security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *                Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <asm/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "xfrm.h"
  84 #include "netlabel.h"
  85
  86 #define XATTR_SELINUX_SUFFIX "selinux"
  87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  88
  89 #define NUM_SEL_MNT_OPTS 4
  90
  91 extern unsigned int policydb_loaded_version;
  92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  93 extern int selinux_compat_net;
  94 extern struct security_operations *security_ops;
  95
  96 /* SECMARK reference count */
  97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 100 int selinux_enforcing = 0;
 101
 102 static int __init enforcing_setup(char *str)
 103 {
 104         selinux_enforcing = simple_strtol(str,NULL,0);
 105         return 1;
 106 }
 107 __setup("enforcing=", enforcing_setup);
 108 #endif
 109
 110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 112
 113 static int __init selinux_enabled_setup(char *str)
 114 {
 115         selinux_enabled = simple_strtol(str, NULL, 0);
 116         return 1;
 117 }
 118 __setup("selinux=", selinux_enabled_setup);
 119 #else
 120 int selinux_enabled = 1;
 121 #endif
 122
 123 /* Original (dummy) security module. */
 124 static struct security_operations *original_ops = NULL;
 125
 126 /* Minimal support for a secondary security module,
 127    just to allow the use of the dummy or capability modules.
 128    The owlsm module can alternatively be used as a secondary
 129    module as long as CONFIG_OWLSM_FD is not enabled. */
 130 static struct security_operations *secondary_ops = NULL;
 131
 132 /* Lists of inode and superblock security structures initialized
 133    before the policy was loaded. */
 134 static LIST_HEAD(superblock_security_head);
 135 static DEFINE_SPINLOCK(sb_security_lock);
 136
 137 static struct kmem_cache *sel_inode_cache;
 138
 139 /**
 140  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 141  *
 142  * Description:
 143  * This function checks the SECMARK reference counter to see if any SECMARK
 144  * targets are currently configured, if the reference counter is greater than
 145  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 146  * enabled, false (0) if SECMARK is disabled.
 147  *
 148  */
 149 static int selinux_secmark_enabled(void)
 150 {
 151         return (atomic_read(&selinux_secmark_refcount) > 0);
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_error = -1,
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 3,
 323         Opt_rootcontext = 4,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331         {Opt_error, NULL},
 332 };
 333
 334 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 335
 336 static int may_context_mount_sb_relabel(u32 sid,
 337                         struct superblock_security_struct *sbsec,
 338                         struct task_security_struct *tsec)
 339 {
 340         int rc;
 341
 342         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 343                           FILESYSTEM__RELABELFROM, NULL);
 344         if (rc)
 345                 return rc;
 346
 347         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELTO, NULL);
 349         return rc;
 350 }
 351
 352 static int may_context_mount_inode_relabel(u32 sid,
 353                         struct superblock_security_struct *sbsec,
 354                         struct task_security_struct *tsec)
 355 {
 356         int rc;
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__ASSOCIATE, NULL);
 364         return rc;
 365 }
 366
 367 static int sb_finish_set_opts(struct super_block *sb)
 368 {
 369         struct superblock_security_struct *sbsec = sb->s_security;
 370         struct dentry *root = sb->s_root;
 371         struct inode *root_inode = root->d_inode;
 372         int rc = 0;
 373
 374         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 375                 /* Make sure that the xattr handler exists and that no
 376                    error other than -ENODATA is returned by getxattr on
 377                    the root directory.  -ENODATA is ok, as this may be
 378                    the first boot of the SELinux kernel before we have
 379                    assigned xattr values to the filesystem. */
 380                 if (!root_inode->i_op->getxattr) {
 381                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 382                                "xattr support\n", sb->s_id, sb->s_type->name);
 383                         rc = -EOPNOTSUPP;
 384                         goto out;
 385                 }
 386                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 387                 if (rc < 0 && rc != -ENODATA) {
 388                         if (rc == -EOPNOTSUPP)
 389                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 390                                        "%s) has no security xattr handler\n",
 391                                        sb->s_id, sb->s_type->name);
 392                         else
 393                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 394                                        "%s) getxattr errno %d\n", sb->s_id,
 395                                        sb->s_type->name, -rc);
 396                         goto out;
 397                 }
 398         }
 399
 400         sbsec->initialized = 1;
 401
 402         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 404                        sb->s_id, sb->s_type->name);
 405         else
 406                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 407                        sb->s_id, sb->s_type->name,
 408                        labeling_behaviors[sbsec->behavior-1]);
 409
 410         /* Initialize the root inode. */
 411         rc = inode_doinit_with_dentry(root_inode, root);
 412
 413         /* Initialize any other inodes associated with the superblock, e.g.
 414            inodes created prior to initial policy load or inodes created
 415            during get_sb by a pseudo filesystem that directly
 416            populates itself. */
 417         spin_lock(&sbsec->isec_lock);
 418 next_inode:
 419         if (!list_empty(&sbsec->isec_head)) {
 420                 struct inode_security_struct *isec =
 421                                 list_entry(sbsec->isec_head.next,
 422                                            struct inode_security_struct, list);
 423                 struct inode *inode = isec->inode;
 424                 spin_unlock(&sbsec->isec_lock);
 425                 inode = igrab(inode);
 426                 if (inode) {
 427                         if (!IS_PRIVATE(inode))
 428                                 inode_doinit(inode);
 429                         iput(inode);
 430                 }
 431                 spin_lock(&sbsec->isec_lock);
 432                 list_del_init(&isec->list);
 433                 goto next_inode;
 434         }
 435         spin_unlock(&sbsec->isec_lock);
 436 out:
 437         return rc;
 438 }
 439
 440 /*
 441  * This function should allow an FS to ask what it's mount security
 442  * options were so it can use those later for submounts, displaying
 443  * mount options, or whatever.
 444  */
 445 static int selinux_get_mnt_opts(const struct super_block *sb,
 446                                 struct security_mnt_opts *opts)
 447 {
 448         int rc = 0, i;
 449         struct superblock_security_struct *sbsec = sb->s_security;
 450         char *context = NULL;
 451         u32 len;
 452         char tmp;
 453
 454         security_init_mnt_opts(opts);
 455
 456         if (!sbsec->initialized)
 457                 return -EINVAL;
 458
 459         if (!ss_initialized)
 460                 return -EINVAL;
 461
 462         /*
 463          * if we ever use sbsec flags for anything other than tracking mount
 464          * settings this is going to need a mask
 465          */
 466         tmp = sbsec->flags;
 467         /* count the number of mount options for this sb */
 468         for (i = 0; i < 8; i++) {
 469                 if (tmp & 0x01)
 470                         opts->num_mnt_opts++;
 471                 tmp >>= 1;
 472         }
 473
 474         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 475         if (!opts->mnt_opts) {
 476                 rc = -ENOMEM;
 477                 goto out_free;
 478         }
 479
 480         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 481         if (!opts->mnt_opts_flags) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         i = 0;
 487         if (sbsec->flags & FSCONTEXT_MNT) {
 488                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 489                 if (rc)
 490                         goto out_free;
 491                 opts->mnt_opts[i] = context;
 492                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 493         }
 494         if (sbsec->flags & CONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 500         }
 501         if (sbsec->flags & DEFCONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 507         }
 508         if (sbsec->flags & ROOTCONTEXT_MNT) {
 509                 struct inode *root = sbsec->sb->s_root->d_inode;
 510                 struct inode_security_struct *isec = root->i_security;
 511
 512                 rc = security_sid_to_context(isec->sid, &context, &len);
 513                 if (rc)
 514                         goto out_free;
 515                 opts->mnt_opts[i] = context;
 516                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 517         }
 518
 519         BUG_ON(i != opts->num_mnt_opts);
 520
 521         return 0;
 522
 523 out_free:
 524         security_free_mnt_opts(opts);
 525         return rc;
 526 }
 527
 528 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 529                       u32 old_sid, u32 new_sid)
 530 {
 531         /* check if the old mount command had the same options */
 532         if (sbsec->initialized)
 533                 if (!(sbsec->flags & flag) ||
 534                     (old_sid != new_sid))
 535                         return 1;
 536
 537         /* check if we were passed the same options twice,
 538          * aka someone passed context=a,context=b
 539          */
 540         if (!sbsec->initialized)
 541                 if (sbsec->flags & flag)
 542                         return 1;
 543         return 0;
 544 }
 545
 546 /*
 547  * Allow filesystems with binary mount data to explicitly set mount point
 548  * labeling information.
 549  */
 550 static int selinux_set_mnt_opts(struct super_block *sb,
 551                                 struct security_mnt_opts *opts)
 552 {
 553         int rc = 0, i;
 554         struct task_security_struct *tsec = current->security;
 555         struct superblock_security_struct *sbsec = sb->s_security;
 556         const char *name = sb->s_type->name;
 557         struct inode *inode = sbsec->sb->s_root->d_inode;
 558         struct inode_security_struct *root_isec = inode->i_security;
 559         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 560         u32 defcontext_sid = 0;
 561         char **mount_options = opts->mnt_opts;
 562         int *flags = opts->mnt_opts_flags;
 563         int num_opts = opts->num_mnt_opts;
 564
 565         mutex_lock(&sbsec->lock);
 566
 567         if (!ss_initialized) {
 568                 if (!num_opts) {
 569                         /* Defer initialization until selinux_complete_init,
 570                            after the initial policy is loaded and the security
 571                            server is ready to handle calls. */
 572                         spin_lock(&sb_security_lock);
 573                         if (list_empty(&sbsec->list))
 574                                 list_add(&sbsec->list, &superblock_security_head);
 575                         spin_unlock(&sb_security_lock);
 576                         goto out;
 577                 }
 578                 rc = -EINVAL;
 579                 printk(KERN_WARNING "Unable to set superblock options before "
 580                        "the security server is initialized\n");
 581                 goto out;
 582         }
 583
 584         /*
 585          * Binary mount data FS will come through this function twice.  Once
 586          * from an explicit call and once from the generic calls from the vfs.
 587          * Since the generic VFS calls will not contain any security mount data
 588          * we need to skip the double mount verification.
 589          *
 590          * This does open a hole in which we will not notice if the first
 591          * mount using this sb set explict options and a second mount using
 592          * this sb does not set any security options.  (The first options
 593          * will be used for both mounts)
 594          */
 595         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 596             && (num_opts == 0))
 597                 goto out;
 598
 599         /*
 600          * parse the mount options, check if they are valid sids.
 601          * also check if someone is trying to mount the same sb more
 602          * than once with different security options.
 603          */
 604         for (i = 0; i < num_opts; i++) {
 605                 u32 sid;
 606                 rc = security_context_to_sid(mount_options[i],
 607                                              strlen(mount_options[i]), &sid);
 608                 if (rc) {
 609                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 610                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 611                                mount_options[i], sb->s_id, name, rc);
 612                         goto out;
 613                 }
 614                 switch (flags[i]) {
 615                 case FSCONTEXT_MNT:
 616                         fscontext_sid = sid;
 617
 618                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 619                                         fscontext_sid))
 620                                 goto out_double_mount;
 621
 622                         sbsec->flags |= FSCONTEXT_MNT;
 623                         break;
 624                 case CONTEXT_MNT:
 625                         context_sid = sid;
 626
 627                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 628                                         context_sid))
 629                                 goto out_double_mount;
 630
 631                         sbsec->flags |= CONTEXT_MNT;
 632                         break;
 633                 case ROOTCONTEXT_MNT:
 634                         rootcontext_sid = sid;
 635
 636                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 637                                         rootcontext_sid))
 638                                 goto out_double_mount;
 639
 640                         sbsec->flags |= ROOTCONTEXT_MNT;
 641
 642                         break;
 643                 case DEFCONTEXT_MNT:
 644                         defcontext_sid = sid;
 645
 646                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 647                                         defcontext_sid))
 648                                 goto out_double_mount;
 649
 650                         sbsec->flags |= DEFCONTEXT_MNT;
 651
 652                         break;
 653                 default:
 654                         rc = -EINVAL;
 655                         goto out;
 656                 }
 657         }
 658
 659         if (sbsec->initialized) {
 660                 /* previously mounted with options, but not on this attempt? */
 661                 if (sbsec->flags && !num_opts)
 662                         goto out_double_mount;
 663                 rc = 0;
 664                 goto out;
 665         }
 666
 667         if (strcmp(sb->s_type->name, "proc") == 0)
 668                 sbsec->proc = 1;
 669
 670         /* Determine the labeling behavior to use for this filesystem type. */
 671         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 672         if (rc) {
 673                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 674                        __FUNCTION__, sb->s_type->name, rc);
 675                 goto out;
 676         }
 677
 678         /* sets the context of the superblock for the fs being mounted. */
 679         if (fscontext_sid) {
 680
 681                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 682                 if (rc)
 683                         goto out;
 684
 685                 sbsec->sid = fscontext_sid;
 686         }
 687
 688         /*
 689          * Switch to using mount point labeling behavior.
