sport = htons(snum);
4125                 ad.u.net->family = family;
4126
4127                 if (family == PF_INET)
4128                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4129                 else
4130                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4131
4132                 err = avc_has_perm(sksec->sid, sid,
4133                                    sksec->sclass, node_perm, &ad);
4134                 if (err)
4135                         goto out;
4136         }
4137 out:
4138         return err;
4139 }
4140
4141 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4142 {
4143         struct sock *sk = sock->sk;
4144         struct sk_security_struct *sksec = sk->sk_security;
4145         int err;
4146
4147         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4148         if (err)
4149                 return err;
4150
4151         /*
4152          * If a TCP or DCCP socket, check name_connect permission for the port.
4153          */
4154         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4155             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4156                 struct common_audit_data ad;
4157                 struct lsm_network_audit net = {0,};
4158                 struct sockaddr_in *addr4 = NULL;
4159                 struct sockaddr_in6 *addr6 = NULL;
4160                 unsigned short snum;
4161                 u32 sid, perm;
4162
4163                 if (sk->sk_family == PF_INET) {
4164                         addr4 = (struct sockaddr_in *)address;
4165                         if (addrlen < sizeof(struct sockaddr_in))
4166                                 return -EINVAL;
4167                         snum = ntohs(addr4->sin_port);
4168                 } else {
4169                         addr6 = (struct sockaddr_in6 *)address;
4170                         if (addrlen < SIN6_LEN_RFC2133)
4171                                 return -EINVAL;
4172                         snum = ntohs(addr6->sin6_port);
4173                 }
4174
4175                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4176                 if (err)
4177                         goto out;
4178
4179                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4180                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4181
4182                 ad.type = LSM_AUDIT_DATA_NET;
4183                 ad.u.net = &net;
4184                 ad.u.net->dport = htons(snum);
4185                 ad.u.net->family = sk->sk_family;
4186                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4187                 if (err)
4188                         goto out;
4189         }
4190
4191         err = selinux_netlbl_socket_connect(sk, address);
4192
4193 out:
4194         return err;
4195 }
4196
4197 static int selinux_socket_listen(struct socket *sock, int backlog)
4198 {
4199         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4200 }
4201
4202 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4203 {
4204         int err;
4205         struct inode_security_struct *isec;
4206         struct inode_security_struct *newisec;
4207
4208         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4209         if (err)
4210                 return err;
4211
4212         newisec = SOCK_INODE(newsock)->i_security;
4213
4214         isec = SOCK_INODE(sock)->i_security;
4215         newisec->sclass = isec->sclass;
4216         newisec->sid = isec->sid;
4217         newisec->initialized = 1;
4218
4219         return 0;
4220 }
4221
4222 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4223                                   int size)
4224 {
4225         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4226 }
4227
4228 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4229                                   int size, int flags)
4230 {
4231         return sock_has_perm(current, sock->sk, SOCKET__READ);
4232 }
4233
4234 static int selinux_socket_getsockname(struct socket *sock)
4235 {
4236         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4237 }
4238
4239 static int selinux_socket_getpeername(struct socket *sock)
4240 {
4241         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4242 }
4243
4244 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4245 {
4246         int err;
4247
4248         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4249         if (err)
4250                 return err;
4251
4252         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4253 }
4254
4255 static int selinux_socket_getsockopt(struct socket *sock, int level,
4256                                      int optname)
4257 {
4258         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4259 }
4260
4261 static int selinux_socket_shutdown(struct socket *sock, int how)
4262 {
4263         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4264 }
4265
4266 static int selinux_socket_unix_stream_connect(struct sock *sock,
4267                                               struct sock *other,
4268                                               struct sock *newsk)
4269 {
4270         struct sk_security_struct *sksec_sock = sock->sk_security;
4271         struct sk_security_struct *sksec_other = other->sk_security;
4272         struct sk_security_struct *sksec_new = newsk->sk_security;
4273         struct common_audit_data ad;
4274         struct lsm_network_audit net = {0,};
4275         int err;
4276
4277         ad.type = LSM_AUDIT_DATA_NET;
4278         ad.u.net = &net;
4279         ad.u.net->sk = other;
4280
4281         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4282                            sksec_other->sclass,
4283                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4284         if (err)
4285                 return err;
4286
4287         /* server child socket */
4288         sksec_new->peer_sid = sksec_sock->sid;
4289         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4290                                     &sksec_new->sid);
4291         if (err)
4292                 return err;
4293
4294         /* connecting socket */
4295         sksec_sock->peer_sid = sksec_new->sid;
4296
4297         return 0;
4298 }
4299
4300 static int selinux_socket_unix_may_send(struct socket *sock,
4301                                         struct socket *other)
4302 {
4303         struct sk_security_struct *ssec = sock->sk->sk_security;
4304         struct sk_security_struct *osec = other->sk->sk_security;
4305         struct common_audit_data ad;
4306         struct lsm_network_audit net = {0,};
4307
4308         ad.type = LSM_AUDIT_DATA_NET;
4309         ad.u.net = &net;
4310         ad.u.net->sk = other->sk;
4311
4312         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4313                             &ad);
4314 }
4315
4316 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4317                                     char *addrp, u16 family, u32 peer_sid,
4318                                     struct common_audit_data *ad)
4319 {
4320         int err;
4321         u32 if_sid;
4322         u32 node_sid;
4323
4324         err = sel_netif_sid(ns, ifindex, &if_sid);
4325         if (err)
4326                 return err;
4327         err = avc_has_perm(peer_sid, if_sid,
4328                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4329         if (err)
4330                 return err;
4331
4332         err = sel_netnode_sid(addrp, family, &node_sid);
4333         if (err)
4334                 return err;
4335         return avc_has_perm(peer_sid, node_sid,
4336                             SECCLASS_NODE, NODE__RECVFROM, ad);
4337 }
4338
4339 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4340                                        u16 family)
4341 {
4342         int err = 0;
4343         struct sk_security_struct *sksec = sk->sk_security;
4344         u32 sk_sid = sksec->sid;
4345         struct common_audit_data ad;
4346         struct lsm_network_audit net = {0,};
4347         char *addrp;
4348
4349         ad.type = LSM_AUDIT_DATA_NET;
4350         ad.u.net = &net;
4351         ad.u.net->netif = skb->skb_iif;
4352         ad.u.net->family = family;
4353         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4354         if (err)
