security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define NUM_SEL_MNT_OPTS 5
  98
  99 extern struct security_operations *security_ops;
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!strict_strtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!strict_strtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (atomic_read(&selinux_secmark_refcount) > 0);
 147 }
 148
 149 /*
 150  * initialise the security for the init task
 151  */
 152 static void cred_init_security(void)
 153 {
 154         struct cred *cred = (struct cred *) current->real_cred;
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 panic("SELinux:  Failed to initialize initial task.\n");
 160
 161         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 162         cred->security = tsec;
 163 }
 164
 165 /*
 166  * get the security ID of a set of credentials
 167  */
 168 static inline u32 cred_sid(const struct cred *cred)
 169 {
 170         const struct task_security_struct *tsec;
 171
 172         tsec = cred->security;
 173         return tsec->sid;
 174 }
 175
 176 /*
 177  * get the objective security ID of a task
 178  */
 179 static inline u32 task_sid(const struct task_struct *task)
 180 {
 181         u32 sid;
 182
 183         rcu_read_lock();
 184         sid = cred_sid(__task_cred(task));
 185         rcu_read_unlock();
 186         return sid;
 187 }
 188
 189 /*
 190  * get the subjective security ID of the current task
 191  */
 192 static inline u32 current_sid(void)
 193 {
 194         const struct task_security_struct *tsec = current_security();
 195
 196         return tsec->sid;
 197 }
 198
 199 /* Allocate and free functions for each kind of security blob. */
 200
 201 static int inode_alloc_security(struct inode *inode)
 202 {
 203         struct inode_security_struct *isec;
 204         u32 sid = current_sid();
 205
 206         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 207         if (!isec)
 208                 return -ENOMEM;
 209
 210         mutex_init(&isec->lock);
 211         INIT_LIST_HEAD(&isec->list);
 212         isec->inode = inode;
 213         isec->sid = SECINITSID_UNLABELED;
 214         isec->sclass = SECCLASS_FILE;
 215         isec->task_sid = sid;
 216         inode->i_security = isec;
 217
 218         return 0;
 219 }
 220
 221 static void inode_free_security(struct inode *inode)
 222 {
 223         struct inode_security_struct *isec = inode->i_security;
 224         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 225
 226         spin_lock(&sbsec->isec_lock);
 227         if (!list_empty(&isec->list))
 228                 list_del_init(&isec->list);
 229         spin_unlock(&sbsec->isec_lock);
 230
 231         inode->i_security = NULL;
 232         kmem_cache_free(sel_inode_cache, isec);
 233 }
 234
 235 static int file_alloc_security(struct file *file)
 236 {
 237         struct file_security_struct *fsec;
 238         u32 sid = current_sid();
 239
 240         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 241         if (!fsec)
 242                 return -ENOMEM;
 243
 244         fsec->sid = sid;
 245         fsec->fown_sid = sid;
 246         file->f_security = fsec;
 247
 248         return 0;
 249 }
 250
 251 static void file_free_security(struct file *file)
 252 {
 253         struct file_security_struct *fsec = file->f_security;
 254         file->f_security = NULL;
 255         kfree(fsec);
 256 }
 257
 258 static int superblock_alloc_security(struct super_block *sb)
 259 {
 260         struct superblock_security_struct *sbsec;
 261
 262         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 263         if (!sbsec)
 264                 return -ENOMEM;
 265
 266         mutex_init(&sbsec->lock);
 267         INIT_LIST_HEAD(&sbsec->isec_head);
 268         spin_lock_init(&sbsec->isec_lock);
 269         sbsec->sb = sb;
 270         sbsec->sid = SECINITSID_UNLABELED;
 271         sbsec->def_sid = SECINITSID_FILE;
 272         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 273         sb->s_security = sbsec;
 274
 275         return 0;
 276 }
 277
 278 static void superblock_free_security(struct super_block *sb)
 279 {
 280         struct superblock_security_struct *sbsec = sb->s_security;
 281         sb->s_security = NULL;
 282         kfree(sbsec);
 283 }
 284
 285 /* The file system's label must be initialized prior to use. */
 286
 287 static const char *labeling_behaviors[6] = {
 288         "uses xattr",
 289         "uses transition SIDs",
 290         "uses task SIDs",
 291         "uses genfs_contexts",
 292         "not configured for labeling",
 293         "uses mountpoint labeling",
 294 };
 295
 296 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 297
 298 static inline int inode_doinit(struct inode *inode)
 299 {
 300         return inode_doinit_with_dentry(inode, NULL);
 301 }
 302
 303 enum {
 304         Opt_error = -1,
 305         Opt_context = 1,
 306         Opt_fscontext = 2,
 307         Opt_defcontext = 3,
 308         Opt_rootcontext = 4,
 309         Opt_labelsupport = 5,
 310 };
 311
 312 static const match_table_t tokens = {
 313         {Opt_context, CONTEXT_STR "%s"},
 314         {Opt_fscontext, FSCONTEXT_STR "%s"},
 315         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 316         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 317         {Opt_labelsupport, LABELSUPP_STR},
 318         {Opt_error, NULL},
 319 };
 320
 321 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 322
 323 static int may_context_mount_sb_relabel(u32 sid,
 324                         struct superblock_security_struct *sbsec,
 325                         const struct cred *cred)
 326 {
 327         const struct task_security_struct *tsec = cred->security;
 328         int rc;
 329
 330         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 331                           FILESYSTEM__RELABELFROM, NULL);
 332         if (rc)
 333                 return rc;
 334
 335         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 336                           FILESYSTEM__RELABELTO, NULL);
 337         return rc;
 338 }
 339
 340 static int may_context_mount_inode_relabel(u32 sid,
 341                         struct superblock_security_struct *sbsec,
 342                         const struct cred *cred)
 343 {
 344         const struct task_security_struct *tsec = cred->security;
 345         int rc;
 346         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELFROM, NULL);
 348         if (rc)
 349                 return rc;
 350
 351         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 352                           FILESYSTEM__ASSOCIATE, NULL);
 353         return rc;
 354 }
 355
 356 static int sb_finish_set_opts(struct super_block *sb)
 357 {
 358         struct superblock_security_struct *sbsec = sb->s_security;
 359         struct dentry *root = sb->s_root;
 360         struct inode *root_inode = root->d_inode;
 361         int rc = 0;
 362
 363         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 364                 /* Make sure that the xattr handler exists and that no
 365                    error other than -ENODATA is returned by getxattr on
 366                    the root directory.  -ENODATA is ok, as this may be
 367                    the first boot of the SELinux kernel before we have
 368                    assigned xattr values to the filesystem. */
 369                 if (!root_inode->i_op->getxattr) {
 370                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 371                                "xattr support\n", sb->s_id, sb->s_type->name);
 372                         rc = -EOPNOTSUPP;
 373                         goto out;
 374                 }
 375                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 376                 if (rc < 0 && rc != -ENODATA) {
 377                         if (rc == -EOPNOTSUPP)
 378                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 379                                        "%s) has no security xattr handler\n",
 380                                        sb->s_id, sb->s_type->name);
 381                         else
 382                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 383                                        "%s) getxattr errno %d\n", sb->s_id,
 384                                        sb->s_type->name, -rc);
 385                         goto out;
 386                 }
 387         }
 388
 389         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 390
 391         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 392                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 393                        sb->s_id, sb->s_type->name);
 394         else
 395                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 396                        sb->s_id, sb->s_type->name,
 397                        labeling_behaviors[sbsec->behavior-1]);
 398
 399         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 400             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 401             sbsec->behavior == SECURITY_FS_USE_NONE ||
 402             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 sbsec->flags &= ~SE_SBLABELSUPP;
 404
 405         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 406         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 407                 sbsec->flags |= SE_SBLABELSUPP;
 408
 409         /* Initialize the root inode. */
 410         rc = inode_doinit_with_dentry(root_inode, root);
 411
 412         /* Initialize any other inodes associated with the superblock, e.g.
 413            inodes created prior to initial policy load or inodes created
 414            during get_sb by a pseudo filesystem that directly
 415            populates itself. */
 416         spin_lock(&sbsec->isec_lock);
 417 next_inode:
 418         if (!list_empty(&sbsec->isec_head)) {
 419                 struct inode_security_struct *isec =
 420                                 list_entry(sbsec->isec_head.next,
 421                                            struct inode_security_struct, list);
 422                 struct inode *inode = isec->inode;
 423                 spin_unlock(&sbsec->isec_lock);
 424                 inode = igrab(inode);
 425                 if (inode) {
 426                         if (!IS_PRIVATE(inode))
 427                                 inode_doinit(inode);
 428                         iput(inode);
 429                 }
 430                 spin_lock(&sbsec->isec_lock);
 431                 list_del_init(&isec->list);
 432                 goto next_inode;
 433         }
 434         spin_unlock(&sbsec->isec_lock);
 435 out:
 436         return rc;
 437 }
 438
 439 /*
 440  * This function should allow an FS to ask what it's mount security
 441  * options were so it can use those later for submounts, displaying
 442  * mount options, or whatever.
 443  */
 444 static int selinux_get_mnt_opts(const struct super_block *sb,
 445                                 struct security_mnt_opts *opts)
 446 {
 447         int rc = 0, i;
 448         struct superblock_security_struct *sbsec = sb->s_security;
 449         char *context = NULL;
 450         u32 len;
 451         char tmp;
 452
 453         security_init_mnt_opts(opts);
 454
 455         if (!(sbsec->flags & SE_SBINITIALIZED))
 456                 return -EINVAL;
 457
 458         if (!ss_initialized)
 459                 return -EINVAL;
 460
 461         tmp = sbsec->flags & SE_MNTMASK;
 462         /* count the number of mount options for this sb */
 463         for (i = 0; i < 8; i++) {
 464                 if (tmp & 0x01)
 465                         opts->num_mnt_opts++;
 466                 tmp >>= 1;
 467         }
 468         /* Check if the Label support flag is set */
 469         if (sbsec->flags & SE_SBLABELSUPP)
 470                 opts->num_mnt_opts++;
 471
 472         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 473         if (!opts->mnt_opts) {
 474                 rc = -ENOMEM;
 475                 goto out_free;
 476         }
 477
 478         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 479         if (!opts->mnt_opts_flags) {
 480                 rc = -ENOMEM;
 481                 goto out_free;
 482         }
 483
 484         i = 0;
 485         if (sbsec->flags & FSCONTEXT_MNT) {
 486                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 487                 if (rc)
 488                         goto out_free;
 489                 opts->mnt_opts[i] = context;
 490                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 491         }
 492         if (sbsec->flags & CONTEXT_MNT) {
 493                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 494                 if (rc)
 495                         goto out_free;
 496                 opts->mnt_opts[i] = context;
 497                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 498         }
 499         if (sbsec->flags & DEFCONTEXT_MNT) {
 500                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 501                 if (rc)
 502                         goto out_free;
 503                 opts->mnt_opts[i] = context;
 504                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 505         }
 506         if (sbsec->flags & ROOTCONTEXT_MNT) {
 507                 struct inode *root = sbsec->sb->s_root->d_inode;
 508                 struct inode_security_struct *isec = root->i_security;
 509
 510                 rc = security_sid_to_context(isec->sid, &context, &len);
 511                 if (rc)
 512                         goto out_free;
 513                 opts->mnt_opts[i] = context;
 514                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 515         }
 516         if (sbsec->flags & SE_SBLABELSUPP) {
 517                 opts->mnt_opts[i] = NULL;
 518                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 519         }
 520
 521         BUG_ON(i != opts->num_mnt_opts);
 522
 523         return 0;
 524
 525 out_free:
 526         security_free_mnt_opts(opts);
 527         return rc;
 528 }
 529
 530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 531                       u32 old_sid, u32 new_sid)
 532 {
 533         char mnt_flags = sbsec->flags & SE_MNTMASK;
 534
 535         /* check if the old mount command had the same options */
 536         if (sbsec->flags & SE_SBINITIALIZED)
 537                 if (!(sbsec->flags & flag) ||
 538                     (old_sid != new_sid))
 539                         return 1;
 540
 541         /* check if we were passed the same options twice,
 542          * aka someone passed context=a,context=b
 543          */
 544         if (!(sbsec->flags & SE_SBINITIALIZED))
 545                 if (mnt_flags & flag)
 546                         return 1;
 547         return 0;
 548 }
 549
 550 /*
 551  * Allow filesystems with binary mount data to explicitly set mount point
 552  * labeling information.
 553  */
 554 static int selinux_set_mnt_opts(struct super_block *sb,
 555                                 struct security_mnt_opts *opts)
 556 {
 557         const struct cred *cred = current_cred();
 558         int rc = 0, i;
 559         struct superblock_security_struct *sbsec = sb->s_security;
 560         const char *name = sb->s_type->name;
 561         struct inode *inode = sbsec->sb->s_root->d_inode;
 562         struct inode_security_struct *root_isec = inode->i_security;
 563         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 564         u32 defcontext_sid = 0;
 565         char **mount_options = opts->mnt_opts;
 566         int *flags = opts->mnt_opts_flags;
 567         int num_opts = opts->num_mnt_opts;
 568
 569         mutex_lock(&sbsec->lock);
 570
 571         if (!ss_initialized) {
 572                 if (!num_opts) {
 573                         /* Defer initialization until selinux_complete_init,
 574                            after the initial policy is loaded and the security
 575                            server is ready to handle calls. */
 576                         goto out;
 577                 }
 578                 rc = -EINVAL;
 579                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 580                         "before the security server is initialized\n");
 581                 goto out;
 582         }
 583
 584         /*
 585          * Binary mount data FS will come through this function twice.  Once
 586          * from an explicit call and once from the generic calls from the vfs.
 587          * Since the generic VFS calls will not contain any security mount data
 588          * we need to skip the double mount verification.
 589          *
 590          * This does open a hole in which we will not notice if the first
 591          * mount using this sb set explict options and a second mount using
 592          * this sb does not set any security options.  (The first options
 593          * will be used for both mounts)
 594          */
 595         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 596             && (num_opts == 0))
 597                 goto out;
 598
 599         /*
 600          * parse the mount options, check if they are valid sids.
 601          * also check if someone is trying to mount the same sb more
 602          * than once with different security options.
 603          */
 604         for (i = 0; i < num_opts; i++) {
 605                 u32 sid;
 606
 607                 if (flags[i] == SE_SBLABELSUPP)
 608                         continue;
 609                 rc = security_context_to_sid(mount_options[i],
 610                                              strlen(mount_options[i]), &sid);
 611                 if (rc) {
 612                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 613                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 614                                mount_options[i], sb->s_id, name, rc);
 615                         goto out;
 616                 }
 617                 switch (flags[i]) {
 618                 case FSCONTEXT_MNT:
 619                         fscontext_sid = sid;
 620
 621                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 622                                         fscontext_sid))
 623                                 goto out_double_mount;
 624
 625                         sbsec->flags |= FSCONTEXT_MNT;
 626                         break;
 627                 case CONTEXT_MNT:
 628                         context_sid = sid;
 629
 630                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 631                                         context_sid))
 632                                 goto out_double_mount;
 633
 634                         sbsec->flags |= CONTEXT_MNT;
 635                         break;
 636                 case ROOTCONTEXT_MNT:
 637                         rootcontext_sid = sid;
 638
 639                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 640                                         rootcontext_sid))
 641                                 goto out_double_mount;
 642
 643                         sbsec->flags |= ROOTCONTEXT_MNT;
 644
 645                         break;
 646                 case DEFCONTEXT_MNT:
 647                         defcontext_sid = sid;
 648
 649                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 650                                         defcontext_sid))
 651                                 goto out_double_mount;
 652
 653                         sbsec->flags |= DEFCONTEXT_MNT;
 654
 655                         break;
 656                 default:
 657                         rc = -EINVAL;
 658                         goto out;
 659                 }
 660         }
 661
 662         if (sbsec->flags & SE_SBINITIALIZED) {
 663                 /* previously mounted with options, but not on this attempt? */
 664                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 665                         goto out_double_mount;
 666                 rc = 0;
 667                 goto out;
 668         }
 669
 670         if (strcmp(sb->s_type->name, "proc") == 0)
 671                 sbsec->flags |= SE_SBPROC;
 672
 673         /* Determine the labeling behavior to use for this filesystem type. */
 674         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 675         if (rc) {
 676                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 677                        __func__, sb->s_type->name, rc);
 678                 goto out;
 679         }
 680
 681         /* sets the context of the superblock for the fs being mounted. */
 682         if (fscontext_sid) {
 683                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 684                 if (rc)
 685                         goto out;
 686
 687                 sbsec->sid = fscontext_sid;
 688         }
 689
 690         /*
 691          * Switch to using mount point labeling behavior.
 692          * sets the label used on all file below the mountpoint, and will set
 693          * the superblock context if not already set.
