security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 141  * policy capability is enabled, SECMARK is always considered enabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 147 }
 148
 149 /**
 150  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 151  *
 152  * Description:
 153  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 154  * (1) if any are enabled or false (0) if neither are enabled.  If the
 155  * always_check_network policy capability is enabled, peer labeling
 156  * is always considered enabled.
 157  *
 158  */
 159 static int selinux_peerlbl_enabled(void)
 160 {
 161         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 162 }
 163
 164 /*
 165  * initialise the security for the init task
 166  */
 167 static void cred_init_security(void)
 168 {
 169         struct cred *cred = (struct cred *) current->real_cred;
 170         struct task_security_struct *tsec;
 171
 172         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 173         if (!tsec)
 174                 panic("SELinux:  Failed to initialize initial task.\n");
 175
 176         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 177         cred->security = tsec;
 178 }
 179
 180 /*
 181  * get the security ID of a set of credentials
 182  */
 183 static inline u32 cred_sid(const struct cred *cred)
 184 {
 185         const struct task_security_struct *tsec;
 186
 187         tsec = cred->security;
 188         return tsec->sid;
 189 }
 190
 191 /*
 192  * get the objective security ID of a task
 193  */
 194 static inline u32 task_sid(const struct task_struct *task)
 195 {
 196         u32 sid;
 197
 198         rcu_read_lock();
 199         sid = cred_sid(__task_cred(task));
 200         rcu_read_unlock();
 201         return sid;
 202 }
 203
 204 /*
 205  * get the subjective security ID of the current task
 206  */
 207 static inline u32 current_sid(void)
 208 {
 209         const struct task_security_struct *tsec = current_security();
 210
 211         return tsec->sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         mutex_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         inode->i_security = isec;
 232
 233         return 0;
 234 }
 235
 236 static void inode_free_rcu(struct rcu_head *head)
 237 {
 238         struct inode_security_struct *isec;
 239
 240         isec = container_of(head, struct inode_security_struct, rcu);
 241         kmem_cache_free(sel_inode_cache, isec);
 242 }
 243
 244 static void inode_free_security(struct inode *inode)
 245 {
 246         struct inode_security_struct *isec = inode->i_security;
 247         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 248
 249         spin_lock(&sbsec->isec_lock);
 250         if (!list_empty(&isec->list))
 251                 list_del_init(&isec->list);
 252         spin_unlock(&sbsec->isec_lock);
 253
 254         /*
 255          * The inode may still be referenced in a path walk and
 256          * a call to selinux_inode_permission() can be made
 257          * after inode_free_security() is called. Ideally, the VFS
 258          * wouldn't do this, but fixing that is a much harder
 259          * job. For now, simply free the i_security via RCU, and
 260          * leave the current inode->i_security pointer intact.
 261          * The inode will be freed after the RCU grace period too.
 262          */
 263         call_rcu(&isec->rcu, inode_free_rcu);
 264 }
 265
 266 static int file_alloc_security(struct file *file)
 267 {
 268         struct file_security_struct *fsec;
 269         u32 sid = current_sid();
 270
 271         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 272         if (!fsec)
 273                 return -ENOMEM;
 274
 275         fsec->sid = sid;
 276         fsec->fown_sid = sid;
 277         file->f_security = fsec;
 278
 279         return 0;
 280 }
 281
 282 static void file_free_security(struct file *file)
 283 {
 284         struct file_security_struct *fsec = file->f_security;
 285         file->f_security = NULL;
 286         kfree(fsec);
 287 }
 288
 289 static int superblock_alloc_security(struct super_block *sb)
 290 {
 291         struct superblock_security_struct *sbsec;
 292
 293         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 294         if (!sbsec)
 295                 return -ENOMEM;
 296
 297         mutex_init(&sbsec->lock);
 298         INIT_LIST_HEAD(&sbsec->isec_head);
 299         spin_lock_init(&sbsec->isec_lock);
 300         sbsec->sb = sb;
 301         sbsec->sid = SECINITSID_UNLABELED;
 302         sbsec->def_sid = SECINITSID_FILE;
 303         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 304         sb->s_security = sbsec;
 305
 306         return 0;
 307 }
 308
 309 static void superblock_free_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec = sb->s_security;
 312         sb->s_security = NULL;
 313         kfree(sbsec);
 314 }
 315
 316 /* The file system's label must be initialized prior to use. */
 317
 318 static const char *labeling_behaviors[7] = {
 319         "uses xattr",
 320         "uses transition SIDs",
 321         "uses task SIDs",
 322         "uses genfs_contexts",
 323         "not configured for labeling",
 324         "uses mountpoint labeling",
 325         "uses native labeling",
 326 };
 327
 328 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 329
 330 static inline int inode_doinit(struct inode *inode)
 331 {
 332         return inode_doinit_with_dentry(inode, NULL);
 333 }
 334
 335 enum {
 336         Opt_error = -1,
 337         Opt_context = 1,
 338         Opt_fscontext = 2,
 339         Opt_defcontext = 3,
 340         Opt_rootcontext = 4,
 341         Opt_labelsupport = 5,
 342         Opt_nextmntopt = 6,
 343 };
 344
 345 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 346
 347 static const match_table_t tokens = {
 348         {Opt_context, CONTEXT_STR "%s"},
 349         {Opt_fscontext, FSCONTEXT_STR "%s"},
 350         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 351         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 352         {Opt_labelsupport, LABELSUPP_STR},
 353         {Opt_error, NULL},
 354 };
 355
 356 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 357
 358 static int may_context_mount_sb_relabel(u32 sid,
 359                         struct superblock_security_struct *sbsec,
 360                         const struct cred *cred)
 361 {
 362         const struct task_security_struct *tsec = cred->security;
 363         int rc;
 364
 365         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 366                           FILESYSTEM__RELABELFROM, NULL);
 367         if (rc)
 368                 return rc;
 369
 370         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 371                           FILESYSTEM__RELABELTO, NULL);
 372         return rc;
 373 }
 374
 375 static int may_context_mount_inode_relabel(u32 sid,
 376                         struct superblock_security_struct *sbsec,
 377                         const struct cred *cred)
 378 {
 379         const struct task_security_struct *tsec = cred->security;
 380         int rc;
 381         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 382                           FILESYSTEM__RELABELFROM, NULL);
 383         if (rc)
 384                 return rc;
 385
 386         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 387                           FILESYSTEM__ASSOCIATE, NULL);
 388         return rc;
 389 }
 390
 391 static int selinux_is_sblabel_mnt(struct super_block *sb)
 392 {
 393         struct superblock_security_struct *sbsec = sb->s_security;
 394
 395         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 396             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 397             sbsec->behavior == SECURITY_FS_USE_TASK)
 398                 return 1;
 399
 400         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 401         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 402                 return 1;
 403
 404         /*
 405          * Special handling for rootfs. Is genfs but supports
 406          * setting SELinux context on in-core inodes.
 407          */
 408         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 409                 return 1;
 410
 411         return 0;
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = root->d_inode;
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450         else
 451                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 452                        sb->s_id, sb->s_type->name,
 453                        labeling_behaviors[sbsec->behavior-1]);
 454
 455         sbsec->flags |= SE_SBINITIALIZED;
 456         if (selinux_is_sblabel_mnt(sb))
 457                 sbsec->flags |= SBLABEL_MNT;
 458
 459         /* Initialize the root inode. */
 460         rc = inode_doinit_with_dentry(root_inode, root);
 461
 462         /* Initialize any other inodes associated with the superblock, e.g.
 463            inodes created prior to initial policy load or inodes created
 464            during get_sb by a pseudo filesystem that directly
 465            populates itself. */
 466         spin_lock(&sbsec->isec_lock);
 467 next_inode:
 468         if (!list_empty(&sbsec->isec_head)) {
 469                 struct inode_security_struct *isec =
 470                                 list_entry(sbsec->isec_head.next,
 471                                            struct inode_security_struct, list);
 472                 struct inode *inode = isec->inode;
 473                 spin_unlock(&sbsec->isec_lock);
 474                 inode = igrab(inode);
 475                 if (inode) {
 476                         if (!IS_PRIVATE(inode))
 477                                 inode_doinit(inode);
 478                         iput(inode);
 479                 }
 480                 spin_lock(&sbsec->isec_lock);
 481                 list_del_init(&isec->list);
 482                 goto next_inode;
 483         }
 484         spin_unlock(&sbsec->isec_lock);
 485 out:
 486         return rc;
 487 }
 488
 489 /*
 490  * This function should allow an FS to ask what it's mount security
 491  * options were so it can use those later for submounts, displaying
 492  * mount options, or whatever.
 493  */
 494 static int selinux_get_mnt_opts(const struct super_block *sb,
 495                                 struct security_mnt_opts *opts)
 496 {
 497         int rc = 0, i;
 498         struct superblock_security_struct *sbsec = sb->s_security;
 499         char *context = NULL;
 500         u32 len;
 501         char tmp;
 502
 503         security_init_mnt_opts(opts);
 504
 505         if (!(sbsec->flags & SE_SBINITIALIZED))
 506                 return -EINVAL;
 507
 508         if (!ss_initialized)
 509                 return -EINVAL;
 510
 511         /* make sure we always check enough bits to cover the mask */
 512         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 513
 514         tmp = sbsec->flags & SE_MNTMASK;
 515         /* count the number of mount options for this sb */
 516         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 517                 if (tmp & 0x01)
 518                         opts->num_mnt_opts++;
 519                 tmp >>= 1;
 520         }
 521         /* Check if the Label support flag is set */
 522         if (sbsec->flags & SBLABEL_MNT)
 523                 opts->num_mnt_opts++;
 524
 525         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 526         if (!opts->mnt_opts) {
 527                 rc = -ENOMEM;
 528                 goto out_free;
 529         }
 530
 531         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 532         if (!opts->mnt_opts_flags) {
 533                 rc = -ENOMEM;
 534                 goto out_free;
 535         }
 536
 537         i = 0;
 538         if (sbsec->flags & FSCONTEXT_MNT) {
 539                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 540                 if (rc)
 541                         goto out_free;
 542                 opts->mnt_opts[i] = context;
 543                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 544         }
 545         if (sbsec->flags & CONTEXT_MNT) {
 546                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 551         }
 552         if (sbsec->flags & DEFCONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 558         }
 559         if (sbsec->flags & ROOTCONTEXT_MNT) {
 560                 struct inode *root = sbsec->sb->s_root->d_inode;
 561                 struct inode_security_struct *isec = root->i_security;
 562
 563                 rc = security_sid_to_context(isec->sid, &context, &len);
 564                 if (rc)
 565                         goto out_free;
 566                 opts->mnt_opts[i] = context;
 567                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 568         }
 569         if (sbsec->flags & SBLABEL_MNT) {
 570                 opts->mnt_opts[i] = NULL;
 571                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 572         }
 573
 574         BUG_ON(i != opts->num_mnt_opts);
 575
 576         return 0;
 577
 578 out_free:
 579         security_free_mnt_opts(opts);
 580         return rc;
 581 }
 582
 583 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 584                       u32 old_sid, u32 new_sid)
 585 {
 586         char mnt_flags = sbsec->flags & SE_MNTMASK;
 587
 588         /* check if the old mount command had the same options */
 589         if (sbsec->flags & SE_SBINITIALIZED)
 590                 if (!(sbsec->flags & flag) ||
 591                     (old_sid != new_sid))
 592                         return 1;
 593
 594         /* check if we were passed the same options twice,
 595          * aka someone passed context=a,context=b
 596          */
 597         if (!(sbsec->flags & SE_SBINITIALIZED))
 598                 if (mnt_flags & flag)
 599                         return 1;
 600         return 0;
 601 }
 602
 603 /*
 604  * Allow filesystems with binary mount data to explicitly set mount point
 605  * labeling information.
 606  */
 607 static int selinux_set_mnt_opts(struct super_block *sb,
 608                                 struct security_mnt_opts *opts,
 609                                 unsigned long kern_flags,
 610                                 unsigned long *set_kern_flags)
 611 {
 612         const struct cred *cred = current_cred();
 613         int rc = 0, i;
 614         struct superblock_security_struct *sbsec = sb->s_security;
 615         const char *name = sb->s_type->name;
 616         struct inode *inode = sbsec->sb->s_root->d_inode;
 617         struct inode_security_struct *root_isec = inode->i_security;
 618         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 619         u32 defcontext_sid = 0;
 620         char **mount_options = opts->mnt_opts;
 621         int *flags = opts->mnt_opts_flags;
 622         int num_opts = opts->num_mnt_opts;
 623
 624         mutex_lock(&sbsec->lock);
 625
 626         if (!ss_initialized) {
 627                 if (!num_opts) {
 628                         /* Defer initialization until selinux_complete_init,
 629                            after the initial policy is loaded and the security
 630                            server is ready to handle calls. */
 631                         goto out;
 632                 }
 633                 rc = -EINVAL;
 634                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 635                         "before the security server is initialized\n");
 636                 goto out;
 637         }
 638         if (kern_flags && !set_kern_flags) {
 639                 /* Specifying internal flags without providing a place to
 640                  * place the results is not allowed */
 641                 rc = -EINVAL;
 642                 goto out;
 643         }
 644
 645         /*
 646          * Binary mount data FS will come through this function twice.  Once
 647          * from an explicit call and once from the generic calls from the vfs.
 648          * Since the generic VFS calls will not contain any security mount data
 649          * we need to skip the double mount verification.
 650          *
 651          * This does open a hole in which we will not notice if the first
 652          * mount using this sb set explict options and a second mount using
 653          * this sb does not set any security options.  (The first options
 654          * will be used for both mounts)
 655          */
 656         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 657             && (num_opts == 0))
 658                 goto out;
 659
 660         /*
 661          * parse the mount options, check if they are valid sids.
 662          * also check if someone is trying to mount the same sb more
 663          * than once with different security options.
 664          */
 665         for (i = 0; i < num_opts; i++) {
 666                 u32 sid;
 667
 668                 if (flags[i] == SBLABEL_MNT)
 669                         continue;
 670                 rc = security_context_to_sid(mount_options[i],
 671                                              strlen(mount_options[i]), &sid);
 672                 if (rc) {
 673                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 674                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 675                                mount_options[i], sb->s_id, name, rc);
 676                         goto out;
 677                 }
 678                 switch (flags[i]) {
 679                 case FSCONTEXT_MNT:
 680                         fscontext_sid = sid;
 681
 682                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 683                                         fscontext_sid))
 684                                 goto out_double_mount;
 685
 686                         sbsec->flags |= FSCONTEXT_MNT;
 687                         break;
 688                 case CONTEXT_MNT:
 689                         context_sid = sid;
 690
 691                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 692                                         context_sid))
 693                                 goto out_double_mount;
 694
 695                         sbsec->flags |= CONTEXT_MNT;
 696                         break;
 697                 case ROOTCONTEXT_MNT:
 698                         rootcontext_sid = sid;
 699
 700                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 701                                         rootcontext_sid))
 702                                 goto out_double_mount;
 703
 704                         sbsec->flags |= ROOTCONTEXT_MNT;
 705
 706                         break;
 707                 case DEFCONTEXT_MNT:
 708                         defcontext_sid = sid;
 709
 710                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 711                                         defcontext_sid))
 712                                 goto out_double_mount;
 713
 714                         sbsec->flags |= DEFCONTEXT_MNT;
 715
 716                         break;
 717                 default:
 718                         rc = -EINVAL;
 719                         goto out;
 720                 }
 721         }
 722
 723         if (sbsec->flags & SE_SBINITIALIZED) {
 724                 /* previously mounted with options, but not on this attempt? */
 725                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 726                         goto out_double_mount;
 727                 rc = 0;
 728                 goto out;
 729         }
 730
 731         if (strcmp(sb->s_type->name, "proc") == 0)
 732                 sbsec->flags |= SE_SBPROC;
 733
 734         if (!sbsec->behavior) {
 735                 /*
 736                  * Determine the labeling behavior to use for this
 737                  * filesystem type.
 738                  */
 739                 rc = security_fs_use(sb);
 740                 if (rc) {
 741                         printk(KERN_WARNING
 742                                 "%s: security_fs_use(%s) returned %d\n",
 743                                         __func__, sb->s_type->name, rc);
 744                         goto out;
 745                 }
 746         }
 747         /* sets the context of the superblock for the fs being mounted. */
 748         if (fscontext_sid) {
 749                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 750                 if (rc)
 751                         goto out;
 752
 753                 sbsec->sid = fscontext_sid;
 754         }
 755
 756         /*
 757          * Switch to using mount point labeling behavior.
 758          * sets the label used on all file below the mountpoint, and will set
 759          * the superblock context if not already set.