 690          * sets the label used on all file below the mountpoint, and will set
 691          * the superblock context if not already set.
 692          */
 693         if (context_sid) {
 694                 if (!fscontext_sid) {
 695                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 696                         if (rc)
 697                                 goto out;
 698                         sbsec->sid = context_sid;
 699                 } else {
 700                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 701                         if (rc)
 702                                 goto out;
 703                 }
 704                 if (!rootcontext_sid)
 705                         rootcontext_sid = context_sid;
 706
 707                 sbsec->mntpoint_sid = context_sid;
 708                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 709         }
 710
 711         if (rootcontext_sid) {
 712                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 713                 if (rc)
 714                         goto out;
 715
 716                 root_isec->sid = rootcontext_sid;
 717                 root_isec->initialized = 1;
 718         }
 719
 720         if (defcontext_sid) {
 721                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 722                         rc = -EINVAL;
 723                         printk(KERN_WARNING "SELinux: defcontext option is "
 724                                "invalid for this filesystem type\n");
 725                         goto out;
 726                 }
 727
 728                 if (defcontext_sid != sbsec->def_sid) {
 729                         rc = may_context_mount_inode_relabel(defcontext_sid,
 730                                                              sbsec, tsec);
 731                         if (rc)
 732                                 goto out;
 733                 }
 734
 735                 sbsec->def_sid = defcontext_sid;
 736         }
 737
 738         rc = sb_finish_set_opts(sb);
 739 out:
 740         mutex_unlock(&sbsec->lock);
 741         return rc;
 742 out_double_mount:
 743         rc = -EINVAL;
 744         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 745                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 746         goto out;
 747 }
 748
 749 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 750                                         struct super_block *newsb)
 751 {
 752         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 753         struct superblock_security_struct *newsbsec = newsb->s_security;
 754
 755         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 756         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 757         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 758
 759         /* we can't error, we can't save the info, this shouldn't get called
 760          * this early in the boot process. */
 761         BUG_ON(!ss_initialized);
 762
 763         /* this might go away sometime down the line if there is a new user
 764          * of clone, but for now, nfs better not get here... */
 765         BUG_ON(newsbsec->initialized);
 766
 767         /* how can we clone if the old one wasn't set up?? */
 768         BUG_ON(!oldsbsec->initialized);
 769
 770         mutex_lock(&newsbsec->lock);
 771
 772         newsbsec->flags = oldsbsec->flags;
 773
 774         newsbsec->sid = oldsbsec->sid;
 775         newsbsec->def_sid = oldsbsec->def_sid;
 776         newsbsec->behavior = oldsbsec->behavior;
 777
 778         if (set_context) {
 779                 u32 sid = oldsbsec->mntpoint_sid;
 780
 781                 if (!set_fscontext)
 782                         newsbsec->sid = sid;
 783                 if (!set_rootcontext) {
 784                         struct inode *newinode = newsb->s_root->d_inode;
 785                         struct inode_security_struct *newisec = newinode->i_security;
 786                         newisec->sid = sid;
 787                 }
 788                 newsbsec->mntpoint_sid = sid;
 789         }
 790         if (set_rootcontext) {
 791                 const struct inode *oldinode = oldsb->s_root->d_inode;
 792                 const struct inode_security_struct *oldisec = oldinode->i_security;
 793                 struct inode *newinode = newsb->s_root->d_inode;
 794                 struct inode_security_struct *newisec = newinode->i_security;
 795
 796                 newisec->sid = oldisec->sid;
 797         }
 798
 799         sb_finish_set_opts(newsb);
 800         mutex_unlock(&newsbsec->lock);
 801 }
 802
 803 int selinux_parse_opts_str(char *options, struct security_mnt_opts *opts)
 804 {
 805         char *p;
 806         char *context = NULL, *defcontext = NULL;
 807         char *fscontext = NULL, *rootcontext = NULL;
 808         int rc, num_mnt_opts = 0;
 809
 810         opts->num_mnt_opts = 0;
 811
 812         /* Standard string-based options. */
 813         while ((p = strsep(&options, "|")) != NULL) {
 814                 int token;
 815                 substring_t args[MAX_OPT_ARGS];
 816
 817                 if (!*p)
 818                         continue;
 819
 820                 token = match_token(p, tokens, args);
 821
 822                 switch (token) {
 823                 case Opt_context:
 824                         if (context || defcontext) {
 825                                 rc = -EINVAL;
 826                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 827                                 goto out_err;
 828                         }
 829                         context = match_strdup(&args[0]);
 830                         if (!context) {
 831                                 rc = -ENOMEM;
 832                                 goto out_err;
 833                         }
 834                         break;
 835
 836                 case Opt_fscontext:
 837                         if (fscontext) {
 838                                 rc = -EINVAL;
 839                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 840                                 goto out_err;
 841                         }
 842                         fscontext = match_strdup(&args[0]);
 843                         if (!fscontext) {
 844                                 rc = -ENOMEM;
 845                                 goto out_err;
 846                         }
 847                         break;
 848
 849                 case Opt_rootcontext:
 850                         if (rootcontext) {
 851                                 rc = -EINVAL;
 852                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 853                                 goto out_err;
 854                         }
 855                         rootcontext = match_strdup(&args[0]);
 856                         if (!rootcontext) {
 857                                 rc = -ENOMEM;
 858                                 goto out_err;
 859                         }
 860                         break;
 861
 862                 case Opt_defcontext:
 863                         if (context || defcontext) {
 864                                 rc = -EINVAL;
 865                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 866                                 goto out_err;
 867                         }
 868                         defcontext = match_strdup(&args[0]);
 869                         if (!defcontext) {
 870                                 rc = -ENOMEM;
 871                                 goto out_err;
 872                         }
 873                         break;
 874
 875                 default:
 876                         rc = -EINVAL;
 877                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 878                         goto out_err;
 879
 880                 }
 881         }
 882
 883         rc = -ENOMEM;
 884         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 885         if (!opts->mnt_opts)
 886                 goto out_err;
 887
 888         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 889         if (!opts->mnt_opts_flags) {
 890                 kfree(opts->mnt_opts);
 891                 goto out_err;
 892         }
 893
 894         if (fscontext) {
 895                 opts->mnt_opts[num_mnt_opts] = fscontext;
 896                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 897         }
 898         if (context) {
 899                 opts->mnt_opts[num_mnt_opts] = context;
 900                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 901         }
 902         if (rootcontext) {
 903                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 904                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 905         }
 906         if (defcontext) {
 907                 opts->mnt_opts[num_mnt_opts] = defcontext;
 908                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 909         }
 910
 911         opts->num_mnt_opts = num_mnt_opts;
 912         return 0;
 913
 914 out_err:
 915         kfree(context);
 916         kfree(defcontext);
 917         kfree(fscontext);
 918         kfree(rootcontext);
 919         return rc;
 920 }
 921 /*
 922  * string mount options parsing and call set the sbsec
 923  */
 924 static int superblock_doinit(struct super_block *sb, void *data)
 925 {
 926         int rc = 0;
 927         char *options = data;
 928         struct security_mnt_opts opts;
 929
 930         security_init_mnt_opts(&opts);
 931
 932         if (!data)
 933                 goto out;
 934
 935         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 936
 937         rc = selinux_parse_opts_str(options, &opts);
 938         if (rc)
 939                 goto out_err;
 940
 941 out:
 942         rc = selinux_set_mnt_opts(sb, &opts);
 943
 944 out_err:
 945         security_free_mnt_opts(&opts);
 946         return rc;
 947 }
 948
 949 static inline u16 inode_mode_to_security_class(umode_t mode)
 950 {
 951         switch (mode & S_IFMT) {
 952         case S_IFSOCK:
 953                 return SECCLASS_SOCK_FILE;
 954         case S_IFLNK:
 955                 return SECCLASS_LNK_FILE;
 956         case S_IFREG:
 957                 return SECCLASS_FILE;
 958         case S_IFBLK:
 959                 return SECCLASS_BLK_FILE;
 960         case S_IFDIR:
 961                 return SECCLASS_DIR;
 962         case S_IFCHR:
 963                 return SECCLASS_CHR_FILE;
 964         case S_IFIFO:
 965                 return SECCLASS_FIFO_FILE;
 966
 967         }
 968
 969         return SECCLASS_FILE;
 970 }
 971
 972 static inline int default_protocol_stream(int protocol)
 973 {
 974         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 975 }
 976
 977 static inline int default_protocol_dgram(int protocol)
 978 {
 979         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 980 }
 981
 982 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 983 {
 984         switch (family) {
 985         case PF_UNIX:
 986                 switch (type) {
 987                 case SOCK_STREAM:
 988                 case SOCK_SEQPACKET:
 989                         return SECCLASS_UNIX_STREAM_SOCKET;
 990                 case SOCK_DGRAM:
 991                         return SECCLASS_UNIX_DGRAM_SOCKET;
 992                 }
 993                 break;
 994         case PF_INET:
 995         case PF_INET6:
 996                 switch (type) {
 997                 case SOCK_STREAM:
 998                         if (default_protocol_stream(protocol))
 999                                 return SECCLASS_TCP_SOCKET;
1000                         else
1001                                 return SECCLASS_RAWIP_SOCKET;
1002                 case SOCK_DGRAM:
1003                         if (default_protocol_dgram(protocol))
1004                                 return SECCLASS_UDP_SOCKET;
1005                         else
1006                                 return SECCLASS_RAWIP_SOCKET;
1007                 case SOCK_DCCP:
1008                         return SECCLASS_DCCP_SOCKET;
1009                 default:
1010                         return SECCLASS_RAWIP_SOCKET;
1011                 }
1012                 break;
1013         case PF_NETLINK:
1014                 switch (protocol) {
1015                 case NETLINK_ROUTE:
1016                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1017                 case NETLINK_FIREWALL:
1018                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1019                 case NETLINK_INET_DIAG:
1020                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1021                 case NETLINK_NFLOG:
1022                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1023                 case NETLINK_XFRM:
1024                         return SECCLASS_NETLINK_XFRM_SOCKET;
1025                 case NETLINK_SELINUX:
1026                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1027                 case NETLINK_AUDIT:
1028                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1029                 case NETLINK_IP6_FW:
1030                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1031                 case NETLINK_DNRTMSG:
1032                         return SECCLASS_NETLINK_DNRT_SOCKET;
1033                 case NETLINK_KOBJECT_UEVENT:
1034                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1035                 default:
1036                         return SECCLASS_NETLINK_SOCKET;
1037                 }
1038         case PF_PACKET:
1039                 return SECCLASS_PACKET_SOCKET;
1040         case PF_KEY:
1041                 return SECCLASS_KEY_SOCKET;
1042         case PF_APPLETALK:
1043                 return SECCLASS_APPLETALK_SOCKET;
1044         }
1045
1046         return SECCLASS_SOCKET;
1047 }
1048
1049 #ifdef CONFIG_PROC_FS
1050 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1051                                 u16 tclass,
1052                                 u32 *sid)
1053 {
1054         int buflen, rc;
1055         char *buffer, *path, *end;
1056
1057         buffer = (char*)__get_free_page(GFP_KERNEL);
1058         if (!buffer)
1059                 return -ENOMEM;
1060
1061         buflen = PAGE_SIZE;
1062         end = buffer+buflen;
1063         *--end = '\0';
1064         buflen--;
1065         path = end-1;
1066         *path = '/';
1067         while (de && de != de->parent) {
1068                 buflen -= de->namelen + 1;
1069                 if (buflen < 0)
1070                         break;
1071                 end -= de->namelen;
1072                 memcpy(end, de->name, de->namelen);
1073                 *--end = '/';
1074                 path = end;
1075                 de = de->parent;
1076         }
1077         rc = security_genfs_sid("proc", path, tclass, sid);
1078         free_page((unsigned long)buffer);
1079         return rc;
1080 }
1081 #else
1082 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1083                                 u16 tclass,
1084                                 u32 *sid)
1085 {
1086         return -EINVAL;
1087 }
1088 #endif
1089
1090 /* The inode's security attributes must be initialized before first use. */
1091 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1092 {
1093         struct superblock_security_struct *sbsec = NULL;
1094         struct inode_security_struct *isec = inode->i_security;
1095         u32 sid;
1096         struct dentry *dentry;
1097 #define INITCONTEXTLEN 255
1098         char *context = NULL;
1099         unsigned len = 0;
1100         int rc = 0;
1101
1102         if (isec->initialized)
1103                 goto out;
1104
1105         mutex_lock(&isec->lock);
1106         if (isec->initialized)
1107                 goto out_unlock;
1108
1109         sbsec = inode->i_sb->s_security;
1110         if (!sbsec->initialized) {
1111                 /* Defer initialization until selinux_complete_init,
1112                    after the initial policy is loaded and the security
1113                    server is ready to handle calls. */
1114                 spin_lock(&sbsec->isec_lock);
1115                 if (list_empty(&isec->list))
1116                         list_add(&isec->list, &sbsec->isec_head);
1117                 spin_unlock(&sbsec->isec_lock);
1118                 goto out_unlock;
1119         }
1120
1121         switch (sbsec->behavior) {
1122         case SECURITY_FS_USE_XATTR:
1123                 if (!inode->i_op->getxattr) {
1124                         isec->sid = sbsec->def_sid;
1125                         break;
1126                 }
1127
1128                 /* Need a dentry, since the xattr API requires one.