 694          */
 695         if (context_sid) {
 696                 if (!fscontext_sid) {
 697                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 698                                                           cred);
 699                         if (rc)
 700                                 goto out;
 701                         sbsec->sid = context_sid;
 702                 } else {
 703                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 704                                                              cred);
 705                         if (rc)
 706                                 goto out;
 707                 }
 708                 if (!rootcontext_sid)
 709                         rootcontext_sid = context_sid;
 710
 711                 sbsec->mntpoint_sid = context_sid;
 712                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 713         }
 714
 715         if (rootcontext_sid) {
 716                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 717                                                      cred);
 718                 if (rc)
 719                         goto out;
 720
 721                 root_isec->sid = rootcontext_sid;
 722                 root_isec->initialized = 1;
 723         }
 724
 725         if (defcontext_sid) {
 726                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 727                         rc = -EINVAL;
 728                         printk(KERN_WARNING "SELinux: defcontext option is "
 729                                "invalid for this filesystem type\n");
 730                         goto out;
 731                 }
 732
 733                 if (defcontext_sid != sbsec->def_sid) {
 734                         rc = may_context_mount_inode_relabel(defcontext_sid,
 735                                                              sbsec, cred);
 736                         if (rc)
 737                                 goto out;
 738                 }
 739
 740                 sbsec->def_sid = defcontext_sid;
 741         }
 742
 743         rc = sb_finish_set_opts(sb);
 744 out:
 745         mutex_unlock(&sbsec->lock);
 746         return rc;
 747 out_double_mount:
 748         rc = -EINVAL;
 749         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 750                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 751         goto out;
 752 }
 753
 754 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 755                                     const struct super_block *newsb)
 756 {
 757         struct superblock_security_struct *old = oldsb->s_security;
 758         struct superblock_security_struct *new = newsb->s_security;
 759         char oldflags = old->flags & SE_MNTMASK;
 760         char newflags = new->flags & SE_MNTMASK;
 761
 762         if (oldflags != newflags)
 763                 goto mismatch;
 764         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 765                 goto mismatch;
 766         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 767                 goto mismatch;
 768         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 769                 goto mismatch;
 770         if (oldflags & ROOTCONTEXT_MNT) {
 771                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 772                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 773                 if (oldroot->sid != newroot->sid)
 774                         goto mismatch;
 775         }
 776         return 0;
 777 mismatch:
 778         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 779                             "different security settings for (dev %s, "
 780                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 781         return -EBUSY;
 782 }
 783
 784 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 785                                         struct super_block *newsb)
 786 {
 787         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 788         struct superblock_security_struct *newsbsec = newsb->s_security;
 789
 790         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 791         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 792         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 793
 794         /*
 795          * if the parent was able to be mounted it clearly had no special lsm
 796          * mount options.  thus we can safely deal with this superblock later
 797          */
 798         if (!ss_initialized)
 799                 return 0;
 800
 801         /* how can we clone if the old one wasn't set up?? */
 802         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 803
 804         /* if fs is reusing a sb, make sure that the contexts match */
 805         if (newsbsec->flags & SE_SBINITIALIZED)
 806                 return selinux_cmp_sb_context(oldsb, newsb);
 807
 808         mutex_lock(&newsbsec->lock);
 809
 810         newsbsec->flags = oldsbsec->flags;
 811
 812         newsbsec->sid = oldsbsec->sid;
 813         newsbsec->def_sid = oldsbsec->def_sid;
 814         newsbsec->behavior = oldsbsec->behavior;
 815
 816         if (set_context) {
 817                 u32 sid = oldsbsec->mntpoint_sid;
 818
 819                 if (!set_fscontext)
 820                         newsbsec->sid = sid;
 821                 if (!set_rootcontext) {
 822                         struct inode *newinode = newsb->s_root->d_inode;
 823                         struct inode_security_struct *newisec = newinode->i_security;
 824                         newisec->sid = sid;
 825                 }
 826                 newsbsec->mntpoint_sid = sid;
 827         }
 828         if (set_rootcontext) {
 829                 const struct inode *oldinode = oldsb->s_root->d_inode;
 830                 const struct inode_security_struct *oldisec = oldinode->i_security;
 831                 struct inode *newinode = newsb->s_root->d_inode;
 832                 struct inode_security_struct *newisec = newinode->i_security;
 833
 834                 newisec->sid = oldisec->sid;
 835         }
 836
 837         sb_finish_set_opts(newsb);
 838         mutex_unlock(&newsbsec->lock);
 839         return 0;
 840 }
 841
 842 static int selinux_parse_opts_str(char *options,
 843                                   struct security_mnt_opts *opts)
 844 {
 845         char *p;
 846         char *context = NULL, *defcontext = NULL;
 847         char *fscontext = NULL, *rootcontext = NULL;
 848         int rc, num_mnt_opts = 0;
 849
 850         opts->num_mnt_opts = 0;
 851
 852         /* Standard string-based options. */
 853         while ((p = strsep(&options, "|")) != NULL) {
 854                 int token;
 855                 substring_t args[MAX_OPT_ARGS];
 856
 857                 if (!*p)
 858                         continue;
 859
 860                 token = match_token(p, tokens, args);
 861
 862                 switch (token) {
 863                 case Opt_context:
 864                         if (context || defcontext) {
 865                                 rc = -EINVAL;
 866                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 867                                 goto out_err;
 868                         }
 869                         context = match_strdup(&args[0]);
 870                         if (!context) {
 871                                 rc = -ENOMEM;
 872                                 goto out_err;
 873                         }
 874                         break;
 875
 876                 case Opt_fscontext:
 877                         if (fscontext) {
 878                                 rc = -EINVAL;
 879                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 880                                 goto out_err;
 881                         }
 882                         fscontext = match_strdup(&args[0]);
 883                         if (!fscontext) {
 884                                 rc = -ENOMEM;
 885                                 goto out_err;
 886                         }
 887                         break;
 888
 889                 case Opt_rootcontext:
 890                         if (rootcontext) {
 891                                 rc = -EINVAL;
 892                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 893                                 goto out_err;
 894                         }
 895                         rootcontext = match_strdup(&args[0]);
 896                         if (!rootcontext) {
 897                                 rc = -ENOMEM;
 898                                 goto out_err;
 899                         }
 900                         break;
 901
 902                 case Opt_defcontext:
 903                         if (context || defcontext) {
 904                                 rc = -EINVAL;
 905                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 906                                 goto out_err;
 907                         }
 908                         defcontext = match_strdup(&args[0]);
 909                         if (!defcontext) {
 910                                 rc = -ENOMEM;
 911                                 goto out_err;
 912                         }
 913                         break;
 914                 case Opt_labelsupport:
 915                         break;
 916                 default:
 917                         rc = -EINVAL;
 918                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 919                         goto out_err;
 920
 921                 }
 922         }
 923
 924         rc = -ENOMEM;
 925         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 926         if (!opts->mnt_opts)
 927                 goto out_err;
 928
 929         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 930         if (!opts->mnt_opts_flags) {
 931                 kfree(opts->mnt_opts);
 932                 goto out_err;
 933         }
 934
 935         if (fscontext) {
 936                 opts->mnt_opts[num_mnt_opts] = fscontext;
 937                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 938         }
 939         if (context) {
 940                 opts->mnt_opts[num_mnt_opts] = context;
 941                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 942         }
 943         if (rootcontext) {
 944                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 945                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 946         }
 947         if (defcontext) {
 948                 opts->mnt_opts[num_mnt_opts] = defcontext;
 949                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 950         }
 951
 952         opts->num_mnt_opts = num_mnt_opts;
 953         return 0;
 954
 955 out_err:
 956         kfree(context);
 957         kfree(defcontext);
 958         kfree(fscontext);
 959         kfree(rootcontext);
 960         return rc;
 961 }
 962 /*
 963  * string mount options parsing and call set the sbsec
 964  */
 965 static int superblock_doinit(struct super_block *sb, void *data)
 966 {
 967         int rc = 0;
 968         char *options = data;
 969         struct security_mnt_opts opts;
 970
 971         security_init_mnt_opts(&opts);
 972
 973         if (!data)
 974                 goto out;
 975
 976         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 977
 978         rc = selinux_parse_opts_str(options, &opts);
 979         if (rc)
 980                 goto out_err;
 981
 982 out:
 983         rc = selinux_set_mnt_opts(sb, &opts);
 984
 985 out_err:
 986         security_free_mnt_opts(&opts);
 987         return rc;
 988 }
 989
 990 static void selinux_write_opts(struct seq_file *m,
 991                                struct security_mnt_opts *opts)
 992 {
 993         int i;
 994         char *prefix;
 995
 996         for (i = 0; i < opts->num_mnt_opts; i++) {
 997                 char *has_comma;
 998
 999                 if (opts->mnt_opts[i])
1000                         has_comma = strchr(opts->mnt_opts[i], ',');
1001                 else
1002                         has_comma = NULL;
1003
1004                 switch (opts->mnt_opts_flags[i]) {
1005                 case CONTEXT_MNT:
1006                         prefix = CONTEXT_STR;
1007                         break;
1008                 case FSCONTEXT_MNT:
1009                         prefix = FSCONTEXT_STR;
1010                         break;
1011                 case ROOTCONTEXT_MNT:
1012                         prefix = ROOTCONTEXT_STR;
1013                         break;
1014                 case DEFCONTEXT_MNT:
1015                         prefix = DEFCONTEXT_STR;
1016                         break;
1017                 case SE_SBLABELSUPP:
1018                         seq_putc(m, ',');
1019                         seq_puts(m, LABELSUPP_STR);
1020                         continue;
1021                 default:
1022                         BUG();
1023                         return;
1024                 };
1025                 /* we need a comma before each option */
1026                 seq_putc(m, ',');
1027                 seq_puts(m, prefix);
1028                 if (has_comma)
1029                         seq_putc(m, '\"');
1030                 seq_puts(m, opts->mnt_opts[i]);
1031                 if (has_comma)
1032                         seq_putc(m, '\"');
1033         }
1034 }
1035
1036 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1037 {
1038         struct security_mnt_opts opts;
1039         int rc;
1040
1041         rc = selinux_get_mnt_opts(sb, &opts);
1042         if (rc) {
1043                 /* before policy load we may get EINVAL, don't show anything */
1044                 if (rc == -EINVAL)
1045                         rc = 0;
1046                 return rc;
1047         }
1048
1049         selinux_write_opts(m, &opts);
1050
1051         security_free_mnt_opts(&opts);
1052
1053         return rc;
1054 }
1055
1056 static inline u16 inode_mode_to_security_class(umode_t mode)
1057 {
1058         switch (mode & S_IFMT) {
1059         case S_IFSOCK:
1060                 return SECCLASS_SOCK_FILE;
1061         case S_IFLNK:
1062                 return SECCLASS_LNK_FILE;
1063         case S_IFREG:
1064                 return SECCLASS_FILE;
1065         case S_IFBLK:
1066                 return SECCLASS_BLK_FILE;
1067         case S_IFDIR:
1068                 return SECCLASS_DIR;
1069         case S_IFCHR:
1070                 return SECCLASS_CHR_FILE;
1071         case S_IFIFO:
1072                 return SECCLASS_FIFO_FILE;
1073
1074         }
1075
1076         return SECCLASS_FILE;
1077 }
1078
1079 static inline int default_protocol_stream(int protocol)
1080 {
1081         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1082 }
1083
1084 static inline int default_protocol_dgram(int protocol)
1085 {
1086         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1087 }
1088
1089 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1090 {
1091         switch (family) {
1092         case PF_UNIX:
1093                 switch (type) {
1094                 case SOCK_STREAM:
1095                 case SOCK_SEQPACKET:
1096                         return SECCLASS_UNIX_STREAM_SOCKET;
1097                 case SOCK_DGRAM:
1098                         return SECCLASS_UNIX_DGRAM_SOCKET;
1099                 }
1100                 break;
1101         case PF_INET:
1102         case PF_INET6:
1103                 switch (type) {
1104                 case SOCK_STREAM:
1105                         if (default_protocol_stream(protocol))
1106                                 return SECCLASS_TCP_SOCKET;
1107                         else
1108                                 return SECCLASS_RAWIP_SOCKET;
1109                 case SOCK_DGRAM:
1110                         if (default_protocol_dgram(protocol))
1111                                 return SECCLASS_UDP_SOCKET;
1112                         else
1113                                 return SECCLASS_RAWIP_SOCKET;
1114                 case SOCK_DCCP:
1115                         return SECCLASS_DCCP_SOCKET;
1116                 default:
1117                         return SECCLASS_RAWIP_SOCKET;
1118                 }
1119                 break;
1120         case PF_NETLINK:
1121                 switch (protocol) {
1122                 case NETLINK_ROUTE:
1123                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1124                 case NETLINK_FIREWALL:
1125                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1126                 case NETLINK_SOCK_DIAG:
1127                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1128                 case NETLINK_NFLOG:
1129                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1130                 case NETLINK_XFRM:
1131                         return SECCLASS_NETLINK_XFRM_SOCKET;
1132                 case NETLINK_SELINUX:
1133                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1134                 case NETLINK_AUDIT:
1135                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1136                 case NETLINK_IP6_FW:
1137                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1138                 case NETLINK_DNRTMSG:
1139                         return SECCLASS_NETLINK_DNRT_SOCKET;
1140                 case NETLINK_KOBJECT_UEVENT:
1141                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1142                 default:
1143                         return SECCLASS_NETLINK_SOCKET;
1144                 }
1145         case PF_PACKET:
1146                 return SECCLASS_PACKET_SOCKET;
1147         case PF_KEY:
1148                 return SECCLASS_KEY_SOCKET;
1149         case PF_APPLETALK:
1150                 return SECCLASS_APPLETALK_SOCKET;
1151         }
1152
1153         return SECCLASS_SOCKET;
1154 }
1155
1156 #ifdef CONFIG_PROC_FS
1157 static int selinux_proc_get_sid(struct dentry *dentry,
1158                                 u16 tclass,
1159                                 u32 *sid)
1160 {
1161         int rc;
1162         char *buffer, *path;
1163
1164         buffer = (char *)__get_free_page(GFP_KERNEL);
1165         if (!buffer)
1166                 return -ENOMEM;
1167
1168         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1169         if (IS_ERR(path))
1170                 rc = PTR_ERR(path);
1171         else {
1172                 /* each process gets a /proc/PID/ entry. Strip off the
1173                  * PID part to get a valid selinux labeling.
1174                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1175                 while (path[1] >= '0' && path[1] <= '9') {
1176                         path[1] = '/';
1177                         path++;
1178                 }
1179                 rc = security_genfs_sid("proc", path, tclass, sid);
1180         }
1181         free_page((unsigned long)buffer);
1182         return rc;
1183 }
1184 #else
1185 static int selinux_proc_get_sid(struct dentry *dentry,
1186                                 u16 tclass,
1187                                 u32 *sid)
1188 {
1189         return -EINVAL;
1190 }
1191 #endif
1192
1193 /* The inode's security attributes must be initialized before first use. */
1194 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1195 {
1196         struct superblock_security_struct *sbsec = NULL;
1197         struct inode_security_struct *isec = inode->i_security;
1198         u32 sid;
1199         struct dentry *dentry;
1200 #define INITCONTEXTLEN 255
1201         char *context = NULL;
1202         unsigned len = 0;
1203         int rc = 0;
1204
1205         if (isec->initialized)
1206                 goto out;
1207
1208         mutex_lock(&isec->lock);
1209         if (isec->initialized)
1210                 goto out_unlock;
1211
1212         sbsec = inode->i_sb->s_security;
1213         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1214                 /* Defer initialization until selinux_complete_init,
1215                    after the initial policy is loaded and the security
1216                    server is ready to handle calls. */
1217                 spin_lock(&sbsec->isec_lock);
1218                 if (list_empty(&isec->list))
1219                         list_add(&isec->list, &sbsec->isec_head);
1220                 spin_unlock(&sbsec->isec_lock);
1221                 goto out_unlock;
1222         }
1223
1224         switch (sbsec->behavior) {
1225         case SECURITY_FS_USE_XATTR:
1226                 if (!inode->i_op->getxattr) {
1227                         isec->sid = sbsec->def_sid;
1228                         break;
1229                 }
1230
1231                 /* Need a dentry, since the xattr API requires one.
1232                    Life would be simpler if we could just pass the inode. */
1233                 if (opt_dentry) {
1234                         /* Called from d_instantiate or d_splice_alias. */
1235                         dentry = dget(opt_dentry);
1236                 } else {
1237                         /* Called from selinux_complete_init, try to find a dentry. */
1238                         dentry = d_find_alias(inode);
1239                 }
1240                 if (!dentry) {
1241                         /*
1242                          * this is can be hit on boot when a file is accessed
1243                          * before the policy is loaded.  When we load policy we
1244                          * may find inodes that have no dentry on the
1245                          * sbsec->isec_head list.  No reason to complain as these
1246                          * will get fixed up the next time we go through
1247                          * inode_doinit with a dentry, before these inodes could
1248                          * be used again by userspace.
1249                          */
1250                         goto out_unlock;
1251                 }
1252
1253                 len = INITCONTEXTLEN;
1254                 context = kmalloc(len+1, GFP_NOFS);
1255                 if (!context) {
1256                         rc = -ENOMEM;
1257                         dput(dentry);
1258                         goto out_unlock;
1259                 }
1260                 context[len] = '\0';
1261                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1262                                            context, len);
1263                 if (rc == -ERANGE) {
1264                         kfree(context);
1265
1266                         /* Need a larger buffer.  Query for the right size. */
1267                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1268                                                    NULL, 0);
1269                         if (rc < 0) {
1270                                 dput(dentry);
1271                                 goto out_unlock;
1272                         }
1273                         len = rc;
1274                         context = kmalloc(len+1, GFP_NOFS);
1275                         if (!context) {
1276                                 rc = -ENOMEM;
1277                                 dput(dentry);
1278                                 goto out_unlock;
1279                         }
1280                         context[len] = '\0';
1281                         rc = inode->i_op->getxattr(dentry,
1282                                                    XATTR_NAME_SELINUX,
1283                                                    context, len);
1284                 }
1285                 dput(dentry);
1286                 if (rc < 0) {
1287                         if (rc != -ENODATA) {
1288                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1289                                        "%d for dev=%s ino=%ld\n", __func__,
1290                                        -rc, inode->i_sb->s_id, inode->i_ino);
1291                                 kfree(context);
1292                                 goto out_unlock;
1293                         }
1294                         /* Map ENODATA to the default file SID */
1295                         sid = sbsec->def_sid;
1296                         rc = 0;
1297                 } else {
1298                         rc = security_context_to_sid_default(context, rc, &sid,
1299                                                              sbsec->def_sid,
1300                                                              GFP_NOFS);
1301                         if (rc) {
1302                                 char *dev = inode->i_sb->s_id;
1303                                 unsigned long ino = inode->i_ino;
1304
1305                                 if (rc == -EINVAL) {
1306                                         if (printk_ratelimit())
1307                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1308                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1309                                                         "filesystem in question.\n", ino, dev, context);
1310                                 } else {
1311                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1312                                                "returned %d for dev=%s ino=%ld\n",
1313                                                __func__, context, -rc, dev, ino);
1314                                 }
1315                                 kfree(context);
1316                                 /* Leave with the unlabeled SID */
1317                                 rc = 0;
1318                                 break;
1319                         }
1320                 }
1321                 kfree(context);
1322                 isec->sid = sid;
1323                 break;
1324         case SECURITY_FS_USE_TASK:
1325                 isec->sid = isec->task_sid;
1326                 break;
1327         case SECURITY_FS_USE_TRANS:
1328                 /* Default to the fs SID. */
1329                 isec->sid = sbsec->sid;
1330
1331                 /* Try to obtain a transition SID. */
1332                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1333                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1334                                              isec->sclass, NULL, &sid);
1335                 if (rc)
1336                         goto out_unlock;
1337                 isec->sid = sid;
1338                 break;
1339         case SECURITY_FS_USE_MNTPOINT:
1340                 isec->sid = sbsec->mntpoint_sid;
1341                 break;
1342         default:
1343                 /* Default to the fs superblock SID. */
1344                 isec->sid = sbsec->sid;
1345
1346                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1347                         if (opt_dentry) {
1348                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1349                                 rc = selinux_proc_get_sid(opt_dentry,
1350                                                           isec->sclass,
1351                                                           &sid);
1352                                 if (rc)
1353                                         goto out_unlock;
1354                                 isec->sid = sid;
1355                         }
1356                 }
1357                 break;
1358         }
1359
1360         isec->initialized = 1;
1361
1362 out_unlock:
1363         mutex_unlock(&isec->lock);
1364 out:
1365         if (isec->sclass == SECCLASS_FILE)
1366                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1367         return rc;
1368 }
1369
1370 /* Convert a Linux signal to an access vector. */
1371 static inline u32 signal_to_av(int sig)
1372 {
1373         u32 perm = 0;
1374
1375         switch (sig) {
1376         case SIGCHLD:
1377                 /* Commonly granted from child to parent. */
1378                 perm = PROCESS__SIGCHLD;
1379                 break;
1380         case SIGKILL:
1381                 /* Cannot be caught or ignored */
1382                 perm = PROCESS__SIGKILL;
1383                 break;
1384         case SIGSTOP:
1385                 /* Cannot be caught or ignored */
1386                 perm = PROCESS__SIGSTOP;
1387                 break;
1388         default:
1389                 /* All other signals. */
1390                 perm = PROCESS__SIGNAL;
1391                 break;
1392         }
1393
1394         return perm;
1395 }
1396
1397 /*
1398  * Check permission between a pair of credentials
1399  * fork check, ptrace check, etc.
1400  */
1401 static int cred_has_perm(const struct cred *actor,
1402                          const struct cred *target,
1403                          u32 perms)
1404 {
1405         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1406
1407         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1408 }
1409
1410 /*
1411  * Check permission between a pair of tasks, e.g. signal checks,
1412  * fork check, ptrace check, etc.
1413  * tsk1 is the actor and tsk2 is the target
1414  * - this uses the default subjective creds of tsk1
1415  */
1416 static int task_has_perm(const struct task_struct *tsk1,
1417                          const struct task_struct *tsk2,
1418                          u32 perms)
1419 {
1420         const struct task_security_struct *__tsec1, *__tsec2;
1421         u32 sid1, sid2;
1422
1423         rcu_read_lock();
1424         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1425         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1426         rcu_read_unlock();
1427         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1428 }
1429
1430 /*
1431  * Check permission between current and another task, e.g. signal checks,
1432  * fork check, ptrace check, etc.
1433  * current is the actor and tsk2 is the target
1434  * - this uses current's subjective creds
1435  */
1436 static int current_has_perm(const struct task_struct *tsk,
1437                             u32 perms)
1438 {
1439         u32 sid, tsid;
1440
1441         sid = current_sid();
1442         tsid = task_sid(tsk);
1443         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1444 }
1445
1446 #if CAP_LAST_CAP > 63
1447 #error Fix SELinux to handle capabilities > 63.
1448 #endif
1449
1450 /* Check whether a task is allowed to use a capability. */
1451 static int cred_has_capability(const struct cred *cred,
1452                                int cap, int audit)
1453 {
1454         struct common_audit_data ad;
1455         struct av_decision avd;
1456         u16 sclass;
1457         u32 sid = cred_sid(cred);
1458         u32 av = CAP_TO_MASK(cap);
1459         int rc;
1460
1461         ad.type = LSM_AUDIT_DATA_CAP;
1462         ad.u.cap = cap;
1463
1464         switch (CAP_TO_INDEX(cap)) {
1465         case 0:
1466                 sclass = SECCLASS_CAPABILITY;
1467                 break;
1468         case 1:
1469                 sclass = SECCLASS_CAPABILITY2;
1470                 break;
1471         default:
1472                 printk(KERN_ERR
1473                        "SELinux:  out of range capability %d\n", cap);
1474                 BUG();
1475                 return -EINVAL;
1476         }
1477
1478         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1479         if (audit == SECURITY_CAP_AUDIT) {
1480                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1481                 if (rc2)
1482                         return rc2;
1483         }
1484         return rc;
1485 }
1486
1487 /* Check whether a task is allowed to use a system operation. */
1488 static int task_has_system(struct task_struct *tsk,
1489                            u32 perms)
1490 {
1491         u32 sid = task_sid(tsk);
1492
1493         return avc_has_perm(sid, SECINITSID_KERNEL,
1494                             SECCLASS_SYSTEM, perms, NULL);
1495 }
1496
1497 /* Check whether a task has a particular permission to an inode.
1498    The 'adp' parameter is optional and allows other audit
1499    data to be passed (e.g. the dentry). */
1500 static int inode_has_perm(const struct cred *cred,
1501                           struct inode *inode,
1502                           u32 perms,
1503                           struct common_audit_data *adp,
1504                           unsigned flags)
1505 {
1506         struct inode_security_struct *isec;
1507         u32 sid;
1508
1509         validate_creds(cred);
1510
1511         if (unlikely(IS_PRIVATE(inode)))
1512                 return 0;
1513
1514         sid = cred_sid(cred);
1515         isec = inode->i_security;
1516
1517         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1518 }
1519
1520 /* Same as inode_has_perm, but pass explicit audit data containing
1521    the dentry to help the auditing code to more easily generate the
1522    pathname if needed. */
1523 static inline int dentry_has_perm(const struct cred *cred,
1524                                   struct dentry *dentry,
1525                                   u32 av)
1526 {
1527         struct inode *inode = dentry->d_inode;
1528         struct common_audit_data ad;
1529
1530         ad.type = LSM_AUDIT_DATA_DENTRY;
1531         ad.u.dentry = dentry;
1532         return inode_has_perm(cred, inode, av, &ad, 0);
1533 }
1534
1535 /* Same as inode_has_perm, but pass explicit audit data containing
1536    the path to help the auditing code to more easily generate the
1537    pathname if needed. */
1538 static inline int path_has_perm(const struct cred *cred,
1539                                 struct path *path,
1540                                 u32 av)
1541 {
1542         struct inode *inode = path->dentry->d_inode;
1543         struct common_audit_data ad;
1544
1545         ad.type = LSM_AUDIT_DATA_PATH;
1546         ad.u.path = *path;
1547         return inode_has_perm(cred, inode, av, &ad, 0);
1548 }
1549
1550 /* Check whether a task can use an open file descriptor to
1551    access an inode in a given way.  Check access to the
1552    descriptor itself, and then use dentry_has_perm to
1553    check a particular permission to the file.