 760          */
 761         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 762                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 763                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 764         }
 765
 766         if (context_sid) {
 767                 if (!fscontext_sid) {
 768                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 769                                                           cred);
 770                         if (rc)
 771                                 goto out;
 772                         sbsec->sid = context_sid;
 773                 } else {
 774                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 775                                                              cred);
 776                         if (rc)
 777                                 goto out;
 778                 }
 779                 if (!rootcontext_sid)
 780                         rootcontext_sid = context_sid;
 781
 782                 sbsec->mntpoint_sid = context_sid;
 783                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 784         }
 785
 786         if (rootcontext_sid) {
 787                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 788                                                      cred);
 789                 if (rc)
 790                         goto out;
 791
 792                 root_isec->sid = rootcontext_sid;
 793                 root_isec->initialized = 1;
 794         }
 795
 796         if (defcontext_sid) {
 797                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 798                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 799                         rc = -EINVAL;
 800                         printk(KERN_WARNING "SELinux: defcontext option is "
 801                                "invalid for this filesystem type\n");
 802                         goto out;
 803                 }
 804
 805                 if (defcontext_sid != sbsec->def_sid) {
 806                         rc = may_context_mount_inode_relabel(defcontext_sid,
 807                                                              sbsec, cred);
 808                         if (rc)
 809                                 goto out;
 810                 }
 811
 812                 sbsec->def_sid = defcontext_sid;
 813         }
 814
 815         rc = sb_finish_set_opts(sb);
 816 out:
 817         mutex_unlock(&sbsec->lock);
 818         return rc;
 819 out_double_mount:
 820         rc = -EINVAL;
 821         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 822                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 823         goto out;
 824 }
 825
 826 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 827                                     const struct super_block *newsb)
 828 {
 829         struct superblock_security_struct *old = oldsb->s_security;
 830         struct superblock_security_struct *new = newsb->s_security;
 831         char oldflags = old->flags & SE_MNTMASK;
 832         char newflags = new->flags & SE_MNTMASK;
 833
 834         if (oldflags != newflags)
 835                 goto mismatch;
 836         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 837                 goto mismatch;
 838         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 839                 goto mismatch;
 840         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 841                 goto mismatch;
 842         if (oldflags & ROOTCONTEXT_MNT) {
 843                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 844                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 845                 if (oldroot->sid != newroot->sid)
 846                         goto mismatch;
 847         }
 848         return 0;
 849 mismatch:
 850         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 851                             "different security settings for (dev %s, "
 852                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 853         return -EBUSY;
 854 }
 855
 856 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 857                                         struct super_block *newsb)
 858 {
 859         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 860         struct superblock_security_struct *newsbsec = newsb->s_security;
 861
 862         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 863         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 864         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 865
 866         /*
 867          * if the parent was able to be mounted it clearly had no special lsm
 868          * mount options.  thus we can safely deal with this superblock later
 869          */
 870         if (!ss_initialized)
 871                 return 0;
 872
 873         /* how can we clone if the old one wasn't set up?? */
 874         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 875
 876         /* if fs is reusing a sb, make sure that the contexts match */
 877         if (newsbsec->flags & SE_SBINITIALIZED)
 878                 return selinux_cmp_sb_context(oldsb, newsb);
 879
 880         mutex_lock(&newsbsec->lock);
 881
 882         newsbsec->flags = oldsbsec->flags;
 883
 884         newsbsec->sid = oldsbsec->sid;
 885         newsbsec->def_sid = oldsbsec->def_sid;
 886         newsbsec->behavior = oldsbsec->behavior;
 887
 888         if (set_context) {
 889                 u32 sid = oldsbsec->mntpoint_sid;
 890
 891                 if (!set_fscontext)
 892                         newsbsec->sid = sid;
 893                 if (!set_rootcontext) {
 894                         struct inode *newinode = newsb->s_root->d_inode;
 895                         struct inode_security_struct *newisec = newinode->i_security;
 896                         newisec->sid = sid;
 897                 }
 898                 newsbsec->mntpoint_sid = sid;
 899         }
 900         if (set_rootcontext) {
 901                 const struct inode *oldinode = oldsb->s_root->d_inode;
 902                 const struct inode_security_struct *oldisec = oldinode->i_security;
 903                 struct inode *newinode = newsb->s_root->d_inode;
 904                 struct inode_security_struct *newisec = newinode->i_security;
 905
 906                 newisec->sid = oldisec->sid;
 907         }
 908
 909         sb_finish_set_opts(newsb);
 910         mutex_unlock(&newsbsec->lock);
 911         return 0;
 912 }
 913
 914 static int selinux_parse_opts_str(char *options,
 915                                   struct security_mnt_opts *opts)
 916 {
 917         char *p;
 918         char *context = NULL, *defcontext = NULL;
 919         char *fscontext = NULL, *rootcontext = NULL;
 920         int rc, num_mnt_opts = 0;
 921
 922         opts->num_mnt_opts = 0;
 923
 924         /* Standard string-based options. */
 925         while ((p = strsep(&options, "|")) != NULL) {
 926                 int token;
 927                 substring_t args[MAX_OPT_ARGS];
 928
 929                 if (!*p)
 930                         continue;
 931
 932                 token = match_token(p, tokens, args);
 933
 934                 switch (token) {
 935                 case Opt_context:
 936                         if (context || defcontext) {
 937                                 rc = -EINVAL;
 938                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 939                                 goto out_err;
 940                         }
 941                         context = match_strdup(&args[0]);
 942                         if (!context) {
 943                                 rc = -ENOMEM;
 944                                 goto out_err;
 945                         }
 946                         break;
 947
 948                 case Opt_fscontext:
 949                         if (fscontext) {
 950                                 rc = -EINVAL;
 951                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 952                                 goto out_err;
 953                         }
 954                         fscontext = match_strdup(&args[0]);
 955                         if (!fscontext) {
 956                                 rc = -ENOMEM;
 957                                 goto out_err;
 958                         }
 959                         break;
 960
 961                 case Opt_rootcontext:
 962                         if (rootcontext) {
 963                                 rc = -EINVAL;
 964                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 965                                 goto out_err;
 966                         }
 967                         rootcontext = match_strdup(&args[0]);
 968                         if (!rootcontext) {
 969                                 rc = -ENOMEM;
 970                                 goto out_err;
 971                         }
 972                         break;
 973
 974                 case Opt_defcontext:
 975                         if (context || defcontext) {
 976                                 rc = -EINVAL;
 977                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 978                                 goto out_err;
 979                         }
 980                         defcontext = match_strdup(&args[0]);
 981                         if (!defcontext) {
 982                                 rc = -ENOMEM;
 983                                 goto out_err;
 984                         }
 985                         break;
 986                 case Opt_labelsupport:
 987                         break;
 988                 default:
 989                         rc = -EINVAL;
 990                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 991                         goto out_err;
 992
 993                 }
 994         }
 995
 996         rc = -ENOMEM;
 997         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 998         if (!opts->mnt_opts)
 999                 goto out_err;
1000
1001         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002         if (!opts->mnt_opts_flags) {
1003                 kfree(opts->mnt_opts);
1004                 goto out_err;
1005         }
1006
1007         if (fscontext) {
1008                 opts->mnt_opts[num_mnt_opts] = fscontext;
1009                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010         }
1011         if (context) {
1012                 opts->mnt_opts[num_mnt_opts] = context;
1013                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014         }
1015         if (rootcontext) {
1016                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018         }
1019         if (defcontext) {
1020                 opts->mnt_opts[num_mnt_opts] = defcontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022         }
1023
1024         opts->num_mnt_opts = num_mnt_opts;
1025         return 0;
1026
1027 out_err:
1028         kfree(context);
1029         kfree(defcontext);
1030         kfree(fscontext);
1031         kfree(rootcontext);
1032         return rc;
1033 }
1034 /*
1035  * string mount options parsing and call set the sbsec
1036  */
1037 static int superblock_doinit(struct super_block *sb, void *data)
1038 {
1039         int rc = 0;
1040         char *options = data;
1041         struct security_mnt_opts opts;
1042
1043         security_init_mnt_opts(&opts);
1044
1045         if (!data)
1046                 goto out;
1047
1048         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050         rc = selinux_parse_opts_str(options, &opts);
1051         if (rc)
1052                 goto out_err;
1053
1054 out:
1055         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057 out_err:
1058         security_free_mnt_opts(&opts);
1059         return rc;
1060 }
1061
1062 static void selinux_write_opts(struct seq_file *m,
1063                                struct security_mnt_opts *opts)
1064 {
1065         int i;
1066         char *prefix;
1067
1068         for (i = 0; i < opts->num_mnt_opts; i++) {
1069                 char *has_comma;
1070
1071                 if (opts->mnt_opts[i])
1072                         has_comma = strchr(opts->mnt_opts[i], ',');
1073                 else
1074                         has_comma = NULL;
1075
1076                 switch (opts->mnt_opts_flags[i]) {
1077                 case CONTEXT_MNT:
1078                         prefix = CONTEXT_STR;
1079                         break;
1080                 case FSCONTEXT_MNT:
1081                         prefix = FSCONTEXT_STR;
1082                         break;
1083                 case ROOTCONTEXT_MNT:
1084                         prefix = ROOTCONTEXT_STR;
1085                         break;
1086                 case DEFCONTEXT_MNT:
1087                         prefix = DEFCONTEXT_STR;
1088                         break;
1089                 case SBLABEL_MNT:
1090                         seq_putc(m, ',');
1091                         seq_puts(m, LABELSUPP_STR);
1092                         continue;
1093                 default:
1094                         BUG();
1095                         return;
1096                 };
1097                 /* we need a comma before each option */
1098                 seq_putc(m, ',');
1099                 seq_puts(m, prefix);
1100                 if (has_comma)
1101                         seq_putc(m, '\"');
1102                 seq_puts(m, opts->mnt_opts[i]);
1103                 if (has_comma)
1104                         seq_putc(m, '\"');
1105         }
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110         struct security_mnt_opts opts;
1111         int rc;
1112
1113         rc = selinux_get_mnt_opts(sb, &opts);
1114         if (rc) {
1115                 /* before policy load we may get EINVAL, don't show anything */
1116                 if (rc == -EINVAL)
1117                         rc = 0;
1118                 return rc;
1119         }
1120
1121         selinux_write_opts(m, &opts);
1122
1123         security_free_mnt_opts(&opts);
1124
1125         return rc;
1126 }
1127
1128 static inline u16 inode_mode_to_security_class(umode_t mode)
1129 {
1130         switch (mode & S_IFMT) {
1131         case S_IFSOCK:
1132                 return SECCLASS_SOCK_FILE;
1133         case S_IFLNK:
1134                 return SECCLASS_LNK_FILE;
1135         case S_IFREG:
1136                 return SECCLASS_FILE;
1137         case S_IFBLK:
1138                 return SECCLASS_BLK_FILE;
1139         case S_IFDIR:
1140                 return SECCLASS_DIR;
1141         case S_IFCHR:
1142                 return SECCLASS_CHR_FILE;
1143         case S_IFIFO:
1144                 return SECCLASS_FIFO_FILE;
1145
1146         }
1147
1148         return SECCLASS_FILE;
1149 }
1150
1151 static inline int default_protocol_stream(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154 }
1155
1156 static inline int default_protocol_dgram(int protocol)
1157 {
1158         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159 }
1160
1161 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162 {
1163         switch (family) {
1164         case PF_UNIX:
1165                 switch (type) {
1166                 case SOCK_STREAM:
1167                 case SOCK_SEQPACKET:
1168                         return SECCLASS_UNIX_STREAM_SOCKET;
1169                 case SOCK_DGRAM:
1170                         return SECCLASS_UNIX_DGRAM_SOCKET;
1171                 }
1172                 break;
1173         case PF_INET:
1174         case PF_INET6:
1175                 switch (type) {
1176                 case SOCK_STREAM:
1177                         if (default_protocol_stream(protocol))
1178                                 return SECCLASS_TCP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DGRAM:
1182                         if (default_protocol_dgram(protocol))
1183                                 return SECCLASS_UDP_SOCKET;
1184                         else
1185                                 return SECCLASS_RAWIP_SOCKET;
1186                 case SOCK_DCCP:
1187                         return SECCLASS_DCCP_SOCKET;
1188                 default:
1189                         return SECCLASS_RAWIP_SOCKET;
1190                 }
1191                 break;
1192         case PF_NETLINK:
1193                 switch (protocol) {
1194                 case NETLINK_ROUTE:
1195                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1196                 case NETLINK_FIREWALL:
1197                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198                 case NETLINK_SOCK_DIAG:
1199                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200                 case NETLINK_NFLOG:
1201                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1202                 case NETLINK_XFRM:
1203                         return SECCLASS_NETLINK_XFRM_SOCKET;
1204                 case NETLINK_SELINUX:
1205                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1206                 case NETLINK_AUDIT:
1207                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1208                 case NETLINK_IP6_FW:
1209                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1210                 case NETLINK_DNRTMSG:
1211                         return SECCLASS_NETLINK_DNRT_SOCKET;
1212                 case NETLINK_KOBJECT_UEVENT:
1213                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214                 default:
1215                         return SECCLASS_NETLINK_SOCKET;
1216                 }
1217         case PF_PACKET:
1218                 return SECCLASS_PACKET_SOCKET;
1219         case PF_KEY:
1220                 return SECCLASS_KEY_SOCKET;
1221         case PF_APPLETALK:
1222                 return SECCLASS_APPLETALK_SOCKET;
1223         }
1224
1225         return SECCLASS_SOCKET;
1226 }
1227
1228 #ifdef CONFIG_PROC_FS
1229 static int selinux_proc_get_sid(struct dentry *dentry,
1230                                 u16 tclass,
1231                                 u32 *sid)
1232 {
1233         int rc;
1234         char *buffer, *path;
1235
1236         buffer = (char *)__get_free_page(GFP_KERNEL);
1237         if (!buffer)
1238                 return -ENOMEM;
1239
1240         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241         if (IS_ERR(path))
1242                 rc = PTR_ERR(path);
1243         else {
1244                 /* each process gets a /proc/PID/ entry. Strip off the
1245                  * PID part to get a valid selinux labeling.
1246                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247                 while (path[1] >= '0' && path[1] <= '9') {
1248                         path[1] = '/';
1249                         path++;
1250                 }
1251                 rc = security_genfs_sid("proc", path, tclass, sid);
1252         }
1253         free_page((unsigned long)buffer);
1254         return rc;
1255 }
1256 #else
1257 static int selinux_proc_get_sid(struct dentry *dentry,
1258                                 u16 tclass,
1259                                 u32 *sid)
1260 {
1261         return -EINVAL;
1262 }
1263 #endif
1264
1265 /* The inode's security attributes must be initialized before first use. */
1266 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267 {
1268         struct superblock_security_struct *sbsec = NULL;
1269         struct inode_security_struct *isec = inode->i_security;
1270         u32 sid;
1271         struct dentry *dentry;
1272 #define INITCONTEXTLEN 255
1273         char *context = NULL;
1274         unsigned len = 0;
1275         int rc = 0;
1276
1277         if (isec->initialized)
1278                 goto out;
1279
1280         mutex_lock(&isec->lock);
1281         if (isec->initialized)
1282                 goto out_unlock;
1283
1284         sbsec = inode->i_sb->s_security;
1285         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286                 /* Defer initialization until selinux_complete_init,
1287                    after the initial policy is loaded and the security
1288                    server is ready to handle calls. */
1289                 spin_lock(&sbsec->isec_lock);
1290                 if (list_empty(&isec->list))
1291                         list_add(&isec->list, &sbsec->isec_head);
1292                 spin_unlock(&sbsec->isec_lock);
1293                 goto out_unlock;
1294         }
1295
1296         switch (sbsec->behavior) {
1297         case SECURITY_FS_USE_NATIVE:
1298                 break;
1299         case SECURITY_FS_USE_XATTR:
1300                 if (!inode->i_op->getxattr) {
1301                         isec->sid = sbsec->def_sid;
1302                         break;
1303                 }
1304
1305                 /* Need a dentry, since the xattr API requires one.
1306                    Life would be simpler if we could just pass the inode. */
1307                 if (opt_dentry) {
1308                         /* Called from d_instantiate or d_splice_alias. */
1309                         dentry = dget(opt_dentry);
1310                 } else {
1311                         /* Called from selinux_complete_init, try to find a dentry. */
1312                         dentry = d_find_alias(inode);
1313                 }
1314                 if (!dentry) {
1315                         /*
1316                          * this is can be hit on boot when a file is accessed
1317                          * before the policy is loaded.  When we load policy we
1318                          * may find inodes that have no dentry on the
1319                          * sbsec->isec_head list.  No reason to complain as these
1320                          * will get fixed up the next time we go through
1321                          * inode_doinit with a dentry, before these inodes could
1322                          * be used again by userspace.
1323                          */
1324                         goto out_unlock;
1325                 }
1326
1327                 len = INITCONTEXTLEN;
1328                 context = kmalloc(len+1, GFP_NOFS);
1329                 if (!context) {
1330                         rc = -ENOMEM;
1331                         dput(dentry);
1332                         goto out_unlock;
1333                 }
1334                 context[len] = '\0';
1335                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336                                            context, len);
1337                 if (rc == -ERANGE) {
1338                         kfree(context);
1339
1340                         /* Need a larger buffer.  Query for the right size. */
1341                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342                                                    NULL, 0);
1343                         if (rc < 0) {
1344                                 dput(dentry);
1345                                 goto out_unlock;
1346                         }
1347                         len = rc;
1348                         context = kmalloc(len+1, GFP_NOFS);
1349                         if (!context) {
1350                                 rc = -ENOMEM;
1351                                 dput(dentry);
1352                                 goto out_unlock;
1353                         }
1354                         context[len] = '\0';
1355                         rc = inode->i_op->getxattr(dentry,
1356                                                    XATTR_NAME_SELINUX,
1357                                                    context, len);
1358                 }
1359                 dput(dentry);
1360                 if (rc < 0) {
1361                         if (rc != -ENODATA) {
1362                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1363                                        "%d for dev=%s ino=%ld\n", __func__,
1364                                        -rc, inode->i_sb->s_id, inode->i_ino);
1365                                 kfree(context);
1366                                 goto out_unlock;
1367                         }
1368                         /* Map ENODATA to the default file SID */
1369                         sid = sbsec->def_sid;
1370                         rc = 0;
1371                 } else {
1372                         rc = security_context_to_sid_default(context, rc, &sid,
1373                                                              sbsec->def_sid,
1374                                                              GFP_NOFS);
1375                         if (rc) {
1376                                 char *dev = inode->i_sb->s_id;
1377                                 unsigned long ino = inode->i_ino;
1378
1379                                 if (rc == -EINVAL) {
1380                                         if (printk_ratelimit())
1381                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1383                                                         "filesystem in question.\n", ino, dev, context);
1384                                 } else {
1385                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1386                                                "returned %d for dev=%s ino=%ld\n",
1387                                                __func__, context, -rc, dev, ino);
1388                                 }
1389                                 kfree(context);
1390                                 /* Leave with the unlabeled SID */
1391                                 rc = 0;
1392                                 break;
1393                         }
1394                 }
1395                 kfree(context);
1396                 isec->sid = sid;
1397                 break;
1398         case SECURITY_FS_USE_TASK:
1399                 isec->sid = isec->task_sid;
1400                 break;
1401         case SECURITY_FS_USE_TRANS:
1402                 /* Default to the fs SID. */
1403                 isec->sid = sbsec->sid;
1404
1405                 /* Try to obtain a transition SID. */
1406                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408                                              isec->sclass, NULL, &sid);
1409                 if (rc)
1410                         goto out_unlock;
1411                 isec->sid = sid;
1412                 break;
1413         case SECURITY_FS_USE_MNTPOINT:
1414                 isec->sid = sbsec->mntpoint_sid;
1415                 break;
1416         default:
1417                 /* Default to the fs superblock SID. */
1418                 isec->sid = sbsec->sid;
1419
1420                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421                         if (opt_dentry) {
1422                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1423                                 rc = selinux_proc_get_sid(opt_dentry,
1424                                                           isec->sclass,
1425                                                           &sid);
1426                                 if (rc)
1427                                         goto out_unlock;
1428                                 isec->sid = sid;
1429                         }
1430                 }
1431                 break;
1432         }
1433
1434         isec->initialized = 1;
1435
1436 out_unlock:
1437         mutex_unlock(&isec->lock);
1438 out:
1439         if (isec->sclass == SECCLASS_FILE)
1440                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441         return rc;
1442 }
1443
1444 /* Convert a Linux signal to an access vector. */
1445 static inline u32 signal_to_av(int sig)
1446 {
1447         u32 perm = 0;
1448
1449         switch (sig) {
1450         case SIGCHLD:
1451                 /* Commonly granted from child to parent. */
1452                 perm = PROCESS__SIGCHLD;
1453                 break;
1454         case SIGKILL:
1455                 /* Cannot be caught or ignored */
1456                 perm = PROCESS__SIGKILL;
1457                 break;
1458         case SIGSTOP:
1459                 /* Cannot be caught or ignored */
1460                 perm = PROCESS__SIGSTOP;
1461                 break;
1462         default:
1463                 /* All other signals. */
1464                 perm = PROCESS__SIGNAL;
1465                 break;
1466         }
1467
1468         return perm;
1469 }
1470
1471 /*
1472  * Check permission between a pair of credentials
1473  * fork check, ptrace check, etc.
1474  */
1475 static int cred_has_perm(const struct cred *actor,
1476                          const struct cred *target,
1477                          u32 perms)
1478 {
1479         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1480
1481         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1482 }
1483
1484 /*
1485  * Check permission between a pair of tasks, e.g. signal checks,
1486  * fork check, ptrace check, etc.
1487  * tsk1 is the actor and tsk2 is the target
1488  * - this uses the default subjective creds of tsk1
1489  */
1490 static int task_has_perm(const struct task_struct *tsk1,
1491                          const struct task_struct *tsk2,
1492                          u32 perms)
1493 {
1494         const struct task_security_struct *__tsec1, *__tsec2;
1495         u32 sid1, sid2;
1496
1497         rcu_read_lock();
1498         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1499         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1500         rcu_read_unlock();
1501         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1502 }
1503
1504 /*
1505  * Check permission between current and another task, e.g. signal checks,
1506  * fork check, ptrace check, etc.
1507  * current is the actor and tsk2 is the target
1508  * - this uses current's subjective creds
1509  */
1510 static int current_has_perm(const struct task_struct *tsk,
1511                             u32 perms)
1512 {
1513         u32 sid, tsid;
1514
1515         sid = current_sid();
1516         tsid = task_sid(tsk);
1517         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1518 }
1519
1520 #if CAP_LAST_CAP > 63
1521 #error Fix SELinux to handle capabilities > 63.
1522 #endif
1523
1524 /* Check whether a task is allowed to use a capability. */
1525 static int cred_has_capability(const struct cred *cred,
1526                                int cap, int audit)
1527 {
1528         struct common_audit_data ad;
1529         struct av_decision avd;
1530         u16 sclass;
1531         u32 sid = cred_sid(cred);
1532         u32 av = CAP_TO_MASK(cap);
1533         int rc;
1534
1535         ad.type = LSM_AUDIT_DATA_CAP;
1536         ad.u.cap = cap;
1537
1538         switch (CAP_TO_INDEX(cap)) {
1539         case 0:
1540                 sclass = SECCLASS_CAPABILITY;
1541                 break;
1542         case 1:
1543                 sclass = SECCLASS_CAPABILITY2;
1544                 break;
1545         default:
1546                 printk(KERN_ERR
1547                        "SELinux:  out of range capability %d\n", cap);
1548                 BUG();
1549                 return -EINVAL;
1550         }
1551
1552         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1553         if (audit == SECURITY_CAP_AUDIT) {
1554                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1555                 if (rc2)
1556                         return rc2;
1557         }
1558         return rc;
1559 }
1560
1561 /* Check whether a task is allowed to use a system operation. */
1562 static int task_has_system(struct task_struct *tsk,
1563                            u32 perms)
1564 {
1565         u32 sid = task_sid(tsk);
1566
1567         return avc_has_perm(sid, SECINITSID_KERNEL,
1568                             SECCLASS_SYSTEM, perms, NULL);
1569 }
1570
1571 /* Check whether a task has a particular permission to an inode.
1572    The 'adp' parameter is optional and allows other audit
1573    data to be passed (e.g. the dentry). */
1574 static int inode_has_perm(const struct cred *cred,
1575                           struct inode *inode,
1576                           u32 perms,
1577                           struct common_audit_data *adp)
1578 {
1579         struct inode_security_struct *isec;
1580         u32 sid;
1581
1582         validate_creds(cred);
1583
1584         if (unlikely(IS_PRIVATE(inode)))
1585                 return 0;
1586
1587         sid = cred_sid(cred);
1588         isec = inode->i_security;
1589
1590         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1591 }
1592
1593 /* Same as inode_has_perm, but pass explicit audit data containing
1594    the dentry to help the auditing code to more easily generate the
1595    pathname if needed. */
1596 static inline int dentry_has_perm(const struct cred *cred,
1597                                   struct dentry *dentry,
1598                                   u32 av)
1599 {
1600         struct inode *inode = dentry->d_inode;
1601         struct common_audit_data ad;
1602
1603         ad.type = LSM_AUDIT_DATA_DENTRY;
1604         ad.u.dentry = dentry;
1605         return inode_has_perm(cred, inode, av, &ad);
1606 }
1607
1608 /* Same as inode_has_perm, but pass explicit audit data containing
1609    the path to help the auditing code to more easily generate the
1610    pathname if needed. */
1611 static inline int path_has_perm(const struct cred *cred,
1612                                 struct path *path,
1613                                 u32 av)
1614 {
1615         struct inode *inode = path->dentry->d_inode;
1616         struct common_audit_data ad;
1617
1618         ad.type = LSM_AUDIT_DATA_PATH;
1619         ad.u.path = *path;
1620         return inode_has_perm(cred, inode, av, &ad);
1621 }
1622
1623 /* Same as path_has_perm, but uses the inode from the file struct. */
1624 static inline int file_path_has_perm(const struct cred *cred,
1625                                      struct file *file,
1626                                      u32 av)
1627 {
1628         struct common_audit_data ad;
1629
1630         ad.type = LSM_AUDIT_DATA_PATH;
1631         ad.u.path = file->f_path;
1632         return inode_has_perm(cred, file_inode(file), av, &ad);
1633 }
1634
1635 /* Check whether a task can use an open file descriptor to
1636    access an inode in a given way.  Check access to the
1637    descriptor itself, and then use dentry_has_perm to
1638    check a particular permission to the file.