1129                    Life would be simpler if we could just pass the inode. */
1130                 if (opt_dentry) {
1131                         /* Called from d_instantiate or d_splice_alias. */
1132                         dentry = dget(opt_dentry);
1133                 } else {
1134                         /* Called from selinux_complete_init, try to find a dentry. */
1135                         dentry = d_find_alias(inode);
1136                 }
1137                 if (!dentry) {
1138                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
1139                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1140                                inode->i_ino);
1141                         goto out_unlock;
1142                 }
1143
1144                 len = INITCONTEXTLEN;
1145                 context = kmalloc(len, GFP_KERNEL);
1146                 if (!context) {
1147                         rc = -ENOMEM;
1148                         dput(dentry);
1149                         goto out_unlock;
1150                 }
1151                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1152                                            context, len);
1153                 if (rc == -ERANGE) {
1154                         /* Need a larger buffer.  Query for the right size. */
1155                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1156                                                    NULL, 0);
1157                         if (rc < 0) {
1158                                 dput(dentry);
1159                                 goto out_unlock;
1160                         }
1161                         kfree(context);
1162                         len = rc;
1163                         context = kmalloc(len, GFP_KERNEL);
1164                         if (!context) {
1165                                 rc = -ENOMEM;
1166                                 dput(dentry);
1167                                 goto out_unlock;
1168                         }
1169                         rc = inode->i_op->getxattr(dentry,
1170                                                    XATTR_NAME_SELINUX,
1171                                                    context, len);
1172                 }
1173                 dput(dentry);
1174                 if (rc < 0) {
1175                         if (rc != -ENODATA) {
1176                                 printk(KERN_WARNING "%s:  getxattr returned "
1177                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
1178                                        -rc, inode->i_sb->s_id, inode->i_ino);
1179                                 kfree(context);
1180                                 goto out_unlock;
1181                         }
1182                         /* Map ENODATA to the default file SID */
1183                         sid = sbsec->def_sid;
1184                         rc = 0;
1185                 } else {
1186                         rc = security_context_to_sid_default(context, rc, &sid,
1187                                                              sbsec->def_sid);
1188                         if (rc) {
1189                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
1190                                        "returned %d for dev=%s ino=%ld\n",
1191                                        __FUNCTION__, context, -rc,
1192                                        inode->i_sb->s_id, inode->i_ino);
1193                                 kfree(context);
1194                                 /* Leave with the unlabeled SID */
1195                                 rc = 0;
1196                                 break;
1197                         }
1198                 }
1199                 kfree(context);
1200                 isec->sid = sid;
1201                 break;
1202         case SECURITY_FS_USE_TASK:
1203                 isec->sid = isec->task_sid;
1204                 break;
1205         case SECURITY_FS_USE_TRANS:
1206                 /* Default to the fs SID. */
1207                 isec->sid = sbsec->sid;
1208
1209                 /* Try to obtain a transition SID. */
1210                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1211                 rc = security_transition_sid(isec->task_sid,
1212                                              sbsec->sid,
1213                                              isec->sclass,
1214                                              &sid);
1215                 if (rc)
1216                         goto out_unlock;
1217                 isec->sid = sid;
1218                 break;
1219         case SECURITY_FS_USE_MNTPOINT:
1220                 isec->sid = sbsec->mntpoint_sid;
1221                 break;
1222         default:
1223                 /* Default to the fs superblock SID. */
1224                 isec->sid = sbsec->sid;
1225
1226                 if (sbsec->proc) {
1227                         struct proc_inode *proci = PROC_I(inode);
1228                         if (proci->pde) {
1229                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1230                                 rc = selinux_proc_get_sid(proci->pde,
1231                                                           isec->sclass,
1232                                                           &sid);
1233                                 if (rc)
1234                                         goto out_unlock;
1235                                 isec->sid = sid;
1236                         }
1237                 }
1238                 break;
1239         }
1240
1241         isec->initialized = 1;
1242
1243 out_unlock:
1244         mutex_unlock(&isec->lock);
1245 out:
1246         if (isec->sclass == SECCLASS_FILE)
1247                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1248         return rc;
1249 }
1250
1251 /* Convert a Linux signal to an access vector. */
1252 static inline u32 signal_to_av(int sig)
1253 {
1254         u32 perm = 0;
1255
1256         switch (sig) {
1257         case SIGCHLD:
1258                 /* Commonly granted from child to parent. */
1259                 perm = PROCESS__SIGCHLD;
1260                 break;
1261         case SIGKILL:
1262                 /* Cannot be caught or ignored */
1263                 perm = PROCESS__SIGKILL;
1264                 break;
1265         case SIGSTOP:
1266                 /* Cannot be caught or ignored */
1267                 perm = PROCESS__SIGSTOP;
1268                 break;
1269         default:
1270                 /* All other signals. */
1271                 perm = PROCESS__SIGNAL;
1272                 break;
1273         }
1274
1275         return perm;
1276 }
1277
1278 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1279    fork check, ptrace check, etc. */
1280 static int task_has_perm(struct task_struct *tsk1,
1281                          struct task_struct *tsk2,
1282                          u32 perms)
1283 {
1284         struct task_security_struct *tsec1, *tsec2;
1285
1286         tsec1 = tsk1->security;
1287         tsec2 = tsk2->security;
1288         return avc_has_perm(tsec1->sid, tsec2->sid,
1289                             SECCLASS_PROCESS, perms, NULL);
1290 }
1291
1292 #if CAP_LAST_CAP > 63
1293 #error Fix SELinux to handle capabilities > 63.
1294 #endif
1295
1296 /* Check whether a task is allowed to use a capability. */
1297 static int task_has_capability(struct task_struct *tsk,
1298                                int cap)
1299 {
1300         struct task_security_struct *tsec;
1301         struct avc_audit_data ad;
1302         u16 sclass;
1303         u32 av = CAP_TO_MASK(cap);
1304
1305         tsec = tsk->security;
1306
1307         AVC_AUDIT_DATA_INIT(&ad,CAP);
1308         ad.tsk = tsk;
1309         ad.u.cap = cap;
1310
1311         switch (CAP_TO_INDEX(cap)) {
1312         case 0:
1313                 sclass = SECCLASS_CAPABILITY;
1314                 break;
1315         case 1:
1316                 sclass = SECCLASS_CAPABILITY2;
1317                 break;
1318         default:
1319                 printk(KERN_ERR
1320                        "SELinux:  out of range capability %d\n", cap);
1321                 BUG();
1322         }
1323         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1324 }
1325
1326 /* Check whether a task is allowed to use a system operation. */
1327 static int task_has_system(struct task_struct *tsk,
1328                            u32 perms)
1329 {
1330         struct task_security_struct *tsec;
1331
1332         tsec = tsk->security;
1333
1334         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1335                             SECCLASS_SYSTEM, perms, NULL);
1336 }
1337
1338 /* Check whether a task has a particular permission to an inode.
1339    The 'adp' parameter is optional and allows other audit
1340    data to be passed (e.g. the dentry). */
1341 static int inode_has_perm(struct task_struct *tsk,
1342                           struct inode *inode,
1343                           u32 perms,
1344                           struct avc_audit_data *adp)
1345 {
1346         struct task_security_struct *tsec;
1347         struct inode_security_struct *isec;
1348         struct avc_audit_data ad;
1349
1350         if (unlikely (IS_PRIVATE (inode)))
1351                 return 0;
1352
1353         tsec = tsk->security;
1354         isec = inode->i_security;
1355
1356         if (!adp) {
1357                 adp = &ad;
1358                 AVC_AUDIT_DATA_INIT(&ad, FS);
1359                 ad.u.fs.inode = inode;
1360         }
1361
1362         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1363 }
1364
1365 /* Same as inode_has_perm, but pass explicit audit data containing
1366    the dentry to help the auditing code to more easily generate the
1367    pathname if needed. */
1368 static inline int dentry_has_perm(struct task_struct *tsk,
1369                                   struct vfsmount *mnt,
1370                                   struct dentry *dentry,
1371                                   u32 av)
1372 {
1373         struct inode *inode = dentry->d_inode;
1374         struct avc_audit_data ad;
1375         AVC_AUDIT_DATA_INIT(&ad,FS);
1376         ad.u.fs.path.mnt = mnt;
1377         ad.u.fs.path.dentry = dentry;
1378         return inode_has_perm(tsk, inode, av, &ad);
1379 }
1380
1381 /* Check whether a task can use an open file descriptor to
1382    access an inode in a given way.  Check access to the
1383    descriptor itself, and then use dentry_has_perm to
1384    check a particular permission to the file.