1554    Access to the descriptor is implicitly granted if it
1555    has the same SID as the process.  If av is zero, then
1556    access to the file is not checked, e.g. for cases
1557    where only the descriptor is affected like seek. */
1558 static int file_has_perm(const struct cred *cred,
1559                          struct file *file,
1560                          u32 av)
1561 {
1562         struct file_security_struct *fsec = file->f_security;
1563         struct inode *inode = file_inode(file);
1564         struct common_audit_data ad;
1565         u32 sid = cred_sid(cred);
1566         int rc;
1567
1568         ad.type = LSM_AUDIT_DATA_PATH;
1569         ad.u.path = file->f_path;
1570
1571         if (sid != fsec->sid) {
1572                 rc = avc_has_perm(sid, fsec->sid,
1573                                   SECCLASS_FD,
1574                                   FD__USE,
1575                                   &ad);
1576                 if (rc)
1577                         goto out;
1578         }
1579
1580         /* av is zero if only checking access to the descriptor. */
1581         rc = 0;
1582         if (av)
1583                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1584
1585 out:
1586         return rc;
1587 }
1588
1589 /* Check whether a task can create a file. */
1590 static int may_create(struct inode *dir,
1591                       struct dentry *dentry,
1592                       u16 tclass)
1593 {
1594         const struct task_security_struct *tsec = current_security();
1595         struct inode_security_struct *dsec;
1596         struct superblock_security_struct *sbsec;
1597         u32 sid, newsid;
1598         struct common_audit_data ad;
1599         int rc;
1600
1601         dsec = dir->i_security;
1602         sbsec = dir->i_sb->s_security;
1603
1604         sid = tsec->sid;
1605         newsid = tsec->create_sid;
1606
1607         ad.type = LSM_AUDIT_DATA_DENTRY;
1608         ad.u.dentry = dentry;
1609
1610         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1611                           DIR__ADD_NAME | DIR__SEARCH,
1612                           &ad);
1613         if (rc)
1614                 return rc;
1615
1616         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1617                 rc = security_transition_sid(sid, dsec->sid, tclass,
1618                                              &dentry->d_name, &newsid);
1619                 if (rc)
1620                         return rc;
1621         }
1622
1623         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1624         if (rc)
1625                 return rc;
1626
1627         return avc_has_perm(newsid, sbsec->sid,
1628                             SECCLASS_FILESYSTEM,
1629                             FILESYSTEM__ASSOCIATE, &ad);
1630 }
1631
1632 /* Check whether a task can create a key. */
1633 static int may_create_key(u32 ksid,
1634                           struct task_struct *ctx)
1635 {
1636         u32 sid = task_sid(ctx);
1637
1638         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1639 }
1640
1641 #define MAY_LINK        0
1642 #define MAY_UNLINK      1
1643 #define MAY_RMDIR       2
1644
1645 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1646 static int may_link(struct inode *dir,
1647                     struct dentry *dentry,
1648                     int kind)
1649
1650 {
1651         struct inode_security_struct *dsec, *isec;
1652         struct common_audit_data ad;
1653         u32 sid = current_sid();
1654         u32 av;
1655         int rc;
1656
1657         dsec = dir->i_security;
1658         isec = dentry->d_inode->i_security;
1659
1660         ad.type = LSM_AUDIT_DATA_DENTRY;
1661         ad.u.dentry = dentry;
1662
1663         av = DIR__SEARCH;
1664         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1665         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1666         if (rc)
1667                 return rc;
1668
1669         switch (kind) {
1670         case MAY_LINK:
1671                 av = FILE__LINK;
1672                 break;
1673         case MAY_UNLINK:
1674                 av = FILE__UNLINK;
1675                 break;
1676         case MAY_RMDIR:
1677                 av = DIR__RMDIR;
1678                 break;
1679         default:
1680                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1681                         __func__, kind);
1682                 return 0;
1683         }
1684
1685         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1686         return rc;
1687 }
1688
1689 static inline int may_rename(struct inode *old_dir,
1690                              struct dentry *old_dentry,
1691                              struct inode *new_dir,
1692                              struct dentry *new_dentry)
1693 {
1694         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1695         struct common_audit_data ad;
1696         u32 sid = current_sid();
1697         u32 av;
1698         int old_is_dir, new_is_dir;
1699         int rc;
1700
1701         old_dsec = old_dir->i_security;
1702         old_isec = old_dentry->d_inode->i_security;
1703         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1704         new_dsec = new_dir->i_security;
1705
1706         ad.type = LSM_AUDIT_DATA_DENTRY;
1707
1708         ad.u.dentry = old_dentry;
1709         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1710                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1711         if (rc)
1712                 return rc;
1713         rc = avc_has_perm(sid, old_isec->sid,
1714                           old_isec->sclass, FILE__RENAME, &ad);
1715         if (rc)
1716                 return rc;
1717         if (old_is_dir && new_dir != old_dir) {
1718                 rc = avc_has_perm(sid, old_isec->sid,
1719                                   old_isec->sclass, DIR__REPARENT, &ad);
1720                 if (rc)
1721                         return rc;
1722         }
1723
1724         ad.u.dentry = new_dentry;
1725         av = DIR__ADD_NAME | DIR__SEARCH;
1726         if (new_dentry->d_inode)
1727                 av |= DIR__REMOVE_NAME;
1728         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1729         if (rc)
1730                 return rc;
1731         if (new_dentry->d_inode) {
1732                 new_isec = new_dentry->d_inode->i_security;
1733                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1734                 rc = avc_has_perm(sid, new_isec->sid,
1735                                   new_isec->sclass,
1736                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1737                 if (rc)
1738                         return rc;
1739         }
1740
1741         return 0;
1742 }
1743
1744 /* Check whether a task can perform a filesystem operation. */
1745 static int superblock_has_perm(const struct cred *cred,
1746                                struct super_block *sb,
1747                                u32 perms,
1748                                struct common_audit_data *ad)
1749 {
1750         struct superblock_security_struct *sbsec;
1751         u32 sid = cred_sid(cred);
1752
1753         sbsec = sb->s_security;
1754         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1755 }
1756
1757 /* Convert a Linux mode and permission mask to an access vector. */
1758 static inline u32 file_mask_to_av(int mode, int mask)
1759 {
1760         u32 av = 0;
1761
1762         if (!S_ISDIR(mode)) {
1763                 if (mask & MAY_EXEC)
1764                         av |= FILE__EXECUTE;
1765                 if (mask & MAY_READ)
1766                         av |= FILE__READ;
1767
1768                 if (mask & MAY_APPEND)
1769                         av |= FILE__APPEND;
1770                 else if (mask & MAY_WRITE)
1771                         av |= FILE__WRITE;
1772
1773         } else {
1774                 if (mask & MAY_EXEC)
1775                         av |= DIR__SEARCH;
1776                 if (mask & MAY_WRITE)
1777                         av |= DIR__WRITE;
1778                 if (mask & MAY_READ)
1779                         av |= DIR__READ;
1780         }
1781
1782         return av;
1783 }
1784
1785 /* Convert a Linux file to an access vector. */
1786 static inline u32 file_to_av(struct file *file)
1787 {
1788         u32 av = 0;
1789
1790         if (file->f_mode & FMODE_READ)
1791                 av |= FILE__READ;
1792         if (file->f_mode & FMODE_WRITE) {
1793                 if (file->f_flags & O_APPEND)
1794                         av |= FILE__APPEND;
1795                 else
1796                         av |= FILE__WRITE;
1797         }
1798         if (!av) {
1799                 /*
1800                  * Special file opened with flags 3 for ioctl-only use.
1801                  */
1802                 av = FILE__IOCTL;
1803         }
1804
1805         return av;
1806 }
1807
1808 /*
1809  * Convert a file to an access vector and include the correct open
1810  * open permission.
1811  */
1812 static inline u32 open_file_to_av(struct file *file)
1813 {
1814         u32 av = file_to_av(file);
1815
1816         if (selinux_policycap_openperm)
1817                 av |= FILE__OPEN;
1818
1819         return av;
1820 }
1821
1822 /* Hook functions begin here. */
1823
1824 static int selinux_ptrace_access_check(struct task_struct *child,
1825                                      unsigned int mode)
1826 {
1827         int rc;
1828
1829         rc = cap_ptrace_access_check(child, mode);
1830         if (rc)
1831                 return rc;
1832
1833         if (mode & PTRACE_MODE_READ) {
1834                 u32 sid = current_sid();
1835                 u32 csid = task_sid(child);
1836                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1837         }
1838
1839         return current_has_perm(child, PROCESS__PTRACE);
1840 }
1841
1842 static int selinux_ptrace_traceme(struct task_struct *parent)
1843 {
1844         int rc;
1845
1846         rc = cap_ptrace_traceme(parent);
1847         if (rc)
1848                 return rc;
1849
1850         return task_has_perm(parent, current, PROCESS__PTRACE);
1851 }
1852
1853 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1854                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1855 {
1856         int error;
1857
1858         error = current_has_perm(target, PROCESS__GETCAP);
1859         if (error)
1860                 return error;
1861
1862         return cap_capget(target, effective, inheritable, permitted);
1863 }
1864
1865 static int selinux_capset(struct cred *new, const struct cred *old,
1866                           const kernel_cap_t *effective,
1867                           const kernel_cap_t *inheritable,
1868                           const kernel_cap_t *permitted)
1869 {
1870         int error;
1871
1872         error = cap_capset(new, old,
1873                                       effective, inheritable, permitted);
1874         if (error)
1875                 return error;
1876
1877         return cred_has_perm(old, new, PROCESS__SETCAP);
1878 }
1879
1880 /*
1881  * (This comment used to live with the selinux_task_setuid hook,
1882  * which was removed).
1883  *
1884  * Since setuid only affects the current process, and since the SELinux
1885  * controls are not based on the Linux identity attributes, SELinux does not
1886  * need to control this operation.  However, SELinux does control the use of
1887  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1888  */
1889
1890 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1891                            int cap, int audit)
1892 {
1893         int rc;
1894
1895         rc = cap_capable(cred, ns, cap, audit);
1896         if (rc)
1897                 return rc;
1898
1899         return cred_has_capability(cred, cap, audit);
1900 }
1901
1902 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1903 {
1904         const struct cred *cred = current_cred();
1905         int rc = 0;
1906
1907         if (!sb)
1908                 return 0;
1909
1910         switch (cmds) {
1911         case Q_SYNC:
1912         case Q_QUOTAON:
1913         case Q_QUOTAOFF:
1914         case Q_SETINFO:
1915         case Q_SETQUOTA:
1916                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1917                 break;
1918         case Q_GETFMT:
1919         case Q_GETINFO:
1920         case Q_GETQUOTA:
1921                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1922                 break;
1923         default:
1924                 rc = 0;  /* let the kernel handle invalid cmds */
1925                 break;
1926         }
1927         return rc;
1928 }
1929
1930 static int selinux_quota_on(struct dentry *dentry)
1931 {
1932         const struct cred *cred = current_cred();
1933
1934         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1935 }
1936
1937 static int selinux_syslog(int type)
1938 {
1939         int rc;
1940
1941         switch (type) {
1942         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1943         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1944                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1945                 break;
1946         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1947         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1948         /* Set level of messages printed to console */
1949         case SYSLOG_ACTION_CONSOLE_LEVEL:
1950                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1951                 break;
1952         case SYSLOG_ACTION_CLOSE:       /* Close log */
1953         case SYSLOG_ACTION_OPEN:        /* Open log */
1954         case SYSLOG_ACTION_READ:        /* Read from log */
1955         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1956         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1957         default:
1958                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1959                 break;
1960         }
1961         return rc;
1962 }
1963
1964 /*
1965  * Check that a process has enough memory to allocate a new virtual
1966  * mapping. 0 means there is enough memory for the allocation to
1967  * succeed and -ENOMEM implies there is not.
1968  *
1969  * Do not audit the selinux permission check, as this is applied to all
1970  * processes that allocate mappings.
1971  */
1972 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1973 {
1974         int rc, cap_sys_admin = 0;
1975
1976         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1977                              SECURITY_CAP_NOAUDIT);
1978         if (rc == 0)
1979                 cap_sys_admin = 1;
1980
1981         return __vm_enough_memory(mm, pages, cap_sys_admin);
1982 }
1983
1984 /* binprm security operations */
1985
1986 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1987 {
1988         const struct task_security_struct *old_tsec;
1989         struct task_security_struct *new_tsec;
1990         struct inode_security_struct *isec;
1991         struct common_audit_data ad;
1992         struct inode *inode = file_inode(bprm->file);
1993         int rc;
1994
1995         rc = cap_bprm_set_creds(bprm);
1996         if (rc)
1997                 return rc;
1998
1999         /* SELinux context only depends on initial program or script and not
2000          * the script interpreter */
2001         if (bprm->cred_prepared)
2002                 return 0;
2003
2004         old_tsec = current_security();
2005         new_tsec = bprm->cred->security;
2006         isec = inode->i_security;
2007
2008         /* Default to the current task SID. */
2009         new_tsec->sid = old_tsec->sid;
2010         new_tsec->osid = old_tsec->sid;
2011
2012         /* Reset fs, key, and sock SIDs on execve. */
2013         new_tsec->create_sid = 0;
2014         new_tsec->keycreate_sid = 0;
2015         new_tsec->sockcreate_sid = 0;
2016
2017         if (old_tsec->exec_sid) {
2018                 new_tsec->sid = old_tsec->exec_sid;
2019                 /* Reset exec SID on execve. */
2020                 new_tsec->exec_sid = 0;
2021
2022                 /*
2023                  * Minimize confusion: if no_new_privs and a transition is
2024                  * explicitly requested, then fail the exec.
2025                  */
2026                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2027                         return -EPERM;
2028         } else {
2029                 /* Check for a default transition on this program. */
2030                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2031                                              SECCLASS_PROCESS, NULL,
2032                                              &new_tsec->sid);
2033                 if (rc)
2034                         return rc;
2035         }
2036
2037         ad.type = LSM_AUDIT_DATA_PATH;
2038         ad.u.path = bprm->file->f_path;
2039
2040         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2041             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2042                 new_tsec->sid = old_tsec->sid;
2043
2044         if (new_tsec->sid == old_tsec->sid) {
2045                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2046                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2047                 if (rc)
2048                         return rc;
2049         } else {
2050                 /* Check permissions for the transition. */
2051                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2052                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2053                 if (rc)
2054                         return rc;
2055
2056                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2057                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2058                 if (rc)
2059                         return rc;
2060
2061                 /* Check for shared state */
2062                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2063                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2064                                           SECCLASS_PROCESS, PROCESS__SHARE,
2065                                           NULL);
2066                         if (rc)
2067                                 return -EPERM;
2068                 }
2069
2070                 /* Make sure that anyone attempting to ptrace over a task that
2071                  * changes its SID has the appropriate permit */
2072                 if (bprm->unsafe &
2073                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2074                         struct task_struct *tracer;
2075                         struct task_security_struct *sec;
2076                         u32 ptsid = 0;
2077
2078                         rcu_read_lock();
2079                         tracer = ptrace_parent(current);
2080                         if (likely(tracer != NULL)) {
2081                                 sec = __task_cred(tracer)->security;
2082                                 ptsid = sec->sid;
2083                         }
2084                         rcu_read_unlock();
2085
2086                         if (ptsid != 0) {
2087                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2088                                                   SECCLASS_PROCESS,
2089                                                   PROCESS__PTRACE, NULL);
2090                                 if (rc)
2091                                         return -EPERM;
2092                         }
2093                 }
2094
2095                 /* Clear any possibly unsafe personality bits on exec: */
2096                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2097         }
2098
2099         return 0;
2100 }
2101
2102 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2103 {
2104         const struct task_security_struct *tsec = current_security();
2105         u32 sid, osid;
2106         int atsecure = 0;
2107
2108         sid = tsec->sid;
2109         osid = tsec->osid;
2110
2111         if (osid != sid) {
2112                 /* Enable secure mode for SIDs transitions unless
2113                    the noatsecure permission is granted between
2114                    the two SIDs, i.e. ahp returns 0. */
2115                 atsecure = avc_has_perm(osid, sid,
2116                                         SECCLASS_PROCESS,
2117                                         PROCESS__NOATSECURE, NULL);
2118         }
2119
2120         return (atsecure || cap_bprm_secureexec(bprm));
2121 }
2122
2123 static int match_file(const void *p, struct file *file, unsigned fd)
2124 {
2125         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2126 }
2127
2128 /* Derived from fs/exec.c:flush_old_files. */
2129 static inline void flush_unauthorized_files(const struct cred *cred,
2130                                             struct files_struct *files)
2131 {
2132         struct file *file, *devnull = NULL;
2133         struct tty_struct *tty;
2134         int drop_tty = 0;
2135         unsigned n;
2136
2137         tty = get_current_tty();
2138         if (tty) {
2139                 spin_lock(&tty_files_lock);
2140                 if (!list_empty(&tty->tty_files)) {
2141                         struct tty_file_private *file_priv;
2142
2143                         /* Revalidate access to controlling tty.
2144                            Use path_has_perm on the tty path directly rather
2145                            than using file_has_perm, as this particular open
2146                            file may belong to another process and we are only
2147                            interested in the inode-based check here. */
2148                         file_priv = list_first_entry(&tty->tty_files,
2149                                                 struct tty_file_private, list);
2150                         file = file_priv->file;
2151                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2152                                 drop_tty = 1;
2153                 }
2154                 spin_unlock(&tty_files_lock);
2155                 tty_kref_put(tty);
2156         }
2157         /* Reset controlling tty. */
2158         if (drop_tty)
2159                 no_tty();
2160
2161         /* Revalidate access to inherited open files. */
2162         n = iterate_fd(files, 0, match_file, cred);
2163         if (!n) /* none found? */
2164                 return;
2165
2166         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2167         if (IS_ERR(devnull))
2168                 devnull = NULL;
2169         /* replace all the matching ones with this */
2170         do {
2171                 replace_fd(n - 1, devnull, 0);
2172         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2173         if (devnull)
2174                 fput(devnull);
2175 }
2176
2177 /*
2178  * Prepare a process for imminent new credential changes due to exec
2179  */
2180 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2181 {
2182         struct task_security_struct *new_tsec;
2183         struct rlimit *rlim, *initrlim;
2184         int rc, i;
2185
2186         new_tsec = bprm->cred->security;
2187         if (new_tsec->sid == new_tsec->osid)
2188                 return;
2189
2190         /* Close files for which the new task SID is not authorized. */
2191         flush_unauthorized_files(bprm->cred, current->files);
2192
2193         /* Always clear parent death signal on SID transitions. */
2194         current->pdeath_signal = 0;
2195
2196         /* Check whether the new SID can inherit resource limits from the old
2197          * SID.  If not, reset all soft limits to the lower of the current
2198          * task's hard limit and the init task's soft limit.
2199          *
2200          * Note that the setting of hard limits (even to lower them) can be
2201          * controlled by the setrlimit check.  The inclusion of the init task's
2202          * soft limit into the computation is to avoid resetting soft limits
2203          * higher than the default soft limit for cases where the default is
2204          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2205          */
2206         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2207                           PROCESS__RLIMITINH, NULL);
2208         if (rc) {
2209                 /* protect against do_prlimit() */
2210                 task_lock(current);
2211                 for (i = 0; i < RLIM_NLIMITS; i++) {
2212                         rlim = current->signal->rlim + i;
2213                         initrlim = init_task.signal->rlim + i;
2214                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2215                 }
2216                 task_unlock(current);
2217                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2218         }
2219 }
2220
2221 /*
2222  * Clean up the process immediately after the installation of new credentials
2223  * due to exec
2224  */
2225 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2226 {
2227         const struct task_security_struct *tsec = current_security();
2228         struct itimerval itimer;
2229         u32 osid, sid;
2230         int rc, i;
2231
2232         osid = tsec->osid;
2233         sid = tsec->sid;
2234
2235         if (sid == osid)
2236                 return;
2237
2238         /* Check whether the new SID can inherit signal state from the old SID.
2239          * If not, clear itimers to avoid subsequent signal generation and
2240          * flush and unblock signals.
2241          *
2242          * This must occur _after_ the task SID has been updated so that any
2243          * kill done after the flush will be checked against the new SID.