1639    Access to the descriptor is implicitly granted if it
1640    has the same SID as the process.  If av is zero, then
1641    access to the file is not checked, e.g. for cases
1642    where only the descriptor is affected like seek. */
1643 static int file_has_perm(const struct cred *cred,
1644                          struct file *file,
1645                          u32 av)
1646 {
1647         struct file_security_struct *fsec = file->f_security;
1648         struct inode *inode = file_inode(file);
1649         struct common_audit_data ad;
1650         u32 sid = cred_sid(cred);
1651         int rc;
1652
1653         ad.type = LSM_AUDIT_DATA_PATH;
1654         ad.u.path = file->f_path;
1655
1656         if (sid != fsec->sid) {
1657                 rc = avc_has_perm(sid, fsec->sid,
1658                                   SECCLASS_FD,
1659                                   FD__USE,
1660                                   &ad);
1661                 if (rc)
1662                         goto out;
1663         }
1664
1665         /* av is zero if only checking access to the descriptor. */
1666         rc = 0;
1667         if (av)
1668                 rc = inode_has_perm(cred, inode, av, &ad);
1669
1670 out:
1671         return rc;
1672 }
1673
1674 /* Check whether a task can create a file. */
1675 static int may_create(struct inode *dir,
1676                       struct dentry *dentry,
1677                       u16 tclass)
1678 {
1679         const struct task_security_struct *tsec = current_security();
1680         struct inode_security_struct *dsec;
1681         struct superblock_security_struct *sbsec;
1682         u32 sid, newsid;
1683         struct common_audit_data ad;
1684         int rc;
1685
1686         dsec = dir->i_security;
1687         sbsec = dir->i_sb->s_security;
1688
1689         sid = tsec->sid;
1690         newsid = tsec->create_sid;
1691
1692         ad.type = LSM_AUDIT_DATA_DENTRY;
1693         ad.u.dentry = dentry;
1694
1695         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1696                           DIR__ADD_NAME | DIR__SEARCH,
1697                           &ad);
1698         if (rc)
1699                 return rc;
1700
1701         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1702                 rc = security_transition_sid(sid, dsec->sid, tclass,
1703                                              &dentry->d_name, &newsid);
1704                 if (rc)
1705                         return rc;
1706         }
1707
1708         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1709         if (rc)
1710                 return rc;
1711
1712         return avc_has_perm(newsid, sbsec->sid,
1713                             SECCLASS_FILESYSTEM,
1714                             FILESYSTEM__ASSOCIATE, &ad);
1715 }
1716
1717 /* Check whether a task can create a key. */
1718 static int may_create_key(u32 ksid,
1719                           struct task_struct *ctx)
1720 {
1721         u32 sid = task_sid(ctx);
1722
1723         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1724 }
1725
1726 #define MAY_LINK        0
1727 #define MAY_UNLINK      1
1728 #define MAY_RMDIR       2
1729
1730 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1731 static int may_link(struct inode *dir,
1732                     struct dentry *dentry,
1733                     int kind)
1734
1735 {
1736         struct inode_security_struct *dsec, *isec;
1737         struct common_audit_data ad;
1738         u32 sid = current_sid();
1739         u32 av;
1740         int rc;
1741
1742         dsec = dir->i_security;
1743         isec = dentry->d_inode->i_security;
1744
1745         ad.type = LSM_AUDIT_DATA_DENTRY;
1746         ad.u.dentry = dentry;
1747
1748         av = DIR__SEARCH;
1749         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1750         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1751         if (rc)
1752                 return rc;
1753
1754         switch (kind) {
1755         case MAY_LINK:
1756                 av = FILE__LINK;
1757                 break;
1758         case MAY_UNLINK:
1759                 av = FILE__UNLINK;
1760                 break;
1761         case MAY_RMDIR:
1762                 av = DIR__RMDIR;
1763                 break;
1764         default:
1765                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1766                         __func__, kind);
1767                 return 0;
1768         }
1769
1770         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1771         return rc;
1772 }
1773
1774 static inline int may_rename(struct inode *old_dir,
1775                              struct dentry *old_dentry,
1776                              struct inode *new_dir,
1777                              struct dentry *new_dentry)
1778 {
1779         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1780         struct common_audit_data ad;
1781         u32 sid = current_sid();
1782         u32 av;
1783         int old_is_dir, new_is_dir;
1784         int rc;
1785
1786         old_dsec = old_dir->i_security;
1787         old_isec = old_dentry->d_inode->i_security;
1788         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1789         new_dsec = new_dir->i_security;
1790
1791         ad.type = LSM_AUDIT_DATA_DENTRY;
1792
1793         ad.u.dentry = old_dentry;
1794         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1795                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1796         if (rc)
1797                 return rc;
1798         rc = avc_has_perm(sid, old_isec->sid,
1799                           old_isec->sclass, FILE__RENAME, &ad);
1800         if (rc)
1801                 return rc;
1802         if (old_is_dir && new_dir != old_dir) {
1803                 rc = avc_has_perm(sid, old_isec->sid,
1804                                   old_isec->sclass, DIR__REPARENT, &ad);
1805                 if (rc)
1806                         return rc;
1807         }
1808
1809         ad.u.dentry = new_dentry;
1810         av = DIR__ADD_NAME | DIR__SEARCH;
1811         if (new_dentry->d_inode)
1812                 av |= DIR__REMOVE_NAME;
1813         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1814         if (rc)
1815                 return rc;
1816         if (new_dentry->d_inode) {
1817                 new_isec = new_dentry->d_inode->i_security;
1818                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1819                 rc = avc_has_perm(sid, new_isec->sid,
1820                                   new_isec->sclass,
1821                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1822                 if (rc)
1823                         return rc;
1824         }
1825
1826         return 0;
1827 }
1828
1829 /* Check whether a task can perform a filesystem operation. */
1830 static int superblock_has_perm(const struct cred *cred,
1831                                struct super_block *sb,
1832                                u32 perms,
1833                                struct common_audit_data *ad)
1834 {
1835         struct superblock_security_struct *sbsec;
1836         u32 sid = cred_sid(cred);
1837
1838         sbsec = sb->s_security;
1839         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1840 }
1841
1842 /* Convert a Linux mode and permission mask to an access vector. */
1843 static inline u32 file_mask_to_av(int mode, int mask)
1844 {
1845         u32 av = 0;
1846
1847         if (!S_ISDIR(mode)) {
1848                 if (mask & MAY_EXEC)
1849                         av |= FILE__EXECUTE;
1850                 if (mask & MAY_READ)
1851                         av |= FILE__READ;
1852
1853                 if (mask & MAY_APPEND)
1854                         av |= FILE__APPEND;
1855                 else if (mask & MAY_WRITE)
1856                         av |= FILE__WRITE;
1857
1858         } else {
1859                 if (mask & MAY_EXEC)
1860                         av |= DIR__SEARCH;
1861                 if (mask & MAY_WRITE)
1862                         av |= DIR__WRITE;
1863                 if (mask & MAY_READ)
1864                         av |= DIR__READ;
1865         }
1866
1867         return av;
1868 }
1869
1870 /* Convert a Linux file to an access vector. */
1871 static inline u32 file_to_av(struct file *file)
1872 {
1873         u32 av = 0;
1874
1875         if (file->f_mode & FMODE_READ)
1876                 av |= FILE__READ;
1877         if (file->f_mode & FMODE_WRITE) {
1878                 if (file->f_flags & O_APPEND)
1879                         av |= FILE__APPEND;
1880                 else
1881                         av |= FILE__WRITE;
1882         }
1883         if (!av) {
1884                 /*
1885                  * Special file opened with flags 3 for ioctl-only use.
1886                  */
1887                 av = FILE__IOCTL;
1888         }
1889
1890         return av;
1891 }
1892
1893 /*
1894  * Convert a file to an access vector and include the correct open
1895  * open permission.
1896  */
1897 static inline u32 open_file_to_av(struct file *file)
1898 {
1899         u32 av = file_to_av(file);
1900
1901         if (selinux_policycap_openperm)
1902                 av |= FILE__OPEN;
1903
1904         return av;
1905 }
1906
1907 /* Hook functions begin here. */
1908
1909 static int selinux_ptrace_access_check(struct task_struct *child,
1910                                      unsigned int mode)
1911 {
1912         int rc;
1913
1914         rc = cap_ptrace_access_check(child, mode);
1915         if (rc)
1916                 return rc;
1917
1918         if (mode & PTRACE_MODE_READ) {
1919                 u32 sid = current_sid();
1920                 u32 csid = task_sid(child);
1921                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1922         }
1923
1924         return current_has_perm(child, PROCESS__PTRACE);
1925 }
1926
1927 static int selinux_ptrace_traceme(struct task_struct *parent)
1928 {
1929         int rc;
1930
1931         rc = cap_ptrace_traceme(parent);
1932         if (rc)
1933                 return rc;
1934
1935         return task_has_perm(parent, current, PROCESS__PTRACE);
1936 }
1937
1938 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1939                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1940 {
1941         int error;
1942
1943         error = current_has_perm(target, PROCESS__GETCAP);
1944         if (error)
1945                 return error;
1946
1947         return cap_capget(target, effective, inheritable, permitted);
1948 }
1949
1950 static int selinux_capset(struct cred *new, const struct cred *old,
1951                           const kernel_cap_t *effective,
1952                           const kernel_cap_t *inheritable,
1953                           const kernel_cap_t *permitted)
1954 {
1955         int error;
1956
1957         error = cap_capset(new, old,
1958                                       effective, inheritable, permitted);
1959         if (error)
1960                 return error;
1961
1962         return cred_has_perm(old, new, PROCESS__SETCAP);
1963 }
1964
1965 /*
1966  * (This comment used to live with the selinux_task_setuid hook,
1967  * which was removed).
1968  *
1969  * Since setuid only affects the current process, and since the SELinux
1970  * controls are not based on the Linux identity attributes, SELinux does not
1971  * need to control this operation.  However, SELinux does control the use of
1972  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1973  */
1974
1975 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1976                            int cap, int audit)
1977 {
1978         int rc;
1979
1980         rc = cap_capable(cred, ns, cap, audit);
1981         if (rc)
1982                 return rc;
1983
1984         return cred_has_capability(cred, cap, audit);
1985 }
1986
1987 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1988 {
1989         const struct cred *cred = current_cred();
1990         int rc = 0;
1991
1992         if (!sb)
1993                 return 0;
1994
1995         switch (cmds) {
1996         case Q_SYNC:
1997         case Q_QUOTAON:
1998         case Q_QUOTAOFF:
1999         case Q_SETINFO:
2000         case Q_SETQUOTA:
2001                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2002                 break;
2003         case Q_GETFMT:
2004         case Q_GETINFO:
2005         case Q_GETQUOTA:
2006                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2007                 break;
2008         default:
2009                 rc = 0;  /* let the kernel handle invalid cmds */
2010                 break;
2011         }
2012         return rc;
2013 }
2014
2015 static int selinux_quota_on(struct dentry *dentry)
2016 {
2017         const struct cred *cred = current_cred();
2018
2019         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2020 }
2021
2022 static int selinux_syslog(int type)
2023 {
2024         int rc;
2025
2026         switch (type) {
2027         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2028         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2029                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2030                 break;
2031         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2032         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2033         /* Set level of messages printed to console */
2034         case SYSLOG_ACTION_CONSOLE_LEVEL:
2035                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2036                 break;
2037         case SYSLOG_ACTION_CLOSE:       /* Close log */
2038         case SYSLOG_ACTION_OPEN:        /* Open log */
2039         case SYSLOG_ACTION_READ:        /* Read from log */
2040         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2041         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2042         default:
2043                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2044                 break;
2045         }
2046         return rc;
2047 }
2048
2049 /*
2050  * Check that a process has enough memory to allocate a new virtual
2051  * mapping. 0 means there is enough memory for the allocation to
2052  * succeed and -ENOMEM implies there is not.
2053  *
2054  * Do not audit the selinux permission check, as this is applied to all
2055  * processes that allocate mappings.
2056  */
2057 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2058 {
2059         int rc, cap_sys_admin = 0;
2060
2061         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2062                              SECURITY_CAP_NOAUDIT);
2063         if (rc == 0)
2064                 cap_sys_admin = 1;
2065
2066         return __vm_enough_memory(mm, pages, cap_sys_admin);
2067 }
2068
2069 /* binprm security operations */
2070
2071 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2072 {
2073         const struct task_security_struct *old_tsec;
2074         struct task_security_struct *new_tsec;
2075         struct inode_security_struct *isec;
2076         struct common_audit_data ad;
2077         struct inode *inode = file_inode(bprm->file);
2078         int rc;
2079
2080         rc = cap_bprm_set_creds(bprm);
2081         if (rc)
2082                 return rc;
2083
2084         /* SELinux context only depends on initial program or script and not
2085          * the script interpreter */
2086         if (bprm->cred_prepared)
2087                 return 0;
2088
2089         old_tsec = current_security();
2090         new_tsec = bprm->cred->security;
2091         isec = inode->i_security;
2092
2093         /* Default to the current task SID. */
2094         new_tsec->sid = old_tsec->sid;
2095         new_tsec->osid = old_tsec->sid;
2096
2097         /* Reset fs, key, and sock SIDs on execve. */
2098         new_tsec->create_sid = 0;
2099         new_tsec->keycreate_sid = 0;
2100         new_tsec->sockcreate_sid = 0;
2101
2102         if (old_tsec->exec_sid) {
2103                 new_tsec->sid = old_tsec->exec_sid;
2104                 /* Reset exec SID on execve. */
2105                 new_tsec->exec_sid = 0;
2106
2107                 /*
2108                  * Minimize confusion: if no_new_privs and a transition is
2109                  * explicitly requested, then fail the exec.
2110                  */
2111                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2112                         return -EPERM;
2113         } else {
2114                 /* Check for a default transition on this program. */
2115                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2116                                              SECCLASS_PROCESS, NULL,
2117                                              &new_tsec->sid);
2118                 if (rc)
2119                         return rc;
2120         }
2121
2122         ad.type = LSM_AUDIT_DATA_PATH;
2123         ad.u.path = bprm->file->f_path;
2124
2125         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2126             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2127                 new_tsec->sid = old_tsec->sid;
2128
2129         if (new_tsec->sid == old_tsec->sid) {
2130                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2131                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2132                 if (rc)
2133                         return rc;
2134         } else {
2135                 /* Check permissions for the transition. */
2136                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2138                 if (rc)
2139                         return rc;
2140
2141                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2142                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2143                 if (rc)
2144                         return rc;
2145
2146                 /* Check for shared state */
2147                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2148                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2149                                           SECCLASS_PROCESS, PROCESS__SHARE,
2150                                           NULL);
2151                         if (rc)
2152                                 return -EPERM;
2153                 }
2154
2155                 /* Make sure that anyone attempting to ptrace over a task that
2156                  * changes its SID has the appropriate permit */
2157                 if (bprm->unsafe &
2158                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2159                         struct task_struct *tracer;
2160                         struct task_security_struct *sec;
2161                         u32 ptsid = 0;
2162
2163                         rcu_read_lock();
2164                         tracer = ptrace_parent(current);
2165                         if (likely(tracer != NULL)) {
2166                                 sec = __task_cred(tracer)->security;
2167                                 ptsid = sec->sid;
2168                         }
2169                         rcu_read_unlock();
2170
2171                         if (ptsid != 0) {
2172                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2173                                                   SECCLASS_PROCESS,
2174                                                   PROCESS__PTRACE, NULL);
2175                                 if (rc)
2176                                         return -EPERM;
2177                         }
2178                 }
2179
2180                 /* Clear any possibly unsafe personality bits on exec: */
2181                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2182         }
2183
2184         return 0;
2185 }
2186
2187 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2188 {
2189         const struct task_security_struct *tsec = current_security();
2190         u32 sid, osid;
2191         int atsecure = 0;
2192
2193         sid = tsec->sid;
2194         osid = tsec->osid;
2195
2196         if (osid != sid) {
2197                 /* Enable secure mode for SIDs transitions unless
2198                    the noatsecure permission is granted between
2199                    the two SIDs, i.e. ahp returns 0. */
2200                 atsecure = avc_has_perm(osid, sid,
2201                                         SECCLASS_PROCESS,
2202                                         PROCESS__NOATSECURE, NULL);
2203         }
2204
2205         return (atsecure || cap_bprm_secureexec(bprm));
2206 }
2207
2208 static int match_file(const void *p, struct file *file, unsigned fd)
2209 {
2210         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2211 }
2212
2213 /* Derived from fs/exec.c:flush_old_files. */
2214 static inline void flush_unauthorized_files(const struct cred *cred,
2215                                             struct files_struct *files)
2216 {
2217         struct file *file, *devnull = NULL;
2218         struct tty_struct *tty;
2219         int drop_tty = 0;
2220         unsigned n;
2221
2222         tty = get_current_tty();
2223         if (tty) {
2224                 spin_lock(&tty_files_lock);
2225                 if (!list_empty(&tty->tty_files)) {
2226                         struct tty_file_private *file_priv;
2227
2228                         /* Revalidate access to controlling tty.
2229                            Use file_path_has_perm on the tty path directly
2230                            rather than using file_has_perm, as this particular
2231                            open file may belong to another process and we are
2232                            only interested in the inode-based check here. */
2233                         file_priv = list_first_entry(&tty->tty_files,
2234                                                 struct tty_file_private, list);
2235                         file = file_priv->file;
2236                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2237                                 drop_tty = 1;
2238                 }
2239                 spin_unlock(&tty_files_lock);
2240                 tty_kref_put(tty);
2241         }
2242         /* Reset controlling tty. */
2243         if (drop_tty)
2244                 no_tty();
2245
2246         /* Revalidate access to inherited open files. */
2247         n = iterate_fd(files, 0, match_file, cred);
2248         if (!n) /* none found? */
2249                 return;
2250
2251         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2252         if (IS_ERR(devnull))
2253                 devnull = NULL;
2254         /* replace all the matching ones with this */
2255         do {
2256                 replace_fd(n - 1, devnull, 0);
2257         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2258         if (devnull)
2259                 fput(devnull);
2260 }
2261
2262 /*
2263  * Prepare a process for imminent new credential changes due to exec
2264  */
2265 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2266 {
2267         struct task_security_struct *new_tsec;
2268         struct rlimit *rlim, *initrlim;
2269         int rc, i;
2270
2271         new_tsec = bprm->cred->security;
2272         if (new_tsec->sid == new_tsec->osid)
2273                 return;
2274
2275         /* Close files for which the new task SID is not authorized. */
2276         flush_unauthorized_files(bprm->cred, current->files);
2277
2278         /* Always clear parent death signal on SID transitions. */
2279         current->pdeath_signal = 0;
2280
2281         /* Check whether the new SID can inherit resource limits from the old
2282          * SID.  If not, reset all soft limits to the lower of the current
2283          * task's hard limit and the init task's soft limit.
2284          *
2285          * Note that the setting of hard limits (even to lower them) can be
2286          * controlled by the setrlimit check.  The inclusion of the init task's
2287          * soft limit into the computation is to avoid resetting soft limits
2288          * higher than the default soft limit for cases where the default is
2289          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2290          */
2291         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2292                           PROCESS__RLIMITINH, NULL);
2293         if (rc) {
2294                 /* protect against do_prlimit() */
2295                 task_lock(current);
2296                 for (i = 0; i < RLIM_NLIMITS; i++) {
2297                         rlim = current->signal->rlim + i;
2298                         initrlim = init_task.signal->rlim + i;
2299                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2300                 }
2301                 task_unlock(current);
2302                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2303         }
2304 }
2305
2306 /*
2307  * Clean up the process immediately after the installation of new credentials
2308  * due to exec
2309  */
2310 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2311 {
2312         const struct task_security_struct *tsec = current_security();
2313         struct itimerval itimer;
2314         u32 osid, sid;
2315         int rc, i;
2316
2317         osid = tsec->osid;
2318         sid = tsec->sid;
2319
2320         if (sid == osid)
2321                 return;
2322
2323         /* Check whether the new SID can inherit signal state from the old SID.
2324          * If not, clear itimers to avoid subsequent signal generation and
2325          * flush and unblock signals.
2326          *
2327          * This must occur _after_ the task SID has been updated so that any
2328          * kill done after the flush will be checked against the new SID.