4355                 return err;
4356
4357         if (selinux_secmark_enabled()) {
4358                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4359                                    PACKET__RECV, &ad);
4360                 if (err)
4361                         return err;
4362         }
4363
4364         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4365         if (err)
4366                 return err;
4367         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4368
4369         return err;
4370 }
4371
4372 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4373 {
4374         int err;
4375         struct sk_security_struct *sksec = sk->sk_security;
4376         u16 family = sk->sk_family;
4377         u32 sk_sid = sksec->sid;
4378         struct common_audit_data ad;
4379         struct lsm_network_audit net = {0,};
4380         char *addrp;
4381         u8 secmark_active;
4382         u8 peerlbl_active;
4383
4384         if (family != PF_INET && family != PF_INET6)
4385                 return 0;
4386
4387         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4388         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4389                 family = PF_INET;
4390
4391         /* If any sort of compatibility mode is enabled then handoff processing
4392          * to the selinux_sock_rcv_skb_compat() function to deal with the
4393          * special handling.  We do this in an attempt to keep this function
4394          * as fast and as clean as possible. */
4395         if (!selinux_policycap_netpeer)
4396                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4397
4398         secmark_active = selinux_secmark_enabled();
4399         peerlbl_active = selinux_peerlbl_enabled();
4400         if (!secmark_active && !peerlbl_active)
4401                 return 0;
4402
4403         ad.type = LSM_AUDIT_DATA_NET;
4404         ad.u.net = &net;
4405         ad.u.net->netif = skb->skb_iif;
4406         ad.u.net->family = family;
4407         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4408         if (err)
4409                 return err;
4410
4411         if (peerlbl_active) {
4412                 u32 peer_sid;
4413
4414                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4415                 if (err)
4416                         return err;
4417                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4418                                                addrp, family, peer_sid, &ad);
4419                 if (err) {
4420                         selinux_netlbl_err(skb, err, 0);
4421                         return err;
4422                 }
4423                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4424                                    PEER__RECV, &ad);
4425                 if (err) {
4426                         selinux_netlbl_err(skb, err, 0);
4427                         return err;
4428                 }
4429         }
4430
4431         if (secmark_active) {
4432                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4433                                    PACKET__RECV, &ad);
4434                 if (err)
4435                         return err;
4436         }
4437
4438         return err;
4439 }
4440
4441 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4442                                             int __user *optlen, unsigned len)
4443 {
4444         int err = 0;
4445         char *scontext;
4446         u32 scontext_len;
4447         struct sk_security_struct *sksec = sock->sk->sk_security;
4448         u32 peer_sid = SECSID_NULL;
4449
4450         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4451             sksec->sclass == SECCLASS_TCP_SOCKET)
4452                 peer_sid = sksec->peer_sid;
4453         if (peer_sid == SECSID_NULL)
4454                 return -ENOPROTOOPT;
4455
4456         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4457         if (err)
4458                 return err;
4459
4460         if (scontext_len > len) {
4461                 err = -ERANGE;
4462                 goto out_len;
4463         }
4464
4465         if (copy_to_user(optval, scontext, scontext_len))
4466                 err = -EFAULT;
4467
4468 out_len:
4469         if (put_user(scontext_len, optlen))
4470                 err = -EFAULT;
4471         kfree(scontext);
4472         return err;
4473 }
4474
4475 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4476 {
4477         u32 peer_secid = SECSID_NULL;
4478         u16 family;
4479
4480         if (skb && skb->protocol == htons(ETH_P_IP))
4481                 family = PF_INET;
4482         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4483                 family = PF_INET6;
4484         else if (sock)
4485                 family = sock->sk->sk_family;
4486         else
4487                 goto out;
4488
4489         if (sock && family == PF_UNIX)
4490                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4491         else if (skb)
4492                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4493
4494 out:
4495         *secid = peer_secid;
4496         if (peer_secid == SECSID_NULL)
4497                 return -EINVAL;
4498         return 0;
4499 }
4500
4501 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4502 {
4503         struct sk_security_struct *sksec;
4504
4505         sksec = kzalloc(sizeof(*sksec), priority);
4506         if (!sksec)
4507                 return -ENOMEM;
4508
4509         sksec->peer_sid = SECINITSID_UNLABELED;
4510         sksec->sid = SECINITSID_UNLABELED;
4511         selinux_netlbl_sk_security_reset(sksec);
4512         sk->sk_security = sksec;
4513
4514         return 0;
4515 }
4516
4517 static void selinux_sk_free_security(struct sock *sk)
4518 {
4519         struct sk_security_struct *sksec = sk->sk_security;
4520
4521         sk->sk_security = NULL;
4522         selinux_netlbl_sk_security_free(sksec);
4523         kfree(sksec);
4524 }
4525
4526 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4527 {
4528         struct sk_security_struct *sksec = sk->sk_security;
4529         struct sk_security_struct *newsksec = newsk->sk_security;
4530
4531         newsksec->sid = sksec->sid;
4532         newsksec->peer_sid = sksec->peer_sid;
4533         newsksec->sclass = sksec->sclass;
4534
4535         selinux_netlbl_sk_security_reset(newsksec);
4536 }
4537
4538 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4539 {
4540         if (!sk)
4541                 *secid = SECINITSID_ANY_SOCKET;
4542         else {
4543                 struct sk_security_struct *sksec = sk->sk_security;
4544
4545                 *secid = sksec->sid;
4546         }
4547 }
4548
4549 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4550 {
4551         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4552         struct sk_security_struct *sksec = sk->sk_security;
4553
4554         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4555             sk->sk_family == PF_UNIX)
4556                 isec->sid = sksec->sid;
4557         sksec->sclass = isec->sclass;
4558 }
4559
4560 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4561                                      struct request_sock *req)
4562 {
4563         struct sk_security_struct *sksec = sk->sk_security;
4564         int err;
4565         u16 family = req->rsk_ops->family;
4566         u32 connsid;
4567         u32 peersid;
4568
4569         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4570         if (err)
4571                 return err;
4572         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4573         if (err)
4574                 return err;
4575         req->secid = connsid;
4576         req->peer_secid = peersid;
4577
4578         return selinux_netlbl_inet_conn_request(req, family);
4579 }
4580
4581 static void selinux_inet_csk_clone(struct sock *newsk,
4582                                    const struct request_sock *req)
4583 {
4584         struct sk_security_struct *newsksec = newsk->sk_security;
4585
4586         newsksec->sid = req->secid;
4587         newsksec->peer_sid = req->peer_secid;
4588         /* NOTE: Ideally, we should also get the isec->sid for the
4589            new socket in sync, but we don't have the isec available yet.