1385    Access to the descriptor is implicitly granted if it
1386    has the same SID as the process.  If av is zero, then
1387    access to the file is not checked, e.g. for cases
1388    where only the descriptor is affected like seek. */
1389 static int file_has_perm(struct task_struct *tsk,
1390                                 struct file *file,
1391                                 u32 av)
1392 {
1393         struct task_security_struct *tsec = tsk->security;
1394         struct file_security_struct *fsec = file->f_security;
1395         struct inode *inode = file->f_path.dentry->d_inode;
1396         struct avc_audit_data ad;
1397         int rc;
1398
1399         AVC_AUDIT_DATA_INIT(&ad, FS);
1400         ad.u.fs.path = file->f_path;
1401
1402         if (tsec->sid != fsec->sid) {
1403                 rc = avc_has_perm(tsec->sid, fsec->sid,
1404                                   SECCLASS_FD,
1405                                   FD__USE,
1406                                   &ad);
1407                 if (rc)
1408                         return rc;
1409         }
1410
1411         /* av is zero if only checking access to the descriptor. */
1412         if (av)
1413                 return inode_has_perm(tsk, inode, av, &ad);
1414
1415         return 0;
1416 }
1417
1418 /* Check whether a task can create a file. */
1419 static int may_create(struct inode *dir,
1420                       struct dentry *dentry,
1421                       u16 tclass)
1422 {
1423         struct task_security_struct *tsec;
1424         struct inode_security_struct *dsec;
1425         struct superblock_security_struct *sbsec;
1426         u32 newsid;
1427         struct avc_audit_data ad;
1428         int rc;
1429
1430         tsec = current->security;
1431         dsec = dir->i_security;
1432         sbsec = dir->i_sb->s_security;
1433
1434         AVC_AUDIT_DATA_INIT(&ad, FS);
1435         ad.u.fs.path.dentry = dentry;
1436
1437         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1438                           DIR__ADD_NAME | DIR__SEARCH,
1439                           &ad);
1440         if (rc)
1441                 return rc;
1442
1443         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1444                 newsid = tsec->create_sid;
1445         } else {
1446                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1447                                              &newsid);
1448                 if (rc)
1449                         return rc;
1450         }
1451
1452         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1453         if (rc)
1454                 return rc;
1455
1456         return avc_has_perm(newsid, sbsec->sid,
1457                             SECCLASS_FILESYSTEM,
1458                             FILESYSTEM__ASSOCIATE, &ad);
1459 }
1460
1461 /* Check whether a task can create a key. */
1462 static int may_create_key(u32 ksid,
1463                           struct task_struct *ctx)
1464 {
1465         struct task_security_struct *tsec;
1466
1467         tsec = ctx->security;
1468
1469         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1470 }
1471
1472 #define MAY_LINK   0
1473 #define MAY_UNLINK 1
1474 #define MAY_RMDIR  2
1475
1476 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1477 static int may_link(struct inode *dir,
1478                     struct dentry *dentry,
1479                     int kind)
1480
1481 {
1482         struct task_security_struct *tsec;
1483         struct inode_security_struct *dsec, *isec;
1484         struct avc_audit_data ad;
1485         u32 av;
1486         int rc;
1487
1488         tsec = current->security;
1489         dsec = dir->i_security;
1490         isec = dentry->d_inode->i_security;
1491
1492         AVC_AUDIT_DATA_INIT(&ad, FS);
1493         ad.u.fs.path.dentry = dentry;
1494
1495         av = DIR__SEARCH;
1496         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1497         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1498         if (rc)
1499                 return rc;
1500
1501         switch (kind) {
1502         case MAY_LINK:
1503                 av = FILE__LINK;
1504                 break;
1505         case MAY_UNLINK:
1506                 av = FILE__UNLINK;
1507                 break;
1508         case MAY_RMDIR:
1509                 av = DIR__RMDIR;
1510                 break;
1511         default:
1512                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1513                 return 0;
1514         }
1515
1516         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1517         return rc;
1518 }
1519
1520 static inline int may_rename(struct inode *old_dir,
1521                              struct dentry *old_dentry,
1522                              struct inode *new_dir,
1523                              struct dentry *new_dentry)
1524 {
1525         struct task_security_struct *tsec;
1526         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1527         struct avc_audit_data ad;
1528         u32 av;
1529         int old_is_dir, new_is_dir;
1530         int rc;
1531
1532         tsec = current->security;
1533         old_dsec = old_dir->i_security;
1534         old_isec = old_dentry->d_inode->i_security;
1535         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1536         new_dsec = new_dir->i_security;
1537
1538         AVC_AUDIT_DATA_INIT(&ad, FS);
1539
1540         ad.u.fs.path.dentry = old_dentry;
1541         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1542                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1543         if (rc)
1544                 return rc;
1545         rc = avc_has_perm(tsec->sid, old_isec->sid,
1546                           old_isec->sclass, FILE__RENAME, &ad);
1547         if (rc)
1548                 return rc;
1549         if (old_is_dir && new_dir != old_dir) {
1550                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1551                                   old_isec->sclass, DIR__REPARENT, &ad);
1552                 if (rc)
1553                         return rc;
1554         }
1555
1556         ad.u.fs.path.dentry = new_dentry;
1557         av = DIR__ADD_NAME | DIR__SEARCH;
1558         if (new_dentry->d_inode)
1559                 av |= DIR__REMOVE_NAME;
1560         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1561         if (rc)
1562                 return rc;
1563         if (new_dentry->d_inode) {
1564                 new_isec = new_dentry->d_inode->i_security;
1565                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1566                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1567                                   new_isec->sclass,
1568                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1569                 if (rc)
1570                         return rc;
1571         }
1572
1573         return 0;
1574 }
1575
1576 /* Check whether a task can perform a filesystem operation. */
1577 static int superblock_has_perm(struct task_struct *tsk,
1578                                struct super_block *sb,
1579                                u32 perms,
1580                                struct avc_audit_data *ad)
1581 {
1582         struct task_security_struct *tsec;
1583         struct superblock_security_struct *sbsec;
1584
1585         tsec = tsk->security;
1586         sbsec = sb->s_security;
1587         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1588                             perms, ad);
1589 }
1590
1591 /* Convert a Linux mode and permission mask to an access vector. */
1592 static inline u32 file_mask_to_av(int mode, int mask)
1593 {
1594         u32 av = 0;
1595
1596         if ((mode & S_IFMT) != S_IFDIR) {
1597                 if (mask & MAY_EXEC)
1598                         av |= FILE__EXECUTE;
1599                 if (mask & MAY_READ)
1600                         av |= FILE__READ;
1601
1602                 if (mask & MAY_APPEND)
1603                         av |= FILE__APPEND;
1604                 else if (mask & MAY_WRITE)
1605                         av |= FILE__WRITE;
1606
1607         } else {
1608                 if (mask & MAY_EXEC)
1609                         av |= DIR__SEARCH;
1610                 if (mask & MAY_WRITE)
1611                         av |= DIR__WRITE;
1612                 if (mask & MAY_READ)
1613                         av |= DIR__READ;
1614         }
1615
1616         return av;
1617 }
1618
1619 /* Convert a Linux file to an access vector. */
1620 static inline u32 file_to_av(struct file *file)
1621 {
1622         u32 av = 0;
1623
1624         if (file->f_mode & FMODE_READ)
1625                 av |= FILE__READ;
1626         if (file->f_mode & FMODE_WRITE) {
1627                 if (file->f_flags & O_APPEND)
1628                         av |= FILE__APPEND;
1629                 else
1630                         av |= FILE__WRITE;
1631         }
1632
1633         return av;
1634 }
1635
1636 /* Hook functions begin here. */
1637
1638 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1639 {
1640         struct task_security_struct *psec = parent->security;
1641         struct task_security_struct *csec = child->security;
1642         int rc;
1643
1644         rc = secondary_ops->ptrace(parent,child);
1645         if (rc)
1646                 return rc;
1647
1648         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1649         /* Save the SID of the tracing process for later use in apply_creds. */
1650         if (!(child->ptrace & PT_PTRACED) && !rc)
1651                 csec->ptrace_sid = psec->sid;
1652         return rc;
1653 }
1654
1655 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1656                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1657 {
1658         int error;
1659
1660         error = task_has_perm(current, target, PROCESS__GETCAP);
1661         if (error)
1662                 return error;
1663
1664         return secondary_ops->capget(target, effective, inheritable, permitted);
1665 }
1666
1667 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1668                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1669 {
1670         int error;
1671
1672         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1673         if (error)
1674                 return error;
1675
1676         return task_has_perm(current, target, PROCESS__SETCAP);
1677 }
1678
1679 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1680                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1681 {
1682         secondary_ops->capset_set(target, effective, inheritable, permitted);
1683 }
1684
1685 static int selinux_capable(struct task_struct *tsk, int cap)
1686 {
1687         int rc;
1688
1689         rc = secondary_ops->capable(tsk, cap);
1690         if (rc)
1691                 return rc;
1692
1693         return task_has_capability(tsk,cap);
1694 }
1695
1696 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1697 {
1698         int buflen, rc;
1699         char *buffer, *path, *end;
1700
1701         rc = -ENOMEM;
1702         buffer = (char*)__get_free_page(GFP_KERNEL);
1703         if (!buffer)
1704                 goto out;
1705
1706         buflen = PAGE_SIZE;
1707         end = buffer+buflen;
1708         *--end = '\0';
1709         buflen--;
1710         path = end-1;
1711         *path = '/';
1712         while (table) {
1713                 const char *name = table->procname;
1714                 size_t namelen = strlen(name);
1715                 buflen -= namelen + 1;
1716                 if (buflen < 0)
1717                         goto out_free;
1718                 end -= namelen;
1719                 memcpy(end, name, namelen);
1720                 *--end = '/';
1721                 path = end;
1722                 table = table->parent;
1723         }
1724         buflen -= 4;
1725         if (buflen < 0)
1726                 goto out_free;
1727         end -= 4;
1728         memcpy(end, "/sys", 4);
1729         path = end;
1730         rc = security_genfs_sid("proc", path, tclass, sid);
1731 out_free:
1732         free_page((unsigned long)buffer);
1733 out:
1734         return rc;
1735 }
1736
1737 static int selinux_sysctl(ctl_table *table, int op)
1738 {
1739         int error = 0;
1740         u32 av;
1741         struct task_security_struct *tsec;
1742         u32 tsid;
1743         int rc;
1744
1745         rc = secondary_ops->sysctl(table, op);
1746         if (rc)
1747                 return rc;
1748
1749         tsec = current->security;
1750
1751         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1752                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1753         if (rc) {
1754                 /* Default to the well-defined sysctl SID. */
1755                 tsid = SECINITSID_SYSCTL;
1756         }
1757
1758         /* The op values are "defined" in sysctl.c, thereby creating
1759          * a bad coupling between this module and sysctl.c */
1760         if(op == 001) {
1761                 error = avc_has_perm(tsec->sid, tsid,
1762                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1763         } else {
1764                 av = 0;
1765                 if (op & 004)
1766                         av |= FILE__READ;
1767                 if (op & 002)
1768                         av |= FILE__WRITE;
1769                 if (av)
1770                         error = avc_has_perm(tsec->sid, tsid,
1771                                              SECCLASS_FILE, av, NULL);
1772         }
1773
1774         return error;
1775 }
1776
1777 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1778 {
1779         int rc = 0;
1780
1781         if (!sb)
1782                 return 0;
1783
1784         switch (cmds) {
1785                 case Q_SYNC:
1786                 case Q_QUOTAON:
1787                 case Q_QUOTAOFF:
1788                 case Q_SETINFO:
1789                 case Q_SETQUOTA:
1790                         rc = superblock_has_perm(current,
1791                                                  sb,
1792                                                  FILESYSTEM__QUOTAMOD, NULL);
1793                         break;
1794                 case Q_GETFMT:
1795                 case Q_GETINFO:
1796                 case Q_GETQUOTA:
1797                         rc = superblock_has_perm(current,
1798                                                  sb,
1799                                                  FILESYSTEM__QUOTAGET, NULL);
1800                         break;
1801                 default:
1802                         rc = 0;  /* let the kernel handle invalid cmds */
1803                         break;
1804         }
1805         return rc;
1806 }
1807
1808 static int selinux_quota_on(struct dentry *dentry)
1809 {
1810         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1811 }
1812
1813 static int selinux_syslog(int type)
1814 {
1815         int rc;
1816
1817         rc = secondary_ops->syslog(type);
1818         if (rc)
1819                 return rc;
1820
1821         switch (type) {
1822                 case 3:         /* Read last kernel messages */
1823                 case 10:        /* Return size of the log buffer */
1824                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1825                         break;
1826                 case 6:         /* Disable logging to console */
1827                 case 7:         /* Enable logging to console */
1828                 case 8:         /* Set level of messages printed to console */
1829                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1830                         break;
1831                 case 0:         /* Close log */
1832                 case 1:         /* Open log */
1833                 case 2:         /* Read from log */
1834                 case 4:         /* Read/clear last kernel messages */
1835                 case 5:         /* Clear ring buffer */
1836                 default:
1837                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1838                         break;
1839         }
1840         return rc;
1841 }
1842
1843 /*
1844  * Check that a process has enough memory to allocate a new virtual
1845  * mapping. 0 means there is enough memory for the allocation to
1846  * succeed and -ENOMEM implies there is not.
