security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define NUM_SEL_MNT_OPTS 5
  98
  99 extern struct security_operations *security_ops;
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!strict_strtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!strict_strtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (atomic_read(&selinux_secmark_refcount) > 0);
 147 }
 148
 149 /*
 150  * initialise the security for the init task
 151  */
 152 static void cred_init_security(void)
 153 {
 154         struct cred *cred = (struct cred *) current->real_cred;
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 panic("SELinux:  Failed to initialize initial task.\n");
 160
 161         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 162         cred->security = tsec;
 163 }
 164
 165 /*
 166  * get the security ID of a set of credentials
 167  */
 168 static inline u32 cred_sid(const struct cred *cred)
 169 {
 170         const struct task_security_struct *tsec;
 171
 172         tsec = cred->security;
 173         return tsec->sid;
 174 }
 175
 176 /*
 177  * get the objective security ID of a task
 178  */
 179 static inline u32 task_sid(const struct task_struct *task)
 180 {
 181         u32 sid;
 182
 183         rcu_read_lock();
 184         sid = cred_sid(__task_cred(task));
 185         rcu_read_unlock();
 186         return sid;
 187 }
 188
 189 /*
 190  * get the subjective security ID of the current task
 191  */
 192 static inline u32 current_sid(void)
 193 {
 194         const struct task_security_struct *tsec = current_security();
 195
 196         return tsec->sid;
 197 }
 198
 199 /* Allocate and free functions for each kind of security blob. */
 200
 201 static int inode_alloc_security(struct inode *inode)
 202 {
 203         struct inode_security_struct *isec;
 204         u32 sid = current_sid();
 205
 206         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 207         if (!isec)
 208                 return -ENOMEM;
 209
 210         mutex_init(&isec->lock);
 211         INIT_LIST_HEAD(&isec->list);
 212         isec->inode = inode;
 213         isec->sid = SECINITSID_UNLABELED;
 214         isec->sclass = SECCLASS_FILE;
 215         isec->task_sid = sid;
 216         inode->i_security = isec;
 217
 218         return 0;
 219 }
 220
 221 static void inode_free_security(struct inode *inode)
 222 {
 223         struct inode_security_struct *isec = inode->i_security;
 224         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 225
 226         spin_lock(&sbsec->isec_lock);
 227         if (!list_empty(&isec->list))
 228                 list_del_init(&isec->list);
 229         spin_unlock(&sbsec->isec_lock);
 230
 231         inode->i_security = NULL;
 232         kmem_cache_free(sel_inode_cache, isec);
 233 }
 234
 235 static int file_alloc_security(struct file *file)
 236 {
 237         struct file_security_struct *fsec;
 238         u32 sid = current_sid();
 239
 240         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 241         if (!fsec)
 242                 return -ENOMEM;
 243
 244         fsec->sid = sid;
 245         fsec->fown_sid = sid;
 246         file->f_security = fsec;
 247
 248         return 0;
 249 }
 250
 251 static void file_free_security(struct file *file)
 252 {
 253         struct file_security_struct *fsec = file->f_security;
 254         file->f_security = NULL;
 255         kfree(fsec);
 256 }
 257
 258 static int superblock_alloc_security(struct super_block *sb)
 259 {
 260         struct superblock_security_struct *sbsec;
 261
 262         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 263         if (!sbsec)
 264                 return -ENOMEM;
 265
 266         mutex_init(&sbsec->lock);
 267         INIT_LIST_HEAD(&sbsec->isec_head);
 268         spin_lock_init(&sbsec->isec_lock);
 269         sbsec->sb = sb;
 270         sbsec->sid = SECINITSID_UNLABELED;
 271         sbsec->def_sid = SECINITSID_FILE;
 272         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 273         sb->s_security = sbsec;
 274
 275         return 0;
 276 }
 277
 278 static void superblock_free_security(struct super_block *sb)
 279 {
 280         struct superblock_security_struct *sbsec = sb->s_security;
 281         sb->s_security = NULL;
 282         kfree(sbsec);
 283 }
 284
 285 /* The file system's label must be initialized prior to use. */
 286
 287 static const char *labeling_behaviors[6] = {
 288         "uses xattr",
 289         "uses transition SIDs",
 290         "uses task SIDs",
 291         "uses genfs_contexts",
 292         "not configured for labeling",
 293         "uses mountpoint labeling",
 294 };
 295
 296 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 297
 298 static inline int inode_doinit(struct inode *inode)
 299 {
 300         return inode_doinit_with_dentry(inode, NULL);
 301 }
 302
 303 enum {
 304         Opt_error = -1,
 305         Opt_context = 1,
 306         Opt_fscontext = 2,
 307         Opt_defcontext = 3,
 308         Opt_rootcontext = 4,
 309         Opt_labelsupport = 5,
 310 };
 311
 312 static const match_table_t tokens = {
 313         {Opt_context, CONTEXT_STR "%s"},
 314         {Opt_fscontext, FSCONTEXT_STR "%s"},
 315         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 316         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 317         {Opt_labelsupport, LABELSUPP_STR},
 318         {Opt_error, NULL},
 319 };
 320
 321 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 322
 323 static int may_context_mount_sb_relabel(u32 sid,
 324                         struct superblock_security_struct *sbsec,
 325                         const struct cred *cred)
 326 {
 327         const struct task_security_struct *tsec = cred->security;
 328         int rc;
 329
 330         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 331                           FILESYSTEM__RELABELFROM, NULL);
 332         if (rc)
 333                 return rc;
 334
 335         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 336                           FILESYSTEM__RELABELTO, NULL);
 337         return rc;
 338 }
 339
 340 static int may_context_mount_inode_relabel(u32 sid,
 341                         struct superblock_security_struct *sbsec,
 342                         const struct cred *cred)
 343 {
 344         const struct task_security_struct *tsec = cred->security;
 345         int rc;
 346         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELFROM, NULL);
 348         if (rc)
 349                 return rc;
 350
 351         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 352                           FILESYSTEM__ASSOCIATE, NULL);
 353         return rc;
 354 }
 355
 356 static int sb_finish_set_opts(struct super_block *sb)
 357 {
 358         struct superblock_security_struct *sbsec = sb->s_security;
 359         struct dentry *root = sb->s_root;
 360         struct inode *root_inode = root->d_inode;
 361         int rc = 0;
 362
 363         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 364                 /* Make sure that the xattr handler exists and that no
 365                    error other than -ENODATA is returned by getxattr on
 366                    the root directory.  -ENODATA is ok, as this may be
 367                    the first boot of the SELinux kernel before we have
 368                    assigned xattr values to the filesystem. */
 369                 if (!root_inode->i_op->getxattr) {
 370                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 371                                "xattr support\n", sb->s_id, sb->s_type->name);
 372                         rc = -EOPNOTSUPP;
 373                         goto out;
 374                 }
 375                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 376                 if (rc < 0 && rc != -ENODATA) {
 377                         if (rc == -EOPNOTSUPP)
 378                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 379                                        "%s) has no security xattr handler\n",
 380                                        sb->s_id, sb->s_type->name);
 381                         else
 382                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 383                                        "%s) getxattr errno %d\n", sb->s_id,
 384                                        sb->s_type->name, -rc);
 385                         goto out;
 386                 }
 387         }
 388
 389         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 390
 391         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 392                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 393                        sb->s_id, sb->s_type->name);
 394         else
 395                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 396                        sb->s_id, sb->s_type->name,
 397                        labeling_behaviors[sbsec->behavior-1]);
 398
 399         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 400             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 401             sbsec->behavior == SECURITY_FS_USE_NONE ||
 402             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 sbsec->flags &= ~SE_SBLABELSUPP;
 404
 405         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 406         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 407                 sbsec->flags |= SE_SBLABELSUPP;
 408
 409         /* Initialize the root inode. */
 410         rc = inode_doinit_with_dentry(root_inode, root);
 411
 412         /* Initialize any other inodes associated with the superblock, e.g.
 413            inodes created prior to initial policy load or inodes created
 414            during get_sb by a pseudo filesystem that directly
 415            populates itself. */
 416         spin_lock(&sbsec->isec_lock);
 417 next_inode:
 418         if (!list_empty(&sbsec->isec_head)) {
 419                 struct inode_security_struct *isec =
 420                                 list_entry(sbsec->isec_head.next,
 421                                            struct inode_security_struct, list);
 422                 struct inode *inode = isec->inode;
 423                 spin_unlock(&sbsec->isec_lock);
 424                 inode = igrab(inode);
 425                 if (inode) {
 426                         if (!IS_PRIVATE(inode))
 427                                 inode_doinit(inode);
 428                         iput(inode);
 429                 }
 430                 spin_lock(&sbsec->isec_lock);
 431                 list_del_init(&isec->list);
 432                 goto next_inode;
 433         }
 434         spin_unlock(&sbsec->isec_lock);
 435 out:
 436         return rc;
 437 }
 438
 439 /*
 440  * This function should allow an FS to ask what it's mount security
 441  * options were so it can use those later for submounts, displaying
 442  * mount options, or whatever.
 443  */
 444 static int selinux_get_mnt_opts(const struct super_block *sb,
 445                                 struct security_mnt_opts *opts)
 446 {
 447         int rc = 0, i;
 448         struct superblock_security_struct *sbsec = sb->s_security;
 449         char *context = NULL;
 450         u32 len;
 451         char tmp;
 452
 453         security_init_mnt_opts(opts);
 454
 455         if (!(sbsec->flags & SE_SBINITIALIZED))
 456                 return -EINVAL;
 457
 458         if (!ss_initialized)
 459                 return -EINVAL;
 460
 461         tmp = sbsec->flags & SE_MNTMASK;
 462         /* count the number of mount options for this sb */
 463         for (i = 0; i < 8; i++) {
 464                 if (tmp & 0x01)
 465                         opts->num_mnt_opts++;
 466                 tmp >>= 1;
 467         }
 468         /* Check if the Label support flag is set */
 469         if (sbsec->flags & SE_SBLABELSUPP)
 470                 opts->num_mnt_opts++;
 471
 472         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 473         if (!opts->mnt_opts) {
 474                 rc = -ENOMEM;
 475                 goto out_free;
 476         }
 477
 478         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 479         if (!opts->mnt_opts_flags) {
 480                 rc = -ENOMEM;
 481                 goto out_free;
 482         }
 483
 484         i = 0;
 485         if (sbsec->flags & FSCONTEXT_MNT) {
 486                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 487                 if (rc)
 488                         goto out_free;
 489                 opts->mnt_opts[i] = context;
 490                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 491         }
 492         if (sbsec->flags & CONTEXT_MNT) {
 493                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 494                 if (rc)
 495                         goto out_free;
 496                 opts->mnt_opts[i] = context;
 497                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 498         }
 499         if (sbsec->flags & DEFCONTEXT_MNT) {
 500                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 501                 if (rc)
 502                         goto out_free;
 503                 opts->mnt_opts[i] = context;
 504                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 505         }
 506         if (sbsec->flags & ROOTCONTEXT_MNT) {
 507                 struct inode *root = sbsec->sb->s_root->d_inode;
 508                 struct inode_security_struct *isec = root->i_security;
 509
 510                 rc = security_sid_to_context(isec->sid, &context, &len);
 511                 if (rc)
 512                         goto out_free;
 513                 opts->mnt_opts[i] = context;
 514                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 515         }
 516         if (sbsec->flags & SE_SBLABELSUPP) {
 517                 opts->mnt_opts[i] = NULL;
 518                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 519         }
 520
 521         BUG_ON(i != opts->num_mnt_opts);
 522
 523         return 0;
 524
 525 out_free:
 526         security_free_mnt_opts(opts);
 527         return rc;
 528 }
 529
 530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 531                       u32 old_sid, u32 new_sid)
 532 {
 533         char mnt_flags = sbsec->flags & SE_MNTMASK;
 534
 535         /* check if the old mount command had the same options */
 536         if (sbsec->flags & SE_SBINITIALIZED)
 537                 if (!(sbsec->flags & flag) ||
 538                     (old_sid != new_sid))
 539                         return 1;
 540
 541         /* check if we were passed the same options twice,
 542          * aka someone passed context=a,context=b
 543          */
 544         if (!(sbsec->flags & SE_SBINITIALIZED))
 545                 if (mnt_flags & flag)
 546                         return 1;
 547         return 0;
 548 }
 549
 550 /*
 551  * Allow filesystems with binary mount data to explicitly set mount point
 552  * labeling information.
 553  */
 554 static int selinux_set_mnt_opts(struct super_block *sb,
 555                                 struct security_mnt_opts *opts,
 556                                 unsigned long kern_flags,
 557                                 unsigned long *set_kern_flags)
 558 {
 559         const struct cred *cred = current_cred();
 560         int rc = 0, i;
 561         struct superblock_security_struct *sbsec = sb->s_security;
 562         const char *name = sb->s_type->name;
 563         struct inode *inode = sbsec->sb->s_root->d_inode;
 564         struct inode_security_struct *root_isec = inode->i_security;
 565         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 566         u32 defcontext_sid = 0;
 567         char **mount_options = opts->mnt_opts;
 568         int *flags = opts->mnt_opts_flags;
 569         int num_opts = opts->num_mnt_opts;
 570
 571         mutex_lock(&sbsec->lock);
 572
 573         if (!ss_initialized) {
 574                 if (!num_opts) {
 575                         /* Defer initialization until selinux_complete_init,
 576                            after the initial policy is loaded and the security
 577                            server is ready to handle calls. */
 578                         goto out;
 579                 }
 580                 rc = -EINVAL;
 581                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 582                         "before the security server is initialized\n");
 583                 goto out;
 584         }
 585         if (kern_flags && !set_kern_flags) {
 586                 /* Specifying internal flags without providing a place to
 587                  * place the results is not allowed */
 588                 rc = -EINVAL;
 589                 goto out;
 590         }
 591
 592         /*
 593          * Binary mount data FS will come through this function twice.  Once
 594          * from an explicit call and once from the generic calls from the vfs.
 595          * Since the generic VFS calls will not contain any security mount data
 596          * we need to skip the double mount verification.
 597          *
 598          * This does open a hole in which we will not notice if the first
 599          * mount using this sb set explict options and a second mount using
 600          * this sb does not set any security options.  (The first options
 601          * will be used for both mounts)
 602          */
 603         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 604             && (num_opts == 0))
 605                 goto out;
 606
 607         /*
 608          * parse the mount options, check if they are valid sids.
 609          * also check if someone is trying to mount the same sb more
 610          * than once with different security options.
 611          */
 612         for (i = 0; i < num_opts; i++) {
 613                 u32 sid;
 614
 615                 if (flags[i] == SE_SBLABELSUPP)
 616                         continue;
 617                 rc = security_context_to_sid(mount_options[i],
 618                                              strlen(mount_options[i]), &sid);
 619                 if (rc) {
 620                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 621                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 622                                mount_options[i], sb->s_id, name, rc);
 623                         goto out;
 624                 }
 625                 switch (flags[i]) {
 626                 case FSCONTEXT_MNT:
 627                         fscontext_sid = sid;
 628
 629                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 630                                         fscontext_sid))
 631                                 goto out_double_mount;
 632
 633                         sbsec->flags |= FSCONTEXT_MNT;
 634                         break;
 635                 case CONTEXT_MNT:
 636                         context_sid = sid;
 637
 638                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 639                                         context_sid))
 640                                 goto out_double_mount;
 641
 642                         sbsec->flags |= CONTEXT_MNT;
 643                         break;
 644                 case ROOTCONTEXT_MNT:
 645                         rootcontext_sid = sid;
 646
 647                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 648                                         rootcontext_sid))
 649                                 goto out_double_mount;
 650
 651                         sbsec->flags |= ROOTCONTEXT_MNT;
 652
 653                         break;
 654                 case DEFCONTEXT_MNT:
 655                         defcontext_sid = sid;
 656
 657                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 658                                         defcontext_sid))
 659                                 goto out_double_mount;
 660
 661                         sbsec->flags |= DEFCONTEXT_MNT;
 662
 663                         break;
 664                 default:
 665                         rc = -EINVAL;
 666                         goto out;
 667                 }
 668         }
 669
 670         if (sbsec->flags & SE_SBINITIALIZED) {
 671                 /* previously mounted with options, but not on this attempt? */
 672                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 673                         goto out_double_mount;
 674                 rc = 0;
 675                 goto out;
 676         }
 677
 678         if (strcmp(sb->s_type->name, "proc") == 0)
 679                 sbsec->flags |= SE_SBPROC;
 680
 681         /* Determine the labeling behavior to use for this filesystem type. */
 682         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 683         if (rc) {
 684                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 685                        __func__, sb->s_type->name, rc);
 686                 goto out;
 687         }
 688
 689         /* sets the context of the superblock for the fs being mounted. */
 690         if (fscontext_sid) {
 691                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 692                 if (rc)
 693                         goto out;
 694
 695                 sbsec->sid = fscontext_sid;
 696         }
 697
 698         /*
 699          * Switch to using mount point labeling behavior.
 700          * sets the label used on all file below the mountpoint, and will set
 701          * the superblock context if not already set.