4590            So we will wait until sock_graft to do it, by which
4591            time it will have been created and available. */
4592
4593         /* We don't need to take any sort of lock here as we are the only
4594          * thread with access to newsksec */
4595         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4596 }
4597
4598 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4599 {
4600         u16 family = sk->sk_family;
4601         struct sk_security_struct *sksec = sk->sk_security;
4602
4603         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4604         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4605                 family = PF_INET;
4606
4607         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4608 }
4609
4610 static int selinux_secmark_relabel_packet(u32 sid)
4611 {
4612         const struct task_security_struct *__tsec;
4613         u32 tsid;
4614
4615         __tsec = current_security();
4616         tsid = __tsec->sid;
4617
4618         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4619 }
4620
4621 static void selinux_secmark_refcount_inc(void)
4622 {
4623         atomic_inc(&selinux_secmark_refcount);
4624 }
4625
4626 static void selinux_secmark_refcount_dec(void)
4627 {
4628         atomic_dec(&selinux_secmark_refcount);
4629 }
4630
4631 static void selinux_req_classify_flow(const struct request_sock *req,
4632                                       struct flowi *fl)
4633 {
4634         fl->flowi_secid = req->secid;
4635 }
4636
4637 static int selinux_tun_dev_alloc_security(void **security)
4638 {
4639         struct tun_security_struct *tunsec;
4640
4641         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4642         if (!tunsec)
4643                 return -ENOMEM;
4644         tunsec->sid = current_sid();
4645
4646         *security = tunsec;
4647         return 0;
4648 }
4649
4650 static void selinux_tun_dev_free_security(void *security)
4651 {
4652         kfree(security);
4653 }
4654
4655 static int selinux_tun_dev_create(void)
4656 {
4657         u32 sid = current_sid();
4658
4659         /* we aren't taking into account the "sockcreate" SID since the socket
4660          * that is being created here is not a socket in the traditional sense,
4661          * instead it is a private sock, accessible only to the kernel, and
4662          * representing a wide range of network traffic spanning multiple
4663          * connections unlike traditional sockets - check the TUN driver to
4664          * get a better understanding of why this socket is special */
4665
4666         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4667                             NULL);
4668 }
4669
4670 static int selinux_tun_dev_attach_queue(void *security)
4671 {
4672         struct tun_security_struct *tunsec = security;
4673
4674         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4675                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4676 }
4677
4678 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4679 {
4680         struct tun_security_struct *tunsec = security;
4681         struct sk_security_struct *sksec = sk->sk_security;
4682
4683         /* we don't currently perform any NetLabel based labeling here and it
4684          * isn't clear that we would want to do so anyway; while we could apply
4685          * labeling without the support of the TUN user the resulting labeled
4686          * traffic from the other end of the connection would almost certainly
4687          * cause confusion to the TUN user that had no idea network labeling
4688          * protocols were being used */
4689
4690         sksec->sid = tunsec->sid;
4691         sksec->sclass = SECCLASS_TUN_SOCKET;
4692
4693         return 0;
4694 }
4695
4696 static int selinux_tun_dev_open(void *security)
4697 {
4698         struct tun_security_struct *tunsec = security;
4699         u32 sid = current_sid();
4700         int err;
4701
4702         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4703                            TUN_SOCKET__RELABELFROM, NULL);
4704         if (err)
4705                 return err;
4706         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4707                            TUN_SOCKET__RELABELTO, NULL);
4708         if (err)
4709                 return err;
4710         tunsec->sid = sid;
4711
4712         return 0;
4713 }
4714
4715 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4716 {
4717         int err = 0;
4718         u32 perm;
4719         struct nlmsghdr *nlh;
4720         struct sk_security_struct *sksec = sk->sk_security;
4721
4722         if (skb->len < NLMSG_HDRLEN) {
4723                 err = -EINVAL;
4724                 goto out;
4725         }
4726         nlh = nlmsg_hdr(skb);
4727
4728         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4729         if (err) {
4730                 if (err == -EINVAL) {
4731                         printk(KERN_WARNING
4732                                "SELinux: unrecognized netlink message:"
4733                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4734                                sk->sk_protocol, nlh->nlmsg_type,
4735                                secclass_map[sksec->sclass - 1].name);
4736                         if (!selinux_enforcing || security_get_allow_unknown())
4737                                 err = 0;
4738                 }
4739
4740                 /* Ignore */
4741                 if (err == -ENOENT)
4742                         err = 0;
4743                 goto out;
4744         }
4745
4746         err = sock_has_perm(current, sk, perm);
4747 out:
4748         return err;
4749 }
4750
4751 #ifdef CONFIG_NETFILTER
4752
4753 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4754                                        const struct net_device *indev,
4755                                        u16 family)
4756 {
4757         int err;
4758         char *addrp;
4759         u32 peer_sid;
4760         struct common_audit_data ad;
4761         struct lsm_network_audit net = {0,};
4762         u8 secmark_active;
4763         u8 netlbl_active;
4764         u8 peerlbl_active;
4765
4766         if (!selinux_policycap_netpeer)
4767                 return NF_ACCEPT;
4768
4769         secmark_active = selinux_secmark_enabled();
4770         netlbl_active = netlbl_enabled();
4771         peerlbl_active = selinux_peerlbl_enabled();
4772         if (!secmark_active && !peerlbl_active)
4773                 return NF_ACCEPT;
4774
4775         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4776                 return NF_DROP;
4777
4778         ad.type = LSM_AUDIT_DATA_NET;
4779         ad.u.net = &net;
4780         ad.u.net->netif = indev->ifindex;
4781         ad.u.net->family = family;
4782         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4783                 return NF_DROP;
4784
4785         if (peerlbl_active) {
4786                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4787                                                addrp, family, peer_sid, &ad);
4788                 if (err) {
4789                         selinux_netlbl_err(skb, err, 1);
4790                         return NF_DROP;
4791                 }
4792         }
4793
4794         if (secmark_active)
4795                 if (avc_has_perm(peer_sid, skb->secmark,
4796                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4797                         return NF_DROP;
4798
4799         if (netlbl_active)
4800                 /* we do this in the FORWARD path and not the POST_ROUTING
4801                  * path because we want to make sure we apply the necessary
4802                  * labeling before IPsec is applied so we can leverage AH
4803                  * protection */
4804                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4805                         return NF_DROP;
4806
4807         return NF_ACCEPT;
4808 }
4809
4810 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4811                                          struct sk_buff *skb,
4812                                          const struct nf_hook_state *state)
4813 {
4814         return selinux_ip_forward(skb, state->in, PF_INET);
4815 }
4816
4817 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4818 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4819                                          struct sk_buff *skb,
4820                                          const struct nf_hook_state *state)
4821 {
4822         return selinux_ip_forward(skb, state->in, PF_INET6);
4823 }
4824 #endif  /* IPV6 */
4825
4826 static unsigned int selinux_ip_output(struct sk_buff *skb,
4827                                       u16 family)
4828 {
4829         struct sock *sk;
4830         u32 sid;
4831
4832         if (!netlbl_enabled())
4833                 return NF_ACCEPT;
4834
4835         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4836          * because we want to make sure we apply the necessary labeling
4837          * before IPsec is applied so we can leverage AH protection */
4838         sk = skb->sk;
4839         if (sk) {
4840                 struct sk_security_struct *sksec;
4841
4842                 if (sk->sk_state == TCP_LISTEN)
4843                         /* if the socket is the listening state then this
4844                          * packet is a SYN-ACK packet which means it needs to
4845                          * be labeled based on the connection/request_sock and
4846                          * not the parent socket.  unfortunately, we can't
4847                          * lookup the request_sock yet as it isn't queued on
4848                          * the parent socket until after the SYN-ACK is sent.