2329          */
2330         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2331         if (rc) {
2332                 memset(&itimer, 0, sizeof itimer);
2333                 for (i = 0; i < 3; i++)
2334                         do_setitimer(i, &itimer, NULL);
2335                 spin_lock_irq(&current->sighand->siglock);
2336                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2337                         __flush_signals(current);
2338                         flush_signal_handlers(current, 1);
2339                         sigemptyset(&current->blocked);
2340                 }
2341                 spin_unlock_irq(&current->sighand->siglock);
2342         }
2343
2344         /* Wake up the parent if it is waiting so that it can recheck
2345          * wait permission to the new task SID. */
2346         read_lock(&tasklist_lock);
2347         __wake_up_parent(current, current->real_parent);
2348         read_unlock(&tasklist_lock);
2349 }
2350
2351 /* superblock security operations */
2352
2353 static int selinux_sb_alloc_security(struct super_block *sb)
2354 {
2355         return superblock_alloc_security(sb);
2356 }
2357
2358 static void selinux_sb_free_security(struct super_block *sb)
2359 {
2360         superblock_free_security(sb);
2361 }
2362
2363 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2364 {
2365         if (plen > olen)
2366                 return 0;
2367
2368         return !memcmp(prefix, option, plen);
2369 }
2370
2371 static inline int selinux_option(char *option, int len)
2372 {
2373         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2374                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2375                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2376                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2377                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2378 }
2379
2380 static inline void take_option(char **to, char *from, int *first, int len)
2381 {
2382         if (!*first) {
2383                 **to = ',';
2384                 *to += 1;
2385         } else
2386                 *first = 0;
2387         memcpy(*to, from, len);
2388         *to += len;
2389 }
2390
2391 static inline void take_selinux_option(char **to, char *from, int *first,
2392                                        int len)
2393 {
2394         int current_size = 0;
2395
2396         if (!*first) {
2397                 **to = '|';
2398                 *to += 1;
2399         } else
2400                 *first = 0;
2401
2402         while (current_size < len) {
2403                 if (*from != '"') {
2404                         **to = *from;
2405                         *to += 1;
2406                 }
2407                 from += 1;
2408                 current_size += 1;
2409         }
2410 }
2411
2412 static int selinux_sb_copy_data(char *orig, char *copy)
2413 {
2414         int fnosec, fsec, rc = 0;
2415         char *in_save, *in_curr, *in_end;
2416         char *sec_curr, *nosec_save, *nosec;
2417         int open_quote = 0;
2418
2419         in_curr = orig;
2420         sec_curr = copy;
2421
2422         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2423         if (!nosec) {
2424                 rc = -ENOMEM;
2425                 goto out;
2426         }
2427
2428         nosec_save = nosec;
2429         fnosec = fsec = 1;
2430         in_save = in_end = orig;
2431
2432         do {
2433                 if (*in_end == '"')
2434                         open_quote = !open_quote;
2435                 if ((*in_end == ',' && open_quote == 0) ||
2436                                 *in_end == '\0') {
2437                         int len = in_end - in_curr;
2438
2439                         if (selinux_option(in_curr, len))
2440                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2441                         else
2442                                 take_option(&nosec, in_curr, &fnosec, len);
2443
2444                         in_curr = in_end + 1;
2445                 }
2446         } while (*in_end++);
2447
2448         strcpy(in_save, nosec_save);
2449         free_page((unsigned long)nosec_save);
2450 out:
2451         return rc;
2452 }
2453
2454 static int selinux_sb_remount(struct super_block *sb, void *data)
2455 {
2456         int rc, i, *flags;
2457         struct security_mnt_opts opts;
2458         char *secdata, **mount_options;
2459         struct superblock_security_struct *sbsec = sb->s_security;
2460
2461         if (!(sbsec->flags & SE_SBINITIALIZED))
2462                 return 0;
2463
2464         if (!data)
2465                 return 0;
2466
2467         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2468                 return 0;
2469
2470         security_init_mnt_opts(&opts);
2471         secdata = alloc_secdata();
2472         if (!secdata)
2473                 return -ENOMEM;
2474         rc = selinux_sb_copy_data(data, secdata);
2475         if (rc)
2476                 goto out_free_secdata;
2477
2478         rc = selinux_parse_opts_str(secdata, &opts);
2479         if (rc)
2480                 goto out_free_secdata;
2481
2482         mount_options = opts.mnt_opts;
2483         flags = opts.mnt_opts_flags;
2484
2485         for (i = 0; i < opts.num_mnt_opts; i++) {
2486                 u32 sid;
2487                 size_t len;
2488
2489                 if (flags[i] == SBLABEL_MNT)
2490                         continue;
2491                 len = strlen(mount_options[i]);
2492                 rc = security_context_to_sid(mount_options[i], len, &sid);
2493                 if (rc) {
2494                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2495                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2496                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2497                         goto out_free_opts;
2498                 }
2499                 rc = -EINVAL;
2500                 switch (flags[i]) {
2501                 case FSCONTEXT_MNT:
2502                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2503                                 goto out_bad_option;
2504                         break;
2505                 case CONTEXT_MNT:
2506                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2507                                 goto out_bad_option;
2508                         break;
2509                 case ROOTCONTEXT_MNT: {
2510                         struct inode_security_struct *root_isec;
2511                         root_isec = sb->s_root->d_inode->i_security;
2512
2513                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2514                                 goto out_bad_option;
2515                         break;
2516                 }
2517                 case DEFCONTEXT_MNT:
2518                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2519                                 goto out_bad_option;
2520                         break;
2521                 default:
2522                         goto out_free_opts;
2523                 }
2524         }
2525
2526         rc = 0;
2527 out_free_opts:
2528         security_free_mnt_opts(&opts);
2529 out_free_secdata:
2530         free_secdata(secdata);
2531         return rc;
2532 out_bad_option:
2533         printk(KERN_WARNING "SELinux: unable to change security options "
2534                "during remount (dev %s, type=%s)\n", sb->s_id,
2535                sb->s_type->name);
2536         goto out_free_opts;
2537 }
2538
2539 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2540 {
2541         const struct cred *cred = current_cred();
2542         struct common_audit_data ad;
2543         int rc;
2544
2545         rc = superblock_doinit(sb, data);
2546         if (rc)
2547                 return rc;
2548
2549         /* Allow all mounts performed by the kernel */
2550         if (flags & MS_KERNMOUNT)
2551                 return 0;
2552
2553         ad.type = LSM_AUDIT_DATA_DENTRY;
2554         ad.u.dentry = sb->s_root;
2555         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2556 }
2557
2558 static int selinux_sb_statfs(struct dentry *dentry)
2559 {
2560         const struct cred *cred = current_cred();
2561         struct common_audit_data ad;
2562
2563         ad.type = LSM_AUDIT_DATA_DENTRY;
2564         ad.u.dentry = dentry->d_sb->s_root;
2565         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2566 }
2567
2568 static int selinux_mount(const char *dev_name,
2569                          struct path *path,
2570                          const char *type,
2571                          unsigned long flags,
2572                          void *data)
2573 {
2574         const struct cred *cred = current_cred();
2575
2576         if (flags & MS_REMOUNT)
2577                 return superblock_has_perm(cred, path->dentry->d_sb,
2578                                            FILESYSTEM__REMOUNT, NULL);
2579         else
2580                 return path_has_perm(cred, path, FILE__MOUNTON);
2581 }
2582
2583 static int selinux_umount(struct vfsmount *mnt, int flags)
2584 {
2585         const struct cred *cred = current_cred();
2586
2587         return superblock_has_perm(cred, mnt->mnt_sb,
2588                                    FILESYSTEM__UNMOUNT, NULL);
2589 }
2590
2591 /* inode security operations */
2592
2593 static int selinux_inode_alloc_security(struct inode *inode)
2594 {
2595         return inode_alloc_security(inode);
2596 }
2597
2598 static void selinux_inode_free_security(struct inode *inode)
2599 {
2600         inode_free_security(inode);
2601 }
2602
2603 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2604                                         struct qstr *name, void **ctx,
2605                                         u32 *ctxlen)
2606 {
2607         const struct cred *cred = current_cred();
2608         struct task_security_struct *tsec;
2609         struct inode_security_struct *dsec;
2610         struct superblock_security_struct *sbsec;
2611         struct inode *dir = dentry->d_parent->d_inode;
2612         u32 newsid;
2613         int rc;
2614
2615         tsec = cred->security;
2616         dsec = dir->i_security;
2617         sbsec = dir->i_sb->s_security;
2618
2619         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2620                 newsid = tsec->create_sid;
2621         } else {
2622                 rc = security_transition_sid(tsec->sid, dsec->sid,
2623                                              inode_mode_to_security_class(mode),
2624                                              name,
2625                                              &newsid);
2626                 if (rc) {
2627                         printk(KERN_WARNING
2628                                 "%s: security_transition_sid failed, rc=%d\n",
2629                                __func__, -rc);
2630                         return rc;
2631                 }
2632         }
2633
2634         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2635 }
2636
2637 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2638                                        const struct qstr *qstr,
2639                                        const char **name,
2640                                        void **value, size_t *len)
2641 {
2642         const struct task_security_struct *tsec = current_security();
2643         struct inode_security_struct *dsec;
2644         struct superblock_security_struct *sbsec;
2645         u32 sid, newsid, clen;
2646         int rc;
2647         char *context;
2648
2649         dsec = dir->i_security;
2650         sbsec = dir->i_sb->s_security;
2651
2652         sid = tsec->sid;
2653         newsid = tsec->create_sid;
2654
2655         if ((sbsec->flags & SE_SBINITIALIZED) &&
2656             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2657                 newsid = sbsec->mntpoint_sid;
2658         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2659                 rc = security_transition_sid(sid, dsec->sid,
2660                                              inode_mode_to_security_class(inode->i_mode),
2661                                              qstr, &newsid);
2662                 if (rc) {
2663                         printk(KERN_WARNING "%s:  "
2664                                "security_transition_sid failed, rc=%d (dev=%s "
2665                                "ino=%ld)\n",
2666                                __func__,
2667                                -rc, inode->i_sb->s_id, inode->i_ino);
2668                         return rc;
2669                 }
2670         }
2671
2672         /* Possibly defer initialization to selinux_complete_init. */
2673         if (sbsec->flags & SE_SBINITIALIZED) {
2674                 struct inode_security_struct *isec = inode->i_security;
2675                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2676                 isec->sid = newsid;
2677                 isec->initialized = 1;
2678         }
2679
2680         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2681                 return -EOPNOTSUPP;
2682
2683         if (name)
2684                 *name = XATTR_SELINUX_SUFFIX;
2685
2686         if (value && len) {
2687                 rc = security_sid_to_context_force(newsid, &context, &clen);
2688                 if (rc)
2689                         return rc;
2690                 *value = context;
2691                 *len = clen;
2692         }
2693
2694         return 0;
2695 }
2696
2697 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2698 {
2699         return may_create(dir, dentry, SECCLASS_FILE);
2700 }
2701
2702 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2703 {
2704         return may_link(dir, old_dentry, MAY_LINK);
2705 }
2706
2707 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2708 {
2709         return may_link(dir, dentry, MAY_UNLINK);
2710 }
2711
2712 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2713 {
2714         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2715 }
2716
2717 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2718 {
2719         return may_create(dir, dentry, SECCLASS_DIR);
2720 }
2721
2722 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2723 {
2724         return may_link(dir, dentry, MAY_RMDIR);
2725 }
2726
2727 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2728 {
2729         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2730 }
2731
2732 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2733                                 struct inode *new_inode, struct dentry *new_dentry)
2734 {
2735         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2736 }
2737
2738 static int selinux_inode_readlink(struct dentry *dentry)
2739 {
2740         const struct cred *cred = current_cred();
2741
2742         return dentry_has_perm(cred, dentry, FILE__READ);
2743 }
2744
2745 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2746 {
2747         const struct cred *cred = current_cred();
2748
2749         return dentry_has_perm(cred, dentry, FILE__READ);
2750 }
2751
2752 static noinline int audit_inode_permission(struct inode *inode,
2753                                            u32 perms, u32 audited, u32 denied,
2754                                            unsigned flags)
2755 {
2756         struct common_audit_data ad;
2757         struct inode_security_struct *isec = inode->i_security;
2758         int rc;
2759
2760         ad.type = LSM_AUDIT_DATA_INODE;
2761         ad.u.inode = inode;
2762
2763         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2764                             audited, denied, &ad, flags);
2765         if (rc)
2766                 return rc;
2767         return 0;
2768 }
2769
2770 static int selinux_inode_permission(struct inode *inode, int mask)
2771 {
2772         const struct cred *cred = current_cred();
2773         u32 perms;
2774         bool from_access;
2775         unsigned flags = mask & MAY_NOT_BLOCK;
2776         struct inode_security_struct *isec;
2777         u32 sid;
2778         struct av_decision avd;
2779         int rc, rc2;
2780         u32 audited, denied;
2781
2782         from_access = mask & MAY_ACCESS;
2783         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2784
2785         /* No permission to check.  Existence test. */
2786         if (!mask)
2787                 return 0;
2788
2789         validate_creds(cred);
2790
2791         if (unlikely(IS_PRIVATE(inode)))
2792                 return 0;
2793
2794         perms = file_mask_to_av(inode->i_mode, mask);
2795
2796         sid = cred_sid(cred);
2797         isec = inode->i_security;
2798
2799         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2800         audited = avc_audit_required(perms, &avd, rc,
2801                                      from_access ? FILE__AUDIT_ACCESS : 0,
2802                                      &denied);
2803         if (likely(!audited))
2804                 return rc;
2805
2806         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2807         if (rc2)
2808                 return rc2;
2809         return rc;
2810 }
2811
2812 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2813 {
2814         const struct cred *cred = current_cred();
2815         unsigned int ia_valid = iattr->ia_valid;
2816         __u32 av = FILE__WRITE;
2817
2818         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2819         if (ia_valid & ATTR_FORCE) {
2820                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2821                               ATTR_FORCE);
2822                 if (!ia_valid)
2823                         return 0;
2824         }
2825
2826         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2827                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2828                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2829
2830         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2831                 av |= FILE__OPEN;
2832
2833         return dentry_has_perm(cred, dentry, av);
2834 }
2835
2836 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2837 {
2838         const struct cred *cred = current_cred();
2839         struct path path;
2840
2841         path.dentry = dentry;
2842         path.mnt = mnt;
2843
2844         return path_has_perm(cred, &path, FILE__GETATTR);
2845 }
2846
2847 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2848 {
2849         const struct cred *cred = current_cred();
2850
2851         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2852                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2853                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2854                         if (!capable(CAP_SETFCAP))
2855                                 return -EPERM;
2856                 } else if (!capable(CAP_SYS_ADMIN)) {
2857                         /* A different attribute in the security namespace.
2858                            Restrict to administrator. */
2859                         return -EPERM;
2860                 }
2861         }
2862
2863         /* Not an attribute we recognize, so just check the
2864            ordinary setattr permission. */
2865         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2866 }
2867
2868 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2869                                   const void *value, size_t size, int flags)
2870 {
2871         struct inode *inode = dentry->d_inode;
2872         struct inode_security_struct *isec = inode->i_security;
2873         struct superblock_security_struct *sbsec;
2874         struct common_audit_data ad;
2875         u32 newsid, sid = current_sid();
2876         int rc = 0;
2877
2878         if (strcmp(name, XATTR_NAME_SELINUX))
2879                 return selinux_inode_setotherxattr(dentry, name);
2880
2881         sbsec = inode->i_sb->s_security;
2882         if (!(sbsec->flags & SBLABEL_MNT))
2883                 return -EOPNOTSUPP;
2884
2885         if (!inode_owner_or_capable(inode))
2886                 return -EPERM;
2887
2888         ad.type = LSM_AUDIT_DATA_DENTRY;
2889         ad.u.dentry = dentry;
2890
2891         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2892                           FILE__RELABELFROM, &ad);
2893         if (rc)
2894                 return rc;
2895
2896         rc = security_context_to_sid(value, size, &newsid);
2897         if (rc == -EINVAL) {
2898                 if (!capable(CAP_MAC_ADMIN)) {
2899                         struct audit_buffer *ab;
2900                         size_t audit_size;
2901                         const char *str;
2902
2903                         /* We strip a nul only if it is at the end, otherwise the
2904                          * context contains a nul and we should audit that */
2905                         if (value) {
2906                                 str = value;
2907                                 if (str[size - 1] == '\0')
2908                                         audit_size = size - 1;
2909                                 else
2910                                         audit_size = size;
2911                         } else {
2912                                 str = "";
2913                                 audit_size = 0;
2914                         }
2915                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2916                         audit_log_format(ab, "op=setxattr invalid_context=");
2917                         audit_log_n_untrustedstring(ab, value, audit_size);
2918                         audit_log_end(ab);
2919
2920                         return rc;
2921                 }
2922                 rc = security_context_to_sid_force(value, size, &newsid);
2923         }
2924         if (rc)
2925                 return rc;
2926
2927         rc = avc_has_perm(sid, newsid, isec->sclass,
2928                           FILE__RELABELTO, &ad);
2929         if (rc)
2930                 return rc;
2931
2932         rc = security_validate_transition(isec->sid, newsid, sid,
2933                                           isec->sclass);
2934         if (rc)
2935                 return rc;
2936
2937         return avc_has_perm(newsid,
2938                             sbsec->sid,
2939                             SECCLASS_FILESYSTEM,
2940                             FILESYSTEM__ASSOCIATE,
2941                             &ad);
2942 }
2943
2944 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2945                                         const void *value, size_t size,
2946                                         int flags)
2947 {
2948         struct inode *inode = dentry->d_inode;
2949         struct inode_security_struct *isec = inode->i_security;
2950         u32 newsid;
2951         int rc;
2952
2953         if (strcmp(name, XATTR_NAME_SELINUX)) {
2954                 /* Not an attribute we recognize, so nothing to do. */
2955                 return;
2956         }
2957
2958         rc = security_context_to_sid_force(value, size, &newsid);
2959         if (rc) {
2960                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2961                        "for (%s, %lu), rc=%d\n",
2962                        inode->i_sb->s_id, inode->i_ino, -rc);
2963                 return;
2964         }
2965
2966         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2967         isec->sid = newsid;
2968         isec->initialized = 1;
2969
2970         return;
2971 }
2972
2973 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2974 {
2975         const struct cred *cred = current_cred();
2976
2977         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2978 }
2979
2980 static int selinux_inode_listxattr(struct dentry *dentry)
2981 {
2982         const struct cred *cred = current_cred();
2983
2984         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2985 }
2986
2987 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2988 {
2989         if (strcmp(name, XATTR_NAME_SELINUX))
2990                 return selinux_inode_setotherxattr(dentry, name);
2991
2992         /* No one is allowed to remove a SELinux security label.
2993            You can change the label, but all data must be labeled. */
2994         return -EACCES;
2995 }
2996
2997 /*
2998  * Copy the inode security context value to the user.
2999  *
3000  * Permission check is handled by selinux_inode_getxattr hook.
3001  */
3002 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3003 {
3004         u32 size;
3005         int error;
3006         char *context = NULL;
3007         struct inode_security_struct *isec = inode->i_security;
3008
3009         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3010                 return -EOPNOTSUPP;
3011
3012         /*
3013          * If the caller has CAP_MAC_ADMIN, then get the raw context
3014          * value even if it is not defined by current policy; otherwise,
3015          * use the in-core value under current policy.
3016          * Use the non-auditing forms of the permission checks since
3017          * getxattr may be called by unprivileged processes commonly
3018          * and lack of permission just means that we fall back to the
3019          * in-core context value, not a denial.
3020          */
3021         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3022                                 SECURITY_CAP_NOAUDIT);
3023         if (!error)
3024                 error = security_sid_to_context_force(isec->sid, &context,
3025                                                       &size);
3026         else
3027                 error = security_sid_to_context(isec->sid, &context, &size);
3028         if (error)
3029                 return error;
3030         error = size;
3031         if (alloc) {
3032                 *buffer = context;
3033                 goto out_nofree;
3034         }
3035         kfree(context);
3036 out_nofree:
3037         return error;
3038 }
3039
3040 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3041                                      const void *value, size_t size, int flags)
3042 {
3043         struct inode_security_struct *isec = inode->i_security;
3044         u32 newsid;
3045         int rc;
3046
3047         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3048                 return -EOPNOTSUPP;
3049
3050         if (!value || !size)
3051                 return -EACCES;
3052
3053         rc = security_context_to_sid((void *)value, size, &newsid);
3054         if (rc)
3055                 return rc;
3056
3057         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3058         isec->sid = newsid;
3059         isec->initialized = 1;
3060         return 0;
3061 }
3062
3063 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3064 {
3065         const int len = sizeof(XATTR_NAME_SELINUX);
3066         if (buffer && len <= buffer_size)
3067                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3068         return len;
3069 }
3070
3071 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3072 {
3073         struct inode_security_struct *isec = inode->i_security;
3074         *secid = isec->sid;
3075 }
3076
3077 /* file security operations */
3078
3079 static int selinux_revalidate_file_permission(struct file *file, int mask)
3080 {
3081         const struct cred *cred = current_cred();
3082         struct inode *inode = file_inode(file);
3083
3084         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3085         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3086                 mask |= MAY_APPEND;
3087
3088         return file_has_perm(cred, file,
3089                              file_mask_to_av(inode->i_mode, mask));
3090 }
3091
3092 static int selinux_file_permission(struct file *file, int mask)
3093 {
3094         struct inode *inode = file_inode(file);
3095         struct file_security_struct *fsec = file->f_security;
3096         struct inode_security_struct *isec = inode->i_security;
3097         u32 sid = current_sid();
3098
3099         if (!mask)
3100                 /* No permission to check.  Existence test. */
3101                 return 0;
3102
3103         if (sid == fsec->sid && fsec->isid == isec->sid &&
3104             fsec->pseqno == avc_policy_seqno())
3105                 /* No change since file_open check. */
3106                 return 0;
3107
3108         return selinux_revalidate_file_permission(file, mask);
3109 }
3110
3111 static int selinux_file_alloc_security(struct file *file)
3112 {
3113         return file_alloc_security(file);
3114 }
3115
3116 static void selinux_file_free_security(struct file *file)
3117 {
3118         file_free_security(file);
3119 }
3120
3121 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3122                               unsigned long arg)
3123 {
3124         const struct cred *cred = current_cred();
3125         int error = 0;
3126
3127         switch (cmd) {
3128         case FIONREAD:
3129         /* fall through */
3130         case FIBMAP:
3131         /* fall through */
3132         case FIGETBSZ:
3133         /* fall through */
3134         case FS_IOC_GETFLAGS:
3135         /* fall through */
3136         case FS_IOC_GETVERSION:
3137                 error = file_has_perm(cred, file, FILE__GETATTR);
3138                 break;
3139
3140         case FS_IOC_SETFLAGS:
3141         /* fall through */
3142         case FS_IOC_SETVERSION:
3143                 error = file_has_perm(cred, file, FILE__SETATTR);
3144                 break;
3145
3146         /* sys_ioctl() checks */
3147         case FIONBIO:
3148         /* fall through */
3149         case FIOASYNC:
3150                 error = file_has_perm(cred, file, 0);
3151                 break;
3152
3153         case KDSKBENT:
3154         case KDSKBSENT:
3155                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3156                                             SECURITY_CAP_AUDIT);
3157                 break;
3158
3159         /* default case assumes that the command will go
3160          * to the file's ioctl() function.