1847  *
1848  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1849  * if the capability is granted, but __vm_enough_memory requires 1 if
1850  * the capability is granted.
1851  *
1852  * Do not audit the selinux permission check, as this is applied to all
1853  * processes that allocate mappings.
1854  */
1855 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1856 {
1857         int rc, cap_sys_admin = 0;
1858         struct task_security_struct *tsec = current->security;
1859
1860         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1861         if (rc == 0)
1862                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1863                                           SECCLASS_CAPABILITY,
1864                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1865                                           0,
1866                                           NULL);
1867
1868         if (rc == 0)
1869                 cap_sys_admin = 1;
1870
1871         return __vm_enough_memory(mm, pages, cap_sys_admin);
1872 }
1873
1874 /* binprm security operations */
1875
1876 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1877 {
1878         struct bprm_security_struct *bsec;
1879
1880         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1881         if (!bsec)
1882                 return -ENOMEM;
1883
1884         bsec->bprm = bprm;
1885         bsec->sid = SECINITSID_UNLABELED;
1886         bsec->set = 0;
1887
1888         bprm->security = bsec;
1889         return 0;
1890 }
1891
1892 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1893 {
1894         struct task_security_struct *tsec;
1895         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1896         struct inode_security_struct *isec;
1897         struct bprm_security_struct *bsec;
1898         u32 newsid;
1899         struct avc_audit_data ad;
1900         int rc;
1901
1902         rc = secondary_ops->bprm_set_security(bprm);
1903         if (rc)
1904                 return rc;
1905
1906         bsec = bprm->security;
1907
1908         if (bsec->set)
1909                 return 0;
1910
1911         tsec = current->security;
1912         isec = inode->i_security;
1913
1914         /* Default to the current task SID. */
1915         bsec->sid = tsec->sid;
1916
1917         /* Reset fs, key, and sock SIDs on execve. */
1918         tsec->create_sid = 0;
1919         tsec->keycreate_sid = 0;
1920         tsec->sockcreate_sid = 0;
1921
1922         if (tsec->exec_sid) {
1923                 newsid = tsec->exec_sid;
1924                 /* Reset exec SID on execve. */
1925                 tsec->exec_sid = 0;
1926         } else {
1927                 /* Check for a default transition on this program. */
1928                 rc = security_transition_sid(tsec->sid, isec->sid,
1929                                              SECCLASS_PROCESS, &newsid);
1930                 if (rc)
1931                         return rc;
1932         }
1933
1934         AVC_AUDIT_DATA_INIT(&ad, FS);
1935         ad.u.fs.path = bprm->file->f_path;
1936
1937         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1938                 newsid = tsec->sid;
1939
1940         if (tsec->sid == newsid) {
1941                 rc = avc_has_perm(tsec->sid, isec->sid,
1942                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1943                 if (rc)
1944                         return rc;
1945         } else {
1946                 /* Check permissions for the transition. */
1947                 rc = avc_has_perm(tsec->sid, newsid,
1948                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1949                 if (rc)
1950                         return rc;
1951
1952                 rc = avc_has_perm(newsid, isec->sid,
1953                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1954                 if (rc)
1955                         return rc;
1956
1957                 /* Clear any possibly unsafe personality bits on exec: */
1958                 current->personality &= ~PER_CLEAR_ON_SETID;
1959
1960                 /* Set the security field to the new SID. */
1961                 bsec->sid = newsid;
1962         }
1963
1964         bsec->set = 1;
1965         return 0;
1966 }
1967
1968 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1969 {
1970         return secondary_ops->bprm_check_security(bprm);
1971 }
1972
1973
1974 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1975 {
1976         struct task_security_struct *tsec = current->security;
1977         int atsecure = 0;
1978
1979         if (tsec->osid != tsec->sid) {
1980                 /* Enable secure mode for SIDs transitions unless
1981                    the noatsecure permission is granted between
1982                    the two SIDs, i.e. ahp returns 0. */
1983                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1984                                          SECCLASS_PROCESS,
1985                                          PROCESS__NOATSECURE, NULL);
1986         }
1987
1988         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1989 }
1990
1991 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1992 {
1993         kfree(bprm->security);
1994         bprm->security = NULL;
1995 }
1996
1997 extern struct vfsmount *selinuxfs_mount;
1998 extern struct dentry *selinux_null;
1999
2000 /* Derived from fs/exec.c:flush_old_files. */
2001 static inline void flush_unauthorized_files(struct files_struct * files)
2002 {
2003         struct avc_audit_data ad;
2004         struct file *file, *devnull = NULL;
2005         struct tty_struct *tty;
2006         struct fdtable *fdt;
2007         long j = -1;
2008         int drop_tty = 0;
2009
2010         mutex_lock(&tty_mutex);
2011         tty = get_current_tty();
2012         if (tty) {
2013                 file_list_lock();
2014                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2015                 if (file) {
2016                         /* Revalidate access to controlling tty.
2017                            Use inode_has_perm on the tty inode directly rather
2018                            than using file_has_perm, as this particular open
2019                            file may belong to another process and we are only
2020                            interested in the inode-based check here. */
2021                         struct inode *inode = file->f_path.dentry->d_inode;
2022                         if (inode_has_perm(current, inode,
2023                                            FILE__READ | FILE__WRITE, NULL)) {
2024                                 drop_tty = 1;
2025                         }
2026                 }
2027                 file_list_unlock();
2028         }
2029         mutex_unlock(&tty_mutex);
2030         /* Reset controlling tty. */
2031         if (drop_tty)
2032                 no_tty();
2033
2034         /* Revalidate access to inherited open files. */
2035
2036         AVC_AUDIT_DATA_INIT(&ad,FS);
2037
2038         spin_lock(&files->file_lock);
2039         for (;;) {
2040                 unsigned long set, i;
2041                 int fd;
2042
2043                 j++;
2044                 i = j * __NFDBITS;
2045                 fdt = files_fdtable(files);
2046                 if (i >= fdt->max_fds)
2047                         break;
2048                 set = fdt->open_fds->fds_bits[j];
2049                 if (!set)
2050                         continue;
2051                 spin_unlock(&files->file_lock);
2052                 for ( ; set ; i++,set >>= 1) {
2053                         if (set & 1) {
2054                                 file = fget(i);
2055                                 if (!file)
2056                                         continue;
2057                                 if (file_has_perm(current,
2058                                                   file,
2059                                                   file_to_av(file))) {
2060                                         sys_close(i);
2061                                         fd = get_unused_fd();
2062                                         if (fd != i) {
2063                                                 if (fd >= 0)
2064                                                         put_unused_fd(fd);
2065                                                 fput(file);
2066                                                 continue;
2067                                         }
2068                                         if (devnull) {
2069                                                 get_file(devnull);
2070                                         } else {
2071                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2072                                                 if (IS_ERR(devnull)) {
2073                                                         devnull = NULL;
2074                                                         put_unused_fd(fd);
2075                                                         fput(file);
2076                                                         continue;
2077                                                 }
2078                                         }
2079                                         fd_install(fd, devnull);
2080                                 }
2081                                 fput(file);
2082                         }
2083                 }
2084                 spin_lock(&files->file_lock);
2085
2086         }
2087         spin_unlock(&files->file_lock);
2088 }
2089
2090 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2091 {
2092         struct task_security_struct *tsec;
2093         struct bprm_security_struct *bsec;
2094         u32 sid;
2095         int rc;
2096
2097         secondary_ops->bprm_apply_creds(bprm, unsafe);
2098
2099         tsec = current->security;
2100
2101         bsec = bprm->security;
2102         sid = bsec->sid;
2103
2104         tsec->osid = tsec->sid;
2105         bsec->unsafe = 0;
2106         if (tsec->sid != sid) {
2107                 /* Check for shared state.  If not ok, leave SID
2108                    unchanged and kill. */
2109                 if (unsafe & LSM_UNSAFE_SHARE) {
2110                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2111                                         PROCESS__SHARE, NULL);
2112                         if (rc) {
2113                                 bsec->unsafe = 1;
2114                                 return;
2115                         }
2116                 }
2117
2118                 /* Check for ptracing, and update the task SID if ok.
2119                    Otherwise, leave SID unchanged and kill. */
2120                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2121                         rc = avc_has_perm(tsec->ptrace_sid, sid,
2122                                           SECCLASS_PROCESS, PROCESS__PTRACE,
2123                                           NULL);
2124                         if (rc) {
2125                                 bsec->unsafe = 1;
2126                                 return;
2127                         }
2128                 }
2129                 tsec->sid = sid;
2130         }
2131 }
2132
2133 /*
2134  * called after apply_creds without the task lock held
2135  */
2136 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2137 {
2138         struct task_security_struct *tsec;
2139         struct rlimit *rlim, *initrlim;
2140         struct itimerval itimer;
2141         struct bprm_security_struct *bsec;
2142         int rc, i;
2143
2144         tsec = current->security;
2145         bsec = bprm->security;
2146
2147         if (bsec->unsafe) {
2148                 force_sig_specific(SIGKILL, current);
2149                 return;
2150         }
2151         if (tsec->osid == tsec->sid)
2152                 return;
2153
2154         /* Close files for which the new task SID is not authorized. */
2155         flush_unauthorized_files(current->files);
2156
2157         /* Check whether the new SID can inherit signal state
2158            from the old SID.  If not, clear itimers to avoid
2159            subsequent signal generation and flush and unblock
2160            signals. This must occur _after_ the task SID has
2161           been updated so that any kill done after the flush
2162           will be checked against the new SID. */
2163         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2164                           PROCESS__SIGINH, NULL);
2165         if (rc) {
2166                 memset(&itimer, 0, sizeof itimer);
2167                 for (i = 0; i < 3; i++)
2168                         do_setitimer(i, &itimer, NULL);
2169                 flush_signals(current);
2170                 spin_lock_irq(&current->sighand->siglock);
2171                 flush_signal_handlers(current, 1);
2172                 sigemptyset(&current->blocked);
2173                 recalc_sigpending();
2174                 spin_unlock_irq(&current->sighand->siglock);
2175         }
2176
2177         /* Always clear parent death signal on SID transitions. */
2178         current->pdeath_signal = 0;
2179
2180         /* Check whether the new SID can inherit resource limits
2181            from the old SID.  If not, reset all soft limits to
2182            the lower of the current task's hard limit and the init
2183            task's soft limit.  Note that the setting of hard limits
2184            (even to lower them) can be controlled by the setrlimit
2185            check. The inclusion of the init task's soft limit into
2186            the computation is to avoid resetting soft limits higher
2187            than the default soft limit for cases where the default
2188            is lower than the hard limit, e.g. RLIMIT_CORE or
2189            RLIMIT_STACK.*/
2190         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2191                           PROCESS__RLIMITINH, NULL);
2192         if (rc) {
2193                 for (i = 0; i < RLIM_NLIMITS; i++) {
2194                         rlim = current->signal->rlim + i;
2195                         initrlim = init_task.signal->rlim+i;
2196                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2197                 }
2198                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2199                         /*
2200                          * This will cause RLIMIT_CPU calculations
2201                          * to be refigured.