 702          */
 703         if (context_sid) {
 704                 if (!fscontext_sid) {
 705                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 706                                                           cred);
 707                         if (rc)
 708                                 goto out;
 709                         sbsec->sid = context_sid;
 710                 } else {
 711                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 712                                                              cred);
 713                         if (rc)
 714                                 goto out;
 715                 }
 716                 if (!rootcontext_sid)
 717                         rootcontext_sid = context_sid;
 718
 719                 sbsec->mntpoint_sid = context_sid;
 720                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 721         }
 722
 723         if (rootcontext_sid) {
 724                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 725                                                      cred);
 726                 if (rc)
 727                         goto out;
 728
 729                 root_isec->sid = rootcontext_sid;
 730                 root_isec->initialized = 1;
 731         }
 732
 733         if (defcontext_sid) {
 734                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 735                         rc = -EINVAL;
 736                         printk(KERN_WARNING "SELinux: defcontext option is "
 737                                "invalid for this filesystem type\n");
 738                         goto out;
 739                 }
 740
 741                 if (defcontext_sid != sbsec->def_sid) {
 742                         rc = may_context_mount_inode_relabel(defcontext_sid,
 743                                                              sbsec, cred);
 744                         if (rc)
 745                                 goto out;
 746                 }
 747
 748                 sbsec->def_sid = defcontext_sid;
 749         }
 750
 751         rc = sb_finish_set_opts(sb);
 752 out:
 753         mutex_unlock(&sbsec->lock);
 754         return rc;
 755 out_double_mount:
 756         rc = -EINVAL;
 757         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 758                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 759         goto out;
 760 }
 761
 762 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 763                                     const struct super_block *newsb)
 764 {
 765         struct superblock_security_struct *old = oldsb->s_security;
 766         struct superblock_security_struct *new = newsb->s_security;
 767         char oldflags = old->flags & SE_MNTMASK;
 768         char newflags = new->flags & SE_MNTMASK;
 769
 770         if (oldflags != newflags)
 771                 goto mismatch;
 772         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 773                 goto mismatch;
 774         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 775                 goto mismatch;
 776         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 777                 goto mismatch;
 778         if (oldflags & ROOTCONTEXT_MNT) {
 779                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 780                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 781                 if (oldroot->sid != newroot->sid)
 782                         goto mismatch;
 783         }
 784         return 0;
 785 mismatch:
 786         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 787                             "different security settings for (dev %s, "
 788                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 789         return -EBUSY;
 790 }
 791
 792 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 793                                         struct super_block *newsb)
 794 {
 795         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 796         struct superblock_security_struct *newsbsec = newsb->s_security;
 797
 798         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 799         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 800         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 801
 802         /*
 803          * if the parent was able to be mounted it clearly had no special lsm
 804          * mount options.  thus we can safely deal with this superblock later
 805          */
 806         if (!ss_initialized)
 807                 return 0;
 808
 809         /* how can we clone if the old one wasn't set up?? */
 810         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 811
 812         /* if fs is reusing a sb, make sure that the contexts match */
 813         if (newsbsec->flags & SE_SBINITIALIZED)
 814                 return selinux_cmp_sb_context(oldsb, newsb);
 815
 816         mutex_lock(&newsbsec->lock);
 817
 818         newsbsec->flags = oldsbsec->flags;
 819
 820         newsbsec->sid = oldsbsec->sid;
 821         newsbsec->def_sid = oldsbsec->def_sid;
 822         newsbsec->behavior = oldsbsec->behavior;
 823
 824         if (set_context) {
 825                 u32 sid = oldsbsec->mntpoint_sid;
 826
 827                 if (!set_fscontext)
 828                         newsbsec->sid = sid;
 829                 if (!set_rootcontext) {
 830                         struct inode *newinode = newsb->s_root->d_inode;
 831                         struct inode_security_struct *newisec = newinode->i_security;
 832                         newisec->sid = sid;
 833                 }
 834                 newsbsec->mntpoint_sid = sid;
 835         }
 836         if (set_rootcontext) {
 837                 const struct inode *oldinode = oldsb->s_root->d_inode;
 838                 const struct inode_security_struct *oldisec = oldinode->i_security;
 839                 struct inode *newinode = newsb->s_root->d_inode;
 840                 struct inode_security_struct *newisec = newinode->i_security;
 841
 842                 newisec->sid = oldisec->sid;
 843         }
 844
 845         sb_finish_set_opts(newsb);
 846         mutex_unlock(&newsbsec->lock);
 847         return 0;
 848 }
 849
 850 static int selinux_parse_opts_str(char *options,
 851                                   struct security_mnt_opts *opts)
 852 {
 853         char *p;
 854         char *context = NULL, *defcontext = NULL;
 855         char *fscontext = NULL, *rootcontext = NULL;
 856         int rc, num_mnt_opts = 0;
 857
 858         opts->num_mnt_opts = 0;
 859
 860         /* Standard string-based options. */
 861         while ((p = strsep(&options, "|")) != NULL) {
 862                 int token;
 863                 substring_t args[MAX_OPT_ARGS];
 864
 865                 if (!*p)
 866                         continue;
 867
 868                 token = match_token(p, tokens, args);
 869
 870                 switch (token) {
 871                 case Opt_context:
 872                         if (context || defcontext) {
 873                                 rc = -EINVAL;
 874                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 875                                 goto out_err;
 876                         }
 877                         context = match_strdup(&args[0]);
 878                         if (!context) {
 879                                 rc = -ENOMEM;
 880                                 goto out_err;
 881                         }
 882                         break;
 883
 884                 case Opt_fscontext:
 885                         if (fscontext) {
 886                                 rc = -EINVAL;
 887                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 888                                 goto out_err;
 889                         }
 890                         fscontext = match_strdup(&args[0]);
 891                         if (!fscontext) {
 892                                 rc = -ENOMEM;
 893                                 goto out_err;
 894                         }
 895                         break;
 896
 897                 case Opt_rootcontext:
 898                         if (rootcontext) {
 899                                 rc = -EINVAL;
 900                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 901                                 goto out_err;
 902                         }
 903                         rootcontext = match_strdup(&args[0]);
 904                         if (!rootcontext) {
 905                                 rc = -ENOMEM;
 906                                 goto out_err;
 907                         }
 908                         break;
 909
 910                 case Opt_defcontext:
 911                         if (context || defcontext) {
 912                                 rc = -EINVAL;
 913                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 914                                 goto out_err;
 915                         }
 916                         defcontext = match_strdup(&args[0]);
 917                         if (!defcontext) {
 918                                 rc = -ENOMEM;
 919                                 goto out_err;
 920                         }
 921                         break;
 922                 case Opt_labelsupport:
 923                         break;
 924                 default:
 925                         rc = -EINVAL;
 926                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 927                         goto out_err;
 928
 929                 }
 930         }
 931
 932         rc = -ENOMEM;
 933         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 934         if (!opts->mnt_opts)
 935                 goto out_err;
 936
 937         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 938         if (!opts->mnt_opts_flags) {
 939                 kfree(opts->mnt_opts);
 940                 goto out_err;
 941         }
 942
 943         if (fscontext) {
 944                 opts->mnt_opts[num_mnt_opts] = fscontext;
 945                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 946         }
 947         if (context) {
 948                 opts->mnt_opts[num_mnt_opts] = context;
 949                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 950         }
 951         if (rootcontext) {
 952                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 953                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 954         }
 955         if (defcontext) {
 956                 opts->mnt_opts[num_mnt_opts] = defcontext;
 957                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 958         }
 959
 960         opts->num_mnt_opts = num_mnt_opts;
 961         return 0;
 962
 963 out_err:
 964         kfree(context);
 965         kfree(defcontext);
 966         kfree(fscontext);
 967         kfree(rootcontext);
 968         return rc;
 969 }
 970 /*
 971  * string mount options parsing and call set the sbsec
 972  */
 973 static int superblock_doinit(struct super_block *sb, void *data)
 974 {
 975         int rc = 0;
 976         char *options = data;
 977         struct security_mnt_opts opts;
 978
 979         security_init_mnt_opts(&opts);
 980
 981         if (!data)
 982                 goto out;
 983
 984         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 985
 986         rc = selinux_parse_opts_str(options, &opts);
 987         if (rc)
 988                 goto out_err;
 989
 990 out:
 991         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
 992
 993 out_err:
 994         security_free_mnt_opts(&opts);
 995         return rc;
 996 }
 997
 998 static void selinux_write_opts(struct seq_file *m,
 999                                struct security_mnt_opts *opts)
1000 {
1001         int i;
1002         char *prefix;
1003
1004         for (i = 0; i < opts->num_mnt_opts; i++) {
1005                 char *has_comma;
1006
1007                 if (opts->mnt_opts[i])
1008                         has_comma = strchr(opts->mnt_opts[i], ',');
1009                 else
1010                         has_comma = NULL;
1011
1012                 switch (opts->mnt_opts_flags[i]) {
1013                 case CONTEXT_MNT:
1014                         prefix = CONTEXT_STR;
1015                         break;
1016                 case FSCONTEXT_MNT:
1017                         prefix = FSCONTEXT_STR;
1018                         break;
1019                 case ROOTCONTEXT_MNT:
1020                         prefix = ROOTCONTEXT_STR;
1021                         break;
1022                 case DEFCONTEXT_MNT:
1023                         prefix = DEFCONTEXT_STR;
1024                         break;
1025                 case SE_SBLABELSUPP:
1026                         seq_putc(m, ',');
1027                         seq_puts(m, LABELSUPP_STR);
1028                         continue;
1029                 default:
1030                         BUG();
1031                         return;
1032                 };
1033                 /* we need a comma before each option */
1034                 seq_putc(m, ',');
1035                 seq_puts(m, prefix);
1036                 if (has_comma)
1037                         seq_putc(m, '\"');
1038                 seq_puts(m, opts->mnt_opts[i]);
1039                 if (has_comma)
1040                         seq_putc(m, '\"');
1041         }
1042 }
1043
1044 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1045 {
1046         struct security_mnt_opts opts;
1047         int rc;
1048
1049         rc = selinux_get_mnt_opts(sb, &opts);
1050         if (rc) {
1051                 /* before policy load we may get EINVAL, don't show anything */
1052                 if (rc == -EINVAL)
1053                         rc = 0;
1054                 return rc;
1055         }
1056
1057         selinux_write_opts(m, &opts);
1058
1059         security_free_mnt_opts(&opts);
1060
1061         return rc;
1062 }
1063
1064 static inline u16 inode_mode_to_security_class(umode_t mode)
1065 {
1066         switch (mode & S_IFMT) {
1067         case S_IFSOCK:
1068                 return SECCLASS_SOCK_FILE;
1069         case S_IFLNK:
1070                 return SECCLASS_LNK_FILE;
1071         case S_IFREG:
1072                 return SECCLASS_FILE;
1073         case S_IFBLK:
1074                 return SECCLASS_BLK_FILE;
1075         case S_IFDIR:
1076                 return SECCLASS_DIR;
1077         case S_IFCHR:
1078                 return SECCLASS_CHR_FILE;
1079         case S_IFIFO:
1080                 return SECCLASS_FIFO_FILE;
1081
1082         }
1083
1084         return SECCLASS_FILE;
1085 }
1086
1087 static inline int default_protocol_stream(int protocol)
1088 {
1089         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1090 }
1091
1092 static inline int default_protocol_dgram(int protocol)
1093 {
1094         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1095 }
1096
1097 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1098 {
1099         switch (family) {
1100         case PF_UNIX:
1101                 switch (type) {
1102                 case SOCK_STREAM:
1103                 case SOCK_SEQPACKET:
1104                         return SECCLASS_UNIX_STREAM_SOCKET;
1105                 case SOCK_DGRAM:
1106                         return SECCLASS_UNIX_DGRAM_SOCKET;
1107                 }
1108                 break;
1109         case PF_INET:
1110         case PF_INET6:
1111                 switch (type) {
1112                 case SOCK_STREAM:
1113                         if (default_protocol_stream(protocol))
1114                                 return SECCLASS_TCP_SOCKET;
1115                         else
1116                                 return SECCLASS_RAWIP_SOCKET;
1117                 case SOCK_DGRAM:
1118                         if (default_protocol_dgram(protocol))
1119                                 return SECCLASS_UDP_SOCKET;
1120                         else
1121                                 return SECCLASS_RAWIP_SOCKET;
1122                 case SOCK_DCCP:
1123                         return SECCLASS_DCCP_SOCKET;
1124                 default:
1125                         return SECCLASS_RAWIP_SOCKET;
1126                 }
1127                 break;
1128         case PF_NETLINK:
1129                 switch (protocol) {
1130                 case NETLINK_ROUTE:
1131                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1132                 case NETLINK_FIREWALL:
1133                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1134                 case NETLINK_SOCK_DIAG:
1135                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1136                 case NETLINK_NFLOG:
1137                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1138                 case NETLINK_XFRM:
1139                         return SECCLASS_NETLINK_XFRM_SOCKET;
1140                 case NETLINK_SELINUX:
1141                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1142                 case NETLINK_AUDIT:
1143                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1144                 case NETLINK_IP6_FW:
1145                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1146                 case NETLINK_DNRTMSG:
1147                         return SECCLASS_NETLINK_DNRT_SOCKET;
1148                 case NETLINK_KOBJECT_UEVENT:
1149                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1150                 default:
1151                         return SECCLASS_NETLINK_SOCKET;
1152                 }
1153         case PF_PACKET:
1154                 return SECCLASS_PACKET_SOCKET;
1155         case PF_KEY:
1156                 return SECCLASS_KEY_SOCKET;
1157         case PF_APPLETALK:
1158                 return SECCLASS_APPLETALK_SOCKET;
1159         }
1160
1161         return SECCLASS_SOCKET;
1162 }
1163
1164 #ifdef CONFIG_PROC_FS
1165 static int selinux_proc_get_sid(struct dentry *dentry,
1166                                 u16 tclass,
1167                                 u32 *sid)
1168 {
1169         int rc;
1170         char *buffer, *path;
1171
1172         buffer = (char *)__get_free_page(GFP_KERNEL);
1173         if (!buffer)
1174                 return -ENOMEM;
1175
1176         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1177         if (IS_ERR(path))
1178                 rc = PTR_ERR(path);
1179         else {
1180                 /* each process gets a /proc/PID/ entry. Strip off the
1181                  * PID part to get a valid selinux labeling.
1182                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1183                 while (path[1] >= '0' && path[1] <= '9') {
1184                         path[1] = '/';
1185                         path++;
1186                 }
1187                 rc = security_genfs_sid("proc", path, tclass, sid);
1188         }
1189         free_page((unsigned long)buffer);
1190         return rc;
1191 }
1192 #else
1193 static int selinux_proc_get_sid(struct dentry *dentry,
1194                                 u16 tclass,
1195                                 u32 *sid)
1196 {
1197         return -EINVAL;
1198 }
1199 #endif
1200
1201 /* The inode's security attributes must be initialized before first use. */
1202 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1203 {
1204         struct superblock_security_struct *sbsec = NULL;
1205         struct inode_security_struct *isec = inode->i_security;
1206         u32 sid;
1207         struct dentry *dentry;
1208 #define INITCONTEXTLEN 255
1209         char *context = NULL;
1210         unsigned len = 0;
1211         int rc = 0;
1212
1213         if (isec->initialized)
1214                 goto out;
1215
1216         mutex_lock(&isec->lock);
1217         if (isec->initialized)
1218                 goto out_unlock;
1219
1220         sbsec = inode->i_sb->s_security;
1221         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1222                 /* Defer initialization until selinux_complete_init,
1223                    after the initial policy is loaded and the security
1224                    server is ready to handle calls. */
1225                 spin_lock(&sbsec->isec_lock);
1226                 if (list_empty(&isec->list))
1227                         list_add(&isec->list, &sbsec->isec_head);
1228                 spin_unlock(&sbsec->isec_lock);
1229                 goto out_unlock;
1230         }
1231
1232         switch (sbsec->behavior) {
1233         case SECURITY_FS_USE_XATTR:
1234                 if (!inode->i_op->getxattr) {
1235                         isec->sid = sbsec->def_sid;
1236                         break;
1237                 }
1238
1239                 /* Need a dentry, since the xattr API requires one.
1240                    Life would be simpler if we could just pass the inode. */
1241                 if (opt_dentry) {
1242                         /* Called from d_instantiate or d_splice_alias. */
1243                         dentry = dget(opt_dentry);
1244                 } else {
1245                         /* Called from selinux_complete_init, try to find a dentry. */
1246                         dentry = d_find_alias(inode);
1247                 }
1248                 if (!dentry) {
1249                         /*
1250                          * this is can be hit on boot when a file is accessed
1251                          * before the policy is loaded.  When we load policy we
1252                          * may find inodes that have no dentry on the
1253                          * sbsec->isec_head list.  No reason to complain as these
1254                          * will get fixed up the next time we go through
1255                          * inode_doinit with a dentry, before these inodes could
1256                          * be used again by userspace.
1257                          */
1258                         goto out_unlock;
1259                 }
1260
1261                 len = INITCONTEXTLEN;
1262                 context = kmalloc(len+1, GFP_NOFS);
1263                 if (!context) {
1264                         rc = -ENOMEM;
1265                         dput(dentry);
1266                         goto out_unlock;
1267                 }
1268                 context[len] = '\0';
1269                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1270                                            context, len);
1271                 if (rc == -ERANGE) {
1272                         kfree(context);
1273
1274                         /* Need a larger buffer.  Query for the right size. */
1275                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1276                                                    NULL, 0);
1277                         if (rc < 0) {
1278                                 dput(dentry);
1279                                 goto out_unlock;
1280                         }
1281                         len = rc;
1282                         context = kmalloc(len+1, GFP_NOFS);
1283                         if (!context) {
1284                                 rc = -ENOMEM;
1285                                 dput(dentry);
1286                                 goto out_unlock;
1287                         }
1288                         context[len] = '\0';
1289                         rc = inode->i_op->getxattr(dentry,
1290                                                    XATTR_NAME_SELINUX,
1291                                                    context, len);
1292                 }
1293                 dput(dentry);
1294                 if (rc < 0) {
1295                         if (rc != -ENODATA) {
1296                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1297                                        "%d for dev=%s ino=%ld\n", __func__,
1298                                        -rc, inode->i_sb->s_id, inode->i_ino);
1299                                 kfree(context);
1300                                 goto out_unlock;
1301                         }
1302                         /* Map ENODATA to the default file SID */
1303                         sid = sbsec->def_sid;
1304                         rc = 0;
1305                 } else {
1306                         rc = security_context_to_sid_default(context, rc, &sid,
1307                                                              sbsec->def_sid,
1308                                                              GFP_NOFS);
1309                         if (rc) {
1310                                 char *dev = inode->i_sb->s_id;
1311                                 unsigned long ino = inode->i_ino;
1312
1313                                 if (rc == -EINVAL) {
1314                                         if (printk_ratelimit())
1315                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1316                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1317                                                         "filesystem in question.\n", ino, dev, context);
1318                                 } else {
1319                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1320                                                "returned %d for dev=%s ino=%ld\n",
1321                                                __func__, context, -rc, dev, ino);
1322                                 }
1323                                 kfree(context);
1324                                 /* Leave with the unlabeled SID */
1325                                 rc = 0;
1326                                 break;
1327                         }
1328                 }
1329                 kfree(context);
1330                 isec->sid = sid;
1331                 break;
1332         case SECURITY_FS_USE_TASK:
1333                 isec->sid = isec->task_sid;
1334                 break;
1335         case SECURITY_FS_USE_TRANS:
1336                 /* Default to the fs SID. */
1337                 isec->sid = sbsec->sid;
1338
1339                 /* Try to obtain a transition SID. */
1340                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1341                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1342                                              isec->sclass, NULL, &sid);
1343                 if (rc)
1344                         goto out_unlock;
1345                 isec->sid = sid;
1346                 break;
1347         case SECURITY_FS_USE_MNTPOINT:
1348                 isec->sid = sbsec->mntpoint_sid;
1349                 break;
1350         default:
1351                 /* Default to the fs superblock SID. */
1352                 isec->sid = sbsec->sid;
1353
1354                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1355                         if (opt_dentry) {
1356                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1357                                 rc = selinux_proc_get_sid(opt_dentry,
1358                                                           isec->sclass,
1359                                                           &sid);
1360                                 if (rc)
1361                                         goto out_unlock;
1362                                 isec->sid = sid;
1363                         }
1364                 }
1365                 break;
1366         }
1367
1368         isec->initialized = 1;
1369
1370 out_unlock:
1371         mutex_unlock(&isec->lock);
1372 out:
1373         if (isec->sclass == SECCLASS_FILE)
1374                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1375         return rc;
1376 }
1377
1378 /* Convert a Linux signal to an access vector. */
1379 static inline u32 signal_to_av(int sig)
1380 {
1381         u32 perm = 0;
1382
1383         switch (sig) {
1384         case SIGCHLD:
1385                 /* Commonly granted from child to parent. */
1386                 perm = PROCESS__SIGCHLD;
1387                 break;
1388         case SIGKILL:
1389                 /* Cannot be caught or ignored */
1390                 perm = PROCESS__SIGKILL;
1391                 break;
1392         case SIGSTOP:
1393                 /* Cannot be caught or ignored */
1394                 perm = PROCESS__SIGSTOP;
1395                 break;
1396         default:
1397                 /* All other signals. */
1398                 perm = PROCESS__SIGNAL;
1399                 break;
1400         }
1401
1402         return perm;
1403 }
1404
1405 /*
1406  * Check permission between a pair of credentials
1407  * fork check, ptrace check, etc.
1408  */
1409 static int cred_has_perm(const struct cred *actor,
1410                          const struct cred *target,
1411                          u32 perms)
1412 {
1413         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1414
1415         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1416 }
1417
1418 /*
1419  * Check permission between a pair of tasks, e.g. signal checks,
1420  * fork check, ptrace check, etc.
1421  * tsk1 is the actor and tsk2 is the target
1422  * - this uses the default subjective creds of tsk1
1423  */
1424 static int task_has_perm(const struct task_struct *tsk1,
1425                          const struct task_struct *tsk2,
1426                          u32 perms)
1427 {
1428         const struct task_security_struct *__tsec1, *__tsec2;
1429         u32 sid1, sid2;
1430
1431         rcu_read_lock();
1432         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1433         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1434         rcu_read_unlock();
1435         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1436 }
1437
1438 /*
1439  * Check permission between current and another task, e.g. signal checks,
1440  * fork check, ptrace check, etc.
1441  * current is the actor and tsk2 is the target
1442  * - this uses current's subjective creds
1443  */
1444 static int current_has_perm(const struct task_struct *tsk,
1445                             u32 perms)
1446 {
1447         u32 sid, tsid;
1448
1449         sid = current_sid();
1450         tsid = task_sid(tsk);
1451         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1452 }
1453
1454 #if CAP_LAST_CAP > 63
1455 #error Fix SELinux to handle capabilities > 63.
1456 #endif
1457
1458 /* Check whether a task is allowed to use a capability. */
1459 static int cred_has_capability(const struct cred *cred,
1460                                int cap, int audit)
1461 {
1462         struct common_audit_data ad;
1463         struct av_decision avd;
1464         u16 sclass;
1465         u32 sid = cred_sid(cred);
1466         u32 av = CAP_TO_MASK(cap);
1467         int rc;
1468
1469         ad.type = LSM_AUDIT_DATA_CAP;
1470         ad.u.cap = cap;
1471
1472         switch (CAP_TO_INDEX(cap)) {
1473         case 0:
1474                 sclass = SECCLASS_CAPABILITY;
1475                 break;
1476         case 1:
1477                 sclass = SECCLASS_CAPABILITY2;
1478                 break;
1479         default:
1480                 printk(KERN_ERR
1481                        "SELinux:  out of range capability %d\n", cap);
1482                 BUG();
1483                 return -EINVAL;
1484         }
1485
1486         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1487         if (audit == SECURITY_CAP_AUDIT) {
1488                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1489                 if (rc2)
1490                         return rc2;
1491         }
1492         return rc;
1493 }
1494
1495 /* Check whether a task is allowed to use a system operation. */
1496 static int task_has_system(struct task_struct *tsk,
1497                            u32 perms)
1498 {
1499         u32 sid = task_sid(tsk);
1500
1501         return avc_has_perm(sid, SECINITSID_KERNEL,
1502                             SECCLASS_SYSTEM, perms, NULL);
1503 }
1504
1505 /* Check whether a task has a particular permission to an inode.
1506    The 'adp' parameter is optional and allows other audit
1507    data to be passed (e.g. the dentry). */
1508 static int inode_has_perm(const struct cred *cred,
1509                           struct inode *inode,
1510                           u32 perms,
1511                           struct common_audit_data *adp,
1512                           unsigned flags)
1513 {
1514         struct inode_security_struct *isec;
1515         u32 sid;
1516
1517         validate_creds(cred);
1518
1519         if (unlikely(IS_PRIVATE(inode)))
1520                 return 0;
1521
1522         sid = cred_sid(cred);
1523         isec = inode->i_security;
1524
1525         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1526 }
1527
1528 /* Same as inode_has_perm, but pass explicit audit data containing
1529    the dentry to help the auditing code to more easily generate the
1530    pathname if needed. */
1531 static inline int dentry_has_perm(const struct cred *cred,
1532                                   struct dentry *dentry,
1533                                   u32 av)
1534 {
1535         struct inode *inode = dentry->d_inode;
1536         struct common_audit_data ad;
1537
1538         ad.type = LSM_AUDIT_DATA_DENTRY;
1539         ad.u.dentry = dentry;
1540         return inode_has_perm(cred, inode, av, &ad, 0);
1541 }
1542
1543 /* Same as inode_has_perm, but pass explicit audit data containing
1544    the path to help the auditing code to more easily generate the
1545    pathname if needed. */
1546 static inline int path_has_perm(const struct cred *cred,
1547                                 struct path *path,
1548                                 u32 av)
1549 {
1550         struct inode *inode = path->dentry->d_inode;
1551         struct common_audit_data ad;
1552
1553         ad.type = LSM_AUDIT_DATA_PATH;
1554         ad.u.path = *path;
1555         return inode_has_perm(cred, inode, av, &ad, 0);
1556 }
1557
1558 /* Check whether a task can use an open file descriptor to
1559    access an inode in a given way.  Check access to the
1560    descriptor itself, and then use dentry_has_perm to
1561    check a particular permission to the file.