4849                          * the "solution" is to simply pass the packet as-is
4850                          * as any IP option based labeling should be copied
4851                          * from the initial connection request (in the IP
4852                          * layer).  it is far from ideal, but until we get a
4853                          * security label in the packet itself this is the
4854                          * best we can do. */
4855                         return NF_ACCEPT;
4856
4857                 /* standard practice, label using the parent socket */
4858                 sksec = sk->sk_security;
4859                 sid = sksec->sid;
4860         } else
4861                 sid = SECINITSID_KERNEL;
4862         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4863                 return NF_DROP;
4864
4865         return NF_ACCEPT;
4866 }
4867
4868 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4869                                         struct sk_buff *skb,
4870                                         const struct nf_hook_state *state)
4871 {
4872         return selinux_ip_output(skb, PF_INET);
4873 }
4874
4875 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4876                                                 int ifindex,
4877                                                 u16 family)
4878 {
4879         struct sock *sk = skb->sk;
4880         struct sk_security_struct *sksec;
4881         struct common_audit_data ad;
4882         struct lsm_network_audit net = {0,};
4883         char *addrp;
4884         u8 proto;
4885
4886         if (sk == NULL)
4887                 return NF_ACCEPT;
4888         sksec = sk->sk_security;
4889
4890         ad.type = LSM_AUDIT_DATA_NET;
4891         ad.u.net = &net;
4892         ad.u.net->netif = ifindex;
4893         ad.u.net->family = family;
4894         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4895                 return NF_DROP;
4896
4897         if (selinux_secmark_enabled())
4898                 if (avc_has_perm(sksec->sid, skb->secmark,
4899                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4900                         return NF_DROP_ERR(-ECONNREFUSED);
4901
4902         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4903                 return NF_DROP_ERR(-ECONNREFUSED);
4904
4905         return NF_ACCEPT;
4906 }
4907
4908 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4909                                          const struct net_device *outdev,
4910                                          u16 family)
4911 {
4912         u32 secmark_perm;
4913         u32 peer_sid;
4914         int ifindex = outdev->ifindex;
4915         struct sock *sk;
4916         struct common_audit_data ad;
4917         struct lsm_network_audit net = {0,};
4918         char *addrp;
4919         u8 secmark_active;
4920         u8 peerlbl_active;
4921
4922         /* If any sort of compatibility mode is enabled then handoff processing
4923          * to the selinux_ip_postroute_compat() function to deal with the
4924          * special handling.  We do this in an attempt to keep this function
4925          * as fast and as clean as possible. */
4926         if (!selinux_policycap_netpeer)
4927                 return selinux_ip_postroute_compat(skb, ifindex, family);
4928
4929         secmark_active = selinux_secmark_enabled();
4930         peerlbl_active = selinux_peerlbl_enabled();
4931         if (!secmark_active && !peerlbl_active)
4932                 return NF_ACCEPT;
4933
4934         sk = skb->sk;
4935
4936 #ifdef CONFIG_XFRM
4937         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4938          * packet transformation so allow the packet to pass without any checks
4939          * since we'll have another chance to perform access control checks
4940          * when the packet is on it's final way out.
4941          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4942          *       is NULL, in this case go ahead and apply access control.
4943          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4944          *       TCP listening state we cannot wait until the XFRM processing
4945          *       is done as we will miss out on the SA label if we do;
4946          *       unfortunately, this means more work, but it is only once per
4947          *       connection. */
4948         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4949             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4950                 return NF_ACCEPT;
4951 #endif
4952
4953         if (sk == NULL) {
4954                 /* Without an associated socket the packet is either coming
4955                  * from the kernel or it is being forwarded; check the packet
4956                  * to determine which and if the packet is being forwarded
4957                  * query the packet directly to determine the security label. */
4958                 if (skb->skb_iif) {
4959                         secmark_perm = PACKET__FORWARD_OUT;
4960                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4961                                 return NF_DROP;
4962                 } else {
4963                         secmark_perm = PACKET__SEND;
4964                         peer_sid = SECINITSID_KERNEL;
4965                 }
4966         } else if (sk->sk_state == TCP_LISTEN) {
4967                 /* Locally generated packet but the associated socket is in the
4968                  * listening state which means this is a SYN-ACK packet.  In
4969                  * this particular case the correct security label is assigned
4970                  * to the connection/request_sock but unfortunately we can't
4971                  * query the request_sock as it isn't queued on the parent
4972                  * socket until after the SYN-ACK packet is sent; the only
4973                  * viable choice is to regenerate the label like we do in
4974                  * selinux_inet_conn_request().  See also selinux_ip_output()
4975                  * for similar problems. */
4976                 u32 skb_sid;
4977                 struct sk_security_struct *sksec = sk->sk_security;
4978                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4979                         return NF_DROP;
4980                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4981                  * and the packet has been through at least one XFRM
4982                  * transformation then we must be dealing with the "final"
4983                  * form of labeled IPsec packet; since we've already applied
4984                  * all of our access controls on this packet we can safely
4985                  * pass the packet. */
4986                 if (skb_sid == SECSID_NULL) {
4987                         switch (family) {
4988                         case PF_INET:
4989                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4990                                         return NF_ACCEPT;
4991                                 break;
4992                         case PF_INET6:
4993                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4994                                         return NF_ACCEPT;
4995                                 break;
4996                         default:
4997                                 return NF_DROP_ERR(-ECONNREFUSED);
4998                         }
4999                 }
5000                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5001                         return NF_DROP;
5002                 secmark_perm = PACKET__SEND;
5003         } else {
5004                 /* Locally generated packet, fetch the security label from the
5005                  * associated socket. */
5006                 struct sk_security_struct *sksec = sk->sk_security;
5007                 peer_sid = sksec->sid;
5008                 secmark_perm = PACKET__SEND;
5009         }
5010
5011         ad.type = LSM_AUDIT_DATA_NET;
5012         ad.u.net = &net;
5013         ad.u.net->netif = ifindex;
5014         ad.u.net->family = family;
5015         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5016                 return NF_DROP;
5017
5018         if (secmark_active)
5019                 if (avc_has_perm(peer_sid, skb->secmark,
5020                                  SECCLASS_PACKET, secmark_perm, &ad))
5021                         return NF_DROP_ERR(-ECONNREFUSED);
5022
5023         if (peerlbl_active) {
5024                 u32 if_sid;
5025                 u32 node_sid;
5026
5027                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5028                         return NF_DROP;