2244          */
2245         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2246         if (rc) {
2247                 memset(&itimer, 0, sizeof itimer);
2248                 for (i = 0; i < 3; i++)
2249                         do_setitimer(i, &itimer, NULL);
2250                 spin_lock_irq(&current->sighand->siglock);
2251                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2252                         __flush_signals(current);
2253                         flush_signal_handlers(current, 1);
2254                         sigemptyset(&current->blocked);
2255                 }
2256                 spin_unlock_irq(&current->sighand->siglock);
2257         }
2258
2259         /* Wake up the parent if it is waiting so that it can recheck
2260          * wait permission to the new task SID. */
2261         read_lock(&tasklist_lock);
2262         __wake_up_parent(current, current->real_parent);
2263         read_unlock(&tasklist_lock);
2264 }
2265
2266 /* superblock security operations */
2267
2268 static int selinux_sb_alloc_security(struct super_block *sb)
2269 {
2270         return superblock_alloc_security(sb);
2271 }
2272
2273 static void selinux_sb_free_security(struct super_block *sb)
2274 {
2275         superblock_free_security(sb);
2276 }
2277
2278 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2279 {
2280         if (plen > olen)
2281                 return 0;
2282
2283         return !memcmp(prefix, option, plen);
2284 }
2285
2286 static inline int selinux_option(char *option, int len)
2287 {
2288         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2289                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2290                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2291                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2292                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2293 }
2294
2295 static inline void take_option(char **to, char *from, int *first, int len)
2296 {
2297         if (!*first) {
2298                 **to = ',';
2299                 *to += 1;
2300         } else
2301                 *first = 0;
2302         memcpy(*to, from, len);
2303         *to += len;
2304 }
2305
2306 static inline void take_selinux_option(char **to, char *from, int *first,
2307                                        int len)
2308 {
2309         int current_size = 0;
2310
2311         if (!*first) {
2312                 **to = '|';
2313                 *to += 1;
2314         } else
2315                 *first = 0;
2316
2317         while (current_size < len) {
2318                 if (*from != '"') {
2319                         **to = *from;
2320                         *to += 1;
2321                 }
2322                 from += 1;
2323                 current_size += 1;
2324         }
2325 }
2326
2327 static int selinux_sb_copy_data(char *orig, char *copy)
2328 {
2329         int fnosec, fsec, rc = 0;
2330         char *in_save, *in_curr, *in_end;
2331         char *sec_curr, *nosec_save, *nosec;
2332         int open_quote = 0;
2333
2334         in_curr = orig;
2335         sec_curr = copy;
2336
2337         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2338         if (!nosec) {
2339                 rc = -ENOMEM;
2340                 goto out;
2341         }
2342
2343         nosec_save = nosec;
2344         fnosec = fsec = 1;
2345         in_save = in_end = orig;
2346
2347         do {
2348                 if (*in_end == '"')
2349                         open_quote = !open_quote;
2350                 if ((*in_end == ',' && open_quote == 0) ||
2351                                 *in_end == '\0') {
2352                         int len = in_end - in_curr;
2353
2354                         if (selinux_option(in_curr, len))
2355                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2356                         else
2357                                 take_option(&nosec, in_curr, &fnosec, len);
2358
2359                         in_curr = in_end + 1;
2360                 }
2361         } while (*in_end++);
2362
2363         strcpy(in_save, nosec_save);
2364         free_page((unsigned long)nosec_save);
2365 out:
2366         return rc;
2367 }
2368
2369 static int selinux_sb_remount(struct super_block *sb, void *data)
2370 {
2371         int rc, i, *flags;
2372         struct security_mnt_opts opts;
2373         char *secdata, **mount_options;
2374         struct superblock_security_struct *sbsec = sb->s_security;
2375
2376         if (!(sbsec->flags & SE_SBINITIALIZED))
2377                 return 0;
2378
2379         if (!data)
2380                 return 0;
2381
2382         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2383                 return 0;
2384
2385         security_init_mnt_opts(&opts);
2386         secdata = alloc_secdata();
2387         if (!secdata)
2388                 return -ENOMEM;
2389         rc = selinux_sb_copy_data(data, secdata);
2390         if (rc)
2391                 goto out_free_secdata;
2392
2393         rc = selinux_parse_opts_str(secdata, &opts);
2394         if (rc)
2395                 goto out_free_secdata;
2396
2397         mount_options = opts.mnt_opts;
2398         flags = opts.mnt_opts_flags;
2399
2400         for (i = 0; i < opts.num_mnt_opts; i++) {
2401                 u32 sid;
2402                 size_t len;
2403
2404                 if (flags[i] == SE_SBLABELSUPP)
2405                         continue;
2406                 len = strlen(mount_options[i]);
2407                 rc = security_context_to_sid(mount_options[i], len, &sid);
2408                 if (rc) {
2409                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2410                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2411                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2412                         goto out_free_opts;
2413                 }
2414                 rc = -EINVAL;
2415                 switch (flags[i]) {
2416                 case FSCONTEXT_MNT:
2417                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2418                                 goto out_bad_option;
2419                         break;
2420                 case CONTEXT_MNT:
2421                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2422                                 goto out_bad_option;
2423                         break;
2424                 case ROOTCONTEXT_MNT: {
2425                         struct inode_security_struct *root_isec;
2426                         root_isec = sb->s_root->d_inode->i_security;
2427
2428                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2429                                 goto out_bad_option;
2430                         break;
2431                 }
2432                 case DEFCONTEXT_MNT:
2433                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2434                                 goto out_bad_option;
2435                         break;
2436                 default:
2437                         goto out_free_opts;
2438                 }
2439         }
2440
2441         rc = 0;
2442 out_free_opts:
2443         security_free_mnt_opts(&opts);
2444 out_free_secdata:
2445         free_secdata(secdata);
2446         return rc;
2447 out_bad_option:
2448         printk(KERN_WARNING "SELinux: unable to change security options "
2449                "during remount (dev %s, type=%s)\n", sb->s_id,
2450                sb->s_type->name);
2451         goto out_free_opts;
2452 }
2453
2454 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2455 {
2456         const struct cred *cred = current_cred();
2457         struct common_audit_data ad;
2458         int rc;
2459
2460         rc = superblock_doinit(sb, data);
2461         if (rc)
2462                 return rc;
2463
2464         /* Allow all mounts performed by the kernel */
2465         if (flags & MS_KERNMOUNT)
2466                 return 0;
2467
2468         ad.type = LSM_AUDIT_DATA_DENTRY;
2469         ad.u.dentry = sb->s_root;
2470         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2471 }
2472
2473 static int selinux_sb_statfs(struct dentry *dentry)
2474 {
2475         const struct cred *cred = current_cred();
2476         struct common_audit_data ad;
2477
2478         ad.type = LSM_AUDIT_DATA_DENTRY;
2479         ad.u.dentry = dentry->d_sb->s_root;
2480         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2481 }
2482
2483 static int selinux_mount(const char *dev_name,
2484                          struct path *path,
2485                          const char *type,
2486                          unsigned long flags,
2487                          void *data)
2488 {
2489         const struct cred *cred = current_cred();
2490
2491         if (flags & MS_REMOUNT)
2492                 return superblock_has_perm(cred, path->dentry->d_sb,
2493                                            FILESYSTEM__REMOUNT, NULL);
2494         else
2495                 return path_has_perm(cred, path, FILE__MOUNTON);
2496 }
2497
2498 static int selinux_umount(struct vfsmount *mnt, int flags)
2499 {
2500         const struct cred *cred = current_cred();
2501
2502         return superblock_has_perm(cred, mnt->mnt_sb,
2503                                    FILESYSTEM__UNMOUNT, NULL);
2504 }
2505
2506 /* inode security operations */
2507
2508 static int selinux_inode_alloc_security(struct inode *inode)
2509 {
2510         return inode_alloc_security(inode);
2511 }
2512
2513 static void selinux_inode_free_security(struct inode *inode)
2514 {
2515         inode_free_security(inode);
2516 }
2517
2518 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2519                                         struct qstr *name, void **ctx,
2520                                         u32 *ctxlen)
2521 {
2522         const struct cred *cred = current_cred();
2523         struct task_security_struct *tsec;
2524         struct inode_security_struct *dsec;
2525         struct superblock_security_struct *sbsec;
2526         struct inode *dir = dentry->d_parent->d_inode;
2527         u32 newsid;
2528         int rc;
2529
2530         tsec = cred->security;
2531         dsec = dir->i_security;
2532         sbsec = dir->i_sb->s_security;
2533
2534         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2535                 newsid = tsec->create_sid;
2536         } else {
2537                 rc = security_transition_sid(tsec->sid, dsec->sid,
2538                                              inode_mode_to_security_class(mode),
2539                                              name,
2540                                              &newsid);
2541                 if (rc) {
2542                         printk(KERN_WARNING
2543                                 "%s: security_transition_sid failed, rc=%d\n",
2544                                __func__, -rc);
2545                         return rc;
2546                 }
2547         }
2548
2549         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2550 }
2551
2552 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2553                                        const struct qstr *qstr, char **name,
2554                                        void **value, size_t *len)
2555 {
2556         const struct task_security_struct *tsec = current_security();
2557         struct inode_security_struct *dsec;
2558         struct superblock_security_struct *sbsec;
2559         u32 sid, newsid, clen;
2560         int rc;
2561         char *namep = NULL, *context;
2562
2563         dsec = dir->i_security;
2564         sbsec = dir->i_sb->s_security;
2565
2566         sid = tsec->sid;
2567         newsid = tsec->create_sid;
2568
2569         if ((sbsec->flags & SE_SBINITIALIZED) &&
2570             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2571                 newsid = sbsec->mntpoint_sid;
2572         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2573                 rc = security_transition_sid(sid, dsec->sid,
2574                                              inode_mode_to_security_class(inode->i_mode),
2575                                              qstr, &newsid);
2576                 if (rc) {
2577                         printk(KERN_WARNING "%s:  "
2578                                "security_transition_sid failed, rc=%d (dev=%s "
2579                                "ino=%ld)\n",
2580                                __func__,
2581                                -rc, inode->i_sb->s_id, inode->i_ino);
2582                         return rc;
2583                 }
2584         }
2585
2586         /* Possibly defer initialization to selinux_complete_init. */
2587         if (sbsec->flags & SE_SBINITIALIZED) {
2588                 struct inode_security_struct *isec = inode->i_security;
2589                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2590                 isec->sid = newsid;
2591                 isec->initialized = 1;
2592         }
2593
2594         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2595                 return -EOPNOTSUPP;
2596
2597         if (name) {
2598                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2599                 if (!namep)
2600                         return -ENOMEM;
2601                 *name = namep;
2602         }
2603
2604         if (value && len) {
2605                 rc = security_sid_to_context_force(newsid, &context, &clen);
2606                 if (rc) {
2607                         kfree(namep);
2608                         return rc;
2609                 }
2610                 *value = context;
2611                 *len = clen;
2612         }
2613
2614         return 0;
2615 }
2616
2617 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2618 {
2619         return may_create(dir, dentry, SECCLASS_FILE);
2620 }
2621
2622 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2623 {
2624         return may_link(dir, old_dentry, MAY_LINK);
2625 }
2626
2627 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2628 {
2629         return may_link(dir, dentry, MAY_UNLINK);
2630 }
2631
2632 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2633 {
2634         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2635 }
2636
2637 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2638 {
2639         return may_create(dir, dentry, SECCLASS_DIR);
2640 }
2641
2642 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2643 {
2644         return may_link(dir, dentry, MAY_RMDIR);
2645 }
2646
2647 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2648 {
2649         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2650 }
2651
2652 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2653                                 struct inode *new_inode, struct dentry *new_dentry)
2654 {
2655         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2656 }
2657
2658 static int selinux_inode_readlink(struct dentry *dentry)
2659 {
2660         const struct cred *cred = current_cred();
2661
2662         return dentry_has_perm(cred, dentry, FILE__READ);
2663 }
2664
2665 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2666 {
2667         const struct cred *cred = current_cred();
2668
2669         return dentry_has_perm(cred, dentry, FILE__READ);
2670 }
2671
2672 static noinline int audit_inode_permission(struct inode *inode,
2673                                            u32 perms, u32 audited, u32 denied,
2674                                            unsigned flags)
2675 {
2676         struct common_audit_data ad;
2677         struct inode_security_struct *isec = inode->i_security;
2678         int rc;
2679
2680         ad.type = LSM_AUDIT_DATA_INODE;
2681         ad.u.inode = inode;
2682
2683         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2684                             audited, denied, &ad, flags);
2685         if (rc)
2686                 return rc;
2687         return 0;
2688 }
2689
2690 static int selinux_inode_permission(struct inode *inode, int mask)
2691 {
2692         const struct cred *cred = current_cred();
2693         u32 perms;
2694         bool from_access;
2695         unsigned flags = mask & MAY_NOT_BLOCK;
2696         struct inode_security_struct *isec;
2697         u32 sid;
2698         struct av_decision avd;
2699         int rc, rc2;
2700         u32 audited, denied;
2701
2702         from_access = mask & MAY_ACCESS;
2703         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2704
2705         /* No permission to check.  Existence test. */
2706         if (!mask)
2707                 return 0;
2708
2709         validate_creds(cred);
2710
2711         if (unlikely(IS_PRIVATE(inode)))
2712                 return 0;
2713
2714         perms = file_mask_to_av(inode->i_mode, mask);
2715
2716         sid = cred_sid(cred);
2717         isec = inode->i_security;
2718
2719         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2720         audited = avc_audit_required(perms, &avd, rc,
2721                                      from_access ? FILE__AUDIT_ACCESS : 0,
2722                                      &denied);
2723         if (likely(!audited))
2724                 return rc;
2725
2726         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2727         if (rc2)
2728                 return rc2;
2729         return rc;
2730 }
2731
2732 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2733 {
2734         const struct cred *cred = current_cred();
2735         unsigned int ia_valid = iattr->ia_valid;
2736         __u32 av = FILE__WRITE;
2737
2738         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2739         if (ia_valid & ATTR_FORCE) {
2740                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2741                               ATTR_FORCE);
2742                 if (!ia_valid)
2743                         return 0;
2744         }
2745
2746         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2747                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2748                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2749
2750         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2751                 av |= FILE__OPEN;
2752
2753         return dentry_has_perm(cred, dentry, av);
2754 }
2755
2756 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2757 {
2758         const struct cred *cred = current_cred();
2759         struct path path;
2760
2761         path.dentry = dentry;
2762         path.mnt = mnt;
2763
2764         return path_has_perm(cred, &path, FILE__GETATTR);
2765 }
2766
2767 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2768 {
2769         const struct cred *cred = current_cred();
2770
2771         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2772                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2773                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2774                         if (!capable(CAP_SETFCAP))
2775                                 return -EPERM;
2776                 } else if (!capable(CAP_SYS_ADMIN)) {
2777                         /* A different attribute in the security namespace.
2778                            Restrict to administrator. */
2779                         return -EPERM;
2780                 }
2781         }
2782
2783         /* Not an attribute we recognize, so just check the
2784            ordinary setattr permission. */
2785         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2786 }
2787
2788 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2789                                   const void *value, size_t size, int flags)
2790 {
2791         struct inode *inode = dentry->d_inode;
2792         struct inode_security_struct *isec = inode->i_security;
2793         struct superblock_security_struct *sbsec;
2794         struct common_audit_data ad;
2795         u32 newsid, sid = current_sid();
2796         int rc = 0;
2797
2798         if (strcmp(name, XATTR_NAME_SELINUX))
2799                 return selinux_inode_setotherxattr(dentry, name);
2800
2801         sbsec = inode->i_sb->s_security;
2802         if (!(sbsec->flags & SE_SBLABELSUPP))
2803                 return -EOPNOTSUPP;
2804
2805         if (!inode_owner_or_capable(inode))
2806                 return -EPERM;
2807
2808         ad.type = LSM_AUDIT_DATA_DENTRY;
2809         ad.u.dentry = dentry;
2810
2811         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2812                           FILE__RELABELFROM, &ad);
2813         if (rc)
2814                 return rc;
2815
2816         rc = security_context_to_sid(value, size, &newsid);
2817         if (rc == -EINVAL) {
2818                 if (!capable(CAP_MAC_ADMIN)) {
2819                         struct audit_buffer *ab;
2820                         size_t audit_size;
2821                         const char *str;
2822
2823                         /* We strip a nul only if it is at the end, otherwise the
2824                          * context contains a nul and we should audit that */
2825                         if (value) {
2826                                 str = value;
2827                                 if (str[size - 1] == '\0')
2828                                         audit_size = size - 1;
2829                                 else
2830                                         audit_size = size;
2831                         } else {
2832                                 str = "";
2833                                 audit_size = 0;
2834                         }
2835                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2836                         audit_log_format(ab, "op=setxattr invalid_context=");
2837                         audit_log_n_untrustedstring(ab, value, audit_size);
2838                         audit_log_end(ab);
2839
2840                         return rc;
2841                 }
2842                 rc = security_context_to_sid_force(value, size, &newsid);
2843         }
2844         if (rc)
2845                 return rc;
2846
2847         rc = avc_has_perm(sid, newsid, isec->sclass,
2848                           FILE__RELABELTO, &ad);
2849         if (rc)
2850                 return rc;
2851
2852         rc = security_validate_transition(isec->sid, newsid, sid,
2853                                           isec->sclass);
2854         if (rc)
2855                 return rc;
2856
2857         return avc_has_perm(newsid,
2858                             sbsec->sid,
2859                             SECCLASS_FILESYSTEM,
2860                             FILESYSTEM__ASSOCIATE,
2861                             &ad);
2862 }
2863
2864 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2865                                         const void *value, size_t size,
2866                                         int flags)
2867 {
2868         struct inode *inode = dentry->d_inode;
2869         struct inode_security_struct *isec = inode->i_security;
2870         u32 newsid;
2871         int rc;
2872
2873         if (strcmp(name, XATTR_NAME_SELINUX)) {
2874                 /* Not an attribute we recognize, so nothing to do. */
2875                 return;
2876         }
2877
2878         rc = security_context_to_sid_force(value, size, &newsid);
2879         if (rc) {
2880                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2881                        "for (%s, %lu), rc=%d\n",
2882                        inode->i_sb->s_id, inode->i_ino, -rc);
2883                 return;
2884         }
2885
2886         isec->sid = newsid;
2887         return;
2888 }
2889
2890 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2891 {
2892         const struct cred *cred = current_cred();
2893
2894         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2895 }
2896
2897 static int selinux_inode_listxattr(struct dentry *dentry)
2898 {
2899         const struct cred *cred = current_cred();
2900
2901         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2902 }
2903
2904 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2905 {
2906         if (strcmp(name, XATTR_NAME_SELINUX))
2907                 return selinux_inode_setotherxattr(dentry, name);
2908
2909         /* No one is allowed to remove a SELinux security label.
2910            You can change the label, but all data must be labeled. */
2911         return -EACCES;
2912 }
2913
2914 /*
2915  * Copy the inode security context value to the user.
2916  *
2917  * Permission check is handled by selinux_inode_getxattr hook.
2918  */
2919 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2920 {
2921         u32 size;
2922         int error;
2923         char *context = NULL;
2924         struct inode_security_struct *isec = inode->i_security;
2925
2926         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2927                 return -EOPNOTSUPP;
2928
2929         /*
2930          * If the caller has CAP_MAC_ADMIN, then get the raw context
2931          * value even if it is not defined by current policy; otherwise,
2932          * use the in-core value under current policy.
2933          * Use the non-auditing forms of the permission checks since
2934          * getxattr may be called by unprivileged processes commonly
2935          * and lack of permission just means that we fall back to the
2936          * in-core context value, not a denial.
2937          */
2938         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2939                                 SECURITY_CAP_NOAUDIT);
2940         if (!error)
2941                 error = security_sid_to_context_force(isec->sid, &context,
2942                                                       &size);
2943         else
2944                 error = security_sid_to_context(isec->sid, &context, &size);
2945         if (error)
2946                 return error;
2947         error = size;
2948         if (alloc) {
2949                 *buffer = context;
2950                 goto out_nofree;
2951         }
2952         kfree(context);
2953 out_nofree:
2954         return error;
2955 }
2956
2957 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2958                                      const void *value, size_t size, int flags)
2959 {
2960         struct inode_security_struct *isec = inode->i_security;
2961         u32 newsid;
2962         int rc;
2963
2964         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2965                 return -EOPNOTSUPP;
2966
2967         if (!value || !size)
2968                 return -EACCES;
2969
2970         rc = security_context_to_sid((void *)value, size, &newsid);
2971         if (rc)
2972                 return rc;
2973
2974         isec->sid = newsid;
2975         isec->initialized = 1;
2976         return 0;
2977 }
2978
2979 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2980 {
2981         const int len = sizeof(XATTR_NAME_SELINUX);
2982         if (buffer && len <= buffer_size)
2983                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2984         return len;
2985 }
2986
2987 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2988 {
2989         struct inode_security_struct *isec = inode->i_security;
2990         *secid = isec->sid;
2991 }
2992
2993 /* file security operations */
2994
2995 static int selinux_revalidate_file_permission(struct file *file, int mask)
2996 {
2997         const struct cred *cred = current_cred();
2998         struct inode *inode = file_inode(file);
2999
3000         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3001         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3002                 mask |= MAY_APPEND;
3003
3004         return file_has_perm(cred, file,
3005                              file_mask_to_av(inode->i_mode, mask));
3006 }
3007
3008 static int selinux_file_permission(struct file *file, int mask)
3009 {
3010         struct inode *inode = file_inode(file);
3011         struct file_security_struct *fsec = file->f_security;
3012         struct inode_security_struct *isec = inode->i_security;
3013         u32 sid = current_sid();
3014
3015         if (!mask)
3016                 /* No permission to check.  Existence test. */
3017                 return 0;
3018
3019         if (sid == fsec->sid && fsec->isid == isec->sid &&
3020             fsec->pseqno == avc_policy_seqno())
3021                 /* No change since file_open check. */
3022                 return 0;
3023
3024         return selinux_revalidate_file_permission(file, mask);
3025 }
3026
3027 static int selinux_file_alloc_security(struct file *file)
3028 {
3029         return file_alloc_security(file);
3030 }
3031
3032 static void selinux_file_free_security(struct file *file)
3033 {
3034         file_free_security(file);
3035 }
3036
3037 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3038                               unsigned long arg)
3039 {
3040         const struct cred *cred = current_cred();
3041         int error = 0;
3042
3043         switch (cmd) {
3044         case FIONREAD:
3045         /* fall through */
3046         case FIBMAP:
3047         /* fall through */
3048         case FIGETBSZ:
3049         /* fall through */
3050         case FS_IOC_GETFLAGS:
3051         /* fall through */
3052         case FS_IOC_GETVERSION:
3053                 error = file_has_perm(cred, file, FILE__GETATTR);
3054                 break;
3055
3056         case FS_IOC_SETFLAGS:
3057         /* fall through */
3058         case FS_IOC_SETVERSION:
3059                 error = file_has_perm(cred, file, FILE__SETATTR);
3060                 break;
3061
3062         /* sys_ioctl() checks */
3063         case FIONBIO:
3064         /* fall through */
3065         case FIOASYNC:
3066                 error = file_has_perm(cred, file, 0);
3067                 break;
3068
3069         case KDSKBENT:
3070         case KDSKBSENT:
3071                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3072                                             SECURITY_CAP_AUDIT);
3073                 break;
3074
3075         /* default case assumes that the command will go
3076          * to the file's ioctl() function.