1562    Access to the descriptor is implicitly granted if it
1563    has the same SID as the process.  If av is zero, then
1564    access to the file is not checked, e.g. for cases
1565    where only the descriptor is affected like seek. */
1566 static int file_has_perm(const struct cred *cred,
1567                          struct file *file,
1568                          u32 av)
1569 {
1570         struct file_security_struct *fsec = file->f_security;
1571         struct inode *inode = file_inode(file);
1572         struct common_audit_data ad;
1573         u32 sid = cred_sid(cred);
1574         int rc;
1575
1576         ad.type = LSM_AUDIT_DATA_PATH;
1577         ad.u.path = file->f_path;
1578
1579         if (sid != fsec->sid) {
1580                 rc = avc_has_perm(sid, fsec->sid,
1581                                   SECCLASS_FD,
1582                                   FD__USE,
1583                                   &ad);
1584                 if (rc)
1585                         goto out;
1586         }
1587
1588         /* av is zero if only checking access to the descriptor. */
1589         rc = 0;
1590         if (av)
1591                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1592
1593 out:
1594         return rc;
1595 }
1596
1597 /* Check whether a task can create a file. */
1598 static int may_create(struct inode *dir,
1599                       struct dentry *dentry,
1600                       u16 tclass)
1601 {
1602         const struct task_security_struct *tsec = current_security();
1603         struct inode_security_struct *dsec;
1604         struct superblock_security_struct *sbsec;
1605         u32 sid, newsid;
1606         struct common_audit_data ad;
1607         int rc;
1608
1609         dsec = dir->i_security;
1610         sbsec = dir->i_sb->s_security;
1611
1612         sid = tsec->sid;
1613         newsid = tsec->create_sid;
1614
1615         ad.type = LSM_AUDIT_DATA_DENTRY;
1616         ad.u.dentry = dentry;
1617
1618         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1619                           DIR__ADD_NAME | DIR__SEARCH,
1620                           &ad);
1621         if (rc)
1622                 return rc;
1623
1624         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1625                 rc = security_transition_sid(sid, dsec->sid, tclass,
1626                                              &dentry->d_name, &newsid);
1627                 if (rc)
1628                         return rc;
1629         }
1630
1631         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1632         if (rc)
1633                 return rc;
1634
1635         return avc_has_perm(newsid, sbsec->sid,
1636                             SECCLASS_FILESYSTEM,
1637                             FILESYSTEM__ASSOCIATE, &ad);
1638 }
1639
1640 /* Check whether a task can create a key. */
1641 static int may_create_key(u32 ksid,
1642                           struct task_struct *ctx)
1643 {
1644         u32 sid = task_sid(ctx);
1645
1646         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1647 }
1648
1649 #define MAY_LINK        0
1650 #define MAY_UNLINK      1
1651 #define MAY_RMDIR       2
1652
1653 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1654 static int may_link(struct inode *dir,
1655                     struct dentry *dentry,
1656                     int kind)
1657
1658 {
1659         struct inode_security_struct *dsec, *isec;
1660         struct common_audit_data ad;
1661         u32 sid = current_sid();
1662         u32 av;
1663         int rc;
1664
1665         dsec = dir->i_security;
1666         isec = dentry->d_inode->i_security;
1667
1668         ad.type = LSM_AUDIT_DATA_DENTRY;
1669         ad.u.dentry = dentry;
1670
1671         av = DIR__SEARCH;
1672         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1673         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1674         if (rc)
1675                 return rc;
1676
1677         switch (kind) {
1678         case MAY_LINK:
1679                 av = FILE__LINK;
1680                 break;
1681         case MAY_UNLINK:
1682                 av = FILE__UNLINK;
1683                 break;
1684         case MAY_RMDIR:
1685                 av = DIR__RMDIR;
1686                 break;
1687         default:
1688                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1689                         __func__, kind);
1690                 return 0;
1691         }
1692
1693         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1694         return rc;
1695 }
1696
1697 static inline int may_rename(struct inode *old_dir,
1698                              struct dentry *old_dentry,
1699                              struct inode *new_dir,
1700                              struct dentry *new_dentry)
1701 {
1702         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1703         struct common_audit_data ad;
1704         u32 sid = current_sid();
1705         u32 av;
1706         int old_is_dir, new_is_dir;
1707         int rc;
1708
1709         old_dsec = old_dir->i_security;
1710         old_isec = old_dentry->d_inode->i_security;
1711         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1712         new_dsec = new_dir->i_security;
1713
1714         ad.type = LSM_AUDIT_DATA_DENTRY;
1715
1716         ad.u.dentry = old_dentry;
1717         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1718                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1719         if (rc)
1720                 return rc;
1721         rc = avc_has_perm(sid, old_isec->sid,
1722                           old_isec->sclass, FILE__RENAME, &ad);
1723         if (rc)
1724                 return rc;
1725         if (old_is_dir && new_dir != old_dir) {
1726                 rc = avc_has_perm(sid, old_isec->sid,
1727                                   old_isec->sclass, DIR__REPARENT, &ad);
1728                 if (rc)
1729                         return rc;
1730         }
1731
1732         ad.u.dentry = new_dentry;
1733         av = DIR__ADD_NAME | DIR__SEARCH;
1734         if (new_dentry->d_inode)
1735                 av |= DIR__REMOVE_NAME;
1736         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1737         if (rc)
1738                 return rc;
1739         if (new_dentry->d_inode) {
1740                 new_isec = new_dentry->d_inode->i_security;
1741                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1742                 rc = avc_has_perm(sid, new_isec->sid,
1743                                   new_isec->sclass,
1744                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1745                 if (rc)
1746                         return rc;
1747         }
1748
1749         return 0;
1750 }
1751
1752 /* Check whether a task can perform a filesystem operation. */
1753 static int superblock_has_perm(const struct cred *cred,
1754                                struct super_block *sb,
1755                                u32 perms,
1756                                struct common_audit_data *ad)
1757 {
1758         struct superblock_security_struct *sbsec;
1759         u32 sid = cred_sid(cred);
1760
1761         sbsec = sb->s_security;
1762         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1763 }
1764
1765 /* Convert a Linux mode and permission mask to an access vector. */
1766 static inline u32 file_mask_to_av(int mode, int mask)
1767 {
1768         u32 av = 0;
1769
1770         if (!S_ISDIR(mode)) {
1771                 if (mask & MAY_EXEC)
1772                         av |= FILE__EXECUTE;
1773                 if (mask & MAY_READ)
1774                         av |= FILE__READ;
1775
1776                 if (mask & MAY_APPEND)
1777                         av |= FILE__APPEND;
1778                 else if (mask & MAY_WRITE)
1779                         av |= FILE__WRITE;
1780
1781         } else {
1782                 if (mask & MAY_EXEC)
1783                         av |= DIR__SEARCH;
1784                 if (mask & MAY_WRITE)
1785                         av |= DIR__WRITE;
1786                 if (mask & MAY_READ)
1787                         av |= DIR__READ;
1788         }
1789
1790         return av;
1791 }
1792
1793 /* Convert a Linux file to an access vector. */
1794 static inline u32 file_to_av(struct file *file)
1795 {
1796         u32 av = 0;
1797
1798         if (file->f_mode & FMODE_READ)
1799                 av |= FILE__READ;
1800         if (file->f_mode & FMODE_WRITE) {
1801                 if (file->f_flags & O_APPEND)
1802                         av |= FILE__APPEND;
1803                 else
1804                         av |= FILE__WRITE;
1805         }
1806         if (!av) {
1807                 /*
1808                  * Special file opened with flags 3 for ioctl-only use.
1809                  */
1810                 av = FILE__IOCTL;
1811         }
1812
1813         return av;
1814 }
1815
1816 /*
1817  * Convert a file to an access vector and include the correct open
1818  * open permission.
1819  */
1820 static inline u32 open_file_to_av(struct file *file)
1821 {
1822         u32 av = file_to_av(file);
1823
1824         if (selinux_policycap_openperm)
1825                 av |= FILE__OPEN;
1826
1827         return av;
1828 }
1829
1830 /* Hook functions begin here. */
1831
1832 static int selinux_ptrace_access_check(struct task_struct *child,
1833                                      unsigned int mode)
1834 {
1835         int rc;
1836
1837         rc = cap_ptrace_access_check(child, mode);
1838         if (rc)
1839                 return rc;
1840
1841         if (mode & PTRACE_MODE_READ) {
1842                 u32 sid = current_sid();
1843                 u32 csid = task_sid(child);
1844                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1845         }
1846
1847         return current_has_perm(child, PROCESS__PTRACE);
1848 }
1849
1850 static int selinux_ptrace_traceme(struct task_struct *parent)
1851 {
1852         int rc;
1853
1854         rc = cap_ptrace_traceme(parent);
1855         if (rc)
1856                 return rc;
1857
1858         return task_has_perm(parent, current, PROCESS__PTRACE);
1859 }
1860
1861 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1862                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1863 {
1864         int error;
1865
1866         error = current_has_perm(target, PROCESS__GETCAP);
1867         if (error)
1868                 return error;
1869
1870         return cap_capget(target, effective, inheritable, permitted);
1871 }
1872
1873 static int selinux_capset(struct cred *new, const struct cred *old,
1874                           const kernel_cap_t *effective,
1875                           const kernel_cap_t *inheritable,
1876                           const kernel_cap_t *permitted)
1877 {
1878         int error;
1879
1880         error = cap_capset(new, old,
1881                                       effective, inheritable, permitted);
1882         if (error)
1883                 return error;
1884
1885         return cred_has_perm(old, new, PROCESS__SETCAP);
1886 }
1887
1888 /*
1889  * (This comment used to live with the selinux_task_setuid hook,
1890  * which was removed).
1891  *
1892  * Since setuid only affects the current process, and since the SELinux
1893  * controls are not based on the Linux identity attributes, SELinux does not
1894  * need to control this operation.  However, SELinux does control the use of
1895  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1896  */
1897
1898 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1899                            int cap, int audit)
1900 {
1901         int rc;
1902
1903         rc = cap_capable(cred, ns, cap, audit);
1904         if (rc)
1905                 return rc;
1906
1907         return cred_has_capability(cred, cap, audit);
1908 }
1909
1910 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1911 {
1912         const struct cred *cred = current_cred();
1913         int rc = 0;
1914
1915         if (!sb)
1916                 return 0;
1917
1918         switch (cmds) {
1919         case Q_SYNC:
1920         case Q_QUOTAON:
1921         case Q_QUOTAOFF:
1922         case Q_SETINFO:
1923         case Q_SETQUOTA:
1924                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1925                 break;
1926         case Q_GETFMT:
1927         case Q_GETINFO:
1928         case Q_GETQUOTA:
1929                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1930                 break;
1931         default:
1932                 rc = 0;  /* let the kernel handle invalid cmds */
1933                 break;
1934         }
1935         return rc;
1936 }
1937
1938 static int selinux_quota_on(struct dentry *dentry)
1939 {
1940         const struct cred *cred = current_cred();
1941
1942         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1943 }
1944
1945 static int selinux_syslog(int type)
1946 {
1947         int rc;
1948
1949         switch (type) {
1950         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1951         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1952                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1953                 break;
1954         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1955         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1956         /* Set level of messages printed to console */
1957         case SYSLOG_ACTION_CONSOLE_LEVEL:
1958                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1959                 break;
1960         case SYSLOG_ACTION_CLOSE:       /* Close log */
1961         case SYSLOG_ACTION_OPEN:        /* Open log */
1962         case SYSLOG_ACTION_READ:        /* Read from log */
1963         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1964         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1965         default:
1966                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1967                 break;
1968         }
1969         return rc;
1970 }
1971
1972 /*
1973  * Check that a process has enough memory to allocate a new virtual
1974  * mapping. 0 means there is enough memory for the allocation to
1975  * succeed and -ENOMEM implies there is not.
1976  *
1977  * Do not audit the selinux permission check, as this is applied to all
1978  * processes that allocate mappings.
1979  */
1980 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1981 {
1982         int rc, cap_sys_admin = 0;
1983
1984         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1985                              SECURITY_CAP_NOAUDIT);
1986         if (rc == 0)
1987                 cap_sys_admin = 1;
1988
1989         return __vm_enough_memory(mm, pages, cap_sys_admin);
1990 }
1991
1992 /* binprm security operations */
1993
1994 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1995 {
1996         const struct task_security_struct *old_tsec;
1997         struct task_security_struct *new_tsec;
1998         struct inode_security_struct *isec;
1999         struct common_audit_data ad;
2000         struct inode *inode = file_inode(bprm->file);
2001         int rc;
2002
2003         rc = cap_bprm_set_creds(bprm);
2004         if (rc)
2005                 return rc;
2006
2007         /* SELinux context only depends on initial program or script and not
2008          * the script interpreter */
2009         if (bprm->cred_prepared)
2010                 return 0;
2011
2012         old_tsec = current_security();
2013         new_tsec = bprm->cred->security;
2014         isec = inode->i_security;
2015
2016         /* Default to the current task SID. */
2017         new_tsec->sid = old_tsec->sid;
2018         new_tsec->osid = old_tsec->sid;
2019
2020         /* Reset fs, key, and sock SIDs on execve. */
2021         new_tsec->create_sid = 0;
2022         new_tsec->keycreate_sid = 0;
2023         new_tsec->sockcreate_sid = 0;
2024
2025         if (old_tsec->exec_sid) {
2026                 new_tsec->sid = old_tsec->exec_sid;
2027                 /* Reset exec SID on execve. */
2028                 new_tsec->exec_sid = 0;
2029
2030                 /*
2031                  * Minimize confusion: if no_new_privs and a transition is
2032                  * explicitly requested, then fail the exec.
2033                  */
2034                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2035                         return -EPERM;
2036         } else {
2037                 /* Check for a default transition on this program. */
2038                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2039                                              SECCLASS_PROCESS, NULL,
2040                                              &new_tsec->sid);
2041                 if (rc)
2042                         return rc;
2043         }
2044
2045         ad.type = LSM_AUDIT_DATA_PATH;
2046         ad.u.path = bprm->file->f_path;
2047
2048         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2049             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2050                 new_tsec->sid = old_tsec->sid;
2051
2052         if (new_tsec->sid == old_tsec->sid) {
2053                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2054                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2055                 if (rc)
2056                         return rc;
2057         } else {
2058                 /* Check permissions for the transition. */
2059                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2060                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2061                 if (rc)
2062                         return rc;
2063
2064                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2065                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2066                 if (rc)
2067                         return rc;
2068
2069                 /* Check for shared state */
2070                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2071                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2072                                           SECCLASS_PROCESS, PROCESS__SHARE,
2073                                           NULL);
2074                         if (rc)
2075                                 return -EPERM;
2076                 }
2077
2078                 /* Make sure that anyone attempting to ptrace over a task that
2079                  * changes its SID has the appropriate permit */
2080                 if (bprm->unsafe &
2081                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2082                         struct task_struct *tracer;
2083                         struct task_security_struct *sec;
2084                         u32 ptsid = 0;
2085
2086                         rcu_read_lock();
2087                         tracer = ptrace_parent(current);
2088                         if (likely(tracer != NULL)) {
2089                                 sec = __task_cred(tracer)->security;
2090                                 ptsid = sec->sid;
2091                         }
2092                         rcu_read_unlock();
2093
2094                         if (ptsid != 0) {
2095                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2096                                                   SECCLASS_PROCESS,
2097                                                   PROCESS__PTRACE, NULL);
2098                                 if (rc)
2099                                         return -EPERM;
2100                         }
2101                 }
2102
2103                 /* Clear any possibly unsafe personality bits on exec: */
2104                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2105         }
2106
2107         return 0;
2108 }
2109
2110 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2111 {
2112         const struct task_security_struct *tsec = current_security();
2113         u32 sid, osid;
2114         int atsecure = 0;
2115
2116         sid = tsec->sid;
2117         osid = tsec->osid;
2118
2119         if (osid != sid) {
2120                 /* Enable secure mode for SIDs transitions unless
2121                    the noatsecure permission is granted between
2122                    the two SIDs, i.e. ahp returns 0. */
2123                 atsecure = avc_has_perm(osid, sid,
2124                                         SECCLASS_PROCESS,
2125                                         PROCESS__NOATSECURE, NULL);
2126         }
2127
2128         return (atsecure || cap_bprm_secureexec(bprm));
2129 }
2130
2131 static int match_file(const void *p, struct file *file, unsigned fd)
2132 {
2133         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2134 }
2135
2136 /* Derived from fs/exec.c:flush_old_files. */
2137 static inline void flush_unauthorized_files(const struct cred *cred,
2138                                             struct files_struct *files)
2139 {
2140         struct file *file, *devnull = NULL;
2141         struct tty_struct *tty;
2142         int drop_tty = 0;
2143         unsigned n;
2144
2145         tty = get_current_tty();
2146         if (tty) {
2147                 spin_lock(&tty_files_lock);
2148                 if (!list_empty(&tty->tty_files)) {
2149                         struct tty_file_private *file_priv;
2150
2151                         /* Revalidate access to controlling tty.
2152                            Use path_has_perm on the tty path directly rather
2153                            than using file_has_perm, as this particular open
2154                            file may belong to another process and we are only
2155                            interested in the inode-based check here. */
2156                         file_priv = list_first_entry(&tty->tty_files,
2157                                                 struct tty_file_private, list);
2158                         file = file_priv->file;
2159                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2160                                 drop_tty = 1;
2161                 }
2162                 spin_unlock(&tty_files_lock);
2163                 tty_kref_put(tty);
2164         }
2165         /* Reset controlling tty. */
2166         if (drop_tty)
2167                 no_tty();
2168
2169         /* Revalidate access to inherited open files. */
2170         n = iterate_fd(files, 0, match_file, cred);
2171         if (!n) /* none found? */
2172                 return;
2173
2174         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2175         if (IS_ERR(devnull))
2176                 devnull = NULL;
2177         /* replace all the matching ones with this */
2178         do {
2179                 replace_fd(n - 1, devnull, 0);
2180         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2181         if (devnull)
2182                 fput(devnull);
2183 }
2184
2185 /*
2186  * Prepare a process for imminent new credential changes due to exec
2187  */
2188 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2189 {
2190         struct task_security_struct *new_tsec;
2191         struct rlimit *rlim, *initrlim;
2192         int rc, i;
2193
2194         new_tsec = bprm->cred->security;
2195         if (new_tsec->sid == new_tsec->osid)
2196                 return;
2197
2198         /* Close files for which the new task SID is not authorized. */
2199         flush_unauthorized_files(bprm->cred, current->files);
2200
2201         /* Always clear parent death signal on SID transitions. */
2202         current->pdeath_signal = 0;
2203
2204         /* Check whether the new SID can inherit resource limits from the old
2205          * SID.  If not, reset all soft limits to the lower of the current
2206          * task's hard limit and the init task's soft limit.
2207          *
2208          * Note that the setting of hard limits (even to lower them) can be
2209          * controlled by the setrlimit check.  The inclusion of the init task's
2210          * soft limit into the computation is to avoid resetting soft limits
2211          * higher than the default soft limit for cases where the default is
2212          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2213          */
2214         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2215                           PROCESS__RLIMITINH, NULL);
2216         if (rc) {
2217                 /* protect against do_prlimit() */
2218                 task_lock(current);
2219                 for (i = 0; i < RLIM_NLIMITS; i++) {
2220                         rlim = current->signal->rlim + i;
2221                         initrlim = init_task.signal->rlim + i;
2222                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2223                 }
2224                 task_unlock(current);
2225                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2226         }
2227 }
2228
2229 /*
2230  * Clean up the process immediately after the installation of new credentials
2231  * due to exec
2232  */
2233 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2234 {
2235         const struct task_security_struct *tsec = current_security();
2236         struct itimerval itimer;
2237         u32 osid, sid;
2238         int rc, i;
2239
2240         osid = tsec->osid;
2241         sid = tsec->sid;
2242
2243         if (sid == osid)
2244                 return;
2245
2246         /* Check whether the new SID can inherit signal state from the old SID.
2247          * If not, clear itimers to avoid subsequent signal generation and
2248          * flush and unblock signals.
2249          *
2250          * This must occur _after_ the task SID has been updated so that any
2251          * kill done after the flush will be checked against the new SID.