2202                          */
2203                         current->it_prof_expires = jiffies_to_cputime(1);
2204                 }
2205         }
2206
2207         /* Wake up the parent if it is waiting so that it can
2208            recheck wait permission to the new task SID. */
2209         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2210 }
2211
2212 /* superblock security operations */
2213
2214 static int selinux_sb_alloc_security(struct super_block *sb)
2215 {
2216         return superblock_alloc_security(sb);
2217 }
2218
2219 static void selinux_sb_free_security(struct super_block *sb)
2220 {
2221         superblock_free_security(sb);
2222 }
2223
2224 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2225 {
2226         if (plen > olen)
2227                 return 0;
2228
2229         return !memcmp(prefix, option, plen);
2230 }
2231
2232 static inline int selinux_option(char *option, int len)
2233 {
2234         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2235                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2236                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2237                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2238 }
2239
2240 static inline void take_option(char **to, char *from, int *first, int len)
2241 {
2242         if (!*first) {
2243                 **to = ',';
2244                 *to += 1;
2245         } else
2246                 *first = 0;
2247         memcpy(*to, from, len);
2248         *to += len;
2249 }
2250
2251 static inline void take_selinux_option(char **to, char *from, int *first,
2252                                        int len)
2253 {
2254         int current_size = 0;
2255
2256         if (!*first) {
2257                 **to = '|';
2258                 *to += 1;
2259         }
2260         else
2261                 *first = 0;
2262
2263         while (current_size < len) {
2264                 if (*from != '"') {
2265                         **to = *from;
2266                         *to += 1;
2267                 }
2268                 from += 1;
2269                 current_size += 1;
2270         }
2271 }
2272
2273 static int selinux_sb_copy_data(char *orig, char *copy)
2274 {
2275         int fnosec, fsec, rc = 0;
2276         char *in_save, *in_curr, *in_end;
2277         char *sec_curr, *nosec_save, *nosec;
2278         int open_quote = 0;
2279
2280         in_curr = orig;
2281         sec_curr = copy;
2282
2283         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2284         if (!nosec) {
2285                 rc = -ENOMEM;
2286                 goto out;
2287         }
2288
2289         nosec_save = nosec;
2290         fnosec = fsec = 1;
2291         in_save = in_end = orig;
2292
2293         do {
2294                 if (*in_end == '"')
2295                         open_quote = !open_quote;
2296                 if ((*in_end == ',' && open_quote == 0) ||
2297                                 *in_end == '\0') {
2298                         int len = in_end - in_curr;
2299
2300                         if (selinux_option(in_curr, len))
2301                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2302                         else
2303                                 take_option(&nosec, in_curr, &fnosec, len);
2304
2305                         in_curr = in_end + 1;
2306                 }
2307         } while (*in_end++);
2308
2309         strcpy(in_save, nosec_save);
2310         free_page((unsigned long)nosec_save);
2311 out:
2312         return rc;
2313 }
2314
2315 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2316 {
2317         struct avc_audit_data ad;
2318         int rc;
2319
2320         rc = superblock_doinit(sb, data);
2321         if (rc)
2322                 return rc;
2323
2324         AVC_AUDIT_DATA_INIT(&ad,FS);
2325         ad.u.fs.path.dentry = sb->s_root;
2326         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2327 }
2328
2329 static int selinux_sb_statfs(struct dentry *dentry)
2330 {
2331         struct avc_audit_data ad;
2332
2333         AVC_AUDIT_DATA_INIT(&ad,FS);
2334         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2335         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2336 }
2337
2338 static int selinux_mount(char * dev_name,
2339                          struct nameidata *nd,
2340                          char * type,
2341                          unsigned long flags,
2342                          void * data)
2343 {
2344         int rc;
2345
2346         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2347         if (rc)
2348                 return rc;
2349
2350         if (flags & MS_REMOUNT)
2351                 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2352                                            FILESYSTEM__REMOUNT, NULL);
2353         else
2354                 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2355                                        FILE__MOUNTON);
2356 }
2357
2358 static int selinux_umount(struct vfsmount *mnt, int flags)
2359 {
2360         int rc;
2361
2362         rc = secondary_ops->sb_umount(mnt, flags);
2363         if (rc)
2364                 return rc;
2365
2366         return superblock_has_perm(current,mnt->mnt_sb,
2367                                    FILESYSTEM__UNMOUNT,NULL);
2368 }
2369
2370 /* inode security operations */
2371
2372 static int selinux_inode_alloc_security(struct inode *inode)
2373 {
2374         return inode_alloc_security(inode);
2375 }
2376
2377 static void selinux_inode_free_security(struct inode *inode)
2378 {
2379         inode_free_security(inode);
2380 }
2381
2382 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2383                                        char **name, void **value,
2384                                        size_t *len)
2385 {
2386         struct task_security_struct *tsec;
2387         struct inode_security_struct *dsec;
2388         struct superblock_security_struct *sbsec;
2389         u32 newsid, clen;
2390         int rc;
2391         char *namep = NULL, *context;
2392
2393         tsec = current->security;
2394         dsec = dir->i_security;
2395         sbsec = dir->i_sb->s_security;
2396
2397         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2398                 newsid = tsec->create_sid;
2399         } else {
2400                 rc = security_transition_sid(tsec->sid, dsec->sid,
2401                                              inode_mode_to_security_class(inode->i_mode),
2402                                              &newsid);
2403                 if (rc) {
2404                         printk(KERN_WARNING "%s:  "
2405                                "security_transition_sid failed, rc=%d (dev=%s "
2406                                "ino=%ld)\n",
2407                                __FUNCTION__,
2408                                -rc, inode->i_sb->s_id, inode->i_ino);
2409                         return rc;
2410                 }
2411         }
2412
2413         /* Possibly defer initialization to selinux_complete_init. */
2414         if (sbsec->initialized) {
2415                 struct inode_security_struct *isec = inode->i_security;
2416                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2417                 isec->sid = newsid;
2418                 isec->initialized = 1;
2419         }
2420
2421         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2422                 return -EOPNOTSUPP;
2423
2424         if (name) {
2425                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2426                 if (!namep)
2427                         return -ENOMEM;
2428                 *name = namep;
2429         }
2430
2431         if (value && len) {
2432                 rc = security_sid_to_context(newsid, &context, &clen);
2433                 if (rc) {
2434                         kfree(namep);
2435                         return rc;
2436                 }
2437                 *value = context;
2438                 *len = clen;
2439         }
2440
2441         return 0;
2442 }
2443
2444 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2445 {
2446         return may_create(dir, dentry, SECCLASS_FILE);
2447 }
2448
2449 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2450 {
2451         int rc;
2452
2453         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2454         if (rc)
2455                 return rc;
2456         return may_link(dir, old_dentry, MAY_LINK);
2457 }
2458
2459 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2460 {
2461         int rc;
2462
2463         rc = secondary_ops->inode_unlink(dir, dentry);
2464         if (rc)
2465                 return rc;
2466         return may_link(dir, dentry, MAY_UNLINK);
2467 }
2468
2469 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2470 {
2471         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2472 }
2473
2474 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2475 {
2476         return may_create(dir, dentry, SECCLASS_DIR);
2477 }
2478
2479 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2480 {
2481         return may_link(dir, dentry, MAY_RMDIR);
2482 }
2483
2484 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2485 {
2486         int rc;
2487
2488         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2489         if (rc)
2490                 return rc;
2491
2492         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2493 }
2494
2495 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2496                                 struct inode *new_inode, struct dentry *new_dentry)
2497 {
2498         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2499 }
2500
2501 static int selinux_inode_readlink(struct dentry *dentry)
2502 {
2503         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2504 }
2505
2506 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2507 {
2508         int rc;
2509
2510         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2511         if (rc)
2512                 return rc;
2513         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2514 }
2515
2516 static int selinux_inode_permission(struct inode *inode, int mask,
2517                                     struct nameidata *nd)
2518 {
2519         int rc;
2520
2521         rc = secondary_ops->inode_permission(inode, mask, nd);
2522         if (rc)
2523                 return rc;
2524
2525         if (!mask) {
2526                 /* No permission to check.  Existence test. */
2527                 return 0;
2528         }
2529
2530         return inode_has_perm(current, inode,
2531                                file_mask_to_av(inode->i_mode, mask), NULL);
2532 }
2533
2534 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2535 {
2536         int rc;
2537
2538         rc = secondary_ops->inode_setattr(dentry, iattr);
2539         if (rc)
2540                 return rc;
2541
2542         if (iattr->ia_valid & ATTR_FORCE)
2543                 return 0;
2544
2545         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2546                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2547                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2548
2549         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2550 }
2551
2552 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2553 {
2554         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2555 }
2556
2557 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2558 {
2559         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2560                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2561                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2562                         if (!capable(CAP_SETFCAP))
2563                                 return -EPERM;
2564                 } else if (!capable(CAP_SYS_ADMIN)) {
2565                         /* A different attribute in the security namespace.
2566                            Restrict to administrator. */
2567                         return -EPERM;
2568                 }
2569         }
2570
2571         /* Not an attribute we recognize, so just check the
2572            ordinary setattr permission. */
2573         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2574 }
2575
2576 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2577 {
2578         struct task_security_struct *tsec = current->security;
2579         struct inode *inode = dentry->d_inode;
2580         struct inode_security_struct *isec = inode->i_security;
2581         struct superblock_security_struct *sbsec;
2582         struct avc_audit_data ad;
2583         u32 newsid;
2584         int rc = 0;
2585
2586         if (strcmp(name, XATTR_NAME_SELINUX))
2587                 return selinux_inode_setotherxattr(dentry, name);
2588
2589         sbsec = inode->i_sb->s_security;
2590         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2591                 return -EOPNOTSUPP;
2592
2593         if (!is_owner_or_cap(inode))
2594                 return -EPERM;
2595
2596         AVC_AUDIT_DATA_INIT(&ad,FS);
2597         ad.u.fs.path.dentry = dentry;
2598
2599         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2600                           FILE__RELABELFROM, &ad);
2601         if (rc)
2602                 return rc;
2603
2604         rc = security_context_to_sid(value, size, &newsid);
2605         if (rc)
2606                 return rc;
2607
2608         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2609                           FILE__RELABELTO, &ad);
2610         if (rc)
2611                 return rc;
2612
2613         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2614                                           isec->sclass);
2615         if (rc)
2616                 return rc;
2617
2618         return avc_has_perm(newsid,
2619                             sbsec->sid,
2620                             SECCLASS_FILESYSTEM,
2621                             FILESYSTEM__ASSOCIATE,
2622                             &ad);
2623 }
2624
2625 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2626                                         void *value, size_t size, int flags)
2627 {
2628         struct inode *inode = dentry->d_inode;
2629         struct inode_security_struct *isec = inode->i_security;
2630         u32 newsid;
2631         int rc;
2632
2633         if (strcmp(name, XATTR_NAME_SELINUX)) {
2634                 /* Not an attribute we recognize, so nothing to do. */
2635                 return;
2636         }
2637
2638         rc = security_context_to_sid(value, size, &newsid);
2639         if (rc) {
2640                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2641                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2642                 return;
2643         }
2644
2645         isec->sid = newsid;
2646         return;
2647 }
2648
2649 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2650 {
2651         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2652 }
2653
2654 static int selinux_inode_listxattr (struct dentry *dentry)
2655 {
2656         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2657 }
2658
2659 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2660 {
2661         if (strcmp(name, XATTR_NAME_SELINUX))
2662                 return selinux_inode_setotherxattr(dentry, name);
2663
2664         /* No one is allowed to remove a SELinux security label.
2665            You can change the label, but all data must be labeled. */
2666         return -EACCES;
2667 }
2668
2669 /*
2670  * Copy the in-core inode security context value to the user.  If the
2671  * getxattr() prior to this succeeded, check to see if we need to
2672  * canonicalize the value to be finally returned to the user.
2673  *
2674  * Permission check is handled by selinux_inode_getxattr hook.