3077          */
3078         default:
3079                 error = file_has_perm(cred, file, FILE__IOCTL);
3080         }
3081         return error;
3082 }
3083
3084 static int default_noexec;
3085
3086 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3087 {
3088         const struct cred *cred = current_cred();
3089         int rc = 0;
3090
3091         if (default_noexec &&
3092             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3093                 /*
3094                  * We are making executable an anonymous mapping or a
3095                  * private file mapping that will also be writable.
3096                  * This has an additional check.
3097                  */
3098                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3099                 if (rc)
3100                         goto error;
3101         }
3102
3103         if (file) {
3104                 /* read access is always possible with a mapping */
3105                 u32 av = FILE__READ;
3106
3107                 /* write access only matters if the mapping is shared */
3108                 if (shared && (prot & PROT_WRITE))
3109                         av |= FILE__WRITE;
3110
3111                 if (prot & PROT_EXEC)
3112                         av |= FILE__EXECUTE;
3113
3114                 return file_has_perm(cred, file, av);
3115         }
3116
3117 error:
3118         return rc;
3119 }
3120
3121 static int selinux_mmap_addr(unsigned long addr)
3122 {
3123         int rc = 0;
3124         u32 sid = current_sid();
3125
3126         /*
3127          * notice that we are intentionally putting the SELinux check before
3128          * the secondary cap_file_mmap check.  This is such a likely attempt
3129          * at bad behaviour/exploit that we always want to get the AVC, even
3130          * if DAC would have also denied the operation.
3131          */
3132         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3133                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3134                                   MEMPROTECT__MMAP_ZERO, NULL);
3135                 if (rc)
3136                         return rc;
3137         }
3138
3139         /* do DAC check on address space usage */
3140         return cap_mmap_addr(addr);
3141 }
3142
3143 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3144                              unsigned long prot, unsigned long flags)
3145 {
3146         if (selinux_checkreqprot)
3147                 prot = reqprot;
3148
3149         return file_map_prot_check(file, prot,
3150                                    (flags & MAP_TYPE) == MAP_SHARED);
3151 }
3152
3153 static int selinux_file_mprotect(struct vm_area_struct *vma,
3154                                  unsigned long reqprot,
3155                                  unsigned long prot)
3156 {
3157         const struct cred *cred = current_cred();
3158
3159         if (selinux_checkreqprot)
3160                 prot = reqprot;
3161
3162         if (default_noexec &&
3163             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3164                 int rc = 0;
3165                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3166                     vma->vm_end <= vma->vm_mm->brk) {
3167                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3168                 } else if (!vma->vm_file &&
3169                            vma->vm_start <= vma->vm_mm->start_stack &&
3170                            vma->vm_end >= vma->vm_mm->start_stack) {
3171                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3172                 } else if (vma->vm_file && vma->anon_vma) {
3173                         /*
3174                          * We are making executable a file mapping that has
3175                          * had some COW done. Since pages might have been
3176                          * written, check ability to execute the possibly
3177                          * modified content.  This typically should only
3178                          * occur for text relocations.
3179                          */
3180                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3181                 }
3182                 if (rc)
3183                         return rc;
3184         }
3185
3186         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3187 }
3188
3189 static int selinux_file_lock(struct file *file, unsigned int cmd)
3190 {
3191         const struct cred *cred = current_cred();
3192
3193         return file_has_perm(cred, file, FILE__LOCK);
3194 }
3195
3196 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3197                               unsigned long arg)
3198 {
3199         const struct cred *cred = current_cred();
3200         int err = 0;
3201
3202         switch (cmd) {
3203         case F_SETFL:
3204                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3205                         err = file_has_perm(cred, file, FILE__WRITE);
3206                         break;
3207                 }
3208                 /* fall through */
3209         case F_SETOWN:
3210         case F_SETSIG:
3211         case F_GETFL:
3212         case F_GETOWN:
3213         case F_GETSIG:
3214         case F_GETOWNER_UIDS:
3215                 /* Just check FD__USE permission */
3216                 err = file_has_perm(cred, file, 0);
3217                 break;
3218         case F_GETLK:
3219         case F_SETLK:
3220         case F_SETLKW:
3221 #if BITS_PER_LONG == 32
3222         case F_GETLK64:
3223         case F_SETLK64:
3224         case F_SETLKW64:
3225 #endif
3226                 err = file_has_perm(cred, file, FILE__LOCK);
3227                 break;
3228         }
3229
3230         return err;
3231 }
3232
3233 static int selinux_file_set_fowner(struct file *file)
3234 {
3235         struct file_security_struct *fsec;
3236
3237         fsec = file->f_security;
3238         fsec->fown_sid = current_sid();
3239
3240         return 0;
3241 }
3242
3243 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3244                                        struct fown_struct *fown, int signum)
3245 {
3246         struct file *file;
3247         u32 sid = task_sid(tsk);
3248         u32 perm;
3249         struct file_security_struct *fsec;
3250
3251         /* struct fown_struct is never outside the context of a struct file */
3252         file = container_of(fown, struct file, f_owner);
3253
3254         fsec = file->f_security;
3255
3256         if (!signum)
3257                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3258         else
3259                 perm = signal_to_av(signum);
3260
3261         return avc_has_perm(fsec->fown_sid, sid,
3262                             SECCLASS_PROCESS, perm, NULL);
3263 }
3264
3265 static int selinux_file_receive(struct file *file)
3266 {
3267         const struct cred *cred = current_cred();
3268
3269         return file_has_perm(cred, file, file_to_av(file));
3270 }
3271
3272 static int selinux_file_open(struct file *file, const struct cred *cred)
3273 {
3274         struct file_security_struct *fsec;
3275         struct inode_security_struct *isec;
3276
3277         fsec = file->f_security;
3278         isec = file_inode(file)->i_security;
3279         /*
3280          * Save inode label and policy sequence number
3281          * at open-time so that selinux_file_permission
3282          * can determine whether revalidation is necessary.
3283          * Task label is already saved in the file security
3284          * struct as its SID.
3285          */
3286         fsec->isid = isec->sid;
3287         fsec->pseqno = avc_policy_seqno();
3288         /*
3289          * Since the inode label or policy seqno may have changed
3290          * between the selinux_inode_permission check and the saving
3291          * of state above, recheck that access is still permitted.
3292          * Otherwise, access might never be revalidated against the
3293          * new inode label or new policy.
3294          * This check is not redundant - do not remove.
3295          */
3296         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3297 }
3298
3299 /* task security operations */
3300
3301 static int selinux_task_create(unsigned long clone_flags)
3302 {
3303         return current_has_perm(current, PROCESS__FORK);
3304 }
3305
3306 /*
3307  * allocate the SELinux part of blank credentials
3308  */
3309 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3310 {
3311         struct task_security_struct *tsec;
3312
3313         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3314         if (!tsec)
3315                 return -ENOMEM;
3316
3317         cred->security = tsec;
3318         return 0;
3319 }
3320
3321 /*
3322  * detach and free the LSM part of a set of credentials
3323  */
3324 static void selinux_cred_free(struct cred *cred)
3325 {
3326         struct task_security_struct *tsec = cred->security;
3327
3328         /*
3329          * cred->security == NULL if security_cred_alloc_blank() or
3330          * security_prepare_creds() returned an error.
3331          */
3332         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3333         cred->security = (void *) 0x7UL;
3334         kfree(tsec);
3335 }
3336
3337 /*
3338  * prepare a new set of credentials for modification
3339  */
3340 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3341                                 gfp_t gfp)
3342 {
3343         const struct task_security_struct *old_tsec;
3344         struct task_security_struct *tsec;
3345
3346         old_tsec = old->security;
3347
3348         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3349         if (!tsec)
3350                 return -ENOMEM;
3351
3352         new->security = tsec;
3353         return 0;
3354 }
3355
3356 /*
3357  * transfer the SELinux data to a blank set of creds
3358  */
3359 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3360 {
3361         const struct task_security_struct *old_tsec = old->security;
3362         struct task_security_struct *tsec = new->security;
3363
3364         *tsec = *old_tsec;
3365 }
3366
3367 /*
3368  * set the security data for a kernel service
3369  * - all the creation contexts are set to unlabelled
3370  */
3371 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3372 {
3373         struct task_security_struct *tsec = new->security;
3374         u32 sid = current_sid();
3375         int ret;
3376
3377         ret = avc_has_perm(sid, secid,
3378                            SECCLASS_KERNEL_SERVICE,
3379                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3380                            NULL);
3381         if (ret == 0) {
3382                 tsec->sid = secid;
3383                 tsec->create_sid = 0;
3384                 tsec->keycreate_sid = 0;
3385                 tsec->sockcreate_sid = 0;
3386         }
3387         return ret;
3388 }
3389
3390 /*
3391  * set the file creation context in a security record to the same as the
3392  * objective context of the specified inode
3393  */
3394 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3395 {
3396         struct inode_security_struct *isec = inode->i_security;
3397         struct task_security_struct *tsec = new->security;
3398         u32 sid = current_sid();
3399         int ret;
3400
3401         ret = avc_has_perm(sid, isec->sid,
3402                            SECCLASS_KERNEL_SERVICE,
3403                            KERNEL_SERVICE__CREATE_FILES_AS,
3404                            NULL);
3405
3406         if (ret == 0)
3407                 tsec->create_sid = isec->sid;
3408         return ret;
3409 }
3410
3411 static int selinux_kernel_module_request(char *kmod_name)
3412 {
3413         u32 sid;
3414         struct common_audit_data ad;
3415
3416         sid = task_sid(current);
3417
3418         ad.type = LSM_AUDIT_DATA_KMOD;
3419         ad.u.kmod_name = kmod_name;
3420
3421         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3422                             SYSTEM__MODULE_REQUEST, &ad);
3423 }
3424
3425 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3426 {
3427         return current_has_perm(p, PROCESS__SETPGID);
3428 }
3429
3430 static int selinux_task_getpgid(struct task_struct *p)
3431 {
3432         return current_has_perm(p, PROCESS__GETPGID);
3433 }
3434
3435 static int selinux_task_getsid(struct task_struct *p)
3436 {
3437         return current_has_perm(p, PROCESS__GETSESSION);
3438 }
3439
3440 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3441 {
3442         *secid = task_sid(p);
3443 }
3444
3445 static int selinux_task_setnice(struct task_struct *p, int nice)
3446 {
3447         int rc;
3448
3449         rc = cap_task_setnice(p, nice);
3450         if (rc)
3451                 return rc;
3452
3453         return current_has_perm(p, PROCESS__SETSCHED);
3454 }
3455
3456 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3457 {
3458         int rc;
3459
3460         rc = cap_task_setioprio(p, ioprio);
3461         if (rc)
3462                 return rc;
3463
3464         return current_has_perm(p, PROCESS__SETSCHED);
3465 }
3466
3467 static int selinux_task_getioprio(struct task_struct *p)
3468 {
3469         return current_has_perm(p, PROCESS__GETSCHED);
3470 }
3471
3472 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3473                 struct rlimit *new_rlim)
3474 {
3475         struct rlimit *old_rlim = p->signal->rlim + resource;
3476
3477         /* Control the ability to change the hard limit (whether
3478            lowering or raising it), so that the hard limit can
3479            later be used as a safe reset point for the soft limit
3480            upon context transitions.  See selinux_bprm_committing_creds. */
3481         if (old_rlim->rlim_max != new_rlim->rlim_max)
3482                 return current_has_perm(p, PROCESS__SETRLIMIT);
3483
3484         return 0;
3485 }
3486
3487 static int selinux_task_setscheduler(struct task_struct *p)
3488 {
3489         int rc;
3490
3491         rc = cap_task_setscheduler(p);
3492         if (rc)
3493                 return rc;
3494
3495         return current_has_perm(p, PROCESS__SETSCHED);
3496 }
3497
3498 static int selinux_task_getscheduler(struct task_struct *p)
3499 {
3500         return current_has_perm(p, PROCESS__GETSCHED);
3501 }
3502
3503 static int selinux_task_movememory(struct task_struct *p)
3504 {
3505         return current_has_perm(p, PROCESS__SETSCHED);
3506 }
3507
3508 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3509                                 int sig, u32 secid)
3510 {
3511         u32 perm;
3512         int rc;
3513
3514         if (!sig)
3515                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3516         else
3517                 perm = signal_to_av(sig);
3518         if (secid)
3519                 rc = avc_has_perm(secid, task_sid(p),
3520                                   SECCLASS_PROCESS, perm, NULL);
3521         else
3522                 rc = current_has_perm(p, perm);
3523         return rc;
3524 }
3525
3526 static int selinux_task_wait(struct task_struct *p)
3527 {
3528         return task_has_perm(p, current, PROCESS__SIGCHLD);
3529 }
3530
3531 static void selinux_task_to_inode(struct task_struct *p,
3532                                   struct inode *inode)
3533 {
3534         struct inode_security_struct *isec = inode->i_security;
3535         u32 sid = task_sid(p);
3536
3537         isec->sid = sid;
3538         isec->initialized = 1;
3539 }
3540
3541 /* Returns error only if unable to parse addresses */
3542 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3543                         struct common_audit_data *ad, u8 *proto)
3544 {
3545         int offset, ihlen, ret = -EINVAL;
3546         struct iphdr _iph, *ih;
3547
3548         offset = skb_network_offset(skb);
3549         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3550         if (ih == NULL)
3551                 goto out;
3552
3553         ihlen = ih->ihl * 4;
3554         if (ihlen < sizeof(_iph))
3555                 goto out;
3556
3557         ad->u.net->v4info.saddr = ih->saddr;
3558         ad->u.net->v4info.daddr = ih->daddr;
3559         ret = 0;
3560
3561         if (proto)
3562                 *proto = ih->protocol;
3563
3564         switch (ih->protocol) {
3565         case IPPROTO_TCP: {
3566                 struct tcphdr _tcph, *th;
3567
3568                 if (ntohs(ih->frag_off) & IP_OFFSET)
3569                         break;
3570
3571                 offset += ihlen;
3572                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3573                 if (th == NULL)
3574                         break;
3575
3576                 ad->u.net->sport = th->source;
3577                 ad->u.net->dport = th->dest;
3578                 break;
3579         }
3580
3581         case IPPROTO_UDP: {
3582                 struct udphdr _udph, *uh;
3583
3584                 if (ntohs(ih->frag_off) & IP_OFFSET)
3585                         break;
3586
3587                 offset += ihlen;
3588                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3589                 if (uh == NULL)
3590                         break;
3591
3592                 ad->u.net->sport = uh->source;
3593                 ad->u.net->dport = uh->dest;
3594                 break;
3595         }
3596
3597         case IPPROTO_DCCP: {
3598                 struct dccp_hdr _dccph, *dh;
3599
3600                 if (ntohs(ih->frag_off) & IP_OFFSET)
3601                         break;
3602
3603                 offset += ihlen;
3604                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3605                 if (dh == NULL)
3606                         break;
3607
3608                 ad->u.net->sport = dh->dccph_sport;
3609                 ad->u.net->dport = dh->dccph_dport;
3610                 break;
3611         }
3612
3613         default:
3614                 break;
3615         }
3616 out:
3617         return ret;
3618 }
3619
3620 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3621
3622 /* Returns error only if unable to parse addresses */
3623 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3624                         struct common_audit_data *ad, u8 *proto)
3625 {
3626         u8 nexthdr;
3627         int ret = -EINVAL, offset;
3628         struct ipv6hdr _ipv6h, *ip6;
3629         __be16 frag_off;
3630
3631         offset = skb_network_offset(skb);
3632         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3633         if (ip6 == NULL)
3634                 goto out;
3635
3636         ad->u.net->v6info.saddr = ip6->saddr;
3637         ad->u.net->v6info.daddr = ip6->daddr;
3638         ret = 0;
3639
3640         nexthdr = ip6->nexthdr;
3641         offset += sizeof(_ipv6h);
3642         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3643         if (offset < 0)
3644                 goto out;
3645
3646         if (proto)
3647                 *proto = nexthdr;
3648
3649         switch (nexthdr) {
3650         case IPPROTO_TCP: {
3651                 struct tcphdr _tcph, *th;
3652
3653                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3654                 if (th == NULL)
3655                         break;
3656
3657                 ad->u.net->sport = th->source;
3658                 ad->u.net->dport = th->dest;
3659                 break;
3660         }
3661
3662         case IPPROTO_UDP: {
3663                 struct udphdr _udph, *uh;
3664
3665                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3666                 if (uh == NULL)
3667                         break;
3668
3669                 ad->u.net->sport = uh->source;
3670                 ad->u.net->dport = uh->dest;
3671                 break;
3672         }
3673
3674         case IPPROTO_DCCP: {
3675                 struct dccp_hdr _dccph, *dh;
3676
3677                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3678                 if (dh == NULL)
3679                         break;
3680
3681                 ad->u.net->sport = dh->dccph_sport;
3682                 ad->u.net->dport = dh->dccph_dport;
3683                 break;
3684         }
3685
3686         /* includes fragments */
3687         default:
3688                 break;
3689         }
3690 out:
3691         return ret;
3692 }
3693
3694 #endif /* IPV6 */
3695
3696 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3697                              char **_addrp, int src, u8 *proto)
3698 {
3699         char *addrp;
3700         int ret;
3701
3702         switch (ad->u.net->family) {
3703         case PF_INET:
3704                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3705                 if (ret)
3706                         goto parse_error;
3707                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3708                                        &ad->u.net->v4info.daddr);
3709                 goto okay;
3710
3711 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3712         case PF_INET6:
3713                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3714                 if (ret)
3715                         goto parse_error;
3716                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3717                                        &ad->u.net->v6info.daddr);
3718                 goto okay;
3719 #endif  /* IPV6 */
3720         default:
3721                 addrp = NULL;
3722                 goto okay;
3723         }
3724
3725 parse_error:
3726         printk(KERN_WARNING
3727                "SELinux: failure in selinux_parse_skb(),"
3728                " unable to parse packet\n");
3729         return ret;
3730
3731 okay:
3732         if (_addrp)
3733                 *_addrp = addrp;
3734         return 0;
3735 }
3736
3737 /**
3738  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3739  * @skb: the packet
3740  * @family: protocol family
3741  * @sid: the packet's peer label SID
3742  *
3743  * Description:
3744  * Check the various different forms of network peer labeling and determine
3745  * the peer label/SID for the packet; most of the magic actually occurs in
3746  * the security server function security_net_peersid_cmp().  The function
3747  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3748  * or -EACCES if @sid is invalid due to inconsistencies with the different
3749  * peer labels.