2252          */
2253         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2254         if (rc) {
2255                 memset(&itimer, 0, sizeof itimer);
2256                 for (i = 0; i < 3; i++)
2257                         do_setitimer(i, &itimer, NULL);
2258                 spin_lock_irq(&current->sighand->siglock);
2259                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2260                         __flush_signals(current);
2261                         flush_signal_handlers(current, 1);
2262                         sigemptyset(&current->blocked);
2263                 }
2264                 spin_unlock_irq(&current->sighand->siglock);
2265         }
2266
2267         /* Wake up the parent if it is waiting so that it can recheck
2268          * wait permission to the new task SID. */
2269         read_lock(&tasklist_lock);
2270         __wake_up_parent(current, current->real_parent);
2271         read_unlock(&tasklist_lock);
2272 }
2273
2274 /* superblock security operations */
2275
2276 static int selinux_sb_alloc_security(struct super_block *sb)
2277 {
2278         return superblock_alloc_security(sb);
2279 }
2280
2281 static void selinux_sb_free_security(struct super_block *sb)
2282 {
2283         superblock_free_security(sb);
2284 }
2285
2286 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2287 {
2288         if (plen > olen)
2289                 return 0;
2290
2291         return !memcmp(prefix, option, plen);
2292 }
2293
2294 static inline int selinux_option(char *option, int len)
2295 {
2296         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2297                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2298                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2299                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2300                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2301 }
2302
2303 static inline void take_option(char **to, char *from, int *first, int len)
2304 {
2305         if (!*first) {
2306                 **to = ',';
2307                 *to += 1;
2308         } else
2309                 *first = 0;
2310         memcpy(*to, from, len);
2311         *to += len;
2312 }
2313
2314 static inline void take_selinux_option(char **to, char *from, int *first,
2315                                        int len)
2316 {
2317         int current_size = 0;
2318
2319         if (!*first) {
2320                 **to = '|';
2321                 *to += 1;
2322         } else
2323                 *first = 0;
2324
2325         while (current_size < len) {
2326                 if (*from != '"') {
2327                         **to = *from;
2328                         *to += 1;
2329                 }
2330                 from += 1;
2331                 current_size += 1;
2332         }
2333 }
2334
2335 static int selinux_sb_copy_data(char *orig, char *copy)
2336 {
2337         int fnosec, fsec, rc = 0;
2338         char *in_save, *in_curr, *in_end;
2339         char *sec_curr, *nosec_save, *nosec;
2340         int open_quote = 0;
2341
2342         in_curr = orig;
2343         sec_curr = copy;
2344
2345         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2346         if (!nosec) {
2347                 rc = -ENOMEM;
2348                 goto out;
2349         }
2350
2351         nosec_save = nosec;
2352         fnosec = fsec = 1;
2353         in_save = in_end = orig;
2354
2355         do {
2356                 if (*in_end == '"')
2357                         open_quote = !open_quote;
2358                 if ((*in_end == ',' && open_quote == 0) ||
2359                                 *in_end == '\0') {
2360                         int len = in_end - in_curr;
2361
2362                         if (selinux_option(in_curr, len))
2363                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2364                         else
2365                                 take_option(&nosec, in_curr, &fnosec, len);
2366
2367                         in_curr = in_end + 1;
2368                 }
2369         } while (*in_end++);
2370
2371         strcpy(in_save, nosec_save);
2372         free_page((unsigned long)nosec_save);
2373 out:
2374         return rc;
2375 }
2376
2377 static int selinux_sb_remount(struct super_block *sb, void *data)
2378 {
2379         int rc, i, *flags;
2380         struct security_mnt_opts opts;
2381         char *secdata, **mount_options;
2382         struct superblock_security_struct *sbsec = sb->s_security;
2383
2384         if (!(sbsec->flags & SE_SBINITIALIZED))
2385                 return 0;
2386
2387         if (!data)
2388                 return 0;
2389
2390         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2391                 return 0;
2392
2393         security_init_mnt_opts(&opts);
2394         secdata = alloc_secdata();
2395         if (!secdata)
2396                 return -ENOMEM;
2397         rc = selinux_sb_copy_data(data, secdata);
2398         if (rc)
2399                 goto out_free_secdata;
2400
2401         rc = selinux_parse_opts_str(secdata, &opts);
2402         if (rc)
2403                 goto out_free_secdata;
2404
2405         mount_options = opts.mnt_opts;
2406         flags = opts.mnt_opts_flags;
2407
2408         for (i = 0; i < opts.num_mnt_opts; i++) {
2409                 u32 sid;
2410                 size_t len;
2411
2412                 if (flags[i] == SE_SBLABELSUPP)
2413                         continue;
2414                 len = strlen(mount_options[i]);
2415                 rc = security_context_to_sid(mount_options[i], len, &sid);
2416                 if (rc) {
2417                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2418                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2419                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2420                         goto out_free_opts;
2421                 }
2422                 rc = -EINVAL;
2423                 switch (flags[i]) {
2424                 case FSCONTEXT_MNT:
2425                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2426                                 goto out_bad_option;
2427                         break;
2428                 case CONTEXT_MNT:
2429                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2430                                 goto out_bad_option;
2431                         break;
2432                 case ROOTCONTEXT_MNT: {
2433                         struct inode_security_struct *root_isec;
2434                         root_isec = sb->s_root->d_inode->i_security;
2435
2436                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2437                                 goto out_bad_option;
2438                         break;
2439                 }
2440                 case DEFCONTEXT_MNT:
2441                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2442                                 goto out_bad_option;
2443                         break;
2444                 default:
2445                         goto out_free_opts;
2446                 }
2447         }
2448
2449         rc = 0;
2450 out_free_opts:
2451         security_free_mnt_opts(&opts);
2452 out_free_secdata:
2453         free_secdata(secdata);
2454         return rc;
2455 out_bad_option:
2456         printk(KERN_WARNING "SELinux: unable to change security options "
2457                "during remount (dev %s, type=%s)\n", sb->s_id,
2458                sb->s_type->name);
2459         goto out_free_opts;
2460 }
2461
2462 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2463 {
2464         const struct cred *cred = current_cred();
2465         struct common_audit_data ad;
2466         int rc;
2467
2468         rc = superblock_doinit(sb, data);
2469         if (rc)
2470                 return rc;
2471
2472         /* Allow all mounts performed by the kernel */
2473         if (flags & MS_KERNMOUNT)
2474                 return 0;
2475
2476         ad.type = LSM_AUDIT_DATA_DENTRY;
2477         ad.u.dentry = sb->s_root;
2478         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2479 }
2480
2481 static int selinux_sb_statfs(struct dentry *dentry)
2482 {
2483         const struct cred *cred = current_cred();
2484         struct common_audit_data ad;
2485
2486         ad.type = LSM_AUDIT_DATA_DENTRY;
2487         ad.u.dentry = dentry->d_sb->s_root;
2488         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2489 }
2490
2491 static int selinux_mount(const char *dev_name,
2492                          struct path *path,
2493                          const char *type,
2494                          unsigned long flags,
2495                          void *data)
2496 {
2497         const struct cred *cred = current_cred();
2498
2499         if (flags & MS_REMOUNT)
2500                 return superblock_has_perm(cred, path->dentry->d_sb,
2501                                            FILESYSTEM__REMOUNT, NULL);
2502         else
2503                 return path_has_perm(cred, path, FILE__MOUNTON);
2504 }
2505
2506 static int selinux_umount(struct vfsmount *mnt, int flags)
2507 {
2508         const struct cred *cred = current_cred();
2509
2510         return superblock_has_perm(cred, mnt->mnt_sb,
2511                                    FILESYSTEM__UNMOUNT, NULL);
2512 }
2513
2514 /* inode security operations */
2515
2516 static int selinux_inode_alloc_security(struct inode *inode)
2517 {
2518         return inode_alloc_security(inode);
2519 }
2520
2521 static void selinux_inode_free_security(struct inode *inode)
2522 {
2523         inode_free_security(inode);
2524 }
2525
2526 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2527                                         struct qstr *name, void **ctx,
2528                                         u32 *ctxlen)
2529 {
2530         const struct cred *cred = current_cred();
2531         struct task_security_struct *tsec;
2532         struct inode_security_struct *dsec;
2533         struct superblock_security_struct *sbsec;
2534         struct inode *dir = dentry->d_parent->d_inode;
2535         u32 newsid;
2536         int rc;
2537
2538         tsec = cred->security;
2539         dsec = dir->i_security;
2540         sbsec = dir->i_sb->s_security;
2541
2542         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2543                 newsid = tsec->create_sid;
2544         } else {
2545                 rc = security_transition_sid(tsec->sid, dsec->sid,
2546                                              inode_mode_to_security_class(mode),
2547                                              name,
2548                                              &newsid);
2549                 if (rc) {
2550                         printk(KERN_WARNING
2551                                 "%s: security_transition_sid failed, rc=%d\n",
2552                                __func__, -rc);
2553                         return rc;
2554                 }
2555         }
2556
2557         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2558 }
2559
2560 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2561                                        const struct qstr *qstr, char **name,
2562                                        void **value, size_t *len)
2563 {
2564         const struct task_security_struct *tsec = current_security();
2565         struct inode_security_struct *dsec;
2566         struct superblock_security_struct *sbsec;
2567         u32 sid, newsid, clen;
2568         int rc;
2569         char *namep = NULL, *context;
2570
2571         dsec = dir->i_security;
2572         sbsec = dir->i_sb->s_security;
2573
2574         sid = tsec->sid;
2575         newsid = tsec->create_sid;
2576
2577         if ((sbsec->flags & SE_SBINITIALIZED) &&
2578             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2579                 newsid = sbsec->mntpoint_sid;
2580         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2581                 rc = security_transition_sid(sid, dsec->sid,
2582                                              inode_mode_to_security_class(inode->i_mode),
2583                                              qstr, &newsid);
2584                 if (rc) {
2585                         printk(KERN_WARNING "%s:  "
2586                                "security_transition_sid failed, rc=%d (dev=%s "
2587                                "ino=%ld)\n",
2588                                __func__,
2589                                -rc, inode->i_sb->s_id, inode->i_ino);
2590                         return rc;
2591                 }
2592         }
2593
2594         /* Possibly defer initialization to selinux_complete_init. */
2595         if (sbsec->flags & SE_SBINITIALIZED) {
2596                 struct inode_security_struct *isec = inode->i_security;
2597                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2598                 isec->sid = newsid;
2599                 isec->initialized = 1;
2600         }
2601
2602         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2603                 return -EOPNOTSUPP;
2604
2605         if (name) {
2606                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2607                 if (!namep)
2608                         return -ENOMEM;
2609                 *name = namep;
2610         }
2611
2612         if (value && len) {
2613                 rc = security_sid_to_context_force(newsid, &context, &clen);
2614                 if (rc) {
2615                         kfree(namep);
2616                         return rc;
2617                 }
2618                 *value = context;
2619                 *len = clen;
2620         }
2621
2622         return 0;
2623 }
2624
2625 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2626 {
2627         return may_create(dir, dentry, SECCLASS_FILE);
2628 }
2629
2630 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2631 {
2632         return may_link(dir, old_dentry, MAY_LINK);
2633 }
2634
2635 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2636 {
2637         return may_link(dir, dentry, MAY_UNLINK);
2638 }
2639
2640 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2641 {
2642         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2643 }
2644
2645 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2646 {
2647         return may_create(dir, dentry, SECCLASS_DIR);
2648 }
2649
2650 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2651 {
2652         return may_link(dir, dentry, MAY_RMDIR);
2653 }
2654
2655 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2656 {
2657         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2658 }
2659
2660 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2661                                 struct inode *new_inode, struct dentry *new_dentry)
2662 {
2663         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2664 }
2665
2666 static int selinux_inode_readlink(struct dentry *dentry)
2667 {
2668         const struct cred *cred = current_cred();
2669
2670         return dentry_has_perm(cred, dentry, FILE__READ);
2671 }
2672
2673 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2674 {
2675         const struct cred *cred = current_cred();
2676
2677         return dentry_has_perm(cred, dentry, FILE__READ);
2678 }
2679
2680 static noinline int audit_inode_permission(struct inode *inode,
2681                                            u32 perms, u32 audited, u32 denied,
2682                                            unsigned flags)
2683 {
2684         struct common_audit_data ad;
2685         struct inode_security_struct *isec = inode->i_security;
2686         int rc;
2687
2688         ad.type = LSM_AUDIT_DATA_INODE;
2689         ad.u.inode = inode;
2690
2691         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2692                             audited, denied, &ad, flags);
2693         if (rc)
2694                 return rc;
2695         return 0;
2696 }
2697
2698 static int selinux_inode_permission(struct inode *inode, int mask)
2699 {
2700         const struct cred *cred = current_cred();
2701         u32 perms;
2702         bool from_access;
2703         unsigned flags = mask & MAY_NOT_BLOCK;
2704         struct inode_security_struct *isec;
2705         u32 sid;
2706         struct av_decision avd;
2707         int rc, rc2;
2708         u32 audited, denied;
2709
2710         from_access = mask & MAY_ACCESS;
2711         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2712
2713         /* No permission to check.  Existence test. */
2714         if (!mask)
2715                 return 0;
2716
2717         validate_creds(cred);
2718
2719         if (unlikely(IS_PRIVATE(inode)))
2720                 return 0;
2721
2722         perms = file_mask_to_av(inode->i_mode, mask);
2723
2724         sid = cred_sid(cred);
2725         isec = inode->i_security;
2726
2727         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2728         audited = avc_audit_required(perms, &avd, rc,
2729                                      from_access ? FILE__AUDIT_ACCESS : 0,
2730                                      &denied);
2731         if (likely(!audited))
2732                 return rc;
2733
2734         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2735         if (rc2)
2736                 return rc2;
2737         return rc;
2738 }
2739
2740 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2741 {
2742         const struct cred *cred = current_cred();
2743         unsigned int ia_valid = iattr->ia_valid;
2744         __u32 av = FILE__WRITE;
2745
2746         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2747         if (ia_valid & ATTR_FORCE) {
2748                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2749                               ATTR_FORCE);
2750                 if (!ia_valid)
2751                         return 0;
2752         }
2753
2754         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2755                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2756                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2757
2758         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2759                 av |= FILE__OPEN;
2760
2761         return dentry_has_perm(cred, dentry, av);
2762 }
2763
2764 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2765 {
2766         const struct cred *cred = current_cred();
2767         struct path path;
2768
2769         path.dentry = dentry;
2770         path.mnt = mnt;
2771
2772         return path_has_perm(cred, &path, FILE__GETATTR);
2773 }
2774
2775 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2776 {
2777         const struct cred *cred = current_cred();
2778
2779         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2780                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2781                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2782                         if (!capable(CAP_SETFCAP))
2783                                 return -EPERM;
2784                 } else if (!capable(CAP_SYS_ADMIN)) {
2785                         /* A different attribute in the security namespace.
2786                            Restrict to administrator. */
2787                         return -EPERM;
2788                 }
2789         }
2790
2791         /* Not an attribute we recognize, so just check the
2792            ordinary setattr permission. */
2793         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2794 }
2795
2796 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2797                                   const void *value, size_t size, int flags)
2798 {
2799         struct inode *inode = dentry->d_inode;
2800         struct inode_security_struct *isec = inode->i_security;
2801         struct superblock_security_struct *sbsec;
2802         struct common_audit_data ad;
2803         u32 newsid, sid = current_sid();
2804         int rc = 0;
2805
2806         if (strcmp(name, XATTR_NAME_SELINUX))
2807                 return selinux_inode_setotherxattr(dentry, name);
2808
2809         sbsec = inode->i_sb->s_security;
2810         if (!(sbsec->flags & SE_SBLABELSUPP))
2811                 return -EOPNOTSUPP;
2812
2813         if (!inode_owner_or_capable(inode))
2814                 return -EPERM;
2815
2816         ad.type = LSM_AUDIT_DATA_DENTRY;
2817         ad.u.dentry = dentry;
2818
2819         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2820                           FILE__RELABELFROM, &ad);
2821         if (rc)
2822                 return rc;
2823
2824         rc = security_context_to_sid(value, size, &newsid);
2825         if (rc == -EINVAL) {
2826                 if (!capable(CAP_MAC_ADMIN)) {
2827                         struct audit_buffer *ab;
2828                         size_t audit_size;
2829                         const char *str;
2830
2831                         /* We strip a nul only if it is at the end, otherwise the
2832                          * context contains a nul and we should audit that */
2833                         if (value) {
2834                                 str = value;
2835                                 if (str[size - 1] == '\0')
2836                                         audit_size = size - 1;
2837                                 else
2838                                         audit_size = size;
2839                         } else {
2840                                 str = "";
2841                                 audit_size = 0;
2842                         }
2843                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2844                         audit_log_format(ab, "op=setxattr invalid_context=");
2845                         audit_log_n_untrustedstring(ab, value, audit_size);
2846                         audit_log_end(ab);
2847
2848                         return rc;
2849                 }
2850                 rc = security_context_to_sid_force(value, size, &newsid);
2851         }
2852         if (rc)
2853                 return rc;
2854
2855         rc = avc_has_perm(sid, newsid, isec->sclass,
2856                           FILE__RELABELTO, &ad);
2857         if (rc)
2858                 return rc;
2859
2860         rc = security_validate_transition(isec->sid, newsid, sid,
2861                                           isec->sclass);
2862         if (rc)
2863                 return rc;
2864
2865         return avc_has_perm(newsid,
2866                             sbsec->sid,
2867                             SECCLASS_FILESYSTEM,
2868                             FILESYSTEM__ASSOCIATE,
2869                             &ad);
2870 }
2871
2872 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2873                                         const void *value, size_t size,
2874                                         int flags)
2875 {
2876         struct inode *inode = dentry->d_inode;
2877         struct inode_security_struct *isec = inode->i_security;
2878         u32 newsid;
2879         int rc;
2880
2881         if (strcmp(name, XATTR_NAME_SELINUX)) {
2882                 /* Not an attribute we recognize, so nothing to do. */
2883                 return;
2884         }
2885
2886         rc = security_context_to_sid_force(value, size, &newsid);
2887         if (rc) {
2888                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2889                        "for (%s, %lu), rc=%d\n",
2890                        inode->i_sb->s_id, inode->i_ino, -rc);
2891                 return;
2892         }
2893
2894         isec->sid = newsid;
2895         return;
2896 }
2897
2898 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2899 {
2900         const struct cred *cred = current_cred();
2901
2902         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2903 }
2904
2905 static int selinux_inode_listxattr(struct dentry *dentry)
2906 {
2907         const struct cred *cred = current_cred();
2908
2909         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2910 }
2911
2912 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2913 {
2914         if (strcmp(name, XATTR_NAME_SELINUX))
2915                 return selinux_inode_setotherxattr(dentry, name);
2916
2917         /* No one is allowed to remove a SELinux security label.
2918            You can change the label, but all data must be labeled. */
2919         return -EACCES;
2920 }
2921
2922 /*
2923  * Copy the inode security context value to the user.
2924  *
2925  * Permission check is handled by selinux_inode_getxattr hook.
2926  */
2927 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2928 {
2929         u32 size;
2930         int error;
2931         char *context = NULL;
2932         struct inode_security_struct *isec = inode->i_security;
2933
2934         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2935                 return -EOPNOTSUPP;
2936
2937         /*
2938          * If the caller has CAP_MAC_ADMIN, then get the raw context
2939          * value even if it is not defined by current policy; otherwise,
2940          * use the in-core value under current policy.
2941          * Use the non-auditing forms of the permission checks since
2942          * getxattr may be called by unprivileged processes commonly
2943          * and lack of permission just means that we fall back to the
2944          * in-core context value, not a denial.
2945          */
2946         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2947                                 SECURITY_CAP_NOAUDIT);
2948         if (!error)
2949                 error = security_sid_to_context_force(isec->sid, &context,
2950                                                       &size);
2951         else
2952                 error = security_sid_to_context(isec->sid, &context, &size);
2953         if (error)
2954                 return error;
2955         error = size;
2956         if (alloc) {
2957                 *buffer = context;
2958                 goto out_nofree;
2959         }
2960         kfree(context);
2961 out_nofree:
2962         return error;
2963 }
2964
2965 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2966                                      const void *value, size_t size, int flags)
2967 {
2968         struct inode_security_struct *isec = inode->i_security;
2969         u32 newsid;
2970         int rc;
2971
2972         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2973                 return -EOPNOTSUPP;
2974
2975         if (!value || !size)
2976                 return -EACCES;
2977
2978         rc = security_context_to_sid((void *)value, size, &newsid);
2979         if (rc)
2980                 return rc;
2981
2982         isec->sid = newsid;
2983         isec->initialized = 1;
2984         return 0;
2985 }
2986
2987 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2988 {
2989         const int len = sizeof(XATTR_NAME_SELINUX);
2990         if (buffer && len <= buffer_size)
2991                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2992         return len;
2993 }
2994
2995 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2996 {
2997         struct inode_security_struct *isec = inode->i_security;
2998         *secid = isec->sid;
2999 }
3000
3001 /* file security operations */
3002
3003 static int selinux_revalidate_file_permission(struct file *file, int mask)
3004 {
3005         const struct cred *cred = current_cred();
3006         struct inode *inode = file_inode(file);
3007
3008         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3009         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3010                 mask |= MAY_APPEND;
3011
3012         return file_has_perm(cred, file,
3013                              file_mask_to_av(inode->i_mode, mask));
3014 }
3015
3016 static int selinux_file_permission(struct file *file, int mask)
3017 {
3018         struct inode *inode = file_inode(file);
3019         struct file_security_struct *fsec = file->f_security;
3020         struct inode_security_struct *isec = inode->i_security;
3021         u32 sid = current_sid();
3022
3023         if (!mask)
3024                 /* No permission to check.  Existence test. */
3025                 return 0;
3026
3027         if (sid == fsec->sid && fsec->isid == isec->sid &&
3028             fsec->pseqno == avc_policy_seqno())
3029                 /* No change since file_open check. */
3030                 return 0;
3031
3032         return selinux_revalidate_file_permission(file, mask);
3033 }
3034
3035 static int selinux_file_alloc_security(struct file *file)
3036 {
3037         return file_alloc_security(file);
3038 }
3039
3040 static void selinux_file_free_security(struct file *file)
3041 {
3042         file_free_security(file);
3043 }
3044
3045 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3046                               unsigned long arg)
3047 {
3048         const struct cred *cred = current_cred();
3049         int error = 0;
3050
3051         switch (cmd) {
3052         case FIONREAD:
3053         /* fall through */
3054         case FIBMAP:
3055         /* fall through */
3056         case FIGETBSZ:
3057         /* fall through */
3058         case FS_IOC_GETFLAGS:
3059         /* fall through */
3060         case FS_IOC_GETVERSION:
3061                 error = file_has_perm(cred, file, FILE__GETATTR);
3062                 break;
3063
3064         case FS_IOC_SETFLAGS:
3065         /* fall through */
3066         case FS_IOC_SETVERSION:
3067                 error = file_has_perm(cred, file, FILE__SETATTR);
3068                 break;
3069
3070         /* sys_ioctl() checks */
3071         case FIONBIO:
3072         /* fall through */
3073         case FIOASYNC:
3074                 error = file_has_perm(cred, file, 0);
3075                 break;
3076
3077         case KDSKBENT:
3078         case KDSKBSENT:
3079                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3080                                             SECURITY_CAP_AUDIT);
3081                 break;
3082
3083         /* default case assumes that the command will go
3084          * to the file's ioctl() function.