5029                 if (avc_has_perm(peer_sid, if_sid,
5030                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5031                         return NF_DROP_ERR(-ECONNREFUSED);
5032
5033                 if (sel_netnode_sid(addrp, family, &node_sid))
5034                         return NF_DROP;
5035                 if (avc_has_perm(peer_sid, node_sid,
5036                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5037                         return NF_DROP_ERR(-ECONNREFUSED);
5038         }
5039
5040         return NF_ACCEPT;
5041 }
5042
5043 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5044                                            struct sk_buff *skb,
5045                                            const struct nf_hook_state *state)
5046 {
5047         return selinux_ip_postroute(skb, state->out, PF_INET);
5048 }
5049
5050 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5051 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5052                                            struct sk_buff *skb,
5053                                            const struct nf_hook_state *state)
5054 {
5055         return selinux_ip_postroute(skb, state->out, PF_INET6);
5056 }
5057 #endif  /* IPV6 */
5058
5059 #endif  /* CONFIG_NETFILTER */
5060
5061 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5062 {
5063         return selinux_nlmsg_perm(sk, skb);
5064 }
5065
5066 static int ipc_alloc_security(struct task_struct *task,
5067                               struct kern_ipc_perm *perm,
5068                               u16 sclass)
5069 {
5070         struct ipc_security_struct *isec;
5071         u32 sid;
5072
5073         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5074         if (!isec)
5075                 return -ENOMEM;
5076
5077         sid = task_sid(task);
5078         isec->sclass = sclass;
5079         isec->sid = sid;
5080         perm->security = isec;
5081
5082         return 0;
5083 }
5084
5085 static void ipc_free_security(struct kern_ipc_perm *perm)
5086 {
5087         struct ipc_security_struct *isec = perm->security;
5088         perm->security = NULL;
5089         kfree(isec);
5090 }
5091
5092 static int msg_msg_alloc_security(struct msg_msg *msg)
5093 {
5094         struct msg_security_struct *msec;
5095
5096         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5097         if (!msec)
5098                 return -ENOMEM;
5099
5100         msec->sid = SECINITSID_UNLABELED;
5101         msg->security = msec;
5102
5103         return 0;
5104 }
5105
5106 static void msg_msg_free_security(struct msg_msg *msg)
5107 {
5108         struct msg_security_struct *msec = msg->security;
5109
5110         msg->security = NULL;
5111         kfree(msec);
5112 }
5113
5114 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5115                         u32 perms)
5116 {
5117         struct ipc_security_struct *isec;
5118         struct common_audit_data ad;
5119         u32 sid = current_sid();
5120
5121         isec = ipc_perms->security;
5122
5123         ad.type = LSM_AUDIT_DATA_IPC;
5124         ad.u.ipc_id = ipc_perms->key;
5125
5126         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5127 }
5128
5129 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5130 {
5131         return msg_msg_alloc_security(msg);
5132 }
5133
5134 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5135 {
5136         msg_msg_free_security(msg);
5137 }
5138
5139 /* message queue security operations */
5140 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5141 {
5142         struct ipc_security_struct *isec;
5143         struct common_audit_data ad;
5144         u32 sid = current_sid();
5145         int rc;
5146
5147         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5148         if (rc)
5149                 return rc;
5150
5151         isec = msq->q_perm.security;
5152
5153         ad.type = LSM_AUDIT_DATA_IPC;
5154         ad.u.ipc_id = msq->q_perm.key;
5155
5156         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5157                           MSGQ__CREATE, &ad);
5158         if (rc) {
5159                 ipc_free_security(&msq->q_perm);
5160                 return rc;
5161         }
5162         return 0;
5163 }
5164
5165 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5166 {
5167         ipc_free_security(&msq->q_perm);
5168 }
5169
5170 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5171 {
5172         struct ipc_security_struct *isec;
5173         struct common_audit_data ad;
5174         u32 sid = current_sid();
5175
5176         isec = msq->q_perm.security;
5177
5178         ad.type = LSM_AUDIT_DATA_IPC;
5179         ad.u.ipc_id = msq->q_perm.key;
5180
5181         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5182                             MSGQ__ASSOCIATE, &ad);
5183 }
5184
5185 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5186 {
5187         int err;
5188         int perms;
5189
5190         switch (cmd) {
5191         case IPC_INFO:
5192         case MSG_INFO:
5193                 /* No specific object, just general system-wide information. */
5194                 return task_has_system(current, SYSTEM__IPC_INFO);
5195         case IPC_STAT:
5196         case MSG_STAT:
5197                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5198                 break;
5199         case IPC_SET:
5200                 perms = MSGQ__SETATTR;
5201                 break;
5202         case IPC_RMID:
5203                 perms = MSGQ__DESTROY;
5204                 break;
5205         default:
5206                 return 0;
5207         }
5208
5209         err = ipc_has_perm(&msq->q_perm, perms);
5210         return err;
5211 }
5212
5213 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5214 {
5215         struct ipc_security_struct *isec;
5216         struct msg_security_struct *msec;
5217         struct common_audit_data ad;
5218         u32 sid = current_sid();
5219         int rc;
5220
5221         isec = msq->q_perm.security;
5222         msec = msg->security;
5223
5224         /*
5225          * First time through, need to assign label to the message
5226          */
5227         if (msec->sid == SECINITSID_UNLABELED) {
5228                 /*
5229                  * Compute new sid based on current process and
5230                  * message queue this message will be stored in
5231                  */
5232                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5233                                              NULL, &msec->sid);
5234                 if (rc)
5235                         return rc;
5236         }
5237
5238         ad.type = LSM_AUDIT_DATA_IPC;
5239         ad.u.ipc_id = msq->q_perm.key;
5240
5241         /* Can this process write to the queue? */
5242         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5243                           MSGQ__WRITE, &ad);
5244         if (!rc)
5245                 /* Can this process send the message */
5246                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5247                                   MSG__SEND, &ad);
5248         if (!rc)
5249                 /* Can the message be put in the queue? */
5250                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5251                                   MSGQ__ENQUEUE, &ad);
5252
5253         return rc;
5254 }
5255
5256 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5257                                     struct task_struct *target,
5258                                     long type, int mode)
5259 {
5260         struct ipc_security_struct *isec;
5261         struct msg_security_struct *msec;
5262         struct common_audit_data ad;
5263         u32 sid = task_sid(target);
5264         int rc;
5265
5266         isec = msq->q_perm.security;
5267         msec = msg->security;
5268
5269         ad.type = LSM_AUDIT_DATA_IPC;
5270         ad.u.ipc_id = msq->q_perm.key;
5271
5272         rc = avc_has_perm(sid, isec->sid,
5273                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5274         if (!rc)
5275                 rc = avc_has_perm(sid, msec->sid,
5276                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5277         return rc;
5278 }
5279
5280 /* Shared Memory security operations */
5281 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5282 {
5283         struct ipc_security_struct *isec;
5284         struct common_audit_data ad;
5285         u32 sid = current_sid();
5286         int rc;
5287
5288         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5289         if (rc)