3750  *
3751  */
3752 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3753 {
3754         int err;
3755         u32 xfrm_sid;
3756         u32 nlbl_sid;
3757         u32 nlbl_type;
3758
3759         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3760         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3761
3762         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3763         if (unlikely(err)) {
3764                 printk(KERN_WARNING
3765                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3766                        " unable to determine packet's peer label\n");
3767                 return -EACCES;
3768         }
3769
3770         return 0;
3771 }
3772
3773 /* socket security operations */
3774
3775 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3776                                  u16 secclass, u32 *socksid)
3777 {
3778         if (tsec->sockcreate_sid > SECSID_NULL) {
3779                 *socksid = tsec->sockcreate_sid;
3780                 return 0;
3781         }
3782
3783         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3784                                        socksid);
3785 }
3786
3787 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3788 {
3789         struct sk_security_struct *sksec = sk->sk_security;
3790         struct common_audit_data ad;
3791         struct lsm_network_audit net = {0,};
3792         u32 tsid = task_sid(task);
3793
3794         if (sksec->sid == SECINITSID_KERNEL)
3795                 return 0;
3796
3797         ad.type = LSM_AUDIT_DATA_NET;
3798         ad.u.net = &net;
3799         ad.u.net->sk = sk;
3800
3801         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3802 }
3803
3804 static int selinux_socket_create(int family, int type,
3805                                  int protocol, int kern)
3806 {
3807         const struct task_security_struct *tsec = current_security();
3808         u32 newsid;
3809         u16 secclass;
3810         int rc;
3811
3812         if (kern)
3813                 return 0;
3814
3815         secclass = socket_type_to_security_class(family, type, protocol);
3816         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3817         if (rc)
3818                 return rc;
3819
3820         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3821 }
3822
3823 static int selinux_socket_post_create(struct socket *sock, int family,
3824                                       int type, int protocol, int kern)
3825 {
3826         const struct task_security_struct *tsec = current_security();
3827         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3828         struct sk_security_struct *sksec;
3829         int err = 0;
3830
3831         isec->sclass = socket_type_to_security_class(family, type, protocol);
3832
3833         if (kern)
3834                 isec->sid = SECINITSID_KERNEL;
3835         else {
3836                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3837                 if (err)
3838                         return err;
3839         }
3840
3841         isec->initialized = 1;
3842
3843         if (sock->sk) {
3844                 sksec = sock->sk->sk_security;
3845                 sksec->sid = isec->sid;
3846                 sksec->sclass = isec->sclass;
3847                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3848         }
3849
3850         return err;
3851 }
3852
3853 /* Range of port numbers used to automatically bind.
3854    Need to determine whether we should perform a name_bind
3855    permission check between the socket and the port number. */
3856
3857 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3858 {
3859         struct sock *sk = sock->sk;
3860         u16 family;
3861         int err;
3862
3863         err = sock_has_perm(current, sk, SOCKET__BIND);
3864         if (err)
3865                 goto out;
3866
3867         /*
3868          * If PF_INET or PF_INET6, check name_bind permission for the port.
3869          * Multiple address binding for SCTP is not supported yet: we just
3870          * check the first address now.
3871          */
3872         family = sk->sk_family;
3873         if (family == PF_INET || family == PF_INET6) {
3874                 char *addrp;
3875                 struct sk_security_struct *sksec = sk->sk_security;
3876                 struct common_audit_data ad;
3877                 struct lsm_network_audit net = {0,};
3878                 struct sockaddr_in *addr4 = NULL;
3879                 struct sockaddr_in6 *addr6 = NULL;
3880                 unsigned short snum;
3881                 u32 sid, node_perm;
3882
3883                 if (family == PF_INET) {
3884                         addr4 = (struct sockaddr_in *)address;
3885                         snum = ntohs(addr4->sin_port);
3886                         addrp = (char *)&addr4->sin_addr.s_addr;
3887                 } else {
3888                         addr6 = (struct sockaddr_in6 *)address;
3889                         snum = ntohs(addr6->sin6_port);
3890                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3891                 }
3892
3893                 if (snum) {
3894                         int low, high;
3895
3896                         inet_get_local_port_range(&low, &high);
3897
3898                         if (snum < max(PROT_SOCK, low) || snum > high) {
3899                                 err = sel_netport_sid(sk->sk_protocol,
3900                                                       snum, &sid);
3901                                 if (err)
3902                                         goto out;
3903                                 ad.type = LSM_AUDIT_DATA_NET;
3904                                 ad.u.net = &net;
3905                                 ad.u.net->sport = htons(snum);
3906                                 ad.u.net->family = family;
3907                                 err = avc_has_perm(sksec->sid, sid,
3908                                                    sksec->sclass,
3909                                                    SOCKET__NAME_BIND, &ad);
3910                                 if (err)
3911                                         goto out;
3912                         }
3913                 }
3914
3915                 switch (sksec->sclass) {
3916                 case SECCLASS_TCP_SOCKET:
3917                         node_perm = TCP_SOCKET__NODE_BIND;
3918                         break;
3919
3920                 case SECCLASS_UDP_SOCKET:
3921                         node_perm = UDP_SOCKET__NODE_BIND;
3922                         break;
3923
3924                 case SECCLASS_DCCP_SOCKET:
3925                         node_perm = DCCP_SOCKET__NODE_BIND;
3926                         break;
3927
3928                 default:
3929                         node_perm = RAWIP_SOCKET__NODE_BIND;
3930                         break;
3931                 }
3932
3933                 err = sel_netnode_sid(addrp, family, &sid);
3934                 if (err)
3935                         goto out;
3936
3937                 ad.type = LSM_AUDIT_DATA_NET;
3938                 ad.u.net = &net;
3939                 ad.u.net->sport = htons(snum);
3940                 ad.u.net->family = family;
3941
3942                 if (family == PF_INET)
3943                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3944                 else
3945                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3946
3947                 err = avc_has_perm(sksec->sid, sid,
3948                                    sksec->sclass, node_perm, &ad);
3949                 if (err)
3950                         goto out;
3951         }
3952 out:
3953         return err;
3954 }
3955
3956 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3957 {
3958         struct sock *sk = sock->sk;
3959         struct sk_security_struct *sksec = sk->sk_security;
3960         int err;
3961
3962         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3963         if (err)
3964                 return err;
3965
3966         /*
3967          * If a TCP or DCCP socket, check name_connect permission for the port.
3968          */
3969         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3970             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3971                 struct common_audit_data ad;
3972                 struct lsm_network_audit net = {0,};
3973                 struct sockaddr_in *addr4 = NULL;
3974                 struct sockaddr_in6 *addr6 = NULL;
3975                 unsigned short snum;
3976                 u32 sid, perm;
3977
3978                 if (sk->sk_family == PF_INET) {
3979                         addr4 = (struct sockaddr_in *)address;
3980                         if (addrlen < sizeof(struct sockaddr_in))
3981                                 return -EINVAL;
3982                         snum = ntohs(addr4->sin_port);
3983                 } else {
3984                         addr6 = (struct sockaddr_in6 *)address;
3985                         if (addrlen < SIN6_LEN_RFC2133)
3986                                 return -EINVAL;
3987                         snum = ntohs(addr6->sin6_port);
3988                 }
3989
3990                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3991                 if (err)
3992                         goto out;
3993
3994                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3995                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3996
3997                 ad.type = LSM_AUDIT_DATA_NET;
3998                 ad.u.net = &net;
3999                 ad.u.net->dport = htons(snum);
4000                 ad.u.net->family = sk->sk_family;
4001                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4002                 if (err)
4003                         goto out;
4004         }
4005
4006         err = selinux_netlbl_socket_connect(sk, address);
4007
4008 out:
4009         return err;
4010 }
4011
4012 static int selinux_socket_listen(struct socket *sock, int backlog)
4013 {
4014         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4015 }
4016
4017 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4018 {
4019         int err;
4020         struct inode_security_struct *isec;
4021         struct inode_security_struct *newisec;
4022
4023         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4024         if (err)
4025                 return err;
4026
4027         newisec = SOCK_INODE(newsock)->i_security;
4028
4029         isec = SOCK_INODE(sock)->i_security;
4030         newisec->sclass = isec->sclass;
4031         newisec->sid = isec->sid;
4032         newisec->initialized = 1;
4033
4034         return 0;
4035 }
4036
4037 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4038                                   int size)
4039 {
4040         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4041 }
4042
4043 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4044                                   int size, int flags)
4045 {
4046         return sock_has_perm(current, sock->sk, SOCKET__READ);
4047 }
4048
4049 static int selinux_socket_getsockname(struct socket *sock)
4050 {
4051         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4052 }
4053
4054 static int selinux_socket_getpeername(struct socket *sock)
4055 {
4056         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4057 }
4058
4059 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4060 {
4061         int err;
4062
4063         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4064         if (err)
4065                 return err;
4066
4067         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4068 }
4069
4070 static int selinux_socket_getsockopt(struct socket *sock, int level,
4071                                      int optname)
4072 {
4073         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4074 }
4075
4076 static int selinux_socket_shutdown(struct socket *sock, int how)
4077 {
4078         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4079 }
4080
4081 static int selinux_socket_unix_stream_connect(struct sock *sock,
4082                                               struct sock *other,
4083                                               struct sock *newsk)
4084 {
4085         struct sk_security_struct *sksec_sock = sock->sk_security;
4086         struct sk_security_struct *sksec_other = other->sk_security;
4087         struct sk_security_struct *sksec_new = newsk->sk_security;
4088         struct common_audit_data ad;
4089         struct lsm_network_audit net = {0,};
4090         int err;
4091
4092         ad.type = LSM_AUDIT_DATA_NET;
4093         ad.u.net = &net;
4094         ad.u.net->sk = other;
4095
4096         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4097                            sksec_other->sclass,
4098                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4099         if (err)
4100                 return err;
4101
4102         /* server child socket */
4103         sksec_new->peer_sid = sksec_sock->sid;
4104         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4105                                     &sksec_new->sid);
4106         if (err)
4107                 return err;
4108
4109         /* connecting socket */
4110         sksec_sock->peer_sid = sksec_new->sid;
4111
4112         return 0;
4113 }
4114
4115 static int selinux_socket_unix_may_send(struct socket *sock,
4116                                         struct socket *other)
4117 {
4118         struct sk_security_struct *ssec = sock->sk->sk_security;
4119         struct sk_security_struct *osec = other->sk->sk_security;
4120         struct common_audit_data ad;
4121         struct lsm_network_audit net = {0,};
4122
4123         ad.type = LSM_AUDIT_DATA_NET;
4124         ad.u.net = &net;
4125         ad.u.net->sk = other->sk;
4126
4127         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4128                             &ad);
4129 }
4130
4131 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4132                                     u32 peer_sid,
4133                                     struct common_audit_data *ad)
4134 {
4135         int err;
4136         u32 if_sid;
4137         u32 node_sid;
4138
4139         err = sel_netif_sid(ifindex, &if_sid);
4140         if (err)
4141                 return err;
4142         err = avc_has_perm(peer_sid, if_sid,
4143                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4144         if (err)
4145                 return err;
4146
4147         err = sel_netnode_sid(addrp, family, &node_sid);
4148         if (err)
4149                 return err;
4150         return avc_has_perm(peer_sid, node_sid,
4151                             SECCLASS_NODE, NODE__RECVFROM, ad);
4152 }
4153
4154 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4155                                        u16 family)
4156 {
4157         int err = 0;
4158         struct sk_security_struct *sksec = sk->sk_security;
4159         u32 sk_sid = sksec->sid;
4160         struct common_audit_data ad;
4161         struct lsm_network_audit net = {0,};
4162         char *addrp;
4163
4164         ad.type = LSM_AUDIT_DATA_NET;
4165         ad.u.net = &net;
4166         ad.u.net->netif = skb->skb_iif;
4167         ad.u.net->family = family;
4168         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4169         if (err)
4170                 return err;
4171
4172         if (selinux_secmark_enabled()) {
4173                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4174                                    PACKET__RECV, &ad);
4175                 if (err)
4176                         return err;
4177         }
4178
4179         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4180         if (err)
4181                 return err;
4182         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4183
4184         return err;
4185 }
4186
4187 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4188 {
4189         int err;
4190         struct sk_security_struct *sksec = sk->sk_security;
4191         u16 family = sk->sk_family;
4192         u32 sk_sid = sksec->sid;
4193         struct common_audit_data ad;
4194         struct lsm_network_audit net = {0,};
4195         char *addrp;
4196         u8 secmark_active;
4197         u8 peerlbl_active;
4198
4199         if (family != PF_INET && family != PF_INET6)
4200                 return 0;
4201
4202         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4203         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4204                 family = PF_INET;
4205
4206         /* If any sort of compatibility mode is enabled then handoff processing
4207          * to the selinux_sock_rcv_skb_compat() function to deal with the
4208          * special handling.  We do this in an attempt to keep this function
4209          * as fast and as clean as possible. */
4210         if (!selinux_policycap_netpeer)
4211                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4212
4213         secmark_active = selinux_secmark_enabled();
4214         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4215         if (!secmark_active && !peerlbl_active)
4216                 return 0;
4217
4218         ad.type = LSM_AUDIT_DATA_NET;
4219         ad.u.net = &net;
4220         ad.u.net->netif = skb->skb_iif;
4221         ad.u.net->family = family;
4222         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4223         if (err)
4224                 return err;
4225
4226         if (peerlbl_active) {
4227                 u32 peer_sid;
4228
4229                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4230                 if (err)
4231                         return err;
4232                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4233                                                peer_sid, &ad);
4234                 if (err) {
4235                         selinux_netlbl_err(skb, err, 0);
4236                         return err;
4237                 }
4238                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4239                                    PEER__RECV, &ad);
4240                 if (err)
4241                         selinux_netlbl_err(skb, err, 0);
4242         }
4243
4244         if (secmark_active) {
4245                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4246                                    PACKET__RECV, &ad);
4247                 if (err)
4248                         return err;
4249         }
4250
4251         return err;
4252 }
4253
4254 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4255                                             int __user *optlen, unsigned len)
4256 {
4257         int err = 0;
4258         char *scontext;
4259         u32 scontext_len;
4260         struct sk_security_struct *sksec = sock->sk->sk_security;
4261         u32 peer_sid = SECSID_NULL;
4262
4263         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4264             sksec->sclass == SECCLASS_TCP_SOCKET)
4265                 peer_sid = sksec->peer_sid;
4266         if (peer_sid == SECSID_NULL)
4267                 return -ENOPROTOOPT;
4268
4269         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4270         if (err)
4271                 return err;
4272
4273         if (scontext_len > len) {
4274                 err = -ERANGE;
4275                 goto out_len;
4276         }
4277
4278         if (copy_to_user(optval, scontext, scontext_len))
4279                 err = -EFAULT;
4280
4281 out_len:
4282         if (put_user(scontext_len, optlen))
4283                 err = -EFAULT;
4284         kfree(scontext);
4285         return err;
4286 }
4287
4288 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4289 {
4290         u32 peer_secid = SECSID_NULL;
4291         u16 family;
4292
4293         if (skb && skb->protocol == htons(ETH_P_IP))
4294                 family = PF_INET;
4295         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4296                 family = PF_INET6;
4297         else if (sock)
4298                 family = sock->sk->sk_family;
4299         else
4300                 goto out;
4301
4302         if (sock && family == PF_UNIX)
4303                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4304         else if (skb)
4305                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4306
4307 out:
4308         *secid = peer_secid;
4309         if (peer_secid == SECSID_NULL)
4310                 return -EINVAL;
4311         return 0;
4312 }
4313
4314 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4315 {
4316         struct sk_security_struct *sksec;
4317
4318         sksec = kzalloc(sizeof(*sksec), priority);
4319         if (!sksec)
4320                 return -ENOMEM;
4321
4322         sksec->peer_sid = SECINITSID_UNLABELED;
4323         sksec->sid = SECINITSID_UNLABELED;
4324         selinux_netlbl_sk_security_reset(sksec);
4325         sk->sk_security = sksec;
4326
4327         return 0;
4328 }
4329
4330 static void selinux_sk_free_security(struct sock *sk)
4331 {
4332         struct sk_security_struct *sksec = sk->sk_security;
4333
4334         sk->sk_security = NULL;
4335         selinux_netlbl_sk_security_free(sksec);
4336         kfree(sksec);
4337 }
4338
4339 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4340 {
4341         struct sk_security_struct *sksec = sk->sk_security;
4342         struct sk_security_struct *newsksec = newsk->sk_security;
4343
4344         newsksec->sid = sksec->sid;
4345         newsksec->peer_sid = sksec->peer_sid;
4346         newsksec->sclass = sksec->sclass;
4347
4348         selinux_netlbl_sk_security_reset(newsksec);
4349 }
4350
4351 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4352 {
4353         if (!sk)
4354                 *secid = SECINITSID_ANY_SOCKET;
4355         else {
4356                 struct sk_security_struct *sksec = sk->sk_security;
4357
4358                 *secid = sksec->sid;
4359         }
4360 }
4361
4362 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4363 {
4364         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4365         struct sk_security_struct *sksec = sk->sk_security;
4366
4367         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4368             sk->sk_family == PF_UNIX)
4369                 isec->sid = sksec->sid;
4370         sksec->sclass = isec->sclass;
4371 }
4372
4373 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4374                                      struct request_sock *req)
4375 {
4376         struct sk_security_struct *sksec = sk->sk_security;
4377         int err;
4378         u16 family = sk->sk_family;
4379         u32 newsid;
4380         u32 peersid;
4381
4382         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4383         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4384                 family = PF_INET;
4385
4386         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4387         if (err)
4388                 return err;
4389         if (peersid == SECSID_NULL) {
4390                 req->secid = sksec->sid;
4391                 req->peer_secid = SECSID_NULL;
4392         } else {
4393                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4394                 if (err)
4395                         return err;
4396                 req->secid = newsid;
4397                 req->peer_secid = peersid;
4398         }
4399
4400         return selinux_netlbl_inet_conn_request(req, family);
4401 }
4402
4403 static void selinux_inet_csk_clone(struct sock *newsk,
4404                                    const struct request_sock *req)
4405 {
4406         struct sk_security_struct *newsksec = newsk->sk_security;
4407
4408         newsksec->sid = req->secid;
4409         newsksec->peer_sid = req->peer_secid;
4410         /* NOTE: Ideally, we should also get the isec->sid for the
4411            new socket in sync, but we don't have the isec available yet.