3085          */
3086         default:
3087                 error = file_has_perm(cred, file, FILE__IOCTL);
3088         }
3089         return error;
3090 }
3091
3092 static int default_noexec;
3093
3094 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3095 {
3096         const struct cred *cred = current_cred();
3097         int rc = 0;
3098
3099         if (default_noexec &&
3100             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3101                 /*
3102                  * We are making executable an anonymous mapping or a
3103                  * private file mapping that will also be writable.
3104                  * This has an additional check.
3105                  */
3106                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3107                 if (rc)
3108                         goto error;
3109         }
3110
3111         if (file) {
3112                 /* read access is always possible with a mapping */
3113                 u32 av = FILE__READ;
3114
3115                 /* write access only matters if the mapping is shared */
3116                 if (shared && (prot & PROT_WRITE))
3117                         av |= FILE__WRITE;
3118
3119                 if (prot & PROT_EXEC)
3120                         av |= FILE__EXECUTE;
3121
3122                 return file_has_perm(cred, file, av);
3123         }
3124
3125 error:
3126         return rc;
3127 }
3128
3129 static int selinux_mmap_addr(unsigned long addr)
3130 {
3131         int rc = 0;
3132         u32 sid = current_sid();
3133
3134         /*
3135          * notice that we are intentionally putting the SELinux check before
3136          * the secondary cap_file_mmap check.  This is such a likely attempt
3137          * at bad behaviour/exploit that we always want to get the AVC, even
3138          * if DAC would have also denied the operation.
3139          */
3140         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3141                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3142                                   MEMPROTECT__MMAP_ZERO, NULL);
3143                 if (rc)
3144                         return rc;
3145         }
3146
3147         /* do DAC check on address space usage */
3148         return cap_mmap_addr(addr);
3149 }
3150
3151 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3152                              unsigned long prot, unsigned long flags)
3153 {
3154         if (selinux_checkreqprot)
3155                 prot = reqprot;
3156
3157         return file_map_prot_check(file, prot,
3158                                    (flags & MAP_TYPE) == MAP_SHARED);
3159 }
3160
3161 static int selinux_file_mprotect(struct vm_area_struct *vma,
3162                                  unsigned long reqprot,
3163                                  unsigned long prot)
3164 {
3165         const struct cred *cred = current_cred();
3166
3167         if (selinux_checkreqprot)
3168                 prot = reqprot;
3169
3170         if (default_noexec &&
3171             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3172                 int rc = 0;
3173                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3174                     vma->vm_end <= vma->vm_mm->brk) {
3175                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3176                 } else if (!vma->vm_file &&
3177                            vma->vm_start <= vma->vm_mm->start_stack &&
3178                            vma->vm_end >= vma->vm_mm->start_stack) {
3179                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3180                 } else if (vma->vm_file && vma->anon_vma) {
3181                         /*
3182                          * We are making executable a file mapping that has
3183                          * had some COW done. Since pages might have been
3184                          * written, check ability to execute the possibly
3185                          * modified content.  This typically should only
3186                          * occur for text relocations.
3187                          */
3188                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3189                 }
3190                 if (rc)
3191                         return rc;
3192         }
3193
3194         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3195 }
3196
3197 static int selinux_file_lock(struct file *file, unsigned int cmd)
3198 {
3199         const struct cred *cred = current_cred();
3200
3201         return file_has_perm(cred, file, FILE__LOCK);
3202 }
3203
3204 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3205                               unsigned long arg)
3206 {
3207         const struct cred *cred = current_cred();
3208         int err = 0;
3209
3210         switch (cmd) {
3211         case F_SETFL:
3212                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3213                         err = file_has_perm(cred, file, FILE__WRITE);
3214                         break;
3215                 }
3216                 /* fall through */
3217         case F_SETOWN:
3218         case F_SETSIG:
3219         case F_GETFL:
3220         case F_GETOWN:
3221         case F_GETSIG:
3222         case F_GETOWNER_UIDS:
3223                 /* Just check FD__USE permission */
3224                 err = file_has_perm(cred, file, 0);
3225                 break;
3226         case F_GETLK:
3227         case F_SETLK:
3228         case F_SETLKW:
3229 #if BITS_PER_LONG == 32
3230         case F_GETLK64:
3231         case F_SETLK64:
3232         case F_SETLKW64:
3233 #endif
3234                 err = file_has_perm(cred, file, FILE__LOCK);
3235                 break;
3236         }
3237
3238         return err;
3239 }
3240
3241 static int selinux_file_set_fowner(struct file *file)
3242 {
3243         struct file_security_struct *fsec;
3244
3245         fsec = file->f_security;
3246         fsec->fown_sid = current_sid();
3247
3248         return 0;
3249 }
3250
3251 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3252                                        struct fown_struct *fown, int signum)
3253 {
3254         struct file *file;
3255         u32 sid = task_sid(tsk);
3256         u32 perm;
3257         struct file_security_struct *fsec;
3258
3259         /* struct fown_struct is never outside the context of a struct file */
3260         file = container_of(fown, struct file, f_owner);
3261
3262         fsec = file->f_security;
3263
3264         if (!signum)
3265                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3266         else
3267                 perm = signal_to_av(signum);
3268
3269         return avc_has_perm(fsec->fown_sid, sid,
3270                             SECCLASS_PROCESS, perm, NULL);
3271 }
3272
3273 static int selinux_file_receive(struct file *file)
3274 {
3275         const struct cred *cred = current_cred();
3276
3277         return file_has_perm(cred, file, file_to_av(file));
3278 }
3279
3280 static int selinux_file_open(struct file *file, const struct cred *cred)
3281 {
3282         struct file_security_struct *fsec;
3283         struct inode_security_struct *isec;
3284
3285         fsec = file->f_security;
3286         isec = file_inode(file)->i_security;
3287         /*
3288          * Save inode label and policy sequence number
3289          * at open-time so that selinux_file_permission
3290          * can determine whether revalidation is necessary.
3291          * Task label is already saved in the file security
3292          * struct as its SID.
3293          */
3294         fsec->isid = isec->sid;
3295         fsec->pseqno = avc_policy_seqno();
3296         /*
3297          * Since the inode label or policy seqno may have changed
3298          * between the selinux_inode_permission check and the saving
3299          * of state above, recheck that access is still permitted.
3300          * Otherwise, access might never be revalidated against the
3301          * new inode label or new policy.
3302          * This check is not redundant - do not remove.
3303          */
3304         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3305 }
3306
3307 /* task security operations */
3308
3309 static int selinux_task_create(unsigned long clone_flags)
3310 {
3311         return current_has_perm(current, PROCESS__FORK);
3312 }
3313
3314 /*
3315  * allocate the SELinux part of blank credentials
3316  */
3317 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3318 {
3319         struct task_security_struct *tsec;
3320
3321         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3322         if (!tsec)
3323                 return -ENOMEM;
3324
3325         cred->security = tsec;
3326         return 0;
3327 }
3328
3329 /*
3330  * detach and free the LSM part of a set of credentials
3331  */
3332 static void selinux_cred_free(struct cred *cred)
3333 {
3334         struct task_security_struct *tsec = cred->security;
3335
3336         /*
3337          * cred->security == NULL if security_cred_alloc_blank() or
3338          * security_prepare_creds() returned an error.
3339          */
3340         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3341         cred->security = (void *) 0x7UL;
3342         kfree(tsec);
3343 }
3344
3345 /*
3346  * prepare a new set of credentials for modification
3347  */
3348 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3349                                 gfp_t gfp)
3350 {
3351         const struct task_security_struct *old_tsec;
3352         struct task_security_struct *tsec;
3353
3354         old_tsec = old->security;
3355
3356         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3357         if (!tsec)
3358                 return -ENOMEM;
3359
3360         new->security = tsec;
3361         return 0;
3362 }
3363
3364 /*
3365  * transfer the SELinux data to a blank set of creds
3366  */
3367 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3368 {
3369         const struct task_security_struct *old_tsec = old->security;
3370         struct task_security_struct *tsec = new->security;
3371
3372         *tsec = *old_tsec;
3373 }
3374
3375 /*
3376  * set the security data for a kernel service
3377  * - all the creation contexts are set to unlabelled
3378  */
3379 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3380 {
3381         struct task_security_struct *tsec = new->security;
3382         u32 sid = current_sid();
3383         int ret;
3384
3385         ret = avc_has_perm(sid, secid,
3386                            SECCLASS_KERNEL_SERVICE,
3387                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3388                            NULL);
3389         if (ret == 0) {
3390                 tsec->sid = secid;
3391                 tsec->create_sid = 0;
3392                 tsec->keycreate_sid = 0;
3393                 tsec->sockcreate_sid = 0;
3394         }
3395         return ret;
3396 }
3397
3398 /*
3399  * set the file creation context in a security record to the same as the
3400  * objective context of the specified inode
3401  */
3402 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3403 {
3404         struct inode_security_struct *isec = inode->i_security;
3405         struct task_security_struct *tsec = new->security;
3406         u32 sid = current_sid();
3407         int ret;
3408
3409         ret = avc_has_perm(sid, isec->sid,
3410                            SECCLASS_KERNEL_SERVICE,
3411                            KERNEL_SERVICE__CREATE_FILES_AS,
3412                            NULL);
3413
3414         if (ret == 0)
3415                 tsec->create_sid = isec->sid;
3416         return ret;
3417 }
3418
3419 static int selinux_kernel_module_request(char *kmod_name)
3420 {
3421         u32 sid;
3422         struct common_audit_data ad;
3423
3424         sid = task_sid(current);
3425
3426         ad.type = LSM_AUDIT_DATA_KMOD;
3427         ad.u.kmod_name = kmod_name;
3428
3429         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3430                             SYSTEM__MODULE_REQUEST, &ad);
3431 }
3432
3433 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3434 {
3435         return current_has_perm(p, PROCESS__SETPGID);
3436 }
3437
3438 static int selinux_task_getpgid(struct task_struct *p)
3439 {
3440         return current_has_perm(p, PROCESS__GETPGID);
3441 }
3442
3443 static int selinux_task_getsid(struct task_struct *p)
3444 {
3445         return current_has_perm(p, PROCESS__GETSESSION);
3446 }
3447
3448 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3449 {
3450         *secid = task_sid(p);
3451 }
3452
3453 static int selinux_task_setnice(struct task_struct *p, int nice)
3454 {
3455         int rc;
3456
3457         rc = cap_task_setnice(p, nice);
3458         if (rc)
3459                 return rc;
3460
3461         return current_has_perm(p, PROCESS__SETSCHED);
3462 }
3463
3464 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3465 {
3466         int rc;
3467
3468         rc = cap_task_setioprio(p, ioprio);
3469         if (rc)
3470                 return rc;
3471
3472         return current_has_perm(p, PROCESS__SETSCHED);
3473 }
3474
3475 static int selinux_task_getioprio(struct task_struct *p)
3476 {
3477         return current_has_perm(p, PROCESS__GETSCHED);
3478 }
3479
3480 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3481                 struct rlimit *new_rlim)
3482 {
3483         struct rlimit *old_rlim = p->signal->rlim + resource;
3484
3485         /* Control the ability to change the hard limit (whether
3486            lowering or raising it), so that the hard limit can
3487            later be used as a safe reset point for the soft limit
3488            upon context transitions.  See selinux_bprm_committing_creds. */
3489         if (old_rlim->rlim_max != new_rlim->rlim_max)
3490                 return current_has_perm(p, PROCESS__SETRLIMIT);
3491
3492         return 0;
3493 }
3494
3495 static int selinux_task_setscheduler(struct task_struct *p)
3496 {
3497         int rc;
3498
3499         rc = cap_task_setscheduler(p);
3500         if (rc)
3501                 return rc;
3502
3503         return current_has_perm(p, PROCESS__SETSCHED);
3504 }
3505
3506 static int selinux_task_getscheduler(struct task_struct *p)
3507 {
3508         return current_has_perm(p, PROCESS__GETSCHED);
3509 }
3510
3511 static int selinux_task_movememory(struct task_struct *p)
3512 {
3513         return current_has_perm(p, PROCESS__SETSCHED);
3514 }
3515
3516 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3517                                 int sig, u32 secid)
3518 {
3519         u32 perm;
3520         int rc;
3521
3522         if (!sig)
3523                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3524         else
3525                 perm = signal_to_av(sig);
3526         if (secid)
3527                 rc = avc_has_perm(secid, task_sid(p),
3528                                   SECCLASS_PROCESS, perm, NULL);
3529         else
3530                 rc = current_has_perm(p, perm);
3531         return rc;
3532 }
3533
3534 static int selinux_task_wait(struct task_struct *p)
3535 {
3536         return task_has_perm(p, current, PROCESS__SIGCHLD);
3537 }
3538
3539 static void selinux_task_to_inode(struct task_struct *p,
3540                                   struct inode *inode)
3541 {
3542         struct inode_security_struct *isec = inode->i_security;
3543         u32 sid = task_sid(p);
3544
3545         isec->sid = sid;
3546         isec->initialized = 1;
3547 }
3548
3549 /* Returns error only if unable to parse addresses */
3550 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3551                         struct common_audit_data *ad, u8 *proto)
3552 {
3553         int offset, ihlen, ret = -EINVAL;
3554         struct iphdr _iph, *ih;
3555
3556         offset = skb_network_offset(skb);
3557         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3558         if (ih == NULL)
3559                 goto out;
3560
3561         ihlen = ih->ihl * 4;
3562         if (ihlen < sizeof(_iph))
3563                 goto out;
3564
3565         ad->u.net->v4info.saddr = ih->saddr;
3566         ad->u.net->v4info.daddr = ih->daddr;
3567         ret = 0;
3568
3569         if (proto)
3570                 *proto = ih->protocol;
3571
3572         switch (ih->protocol) {
3573         case IPPROTO_TCP: {
3574                 struct tcphdr _tcph, *th;
3575
3576                 if (ntohs(ih->frag_off) & IP_OFFSET)
3577                         break;
3578
3579                 offset += ihlen;
3580                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3581                 if (th == NULL)
3582                         break;
3583
3584                 ad->u.net->sport = th->source;
3585                 ad->u.net->dport = th->dest;
3586                 break;
3587         }
3588
3589         case IPPROTO_UDP: {
3590                 struct udphdr _udph, *uh;
3591
3592                 if (ntohs(ih->frag_off) & IP_OFFSET)
3593                         break;
3594
3595                 offset += ihlen;
3596                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3597                 if (uh == NULL)
3598                         break;
3599
3600                 ad->u.net->sport = uh->source;
3601                 ad->u.net->dport = uh->dest;
3602                 break;
3603         }
3604
3605         case IPPROTO_DCCP: {
3606                 struct dccp_hdr _dccph, *dh;
3607
3608                 if (ntohs(ih->frag_off) & IP_OFFSET)
3609                         break;
3610
3611                 offset += ihlen;
3612                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3613                 if (dh == NULL)
3614                         break;
3615
3616                 ad->u.net->sport = dh->dccph_sport;
3617                 ad->u.net->dport = dh->dccph_dport;
3618                 break;
3619         }
3620
3621         default:
3622                 break;
3623         }
3624 out:
3625         return ret;
3626 }
3627
3628 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3629
3630 /* Returns error only if unable to parse addresses */
3631 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3632                         struct common_audit_data *ad, u8 *proto)
3633 {
3634         u8 nexthdr;
3635         int ret = -EINVAL, offset;
3636         struct ipv6hdr _ipv6h, *ip6;
3637         __be16 frag_off;
3638
3639         offset = skb_network_offset(skb);
3640         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3641         if (ip6 == NULL)
3642                 goto out;
3643
3644         ad->u.net->v6info.saddr = ip6->saddr;
3645         ad->u.net->v6info.daddr = ip6->daddr;
3646         ret = 0;
3647
3648         nexthdr = ip6->nexthdr;
3649         offset += sizeof(_ipv6h);
3650         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3651         if (offset < 0)
3652                 goto out;
3653
3654         if (proto)
3655                 *proto = nexthdr;
3656
3657         switch (nexthdr) {
3658         case IPPROTO_TCP: {
3659                 struct tcphdr _tcph, *th;
3660
3661                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3662                 if (th == NULL)
3663                         break;
3664
3665                 ad->u.net->sport = th->source;
3666                 ad->u.net->dport = th->dest;
3667                 break;
3668         }
3669
3670         case IPPROTO_UDP: {
3671                 struct udphdr _udph, *uh;
3672
3673                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3674                 if (uh == NULL)
3675                         break;
3676
3677                 ad->u.net->sport = uh->source;
3678                 ad->u.net->dport = uh->dest;
3679                 break;
3680         }
3681
3682         case IPPROTO_DCCP: {
3683                 struct dccp_hdr _dccph, *dh;
3684
3685                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3686                 if (dh == NULL)
3687                         break;
3688
3689                 ad->u.net->sport = dh->dccph_sport;
3690                 ad->u.net->dport = dh->dccph_dport;
3691                 break;
3692         }
3693
3694         /* includes fragments */
3695         default:
3696                 break;
3697         }
3698 out:
3699         return ret;
3700 }
3701
3702 #endif /* IPV6 */
3703
3704 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3705                              char **_addrp, int src, u8 *proto)
3706 {
3707         char *addrp;
3708         int ret;
3709
3710         switch (ad->u.net->family) {
3711         case PF_INET:
3712                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3713                 if (ret)
3714                         goto parse_error;
3715                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3716                                        &ad->u.net->v4info.daddr);
3717                 goto okay;
3718
3719 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3720         case PF_INET6:
3721                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3722                 if (ret)
3723                         goto parse_error;
3724                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3725                                        &ad->u.net->v6info.daddr);
3726                 goto okay;
3727 #endif  /* IPV6 */
3728         default:
3729                 addrp = NULL;
3730                 goto okay;
3731         }
3732
3733 parse_error:
3734         printk(KERN_WARNING
3735                "SELinux: failure in selinux_parse_skb(),"
3736                " unable to parse packet\n");
3737         return ret;
3738
3739 okay:
3740         if (_addrp)
3741                 *_addrp = addrp;
3742         return 0;
3743 }
3744
3745 /**
3746  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3747  * @skb: the packet
3748  * @family: protocol family
3749  * @sid: the packet's peer label SID
3750  *
3751  * Description:
3752  * Check the various different forms of network peer labeling and determine
3753  * the peer label/SID for the packet; most of the magic actually occurs in
3754  * the security server function security_net_peersid_cmp().  The function
3755  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3756  * or -EACCES if @sid is invalid due to inconsistencies with the different
3757  * peer labels.