3161          */
3162         default:
3163                 error = file_has_perm(cred, file, FILE__IOCTL);
3164         }
3165         return error;
3166 }
3167
3168 static int default_noexec;
3169
3170 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3171 {
3172         const struct cred *cred = current_cred();
3173         int rc = 0;
3174
3175         if (default_noexec &&
3176             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3177                 /*
3178                  * We are making executable an anonymous mapping or a
3179                  * private file mapping that will also be writable.
3180                  * This has an additional check.
3181                  */
3182                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3183                 if (rc)
3184                         goto error;
3185         }
3186
3187         if (file) {
3188                 /* read access is always possible with a mapping */
3189                 u32 av = FILE__READ;
3190
3191                 /* write access only matters if the mapping is shared */
3192                 if (shared && (prot & PROT_WRITE))
3193                         av |= FILE__WRITE;
3194
3195                 if (prot & PROT_EXEC)
3196                         av |= FILE__EXECUTE;
3197
3198                 return file_has_perm(cred, file, av);
3199         }
3200
3201 error:
3202         return rc;
3203 }
3204
3205 static int selinux_mmap_addr(unsigned long addr)
3206 {
3207         int rc = 0;
3208         u32 sid = current_sid();
3209
3210         /*
3211          * notice that we are intentionally putting the SELinux check before
3212          * the secondary cap_file_mmap check.  This is such a likely attempt
3213          * at bad behaviour/exploit that we always want to get the AVC, even
3214          * if DAC would have also denied the operation.
3215          */
3216         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3217                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3218                                   MEMPROTECT__MMAP_ZERO, NULL);
3219                 if (rc)
3220                         return rc;
3221         }
3222
3223         /* do DAC check on address space usage */
3224         return cap_mmap_addr(addr);
3225 }
3226
3227 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3228                              unsigned long prot, unsigned long flags)
3229 {
3230         if (selinux_checkreqprot)
3231                 prot = reqprot;
3232
3233         return file_map_prot_check(file, prot,
3234                                    (flags & MAP_TYPE) == MAP_SHARED);
3235 }
3236
3237 static int selinux_file_mprotect(struct vm_area_struct *vma,
3238                                  unsigned long reqprot,
3239                                  unsigned long prot)
3240 {
3241         const struct cred *cred = current_cred();
3242
3243         if (selinux_checkreqprot)
3244                 prot = reqprot;
3245
3246         if (default_noexec &&
3247             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3248                 int rc = 0;
3249                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3250                     vma->vm_end <= vma->vm_mm->brk) {
3251                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3252                 } else if (!vma->vm_file &&
3253                            vma->vm_start <= vma->vm_mm->start_stack &&
3254                            vma->vm_end >= vma->vm_mm->start_stack) {
3255                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3256                 } else if (vma->vm_file && vma->anon_vma) {
3257                         /*
3258                          * We are making executable a file mapping that has
3259                          * had some COW done. Since pages might have been
3260                          * written, check ability to execute the possibly
3261                          * modified content.  This typically should only
3262                          * occur for text relocations.
3263                          */
3264                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3265                 }
3266                 if (rc)
3267                         return rc;
3268         }
3269
3270         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3271 }
3272
3273 static int selinux_file_lock(struct file *file, unsigned int cmd)
3274 {
3275         const struct cred *cred = current_cred();
3276
3277         return file_has_perm(cred, file, FILE__LOCK);
3278 }
3279
3280 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3281                               unsigned long arg)
3282 {
3283         const struct cred *cred = current_cred();
3284         int err = 0;
3285
3286         switch (cmd) {
3287         case F_SETFL:
3288                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3289                         err = file_has_perm(cred, file, FILE__WRITE);
3290                         break;
3291                 }
3292                 /* fall through */
3293         case F_SETOWN:
3294         case F_SETSIG:
3295         case F_GETFL:
3296         case F_GETOWN:
3297         case F_GETSIG:
3298         case F_GETOWNER_UIDS:
3299                 /* Just check FD__USE permission */
3300                 err = file_has_perm(cred, file, 0);
3301                 break;
3302         case F_GETLK:
3303         case F_SETLK:
3304         case F_SETLKW:
3305         case F_GETLKP:
3306         case F_SETLKP:
3307         case F_SETLKPW:
3308 #if BITS_PER_LONG == 32
3309         case F_GETLK64:
3310         case F_SETLK64:
3311         case F_SETLKW64:
3312 #endif
3313                 err = file_has_perm(cred, file, FILE__LOCK);
3314                 break;
3315         }
3316
3317         return err;
3318 }
3319
3320 static int selinux_file_set_fowner(struct file *file)
3321 {
3322         struct file_security_struct *fsec;
3323
3324         fsec = file->f_security;
3325         fsec->fown_sid = current_sid();
3326
3327         return 0;
3328 }
3329
3330 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3331                                        struct fown_struct *fown, int signum)
3332 {
3333         struct file *file;
3334         u32 sid = task_sid(tsk);
3335         u32 perm;
3336         struct file_security_struct *fsec;
3337
3338         /* struct fown_struct is never outside the context of a struct file */
3339         file = container_of(fown, struct file, f_owner);
3340
3341         fsec = file->f_security;
3342
3343         if (!signum)
3344                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3345         else
3346                 perm = signal_to_av(signum);
3347
3348         return avc_has_perm(fsec->fown_sid, sid,
3349                             SECCLASS_PROCESS, perm, NULL);
3350 }
3351
3352 static int selinux_file_receive(struct file *file)
3353 {
3354         const struct cred *cred = current_cred();
3355
3356         return file_has_perm(cred, file, file_to_av(file));
3357 }
3358
3359 static int selinux_file_open(struct file *file, const struct cred *cred)
3360 {
3361         struct file_security_struct *fsec;
3362         struct inode_security_struct *isec;
3363
3364         fsec = file->f_security;
3365         isec = file_inode(file)->i_security;
3366         /*
3367          * Save inode label and policy sequence number
3368          * at open-time so that selinux_file_permission
3369          * can determine whether revalidation is necessary.
3370          * Task label is already saved in the file security
3371          * struct as its SID.
3372          */
3373         fsec->isid = isec->sid;
3374         fsec->pseqno = avc_policy_seqno();
3375         /*
3376          * Since the inode label or policy seqno may have changed
3377          * between the selinux_inode_permission check and the saving
3378          * of state above, recheck that access is still permitted.
3379          * Otherwise, access might never be revalidated against the
3380          * new inode label or new policy.
3381          * This check is not redundant - do not remove.
3382          */
3383         return file_path_has_perm(cred, file, open_file_to_av(file));
3384 }
3385
3386 /* task security operations */
3387
3388 static int selinux_task_create(unsigned long clone_flags)
3389 {
3390         return current_has_perm(current, PROCESS__FORK);
3391 }
3392
3393 /*
3394  * allocate the SELinux part of blank credentials
3395  */
3396 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3397 {
3398         struct task_security_struct *tsec;
3399
3400         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3401         if (!tsec)
3402                 return -ENOMEM;
3403
3404         cred->security = tsec;
3405         return 0;
3406 }
3407
3408 /*
3409  * detach and free the LSM part of a set of credentials
3410  */
3411 static void selinux_cred_free(struct cred *cred)
3412 {
3413         struct task_security_struct *tsec = cred->security;
3414
3415         /*
3416          * cred->security == NULL if security_cred_alloc_blank() or
3417          * security_prepare_creds() returned an error.
3418          */
3419         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3420         cred->security = (void *) 0x7UL;
3421         kfree(tsec);
3422 }
3423
3424 /*
3425  * prepare a new set of credentials for modification
3426  */
3427 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3428                                 gfp_t gfp)
3429 {
3430         const struct task_security_struct *old_tsec;
3431         struct task_security_struct *tsec;
3432
3433         old_tsec = old->security;
3434
3435         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3436         if (!tsec)
3437                 return -ENOMEM;
3438
3439         new->security = tsec;
3440         return 0;
3441 }
3442
3443 /*
3444  * transfer the SELinux data to a blank set of creds
3445  */
3446 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3447 {
3448         const struct task_security_struct *old_tsec = old->security;
3449         struct task_security_struct *tsec = new->security;
3450
3451         *tsec = *old_tsec;
3452 }
3453
3454 /*
3455  * set the security data for a kernel service
3456  * - all the creation contexts are set to unlabelled
3457  */
3458 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3459 {
3460         struct task_security_struct *tsec = new->security;
3461         u32 sid = current_sid();
3462         int ret;
3463
3464         ret = avc_has_perm(sid, secid,
3465                            SECCLASS_KERNEL_SERVICE,
3466                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3467                            NULL);
3468         if (ret == 0) {
3469                 tsec->sid = secid;
3470                 tsec->create_sid = 0;
3471                 tsec->keycreate_sid = 0;
3472                 tsec->sockcreate_sid = 0;
3473         }
3474         return ret;
3475 }
3476
3477 /*
3478  * set the file creation context in a security record to the same as the
3479  * objective context of the specified inode
3480  */
3481 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3482 {
3483         struct inode_security_struct *isec = inode->i_security;
3484         struct task_security_struct *tsec = new->security;
3485         u32 sid = current_sid();
3486         int ret;
3487
3488         ret = avc_has_perm(sid, isec->sid,
3489                            SECCLASS_KERNEL_SERVICE,
3490                            KERNEL_SERVICE__CREATE_FILES_AS,
3491                            NULL);
3492
3493         if (ret == 0)
3494                 tsec->create_sid = isec->sid;
3495         return ret;
3496 }
3497
3498 static int selinux_kernel_module_request(char *kmod_name)
3499 {
3500         u32 sid;
3501         struct common_audit_data ad;
3502
3503         sid = task_sid(current);
3504
3505         ad.type = LSM_AUDIT_DATA_KMOD;
3506         ad.u.kmod_name = kmod_name;
3507
3508         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3509                             SYSTEM__MODULE_REQUEST, &ad);
3510 }
3511
3512 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3513 {
3514         return current_has_perm(p, PROCESS__SETPGID);
3515 }
3516
3517 static int selinux_task_getpgid(struct task_struct *p)
3518 {
3519         return current_has_perm(p, PROCESS__GETPGID);
3520 }
3521
3522 static int selinux_task_getsid(struct task_struct *p)
3523 {
3524         return current_has_perm(p, PROCESS__GETSESSION);
3525 }
3526
3527 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3528 {
3529         *secid = task_sid(p);
3530 }
3531
3532 static int selinux_task_setnice(struct task_struct *p, int nice)
3533 {
3534         int rc;
3535
3536         rc = cap_task_setnice(p, nice);
3537         if (rc)
3538                 return rc;
3539
3540         return current_has_perm(p, PROCESS__SETSCHED);
3541 }
3542
3543 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3544 {
3545         int rc;
3546
3547         rc = cap_task_setioprio(p, ioprio);
3548         if (rc)
3549                 return rc;
3550
3551         return current_has_perm(p, PROCESS__SETSCHED);
3552 }
3553
3554 static int selinux_task_getioprio(struct task_struct *p)
3555 {
3556         return current_has_perm(p, PROCESS__GETSCHED);
3557 }
3558
3559 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3560                 struct rlimit *new_rlim)
3561 {
3562         struct rlimit *old_rlim = p->signal->rlim + resource;
3563
3564         /* Control the ability to change the hard limit (whether
3565            lowering or raising it), so that the hard limit can
3566            later be used as a safe reset point for the soft limit
3567            upon context transitions.  See selinux_bprm_committing_creds. */
3568         if (old_rlim->rlim_max != new_rlim->rlim_max)
3569                 return current_has_perm(p, PROCESS__SETRLIMIT);
3570
3571         return 0;
3572 }
3573
3574 static int selinux_task_setscheduler(struct task_struct *p)
3575 {
3576         int rc;
3577
3578         rc = cap_task_setscheduler(p);
3579         if (rc)
3580                 return rc;
3581
3582         return current_has_perm(p, PROCESS__SETSCHED);
3583 }
3584
3585 static int selinux_task_getscheduler(struct task_struct *p)
3586 {
3587         return current_has_perm(p, PROCESS__GETSCHED);
3588 }
3589
3590 static int selinux_task_movememory(struct task_struct *p)
3591 {
3592         return current_has_perm(p, PROCESS__SETSCHED);
3593 }
3594
3595 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3596                                 int sig, u32 secid)
3597 {
3598         u32 perm;
3599         int rc;
3600
3601         if (!sig)
3602                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3603         else
3604                 perm = signal_to_av(sig);
3605         if (secid)
3606                 rc = avc_has_perm(secid, task_sid(p),
3607                                   SECCLASS_PROCESS, perm, NULL);
3608         else
3609                 rc = current_has_perm(p, perm);
3610         return rc;
3611 }
3612
3613 static int selinux_task_wait(struct task_struct *p)
3614 {
3615         return task_has_perm(p, current, PROCESS__SIGCHLD);
3616 }
3617
3618 static void selinux_task_to_inode(struct task_struct *p,
3619                                   struct inode *inode)
3620 {
3621         struct inode_security_struct *isec = inode->i_security;
3622         u32 sid = task_sid(p);
3623
3624         isec->sid = sid;
3625         isec->initialized = 1;
3626 }
3627
3628 /* Returns error only if unable to parse addresses */
3629 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3630                         struct common_audit_data *ad, u8 *proto)
3631 {
3632         int offset, ihlen, ret = -EINVAL;
3633         struct iphdr _iph, *ih;
3634
3635         offset = skb_network_offset(skb);
3636         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3637         if (ih == NULL)
3638                 goto out;
3639
3640         ihlen = ih->ihl * 4;
3641         if (ihlen < sizeof(_iph))
3642                 goto out;
3643
3644         ad->u.net->v4info.saddr = ih->saddr;
3645         ad->u.net->v4info.daddr = ih->daddr;
3646         ret = 0;
3647
3648         if (proto)
3649                 *proto = ih->protocol;
3650
3651         switch (ih->protocol) {
3652         case IPPROTO_TCP: {
3653                 struct tcphdr _tcph, *th;
3654
3655                 if (ntohs(ih->frag_off) & IP_OFFSET)
3656                         break;
3657
3658                 offset += ihlen;
3659                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3660                 if (th == NULL)
3661                         break;
3662
3663                 ad->u.net->sport = th->source;
3664                 ad->u.net->dport = th->dest;
3665                 break;
3666         }
3667
3668         case IPPROTO_UDP: {
3669                 struct udphdr _udph, *uh;
3670
3671                 if (ntohs(ih->frag_off) & IP_OFFSET)
3672                         break;
3673
3674                 offset += ihlen;
3675                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3676                 if (uh == NULL)
3677                         break;
3678
3679                 ad->u.net->sport = uh->source;
3680                 ad->u.net->dport = uh->dest;
3681                 break;
3682         }
3683
3684         case IPPROTO_DCCP: {
3685                 struct dccp_hdr _dccph, *dh;
3686
3687                 if (ntohs(ih->frag_off) & IP_OFFSET)
3688                         break;
3689
3690                 offset += ihlen;
3691                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3692                 if (dh == NULL)
3693                         break;
3694
3695                 ad->u.net->sport = dh->dccph_sport;
3696                 ad->u.net->dport = dh->dccph_dport;
3697                 break;
3698         }
3699
3700         default:
3701                 break;
3702         }
3703 out:
3704         return ret;
3705 }
3706
3707 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3708
3709 /* Returns error only if unable to parse addresses */
3710 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3711                         struct common_audit_data *ad, u8 *proto)
3712 {
3713         u8 nexthdr;
3714         int ret = -EINVAL, offset;
3715         struct ipv6hdr _ipv6h, *ip6;
3716         __be16 frag_off;
3717
3718         offset = skb_network_offset(skb);
3719         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3720         if (ip6 == NULL)
3721                 goto out;
3722
3723         ad->u.net->v6info.saddr = ip6->saddr;
3724         ad->u.net->v6info.daddr = ip6->daddr;
3725         ret = 0;
3726
3727         nexthdr = ip6->nexthdr;
3728         offset += sizeof(_ipv6h);
3729         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3730         if (offset < 0)
3731                 goto out;
3732
3733         if (proto)
3734                 *proto = nexthdr;
3735
3736         switch (nexthdr) {
3737         case IPPROTO_TCP: {
3738                 struct tcphdr _tcph, *th;
3739
3740                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3741                 if (th == NULL)
3742                         break;
3743
3744                 ad->u.net->sport = th->source;
3745                 ad->u.net->dport = th->dest;
3746                 break;
3747         }
3748
3749         case IPPROTO_UDP: {
3750                 struct udphdr _udph, *uh;
3751
3752                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3753                 if (uh == NULL)
3754                         break;
3755
3756                 ad->u.net->sport = uh->source;
3757                 ad->u.net->dport = uh->dest;
3758                 break;
3759         }
3760
3761         case IPPROTO_DCCP: {
3762                 struct dccp_hdr _dccph, *dh;
3763
3764                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3765                 if (dh == NULL)
3766                         break;
3767
3768                 ad->u.net->sport = dh->dccph_sport;
3769                 ad->u.net->dport = dh->dccph_dport;
3770                 break;
3771         }
3772
3773         /* includes fragments */
3774         default:
3775                 break;
3776         }
3777 out:
3778         return ret;
3779 }
3780
3781 #endif /* IPV6 */
3782
3783 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3784                              char **_addrp, int src, u8 *proto)
3785 {
3786         char *addrp;
3787         int ret;
3788
3789         switch (ad->u.net->family) {
3790         case PF_INET:
3791                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3792                 if (ret)
3793                         goto parse_error;
3794                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3795                                        &ad->u.net->v4info.daddr);
3796                 goto okay;
3797
3798 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3799         case PF_INET6:
3800                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3801                 if (ret)
3802                         goto parse_error;
3803                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3804                                        &ad->u.net->v6info.daddr);
3805                 goto okay;
3806 #endif  /* IPV6 */
3807         default:
3808                 addrp = NULL;
3809                 goto okay;
3810         }
3811
3812 parse_error:
3813         printk(KERN_WARNING
3814                "SELinux: failure in selinux_parse_skb(),"
3815                " unable to parse packet\n");
3816         return ret;
3817
3818 okay:
3819         if (_addrp)
3820                 *_addrp = addrp;
3821         return 0;
3822 }
3823
3824 /**
3825  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3826  * @skb: the packet
3827  * @family: protocol family
3828  * @sid: the packet's peer label SID
3829  *
3830  * Description:
3831  * Check the various different forms of network peer labeling and determine
3832  * the peer label/SID for the packet; most of the magic actually occurs in
3833  * the security server function security_net_peersid_cmp().  The function
3834  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3835  * or -EACCES if @sid is invalid due to inconsistencies with the different
3836  * peer labels.
3837  *
3838  */
3839 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3840 {
3841         int err;
3842         u32 xfrm_sid;
3843         u32 nlbl_sid;
3844         u32 nlbl_type;
3845
3846         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3847         if (unlikely(err))
3848                 return -EACCES;
3849         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3850         if (unlikely(err))
3851                 return -EACCES;
3852
3853         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3854         if (unlikely(err)) {
3855                 printk(KERN_WARNING
3856                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3857                        " unable to determine packet's peer label\n");
3858                 return -EACCES;
3859         }
3860
3861         return 0;
3862 }
3863
3864 /**
3865  * selinux_conn_sid - Determine the child socket label for a connection
3866  * @sk_sid: the parent socket's SID
3867  * @skb_sid: the packet's SID
3868  * @conn_sid: the resulting connection SID
3869  *
3870  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3871  * combined with the MLS information from @skb_sid in order to create
3872  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3873  * of @sk_sid.  Returns zero on success, negative values on failure.
3874  *
3875  */
3876 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3877 {
3878         int err = 0;
3879
3880         if (skb_sid != SECSID_NULL)
3881                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3882         else
3883                 *conn_sid = sk_sid;
3884
3885         return err;
3886 }
3887
3888 /* socket security operations */
3889
3890 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3891                                  u16 secclass, u32 *socksid)
3892 {
3893         if (tsec->sockcreate_sid > SECSID_NULL) {
3894                 *socksid = tsec->sockcreate_sid;
3895                 return 0;
3896         }
3897
3898         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3899                                        socksid);
3900 }
3901
3902 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3903 {
3904         struct sk_security_struct *sksec = sk->sk_security;
3905         struct common_audit_data ad;
3906         struct lsm_network_audit net = {0,};
3907         u32 tsid = task_sid(task);
3908
3909         if (sksec->sid == SECINITSID_KERNEL)
3910                 return 0;
3911
3912         ad.type = LSM_AUDIT_DATA_NET;
3913         ad.u.net = &net;
3914         ad.u.net->sk = sk;
3915
3916         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3917 }
3918
3919 static int selinux_socket_create(int family, int type,
3920                                  int protocol, int kern)
3921 {
3922         const struct task_security_struct *tsec = current_security();
3923         u32 newsid;
3924         u16 secclass;
3925         int rc;
3926
3927         if (kern)
3928                 return 0;
3929
3930         secclass = socket_type_to_security_class(family, type, protocol);
3931         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3932         if (rc)
3933                 return rc;
3934
3935         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3936 }
3937
3938 static int selinux_socket_post_create(struct socket *sock, int family,
3939                                       int type, int protocol, int kern)
3940 {
3941         const struct task_security_struct *tsec = current_security();
3942         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3943         struct sk_security_struct *sksec;
3944         int err = 0;
3945
3946         isec->sclass = socket_type_to_security_class(family, type, protocol);
3947
3948         if (kern)
3949                 isec->sid = SECINITSID_KERNEL;
3950         else {
3951                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3952                 if (err)
3953                         return err;
3954         }
3955
3956         isec->initialized = 1;
3957
3958         if (sock->sk) {
3959                 sksec = sock->sk->sk_security;
3960                 sksec->sid = isec->sid;
3961                 sksec->sclass = isec->sclass;
3962                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3963         }
3964
3965         return err;
3966 }
3967
3968 /* Range of port numbers used to automatically bind.