4412            So we will wait until sock_graft to do it, by which
4413            time it will have been created and available. */
4414
4415         /* We don't need to take any sort of lock here as we are the only
4416          * thread with access to newsksec */
4417         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4418 }
4419
4420 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4421 {
4422         u16 family = sk->sk_family;
4423         struct sk_security_struct *sksec = sk->sk_security;
4424
4425         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4426         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4427                 family = PF_INET;
4428
4429         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4430 }
4431
4432 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4433 {
4434         skb_set_owner_w(skb, sk);
4435 }
4436
4437 static int selinux_secmark_relabel_packet(u32 sid)
4438 {
4439         const struct task_security_struct *__tsec;
4440         u32 tsid;
4441
4442         __tsec = current_security();
4443         tsid = __tsec->sid;
4444
4445         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4446 }
4447
4448 static void selinux_secmark_refcount_inc(void)
4449 {
4450         atomic_inc(&selinux_secmark_refcount);
4451 }
4452
4453 static void selinux_secmark_refcount_dec(void)
4454 {
4455         atomic_dec(&selinux_secmark_refcount);
4456 }
4457
4458 static void selinux_req_classify_flow(const struct request_sock *req,
4459                                       struct flowi *fl)
4460 {
4461         fl->flowi_secid = req->secid;
4462 }
4463
4464 static int selinux_tun_dev_alloc_security(void **security)
4465 {
4466         struct tun_security_struct *tunsec;
4467
4468         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4469         if (!tunsec)
4470                 return -ENOMEM;
4471         tunsec->sid = current_sid();
4472
4473         *security = tunsec;
4474         return 0;
4475 }
4476
4477 static void selinux_tun_dev_free_security(void *security)
4478 {
4479         kfree(security);
4480 }
4481
4482 static int selinux_tun_dev_create(void)
4483 {
4484         u32 sid = current_sid();
4485
4486         /* we aren't taking into account the "sockcreate" SID since the socket
4487          * that is being created here is not a socket in the traditional sense,
4488          * instead it is a private sock, accessible only to the kernel, and
4489          * representing a wide range of network traffic spanning multiple
4490          * connections unlike traditional sockets - check the TUN driver to
4491          * get a better understanding of why this socket is special */
4492
4493         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4494                             NULL);
4495 }
4496
4497 static int selinux_tun_dev_attach_queue(void *security)
4498 {
4499         struct tun_security_struct *tunsec = security;
4500
4501         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4502                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4503 }
4504
4505 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4506 {
4507         struct tun_security_struct *tunsec = security;
4508         struct sk_security_struct *sksec = sk->sk_security;
4509
4510         /* we don't currently perform any NetLabel based labeling here and it
4511          * isn't clear that we would want to do so anyway; while we could apply
4512          * labeling without the support of the TUN user the resulting labeled
4513          * traffic from the other end of the connection would almost certainly
4514          * cause confusion to the TUN user that had no idea network labeling
4515          * protocols were being used */
4516
4517         sksec->sid = tunsec->sid;
4518         sksec->sclass = SECCLASS_TUN_SOCKET;
4519
4520         return 0;
4521 }
4522
4523 static int selinux_tun_dev_open(void *security)
4524 {
4525         struct tun_security_struct *tunsec = security;
4526         u32 sid = current_sid();
4527         int err;
4528
4529         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4530                            TUN_SOCKET__RELABELFROM, NULL);
4531         if (err)
4532                 return err;
4533         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4534                            TUN_SOCKET__RELABELTO, NULL);
4535         if (err)
4536                 return err;
4537         tunsec->sid = sid;
4538
4539         return 0;
4540 }
4541
4542 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4543 {
4544         int err = 0;
4545         u32 perm;
4546         struct nlmsghdr *nlh;
4547         struct sk_security_struct *sksec = sk->sk_security;
4548
4549         if (skb->len < NLMSG_HDRLEN) {
4550                 err = -EINVAL;
4551                 goto out;
4552         }
4553         nlh = nlmsg_hdr(skb);
4554
4555         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4556         if (err) {
4557                 if (err == -EINVAL) {
4558                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4559                                   "SELinux:  unrecognized netlink message"
4560                                   " type=%hu for sclass=%hu\n",
4561                                   nlh->nlmsg_type, sksec->sclass);
4562                         if (!selinux_enforcing || security_get_allow_unknown())
4563                                 err = 0;
4564                 }
4565
4566                 /* Ignore */
4567                 if (err == -ENOENT)
4568                         err = 0;
4569                 goto out;
4570         }
4571
4572         err = sock_has_perm(current, sk, perm);
4573 out:
4574         return err;
4575 }
4576
4577 #ifdef CONFIG_NETFILTER
4578
4579 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4580                                        u16 family)
4581 {
4582         int err;
4583         char *addrp;
4584         u32 peer_sid;
4585         struct common_audit_data ad;
4586         struct lsm_network_audit net = {0,};
4587         u8 secmark_active;
4588         u8 netlbl_active;
4589         u8 peerlbl_active;
4590
4591         if (!selinux_policycap_netpeer)
4592                 return NF_ACCEPT;
4593
4594         secmark_active = selinux_secmark_enabled();
4595         netlbl_active = netlbl_enabled();
4596         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4597         if (!secmark_active && !peerlbl_active)
4598                 return NF_ACCEPT;
4599
4600         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4601                 return NF_DROP;
4602
4603         ad.type = LSM_AUDIT_DATA_NET;
4604         ad.u.net = &net;
4605         ad.u.net->netif = ifindex;
4606         ad.u.net->family = family;
4607         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4608                 return NF_DROP;
4609
4610         if (peerlbl_active) {
4611                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4612                                                peer_sid, &ad);
4613                 if (err) {
4614                         selinux_netlbl_err(skb, err, 1);
4615                         return NF_DROP;
4616                 }
4617         }
4618
4619         if (secmark_active)
4620                 if (avc_has_perm(peer_sid, skb->secmark,
4621                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4622                         return NF_DROP;
4623
4624         if (netlbl_active)
4625                 /* we do this in the FORWARD path and not the POST_ROUTING
4626                  * path because we want to make sure we apply the necessary
4627                  * labeling before IPsec is applied so we can leverage AH
4628                  * protection */
4629                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4630                         return NF_DROP;
4631
4632         return NF_ACCEPT;
4633 }
4634
4635 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4636                                          struct sk_buff *skb,
4637                                          const struct net_device *in,
4638                                          const struct net_device *out,
4639                                          int (*okfn)(struct sk_buff *))
4640 {
4641         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4642 }
4643
4644 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4645 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4646                                          struct sk_buff *skb,
4647                                          const struct net_device *in,
4648                                          const struct net_device *out,
4649                                          int (*okfn)(struct sk_buff *))
4650 {
4651         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4652 }
4653 #endif  /* IPV6 */
4654
4655 static unsigned int selinux_ip_output(struct sk_buff *skb,
4656                                       u16 family)
4657 {
4658         u32 sid;
4659
4660         if (!netlbl_enabled())
4661                 return NF_ACCEPT;
4662
4663         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4664          * because we want to make sure we apply the necessary labeling
4665          * before IPsec is applied so we can leverage AH protection */
4666         if (skb->sk) {
4667                 struct sk_security_struct *sksec = skb->sk->sk_security;
4668                 sid = sksec->sid;
4669         } else
4670                 sid = SECINITSID_KERNEL;
4671         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4672                 return NF_DROP;
4673
4674         return NF_ACCEPT;
4675 }
4676
4677 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4678                                         struct sk_buff *skb,
4679                                         const struct net_device *in,
4680                                         const struct net_device *out,
4681                                         int (*okfn)(struct sk_buff *))
4682 {
4683         return selinux_ip_output(skb, PF_INET);
4684 }
4685
4686 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4687                                                 int ifindex,
4688                                                 u16 family)
4689 {
4690         struct sock *sk = skb->sk;
4691         struct sk_security_struct *sksec;
4692         struct common_audit_data ad;
4693         struct lsm_network_audit net = {0,};
4694         char *addrp;
4695         u8 proto;
4696
4697         if (sk == NULL)
4698                 return NF_ACCEPT;
4699         sksec = sk->sk_security;
4700
4701         ad.type = LSM_AUDIT_DATA_NET;
4702         ad.u.net = &net;
4703         ad.u.net->netif = ifindex;
4704         ad.u.net->family = family;
4705         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4706                 return NF_DROP;
4707
4708         if (selinux_secmark_enabled())
4709                 if (avc_has_perm(sksec->sid, skb->secmark,
4710                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4711                         return NF_DROP_ERR(-ECONNREFUSED);
4712
4713         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4714                 return NF_DROP_ERR(-ECONNREFUSED);
4715
4716         return NF_ACCEPT;
4717 }
4718
4719 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4720                                          u16 family)
4721 {
4722         u32 secmark_perm;
4723         u32 peer_sid;
4724         struct sock *sk;
4725         struct common_audit_data ad;
4726         struct lsm_network_audit net = {0,};
4727         char *addrp;
4728         u8 secmark_active;
4729         u8 peerlbl_active;
4730
4731         /* If any sort of compatibility mode is enabled then handoff processing
4732          * to the selinux_ip_postroute_compat() function to deal with the
4733          * special handling.  We do this in an attempt to keep this function
4734          * as fast and as clean as possible. */
4735         if (!selinux_policycap_netpeer)
4736                 return selinux_ip_postroute_compat(skb, ifindex, family);
4737 #ifdef CONFIG_XFRM
4738         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4739          * packet transformation so allow the packet to pass without any checks
4740          * since we'll have another chance to perform access control checks
4741          * when the packet is on it's final way out.
4742          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4743          *       is NULL, in this case go ahead and apply access control. */
4744         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4745                 return NF_ACCEPT;
4746 #endif
4747         secmark_active = selinux_secmark_enabled();
4748         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4749         if (!secmark_active && !peerlbl_active)
4750                 return NF_ACCEPT;
4751
4752         /* if the packet is being forwarded then get the peer label from the
4753          * packet itself; otherwise check to see if it is from a local
4754          * application or the kernel, if from an application get the peer label
4755          * from the sending socket, otherwise use the kernel's sid */
4756         sk = skb->sk;
4757         if (sk == NULL) {
4758                 if (skb->skb_iif) {
4759                         secmark_perm = PACKET__FORWARD_OUT;
4760                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4761                                 return NF_DROP;
4762                 } else {
4763                         secmark_perm = PACKET__SEND;
4764                         peer_sid = SECINITSID_KERNEL;
4765                 }
4766         } else {
4767                 struct sk_security_struct *sksec = sk->sk_security;
4768                 peer_sid = sksec->sid;
4769                 secmark_perm = PACKET__SEND;
4770         }
4771
4772         ad.type = LSM_AUDIT_DATA_NET;
4773         ad.u.net = &net;
4774         ad.u.net->netif = ifindex;
4775         ad.u.net->family = family;
4776         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4777                 return NF_DROP;
4778
4779         if (secmark_active)
4780                 if (avc_has_perm(peer_sid, skb->secmark,
4781                                  SECCLASS_PACKET, secmark_perm, &ad))
4782                         return NF_DROP_ERR(-ECONNREFUSED);
4783
4784         if (peerlbl_active) {
4785                 u32 if_sid;
4786                 u32 node_sid;
4787
4788                 if (sel_netif_sid(ifindex, &if_sid))
4789                         return NF_DROP;
4790                 if (avc_has_perm(peer_sid, if_sid,
4791                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4792                         return NF_DROP_ERR(-ECONNREFUSED);
4793
4794                 if (sel_netnode_sid(addrp, family, &node_sid))
4795                         return NF_DROP;
4796                 if (avc_has_perm(peer_sid, node_sid,
4797                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4798                         return NF_DROP_ERR(-ECONNREFUSED);
4799         }
4800
4801         return NF_ACCEPT;
4802 }
4803
4804 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4805                                            struct sk_buff *skb,
4806                                            const struct net_device *in,
4807                                            const struct net_device *out,
4808                                            int (*okfn)(struct sk_buff *))
4809 {
4810         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4811 }
4812
4813 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4814 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4815                                            struct sk_buff *skb,
4816                                            const struct net_device *in,
4817                                            const struct net_device *out,
4818                                            int (*okfn)(struct sk_buff *))
4819 {
4820         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4821 }
4822 #endif  /* IPV6 */
4823
4824 #endif  /* CONFIG_NETFILTER */
4825
4826 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4827 {
4828         int err;
4829
4830         err = cap_netlink_send(sk, skb);
4831         if (err)
4832                 return err;
4833
4834         return selinux_nlmsg_perm(sk, skb);
4835 }
4836
4837 static int ipc_alloc_security(struct task_struct *task,
4838                               struct kern_ipc_perm *perm,
4839                               u16 sclass)
4840 {
4841         struct ipc_security_struct *isec;
4842         u32 sid;
4843
4844         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4845         if (!isec)
4846                 return -ENOMEM;
4847
4848         sid = task_sid(task);
4849         isec->sclass = sclass;
4850         isec->sid = sid;
4851         perm->security = isec;
4852
4853         return 0;
4854 }
4855
4856 static void ipc_free_security(struct kern_ipc_perm *perm)
4857 {
4858         struct ipc_security_struct *isec = perm->security;
4859         perm->security = NULL;
4860         kfree(isec);
4861 }
4862
4863 static int msg_msg_alloc_security(struct msg_msg *msg)
4864 {
4865         struct msg_security_struct *msec;
4866
4867         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4868         if (!msec)
4869                 return -ENOMEM;
4870
4871         msec->sid = SECINITSID_UNLABELED;
4872         msg->security = msec;
4873
4874         return 0;
4875 }
4876
4877 static void msg_msg_free_security(struct msg_msg *msg)
4878 {
4879         struct msg_security_struct *msec = msg->security;
4880
4881         msg->security = NULL;
4882         kfree(msec);
4883 }
4884
4885 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4886                         u32 perms)
4887 {
4888         struct ipc_security_struct *isec;
4889         struct common_audit_data ad;
4890         u32 sid = current_sid();
4891
4892         isec = ipc_perms->security;
4893
4894         ad.type = LSM_AUDIT_DATA_IPC;
4895         ad.u.ipc_id = ipc_perms->key;
4896
4897         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4898 }
4899
4900 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4901 {
4902         return msg_msg_alloc_security(msg);
4903 }
4904
4905 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4906 {
4907         msg_msg_free_security(msg);
4908 }
4909
4910 /* message queue security operations */
4911 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4912 {
4913         struct ipc_security_struct *isec;
4914         struct common_audit_data ad;
4915         u32 sid = current_sid();
4916         int rc;
4917
4918         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4919         if (rc)
4920                 return rc;
4921
4922         isec = msq->q_perm.security;
4923
4924         ad.type = LSM_AUDIT_DATA_IPC;
4925         ad.u.ipc_id = msq->q_perm.key;
4926
4927         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4928                           MSGQ__CREATE, &ad);
4929         if (rc) {
4930                 ipc_free_security(&msq->q_perm);
4931                 return rc;
4932         }
4933         return 0;
4934 }
4935
4936 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4937 {
4938         ipc_free_security(&msq->q_perm);
4939 }
4940
4941 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4942 {
4943         struct ipc_security_struct *isec;
4944         struct common_audit_data ad;
4945         u32 sid = current_sid();
4946
4947         isec = msq->q_perm.security;
4948
4949         ad.type = LSM_AUDIT_DATA_IPC;
4950         ad.u.ipc_id = msq->q_perm.key;
4951
4952         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4953                             MSGQ__ASSOCIATE, &ad);
4954 }
4955
4956 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4957 {
4958         int err;
4959         int perms;
4960
4961         switch (cmd) {
4962         case IPC_INFO:
4963         case MSG_INFO:
4964                 /* No specific object, just general system-wide information. */
4965                 return task_has_system(current, SYSTEM__IPC_INFO);
4966         case IPC_STAT:
4967         case MSG_STAT:
4968                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4969                 break;
4970         case IPC_SET:
4971                 perms = MSGQ__SETATTR;
4972                 break;
4973         case IPC_RMID:
4974                 perms = MSGQ__DESTROY;
4975                 break;
4976         default:
4977                 return 0;
4978         }
4979
4980         err = ipc_has_perm(&msq->q_perm, perms);
4981         return err;
4982 }
4983
4984 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4985 {
4986         struct ipc_security_struct *isec;
4987         struct msg_security_struct *msec;
4988         struct common_audit_data ad;
4989         u32 sid = current_sid();
4990         int rc;
4991
4992         isec = msq->q_perm.security;
4993         msec = msg->security;
4994
4995         /*
4996          * First time through, need to assign label to the message
4997          */
4998         if (msec->sid == SECINITSID_UNLABELED) {
4999                 /*
5000                  * Compute new sid based on current process and
5001                  * message queue this message will be stored in
5002                  */
5003                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5004                                              NULL, &msec->sid);
5005                 if (rc)
5006                         return rc;
5007         }
5008
5009         ad.type = LSM_AUDIT_DATA_IPC;
5010         ad.u.ipc_id = msq->q_perm.key;
5011
5012         /* Can this process write to the queue? */
5013         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5014                           MSGQ__WRITE, &ad);
5015         if (!rc)
5016                 /* Can this process send the message */
5017                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5018                                   MSG__SEND, &ad);
5019         if (!rc)
5020                 /* Can the message be put in the queue? */
5021                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5022                                   MSGQ__ENQUEUE, &ad);
5023
5024         return rc;
5025 }
5026
5027 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5028                                     struct task_struct *target,
5029                                     long type, int mode)
5030 {
5031         struct ipc_security_struct *isec;
5032         struct msg_security_struct *msec;
5033         struct common_audit_data ad;
5034         u32 sid = task_sid(target);
5035         int rc;
5036
5037         isec = msq->q_perm.security;
5038         msec = msg->security;
5039
5040         ad.type = LSM_AUDIT_DATA_IPC;
5041         ad.u.ipc_id = msq->q_perm.key;
5042
5043         rc = avc_has_perm(sid, isec->sid,
5044                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5045         if (!rc)
5046                 rc = avc_has_perm(sid, msec->sid,
5047                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5048         return rc;
5049 }
5050
5051 /* Shared Memory security operations */
5052 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5053 {
5054         struct ipc_security_struct *isec;
5055         struct common_audit_data ad;
5056         u32 sid = current_sid();
5057         int rc;
5058
5059         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5060         if (rc)
5061                 return rc;
5062
5063         isec = shp->shm_perm.security;
5064
5065         ad.type = LSM_AUDIT_DATA_IPC;
5066         ad.u.ipc_id = shp->shm_perm.key;
5067
5068         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5069                           SHM__CREATE, &ad);
5070         if (rc) {
5071                 ipc_free_security(&shp->shm_perm);
5072                 return rc;
5073         }
5074         return 0;
5075 }
5076
5077 static void selinux_shm_free_security(struct shmid_kernel *shp)
5078 {
5079         ipc_free_security(&shp->shm_perm);
5080 }
5081
5082 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5083 {
5084         struct ipc_security_struct *isec;
5085         struct common_audit_data ad;
5086         u32 sid = current_sid();
5087
5088         isec = shp->shm_perm.security;
5089
5090         ad.type = LSM_AUDIT_DATA_IPC;
5091         ad.u.ipc_id = shp->shm_perm.key;
5092
5093         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5094                             SHM__ASSOCIATE, &ad);
5095 }
5096
5097 /* Note, at this point, shp is locked down */
5098 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5099 {
5100         int perms;
5101         int err;
5102
5103         switch (cmd) {
5104         case IPC_INFO:
5105         case SHM_INFO:
5106                 /* No specific object, just general system-wide information. */
5107                 return task_has_system(current, SYSTEM__IPC_INFO);
5108         case IPC_STAT:
5109         case SHM_STAT:
5110                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5111                 break;
5112         case IPC_SET:
5113                 perms = SHM__SETATTR;
5114                 break;
5115         case SHM_LOCK:
5116         case SHM_UNLOCK:
5117                 perms = SHM__LOCK;
5118                 break;
5119         case IPC_RMID:
5120                 perms = SHM__DESTROY;
5121                 break;
5122         default:
5123                 return 0;
5124         }
5125
5126         err = ipc_has_perm(&shp->shm_perm, perms);
5127         return err;
5128 }
5129
5130 static int selinux_shm_shmat(struct shmid_kernel *shp,
5131                              char __user *shmaddr, int shmflg)
5132 {
5133         u32 perms;
5134
5135         if (shmflg & SHM_RDONLY)
5136                 perms = SHM__READ;
5137         else
5138                 perms = SHM__READ | SHM__WRITE;
5139
5140         return ipc_has_perm(&shp->shm_perm, perms);
5141 }
5142
5143 /* Semaphore security operations */
5144 static int selinux_sem_alloc_security(struct sem_array *sma)
5145 {
5146         struct ipc_security_struct *isec;
5147         struct common_audit_data ad;
5148         u32 sid = current_sid();
5149         int rc;
5150
5151         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5152         if (rc)
5153                 return rc;
5154
5155         isec = sma->sem_perm.security;
5156
5157         ad.type = LSM_AUDIT_DATA_IPC;
5158         ad.u.ipc_id = sma->sem_perm.key;
5159
5160         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5161                           SEM__CREATE, &ad);
5162         if (rc) {
5163                 ipc_free_security(&sma->sem_perm);
5164                 return rc;
5165         }
5166         return 0;
5167 }
5168
5169 static void selinux_sem_free_security(struct sem_array *sma)
5170 {
5171         ipc_free_security(&sma->sem_perm);
5172 }
5173
5174 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5175 {
5176         struct ipc_security_struct *isec;
5177         struct common_audit_data ad;
5178         u32 sid = current_sid();
5179
5180         isec = sma->sem_perm.security;
5181
5182         ad.type = LSM_AUDIT_DATA_IPC;
5183         ad.u.ipc_id = sma->sem_perm.key;
5184
5185         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5186                             SEM__ASSOCIATE, &ad);
5187 }
5188
5189 /* Note, at this point, sma is locked down */
5190 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5191 {
5192         int err;
5193         u32 perms;
5194
5195         switch (cmd) {
5196         case IPC_INFO:
5197         case SEM_INFO:
5198                 /* No specific object, just general system-wide information. */
5199                 return task_has_system(current, SYSTEM__IPC_INFO);
5200         case GETPID:
5201         case GETNCNT:
5202         case GETZCNT:
5203                 perms = SEM__GETATTR;
5204                 break;
5205         case GETVAL:
5206         case GETALL:
5207                 perms = SEM__READ;
5208                 break;
5209         case SETVAL:
5210         case SETALL:
5211                 perms = SEM__WRITE;
5212                 break;
5213         case IPC_RMID:
5214                 perms = SEM__DESTROY;
5215                 break;
5216         case IPC_SET:
5217                 perms = SEM__SETATTR;
5218                 break;
5219         case IPC_STAT:
5220         case SEM_STAT:
5221                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5222                 break;
5223         default:
5224                 return 0;
5225         }
5226
5227         err = ipc_has_perm(&sma->sem_perm, perms);
5228         return err;
5229 }
5230
5231 static int selinux_sem_semop(struct sem_array *sma,
5232                              struct sembuf *sops, unsigned nsops, int alter)
5233 {
5234         u32 perms;
5235
5236         if (alter)
5237                 perms = SEM__READ | SEM__WRITE;
5238         else
5239                 perms = SEM__READ;
5240
5241         return ipc_has_perm(&sma->sem_perm, perms);
5242 }
5243
5244 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5245 {
5246         u32 av = 0;
5247
5248         av = 0;
5249         if (flag & S_IRUGO)
5250                 av |= IPC__UNIX_READ;
5251         if (flag & S_IWUGO)
5252                 av |= IPC__UNIX_WRITE;
5253
5254         if (av == 0)
5255                 return 0;
5256
5257         return ipc_has_perm(ipcp, av);
5258 }
5259
5260 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5261 {
5262         struct ipc_security_struct *isec = ipcp->security;
5263         *secid = isec->sid;
5264 }
5265
5266 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5267 {
5268         if (inode)
5269                 inode_doinit_with_dentry(inode, dentry);
5270 }
5271
5272 static int selinux_getprocattr(struct task_struct *p,
5273                                char *name, char **value)
5274 {
5275         const struct task_security_struct *__tsec;
5276         u32 sid;
5277         int error;
5278         unsigned len;
5279
5280         if (current != p) {
5281                 error = current_has_perm(p, PROCESS__GETATTR);
5282                 if (error)
5283                         return error;
5284         }
5285
5286         rcu_read_lock();
5287         __tsec = __task_cred(p)->security;
5288
5289         if (!strcmp(name, "current"))
5290                 sid = __tsec->sid;
5291         else if (!strcmp(name, "prev"))
5292                 sid = __tsec->osid;
5293         else if (!strcmp(name, "exec"))
5294                 sid = __tsec->exec_sid;
5295         else if (!strcmp(name, "fscreate"))
5296                 sid = __tsec->create_sid;
5297         else if (!strcmp(name, "keycreate"))
5298                 sid = __tsec->keycreate_sid;
5299         else if (!strcmp(name, "sockcreate"))
5300                 sid = __tsec->sockcreate_sid;
5301         else
5302                 goto invalid;
5303         rcu_read_unlock();
5304
5305         if (!sid)
5306                 return 0;
5307
5308         error = security_sid_to_context(sid, value, &len);
5309         if (error)
5310                 return error;
5311         return len;
5312
5313 invalid:
5314         rcu_read_unlock();
5315         return -EINVAL;
5316 }
5317
5318 static int selinux_setprocattr(struct task_struct *p,
5319                                char *name, void *value, size_t size)
5320 {
5321         struct task_security_struct *tsec;
5322         struct task_struct *tracer;
5323         struct cred *new;
5324         u32 sid = 0, ptsid;
5325         int error;
5326         char *str = value;
5327
5328         if (current != p) {
5329                 /* SELinux only allows a process to change its own
5330                    security attributes. */
5331                 return -EACCES;
5332         }
5333
5334         /*
5335          * Basic control over ability to set these attributes at all.