5290                 return rc;
5291
5292         isec = shp->shm_perm.security;
5293
5294         ad.type = LSM_AUDIT_DATA_IPC;
5295         ad.u.ipc_id = shp->shm_perm.key;
5296
5297         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5298                           SHM__CREATE, &ad);
5299         if (rc) {
5300                 ipc_free_security(&shp->shm_perm);
5301                 return rc;
5302         }
5303         return 0;
5304 }
5305
5306 static void selinux_shm_free_security(struct shmid_kernel *shp)
5307 {
5308         ipc_free_security(&shp->shm_perm);
5309 }
5310
5311 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5312 {
5313         struct ipc_security_struct *isec;
5314         struct common_audit_data ad;
5315         u32 sid = current_sid();
5316
5317         isec = shp->shm_perm.security;
5318
5319         ad.type = LSM_AUDIT_DATA_IPC;
5320         ad.u.ipc_id = shp->shm_perm.key;
5321
5322         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5323                             SHM__ASSOCIATE, &ad);
5324 }
5325
5326 /* Note, at this point, shp is locked down */
5327 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5328 {
5329         int perms;
5330         int err;
5331
5332         switch (cmd) {
5333         case IPC_INFO:
5334         case SHM_INFO:
5335                 /* No specific object, just general system-wide information. */
5336                 return task_has_system(current, SYSTEM__IPC_INFO);
5337         case IPC_STAT:
5338         case SHM_STAT:
5339                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5340                 break;
5341         case IPC_SET:
5342                 perms = SHM__SETATTR;
5343                 break;
5344         case SHM_LOCK:
5345         case SHM_UNLOCK:
5346                 perms = SHM__LOCK;
5347                 break;
5348         case IPC_RMID:
5349                 perms = SHM__DESTROY;
5350                 break;
5351         default:
5352                 return 0;
5353         }
5354
5355         err = ipc_has_perm(&shp->shm_perm, perms);
5356         return err;
5357 }
5358
5359 static int selinux_shm_shmat(struct shmid_kernel *shp,
5360                              char __user *shmaddr, int shmflg)
5361 {
5362         u32 perms;
5363
5364         if (shmflg & SHM_RDONLY)
5365                 perms = SHM__READ;
5366         else
5367                 perms = SHM__READ | SHM__WRITE;
5368
5369         return ipc_has_perm(&shp->shm_perm, perms);
5370 }
5371
5372 /* Semaphore security operations */
5373 static int selinux_sem_alloc_security(struct sem_array *sma)
5374 {
5375         struct ipc_security_struct *isec;
5376         struct common_audit_data ad;
5377         u32 sid = current_sid();
5378         int rc;
5379
5380         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5381         if (rc)
5382                 return rc;
5383
5384         isec = sma->sem_perm.security;
5385
5386         ad.type = LSM_AUDIT_DATA_IPC;
5387         ad.u.ipc_id = sma->sem_perm.key;
5388
5389         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5390                           SEM__CREATE, &ad);
5391         if (rc) {
5392                 ipc_free_security(&sma->sem_perm);
5393                 return rc;
5394         }
5395         return 0;
5396 }
5397
5398 static void selinux_sem_free_security(struct sem_array *sma)
5399 {
5400         ipc_free_security(&sma->sem_perm);
5401 }
5402
5403 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5404 {
5405         struct ipc_security_struct *isec;
5406         struct common_audit_data ad;
5407         u32 sid = current_sid();
5408
5409         isec = sma->sem_perm.security;
5410
5411         ad.type = LSM_AUDIT_DATA_IPC;
5412         ad.u.ipc_id = sma->sem_perm.key;
5413
5414         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5415                             SEM__ASSOCIATE, &ad);
5416 }
5417
5418 /* Note, at this point, sma is locked down */
5419 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5420 {
5421         int err;
5422         u32 perms;
5423
5424         switch (cmd) {
5425         case IPC_INFO:
5426         case SEM_INFO:
5427                 /* No specific object, just general system-wide information. */
5428                 return task_has_system(current, SYSTEM__IPC_INFO);
5429         case GETPID:
5430         case GETNCNT:
5431         case GETZCNT:
5432                 perms = SEM__GETATTR;
5433                 break;
5434         case GETVAL:
5435         case GETALL:
5436                 perms = SEM__READ;
5437                 break;
5438         case SETVAL:
5439         case SETALL:
5440                 perms = SEM__WRITE;
5441                 break;
5442         case IPC_RMID:
5443                 perms = SEM__DESTROY;
5444                 break;
5445         case IPC_SET:
5446                 perms = SEM__SETATTR;
5447                 break;
5448         case IPC_STAT:
5449         case SEM_STAT:
5450                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5451                 break;
5452         default:
5453                 return 0;
5454         }
5455
5456         err = ipc_has_perm(&sma->sem_perm, perms);
5457         return err;
5458 }
5459
5460 static int selinux_sem_semop(struct sem_array *sma,
5461                              struct sembuf *sops, unsigned nsops, int alter)
5462 {
5463         u32 perms;
5464
5465         if (alter)
5466                 perms = SEM__READ | SEM__WRITE;
5467         else
5468                 perms = SEM__READ;
5469
5470         return ipc_has_perm(&sma->sem_perm, perms);
5471 }
5472
5473 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5474 {
5475         u32 av = 0;
5476
5477         av = 0;
5478         if (flag & S_IRUGO)
5479                 av |= IPC__UNIX_READ;
5480         if (flag & S_IWUGO)
5481                 av |= IPC__UNIX_WRITE;
5482
5483         if (av == 0)
5484                 return 0;
5485
5486         return ipc_has_perm(ipcp, av);
5487 }
5488
5489 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5490 {
5491         struct ipc_security_struct *isec = ipcp->security;
5492         *secid = isec->sid;
5493 }
5494
5495 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5496 {
5497         if (inode)
5498                 inode_doinit_with_dentry(inode, dentry);
5499 }
5500
5501 static int selinux_getprocattr(struct task_struct *p,
5502                                char *name, char **value)
5503 {
5504         const struct task_security_struct *__tsec;
5505         u32 sid;
5506         int error;
5507         unsigned len;
5508
5509         if (current != p) {
5510                 error = current_has_perm(p, PROCESS__GETATTR);
5511                 if (error)
5512                         return error;
5513         }
5514
5515         rcu_read_lock();
5516         __tsec = __task_cred(p)->security;
5517
5518         if (!strcmp(name, "current"))
5519                 sid = __tsec->sid;
5520         else if (!strcmp(name, "prev"))
5521                 sid = __tsec->osid;
5522         else if (!strcmp(name, "exec"))
5523                 sid = __tsec->exec_sid;
5524         else if (!strcmp(name, "fscreate"))
5525                 sid = __tsec->create_sid;
5526         else if (!strcmp(name, "keycreate"))
5527                 sid = __tsec->keycreate_sid;
5528         else if (!strcmp(name, "sockcreate"))
5529                 sid = __tsec->sockcreate_sid;
5530         else
5531                 goto invalid;
5532         rcu_read_unlock();
5533
5534         if (!sid)
5535                 return 0;
5536
5537         error = security_sid_to_context(sid, value, &len);
5538         if (error)
5539                 return error;
5540         return len;
5541
5542 invalid:
5543         rcu_read_unlock();
5544         return -EINVAL;
5545 }
5546
5547 static int selinux_setprocattr(struct task_struct *p,
5548                                char *name, void *value, size_t size)
5549 {
5550         struct task_security_struct *tsec;
5551         struct task_struct *tracer;
5552         struct cred *new;
5553         u32 sid = 0, ptsid;
5554         int error;
5555         char *str = value;
5556
5557         if (current != p) {
5558                 /* SELinux only allows a process to change its own
5559                    security attributes. */
5560                 return -EACCES;
5561         }
5562
5563         /*
5564          * Basic control over ability to set these attributes at all.
5565          * current == p, but we'll pass them separately in case the
5566          * above restriction is ever removed.