3758  *
3759  */
3760 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3761 {
3762         int err;
3763         u32 xfrm_sid;
3764         u32 nlbl_sid;
3765         u32 nlbl_type;
3766
3767         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3768         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3769
3770         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3771         if (unlikely(err)) {
3772                 printk(KERN_WARNING
3773                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3774                        " unable to determine packet's peer label\n");
3775                 return -EACCES;
3776         }
3777
3778         return 0;
3779 }
3780
3781 /* socket security operations */
3782
3783 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3784                                  u16 secclass, u32 *socksid)
3785 {
3786         if (tsec->sockcreate_sid > SECSID_NULL) {
3787                 *socksid = tsec->sockcreate_sid;
3788                 return 0;
3789         }
3790
3791         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3792                                        socksid);
3793 }
3794
3795 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3796 {
3797         struct sk_security_struct *sksec = sk->sk_security;
3798         struct common_audit_data ad;
3799         struct lsm_network_audit net = {0,};
3800         u32 tsid = task_sid(task);
3801
3802         if (sksec->sid == SECINITSID_KERNEL)
3803                 return 0;
3804
3805         ad.type = LSM_AUDIT_DATA_NET;
3806         ad.u.net = &net;
3807         ad.u.net->sk = sk;
3808
3809         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3810 }
3811
3812 static int selinux_socket_create(int family, int type,
3813                                  int protocol, int kern)
3814 {
3815         const struct task_security_struct *tsec = current_security();
3816         u32 newsid;
3817         u16 secclass;
3818         int rc;
3819
3820         if (kern)
3821                 return 0;
3822
3823         secclass = socket_type_to_security_class(family, type, protocol);
3824         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3825         if (rc)
3826                 return rc;
3827
3828         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3829 }
3830
3831 static int selinux_socket_post_create(struct socket *sock, int family,
3832                                       int type, int protocol, int kern)
3833 {
3834         const struct task_security_struct *tsec = current_security();
3835         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3836         struct sk_security_struct *sksec;
3837         int err = 0;
3838
3839         isec->sclass = socket_type_to_security_class(family, type, protocol);
3840
3841         if (kern)
3842                 isec->sid = SECINITSID_KERNEL;
3843         else {
3844                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3845                 if (err)
3846                         return err;
3847         }
3848
3849         isec->initialized = 1;
3850
3851         if (sock->sk) {
3852                 sksec = sock->sk->sk_security;
3853                 sksec->sid = isec->sid;
3854                 sksec->sclass = isec->sclass;
3855                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3856         }
3857
3858         return err;
3859 }
3860
3861 /* Range of port numbers used to automatically bind.
3862    Need to determine whether we should perform a name_bind
3863    permission check between the socket and the port number. */
3864
3865 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3866 {
3867         struct sock *sk = sock->sk;
3868         u16 family;
3869         int err;
3870
3871         err = sock_has_perm(current, sk, SOCKET__BIND);
3872         if (err)
3873                 goto out;
3874
3875         /*
3876          * If PF_INET or PF_INET6, check name_bind permission for the port.
3877          * Multiple address binding for SCTP is not supported yet: we just
3878          * check the first address now.
3879          */
3880         family = sk->sk_family;
3881         if (family == PF_INET || family == PF_INET6) {
3882                 char *addrp;
3883                 struct sk_security_struct *sksec = sk->sk_security;
3884                 struct common_audit_data ad;
3885                 struct lsm_network_audit net = {0,};
3886                 struct sockaddr_in *addr4 = NULL;
3887                 struct sockaddr_in6 *addr6 = NULL;
3888                 unsigned short snum;
3889                 u32 sid, node_perm;
3890
3891                 if (family == PF_INET) {
3892                         addr4 = (struct sockaddr_in *)address;
3893                         snum = ntohs(addr4->sin_port);
3894                         addrp = (char *)&addr4->sin_addr.s_addr;
3895                 } else {
3896                         addr6 = (struct sockaddr_in6 *)address;
3897                         snum = ntohs(addr6->sin6_port);
3898                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3899                 }
3900
3901                 if (snum) {
3902                         int low, high;
3903
3904                         inet_get_local_port_range(&low, &high);
3905
3906                         if (snum < max(PROT_SOCK, low) || snum > high) {
3907                                 err = sel_netport_sid(sk->sk_protocol,
3908                                                       snum, &sid);
3909                                 if (err)
3910                                         goto out;
3911                                 ad.type = LSM_AUDIT_DATA_NET;
3912                                 ad.u.net = &net;
3913                                 ad.u.net->sport = htons(snum);
3914                                 ad.u.net->family = family;
3915                                 err = avc_has_perm(sksec->sid, sid,
3916                                                    sksec->sclass,
3917                                                    SOCKET__NAME_BIND, &ad);
3918                                 if (err)
3919                                         goto out;
3920                         }
3921                 }
3922
3923                 switch (sksec->sclass) {
3924                 case SECCLASS_TCP_SOCKET:
3925                         node_perm = TCP_SOCKET__NODE_BIND;
3926                         break;
3927
3928                 case SECCLASS_UDP_SOCKET:
3929                         node_perm = UDP_SOCKET__NODE_BIND;
3930                         break;
3931
3932                 case SECCLASS_DCCP_SOCKET:
3933                         node_perm = DCCP_SOCKET__NODE_BIND;
3934                         break;
3935
3936                 default:
3937                         node_perm = RAWIP_SOCKET__NODE_BIND;
3938                         break;
3939                 }
3940
3941                 err = sel_netnode_sid(addrp, family, &sid);
3942                 if (err)
3943                         goto out;
3944
3945                 ad.type = LSM_AUDIT_DATA_NET;
3946                 ad.u.net = &net;
3947                 ad.u.net->sport = htons(snum);
3948                 ad.u.net->family = family;
3949
3950                 if (family == PF_INET)
3951                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3952                 else
3953                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3954
3955                 err = avc_has_perm(sksec->sid, sid,
3956                                    sksec->sclass, node_perm, &ad);
3957                 if (err)
3958                         goto out;
3959         }
3960 out:
3961         return err;
3962 }
3963
3964 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3965 {
3966         struct sock *sk = sock->sk;
3967         struct sk_security_struct *sksec = sk->sk_security;
3968         int err;
3969
3970         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3971         if (err)
3972                 return err;
3973
3974         /*
3975          * If a TCP or DCCP socket, check name_connect permission for the port.
3976          */
3977         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3978             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3979                 struct common_audit_data ad;
3980                 struct lsm_network_audit net = {0,};
3981                 struct sockaddr_in *addr4 = NULL;
3982                 struct sockaddr_in6 *addr6 = NULL;
3983                 unsigned short snum;
3984                 u32 sid, perm;
3985
3986                 if (sk->sk_family == PF_INET) {
3987                         addr4 = (struct sockaddr_in *)address;
3988                         if (addrlen < sizeof(struct sockaddr_in))
3989                                 return -EINVAL;
3990                         snum = ntohs(addr4->sin_port);
3991                 } else {
3992                         addr6 = (struct sockaddr_in6 *)address;
3993                         if (addrlen < SIN6_LEN_RFC2133)
3994                                 return -EINVAL;
3995                         snum = ntohs(addr6->sin6_port);
3996                 }
3997
3998                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3999                 if (err)
4000                         goto out;
4001
4002                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4003                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4004
4005                 ad.type = LSM_AUDIT_DATA_NET;
4006                 ad.u.net = &net;
4007                 ad.u.net->dport = htons(snum);
4008                 ad.u.net->family = sk->sk_family;
4009                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4010                 if (err)
4011                         goto out;
4012         }
4013
4014         err = selinux_netlbl_socket_connect(sk, address);
4015
4016 out:
4017         return err;
4018 }
4019
4020 static int selinux_socket_listen(struct socket *sock, int backlog)
4021 {
4022         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4023 }
4024
4025 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4026 {
4027         int err;
4028         struct inode_security_struct *isec;
4029         struct inode_security_struct *newisec;
4030
4031         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4032         if (err)
4033                 return err;
4034
4035         newisec = SOCK_INODE(newsock)->i_security;
4036
4037         isec = SOCK_INODE(sock)->i_security;
4038         newisec->sclass = isec->sclass;
4039         newisec->sid = isec->sid;
4040         newisec->initialized = 1;
4041
4042         return 0;
4043 }
4044
4045 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4046                                   int size)
4047 {
4048         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4049 }
4050
4051 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4052                                   int size, int flags)
4053 {
4054         return sock_has_perm(current, sock->sk, SOCKET__READ);
4055 }
4056
4057 static int selinux_socket_getsockname(struct socket *sock)
4058 {
4059         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4060 }
4061
4062 static int selinux_socket_getpeername(struct socket *sock)
4063 {
4064         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4065 }
4066
4067 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4068 {
4069         int err;
4070
4071         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4072         if (err)
4073                 return err;
4074
4075         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4076 }
4077
4078 static int selinux_socket_getsockopt(struct socket *sock, int level,
4079                                      int optname)
4080 {
4081         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4082 }
4083
4084 static int selinux_socket_shutdown(struct socket *sock, int how)
4085 {
4086         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4087 }
4088
4089 static int selinux_socket_unix_stream_connect(struct sock *sock,
4090                                               struct sock *other,
4091                                               struct sock *newsk)
4092 {
4093         struct sk_security_struct *sksec_sock = sock->sk_security;
4094         struct sk_security_struct *sksec_other = other->sk_security;
4095         struct sk_security_struct *sksec_new = newsk->sk_security;
4096         struct common_audit_data ad;
4097         struct lsm_network_audit net = {0,};
4098         int err;
4099
4100         ad.type = LSM_AUDIT_DATA_NET;
4101         ad.u.net = &net;
4102         ad.u.net->sk = other;
4103
4104         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4105                            sksec_other->sclass,
4106                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4107         if (err)
4108                 return err;
4109
4110         /* server child socket */
4111         sksec_new->peer_sid = sksec_sock->sid;
4112         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4113                                     &sksec_new->sid);
4114         if (err)
4115                 return err;
4116
4117         /* connecting socket */
4118         sksec_sock->peer_sid = sksec_new->sid;
4119
4120         return 0;
4121 }
4122
4123 static int selinux_socket_unix_may_send(struct socket *sock,
4124                                         struct socket *other)
4125 {
4126         struct sk_security_struct *ssec = sock->sk->sk_security;
4127         struct sk_security_struct *osec = other->sk->sk_security;
4128         struct common_audit_data ad;
4129         struct lsm_network_audit net = {0,};
4130
4131         ad.type = LSM_AUDIT_DATA_NET;
4132         ad.u.net = &net;
4133         ad.u.net->sk = other->sk;
4134
4135         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4136                             &ad);
4137 }
4138
4139 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4140                                     u32 peer_sid,
4141                                     struct common_audit_data *ad)
4142 {
4143         int err;
4144         u32 if_sid;
4145         u32 node_sid;
4146
4147         err = sel_netif_sid(ifindex, &if_sid);
4148         if (err)
4149                 return err;
4150         err = avc_has_perm(peer_sid, if_sid,
4151                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4152         if (err)
4153                 return err;
4154
4155         err = sel_netnode_sid(addrp, family, &node_sid);
4156         if (err)
4157                 return err;
4158         return avc_has_perm(peer_sid, node_sid,
4159                             SECCLASS_NODE, NODE__RECVFROM, ad);
4160 }
4161
4162 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4163                                        u16 family)
4164 {
4165         int err = 0;
4166         struct sk_security_struct *sksec = sk->sk_security;
4167         u32 sk_sid = sksec->sid;
4168         struct common_audit_data ad;
4169         struct lsm_network_audit net = {0,};
4170         char *addrp;
4171
4172         ad.type = LSM_AUDIT_DATA_NET;
4173         ad.u.net = &net;
4174         ad.u.net->netif = skb->skb_iif;
4175         ad.u.net->family = family;
4176         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4177         if (err)
4178                 return err;
4179
4180         if (selinux_secmark_enabled()) {
4181                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4182                                    PACKET__RECV, &ad);
4183                 if (err)
4184                         return err;
4185         }
4186
4187         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4188         if (err)
4189                 return err;
4190         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4191
4192         return err;
4193 }
4194
4195 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4196 {
4197         int err;
4198         struct sk_security_struct *sksec = sk->sk_security;
4199         u16 family = sk->sk_family;
4200         u32 sk_sid = sksec->sid;
4201         struct common_audit_data ad;
4202         struct lsm_network_audit net = {0,};
4203         char *addrp;
4204         u8 secmark_active;
4205         u8 peerlbl_active;
4206
4207         if (family != PF_INET && family != PF_INET6)
4208                 return 0;
4209
4210         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4211         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4212                 family = PF_INET;
4213
4214         /* If any sort of compatibility mode is enabled then handoff processing
4215          * to the selinux_sock_rcv_skb_compat() function to deal with the
4216          * special handling.  We do this in an attempt to keep this function
4217          * as fast and as clean as possible. */
4218         if (!selinux_policycap_netpeer)
4219                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4220
4221         secmark_active = selinux_secmark_enabled();
4222         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4223         if (!secmark_active && !peerlbl_active)
4224                 return 0;
4225
4226         ad.type = LSM_AUDIT_DATA_NET;
4227         ad.u.net = &net;
4228         ad.u.net->netif = skb->skb_iif;
4229         ad.u.net->family = family;
4230         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4231         if (err)
4232                 return err;
4233
4234         if (peerlbl_active) {
4235                 u32 peer_sid;
4236
4237                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4238                 if (err)
4239                         return err;
4240                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4241                                                peer_sid, &ad);
4242                 if (err) {
4243                         selinux_netlbl_err(skb, err, 0);
4244                         return err;
4245                 }
4246                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4247                                    PEER__RECV, &ad);
4248                 if (err)
4249                         selinux_netlbl_err(skb, err, 0);
4250         }
4251
4252         if (secmark_active) {
4253                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4254                                    PACKET__RECV, &ad);
4255                 if (err)
4256                         return err;
4257         }
4258
4259         return err;
4260 }
4261
4262 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4263                                             int __user *optlen, unsigned len)
4264 {
4265         int err = 0;
4266         char *scontext;
4267         u32 scontext_len;
4268         struct sk_security_struct *sksec = sock->sk->sk_security;
4269         u32 peer_sid = SECSID_NULL;
4270
4271         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4272             sksec->sclass == SECCLASS_TCP_SOCKET)
4273                 peer_sid = sksec->peer_sid;
4274         if (peer_sid == SECSID_NULL)
4275                 return -ENOPROTOOPT;
4276
4277         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4278         if (err)
4279                 return err;
4280
4281         if (scontext_len > len) {
4282                 err = -ERANGE;
4283                 goto out_len;
4284         }
4285
4286         if (copy_to_user(optval, scontext, scontext_len))
4287                 err = -EFAULT;
4288
4289 out_len:
4290         if (put_user(scontext_len, optlen))
4291                 err = -EFAULT;
4292         kfree(scontext);
4293         return err;
4294 }
4295
4296 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4297 {
4298         u32 peer_secid = SECSID_NULL;
4299         u16 family;
4300
4301         if (skb && skb->protocol == htons(ETH_P_IP))
4302                 family = PF_INET;
4303         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4304                 family = PF_INET6;
4305         else if (sock)
4306                 family = sock->sk->sk_family;
4307         else
4308                 goto out;
4309
4310         if (sock && family == PF_UNIX)
4311                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4312         else if (skb)
4313                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4314
4315 out:
4316         *secid = peer_secid;
4317         if (peer_secid == SECSID_NULL)
4318                 return -EINVAL;
4319         return 0;
4320 }
4321
4322 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4323 {
4324         struct sk_security_struct *sksec;
4325
4326         sksec = kzalloc(sizeof(*sksec), priority);
4327         if (!sksec)
4328                 return -ENOMEM;
4329
4330         sksec->peer_sid = SECINITSID_UNLABELED;
4331         sksec->sid = SECINITSID_UNLABELED;
4332         selinux_netlbl_sk_security_reset(sksec);
4333         sk->sk_security = sksec;
4334
4335         return 0;
4336 }
4337
4338 static void selinux_sk_free_security(struct sock *sk)
4339 {
4340         struct sk_security_struct *sksec = sk->sk_security;
4341
4342         sk->sk_security = NULL;
4343         selinux_netlbl_sk_security_free(sksec);
4344         kfree(sksec);
4345 }
4346
4347 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4348 {
4349         struct sk_security_struct *sksec = sk->sk_security;
4350         struct sk_security_struct *newsksec = newsk->sk_security;
4351
4352         newsksec->sid = sksec->sid;
4353         newsksec->peer_sid = sksec->peer_sid;
4354         newsksec->sclass = sksec->sclass;
4355
4356         selinux_netlbl_sk_security_reset(newsksec);
4357 }
4358
4359 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4360 {
4361         if (!sk)
4362                 *secid = SECINITSID_ANY_SOCKET;
4363         else {
4364                 struct sk_security_struct *sksec = sk->sk_security;
4365
4366                 *secid = sksec->sid;
4367         }
4368 }
4369
4370 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4371 {
4372         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4373         struct sk_security_struct *sksec = sk->sk_security;
4374
4375         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4376             sk->sk_family == PF_UNIX)
4377                 isec->sid = sksec->sid;
4378         sksec->sclass = isec->sclass;
4379 }
4380
4381 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4382                                      struct request_sock *req)
4383 {
4384         struct sk_security_struct *sksec = sk->sk_security;
4385         int err;
4386         u16 family = sk->sk_family;
4387         u32 newsid;
4388         u32 peersid;
4389
4390         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4391         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4392                 family = PF_INET;
4393
4394         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4395         if (err)
4396                 return err;
4397         if (peersid == SECSID_NULL) {
4398                 req->secid = sksec->sid;
4399                 req->peer_secid = SECSID_NULL;
4400         } else {
4401                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4402                 if (err)
4403                         return err;
4404                 req->secid = newsid;
4405                 req->peer_secid = peersid;
4406         }
4407
4408         return selinux_netlbl_inet_conn_request(req, family);
4409 }
4410
4411 static void selinux_inet_csk_clone(struct sock *newsk,
4412                                    const struct request_sock *req)
4413 {
4414         struct sk_security_struct *newsksec = newsk->sk_security;
4415
4416         newsksec->sid = req->secid;
4417         newsksec->peer_sid = req->peer_secid;
4418         /* NOTE: Ideally, we should also get the isec->sid for the
4419            new socket in sync, but we don't have the isec available yet.