5336          * current == p, but we'll pass them separately in case the
5337          * above restriction is ever removed.
5338          */
5339         if (!strcmp(name, "exec"))
5340                 error = current_has_perm(p, PROCESS__SETEXEC);
5341         else if (!strcmp(name, "fscreate"))
5342                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5343         else if (!strcmp(name, "keycreate"))
5344                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5345         else if (!strcmp(name, "sockcreate"))
5346                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5347         else if (!strcmp(name, "current"))
5348                 error = current_has_perm(p, PROCESS__SETCURRENT);
5349         else
5350                 error = -EINVAL;
5351         if (error)
5352                 return error;
5353
5354         /* Obtain a SID for the context, if one was specified. */
5355         if (size && str[1] && str[1] != '\n') {
5356                 if (str[size-1] == '\n') {
5357                         str[size-1] = 0;
5358                         size--;
5359                 }
5360                 error = security_context_to_sid(value, size, &sid);
5361                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5362                         if (!capable(CAP_MAC_ADMIN)) {
5363                                 struct audit_buffer *ab;
5364                                 size_t audit_size;
5365
5366                                 /* We strip a nul only if it is at the end, otherwise the
5367                                  * context contains a nul and we should audit that */
5368                                 if (str[size - 1] == '\0')
5369                                         audit_size = size - 1;
5370                                 else
5371                                         audit_size = size;
5372                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5373                                 audit_log_format(ab, "op=fscreate invalid_context=");
5374                                 audit_log_n_untrustedstring(ab, value, audit_size);
5375                                 audit_log_end(ab);
5376
5377                                 return error;
5378                         }
5379                         error = security_context_to_sid_force(value, size,
5380                                                               &sid);
5381                 }
5382                 if (error)
5383                         return error;
5384         }
5385
5386         new = prepare_creds();
5387         if (!new)
5388                 return -ENOMEM;
5389
5390         /* Permission checking based on the specified context is
5391            performed during the actual operation (execve,
5392            open/mkdir/...), when we know the full context of the
5393            operation.  See selinux_bprm_set_creds for the execve
5394            checks and may_create for the file creation checks. The
5395            operation will then fail if the context is not permitted. */
5396         tsec = new->security;
5397         if (!strcmp(name, "exec")) {
5398                 tsec->exec_sid = sid;
5399         } else if (!strcmp(name, "fscreate")) {
5400                 tsec->create_sid = sid;
5401         } else if (!strcmp(name, "keycreate")) {
5402                 error = may_create_key(sid, p);
5403                 if (error)
5404                         goto abort_change;
5405                 tsec->keycreate_sid = sid;
5406         } else if (!strcmp(name, "sockcreate")) {
5407                 tsec->sockcreate_sid = sid;
5408         } else if (!strcmp(name, "current")) {
5409                 error = -EINVAL;
5410                 if (sid == 0)
5411                         goto abort_change;
5412
5413                 /* Only allow single threaded processes to change context */
5414                 error = -EPERM;
5415                 if (!current_is_single_threaded()) {
5416                         error = security_bounded_transition(tsec->sid, sid);
5417                         if (error)
5418                                 goto abort_change;
5419                 }
5420
5421                 /* Check permissions for the transition. */
5422                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5423                                      PROCESS__DYNTRANSITION, NULL);
5424                 if (error)
5425                         goto abort_change;
5426
5427                 /* Check for ptracing, and update the task SID if ok.
5428                    Otherwise, leave SID unchanged and fail. */
5429                 ptsid = 0;
5430                 task_lock(p);
5431                 tracer = ptrace_parent(p);
5432                 if (tracer)
5433                         ptsid = task_sid(tracer);
5434                 task_unlock(p);
5435
5436                 if (tracer) {
5437                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5438                                              PROCESS__PTRACE, NULL);
5439                         if (error)
5440                                 goto abort_change;
5441                 }
5442
5443                 tsec->sid = sid;
5444         } else {
5445                 error = -EINVAL;
5446                 goto abort_change;
5447         }
5448
5449         commit_creds(new);
5450         return size;
5451
5452 abort_change:
5453         abort_creds(new);
5454         return error;
5455 }
5456
5457 static int selinux_ismaclabel(const char *name)
5458 {
5459         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5460 }
5461
5462 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5463 {
5464         return security_sid_to_context(secid, secdata, seclen);
5465 }
5466
5467 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5468 {
5469         return security_context_to_sid(secdata, seclen, secid);
5470 }
5471
5472 static void selinux_release_secctx(char *secdata, u32 seclen)
5473 {
5474         kfree(secdata);
5475 }
5476
5477 /*
5478  *      called with inode->i_mutex locked
5479  */
5480 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5481 {
5482         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5483 }
5484
5485 /*
5486  *      called with inode->i_mutex locked
5487  */
5488 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5489 {
5490         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5491 }
5492
5493 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5494 {
5495         int len = 0;
5496         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5497                                                 ctx, true);
5498         if (len < 0)
5499                 return len;
5500         *ctxlen = len;
5501         return 0;
5502 }
5503 #ifdef CONFIG_KEYS
5504
5505 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5506                              unsigned long flags)
5507 {
5508         const struct task_security_struct *tsec;
5509         struct key_security_struct *ksec;
5510
5511         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5512         if (!ksec)
5513                 return -ENOMEM;
5514
5515         tsec = cred->security;
5516         if (tsec->keycreate_sid)
5517                 ksec->sid = tsec->keycreate_sid;
5518         else
5519                 ksec->sid = tsec->sid;
5520
5521         k->security = ksec;
5522         return 0;
5523 }
5524
5525 static void selinux_key_free(struct key *k)
5526 {
5527         struct key_security_struct *ksec = k->security;
5528
5529         k->security = NULL;
5530         kfree(ksec);
5531 }
5532
5533 static int selinux_key_permission(key_ref_t key_ref,
5534                                   const struct cred *cred,
5535                                   key_perm_t perm)
5536 {
5537         struct key *key;
5538         struct key_security_struct *ksec;
5539         u32 sid;
5540
5541         /* if no specific permissions are requested, we skip the
5542            permission check. No serious, additional covert channels
5543            appear to be created. */
5544         if (perm == 0)
5545                 return 0;
5546
5547         sid = cred_sid(cred);
5548
5549         key = key_ref_to_ptr(key_ref);
5550         ksec = key->security;
5551
5552         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5553 }
5554
5555 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5556 {
5557         struct key_security_struct *ksec = key->security;
5558         char *context = NULL;
5559         unsigned len;
5560         int rc;
5561
5562         rc = security_sid_to_context(ksec->sid, &context, &len);
5563         if (!rc)
5564                 rc = len;
5565         *_buffer = context;
5566         return rc;
5567 }
5568
5569 #endif
5570
5571 static struct security_operations selinux_ops = {
5572         .name =                         "selinux",
5573
5574         .ptrace_access_check =          selinux_ptrace_access_check,
5575         .ptrace_traceme =               selinux_ptrace_traceme,
5576         .capget =                       selinux_capget,
5577         .capset =                       selinux_capset,
5578         .capable =                      selinux_capable,
5579         .quotactl =                     selinux_quotactl,
5580         .quota_on =                     selinux_quota_on,
5581         .syslog =                       selinux_syslog,
5582         .vm_enough_memory =             selinux_vm_enough_memory,
5583
5584         .netlink_send =                 selinux_netlink_send,
5585
5586         .bprm_set_creds =               selinux_bprm_set_creds,
5587         .bprm_committing_creds =        selinux_bprm_committing_creds,
5588         .bprm_committed_creds =         selinux_bprm_committed_creds,
5589         .bprm_secureexec =              selinux_bprm_secureexec,
5590
5591         .sb_alloc_security =            selinux_sb_alloc_security,
5592         .sb_free_security =             selinux_sb_free_security,
5593         .sb_copy_data =                 selinux_sb_copy_data,
5594         .sb_remount =                   selinux_sb_remount,
5595         .sb_kern_mount =                selinux_sb_kern_mount,
5596         .sb_show_options =              selinux_sb_show_options,
5597         .sb_statfs =                    selinux_sb_statfs,
5598         .sb_mount =                     selinux_mount,
5599         .sb_umount =                    selinux_umount,
5600         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5601         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5602         .sb_parse_opts_str =            selinux_parse_opts_str,
5603
5604         .dentry_init_security =         selinux_dentry_init_security,
5605
5606         .inode_alloc_security =         selinux_inode_alloc_security,
5607         .inode_free_security =          selinux_inode_free_security,
5608         .inode_init_security =          selinux_inode_init_security,
5609         .inode_create =                 selinux_inode_create,
5610         .inode_link =                   selinux_inode_link,
5611         .inode_unlink =                 selinux_inode_unlink,
5612         .inode_symlink =                selinux_inode_symlink,
5613         .inode_mkdir =                  selinux_inode_mkdir,
5614         .inode_rmdir =                  selinux_inode_rmdir,
5615         .inode_mknod =                  selinux_inode_mknod,
5616         .inode_rename =                 selinux_inode_rename,
5617         .inode_readlink =               selinux_inode_readlink,
5618         .inode_follow_link =            selinux_inode_follow_link,
5619         .inode_permission =             selinux_inode_permission,
5620         .inode_setattr =                selinux_inode_setattr,
5621         .inode_getattr =                selinux_inode_getattr,
5622         .inode_setxattr =               selinux_inode_setxattr,
5623         .inode_post_setxattr =          selinux_inode_post_setxattr,
5624         .inode_getxattr =               selinux_inode_getxattr,
5625         .inode_listxattr =              selinux_inode_listxattr,
5626         .inode_removexattr =            selinux_inode_removexattr,
5627         .inode_getsecurity =            selinux_inode_getsecurity,
5628         .inode_setsecurity =            selinux_inode_setsecurity,
5629         .inode_listsecurity =           selinux_inode_listsecurity,
5630         .inode_getsecid =               selinux_inode_getsecid,
5631
5632         .file_permission =              selinux_file_permission,
5633         .file_alloc_security =          selinux_file_alloc_security,
5634         .file_free_security =           selinux_file_free_security,
5635         .file_ioctl =                   selinux_file_ioctl,
5636         .mmap_file =                    selinux_mmap_file,
5637         .mmap_addr =                    selinux_mmap_addr,
5638         .file_mprotect =                selinux_file_mprotect,
5639         .file_lock =                    selinux_file_lock,
5640         .file_fcntl =                   selinux_file_fcntl,
5641         .file_set_fowner =              selinux_file_set_fowner,
5642         .file_send_sigiotask =          selinux_file_send_sigiotask,
5643         .file_receive =                 selinux_file_receive,
5644
5645         .file_open =                    selinux_file_open,
5646
5647         .task_create =                  selinux_task_create,
5648         .cred_alloc_blank =             selinux_cred_alloc_blank,
5649         .cred_free =                    selinux_cred_free,
5650         .cred_prepare =                 selinux_cred_prepare,
5651         .cred_transfer =                selinux_cred_transfer,
5652         .kernel_act_as =                selinux_kernel_act_as,
5653         .kernel_create_files_as =       selinux_kernel_create_files_as,
5654         .kernel_module_request =        selinux_kernel_module_request,
5655         .task_setpgid =                 selinux_task_setpgid,
5656         .task_getpgid =                 selinux_task_getpgid,
5657         .task_getsid =                  selinux_task_getsid,
5658         .task_getsecid =                selinux_task_getsecid,
5659         .task_setnice =                 selinux_task_setnice,
5660         .task_setioprio =               selinux_task_setioprio,
5661         .task_getioprio =               selinux_task_getioprio,
5662         .task_setrlimit =               selinux_task_setrlimit,
5663         .task_setscheduler =            selinux_task_setscheduler,
5664         .task_getscheduler =            selinux_task_getscheduler,
5665         .task_movememory =              selinux_task_movememory,
5666         .task_kill =                    selinux_task_kill,
5667         .task_wait =                    selinux_task_wait,
5668         .task_to_inode =                selinux_task_to_inode,
5669
5670         .ipc_permission =               selinux_ipc_permission,
5671         .ipc_getsecid =                 selinux_ipc_getsecid,
5672
5673         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5674         .msg_msg_free_security =        selinux_msg_msg_free_security,
5675
5676         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5677         .msg_queue_free_security =      selinux_msg_queue_free_security,
5678         .msg_queue_associate =          selinux_msg_queue_associate,
5679         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5680         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5681         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5682
5683         .shm_alloc_security =           selinux_shm_alloc_security,
5684         .shm_free_security =            selinux_shm_free_security,
5685         .shm_associate =                selinux_shm_associate,
5686         .shm_shmctl =                   selinux_shm_shmctl,
5687         .shm_shmat =                    selinux_shm_shmat,
5688
5689         .sem_alloc_security =           selinux_sem_alloc_security,
5690         .sem_free_security =            selinux_sem_free_security,
5691         .sem_associate =                selinux_sem_associate,
5692         .sem_semctl =                   selinux_sem_semctl,
5693         .sem_semop =                    selinux_sem_semop,
5694
5695         .d_instantiate =                selinux_d_instantiate,
5696
5697         .getprocattr =                  selinux_getprocattr,
5698         .setprocattr =                  selinux_setprocattr,
5699
5700         .ismaclabel =                   selinux_ismaclabel,
5701         .secid_to_secctx =              selinux_secid_to_secctx,
5702         .secctx_to_secid =              selinux_secctx_to_secid,
5703         .release_secctx =               selinux_release_secctx,
5704         .inode_notifysecctx =           selinux_inode_notifysecctx,
5705         .inode_setsecctx =              selinux_inode_setsecctx,
5706         .inode_getsecctx =              selinux_inode_getsecctx,
5707
5708         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5709         .unix_may_send =                selinux_socket_unix_may_send,
5710
5711         .socket_create =                selinux_socket_create,
5712         .socket_post_create =           selinux_socket_post_create,
5713         .socket_bind =                  selinux_socket_bind,
5714         .socket_connect =               selinux_socket_connect,
5715         .socket_listen =                selinux_socket_listen,
5716         .socket_accept =                selinux_socket_accept,
5717         .socket_sendmsg =               selinux_socket_sendmsg,
5718         .socket_recvmsg =               selinux_socket_recvmsg,
5719         .socket_getsockname =           selinux_socket_getsockname,
5720         .socket_getpeername =           selinux_socket_getpeername,
5721         .socket_getsockopt =            selinux_socket_getsockopt,
5722         .socket_setsockopt =            selinux_socket_setsockopt,
5723         .socket_shutdown =              selinux_socket_shutdown,
5724         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5725         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5726         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5727         .sk_alloc_security =            selinux_sk_alloc_security,
5728         .sk_free_security =             selinux_sk_free_security,
5729         .sk_clone_security =            selinux_sk_clone_security,
5730         .sk_getsecid =                  selinux_sk_getsecid,
5731         .sock_graft =                   selinux_sock_graft,
5732         .inet_conn_request =            selinux_inet_conn_request,
5733         .inet_csk_clone =               selinux_inet_csk_clone,
5734         .inet_conn_established =        selinux_inet_conn_established,
5735         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5736         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5737         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5738         .req_classify_flow =            selinux_req_classify_flow,
5739         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5740         .tun_dev_free_security =        selinux_tun_dev_free_security,
5741         .tun_dev_create =               selinux_tun_dev_create,
5742         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5743         .tun_dev_attach =               selinux_tun_dev_attach,
5744         .tun_dev_open =                 selinux_tun_dev_open,
5745         .skb_owned_by =                 selinux_skb_owned_by,
5746
5747 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5748         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5749         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5750         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5751         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5752         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5753         .xfrm_state_free_security =     selinux_xfrm_state_free,
5754         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5755         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5756         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5757         .xfrm_decode_session =          selinux_xfrm_decode_session,
5758 #endif
5759
5760 #ifdef CONFIG_KEYS
5761         .key_alloc =                    selinux_key_alloc,
5762         .key_free =                     selinux_key_free,
5763         .key_permission =               selinux_key_permission,
5764         .key_getsecurity =              selinux_key_getsecurity,
5765 #endif
5766
5767 #ifdef CONFIG_AUDIT
5768         .audit_rule_init =              selinux_audit_rule_init,
5769         .audit_rule_known =             selinux_audit_rule_known,
5770         .audit_rule_match =             selinux_audit_rule_match,
5771         .audit_rule_free =              selinux_audit_rule_free,
5772 #endif
5773 };
5774
5775 static __init int selinux_init(void)
5776 {
5777         if (!security_module_enable(&selinux_ops)) {
5778                 selinux_enabled = 0;
5779                 return 0;
5780         }
5781
5782         if (!selinux_enabled) {
5783                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5784                 return 0;
5785         }
5786
5787         printk(KERN_INFO "SELinux:  Initializing.\n");
5788
5789         /* Set the security state for the initial task. */
5790         cred_init_security();
5791
5792         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5793
5794         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5795                                             sizeof(struct inode_security_struct),
5796                                             0, SLAB_PANIC, NULL);
5797         avc_init();
5798
5799         if (register_security(&selinux_ops))
5800                 panic("SELinux: Unable to register with kernel.\n");
5801
5802         if (selinux_enforcing)
5803                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5804         else
5805                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5806
5807         return 0;
5808 }
5809
5810 static void delayed_superblock_init(struct super_block *sb, void *unused)
5811 {
5812         superblock_doinit(sb, NULL);
5813 }
5814
5815 void selinux_complete_init(void)
5816 {
5817         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5818
5819         /* Set up any superblocks initialized prior to the policy load. */
5820         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5821         iterate_supers(delayed_superblock_init, NULL);
5822 }
5823
5824 /* SELinux requires early initialization in order to label
5825    all processes and objects when they are created. */
5826 security_initcall(selinux_init);
5827
5828 #if defined(CONFIG_NETFILTER)
5829
5830 static struct nf_hook_ops selinux_ipv4_ops[] = {
5831         {
5832                 .hook =         selinux_ipv4_postroute,
5833                 .owner =        THIS_MODULE,
5834                 .pf =           NFPROTO_IPV4,
5835                 .hooknum =      NF_INET_POST_ROUTING,
5836                 .priority =     NF_IP_PRI_SELINUX_LAST,
5837         },
5838         {
5839                 .hook =         selinux_ipv4_forward,
5840                 .owner =        THIS_MODULE,
5841                 .pf =           NFPROTO_IPV4,
5842                 .hooknum =      NF_INET_FORWARD,
5843                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5844         },
5845         {
5846                 .hook =         selinux_ipv4_output,
5847                 .owner =        THIS_MODULE,
5848                 .pf =           NFPROTO_IPV4,
5849                 .hooknum =      NF_INET_LOCAL_OUT,
5850                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5851         }
5852 };
5853
5854 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5855
5856 static struct nf_hook_ops selinux_ipv6_ops[] = {
5857         {
5858                 .hook =         selinux_ipv6_postroute,
5859                 .owner =        THIS_MODULE,
5860                 .pf =           NFPROTO_IPV6,
5861                 .hooknum =      NF_INET_POST_ROUTING,
5862                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5863         },
5864         {
5865                 .hook =         selinux_ipv6_forward,
5866                 .owner =        THIS_MODULE,
5867                 .pf =           NFPROTO_IPV6,
5868                 .hooknum =      NF_INET_FORWARD,
5869                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5870         }
5871 };
5872
5873 #endif  /* IPV6 */
5874
5875 static int __init selinux_nf_ip_init(void)
5876 {
5877         int err = 0;
5878
5879         if (!selinux_enabled)
5880                 goto out;
5881
5882         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5883
5884         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5885         if (err)
5886                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5887
5888 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5889         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5890         if (err)
5891                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5892 #endif  /* IPV6 */
5893
5894 out:
5895         return err;
5896 }
5897
5898 __initcall(selinux_nf_ip_init);
5899
5900 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5901 static void selinux_nf_ip_exit(void)
5902 {
5903         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5904
5905         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5906 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5907         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5908 #endif  /* IPV6 */
5909 }
5910 #endif
5911
5912 #else /* CONFIG_NETFILTER */
5913
5914 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5915 #define selinux_nf_ip_exit()
5916 #endif
5917
5918 #endif /* CONFIG_NETFILTER */
5919
5920 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5921 static int selinux_disabled;
5922
5923 int selinux_disable(void)
5924 {
5925         if (ss_initialized) {
5926                 /* Not permitted after initial policy load. */
5927                 return -EINVAL;
5928         }
5929
5930         if (selinux_disabled) {
5931                 /* Only do this once. */
5932                 return -EINVAL;
5933         }
5934
5935         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5936
5937         selinux_disabled = 1;
5938         selinux_enabled = 0;
5939
5940         reset_security_ops();
5941
5942         /* Try to destroy the avc node cache */
5943         avc_disable();
5944
5945         /* Unregister netfilter hooks. */
5946         selinux_nf_ip_exit();
5947
5948         /* Unregister selinuxfs. */
5949         exit_sel_fs();
5950
5951         return 0;
5952 }
5953 #endif