5567          */
5568         if (!strcmp(name, "exec"))
5569                 error = current_has_perm(p, PROCESS__SETEXEC);
5570         else if (!strcmp(name, "fscreate"))
5571                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5572         else if (!strcmp(name, "keycreate"))
5573                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5574         else if (!strcmp(name, "sockcreate"))
5575                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5576         else if (!strcmp(name, "current"))
5577                 error = current_has_perm(p, PROCESS__SETCURRENT);
5578         else
5579                 error = -EINVAL;
5580         if (error)
5581                 return error;
5582
5583         /* Obtain a SID for the context, if one was specified. */
5584         if (size && str[1] && str[1] != '\n') {
5585                 if (str[size-1] == '\n') {
5586                         str[size-1] = 0;
5587                         size--;
5588                 }
5589                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5590                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5591                         if (!capable(CAP_MAC_ADMIN)) {
5592                                 struct audit_buffer *ab;
5593                                 size_t audit_size;
5594
5595                                 /* We strip a nul only if it is at the end, otherwise the
5596                                  * context contains a nul and we should audit that */
5597                                 if (str[size - 1] == '\0')
5598                                         audit_size = size - 1;
5599                                 else
5600                                         audit_size = size;
5601                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5602                                 audit_log_format(ab, "op=fscreate invalid_context=");
5603                                 audit_log_n_untrustedstring(ab, value, audit_size);
5604                                 audit_log_end(ab);
5605
5606                                 return error;
5607                         }
5608                         error = security_context_to_sid_force(value, size,
5609                                                               &sid);
5610                 }
5611                 if (error)
5612                         return error;
5613         }
5614
5615         new = prepare_creds();
5616         if (!new)
5617                 return -ENOMEM;
5618
5619         /* Permission checking based on the specified context is
5620            performed during the actual operation (execve,
5621            open/mkdir/...), when we know the full context of the
5622            operation.  See selinux_bprm_set_creds for the execve
5623            checks and may_create for the file creation checks. The
5624            operation will then fail if the context is not permitted. */
5625         tsec = new->security;
5626         if (!strcmp(name, "exec")) {
5627                 tsec->exec_sid = sid;
5628         } else if (!strcmp(name, "fscreate")) {
5629                 tsec->create_sid = sid;
5630         } else if (!strcmp(name, "keycreate")) {
5631                 error = may_create_key(sid, p);
5632                 if (error)
5633                         goto abort_change;
5634                 tsec->keycreate_sid = sid;
5635         } else if (!strcmp(name, "sockcreate")) {
5636                 tsec->sockcreate_sid = sid;
5637         } else if (!strcmp(name, "current")) {
5638                 error = -EINVAL;
5639                 if (sid == 0)
5640                         goto abort_change;
5641
5642                 /* Only allow single threaded processes to change context */
5643                 error = -EPERM;
5644                 if (!current_is_single_threaded()) {
5645                         error = security_bounded_transition(tsec->sid, sid);
5646                         if (error)
5647                                 goto abort_change;
5648                 }
5649
5650                 /* Check permissions for the transition. */
5651                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5652                                      PROCESS__DYNTRANSITION, NULL);
5653                 if (error)
5654                         goto abort_change;
5655
5656                 /* Check for ptracing, and update the task SID if ok.
5657                    Otherwise, leave SID unchanged and fail. */
5658                 ptsid = 0;
5659                 rcu_read_lock();
5660                 tracer = ptrace_parent(p);
5661                 if (tracer)
5662                         ptsid = task_sid(tracer);
5663                 rcu_read_unlock();
5664
5665                 if (tracer) {
5666                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5667                                              PROCESS__PTRACE, NULL);
5668                         if (error)
5669                                 goto abort_change;
5670                 }
5671
5672                 tsec->sid = sid;
5673         } else {
5674                 error = -EINVAL;
5675                 goto abort_change;
5676         }
5677
5678         commit_creds(new);
5679         return size;
5680
5681 abort_change:
5682         abort_creds(new);
5683         return error;
5684 }
5685
5686 static int selinux_ismaclabel(const char *name)
5687 {
5688         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5689 }
5690
5691 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5692 {
5693         return security_sid_to_context(secid, secdata, seclen);
5694 }
5695
5696 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5697 {
5698         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5699 }
5700
5701 static void selinux_release_secctx(char *secdata, u32 seclen)
5702 {
5703         kfree(secdata);
5704 }
5705
5706 /*
5707  *      called with inode->i_mutex locked
5708  */
5709 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5710 {
5711         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5712 }
5713
5714 /*
5715  *      called with inode->i_mutex locked
5716  */
5717 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5718 {
5719         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5720 }
5721
5722 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5723 {
5724         int len = 0;
5725         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5726                                                 ctx, true);
5727         if (len < 0)
5728                 return len;
5729         *ctxlen = len;
5730         return 0;
5731 }
5732 #ifdef CONFIG_KEYS
5733
5734 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5735                              unsigned long flags)
5736 {
5737         const struct task_security_struct *tsec;
5738         struct key_security_struct *ksec;
5739
5740         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5741         if (!ksec)
5742                 return -ENOMEM;
5743
5744         tsec = cred->security;
5745         if (tsec->keycreate_sid)
5746                 ksec->sid = tsec->keycreate_sid;
5747         else
5748                 ksec->sid = tsec->sid;
5749
5750         k->security = ksec;
5751         return 0;
5752 }
5753
5754 static void selinux_key_free(struct key *k)
5755 {
5756         struct key_security_struct *ksec = k->security;
5757
5758         k->security = NULL;
5759         kfree(ksec);
5760 }
5761
5762 static int selinux_key_permission(key_ref_t key_ref,
5763                                   const struct cred *cred,
5764                                   unsigned perm)
5765 {
5766         struct key *key;
5767         struct key_security_struct *ksec;
5768         u32 sid;
5769
5770         /* if no specific permissions are requested, we skip the
5771            permission check. No serious, additional covert channels
5772            appear to be created. */
5773         if (perm == 0)
5774                 return 0;
5775
5776         sid = cred_sid(cred);
5777
5778         key = key_ref_to_ptr(key_ref);
5779         ksec = key->security;
5780
5781         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5782 }
5783
5784 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5785 {
5786         struct key_security_struct *ksec = key->security;
5787         char *context = NULL;
5788         unsigned len;
5789         int rc;
5790
5791         rc = security_sid_to_context(ksec->sid, &context, &len);
5792         if (!rc)
5793                 rc = len;
5794         *_buffer = context;
5795         return rc;
5796 }
5797
5798 #endif
5799
5800 static struct security_hook_list selinux_hooks[] = {
5801         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5802         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5803         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5804         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5805
5806         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5807         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5808         LSM_HOOK_INIT(capget, selinux_capget),
5809         LSM_HOOK_INIT(capset, selinux_capset),
5810         LSM_HOOK_INIT(capable, selinux_capable),
5811         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5812         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5813         LSM_HOOK_INIT(syslog, selinux_syslog),
5814         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5815
5816         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5817
5818         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5819         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5820         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5821         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5822
5823         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5824         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5825         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5826         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5827         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5828         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5829         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5830         LSM_HOOK_INIT(sb_mount, selinux_mount),
5831         LSM_HOOK_INIT(sb_umount, selinux_umount),
5832         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5833         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5834         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5835
5836         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5837
5838         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5839         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5840         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5841         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5842         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5843         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5844         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5845         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5846         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5847         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5848         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5849         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5850         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5851         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5852         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5853         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5854         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5855         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5856         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5857         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5858         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5859         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5860         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5861         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5862         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5863
5864         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5865         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5866         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5867         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5868         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5869         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5870         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5871         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5872         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5873         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5874         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5875         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5876