3969    Need to determine whether we should perform a name_bind
3970    permission check between the socket and the port number. */
3971
3972 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3973 {
3974         struct sock *sk = sock->sk;
3975         u16 family;
3976         int err;
3977
3978         err = sock_has_perm(current, sk, SOCKET__BIND);
3979         if (err)
3980                 goto out;
3981
3982         /*
3983          * If PF_INET or PF_INET6, check name_bind permission for the port.
3984          * Multiple address binding for SCTP is not supported yet: we just
3985          * check the first address now.
3986          */
3987         family = sk->sk_family;
3988         if (family == PF_INET || family == PF_INET6) {
3989                 char *addrp;
3990                 struct sk_security_struct *sksec = sk->sk_security;
3991                 struct common_audit_data ad;
3992                 struct lsm_network_audit net = {0,};
3993                 struct sockaddr_in *addr4 = NULL;
3994                 struct sockaddr_in6 *addr6 = NULL;
3995                 unsigned short snum;
3996                 u32 sid, node_perm;
3997
3998                 if (family == PF_INET) {
3999                         addr4 = (struct sockaddr_in *)address;
4000                         snum = ntohs(addr4->sin_port);
4001                         addrp = (char *)&addr4->sin_addr.s_addr;
4002                 } else {
4003                         addr6 = (struct sockaddr_in6 *)address;
4004                         snum = ntohs(addr6->sin6_port);
4005                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4006                 }
4007
4008                 if (snum) {
4009                         int low, high;
4010
4011                         inet_get_local_port_range(sock_net(sk), &low, &high);
4012
4013                         if (snum < max(PROT_SOCK, low) || snum > high) {
4014                                 err = sel_netport_sid(sk->sk_protocol,
4015                                                       snum, &sid);
4016                                 if (err)
4017                                         goto out;
4018                                 ad.type = LSM_AUDIT_DATA_NET;
4019                                 ad.u.net = &net;
4020                                 ad.u.net->sport = htons(snum);
4021                                 ad.u.net->family = family;
4022                                 err = avc_has_perm(sksec->sid, sid,
4023                                                    sksec->sclass,
4024                                                    SOCKET__NAME_BIND, &ad);
4025                                 if (err)
4026                                         goto out;
4027                         }
4028                 }
4029
4030                 switch (sksec->sclass) {
4031                 case SECCLASS_TCP_SOCKET:
4032                         node_perm = TCP_SOCKET__NODE_BIND;
4033                         break;
4034
4035                 case SECCLASS_UDP_SOCKET:
4036                         node_perm = UDP_SOCKET__NODE_BIND;
4037                         break;
4038
4039                 case SECCLASS_DCCP_SOCKET:
4040                         node_perm = DCCP_SOCKET__NODE_BIND;
4041                         break;
4042
4043                 default:
4044                         node_perm = RAWIP_SOCKET__NODE_BIND;
4045                         break;
4046                 }
4047
4048                 err = sel_netnode_sid(addrp, family, &sid);
4049                 if (err)
4050                         goto out;
4051
4052                 ad.type = LSM_AUDIT_DATA_NET;
4053                 ad.u.net = &net;
4054                 ad.u.net->sport = htons(snum);
4055                 ad.u.net->family = family;
4056
4057                 if (family == PF_INET)
4058                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4059                 else
4060                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4061
4062                 err = avc_has_perm(sksec->sid, sid,
4063                                    sksec->sclass, node_perm, &ad);
4064                 if (err)
4065                         goto out;
4066         }
4067 out:
4068         return err;
4069 }
4070
4071 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4072 {
4073         struct sock *sk = sock->sk;
4074         struct sk_security_struct *sksec = sk->sk_security;
4075         int err;
4076
4077         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4078         if (err)
4079                 return err;
4080
4081         /*
4082          * If a TCP or DCCP socket, check name_connect permission for the port.
4083          */
4084         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4085             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4086                 struct common_audit_data ad;
4087                 struct lsm_network_audit net = {0,};
4088                 struct sockaddr_in *addr4 = NULL;
4089                 struct sockaddr_in6 *addr6 = NULL;
4090                 unsigned short snum;
4091                 u32 sid, perm;
4092
4093                 if (sk->sk_family == PF_INET) {
4094                         addr4 = (struct sockaddr_in *)address;
4095                         if (addrlen < sizeof(struct sockaddr_in))
4096                                 return -EINVAL;
4097                         snum = ntohs(addr4->sin_port);
4098                 } else {
4099                         addr6 = (struct sockaddr_in6 *)address;
4100                         if (addrlen < SIN6_LEN_RFC2133)
4101                                 return -EINVAL;
4102                         snum = ntohs(addr6->sin6_port);
4103                 }
4104
4105                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4106                 if (err)
4107                         goto out;
4108
4109                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4110                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4111
4112                 ad.type = LSM_AUDIT_DATA_NET;
4113                 ad.u.net = &net;
4114                 ad.u.net->dport = htons(snum);
4115                 ad.u.net->family = sk->sk_family;
4116                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4117                 if (err)
4118                         goto out;
4119         }
4120
4121         err = selinux_netlbl_socket_connect(sk, address);
4122
4123 out:
4124         return err;
4125 }
4126
4127 static int selinux_socket_listen(struct socket *sock, int backlog)
4128 {
4129         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4130 }
4131
4132 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4133 {
4134         int err;
4135         struct inode_security_struct *isec;
4136         struct inode_security_struct *newisec;
4137
4138         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4139         if (err)
4140                 return err;
4141
4142         newisec = SOCK_INODE(newsock)->i_security;
4143
4144         isec = SOCK_INODE(sock)->i_security;
4145         newisec->sclass = isec->sclass;
4146         newisec->sid = isec->sid;
4147         newisec->initialized = 1;
4148
4149         return 0;
4150 }
4151
4152 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4153                                   int size)
4154 {
4155         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4156 }
4157
4158 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4159                                   int size, int flags)
4160 {
4161         return sock_has_perm(current, sock->sk, SOCKET__READ);
4162 }
4163
4164 static int selinux_socket_getsockname(struct socket *sock)
4165 {
4166         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4167 }
4168
4169 static int selinux_socket_getpeername(struct socket *sock)
4170 {
4171         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4172 }
4173
4174 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4175 {
4176         int err;
4177
4178         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4179         if (err)
4180                 return err;
4181
4182         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4183 }
4184
4185 static int selinux_socket_getsockopt(struct socket *sock, int level,
4186                                      int optname)
4187 {
4188         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4189 }
4190
4191 static int selinux_socket_shutdown(struct socket *sock, int how)
4192 {
4193         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4194 }
4195
4196 static int selinux_socket_unix_stream_connect(struct sock *sock,
4197                                               struct sock *other,
4198                                               struct sock *newsk)
4199 {
4200         struct sk_security_struct *sksec_sock = sock->sk_security;
4201         struct sk_security_struct *sksec_other = other->sk_security;
4202         struct sk_security_struct *sksec_new = newsk->sk_security;
4203         struct common_audit_data ad;
4204         struct lsm_network_audit net = {0,};
4205         int err;
4206
4207         ad.type = LSM_AUDIT_DATA_NET;
4208         ad.u.net = &net;
4209         ad.u.net->sk = other;
4210
4211         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4212                            sksec_other->sclass,
4213                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4214         if (err)
4215                 return err;
4216
4217         /* server child socket */
4218         sksec_new->peer_sid = sksec_sock->sid;
4219         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4220                                     &sksec_new->sid);
4221         if (err)
4222                 return err;
4223
4224         /* connecting socket */
4225         sksec_sock->peer_sid = sksec_new->sid;
4226
4227         return 0;
4228 }
4229
4230 static int selinux_socket_unix_may_send(struct socket *sock,
4231                                         struct socket *other)
4232 {
4233         struct sk_security_struct *ssec = sock->sk->sk_security;
4234         struct sk_security_struct *osec = other->sk->sk_security;
4235         struct common_audit_data ad;
4236         struct lsm_network_audit net = {0,};
4237
4238         ad.type = LSM_AUDIT_DATA_NET;
4239         ad.u.net = &net;
4240         ad.u.net->sk = other->sk;
4241
4242         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4243                             &ad);
4244 }
4245
4246 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4247                                     u32 peer_sid,
4248                                     struct common_audit_data *ad)
4249 {
4250         int err;
4251         u32 if_sid;
4252         u32 node_sid;
4253
4254         err = sel_netif_sid(ifindex, &if_sid);
4255         if (err)
4256                 return err;
4257         err = avc_has_perm(peer_sid, if_sid,
4258                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4259         if (err)
4260                 return err;
4261
4262         err = sel_netnode_sid(addrp, family, &node_sid);
4263         if (err)
4264                 return err;
4265         return avc_has_perm(peer_sid, node_sid,
4266                             SECCLASS_NODE, NODE__RECVFROM, ad);
4267 }
4268
4269 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4270                                        u16 family)
4271 {
4272         int err = 0;
4273         struct sk_security_struct *sksec = sk->sk_security;
4274         u32 sk_sid = sksec->sid;
4275         struct common_audit_data ad;
4276         struct lsm_network_audit net = {0,};
4277         char *addrp;
4278
4279         ad.type = LSM_AUDIT_DATA_NET;
4280         ad.u.net = &net;
4281         ad.u.net->netif = skb->skb_iif;
4282         ad.u.net->family = family;
4283         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4284         if (err)
4285                 return err;
4286
4287         if (selinux_secmark_enabled()) {
4288                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4289                                    PACKET__RECV, &ad);
4290                 if (err)
4291                         return err;
4292         }
4293
4294         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4295         if (err)
4296                 return err;
4297         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4298
4299         return err;
4300 }
4301
4302 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4303 {
4304         int err;
4305         struct sk_security_struct *sksec = sk->sk_security;
4306         u16 family = sk->sk_family;
4307         u32 sk_sid = sksec->sid;
4308         struct common_audit_data ad;
4309         struct lsm_network_audit net = {0,};
4310         char *addrp;
4311         u8 secmark_active;
4312         u8 peerlbl_active;
4313
4314         if (family != PF_INET && family != PF_INET6)
4315                 return 0;
4316
4317         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4318         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4319                 family = PF_INET;
4320
4321         /* If any sort of compatibility mode is enabled then handoff processing
4322          * to the selinux_sock_rcv_skb_compat() function to deal with the
4323          * special handling.  We do this in an attempt to keep this function
4324          * as fast and as clean as possible. */
4325         if (!selinux_policycap_netpeer)
4326                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4327
4328         secmark_active = selinux_secmark_enabled();
4329         peerlbl_active = selinux_peerlbl_enabled();
4330         if (!secmark_active && !peerlbl_active)
4331                 return 0;
4332
4333         ad.type = LSM_AUDIT_DATA_NET;
4334         ad.u.net = &net;
4335         ad.u.net->netif = skb->skb_iif;
4336         ad.u.net->family = family;
4337         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4338         if (err)
4339                 return err;
4340
4341         if (peerlbl_active) {
4342                 u32 peer_sid;
4343
4344                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4345                 if (err)
4346                         return err;
4347                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4348                                                peer_sid, &ad);
4349                 if (err) {
4350                         selinux_netlbl_err(skb, err, 0);
4351                         return err;
4352                 }
4353                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4354                                    PEER__RECV, &ad);
4355                 if (err) {
4356                         selinux_netlbl_err(skb, err, 0);
4357                         return err;
4358                 }
4359         }
4360
4361         if (secmark_active) {
4362                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4363                                    PACKET__RECV, &ad);
4364                 if (err)
4365                         return err;
4366         }
4367
4368         return err;
4369 }
4370
4371 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4372                                             int __user *optlen, unsigned len)
4373 {
4374         int err = 0;
4375         char *scontext;
4376         u32 scontext_len;
4377         struct sk_security_struct *sksec = sock->sk->sk_security;
4378         u32 peer_sid = SECSID_NULL;
4379
4380         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4381             sksec->sclass == SECCLASS_TCP_SOCKET)
4382                 peer_sid = sksec->peer_sid;
4383         if (peer_sid == SECSID_NULL)
4384                 return -ENOPROTOOPT;
4385
4386         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4387         if (err)
4388                 return err;
4389
4390         if (scontext_len > len) {
4391                 err = -ERANGE;
4392                 goto out_len;
4393         }
4394
4395         if (copy_to_user(optval, scontext, scontext_len))
4396                 err = -EFAULT;
4397
4398 out_len:
4399         if (put_user(scontext_len, optlen))
4400                 err = -EFAULT;
4401         kfree(scontext);
4402         return err;
4403 }
4404
4405 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4406 {
4407         u32 peer_secid = SECSID_NULL;
4408         u16 family;
4409
4410         if (skb && skb->protocol == htons(ETH_P_IP))
4411                 family = PF_INET;
4412         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4413                 family = PF_INET6;
4414         else if (sock)
4415                 family = sock->sk->sk_family;
4416         else
4417                 goto out;
4418
4419         if (sock && family == PF_UNIX)
4420                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4421         else if (skb)
4422                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4423
4424 out:
4425         *secid = peer_secid;
4426         if (peer_secid == SECSID_NULL)
4427                 return -EINVAL;
4428         return 0;
4429 }
4430
4431 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4432 {
4433         struct sk_security_struct *sksec;
4434
4435         sksec = kzalloc(sizeof(*sksec), priority);
4436         if (!sksec)
4437                 return -ENOMEM;
4438
4439         sksec->peer_sid = SECINITSID_UNLABELED;
4440         sksec->sid = SECINITSID_UNLABELED;
4441         selinux_netlbl_sk_security_reset(sksec);
4442         sk->sk_security = sksec;
4443
4444         return 0;
4445 }
4446
4447 static void selinux_sk_free_security(struct sock *sk)
4448 {
4449         struct sk_security_struct *sksec = sk->sk_security;
4450
4451         sk->sk_security = NULL;
4452         selinux_netlbl_sk_security_free(sksec);
4453         kfree(sksec);
4454 }
4455
4456 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4457 {
4458         struct sk_security_struct *sksec = sk->sk_security;
4459         struct sk_security_struct *newsksec = newsk->sk_security;
4460
4461         newsksec->sid = sksec->sid;
4462         newsksec->peer_sid = sksec->peer_sid;
4463         newsksec->sclass = sksec->sclass;
4464
4465         selinux_netlbl_sk_security_reset(newsksec);
4466 }
4467
4468 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4469 {
4470         if (!sk)
4471                 *secid = SECINITSID_ANY_SOCKET;
4472         else {
4473                 struct sk_security_struct *sksec = sk->sk_security;
4474
4475                 *secid = sksec->sid;
4476         }
4477 }
4478
4479 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4480 {
4481         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4482         struct sk_security_struct *sksec = sk->sk_security;
4483
4484         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4485             sk->sk_family == PF_UNIX)
4486                 isec->sid = sksec->sid;
4487         sksec->sclass = isec->sclass;
4488 }
4489
4490 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4491                                      struct request_sock *req)
4492 {
4493         struct sk_security_struct *sksec = sk->sk_security;
4494         int err;
4495         u16 family = req->rsk_ops->family;
4496         u32 connsid;
4497         u32 peersid;
4498
4499         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4500         if (err)
4501                 return err;
4502         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4503         if (err)
4504                 return err;
4505         req->secid = connsid;
4506         req->peer_secid = peersid;
4507
4508         return selinux_netlbl_inet_conn_request(req, family);
4509 }
4510
4511 static void selinux_inet_csk_clone(struct sock *newsk,
4512                                    const struct request_sock *req)
4513 {
4514         struct sk_security_struct *newsksec = newsk->sk_security;
4515
4516         newsksec->sid = req->secid;
4517         newsksec->peer_sid = req->peer_secid;
4518         /* NOTE: Ideally, we should also get the isec->sid for the
4519            new socket in sync, but we don't have the isec available yet.
4520            So we will wait until sock_graft to do it, by which
4521            time it will have been created and available. */
4522
4523         /* We don't need to take any sort of lock here as we are the only
4524          * thread with access to newsksec */
4525         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4526 }
4527
4528 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4529 {
4530         u16 family = sk->sk_family;
4531         struct sk_security_struct *sksec = sk->sk_security;
4532
4533         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4534         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4535                 family = PF_INET;
4536
4537         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4538 }
4539
4540 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4541 {
4542         skb_set_owner_w(skb, sk);
4543 }
4544
4545 static int selinux_secmark_relabel_packet(u32 sid)
4546 {
4547         const struct task_security_struct *__tsec;
4548         u32 tsid;
4549
4550         __tsec = current_security();
4551         tsid = __tsec->sid;
4552
4553         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4554 }
4555
4556 static void selinux_secmark_refcount_inc(void)
4557 {
4558         atomic_inc(&selinux_secmark_refcount);
4559 }
4560
4561 static void selinux_secmark_refcount_dec(void)
4562 {
4563         atomic_dec(&selinux_secmark_refcount);
4564 }
4565
4566 static void selinux_req_classify_flow(const struct request_sock *req,
4567                                       struct flowi *fl)
4568 {
4569         fl->flowi_secid = req->secid;
4570 }
4571
4572 static int selinux_tun_dev_alloc_security(void **security)
4573 {
4574         struct tun_security_struct *tunsec;
4575
4576         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4577         if (!tunsec)
4578                 return -ENOMEM;
4579         tunsec->sid = current_sid();
4580
4581         *security = tunsec;
4582         return 0;
4583 }
4584
4585 static void selinux_tun_dev_free_security(void *security)
4586 {
4587         kfree(security);
4588 }
4589
4590 static int selinux_tun_dev_create(void)
4591 {
4592         u32 sid = current_sid();
4593
4594         /* we aren't taking into account the "sockcreate" SID since the socket
4595          * that is being created here is not a socket in the traditional sense,
4596          * instead it is a private sock, accessible only to the kernel, and
4597          * representing a wide range of network traffic spanning multiple
4598          * connections unlike traditional sockets - check the TUN driver to
4599          * get a better understanding of why this socket is special */
4600
4601         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4602                             NULL);
4603 }
4604
4605 static int selinux_tun_dev_attach_queue(void *security)
4606 {
4607         struct tun_security_struct *tunsec = security;
4608
4609         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4610                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4611 }
4612
4613 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4614 {
4615         struct tun_security_struct *tunsec = security;
4616         struct sk_security_struct *sksec = sk->sk_security;
4617
4618         /* we don't currently perform any NetLabel based labeling here and it
4619          * isn't clear that we would want to do so anyway; while we could apply
4620          * labeling without the support of the TUN user the resulting labeled
4621          * traffic from the other end of the connection would almost certainly
4622          * cause confusion to the TUN user that had no idea network labeling
4623          * protocols were being used */
4624
4625         sksec->sid = tunsec->sid;
4626         sksec->sclass = SECCLASS_TUN_SOCKET;
4627
4628         return 0;
4629 }
4630
4631 static int selinux_tun_dev_open(void *security)
4632 {
4633         struct tun_security_struct *tunsec = security;
4634         u32 sid = current_sid();
4635         int err;
4636
4637         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4638                            TUN_SOCKET__RELABELFROM, NULL);
4639         if (err)
4640                 return err;
4641         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4642                            TUN_SOCKET__RELABELTO, NULL);
4643         if (err)
4644                 return err;
4645         tunsec->sid = sid;
4646
4647         return 0;
4648 }
4649
4650 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4651 {
4652         int err = 0;
4653         u32 perm;
4654         struct nlmsghdr *nlh;
4655         struct sk_security_struct *sksec = sk->sk_security;
4656
4657         if (skb->len < NLMSG_HDRLEN) {
4658                 err = -EINVAL;
4659                 goto out;
4660         }
4661         nlh = nlmsg_hdr(skb);
4662
4663         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4664         if (err) {
4665                 if (err == -EINVAL) {
4666                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4667                                   "SELinux:  unrecognized netlink message"
4668                                   " type=%hu for sclass=%hu\n",
4669                                   nlh->nlmsg_type, sksec->sclass);
4670                         if (!selinux_enforcing || security_get_allow_unknown())
4671                                 err = 0;
4672                 }
4673
4674                 /* Ignore */
4675                 if (err == -ENOENT)
4676                         err = 0;
4677                 goto out;
4678         }
4679
4680         err = sock_has_perm(current, sk, perm);
4681 out:
4682         return err;
4683 }
4684
4685 #ifdef CONFIG_NETFILTER
4686
4687 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4688                                        u16 family)
4689 {
4690         int err;
4691         char *addrp;
4692         u32 peer_sid;
4693         struct common_audit_data ad;
4694         struct lsm_network_audit net = {0,};
4695         u8 secmark_active;
4696         u8 netlbl_active;
4697         u8 peerlbl_active;
4698
4699         if (!selinux_policycap_netpeer)
4700                 return NF_ACCEPT;
4701
4702         secmark_active = selinux_secmark_enabled();
4703         netlbl_active = netlbl_enabled();
4704         peerlbl_active = selinux_peerlbl_enabled();
4705         if (!secmark_active && !peerlbl_active)
4706                 return NF_ACCEPT;
4707
4708         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4709                 return NF_DROP;
4710
4711         ad.type = LSM_AUDIT_DATA_NET;
4712         ad.u.net = &net;
4713         ad.u.net->netif = ifindex;
4714         ad.u.net->family = family;
4715         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4716                 return NF_DROP;
4717
4718         if (peerlbl_active) {
4719                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4720                                                peer_sid, &ad);
4721                 if (err) {
4722                         selinux_netlbl_err(skb, err, 1);
4723                         return NF_DROP;
4724                 }
4725         }
4726
4727         if (secmark_active)
4728                 if (avc_has_perm(peer_sid, skb->secmark,
4729                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4730                         return NF_DROP;
4731
4732         if (netlbl_active)
4733                 /* we do this in the FORWARD path and not the POST_ROUTING
4734                  * path because we want to make sure we apply the necessary
4735                  * labeling before IPsec is applied so we can leverage AH
4736                  * protection */
4737                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4738                         return NF_DROP;
4739
4740         return NF_ACCEPT;
4741 }
4742
4743 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4744                                          struct sk_buff *skb,
4745                                          const struct net_device *in,
4746                                          const struct net_device *out,
4747                                          int (*okfn)(struct sk_buff *))
4748 {
4749         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4750 }
4751
4752 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4753 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4754                                          struct sk_buff *skb,
4755                                          const struct net_device *in,
4756                                          const struct net_device *out,
4757                                          int (*okfn)(struct sk_buff *))
4758 {
4759         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4760 }
4761 #endif  /* IPV6 */
4762
4763 static unsigned int selinux_ip_output(struct sk_buff *skb,
4764                                       u16 family)
4765 {
4766         struct sock *sk;
4767         u32 sid;
4768
4769         if (!netlbl_enabled())
4770                 return NF_ACCEPT;
4771
4772         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4773          * because we want to make sure we apply the necessary labeling
4774          * before IPsec is applied so we can leverage AH protection */
4775         sk = skb->sk;
4776         if (sk) {
4777                 struct sk_security_struct *sksec;
4778
4779                 if (sk->sk_state == TCP_LISTEN)
4780                         /* if the socket is the listening state then this
4781                          * packet is a SYN-ACK packet which means it needs to
4782                          * be labeled based on the connection/request_sock and
4783                          * not the parent socket.  unfortunately, we can't
4784                          * lookup the request_sock yet as it isn't queued on
4785                          * the parent socket until after the SYN-ACK is sent.