2675  */
2676 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2677 {
2678         u32 size;
2679         int error;
2680         char *context = NULL;
2681         struct inode_security_struct *isec = inode->i_security;
2682
2683         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2684                 return -EOPNOTSUPP;
2685
2686         error = security_sid_to_context(isec->sid, &context, &size);
2687         if (error)
2688                 return error;
2689         error = size;
2690         if (alloc) {
2691                 *buffer = context;
2692                 goto out_nofree;
2693         }
2694         kfree(context);
2695 out_nofree:
2696         return error;
2697 }
2698
2699 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2700                                      const void *value, size_t size, int flags)
2701 {
2702         struct inode_security_struct *isec = inode->i_security;
2703         u32 newsid;
2704         int rc;
2705
2706         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2707                 return -EOPNOTSUPP;
2708
2709         if (!value || !size)
2710                 return -EACCES;
2711
2712         rc = security_context_to_sid((void*)value, size, &newsid);
2713         if (rc)
2714                 return rc;
2715
2716         isec->sid = newsid;
2717         return 0;
2718 }
2719
2720 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2721 {
2722         const int len = sizeof(XATTR_NAME_SELINUX);
2723         if (buffer && len <= buffer_size)
2724                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2725         return len;
2726 }
2727
2728 static int selinux_inode_need_killpriv(struct dentry *dentry)
2729 {
2730         return secondary_ops->inode_need_killpriv(dentry);
2731 }
2732
2733 static int selinux_inode_killpriv(struct dentry *dentry)
2734 {
2735         return secondary_ops->inode_killpriv(dentry);
2736 }
2737
2738 /* file security operations */
2739
2740 static int selinux_revalidate_file_permission(struct file *file, int mask)
2741 {
2742         int rc;
2743         struct inode *inode = file->f_path.dentry->d_inode;
2744
2745         if (!mask) {
2746                 /* No permission to check.  Existence test. */
2747                 return 0;
2748         }
2749
2750         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2751         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2752                 mask |= MAY_APPEND;
2753
2754         rc = file_has_perm(current, file,
2755                            file_mask_to_av(inode->i_mode, mask));
2756         if (rc)
2757                 return rc;
2758
2759         return selinux_netlbl_inode_permission(inode, mask);
2760 }
2761
2762 static int selinux_file_permission(struct file *file, int mask)
2763 {
2764         struct inode *inode = file->f_path.dentry->d_inode;
2765         struct task_security_struct *tsec = current->security;
2766         struct file_security_struct *fsec = file->f_security;
2767         struct inode_security_struct *isec = inode->i_security;
2768
2769         if (!mask) {
2770                 /* No permission to check.  Existence test. */
2771                 return 0;
2772         }
2773
2774         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2775             && fsec->pseqno == avc_policy_seqno())
2776                 return selinux_netlbl_inode_permission(inode, mask);
2777
2778         return selinux_revalidate_file_permission(file, mask);
2779 }
2780
2781 static int selinux_file_alloc_security(struct file *file)
2782 {
2783         return file_alloc_security(file);
2784 }
2785
2786 static void selinux_file_free_security(struct file *file)
2787 {
2788         file_free_security(file);
2789 }
2790
2791 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2792                               unsigned long arg)
2793 {
2794         int error = 0;
2795
2796         switch (cmd) {
2797                 case FIONREAD:
2798                 /* fall through */
2799                 case FIBMAP:
2800                 /* fall through */
2801                 case FIGETBSZ:
2802                 /* fall through */
2803                 case EXT2_IOC_GETFLAGS:
2804                 /* fall through */
2805                 case EXT2_IOC_GETVERSION:
2806                         error = file_has_perm(current, file, FILE__GETATTR);
2807                         break;
2808
2809                 case EXT2_IOC_SETFLAGS:
2810                 /* fall through */
2811                 case EXT2_IOC_SETVERSION:
2812                         error = file_has_perm(current, file, FILE__SETATTR);
2813                         break;
2814
2815                 /* sys_ioctl() checks */
2816                 case FIONBIO:
2817                 /* fall through */
2818                 case FIOASYNC:
2819                         error = file_has_perm(current, file, 0);
2820                         break;
2821
2822                 case KDSKBENT:
2823                 case KDSKBSENT:
2824                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2825                         break;
2826
2827                 /* default case assumes that the command will go
2828                  * to the file's ioctl() function.
2829                  */
2830                 default:
2831                         error = file_has_perm(current, file, FILE__IOCTL);
2832
2833         }
2834         return error;
2835 }
2836
2837 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2838 {
2839 #ifndef CONFIG_PPC32
2840         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2841                 /*
2842                  * We are making executable an anonymous mapping or a
2843                  * private file mapping that will also be writable.
2844                  * This has an additional check.
2845                  */
2846                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2847                 if (rc)
2848                         return rc;
2849         }
2850 #endif
2851
2852         if (file) {
2853                 /* read access is always possible with a mapping */
2854                 u32 av = FILE__READ;
2855
2856                 /* write access only matters if the mapping is shared */
2857                 if (shared && (prot & PROT_WRITE))
2858                         av |= FILE__WRITE;
2859
2860                 if (prot & PROT_EXEC)
2861                         av |= FILE__EXECUTE;
2862
2863                 return file_has_perm(current, file, av);
2864         }
2865         return 0;
2866 }
2867
2868 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2869                              unsigned long prot, unsigned long flags,
2870                              unsigned long addr, unsigned long addr_only)
2871 {
2872         int rc = 0;
2873         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2874
2875         if (addr < mmap_min_addr)
2876                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2877                                   MEMPROTECT__MMAP_ZERO, NULL);
2878         if (rc || addr_only)
2879                 return rc;
2880
2881         if (selinux_checkreqprot)
2882                 prot = reqprot;
2883
2884         return file_map_prot_check(file, prot,
2885                                    (flags & MAP_TYPE) == MAP_SHARED);
2886 }
2887
2888 static int selinux_file_mprotect(struct vm_area_struct *vma,
2889                                  unsigned long reqprot,
2890                                  unsigned long prot)
2891 {
2892         int rc;
2893
2894         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2895         if (rc)
2896                 return rc;
2897
2898         if (selinux_checkreqprot)
2899                 prot = reqprot;
2900
2901 #ifndef CONFIG_PPC32
2902         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2903                 rc = 0;
2904                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2905                     vma->vm_end <= vma->vm_mm->brk) {
2906                         rc = task_has_perm(current, current,
2907                                            PROCESS__EXECHEAP);
2908                 } else if (!vma->vm_file &&
2909                            vma->vm_start <= vma->vm_mm->start_stack &&
2910                            vma->vm_end >= vma->vm_mm->start_stack) {
2911                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2912                 } else if (vma->vm_file && vma->anon_vma) {
2913                         /*
2914                          * We are making executable a file mapping that has
2915                          * had some COW done. Since pages might have been
2916                          * written, check ability to execute the possibly
2917                          * modified content.  This typically should only
2918                          * occur for text relocations.
2919                          */
2920                         rc = file_has_perm(current, vma->vm_file,
2921                                            FILE__EXECMOD);
2922                 }
2923                 if (rc)
2924                         return rc;
2925         }
2926 #endif
2927
2928         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2929 }
2930
2931 static int selinux_file_lock(struct file *file, unsigned int cmd)
2932 {
2933         return file_has_perm(current, file, FILE__LOCK);
2934 }
2935
2936 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2937                               unsigned long arg)
2938 {
2939         int err = 0;
2940
2941         switch (cmd) {
2942                 case F_SETFL:
2943                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2944                                 err = -EINVAL;
2945                                 break;
2946                         }
2947
2948                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2949                                 err = file_has_perm(current, file,FILE__WRITE);
2950                                 break;
2951                         }
2952                         /* fall through */
2953                 case F_SETOWN:
2954                 case F_SETSIG:
2955                 case F_GETFL:
2956                 case F_GETOWN:
2957                 case F_GETSIG:
2958                         /* Just check FD__USE permission */
2959                         err = file_has_perm(current, file, 0);
2960                         break;
2961                 case F_GETLK:
2962                 case F_SETLK:
2963                 case F_SETLKW:
2964 #if BITS_PER_LONG == 32
2965                 case F_GETLK64:
2966                 case F_SETLK64:
2967                 case F_SETLKW64:
2968 #endif
2969                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2970                                 err = -EINVAL;
2971                                 break;
2972                         }
2973                         err = file_has_perm(current, file, FILE__LOCK);
2974                         break;
2975         }
2976
2977         return err;
2978 }
2979
2980 static int selinux_file_set_fowner(struct file *file)
2981 {
2982         struct task_security_struct *tsec;
2983         struct file_security_struct *fsec;
2984
2985         tsec = current->security;
2986         fsec = file->f_security;
2987         fsec->fown_sid = tsec->sid;
2988
2989         return 0;
2990 }
2991
2992 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2993                                        struct fown_struct *fown, int signum)
2994 {
2995         struct file *file;
2996         u32 perm;
2997         struct task_security_struct *tsec;
2998         struct file_security_struct *fsec;
2999
3000         /* struct fown_struct is never outside the context of a struct file */
3001         file = container_of(fown, struct file, f_owner);
3002
3003         tsec = tsk->security;
3004         fsec = file->f_security;
3005
3006         if (!signum)
3007                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3008         else
3009                 perm = signal_to_av(signum);
3010
3011         return avc_has_perm(fsec->fown_sid, tsec->sid,
3012                             SECCLASS_PROCESS, perm, NULL);
3013 }
3014
3015 static int selinux_file_receive(struct file *file)
3016 {
3017         return file_has_perm(current, file, file_to_av(file));
3018 }
3019
3020 static int selinux_dentry_open(struct file *file)
3021 {
3022         struct file_security_struct *fsec;
3023         struct inode *inode;
3024         struct inode_security_struct *isec;
3025         inode = file->f_path.dentry->d_inode;
3026         fsec = file->f_security;
3027         isec = inode->i_security;
3028         /*
3029          * Save inode label and policy sequence number
3030          * at open-time so that selinux_file_permission
3031          * can determine whether revalidation is necessary.
3032          * Task label is already saved in the file security
3033          * struct as its SID.
3034          */
3035         fsec->isid = isec->sid;
3036         fsec->pseqno = avc_policy_seqno();
3037         /*
3038          * Since the inode label or policy seqno may have changed
3039          * between the selinux_inode_permission check and the saving
3040          * of state above, recheck that access is still permitted.
3041          * Otherwise, access might never be revalidated against the
3042          * new inode label or new policy.
3043          * This check is not redundant - do not remove.
3044          */
3045         return inode_has_perm(current, inode, file_to_av(file), NULL);
3046 }
3047
3048 /* task security operations */
3049
3050 static int selinux_task_create(unsigned long clone_flags)
3051 {
3052         int rc;
3053
3054         rc = secondary_ops->task_create(clone_flags);
3055         if (rc)
3056                 return rc;
3057
3058         return task_has_perm(current, current, PROCESS__FORK);
3059 }
3060
3061 static int selinux_task_alloc_security(struct task_struct *tsk)
3062 {
3063         struct task_security_struct *tsec1, *tsec2;
3064         int rc;
3065
3066         tsec1 = current->security;
3067
3068         rc = task_alloc_security(tsk);
3069         if (rc)
3070                 return rc;
3071         tsec2 = tsk->security;
3072
3073         tsec2->osid = tsec1->osid;
3074         tsec2->sid = tsec1->sid;
3075
3076         /* Retain the exec, fs, key, and sock SIDs across fork */
3077         tsec2->exec_sid = tsec1->exec_sid;
3078         tsec2->create_sid = tsec1->create_sid;
3079         tsec2->keycreate_sid = tsec1->keycreate_sid;
3080         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3081
3082         /* Retain ptracer SID across fork, if any.