4420            So we will wait until sock_graft to do it, by which
4421            time it will have been created and available. */
4422
4423         /* We don't need to take any sort of lock here as we are the only
4424          * thread with access to newsksec */
4425         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4426 }
4427
4428 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4429 {
4430         u16 family = sk->sk_family;
4431         struct sk_security_struct *sksec = sk->sk_security;
4432
4433         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4434         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4435                 family = PF_INET;
4436
4437         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4438 }
4439
4440 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4441 {
4442         skb_set_owner_w(skb, sk);
4443 }
4444
4445 static int selinux_secmark_relabel_packet(u32 sid)
4446 {
4447         const struct task_security_struct *__tsec;
4448         u32 tsid;
4449
4450         __tsec = current_security();
4451         tsid = __tsec->sid;
4452
4453         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4454 }
4455
4456 static void selinux_secmark_refcount_inc(void)
4457 {
4458         atomic_inc(&selinux_secmark_refcount);
4459 }
4460
4461 static void selinux_secmark_refcount_dec(void)
4462 {
4463         atomic_dec(&selinux_secmark_refcount);
4464 }
4465
4466 static void selinux_req_classify_flow(const struct request_sock *req,
4467                                       struct flowi *fl)
4468 {
4469         fl->flowi_secid = req->secid;
4470 }
4471
4472 static int selinux_tun_dev_alloc_security(void **security)
4473 {
4474         struct tun_security_struct *tunsec;
4475
4476         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4477         if (!tunsec)
4478                 return -ENOMEM;
4479         tunsec->sid = current_sid();
4480
4481         *security = tunsec;
4482         return 0;
4483 }
4484
4485 static void selinux_tun_dev_free_security(void *security)
4486 {
4487         kfree(security);
4488 }
4489
4490 static int selinux_tun_dev_create(void)
4491 {
4492         u32 sid = current_sid();
4493
4494         /* we aren't taking into account the "sockcreate" SID since the socket
4495          * that is being created here is not a socket in the traditional sense,
4496          * instead it is a private sock, accessible only to the kernel, and
4497          * representing a wide range of network traffic spanning multiple
4498          * connections unlike traditional sockets - check the TUN driver to
4499          * get a better understanding of why this socket is special */
4500
4501         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4502                             NULL);
4503 }
4504
4505 static int selinux_tun_dev_attach_queue(void *security)
4506 {
4507         struct tun_security_struct *tunsec = security;
4508
4509         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4510                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4511 }
4512
4513 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4514 {
4515         struct tun_security_struct *tunsec = security;
4516         struct sk_security_struct *sksec = sk->sk_security;
4517
4518         /* we don't currently perform any NetLabel based labeling here and it
4519          * isn't clear that we would want to do so anyway; while we could apply
4520          * labeling without the support of the TUN user the resulting labeled
4521          * traffic from the other end of the connection would almost certainly
4522          * cause confusion to the TUN user that had no idea network labeling
4523          * protocols were being used */
4524
4525         sksec->sid = tunsec->sid;
4526         sksec->sclass = SECCLASS_TUN_SOCKET;
4527
4528         return 0;
4529 }
4530
4531 static int selinux_tun_dev_open(void *security)
4532 {
4533         struct tun_security_struct *tunsec = security;
4534         u32 sid = current_sid();
4535         int err;
4536
4537         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4538                            TUN_SOCKET__RELABELFROM, NULL);
4539         if (err)
4540                 return err;
4541         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4542                            TUN_SOCKET__RELABELTO, NULL);
4543         if (err)
4544                 return err;
4545         tunsec->sid = sid;
4546
4547         return 0;
4548 }
4549
4550 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4551 {
4552         int err = 0;
4553         u32 perm;
4554         struct nlmsghdr *nlh;
4555         struct sk_security_struct *sksec = sk->sk_security;
4556
4557         if (skb->len < NLMSG_HDRLEN) {
4558                 err = -EINVAL;
4559                 goto out;
4560         }
4561         nlh = nlmsg_hdr(skb);
4562
4563         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4564         if (err) {
4565                 if (err == -EINVAL) {
4566                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4567                                   "SELinux:  unrecognized netlink message"
4568                                   " type=%hu for sclass=%hu\n",
4569                                   nlh->nlmsg_type, sksec->sclass);
4570                         if (!selinux_enforcing || security_get_allow_unknown())
4571                                 err = 0;
4572                 }
4573
4574                 /* Ignore */
4575                 if (err == -ENOENT)
4576                         err = 0;
4577                 goto out;
4578         }
4579
4580         err = sock_has_perm(current, sk, perm);
4581 out:
4582         return err;
4583 }
4584
4585 #ifdef CONFIG_NETFILTER
4586
4587 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4588                                        u16 family)
4589 {
4590         int err;
4591         char *addrp;
4592         u32 peer_sid;
4593         struct common_audit_data ad;
4594         struct lsm_network_audit net = {0,};
4595         u8 secmark_active;
4596         u8 netlbl_active;
4597         u8 peerlbl_active;
4598
4599         if (!selinux_policycap_netpeer)
4600                 return NF_ACCEPT;
4601
4602         secmark_active = selinux_secmark_enabled();
4603         netlbl_active = netlbl_enabled();
4604         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4605         if (!secmark_active && !peerlbl_active)
4606                 return NF_ACCEPT;
4607
4608         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4609                 return NF_DROP;
4610
4611         ad.type = LSM_AUDIT_DATA_NET;
4612         ad.u.net = &net;
4613         ad.u.net->netif = ifindex;
4614         ad.u.net->family = family;
4615         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4616                 return NF_DROP;
4617
4618         if (peerlbl_active) {
4619                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4620                                                peer_sid, &ad);
4621                 if (err) {
4622                         selinux_netlbl_err(skb, err, 1);
4623                         return NF_DROP;
4624                 }
4625         }
4626
4627         if (secmark_active)
4628                 if (avc_has_perm(peer_sid, skb->secmark,
4629                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4630                         return NF_DROP;
4631
4632         if (netlbl_active)
4633                 /* we do this in the FORWARD path and not the POST_ROUTING
4634                  * path because we want to make sure we apply the necessary
4635                  * labeling before IPsec is applied so we can leverage AH
4636                  * protection */
4637                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4638                         return NF_DROP;
4639
4640         return NF_ACCEPT;
4641 }
4642
4643 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4644                                          struct sk_buff *skb,
4645                                          const struct net_device *in,
4646                                          const struct net_device *out,
4647                                          int (*okfn)(struct sk_buff *))
4648 {
4649         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4650 }
4651
4652 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4653 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4654                                          struct sk_buff *skb,
4655                                          const struct net_device *in,
4656                                          const struct net_device *out,
4657                                          int (*okfn)(struct sk_buff *))
4658 {
4659         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4660 }
4661 #endif  /* IPV6 */
4662
4663 static unsigned int selinux_ip_output(struct sk_buff *skb,
4664                                       u16 family)
4665 {
4666         u32 sid;
4667
4668         if (!netlbl_enabled())
4669                 return NF_ACCEPT;
4670
4671         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4672          * because we want to make sure we apply the necessary labeling
4673          * before IPsec is applied so we can leverage AH protection */
4674         if (skb->sk) {
4675                 struct sk_security_struct *sksec = skb->sk->sk_security;
4676                 sid = sksec->sid;
4677         } else
4678                 sid = SECINITSID_KERNEL;
4679         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4680                 return NF_DROP;
4681
4682         return NF_ACCEPT;
4683 }
4684
4685 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4686                                         struct sk_buff *skb,
4687                                         const struct net_device *in,
4688                                         const struct net_device *out,
4689                                         int (*okfn)(struct sk_buff *))
4690 {
4691         return selinux_ip_output(skb, PF_INET);
4692 }
4693
4694 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4695                                                 int ifindex,
4696                                                 u16 family)
4697 {
4698         struct sock *sk = skb->sk;
4699         struct sk_security_struct *sksec;
4700         struct common_audit_data ad;
4701         struct lsm_network_audit net = {0,};
4702         char *addrp;
4703         u8 proto;
4704
4705         if (sk == NULL)
4706                 return NF_ACCEPT;
4707         sksec = sk->sk_security;
4708
4709         ad.type = LSM_AUDIT_DATA_NET;
4710         ad.u.net = &net;
4711         ad.u.net->netif = ifindex;
4712         ad.u.net->family = family;
4713         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4714                 return NF_DROP;
4715
4716         if (selinux_secmark_enabled())
4717                 if (avc_has_perm(sksec->sid, skb->secmark,
4718                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4719                         return NF_DROP_ERR(-ECONNREFUSED);
4720
4721         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4722                 return NF_DROP_ERR(-ECONNREFUSED);
4723
4724         return NF_ACCEPT;
4725 }
4726
4727 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4728                                          u16 family)
4729 {
4730         u32 secmark_perm;
4731         u32 peer_sid;
4732         struct sock *sk;
4733         struct common_audit_data ad;
4734         struct lsm_network_audit net = {0,};
4735         char *addrp;
4736         u8 secmark_active;
4737         u8 peerlbl_active;
4738
4739         /* If any sort of compatibility mode is enabled then handoff processing
4740          * to the selinux_ip_postroute_compat() function to deal with the
4741          * special handling.  We do this in an attempt to keep this function
4742          * as fast and as clean as possible. */
4743         if (!selinux_policycap_netpeer)
4744                 return selinux_ip_postroute_compat(skb, ifindex, family);
4745 #ifdef CONFIG_XFRM
4746         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4747          * packet transformation so allow the packet to pass without any checks
4748          * since we'll have another chance to perform access control checks
4749          * when the packet is on it's final way out.
4750          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4751          *       is NULL, in this case go ahead and apply access control. */
4752         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4753                 return NF_ACCEPT;
4754 #endif
4755         secmark_active = selinux_secmark_enabled();
4756         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4757         if (!secmark_active && !peerlbl_active)
4758                 return NF_ACCEPT;
4759
4760         /* if the packet is being forwarded then get the peer label from the
4761          * packet itself; otherwise check to see if it is from a local
4762          * application or the kernel, if from an application get the peer label
4763          * from the sending socket, otherwise use the kernel's sid */
4764         sk = skb->sk;
4765         if (sk == NULL) {
4766                 if (skb->skb_iif) {
4767                         secmark_perm = PACKET__FORWARD_OUT;
4768                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4769                                 return NF_DROP;
4770                 } else {
4771                         secmark_perm = PACKET__SEND;
4772                         peer_sid = SECINITSID_KERNEL;
4773                 }
4774         } else {
4775                 struct sk_security_struct *sksec = sk->sk_security;
4776                 peer_sid = sksec->sid;
4777                 secmark_perm = PACKET__SEND;
4778         }
4779
4780         ad.type = LSM_AUDIT_DATA_NET;
4781         ad.u.net = &net;
4782         ad.u.net->netif = ifindex;
4783         ad.u.net->family = family;
4784         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4785                 return NF_DROP;
4786
4787         if (secmark_active)
4788                 if (avc_has_perm(peer_sid, skb->secmark,
4789                                  SECCLASS_PACKET, secmark_perm, &ad))
4790                         return NF_DROP_ERR(-ECONNREFUSED);
4791
4792         if (peerlbl_active) {
4793                 u32 if_sid;
4794                 u32 node_sid;
4795
4796                 if (sel_netif_sid(ifindex, &if_sid))
4797                         return NF_DROP;
4798                 if (avc_has_perm(peer_sid, if_sid,
4799                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4800                         return NF_DROP_ERR(-ECONNREFUSED);
4801
4802                 if (sel_netnode_sid(addrp, family, &node_sid))
4803                         return NF_DROP;
4804                 if (avc_has_perm(peer_sid, node_sid,
4805                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4806                         return NF_DROP_ERR(-ECONNREFUSED);
4807         }
4808
4809         return NF_ACCEPT;
4810 }
4811
4812 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4813                                            struct sk_buff *skb,
4814                                            const struct net_device *in,
4815                                            const struct net_device *out,
4816                                            int (*okfn)(struct sk_buff *))
4817 {
4818         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4819 }
4820
4821 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4822 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4823                                            struct sk_buff *skb,
4824                                            const struct net_device *in,
4825                                            const struct net_device *out,
4826                                            int (*okfn)(struct sk_buff *))
4827 {
4828         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4829 }
4830 #endif  /* IPV6 */
4831
4832 #endif  /* CONFIG_NETFILTER */
4833
4834 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4835 {
4836         int err;
4837
4838         err = cap_netlink_send(sk, skb);
4839         if (err)
4840                 return err;
4841
4842         return selinux_nlmsg_perm(sk, skb);
4843 }
4844
4845 static int ipc_alloc_security(struct task_struct *task,
4846                               struct kern_ipc_perm *perm,
4847                               u16 sclass)
4848 {
4849         struct ipc_security_struct *isec;
4850         u32 sid;
4851
4852         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4853         if (!isec)
4854                 return -ENOMEM;
4855
4856         sid = task_sid(task);
4857         isec->sclass = sclass;
4858         isec->sid = sid;
4859         perm->security = isec;
4860
4861         return 0;
4862 }
4863
4864 static void ipc_free_security(struct kern_ipc_perm *perm)
4865 {
4866         struct ipc_security_struct *isec = perm->security;
4867         perm->security = NULL;
4868         kfree(isec);
4869 }
4870
4871 static int msg_msg_alloc_security(struct msg_msg *msg)
4872 {
4873         struct msg_security_struct *msec;
4874
4875         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4876         if (!msec)
4877                 return -ENOMEM;
4878
4879         msec->sid = SECINITSID_UNLABELED;
4880         msg->security = msec;
4881
4882         return 0;
4883 }
4884
4885 static void msg_msg_free_security(struct msg_msg *msg)
4886 {
4887         struct msg_security_struct *msec = msg->security;
4888
4889         msg->security = NULL;
4890         kfree(msec);
4891 }
4892
4893 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4894                         u32 perms)
4895 {
4896         struct ipc_security_struct *isec;
4897         struct common_audit_data ad;
4898         u32 sid = current_sid();
4899
4900         isec = ipc_perms->security;
4901
4902         ad.type = LSM_AUDIT_DATA_IPC;
4903         ad.u.ipc_id = ipc_perms->key;
4904
4905         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4906 }
4907
4908 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4909 {
4910         return msg_msg_alloc_security(msg);
4911 }
4912
4913 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4914 {
4915         msg_msg_free_security(msg);
4916 }
4917
4918 /* message queue security operations */
4919 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4920 {
4921         struct ipc_security_struct *isec;
4922         struct common_audit_data ad;
4923         u32 sid = current_sid();
4924         int rc;
4925
4926         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4927         if (rc)
4928                 return rc;
4929
4930         isec = msq->q_perm.security;
4931
4932         ad.type = LSM_AUDIT_DATA_IPC;
4933         ad.u.ipc_id = msq->q_perm.key;
4934
4935         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4936                           MSGQ__CREATE, &ad);
4937         if (rc) {
4938                 ipc_free_security(&msq->q_perm);
4939                 return rc;
4940         }
4941         return 0;
4942 }
4943
4944 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4945 {
4946         ipc_free_security(&msq->q_perm);
4947 }
4948
4949 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4950 {
4951         struct ipc_security_struct *isec;
4952         struct common_audit_data ad;
4953         u32 sid = current_sid();
4954
4955         isec = msq->q_perm.security;
4956
4957         ad.type = LSM_AUDIT_DATA_IPC;
4958         ad.u.ipc_id = msq->q_perm.key;
4959
4960         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4961                             MSGQ__ASSOCIATE, &ad);
4962 }
4963
4964 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4965 {
4966         int err;
4967         int perms;
4968
4969         switch (cmd) {
4970         case IPC_INFO:
4971         case MSG_INFO:
4972                 /* No specific object, just general system-wide information. */
4973                 return task_has_system(current, SYSTEM__IPC_INFO);
4974         case IPC_STAT:
4975         case MSG_STAT:
4976                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4977                 break;
4978         case IPC_SET:
4979                 perms = MSGQ__SETATTR;
4980                 break;
4981         case IPC_RMID:
4982                 perms = MSGQ__DESTROY;
4983                 break;
4984         default:
4985                 return 0;
4986         }
4987
4988         err = ipc_has_perm(&msq->q_perm, perms);
4989         return err;
4990 }
4991
4992 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4993 {
4994         struct ipc_security_struct *isec;
4995         struct msg_security_struct *msec;
4996         struct common_audit_data ad;
4997         u32 sid = current_sid();
4998         int rc;
4999
5000         isec = msq->q_perm.security;
5001         msec = msg->security;
5002
5003         /*
5004          * First time through, need to assign label to the message
5005          */
5006         if (msec->sid == SECINITSID_UNLABELED) {
5007                 /*
5008                  * Compute new sid based on current process and
5009                  * message queue this message will be stored in
5010                  */
5011                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5012                                              NULL, &msec->sid);
5013                 if (rc)
5014                         return rc;
5015         }
5016
5017         ad.type = LSM_AUDIT_DATA_IPC;
5018         ad.u.ipc_id = msq->q_perm.key;
5019
5020         /* Can this process write to the queue? */
5021         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5022                           MSGQ__WRITE, &ad);
5023         if (!rc)
5024                 /* Can this process send the message */
5025                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5026                                   MSG__SEND, &ad);
5027         if (!rc)
5028                 /* Can the message be put in the queue? */
5029                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5030                                   MSGQ__ENQUEUE, &ad);
5031
5032         return rc;
5033 }
5034
5035 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5036                                     struct task_struct *target,
5037                                     long type, int mode)
5038 {
5039         struct ipc_security_struct *isec;
5040         struct msg_security_struct *msec;
5041         struct common_audit_data ad;
5042         u32 sid = task_sid(target);
5043         int rc;
5044
5045         isec = msq->q_perm.security;
5046         msec = msg->security;
5047
5048         ad.type = LSM_AUDIT_DATA_IPC;
5049         ad.u.ipc_id = msq->q_perm.key;
5050
5051         rc = avc_has_perm(sid, isec->sid,
5052                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5053         if (!rc)
5054                 rc = avc_has_perm(sid, msec->sid,
5055                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5056         return rc;
5057 }
5058
5059 /* Shared Memory security operations */
5060 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5061 {
5062         struct ipc_security_struct *isec;
5063         struct common_audit_data ad;
5064         u32 sid = current_sid();
5065         int rc;
5066
5067         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5068         if (rc)
5069                 return rc;
5070
5071         isec = shp->shm_perm.security;
5072
5073         ad.type = LSM_AUDIT_DATA_IPC;
5074         ad.u.ipc_id = shp->shm_perm.key;
5075
5076         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5077                           SHM__CREATE, &ad);
5078         if (rc) {
5079                 ipc_free_security(&shp->shm_perm);
5080                 return rc;
5081         }
5082         return 0;
5083 }
5084
5085 static void selinux_shm_free_security(struct shmid_kernel *shp)
5086 {
5087         ipc_free_security(&shp->shm_perm);
5088 }
5089
5090 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5091 {
5092         struct ipc_security_struct *isec;
5093         struct common_audit_data ad;
5094         u32 sid = current_sid();
5095
5096         isec = shp->shm_perm.security;
5097
5098         ad.type = LSM_AUDIT_DATA_IPC;
5099         ad.u.ipc_id = shp->shm_perm.key;
5100
5101         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5102                             SHM__ASSOCIATE, &ad);
5103 }
5104
5105 /* Note, at this point, shp is locked down */
5106 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5107 {
5108         int perms;
5109         int err;
5110
5111         switch (cmd) {
5112         case IPC_INFO:
5113         case SHM_INFO:
5114                 /* No specific object, just general system-wide information. */
5115                 return task_has_system(current, SYSTEM__IPC_INFO);
5116         case IPC_STAT:
5117         case SHM_STAT:
5118                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5119                 break;
5120         case IPC_SET:
5121                 perms = SHM__SETATTR;
5122                 break;
5123         case SHM_LOCK:
5124         case SHM_UNLOCK:
5125                 perms = SHM__LOCK;
5126                 break;
5127         case IPC_RMID:
5128                 perms = SHM__DESTROY;
5129                 break;
5130         default:
5131                 return 0;
5132         }
5133
5134         err = ipc_has_perm(&shp->shm_perm, perms);
5135         return err;
5136 }
5137
5138 static int selinux_shm_shmat(struct shmid_kernel *shp,
5139                              char __user *shmaddr, int shmflg)
5140 {
5141         u32 perms;
5142
5143         if (shmflg & SHM_RDONLY)
5144                 perms = SHM__READ;
5145         else
5146                 perms = SHM__READ | SHM__WRITE;
5147
5148         return ipc_has_perm(&shp->shm_perm, perms);
5149 }
5150
5151 /* Semaphore security operations */
5152 static int selinux_sem_alloc_security(struct sem_array *sma)
5153 {
5154         struct ipc_security_struct *isec;
5155         struct common_audit_data ad;
5156         u32 sid = current_sid();
5157         int rc;
5158
5159         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5160         if (rc)
5161                 return rc;
5162
5163         isec = sma->sem_perm.security;
5164
5165         ad.type = LSM_AUDIT_DATA_IPC;
5166         ad.u.ipc_id = sma->sem_perm.key;
5167
5168         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5169                           SEM__CREATE, &ad);
5170         if (rc) {
5171                 ipc_free_security(&sma->sem_perm);
5172                 return rc;
5173         }
5174         return 0;
5175 }
5176
5177 static void selinux_sem_free_security(struct sem_array *sma)
5178 {
5179         ipc_free_security(&sma->sem_perm);
5180 }
5181
5182 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5183 {
5184         struct ipc_security_struct *isec;
5185         struct common_audit_data ad;
5186         u32 sid = current_sid();
5187
5188         isec = sma->sem_perm.security;
5189
5190         ad.type = LSM_AUDIT_DATA_IPC;
5191         ad.u.ipc_id = sma->sem_perm.key;
5192
5193         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5194                             SEM__ASSOCIATE, &ad);
5195 }
5196
5197 /* Note, at this point, sma is locked down */
5198 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5199 {
5200         int err;
5201         u32 perms;
5202
5203         switch (cmd) {
5204         case IPC_INFO:
5205         case SEM_INFO:
5206                 /* No specific object, just general system-wide information. */
5207                 return task_has_system(current, SYSTEM__IPC_INFO);
5208         case GETPID:
5209         case GETNCNT:
5210         case GETZCNT:
5211                 perms = SEM__GETATTR;
5212                 break;
5213         case GETVAL:
5214         case GETALL:
5215                 perms = SEM__READ;
5216                 break;
5217         case SETVAL:
5218         case SETALL:
5219                 perms = SEM__WRITE;
5220                 break;
5221         case IPC_RMID:
5222                 perms = SEM__DESTROY;
5223                 break;
5224         case IPC_SET:
5225                 perms = SEM__SETATTR;
5226                 break;
5227         case IPC_STAT:
5228         case SEM_STAT:
5229                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5230                 break;
5231         default:
5232                 return 0;
5233         }
5234
5235         err = ipc_has_perm(&sma->sem_perm, perms);
5236         return err;
5237 }
5238
5239 static int selinux_sem_semop(struct sem_array *sma,
5240                              struct sembuf *sops, unsigned nsops, int alter)
5241 {
5242         u32 perms;
5243
5244         if (alter)
5245                 perms = SEM__READ | SEM__WRITE;
5246         else
5247                 perms = SEM__READ;
5248
5249         return ipc_has_perm(&sma->sem_perm, perms);
5250 }
5251
5252 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5253 {
5254         u32 av = 0;
5255
5256         av = 0;
5257         if (flag & S_IRUGO)
5258                 av |= IPC__UNIX_READ;
5259         if (flag & S_IWUGO)
5260                 av |= IPC__UNIX_WRITE;
5261
5262         if (av == 0)
5263                 return 0;
5264
5265         return ipc_has_perm(ipcp, av);
5266 }
5267
5268 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5269 {
5270         struct ipc_security_struct *isec = ipcp->security;
5271         *secid = isec->sid;
5272 }
5273
5274 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5275 {
5276         if (inode)
5277                 inode_doinit_with_dentry(inode, dentry);
5278 }
5279
5280 static int selinux_getprocattr(struct task_struct *p,
5281                                char *name, char **value)
5282 {
5283         const struct task_security_struct *__tsec;
5284         u32 sid;
5285         int error;
5286         unsigned len;
5287
5288         if (current != p) {
5289                 error = current_has_perm(p, PROCESS__GETATTR);
5290                 if (error)
5291                         return error;
5292         }
5293
5294         rcu_read_lock();
5295         __tsec = __task_cred(p)->security;
5296
5297         if (!strcmp(name, "current"))
5298                 sid = __tsec->sid;
5299         else if (!strcmp(name, "prev"))
5300                 sid = __tsec->osid;
5301         else if (!strcmp(name, "exec"))
5302                 sid = __tsec->exec_sid;
5303         else if (!strcmp(name, "fscreate"))
5304                 sid = __tsec->create_sid;
5305         else if (!strcmp(name, "keycreate"))
5306                 sid = __tsec->keycreate_sid;
5307         else if (!strcmp(name, "sockcreate"))
5308                 sid = __tsec->sockcreate_sid;
5309         else
5310                 goto invalid;
5311         rcu_read_unlock();
5312
5313         if (!sid)
5314                 return 0;
5315
5316         error = security_sid_to_context(sid, value, &len);
5317         if (error)
5318                 return error;
5319         return len;
5320
5321 invalid:
5322         rcu_read_unlock();
5323         return -EINVAL;
5324 }
5325
5326 static int selinux_setprocattr(struct task_struct *p,
5327                                char *name, void *value, size_t size)
5328 {
5329         struct task_security_struct *tsec;
5330         struct task_struct *tracer;
5331         struct cred *new;
5332         u32 sid = 0, ptsid;
5333         int error;
5334         char *str = value;
5335
5336         if (current != p) {
5337                 /* SELinux only allows a process to change its own
5338                    security attributes. */
5339                 return -EACCES;
5340         }
5341
5342         /*
5343          * Basic control over ability to set these attributes at all.