4786                          * the "solution" is to simply pass the packet as-is
4787                          * as any IP option based labeling should be copied
4788                          * from the initial connection request (in the IP
4789                          * layer).  it is far from ideal, but until we get a
4790                          * security label in the packet itself this is the
4791                          * best we can do. */
4792                         return NF_ACCEPT;
4793
4794                 /* standard practice, label using the parent socket */
4795                 sksec = sk->sk_security;
4796                 sid = sksec->sid;
4797         } else
4798                 sid = SECINITSID_KERNEL;
4799         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4800                 return NF_DROP;
4801
4802         return NF_ACCEPT;
4803 }
4804
4805 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4806                                         struct sk_buff *skb,
4807                                         const struct net_device *in,
4808                                         const struct net_device *out,
4809                                         int (*okfn)(struct sk_buff *))
4810 {
4811         return selinux_ip_output(skb, PF_INET);
4812 }
4813
4814 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4815                                                 int ifindex,
4816                                                 u16 family)
4817 {
4818         struct sock *sk = skb->sk;
4819         struct sk_security_struct *sksec;
4820         struct common_audit_data ad;
4821         struct lsm_network_audit net = {0,};
4822         char *addrp;
4823         u8 proto;
4824
4825         if (sk == NULL)
4826                 return NF_ACCEPT;
4827         sksec = sk->sk_security;
4828
4829         ad.type = LSM_AUDIT_DATA_NET;
4830         ad.u.net = &net;
4831         ad.u.net->netif = ifindex;
4832         ad.u.net->family = family;
4833         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4834                 return NF_DROP;
4835
4836         if (selinux_secmark_enabled())
4837                 if (avc_has_perm(sksec->sid, skb->secmark,
4838                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4839                         return NF_DROP_ERR(-ECONNREFUSED);
4840
4841         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4842                 return NF_DROP_ERR(-ECONNREFUSED);
4843
4844         return NF_ACCEPT;
4845 }
4846
4847 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4848                                          u16 family)
4849 {
4850         u32 secmark_perm;
4851         u32 peer_sid;
4852         struct sock *sk;
4853         struct common_audit_data ad;
4854         struct lsm_network_audit net = {0,};
4855         char *addrp;
4856         u8 secmark_active;
4857         u8 peerlbl_active;
4858
4859         /* If any sort of compatibility mode is enabled then handoff processing
4860          * to the selinux_ip_postroute_compat() function to deal with the
4861          * special handling.  We do this in an attempt to keep this function
4862          * as fast and as clean as possible. */
4863         if (!selinux_policycap_netpeer)
4864                 return selinux_ip_postroute_compat(skb, ifindex, family);
4865
4866         secmark_active = selinux_secmark_enabled();
4867         peerlbl_active = selinux_peerlbl_enabled();
4868         if (!secmark_active && !peerlbl_active)
4869                 return NF_ACCEPT;
4870
4871         sk = skb->sk;
4872
4873 #ifdef CONFIG_XFRM
4874         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4875          * packet transformation so allow the packet to pass without any checks
4876          * since we'll have another chance to perform access control checks
4877          * when the packet is on it's final way out.
4878          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4879          *       is NULL, in this case go ahead and apply access control.
4880          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4881          *       TCP listening state we cannot wait until the XFRM processing
4882          *       is done as we will miss out on the SA label if we do;
4883          *       unfortunately, this means more work, but it is only once per
4884          *       connection. */
4885         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4886             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4887                 return NF_ACCEPT;
4888 #endif
4889
4890         if (sk == NULL) {
4891                 /* Without an associated socket the packet is either coming
4892                  * from the kernel or it is being forwarded; check the packet
4893                  * to determine which and if the packet is being forwarded
4894                  * query the packet directly to determine the security label. */
4895                 if (skb->skb_iif) {
4896                         secmark_perm = PACKET__FORWARD_OUT;
4897                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4898                                 return NF_DROP;
4899                 } else {
4900                         secmark_perm = PACKET__SEND;
4901                         peer_sid = SECINITSID_KERNEL;
4902                 }
4903         } else if (sk->sk_state == TCP_LISTEN) {
4904                 /* Locally generated packet but the associated socket is in the
4905                  * listening state which means this is a SYN-ACK packet.  In
4906                  * this particular case the correct security label is assigned
4907                  * to the connection/request_sock but unfortunately we can't
4908                  * query the request_sock as it isn't queued on the parent
4909                  * socket until after the SYN-ACK packet is sent; the only
4910                  * viable choice is to regenerate the label like we do in
4911                  * selinux_inet_conn_request().  See also selinux_ip_output()
4912                  * for similar problems. */
4913                 u32 skb_sid;
4914                 struct sk_security_struct *sksec = sk->sk_security;
4915                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4916                         return NF_DROP;
4917                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4918                  * and the packet has been through at least one XFRM
4919                  * transformation then we must be dealing with the "final"
4920                  * form of labeled IPsec packet; since we've already applied
4921                  * all of our access controls on this packet we can safely
4922                  * pass the packet. */
4923                 if (skb_sid == SECSID_NULL) {
4924                         switch (family) {
4925                         case PF_INET:
4926                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4927                                         return NF_ACCEPT;
4928                                 break;
4929                         case PF_INET6:
4930                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4931                                         return NF_ACCEPT;
4932                         default:
4933                                 return NF_DROP_ERR(-ECONNREFUSED);
4934                         }
4935                 }
4936                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4937                         return NF_DROP;
4938                 secmark_perm = PACKET__SEND;
4939         } else {
4940                 /* Locally generated packet, fetch the security label from the
4941                  * associated socket. */
4942                 struct sk_security_struct *sksec = sk->sk_security;
4943                 peer_sid = sksec->sid;
4944                 secmark_perm = PACKET__SEND;
4945         }
4946
4947         ad.type = LSM_AUDIT_DATA_NET;
4948         ad.u.net = &net;
4949         ad.u.net->netif = ifindex;
4950         ad.u.net->family = family;
4951         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4952                 return NF_DROP;
4953
4954         if (secmark_active)
4955                 if (avc_has_perm(peer_sid, skb->secmark,
4956                                  SECCLASS_PACKET, secmark_perm, &ad))
4957                         return NF_DROP_ERR(-ECONNREFUSED);
4958
4959         if (peerlbl_active) {
4960                 u32 if_sid;
4961                 u32 node_sid;
4962
4963                 if (sel_netif_sid(ifindex, &if_sid))
4964                         return NF_DROP;
4965                 if (avc_has_perm(peer_sid, if_sid,
4966                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4967                         return NF_DROP_ERR(-ECONNREFUSED);
4968
4969                 if (sel_netnode_sid(addrp, family, &node_sid))
4970                         return NF_DROP;
4971                 if (avc_has_perm(peer_sid, node_sid,
4972                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4973                         return NF_DROP_ERR(-ECONNREFUSED);
4974         }
4975
4976         return NF_ACCEPT;
4977 }
4978
4979 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4980                                            struct sk_buff *skb,
4981                                            const struct net_device *in,
4982                                            const struct net_device *out,
4983                                            int (*okfn)(struct sk_buff *))
4984 {
4985         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4986 }
4987
4988 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4989 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4990                                            struct sk_buff *skb,
4991                                            const struct net_device *in,
4992                                            const struct net_device *out,
4993                                            int (*okfn)(struct sk_buff *))
4994 {
4995         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4996 }
4997 #endif  /* IPV6 */
4998
4999 #endif  /* CONFIG_NETFILTER */
5000
5001 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5002 {
5003         int err;
5004
5005         err = cap_netlink_send(sk, skb);
5006         if (err)
5007                 return err;
5008
5009         return selinux_nlmsg_perm(sk, skb);
5010 }
5011
5012 static int ipc_alloc_security(struct task_struct *task,
5013                               struct kern_ipc_perm *perm,
5014                               u16 sclass)
5015 {
5016         struct ipc_security_struct *isec;
5017         u32 sid;
5018
5019         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5020         if (!isec)
5021                 return -ENOMEM;
5022
5023         sid = task_sid(task);
5024         isec->sclass = sclass;
5025         isec->sid = sid;
5026         perm->security = isec;
5027
5028         return 0;
5029 }
5030
5031 static void ipc_free_security(struct kern_ipc_perm *perm)
5032 {
5033         struct ipc_security_struct *isec = perm->security;
5034         perm->security = NULL;
5035         kfree(isec);
5036 }
5037
5038 static int msg_msg_alloc_security(struct msg_msg *msg)
5039 {
5040         struct msg_security_struct *msec;
5041
5042         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5043         if (!msec)
5044                 return -ENOMEM;
5045
5046         msec->sid = SECINITSID_UNLABELED;
5047         msg->security = msec;
5048
5049         return 0;
5050 }
5051
5052 static void msg_msg_free_security(struct msg_msg *msg)
5053 {
5054         struct msg_security_struct *msec = msg->security;
5055
5056         msg->security = NULL;
5057         kfree(msec);
5058 }
5059
5060 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5061                         u32 perms)
5062 {
5063         struct ipc_security_struct *isec;
5064         struct common_audit_data ad;
5065         u32 sid = current_sid();
5066
5067         isec = ipc_perms->security;
5068
5069         ad.type = LSM_AUDIT_DATA_IPC;
5070         ad.u.ipc_id = ipc_perms->key;
5071
5072         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5073 }
5074
5075 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5076 {
5077         return msg_msg_alloc_security(msg);
5078 }
5079
5080 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5081 {
5082         msg_msg_free_security(msg);
5083 }
5084
5085 /* message queue security operations */
5086 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5087 {
5088         struct ipc_security_struct *isec;
5089         struct common_audit_data ad;
5090         u32 sid = current_sid();
5091         int rc;
5092
5093         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5094         if (rc)
5095                 return rc;
5096
5097         isec = msq->q_perm.security;
5098
5099         ad.type = LSM_AUDIT_DATA_IPC;
5100         ad.u.ipc_id = msq->q_perm.key;
5101
5102         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5103                           MSGQ__CREATE, &ad);
5104         if (rc) {
5105                 ipc_free_security(&msq->q_perm);
5106                 return rc;
5107         }
5108         return 0;
5109 }
5110
5111 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5112 {
5113         ipc_free_security(&msq->q_perm);
5114 }
5115
5116 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5117 {
5118         struct ipc_security_struct *isec;
5119         struct common_audit_data ad;
5120         u32 sid = current_sid();
5121
5122         isec = msq->q_perm.security;
5123
5124         ad.type = LSM_AUDIT_DATA_IPC;
5125         ad.u.ipc_id = msq->q_perm.key;
5126
5127         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5128                             MSGQ__ASSOCIATE, &ad);
5129 }
5130
5131 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5132 {
5133         int err;
5134         int perms;
5135
5136         switch (cmd) {
5137         case IPC_INFO:
5138         case MSG_INFO:
5139                 /* No specific object, just general system-wide information. */
5140                 return task_has_system(current, SYSTEM__IPC_INFO);
5141         case IPC_STAT:
5142         case MSG_STAT:
5143                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5144                 break;
5145         case IPC_SET:
5146                 perms = MSGQ__SETATTR;
5147                 break;
5148         case IPC_RMID:
5149                 perms = MSGQ__DESTROY;
5150                 break;
5151         default:
5152                 return 0;
5153         }
5154
5155         err = ipc_has_perm(&msq->q_perm, perms);
5156         return err;
5157 }
5158
5159 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5160 {
5161         struct ipc_security_struct *isec;
5162         struct msg_security_struct *msec;
5163         struct common_audit_data ad;
5164         u32 sid = current_sid();
5165         int rc;
5166
5167         isec = msq->q_perm.security;
5168         msec = msg->security;
5169
5170         /*
5171          * First time through, need to assign label to the message
5172          */
5173         if (msec->sid == SECINITSID_UNLABELED) {
5174                 /*
5175                  * Compute new sid based on current process and
5176                  * message queue this message will be stored in
5177                  */
5178                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5179                                              NULL, &msec->sid);
5180                 if (rc)
5181                         return rc;
5182         }
5183
5184         ad.type = LSM_AUDIT_DATA_IPC;
5185         ad.u.ipc_id = msq->q_perm.key;
5186
5187         /* Can this process write to the queue? */
5188         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5189                           MSGQ__WRITE, &ad);
5190         if (!rc)
5191                 /* Can this process send the message */
5192                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5193                                   MSG__SEND, &ad);
5194         if (!rc)
5195                 /* Can the message be put in the queue? */
5196                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5197                                   MSGQ__ENQUEUE, &ad);
5198
5199         return rc;
5200 }
5201
5202 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5203                                     struct task_struct *target,
5204                                     long type, int mode)
5205 {
5206         struct ipc_security_struct *isec;
5207         struct msg_security_struct *msec;
5208         struct common_audit_data ad;
5209         u32 sid = task_sid(target);
5210         int rc;
5211
5212         isec = msq->q_perm.security;
5213         msec = msg->security;
5214
5215         ad.type = LSM_AUDIT_DATA_IPC;
5216         ad.u.ipc_id = msq->q_perm.key;
5217
5218         rc = avc_has_perm(sid, isec->sid,
5219                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5220         if (!rc)
5221                 rc = avc_has_perm(sid, msec->sid,
5222                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5223         return rc;
5224 }
5225
5226 /* Shared Memory security operations */
5227 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5228 {
5229         struct ipc_security_struct *isec;
5230         struct common_audit_data ad;
5231         u32 sid = current_sid();
5232         int rc;
5233
5234         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5235         if (rc)
5236                 return rc;
5237
5238         isec = shp->shm_perm.security;
5239
5240         ad.type = LSM_AUDIT_DATA_IPC;
5241         ad.u.ipc_id = shp->shm_perm.key;
5242
5243         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5244                           SHM__CREATE, &ad);
5245         if (rc) {
5246                 ipc_free_security(&shp->shm_perm);
5247                 return rc;
5248         }
5249         return 0;
5250 }
5251
5252 static void selinux_shm_free_security(struct shmid_kernel *shp)
5253 {
5254         ipc_free_security(&shp->shm_perm);
5255 }
5256
5257 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5258 {
5259         struct ipc_security_struct *isec;
5260         struct common_audit_data ad;
5261         u32 sid = current_sid();
5262
5263         isec = shp->shm_perm.security;
5264
5265         ad.type = LSM_AUDIT_DATA_IPC;
5266         ad.u.ipc_id = shp->shm_perm.key;
5267
5268         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5269                             SHM__ASSOCIATE, &ad);
5270 }
5271
5272 /* Note, at this point, shp is locked down */
5273 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5274 {
5275         int perms;
5276         int err;
5277
5278         switch (cmd) {
5279         case IPC_INFO:
5280         case SHM_INFO:
5281                 /* No specific object, just general system-wide information. */
5282                 return task_has_system(current, SYSTEM__IPC_INFO);
5283         case IPC_STAT:
5284         case SHM_STAT:
5285                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5286                 break;
5287         case IPC_SET:
5288                 perms = SHM__SETATTR;
5289                 break;
5290         case SHM_LOCK:
5291         case SHM_UNLOCK:
5292                 perms = SHM__LOCK;
5293                 break;
5294         case IPC_RMID:
5295                 perms = SHM__DESTROY;
5296                 break;
5297         default:
5298                 return 0;
5299         }
5300
5301         err = ipc_has_perm(&shp->shm_perm, perms);
5302         return err;
5303 }
5304
5305 static int selinux_shm_shmat(struct shmid_kernel *shp,
5306                              char __user *shmaddr, int shmflg)
5307 {
5308         u32 perms;
5309
5310         if (shmflg & SHM_RDONLY)
5311                 perms = SHM__READ;
5312         else
5313                 perms = SHM__READ | SHM__WRITE;
5314
5315         return ipc_has_perm(&shp->shm_perm, perms);
5316 }
5317
5318 /* Semaphore security operations */
5319 static int selinux_sem_alloc_security(struct sem_array *sma)
5320 {
5321         struct ipc_security_struct *isec;
5322         struct common_audit_data ad;
5323         u32 sid = current_sid();
5324         int rc;
5325
5326         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5327         if (rc)
5328                 return rc;
5329
5330         isec = sma->sem_perm.security;
5331
5332         ad.type = LSM_AUDIT_DATA_IPC;
5333         ad.u.ipc_id = sma->sem_perm.key;
5334
5335         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5336                           SEM__CREATE, &ad);
5337         if (rc) {
5338                 ipc_free_security(&sma->sem_perm);
5339                 return rc;
5340         }
5341         return 0;
5342 }
5343
5344 static void selinux_sem_free_security(struct sem_array *sma)
5345 {
5346         ipc_free_security(&sma->sem_perm);
5347 }
5348
5349 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5350 {
5351         struct ipc_security_struct *isec;
5352         struct common_audit_data ad;
5353         u32 sid = current_sid();
5354
5355         isec = sma->sem_perm.security;
5356
5357         ad.type = LSM_AUDIT_DATA_IPC;
5358         ad.u.ipc_id = sma->sem_perm.key;
5359
5360         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5361                             SEM__ASSOCIATE, &ad);
5362 }
5363
5364 /* Note, at this point, sma is locked down */
5365 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5366 {
5367         int err;
5368         u32 perms;
5369
5370         switch (cmd) {
5371         case IPC_INFO:
5372         case SEM_INFO:
5373                 /* No specific object, just general system-wide information. */
5374                 return task_has_system(current, SYSTEM__IPC_INFO);
5375         case GETPID:
5376         case GETNCNT:
5377         case GETZCNT:
5378                 perms = SEM__GETATTR;
5379                 break;
5380         case GETVAL:
5381         case GETALL:
5382                 perms = SEM__READ;
5383                 break;
5384         case SETVAL:
5385         case SETALL:
5386                 perms = SEM__WRITE;
5387                 break;
5388         case IPC_RMID:
5389                 perms = SEM__DESTROY;
5390                 break;
5391         case IPC_SET:
5392                 perms = SEM__SETATTR;
5393                 break;
5394         case IPC_STAT:
5395         case SEM_STAT:
5396                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5397                 break;
5398         default:
5399                 return 0;
5400         }
5401
5402         err = ipc_has_perm(&sma->sem_perm, perms);
5403         return err;
5404 }
5405
5406 static int selinux_sem_semop(struct sem_array *sma,
5407                              struct sembuf *sops, unsigned nsops, int alter)
5408 {
5409         u32 perms;
5410
5411         if (alter)
5412                 perms = SEM__READ | SEM__WRITE;
5413         else
5414                 perms = SEM__READ;
5415
5416         return ipc_has_perm(&sma->sem_perm, perms);
5417 }
5418
5419 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5420 {
5421         u32 av = 0;
5422
5423         av = 0;
5424         if (flag & S_IRUGO)
5425                 av |= IPC__UNIX_READ;
5426         if (flag & S_IWUGO)
5427                 av |= IPC__UNIX_WRITE;
5428
5429         if (av == 0)
5430                 return 0;
5431
5432         return ipc_has_perm(ipcp, av);
5433 }
5434
5435 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5436 {
5437         struct ipc_security_struct *isec = ipcp->security;
5438         *secid = isec->sid;
5439 }
5440
5441 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5442 {
5443         if (inode)
5444                 inode_doinit_with_dentry(inode, dentry);
5445 }
5446
5447 static int selinux_getprocattr(struct task_struct *p,
5448                                char *name, char **value)
5449 {
5450         const struct task_security_struct *__tsec;
5451         u32 sid;
5452         int error;
5453         unsigned len;
5454
5455         if (current != p) {
5456                 error = current_has_perm(p, PROCESS__GETATTR);
5457                 if (error)
5458                         return error;
5459         }
5460
5461         rcu_read_lock();
5462         __tsec = __task_cred(p)->security;
5463
5464         if (!strcmp(name, "current"))
5465                 sid = __tsec->sid;
5466         else if (!strcmp(name, "prev"))
5467                 sid = __tsec->osid;
5468         else if (!strcmp(name, "exec"))
5469                 sid = __tsec->exec_sid;
5470         else if (!strcmp(name, "fscreate"))
5471                 sid = __tsec->create_sid;
5472         else if (!strcmp(name, "keycreate"))
5473                 sid = __tsec->keycreate_sid;
5474         else if (!strcmp(name, "sockcreate"))
5475                 sid = __tsec->sockcreate_sid;
5476         else
5477                 goto invalid;
5478         rcu_read_unlock();
5479
5480         if (!sid)
5481                 return 0;
5482
5483         error = security_sid_to_context(sid, value, &len);
5484         if (error)
5485                 return error;
5486         return len;
5487
5488 invalid:
5489         rcu_read_unlock();
5490         return -EINVAL;
5491 }
5492
5493 static int selinux_setprocattr(struct task_struct *p,
5494                                char *name, void *value, size_t size)
5495 {
5496         struct task_security_struct *tsec;
5497         struct task_struct *tracer;
5498         struct cred *new;
5499         u32 sid = 0, ptsid;
5500         int error;
5501         char *str = value;
5502
5503         if (current != p) {
5504                 /* SELinux only allows a process to change its own
5505                    security attributes. */
5506                 return -EACCES;
5507         }
5508
5509         /*
5510          * Basic control over ability to set these attributes at all.