5877         LSM_HOOK_INIT(file_open, selinux_file_open),
5878
5879         LSM_HOOK_INIT(task_create, selinux_task_create),
5880         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5881         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5882         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5883         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5884         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5885         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5886         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5887         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5888         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5889         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5890         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5891         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5892         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5893         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5894         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5895         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5896         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5897         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5898         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5899         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5900         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5901
5902         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5903         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5904
5905         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5906         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5907
5908         LSM_HOOK_INIT(msg_queue_alloc_security,
5909                         selinux_msg_queue_alloc_security),
5910         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5911         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5912         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5913         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5914         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5915
5916         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5917         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5918         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5919         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5920         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5921
5922         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5923         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5924         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5925         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5926         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5927
5928         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5929
5930         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5931         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5932
5933         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5934         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5935         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5936         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5937         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5938         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5939         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5940
5941         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5942         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5943
5944         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5945         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5946         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5947         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
5948         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
5949         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
5950         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
5951         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
5952         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
5953         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
5954         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
5955         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
5956         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
5957         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
5958         LSM_HOOK_INIT(socket_getpeersec_stream,
5959                         selinux_socket_getpeersec_stream),
5960         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
5961         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
5962         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
5963         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
5964         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
5965         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
5966         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
5967         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
5968         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
5969         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
5970         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
5971         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
5972         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
5973         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
5974         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
5975         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
5976         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
5977         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
5978         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
5979
5980 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5981         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
5982         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
5983         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
5984         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
5985         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
5986         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
5987                         selinux_xfrm_state_alloc_acquire),
5988         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
5989         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
5990         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
5991         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
5992                         selinux_xfrm_state_pol_flow_match),
5993         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
5994 #endif
5995
5996 #ifdef CONFIG_KEYS
5997         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
5998         LSM_HOOK_INIT(key_free, selinux_key_free),
5999         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6000         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6001 #endif
6002
6003 #ifdef CONFIG_AUDIT
6004         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6005         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6006         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6007         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6008 #endif
6009 };
6010
6011 static __init int selinux_init(void)
6012 {
6013         if (!security_module_enable("selinux")) {
6014                 selinux_enabled = 0;
6015                 return 0;
6016         }
6017
6018         if (!selinux_enabled) {
6019                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6020                 return 0;
6021         }
6022
6023         printk(KERN_INFO "SELinux:  Initializing.\n");
6024
6025         /* Set the security state for the initial task. */
6026         cred_init_security();
6027
6028         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6029
6030         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6031                                             sizeof(struct inode_security_struct),
6032                                             0, SLAB_PANIC, NULL);
6033         avc_init();
6034
6035         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6036
6037         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6038                 panic("SELinux: Unable to register AVC netcache callback\n");
6039
6040         if (selinux_enforcing)
6041                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6042         else
6043                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6044
6045         return 0;
6046 }
6047
6048 static void delayed_superblock_init(struct super_block *sb, void *unused)
6049 {
6050         superblock_doinit(sb, NULL);
6051 }
6052
6053 void selinux_complete_init(void)
6054 {
6055         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6056
6057         /* Set up any superblocks initialized prior to the policy load. */
6058         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6059         iterate_supers(delayed_superblock_init, NULL);
6060 }
6061
6062 /* SELinux requires early initialization in order to label
6063    all processes and objects when they are created. */
6064 security_initcall(selinux_init);
6065
6066 #if defined(CONFIG_NETFILTER)
6067
6068 static struct nf_hook_ops selinux_nf_ops[] = {
6069         {
6070                 .hook =         selinux_ipv4_postroute,
6071                 .owner =        THIS_MODULE,
6072                 .pf =           NFPROTO_IPV4,
6073                 .hooknum =      NF_INET_POST_ROUTING,
6074                 .priority =     NF_IP_PRI_SELINUX_LAST,
6075         },
6076         {
6077                 .hook =         selinux_ipv4_forward,
6078                 .owner =        THIS_MODULE,
6079                 .pf =           NFPROTO_IPV4,
6080                 .hooknum =      NF_INET_FORWARD,
6081                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6082         },
6083         {
6084                 .hook =         selinux_ipv4_output,
6085                 .owner =        THIS_MODULE,
6086                 .pf =           NFPROTO_IPV4,
6087                 .hooknum =      NF_INET_LOCAL_OUT,
6088                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6089         },
6090 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6091         {
6092                 .hook =         selinux_ipv6_postroute,
6093                 .owner =        THIS_MODULE,
6094                 .pf =           NFPROTO_IPV6,
6095                 .hooknum =      NF_INET_POST_ROUTING,
6096                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6097         },
6098         {
6099                 .hook =         selinux_ipv6_forward,
6100                 .owner =        THIS_MODULE,
6101                 .pf =           NFPROTO_IPV6,
6102                 .hooknum =      NF_INET_FORWARD,
6103                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6104         },
6105 #endif  /* IPV6 */
6106 };
6107
6108 static int __init selinux_nf_ip_init(void)
6109 {
6110         int err;
6111
6112         if (!selinux_enabled)
6113                 return 0;
6114
6115         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6116
6117         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6118         if (err)
6119                 panic("SELinux: nf_register_hooks: error %d\n", err);
6120
6121         return 0;
6122 }
6123
6124 __initcall(selinux_nf_ip_init);
6125
6126 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6127 static void selinux_nf_ip_exit(void)
6128 {
6129         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6130
6131         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6132 }
6133 #endif
6134
6135 #else /* CONFIG_NETFILTER */
6136
6137 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6138 #define selinux_nf_ip_exit()
6139 #endif
6140
6141 #endif /* CONFIG_NETFILTER */
6142
6143 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6144 static int selinux_disabled;
6145
6146 int selinux_disable(void)
6147 {
6148         if (ss_initialized) {
6149                 /* Not permitted after initial policy load. */
6150                 return -EINVAL;
6151         }
6152
6153         if (selinux_disabled) {
6154                 /* Only do this once. */
6155                 return -EINVAL;
6156         }
6157
6158         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6159
6160         selinux_disabled = 1;
6161         selinux_enabled = 0;
6162
6163         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6164
6165         /* Try to destroy the avc node cache */
6166         avc_disable();
6167
6168         /* Unregister netfilter hooks. */
6169         selinux_nf_ip_exit();
6170
6171         /* Unregister selinuxfs. */
6172         exit_sel_fs();
6173
6174         return 0;
6175 }
6176 #endif