5344          * current == p, but we'll pass them separately in case the
5345          * above restriction is ever removed.
5346          */
5347         if (!strcmp(name, "exec"))
5348                 error = current_has_perm(p, PROCESS__SETEXEC);
5349         else if (!strcmp(name, "fscreate"))
5350                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5351         else if (!strcmp(name, "keycreate"))
5352                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5353         else if (!strcmp(name, "sockcreate"))
5354                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5355         else if (!strcmp(name, "current"))
5356                 error = current_has_perm(p, PROCESS__SETCURRENT);
5357         else
5358                 error = -EINVAL;
5359         if (error)
5360                 return error;
5361
5362         /* Obtain a SID for the context, if one was specified. */
5363         if (size && str[1] && str[1] != '\n') {
5364                 if (str[size-1] == '\n') {
5365                         str[size-1] = 0;
5366                         size--;
5367                 }
5368                 error = security_context_to_sid(value, size, &sid);
5369                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5370                         if (!capable(CAP_MAC_ADMIN)) {
5371                                 struct audit_buffer *ab;
5372                                 size_t audit_size;
5373
5374                                 /* We strip a nul only if it is at the end, otherwise the
5375                                  * context contains a nul and we should audit that */
5376                                 if (str[size - 1] == '\0')
5377                                         audit_size = size - 1;
5378                                 else
5379                                         audit_size = size;
5380                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5381                                 audit_log_format(ab, "op=fscreate invalid_context=");
5382                                 audit_log_n_untrustedstring(ab, value, audit_size);
5383                                 audit_log_end(ab);
5384
5385                                 return error;
5386                         }
5387                         error = security_context_to_sid_force(value, size,
5388                                                               &sid);
5389                 }
5390                 if (error)
5391                         return error;
5392         }
5393
5394         new = prepare_creds();
5395         if (!new)
5396                 return -ENOMEM;
5397
5398         /* Permission checking based on the specified context is
5399            performed during the actual operation (execve,
5400            open/mkdir/...), when we know the full context of the
5401            operation.  See selinux_bprm_set_creds for the execve
5402            checks and may_create for the file creation checks. The
5403            operation will then fail if the context is not permitted. */
5404         tsec = new->security;
5405         if (!strcmp(name, "exec")) {
5406                 tsec->exec_sid = sid;
5407         } else if (!strcmp(name, "fscreate")) {
5408                 tsec->create_sid = sid;
5409         } else if (!strcmp(name, "keycreate")) {
5410                 error = may_create_key(sid, p);
5411                 if (error)
5412                         goto abort_change;
5413                 tsec->keycreate_sid = sid;
5414         } else if (!strcmp(name, "sockcreate")) {
5415                 tsec->sockcreate_sid = sid;
5416         } else if (!strcmp(name, "current")) {
5417                 error = -EINVAL;
5418                 if (sid == 0)
5419                         goto abort_change;
5420
5421                 /* Only allow single threaded processes to change context */
5422                 error = -EPERM;
5423                 if (!current_is_single_threaded()) {
5424                         error = security_bounded_transition(tsec->sid, sid);
5425                         if (error)
5426                                 goto abort_change;
5427                 }
5428
5429                 /* Check permissions for the transition. */
5430                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5431                                      PROCESS__DYNTRANSITION, NULL);
5432                 if (error)
5433                         goto abort_change;
5434
5435                 /* Check for ptracing, and update the task SID if ok.
5436                    Otherwise, leave SID unchanged and fail. */
5437                 ptsid = 0;
5438                 task_lock(p);
5439                 tracer = ptrace_parent(p);
5440                 if (tracer)
5441                         ptsid = task_sid(tracer);
5442                 task_unlock(p);
5443
5444                 if (tracer) {
5445                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5446                                              PROCESS__PTRACE, NULL);
5447                         if (error)
5448                                 goto abort_change;
5449                 }
5450
5451                 tsec->sid = sid;
5452         } else {
5453                 error = -EINVAL;
5454                 goto abort_change;
5455         }
5456
5457         commit_creds(new);
5458         return size;
5459
5460 abort_change:
5461         abort_creds(new);
5462         return error;
5463 }
5464
5465 static int selinux_ismaclabel(const char *name)
5466 {
5467         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5468 }
5469
5470 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5471 {
5472         return security_sid_to_context(secid, secdata, seclen);
5473 }
5474
5475 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5476 {
5477         return security_context_to_sid(secdata, seclen, secid);
5478 }
5479
5480 static void selinux_release_secctx(char *secdata, u32 seclen)
5481 {
5482         kfree(secdata);
5483 }
5484
5485 /*
5486  *      called with inode->i_mutex locked
5487  */
5488 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5489 {
5490         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5491 }
5492
5493 /*
5494  *      called with inode->i_mutex locked
5495  */
5496 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5497 {
5498         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5499 }
5500
5501 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5502 {
5503         int len = 0;
5504         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5505                                                 ctx, true);
5506         if (len < 0)
5507                 return len;
5508         *ctxlen = len;
5509         return 0;
5510 }
5511 #ifdef CONFIG_KEYS
5512
5513 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5514                              unsigned long flags)
5515 {
5516         const struct task_security_struct *tsec;
5517         struct key_security_struct *ksec;
5518
5519         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5520         if (!ksec)
5521                 return -ENOMEM;
5522
5523         tsec = cred->security;
5524         if (tsec->keycreate_sid)
5525                 ksec->sid = tsec->keycreate_sid;
5526         else
5527                 ksec->sid = tsec->sid;
5528
5529         k->security = ksec;
5530         return 0;
5531 }
5532
5533 static void selinux_key_free(struct key *k)
5534 {
5535         struct key_security_struct *ksec = k->security;
5536
5537         k->security = NULL;
5538         kfree(ksec);
5539 }
5540
5541 static int selinux_key_permission(key_ref_t key_ref,
5542                                   const struct cred *cred,
5543                                   key_perm_t perm)
5544 {
5545         struct key *key;
5546         struct key_security_struct *ksec;
5547         u32 sid;
5548
5549         /* if no specific permissions are requested, we skip the
5550            permission check. No serious, additional covert channels
5551            appear to be created. */
5552         if (perm == 0)
5553                 return 0;
5554
5555         sid = cred_sid(cred);
5556
5557         key = key_ref_to_ptr(key_ref);
5558         ksec = key->security;
5559
5560         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5561 }
5562
5563 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5564 {
5565         struct key_security_struct *ksec = key->security;
5566         char *context = NULL;
5567         unsigned len;
5568         int rc;
5569
5570         rc = security_sid_to_context(ksec->sid, &context, &len);
5571         if (!rc)
5572                 rc = len;
5573         *_buffer = context;
5574         return rc;
5575 }
5576
5577 #endif
5578
5579 static struct security_operations selinux_ops = {
5580         .name =                         "selinux",
5581
5582         .ptrace_access_check =          selinux_ptrace_access_check,
5583         .ptrace_traceme =               selinux_ptrace_traceme,
5584         .capget =                       selinux_capget,
5585         .capset =                       selinux_capset,
5586         .capable =                      selinux_capable,
5587         .quotactl =                     selinux_quotactl,
5588         .quota_on =                     selinux_quota_on,
5589         .syslog =                       selinux_syslog,
5590         .vm_enough_memory =             selinux_vm_enough_memory,
5591
5592         .netlink_send =                 selinux_netlink_send,
5593
5594         .bprm_set_creds =               selinux_bprm_set_creds,
5595         .bprm_committing_creds =        selinux_bprm_committing_creds,
5596         .bprm_committed_creds =         selinux_bprm_committed_creds,
5597         .bprm_secureexec =              selinux_bprm_secureexec,
5598
5599         .sb_alloc_security =            selinux_sb_alloc_security,
5600         .sb_free_security =             selinux_sb_free_security,
5601         .sb_copy_data =                 selinux_sb_copy_data,
5602         .sb_remount =                   selinux_sb_remount,
5603         .sb_kern_mount =                selinux_sb_kern_mount,
5604         .sb_show_options =              selinux_sb_show_options,
5605         .sb_statfs =                    selinux_sb_statfs,
5606         .sb_mount =                     selinux_mount,
5607         .sb_umount =                    selinux_umount,
5608         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5609         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5610         .sb_parse_opts_str =            selinux_parse_opts_str,
5611
5612         .dentry_init_security =         selinux_dentry_init_security,
5613
5614         .inode_alloc_security =         selinux_inode_alloc_security,
5615         .inode_free_security =          selinux_inode_free_security,
5616         .inode_init_security =          selinux_inode_init_security,
5617         .inode_create =                 selinux_inode_create,
5618         .inode_link =                   selinux_inode_link,
5619         .inode_unlink =                 selinux_inode_unlink,
5620         .inode_symlink =                selinux_inode_symlink,
5621         .inode_mkdir =                  selinux_inode_mkdir,
5622         .inode_rmdir =                  selinux_inode_rmdir,
5623         .inode_mknod =                  selinux_inode_mknod,
5624         .inode_rename =                 selinux_inode_rename,
5625         .inode_readlink =               selinux_inode_readlink,
5626         .inode_follow_link =            selinux_inode_follow_link,
5627         .inode_permission =             selinux_inode_permission,
5628         .inode_setattr =                selinux_inode_setattr,
5629         .inode_getattr =                selinux_inode_getattr,
5630         .inode_setxattr =               selinux_inode_setxattr,
5631         .inode_post_setxattr =          selinux_inode_post_setxattr,
5632         .inode_getxattr =               selinux_inode_getxattr,
5633         .inode_listxattr =              selinux_inode_listxattr,
5634         .inode_removexattr =            selinux_inode_removexattr,
5635         .inode_getsecurity =            selinux_inode_getsecurity,
5636         .inode_setsecurity =            selinux_inode_setsecurity,
5637         .inode_listsecurity =           selinux_inode_listsecurity,
5638         .inode_getsecid =               selinux_inode_getsecid,
5639
5640         .file_permission =              selinux_file_permission,
5641         .file_alloc_security =          selinux_file_alloc_security,
5642         .file_free_security =           selinux_file_free_security,
5643         .file_ioctl =                   selinux_file_ioctl,
5644         .mmap_file =                    selinux_mmap_file,
5645         .mmap_addr =                    selinux_mmap_addr,
5646         .file_mprotect =                selinux_file_mprotect,
5647         .file_lock =                    selinux_file_lock,
5648         .file_fcntl =                   selinux_file_fcntl,
5649         .file_set_fowner =              selinux_file_set_fowner,
5650         .file_send_sigiotask =          selinux_file_send_sigiotask,
5651         .file_receive =                 selinux_file_receive,
5652
5653         .file_open =                    selinux_file_open,
5654
5655         .task_create =                  selinux_task_create,
5656         .cred_alloc_blank =             selinux_cred_alloc_blank,
5657         .cred_free =                    selinux_cred_free,
5658         .cred_prepare =                 selinux_cred_prepare,
5659         .cred_transfer =                selinux_cred_transfer,
5660         .kernel_act_as =                selinux_kernel_act_as,
5661         .kernel_create_files_as =       selinux_kernel_create_files_as,
5662         .kernel_module_request =        selinux_kernel_module_request,
5663         .task_setpgid =                 selinux_task_setpgid,
5664         .task_getpgid =                 selinux_task_getpgid,
5665         .task_getsid =                  selinux_task_getsid,
5666         .task_getsecid =                selinux_task_getsecid,
5667         .task_setnice =                 selinux_task_setnice,
5668         .task_setioprio =               selinux_task_setioprio,
5669         .task_getioprio =               selinux_task_getioprio,
5670         .task_setrlimit =               selinux_task_setrlimit,
5671         .task_setscheduler =            selinux_task_setscheduler,
5672         .task_getscheduler =            selinux_task_getscheduler,
5673         .task_movememory =              selinux_task_movememory,
5674         .task_kill =                    selinux_task_kill,
5675         .task_wait =                    selinux_task_wait,
5676         .task_to_inode =                selinux_task_to_inode,
5677
5678         .ipc_permission =               selinux_ipc_permission,
5679         .ipc_getsecid =                 selinux_ipc_getsecid,
5680
5681         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5682         .msg_msg_free_security =        selinux_msg_msg_free_security,
5683
5684         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5685         .msg_queue_free_security =      selinux_msg_queue_free_security,
5686         .msg_queue_associate =          selinux_msg_queue_associate,
5687         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5688         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5689         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5690
5691         .shm_alloc_security =           selinux_shm_alloc_security,
5692         .shm_free_security =            selinux_shm_free_security,
5693         .shm_associate =                selinux_shm_associate,
5694         .shm_shmctl =                   selinux_shm_shmctl,
5695         .shm_shmat =                    selinux_shm_shmat,
5696
5697         .sem_alloc_security =           selinux_sem_alloc_security,
5698         .sem_free_security =            selinux_sem_free_security,
5699         .sem_associate =                selinux_sem_associate,
5700         .sem_semctl =                   selinux_sem_semctl,
5701         .sem_semop =                    selinux_sem_semop,
5702
5703         .d_instantiate =                selinux_d_instantiate,
5704
5705         .getprocattr =                  selinux_getprocattr,
5706         .setprocattr =                  selinux_setprocattr,
5707
5708         .ismaclabel =                   selinux_ismaclabel,
5709         .secid_to_secctx =              selinux_secid_to_secctx,
5710         .secctx_to_secid =              selinux_secctx_to_secid,
5711         .release_secctx =               selinux_release_secctx,
5712         .inode_notifysecctx =           selinux_inode_notifysecctx,
5713         .inode_setsecctx =              selinux_inode_setsecctx,
5714         .inode_getsecctx =              selinux_inode_getsecctx,
5715
5716         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5717         .unix_may_send =                selinux_socket_unix_may_send,
5718
5719         .socket_create =                selinux_socket_create,
5720         .socket_post_create =           selinux_socket_post_create,
5721         .socket_bind =                  selinux_socket_bind,
5722         .socket_connect =               selinux_socket_connect,
5723         .socket_listen =                selinux_socket_listen,
5724         .socket_accept =                selinux_socket_accept,
5725         .socket_sendmsg =               selinux_socket_sendmsg,
5726         .socket_recvmsg =               selinux_socket_recvmsg,
5727         .socket_getsockname =           selinux_socket_getsockname,
5728         .socket_getpeername =           selinux_socket_getpeername,
5729         .socket_getsockopt =            selinux_socket_getsockopt,
5730         .socket_setsockopt =            selinux_socket_setsockopt,
5731         .socket_shutdown =              selinux_socket_shutdown,
5732         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5733         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5734         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5735         .sk_alloc_security =            selinux_sk_alloc_security,
5736         .sk_free_security =             selinux_sk_free_security,
5737         .sk_clone_security =            selinux_sk_clone_security,
5738         .sk_getsecid =                  selinux_sk_getsecid,
5739         .sock_graft =                   selinux_sock_graft,
5740         .inet_conn_request =            selinux_inet_conn_request,
5741         .inet_csk_clone =               selinux_inet_csk_clone,
5742         .inet_conn_established =        selinux_inet_conn_established,
5743         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5744         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5745         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5746         .req_classify_flow =            selinux_req_classify_flow,
5747         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5748         .tun_dev_free_security =        selinux_tun_dev_free_security,
5749         .tun_dev_create =               selinux_tun_dev_create,
5750         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5751         .tun_dev_attach =               selinux_tun_dev_attach,
5752         .tun_dev_open =                 selinux_tun_dev_open,
5753         .skb_owned_by =                 selinux_skb_owned_by,
5754
5755 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5756         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5757         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5758         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5759         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5760         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5761         .xfrm_state_free_security =     selinux_xfrm_state_free,
5762         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5763         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5764         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5765         .xfrm_decode_session =          selinux_xfrm_decode_session,
5766 #endif
5767
5768 #ifdef CONFIG_KEYS
5769         .key_alloc =                    selinux_key_alloc,
5770         .key_free =                     selinux_key_free,
5771         .key_permission =               selinux_key_permission,
5772         .key_getsecurity =              selinux_key_getsecurity,
5773 #endif
5774
5775 #ifdef CONFIG_AUDIT
5776         .audit_rule_init =              selinux_audit_rule_init,
5777         .audit_rule_known =             selinux_audit_rule_known,
5778         .audit_rule_match =             selinux_audit_rule_match,
5779         .audit_rule_free =              selinux_audit_rule_free,
5780 #endif
5781 };
5782
5783 static __init int selinux_init(void)
5784 {
5785         if (!security_module_enable(&selinux_ops)) {
5786                 selinux_enabled = 0;
5787                 return 0;
5788         }
5789
5790         if (!selinux_enabled) {
5791                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5792                 return 0;
5793         }
5794
5795         printk(KERN_INFO "SELinux:  Initializing.\n");
5796
5797         /* Set the security state for the initial task. */
5798         cred_init_security();
5799
5800         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5801
5802         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5803                                             sizeof(struct inode_security_struct),
5804                                             0, SLAB_PANIC, NULL);
5805         avc_init();
5806
5807         if (register_security(&selinux_ops))
5808                 panic("SELinux: Unable to register with kernel.\n");
5809
5810         if (selinux_enforcing)
5811                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5812         else
5813                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5814
5815         return 0;
5816 }
5817
5818 static void delayed_superblock_init(struct super_block *sb, void *unused)
5819 {
5820         superblock_doinit(sb, NULL);
5821 }
5822
5823 void selinux_complete_init(void)
5824 {
5825         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5826
5827         /* Set up any superblocks initialized prior to the policy load. */
5828         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5829         iterate_supers(delayed_superblock_init, NULL);
5830 }
5831
5832 /* SELinux requires early initialization in order to label
5833    all processes and objects when they are created. */
5834 security_initcall(selinux_init);
5835
5836 #if defined(CONFIG_NETFILTER)
5837
5838 static struct nf_hook_ops selinux_ipv4_ops[] = {
5839         {
5840                 .hook =         selinux_ipv4_postroute,
5841                 .owner =        THIS_MODULE,
5842                 .pf =           NFPROTO_IPV4,
5843                 .hooknum =      NF_INET_POST_ROUTING,
5844                 .priority =     NF_IP_PRI_SELINUX_LAST,
5845         },
5846         {
5847                 .hook =         selinux_ipv4_forward,
5848                 .owner =        THIS_MODULE,
5849                 .pf =           NFPROTO_IPV4,
5850                 .hooknum =      NF_INET_FORWARD,
5851                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5852         },
5853         {
5854                 .hook =         selinux_ipv4_output,
5855                 .owner =        THIS_MODULE,
5856                 .pf =           NFPROTO_IPV4,
5857                 .hooknum =      NF_INET_LOCAL_OUT,
5858                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5859         }
5860 };
5861
5862 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5863
5864 static struct nf_hook_ops selinux_ipv6_ops[] = {
5865         {
5866                 .hook =         selinux_ipv6_postroute,
5867                 .owner =        THIS_MODULE,
5868                 .pf =           NFPROTO_IPV6,
5869                 .hooknum =      NF_INET_POST_ROUTING,
5870                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5871         },
5872         {
5873                 .hook =         selinux_ipv6_forward,
5874                 .owner =        THIS_MODULE,
5875                 .pf =           NFPROTO_IPV6,
5876                 .hooknum =      NF_INET_FORWARD,
5877                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5878         }
5879 };
5880
5881 #endif  /* IPV6 */
5882
5883 static int __init selinux_nf_ip_init(void)
5884 {
5885         int err = 0;
5886
5887         if (!selinux_enabled)
5888                 goto out;
5889
5890         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5891
5892         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5893         if (err)
5894                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5895
5896 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5897         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5898         if (err)
5899                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5900 #endif  /* IPV6 */
5901
5902 out:
5903         return err;
5904 }
5905
5906 __initcall(selinux_nf_ip_init);
5907
5908 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5909 static void selinux_nf_ip_exit(void)
5910 {
5911         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5912
5913         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5914 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5915         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5916 #endif  /* IPV6 */
5917 }
5918 #endif
5919
5920 #else /* CONFIG_NETFILTER */
5921
5922 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5923 #define selinux_nf_ip_exit()
5924 #endif
5925
5926 #endif /* CONFIG_NETFILTER */
5927
5928 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5929 static int selinux_disabled;
5930
5931 int selinux_disable(void)
5932 {
5933         if (ss_initialized) {
5934                 /* Not permitted after initial policy load. */
5935                 return -EINVAL;
5936         }
5937
5938         if (selinux_disabled) {
5939                 /* Only do this once. */
5940                 return -EINVAL;
5941         }
5942
5943         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5944
5945         selinux_disabled = 1;
5946         selinux_enabled = 0;
5947
5948         reset_security_ops();
5949
5950         /* Try to destroy the avc node cache */
5951         avc_disable();
5952
5953         /* Unregister netfilter hooks. */
5954         selinux_nf_ip_exit();
5955
5956         /* Unregister selinuxfs. */
5957         exit_sel_fs();
5958
5959         return 0;
5960 }
5961 #endif