5511          * current == p, but we'll pass them separately in case the
5512          * above restriction is ever removed.
5513          */
5514         if (!strcmp(name, "exec"))
5515                 error = current_has_perm(p, PROCESS__SETEXEC);
5516         else if (!strcmp(name, "fscreate"))
5517                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5518         else if (!strcmp(name, "keycreate"))
5519                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5520         else if (!strcmp(name, "sockcreate"))
5521                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5522         else if (!strcmp(name, "current"))
5523                 error = current_has_perm(p, PROCESS__SETCURRENT);
5524         else
5525                 error = -EINVAL;
5526         if (error)
5527                 return error;
5528
5529         /* Obtain a SID for the context, if one was specified. */
5530         if (size && str[1] && str[1] != '\n') {
5531                 if (str[size-1] == '\n') {
5532                         str[size-1] = 0;
5533                         size--;
5534                 }
5535                 error = security_context_to_sid(value, size, &sid);
5536                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5537                         if (!capable(CAP_MAC_ADMIN)) {
5538                                 struct audit_buffer *ab;
5539                                 size_t audit_size;
5540
5541                                 /* We strip a nul only if it is at the end, otherwise the
5542                                  * context contains a nul and we should audit that */
5543                                 if (str[size - 1] == '\0')
5544                                         audit_size = size - 1;
5545                                 else
5546                                         audit_size = size;
5547                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5548                                 audit_log_format(ab, "op=fscreate invalid_context=");
5549                                 audit_log_n_untrustedstring(ab, value, audit_size);
5550                                 audit_log_end(ab);
5551
5552                                 return error;
5553                         }
5554                         error = security_context_to_sid_force(value, size,
5555                                                               &sid);
5556                 }
5557                 if (error)
5558                         return error;
5559         }
5560
5561         new = prepare_creds();
5562         if (!new)
5563                 return -ENOMEM;
5564
5565         /* Permission checking based on the specified context is
5566            performed during the actual operation (execve,
5567            open/mkdir/...), when we know the full context of the
5568            operation.  See selinux_bprm_set_creds for the execve
5569            checks and may_create for the file creation checks. The
5570            operation will then fail if the context is not permitted. */
5571         tsec = new->security;
5572         if (!strcmp(name, "exec")) {
5573                 tsec->exec_sid = sid;
5574         } else if (!strcmp(name, "fscreate")) {
5575                 tsec->create_sid = sid;
5576         } else if (!strcmp(name, "keycreate")) {
5577                 error = may_create_key(sid, p);
5578                 if (error)
5579                         goto abort_change;
5580                 tsec->keycreate_sid = sid;
5581         } else if (!strcmp(name, "sockcreate")) {
5582                 tsec->sockcreate_sid = sid;
5583         } else if (!strcmp(name, "current")) {
5584                 error = -EINVAL;
5585                 if (sid == 0)
5586                         goto abort_change;
5587
5588                 /* Only allow single threaded processes to change context */
5589                 error = -EPERM;
5590                 if (!current_is_single_threaded()) {
5591                         error = security_bounded_transition(tsec->sid, sid);
5592                         if (error)
5593                                 goto abort_change;
5594                 }
5595
5596                 /* Check permissions for the transition. */
5597                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5598                                      PROCESS__DYNTRANSITION, NULL);
5599                 if (error)
5600                         goto abort_change;
5601
5602                 /* Check for ptracing, and update the task SID if ok.
5603                    Otherwise, leave SID unchanged and fail. */
5604                 ptsid = 0;
5605                 rcu_read_lock();
5606                 tracer = ptrace_parent(p);
5607                 if (tracer)
5608                         ptsid = task_sid(tracer);
5609                 rcu_read_unlock();
5610
5611                 if (tracer) {
5612                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5613                                              PROCESS__PTRACE, NULL);
5614                         if (error)
5615                                 goto abort_change;
5616                 }
5617
5618                 tsec->sid = sid;
5619         } else {
5620                 error = -EINVAL;
5621                 goto abort_change;
5622         }
5623
5624         commit_creds(new);
5625         return size;
5626
5627 abort_change:
5628         abort_creds(new);
5629         return error;
5630 }
5631
5632 static int selinux_ismaclabel(const char *name)
5633 {
5634         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5635 }
5636
5637 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5638 {
5639         return security_sid_to_context(secid, secdata, seclen);
5640 }
5641
5642 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5643 {
5644         return security_context_to_sid(secdata, seclen, secid);
5645 }
5646
5647 static void selinux_release_secctx(char *secdata, u32 seclen)
5648 {
5649         kfree(secdata);
5650 }
5651
5652 /*
5653  *      called with inode->i_mutex locked
5654  */
5655 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5656 {
5657         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5658 }
5659
5660 /*
5661  *      called with inode->i_mutex locked
5662  */
5663 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5664 {
5665         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5666 }
5667
5668 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5669 {
5670         int len = 0;
5671         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5672                                                 ctx, true);
5673         if (len < 0)
5674                 return len;
5675         *ctxlen = len;
5676         return 0;
5677 }
5678 #ifdef CONFIG_KEYS
5679
5680 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5681                              unsigned long flags)
5682 {
5683         const struct task_security_struct *tsec;
5684         struct key_security_struct *ksec;
5685
5686         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5687         if (!ksec)
5688                 return -ENOMEM;
5689
5690         tsec = cred->security;
5691         if (tsec->keycreate_sid)
5692                 ksec->sid = tsec->keycreate_sid;
5693         else
5694                 ksec->sid = tsec->sid;
5695
5696         k->security = ksec;
5697         return 0;
5698 }
5699
5700 static void selinux_key_free(struct key *k)
5701 {
5702         struct key_security_struct *ksec = k->security;
5703
5704         k->security = NULL;
5705         kfree(ksec);
5706 }
5707
5708 static int selinux_key_permission(key_ref_t key_ref,
5709                                   const struct cred *cred,
5710                                   key_perm_t perm)
5711 {
5712         struct key *key;
5713         struct key_security_struct *ksec;
5714         u32 sid;
5715
5716         /* if no specific permissions are requested, we skip the
5717            permission check. No serious, additional covert channels
5718            appear to be created. */
5719         if (perm == 0)
5720                 return 0;
5721
5722         sid = cred_sid(cred);
5723
5724         key = key_ref_to_ptr(key_ref);
5725         ksec = key->security;
5726
5727         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5728 }
5729
5730 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5731 {
5732         struct key_security_struct *ksec = key->security;
5733         char *context = NULL;
5734         unsigned len;
5735         int rc;
5736
5737         rc = security_sid_to_context(ksec->sid, &context, &len);
5738         if (!rc)
5739                 rc = len;
5740         *_buffer = context;
5741         return rc;
5742 }
5743
5744 #endif
5745
5746 static struct security_operations selinux_ops = {
5747         .name =                         "selinux",
5748
5749         .ptrace_access_check =          selinux_ptrace_access_check,
5750         .ptrace_traceme =               selinux_ptrace_traceme,
5751         .capget =                       selinux_capget,
5752         .capset =                       selinux_capset,
5753         .capable =                      selinux_capable,
5754         .quotactl =                     selinux_quotactl,
5755         .quota_on =                     selinux_quota_on,
5756         .syslog =                       selinux_syslog,
5757         .vm_enough_memory =             selinux_vm_enough_memory,
5758
5759         .netlink_send =                 selinux_netlink_send,
5760
5761         .bprm_set_creds =               selinux_bprm_set_creds,
5762         .bprm_committing_creds =        selinux_bprm_committing_creds,
5763         .bprm_committed_creds =         selinux_bprm_committed_creds,
5764         .bprm_secureexec =              selinux_bprm_secureexec,
5765
5766         .sb_alloc_security =            selinux_sb_alloc_security,
5767         .sb_free_security =             selinux_sb_free_security,
5768         .sb_copy_data =                 selinux_sb_copy_data,
5769         .sb_remount =                   selinux_sb_remount,
5770         .sb_kern_mount =                selinux_sb_kern_mount,
5771         .sb_show_options =              selinux_sb_show_options,
5772         .sb_statfs =                    selinux_sb_statfs,
5773         .sb_mount =                     selinux_mount,
5774         .sb_umount =                    selinux_umount,
5775         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5776         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5777         .sb_parse_opts_str =            selinux_parse_opts_str,
5778
5779         .dentry_init_security =         selinux_dentry_init_security,
5780
5781         .inode_alloc_security =         selinux_inode_alloc_security,
5782         .inode_free_security =          selinux_inode_free_security,
5783         .inode_init_security =          selinux_inode_init_security,
5784         .inode_create =                 selinux_inode_create,
5785         .inode_link =                   selinux_inode_link,
5786         .inode_unlink =                 selinux_inode_unlink,
5787         .inode_symlink =                selinux_inode_symlink,
5788         .inode_mkdir =                  selinux_inode_mkdir,
5789         .inode_rmdir =                  selinux_inode_rmdir,
5790         .inode_mknod =                  selinux_inode_mknod,
5791         .inode_rename =                 selinux_inode_rename,
5792         .inode_readlink =               selinux_inode_readlink,
5793         .inode_follow_link =            selinux_inode_follow_link,
5794         .inode_permission =             selinux_inode_permission,
5795         .inode_setattr =                selinux_inode_setattr,
5796         .inode_getattr =                selinux_inode_getattr,
5797         .inode_setxattr =               selinux_inode_setxattr,
5798         .inode_post_setxattr =          selinux_inode_post_setxattr,
5799         .inode_getxattr =               selinux_inode_getxattr,
5800         .inode_listxattr =              selinux_inode_listxattr,
5801         .inode_removexattr =            selinux_inode_removexattr,
5802         .inode_getsecurity =            selinux_inode_getsecurity,
5803         .inode_setsecurity =            selinux_inode_setsecurity,
5804         .inode_listsecurity =           selinux_inode_listsecurity,
5805         .inode_getsecid =               selinux_inode_getsecid,
5806
5807         .file_permission =              selinux_file_permission,
5808         .file_alloc_security =          selinux_file_alloc_security,
5809         .file_free_security =           selinux_file_free_security,
5810         .file_ioctl =                   selinux_file_ioctl,
5811         .mmap_file =                    selinux_mmap_file,
5812         .mmap_addr =                    selinux_mmap_addr,
5813         .file_mprotect =                selinux_file_mprotect,
5814         .file_lock =                    selinux_file_lock,
5815         .file_fcntl =                   selinux_file_fcntl,
5816         .file_set_fowner =              selinux_file_set_fowner,
5817         .file_send_sigiotask =          selinux_file_send_sigiotask,
5818         .file_receive =                 selinux_file_receive,
5819
5820         .file_open =                    selinux_file_open,
5821
5822         .task_create =                  selinux_task_create,
5823         .cred_alloc_blank =             selinux_cred_alloc_blank,
5824         .cred_free =                    selinux_cred_free,
5825         .cred_prepare =                 selinux_cred_prepare,
5826         .cred_transfer =                selinux_cred_transfer,
5827         .kernel_act_as =                selinux_kernel_act_as,
5828         .kernel_create_files_as =       selinux_kernel_create_files_as,
5829         .kernel_module_request =        selinux_kernel_module_request,
5830         .task_setpgid =                 selinux_task_setpgid,
5831         .task_getpgid =                 selinux_task_getpgid,
5832         .task_getsid =                  selinux_task_getsid,
5833         .task_getsecid =                selinux_task_getsecid,
5834         .task_setnice =                 selinux_task_setnice,
5835         .task_setioprio =               selinux_task_setioprio,
5836         .task_getioprio =               selinux_task_getioprio,
5837         .task_setrlimit =               selinux_task_setrlimit,
5838         .task_setscheduler =            selinux_task_setscheduler,
5839         .task_getscheduler =            selinux_task_getscheduler,
5840         .task_movememory =              selinux_task_movememory,
5841         .task_kill =                    selinux_task_kill,
5842         .task_wait =                    selinux_task_wait,
5843         .task_to_inode =                selinux_task_to_inode,
5844
5845         .ipc_permission =               selinux_ipc_permission,
5846         .ipc_getsecid =                 selinux_ipc_getsecid,
5847
5848         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5849         .msg_msg_free_security =        selinux_msg_msg_free_security,
5850
5851         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5852         .msg_queue_free_security =      selinux_msg_queue_free_security,
5853         .msg_queue_associate =          selinux_msg_queue_associate,
5854         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5855         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5856         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5857
5858         .shm_alloc_security =           selinux_shm_alloc_security,
5859         .shm_free_security =            selinux_shm_free_security,
5860         .shm_associate =                selinux_shm_associate,
5861         .shm_shmctl =                   selinux_shm_shmctl,
5862         .shm_shmat =                    selinux_shm_shmat,
5863
5864         .sem_alloc_security =           selinux_sem_alloc_security,
5865         .sem_free_security =            selinux_sem_free_security,
5866         .sem_associate =                selinux_sem_associate,
5867         .sem_semctl =                   selinux_sem_semctl,
5868         .sem_semop =                    selinux_sem_semop,
5869
5870         .d_instantiate =                selinux_d_instantiate,
5871
5872         .getprocattr =                  selinux_getprocattr,
5873         .setprocattr =                  selinux_setprocattr,
5874
5875         .ismaclabel =                   selinux_ismaclabel,
5876         .secid_to_secctx =              selinux_secid_to_secctx,
5877         .secctx_to_secid =              selinux_secctx_to_secid,
5878         .release_secctx =               selinux_release_secctx,
5879         .inode_notifysecctx =           selinux_inode_notifysecctx,
5880         .inode_setsecctx =              selinux_inode_setsecctx,
5881         .inode_getsecctx =              selinux_inode_getsecctx,
5882
5883         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5884         .unix_may_send =                selinux_socket_unix_may_send,
5885
5886         .socket_create =                selinux_socket_create,
5887         .socket_post_create =           selinux_socket_post_create,
5888         .socket_bind =                  selinux_socket_bind,
5889         .socket_connect =               selinux_socket_connect,
5890         .socket_listen =                selinux_socket_listen,
5891         .socket_accept =                selinux_socket_accept,
5892         .socket_sendmsg =               selinux_socket_sendmsg,
5893         .socket_recvmsg =               selinux_socket_recvmsg,
5894         .socket_getsockname =           selinux_socket_getsockname,
5895         .socket_getpeername =           selinux_socket_getpeername,
5896         .socket_getsockopt =            selinux_socket_getsockopt,
5897         .socket_setsockopt =            selinux_socket_setsockopt,
5898         .socket_shutdown =              selinux_socket_shutdown,
5899         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5900         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5901         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5902         .sk_alloc_security =            selinux_sk_alloc_security,
5903         .sk_free_security =             selinux_sk_free_security,
5904         .sk_clone_security =            selinux_sk_clone_security,
5905         .sk_getsecid =                  selinux_sk_getsecid,
5906         .sock_graft =                   selinux_sock_graft,
5907         .inet_conn_request =            selinux_inet_conn_request,
5908         .inet_csk_clone =               selinux_inet_csk_clone,
5909         .inet_conn_established =        selinux_inet_conn_established,
5910         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5911         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5912         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5913         .req_classify_flow =            selinux_req_classify_flow,
5914         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5915         .tun_dev_free_security =        selinux_tun_dev_free_security,
5916         .tun_dev_create =               selinux_tun_dev_create,
5917         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5918         .tun_dev_attach =               selinux_tun_dev_attach,
5919         .tun_dev_open =                 selinux_tun_dev_open,
5920         .skb_owned_by =                 selinux_skb_owned_by,
5921
5922 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5923         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5924         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5925         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5926         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5927         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5928         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5929         .xfrm_state_free_security =     selinux_xfrm_state_free,
5930         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5931         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5932         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5933         .xfrm_decode_session =          selinux_xfrm_decode_session,
5934 #endif
5935
5936 #ifdef CONFIG_KEYS
5937         .key_alloc =                    selinux_key_alloc,
5938         .key_free =                     selinux_key_free,
5939         .key_permission =               selinux_key_permission,
5940         .key_getsecurity =              selinux_key_getsecurity,
5941 #endif
5942
5943 #ifdef CONFIG_AUDIT
5944         .audit_rule_init =              selinux_audit_rule_init,
5945         .audit_rule_known =             selinux_audit_rule_known,
5946         .audit_rule_match =             selinux_audit_rule_match,
5947         .audit_rule_free =              selinux_audit_rule_free,
5948 #endif
5949 };
5950
5951 static __init int selinux_init(void)
5952 {
5953         if (!security_module_enable(&selinux_ops)) {
5954                 selinux_enabled = 0;
5955                 return 0;
5956         }
5957
5958         if (!selinux_enabled) {
5959                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5960                 return 0;
5961         }
5962
5963         printk(KERN_INFO "SELinux:  Initializing.\n");
5964
5965         /* Set the security state for the initial task. */
5966         cred_init_security();
5967
5968         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5969
5970         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5971                                             sizeof(struct inode_security_struct),
5972                                             0, SLAB_PANIC, NULL);
5973         avc_init();
5974
5975         if (register_security(&selinux_ops))
5976                 panic("SELinux: Unable to register with kernel.\n");
5977
5978         if (selinux_enforcing)
5979                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5980         else
5981                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5982
5983         return 0;
5984 }
5985
5986 static void delayed_superblock_init(struct super_block *sb, void *unused)
5987 {
5988         superblock_doinit(sb, NULL);
5989 }
5990
5991 void selinux_complete_init(void)
5992 {
5993         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5994
5995         /* Set up any superblocks initialized prior to the policy load. */
5996         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5997         iterate_supers(delayed_superblock_init, NULL);
5998 }
5999
6000 /* SELinux requires early initialization in order to label
6001    all processes and objects when they are created. */
6002 security_initcall(selinux_init);
6003
6004 #if defined(CONFIG_NETFILTER)
6005
6006 static struct nf_hook_ops selinux_ipv4_ops[] = {
6007         {
6008                 .hook =         selinux_ipv4_postroute,
6009                 .owner =        THIS_MODULE,
6010                 .pf =           NFPROTO_IPV4,
6011                 .hooknum =      NF_INET_POST_ROUTING,
6012                 .priority =     NF_IP_PRI_SELINUX_LAST,
6013         },
6014         {
6015                 .hook =         selinux_ipv4_forward,
6016                 .owner =        THIS_MODULE,
6017                 .pf =           NFPROTO_IPV4,
6018                 .hooknum =      NF_INET_FORWARD,
6019                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6020         },
6021         {
6022                 .hook =         selinux_ipv4_output,
6023                 .owner =        THIS_MODULE,
6024                 .pf =           NFPROTO_IPV4,
6025                 .hooknum =      NF_INET_LOCAL_OUT,
6026                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6027         }
6028 };
6029
6030 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6031
6032 static struct nf_hook_ops selinux_ipv6_ops[] = {
6033         {
6034                 .hook =         selinux_ipv6_postroute,
6035                 .owner =        THIS_MODULE,
6036                 .pf =           NFPROTO_IPV6,
6037                 .hooknum =      NF_INET_POST_ROUTING,
6038                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6039         },
6040         {
6041                 .hook =         selinux_ipv6_forward,
6042                 .owner =        THIS_MODULE,
6043                 .pf =           NFPROTO_IPV6,
6044                 .hooknum =      NF_INET_FORWARD,
6045                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6046         }
6047 };
6048
6049 #endif  /* IPV6 */
6050
6051 static int __init selinux_nf_ip_init(void)
6052 {
6053         int err = 0;
6054
6055         if (!selinux_enabled)
6056                 goto out;
6057
6058         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6059
6060         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6061         if (err)
6062                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6063
6064 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6065         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6066         if (err)
6067                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6068 #endif  /* IPV6 */
6069
6070 out:
6071         return err;
6072 }
6073
6074 __initcall(selinux_nf_ip_init);
6075
6076 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6077 static void selinux_nf_ip_exit(void)
6078 {
6079         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6080
6081         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6082 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6083         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6084 #endif  /* IPV6 */
6085 }
6086 #endif
6087
6088 #else /* CONFIG_NETFILTER */
6089
6090 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6091 #define selinux_nf_ip_exit()
6092 #endif
6093
6094 #endif /* CONFIG_NETFILTER */
6095
6096 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6097 static int selinux_disabled;
6098
6099 int selinux_disable(void)
6100 {
6101         if (ss_initialized) {
6102                 /* Not permitted after initial policy load. */
6103                 return -EINVAL;
6104         }
6105
6106         if (selinux_disabled) {
6107                 /* Only do this once. */
6108                 return -EINVAL;
6109         }
6110
6111         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6112
6113         selinux_disabled = 1;
6114         selinux_enabled = 0;
6115
6116         reset_security_ops();
6117
6118         /* Try to destroy the avc node cache */
6119         avc_disable();
6120
6121         /* Unregister netfilter hooks. */
6122         selinux_nf_ip_exit();
6123
6124         /* Unregister selinuxfs. */
6125         exit_sel_fs();
6126
6127         return 0;
6128 }
6129 #endif