3083            This will be reset by the ptrace hook upon any
3084            subsequent ptrace_attach operations. */
3085         tsec2->ptrace_sid = tsec1->ptrace_sid;
3086
3087         return 0;
3088 }
3089
3090 static void selinux_task_free_security(struct task_struct *tsk)
3091 {
3092         task_free_security(tsk);
3093 }
3094
3095 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3096 {
3097         /* Since setuid only affects the current process, and
3098            since the SELinux controls are not based on the Linux
3099            identity attributes, SELinux does not need to control
3100            this operation.  However, SELinux does control the use
3101            of the CAP_SETUID and CAP_SETGID capabilities using the
3102            capable hook. */
3103         return 0;
3104 }
3105
3106 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3107 {
3108         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3109 }
3110
3111 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3112 {
3113         /* See the comment for setuid above. */
3114         return 0;
3115 }
3116
3117 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3118 {
3119         return task_has_perm(current, p, PROCESS__SETPGID);
3120 }
3121
3122 static int selinux_task_getpgid(struct task_struct *p)
3123 {
3124         return task_has_perm(current, p, PROCESS__GETPGID);
3125 }
3126
3127 static int selinux_task_getsid(struct task_struct *p)
3128 {
3129         return task_has_perm(current, p, PROCESS__GETSESSION);
3130 }
3131
3132 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3133 {
3134         selinux_get_task_sid(p, secid);
3135 }
3136
3137 static int selinux_task_setgroups(struct group_info *group_info)
3138 {
3139         /* See the comment for setuid above. */
3140         return 0;
3141 }
3142
3143 static int selinux_task_setnice(struct task_struct *p, int nice)
3144 {
3145         int rc;
3146
3147         rc = secondary_ops->task_setnice(p, nice);
3148         if (rc)
3149                 return rc;
3150
3151         return task_has_perm(current,p, PROCESS__SETSCHED);
3152 }
3153
3154 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3155 {
3156         int rc;
3157
3158         rc = secondary_ops->task_setioprio(p, ioprio);
3159         if (rc)
3160                 return rc;
3161
3162         return task_has_perm(current, p, PROCESS__SETSCHED);
3163 }
3164
3165 static int selinux_task_getioprio(struct task_struct *p)
3166 {
3167         return task_has_perm(current, p, PROCESS__GETSCHED);
3168 }
3169
3170 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3171 {
3172         struct rlimit *old_rlim = current->signal->rlim + resource;
3173         int rc;
3174
3175         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3176         if (rc)
3177                 return rc;
3178
3179         /* Control the ability to change the hard limit (whether
3180            lowering or raising it), so that the hard limit can
3181            later be used as a safe reset point for the soft limit
3182            upon context transitions. See selinux_bprm_apply_creds. */
3183         if (old_rlim->rlim_max != new_rlim->rlim_max)
3184                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3185
3186         return 0;
3187 }
3188
3189 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3190 {
3191         int rc;
3192
3193         rc = secondary_ops->task_setscheduler(p, policy, lp);
3194         if (rc)
3195                 return rc;
3196
3197         return task_has_perm(current, p, PROCESS__SETSCHED);
3198 }
3199
3200 static int selinux_task_getscheduler(struct task_struct *p)
3201 {
3202         return task_has_perm(current, p, PROCESS__GETSCHED);
3203 }
3204
3205 static int selinux_task_movememory(struct task_struct *p)
3206 {
3207         return task_has_perm(current, p, PROCESS__SETSCHED);
3208 }
3209
3210 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3211                                 int sig, u32 secid)
3212 {
3213         u32 perm;
3214         int rc;
3215         struct task_security_struct *tsec;
3216
3217         rc = secondary_ops->task_kill(p, info, sig, secid);
3218         if (rc)
3219                 return rc;
3220
3221         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3222                 return 0;
3223
3224         if (!sig)
3225                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3226         else
3227                 perm = signal_to_av(sig);
3228         tsec = p->security;
3229         if (secid)
3230                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3231         else
3232                 rc = task_has_perm(current, p, perm);
3233         return rc;
3234 }
3235
3236 static int selinux_task_prctl(int option,
3237                               unsigned long arg2,
3238                               unsigned long arg3,
3239                               unsigned long arg4,
3240                               unsigned long arg5)
3241 {
3242         /* The current prctl operations do not appear to require
3243            any SELinux controls since they merely observe or modify
3244            the state of the current process. */
3245         return 0;
3246 }
3247
3248 static int selinux_task_wait(struct task_struct *p)
3249 {
3250         return task_has_perm(p, current, PROCESS__SIGCHLD);
3251 }
3252
3253 static void selinux_task_reparent_to_init(struct task_struct *p)
3254 {
3255         struct task_security_struct *tsec;
3256
3257         secondary_ops->task_reparent_to_init(p);
3258
3259         tsec = p->security;
3260         tsec->osid = tsec->sid;
3261         tsec->sid = SECINITSID_KERNEL;
3262         return;
3263 }
3264
3265 static void selinux_task_to_inode(struct task_struct *p,
3266                                   struct inode *inode)
3267 {
3268         struct task_security_struct *tsec = p->security;
3269         struct inode_security_struct *isec = inode->i_security;
3270
3271         isec->sid = tsec->sid;
3272         isec->initialized = 1;
3273         return;
3274 }
3275
3276 /* Returns error only if unable to parse addresses */
3277 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3278                         struct avc_audit_data *ad, u8 *proto)
3279 {
3280         int offset, ihlen, ret = -EINVAL;
3281         struct iphdr _iph, *ih;
3282
3283         offset = skb_network_offset(skb);
3284         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3285         if (ih == NULL)
3286                 goto out;
3287
3288         ihlen = ih->ihl * 4;
3289         if (ihlen < sizeof(_iph))
3290                 goto out;
3291
3292         ad->u.net.v4info.saddr = ih->saddr;
3293         ad->u.net.v4info.daddr = ih->daddr;
3294         ret = 0;
3295
3296         if (proto)
3297                 *proto = ih->protocol;
3298
3299         switch (ih->protocol) {
3300         case IPPROTO_TCP: {
3301                 struct tcphdr _tcph, *th;
3302
3303                 if (ntohs(ih->frag_off) & IP_OFFSET)
3304                         break;
3305
3306                 offset += ihlen;
3307                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3308                 if (th == NULL)
3309                         break;
3310
3311                 ad->u.net.sport = th->source;
3312                 ad->u.net.dport = th->dest;
3313                 break;
3314         }
3315
3316         case IPPROTO_UDP: {
3317                 struct udphdr _udph, *uh;
3318
3319                 if (ntohs(ih->frag_off) & IP_OFFSET)
3320                         break;
3321
3322                 offset += ihlen;
3323                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3324                 if (uh == NULL)
3325                         break;
3326
3327                 ad->u.net.sport = uh->source;
3328                 ad->u.net.dport = uh->dest;
3329                 break;
3330         }
3331
3332         case IPPROTO_DCCP: {
3333                 struct dccp_hdr _dccph, *dh;
3334
3335                 if (ntohs(ih->frag_off) & IP_OFFSET)
3336                         break;
3337
3338                 offset += ihlen;
3339                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3340                 if (dh == NULL)
3341                         break;
3342
3343                 ad->u.net.sport = dh->dccph_sport;
3344                 ad->u.net.dport = dh->dccph_dport;
3345                 break;
3346         }
3347
3348         default:
3349                 break;
3350         }
3351 out:
3352         return ret;
3353 }
3354
3355 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3356
3357 /* Returns error only if unable to parse addresses */
3358 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3359                         struct avc_audit_data *ad, u8 *proto)
3360 {
3361         u8 nexthdr;
3362         int ret = -EINVAL, offset;
3363         struct ipv6hdr _ipv6h, *ip6;
3364
3365         offset = skb_network_offset(skb);
3366         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3367         if (ip6 == NULL)
3368                 goto out;
3369
3370         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3371         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3372         ret = 0;
3373
3374         nexthdr = ip6->nexthdr;
3375         offset += sizeof(_ipv6h);
3376         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3377         if (offset < 0)
3378                 goto out;
3379
3380         if (proto)
3381                 *proto = nexthdr;
3382
3383         switch (nexthdr) {
3384         case IPPROTO_TCP: {
3385                 struct tcphdr _tcph, *th;
3386
3387                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3388                 if (th == NULL)
3389                         break;
3390
3391                 ad->u.net.sport = th->source;
3392                 ad->u.net.dport = th->dest;
3393                 break;
3394         }
3395
3396         case IPPROTO_UDP: {
3397                 struct udphdr _udph, *uh;
3398
3399                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3400                 if (uh == NULL)
3401                         break;
3402
3403                 ad->u.net.sport = uh->source;
3404                 ad->u.net.dport = uh->dest;
3405                 break;
3406         }
3407
3408         case IPPROTO_DCCP: {
3409                 struct dccp_hdr _dccph, *dh;
3410
3411                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3412                 if (dh == NULL)
3413                         break;
3414
3415                 ad->u.net.sport = dh->dccph_sport;
3416                 ad->u.net.dport = dh->dccph_dport;
3417                 break;
3418         }
3419
3420         /* includes fragments */
3421         default:
3422                 break;
3423         }
3424 out:
3425         return ret;
3426 }
3427
3428 #endif /* IPV6 */
3429
3430 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3431                              char **addrp, int src, u8 *proto)
3432 {
3433         int ret = 0;
3434
3435         switch (ad->u.net.family) {
3436         case PF_INET:
3437                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3438                 if (ret || !addrp)
3439                         break;
3440                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3441                                         &ad->u.net.v4info.daddr);
3442                 break;
3443
3444 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3445         case PF_INET6:
3446                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3447                 if (ret || !addrp)
3448                         break;
3449                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3450                                         &ad->u.net.v6info.daddr);
3451                 break;
3452 #endif  /* IPV6 */
3453         default:
3454                 break;
3455         }
3456
3457         if (unlikely(ret))
3458                 printk(KERN_WARNING
3459                        "SELinux: failure in selinux_parse_skb(),"
3460                        " unable to parse packet\n");
3461
3462         return ret;
3463 }
3464
3465 /**
3466  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3467  * @skb: the packet
3468  * @family: protocol family
3469  * @sid: the packet's peer label SID
3470  *
3471  * Description:
3472  * Check the various different forms of network peer labeling and determine
3473  * the peer label/SID for the packet; most of the magic actually occurs in
3474  * the security server function security_net_peersid_cmp().  The function
3475  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3476  * or -EACCES if @sid is invalid due to inconsistencies with the different
3477  * peer labels.
3478  *
3479  */
3480 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3481 {
3482         int err;
3483         u32 xfrm_sid;
3484         u32 nlbl_sid;
3485         u32 nlbl_type;
3486
3487         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3488         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3489
3490         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3491         if (unlikely(err)) {
3492                 printk(KERN_WARNING
3493                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3494                        " unable to determine packet's peer label\n");
3495                 return -EACCES;
3496         }
3497
3498         return 0;
3499 }
3500
3501 /* socket security operations */
3502 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3503                            u32 perms)
3504 {
3505         struct inode_security_struct *isec;
3506         struct task_security_struct *tsec;
3507         struct avc_audit_data ad;
3508         int err = 0;
3509
3510         tsec = task->security;
3511         isec = SOCK_INODE(sock)->i_security;
3512
3513         if (isec->sid == SECINITSID_KERNEL)
3514                 goto out;
3515
3516         AVC_AUDIT_DATA_INIT(&ad,NET);
3517         ad.u.net.sk = sock->sk;
3518         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3519
3520 out:
3521         return err;
3522 }
3523
3524 static int selinux_socket_create(int family, int type,
3525                                  int protocol, int kern)
3526 {
3527         int err = 0;
3528         struct task_security_struct *tsec;
3529         u32 newsid;
3530
3531         if (kern)
3532                 goto out;
3533
3534         tsec = current->security;
3535         newsid = tsec->sockcreate_sid ? : tsec->sid;
3536         err = avc_has_perm(tsec->sid, newsid,
3537                            socket_type_to_security_class(family, type,
3538                            protocol), SOCKET__CREATE, NULL);
3539
3540 out:
3541         return err;
3542 }
3543
3544 static int selinux_socket_post_create(struct socket *sock, int family,
3545                                       int type, int protocol, int kern)
3546 {
3547         int err = 0;
3548         struct inode_security_struct *isec;
3549         struct task_security_struct *tsec;
3550         struct sk_security_struct *sksec;
3551         u32 newsid;
3552
3553         isec = SOCK_INODE(sock)->i_security;
3554
3555         tsec = current->security;
3556         newsid = tsec->sockcreate_sid ? : tsec->sid;
3557         isec->sclass = socket_type_to_security_class(family, type, protocol);
3558         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3559         isec->initialized = 1;
3560
3561         if (sock->sk) {
3562                 sksec = sock->sk->sk_security;
3563                 sksec->sid = isec->sid;
3564                 sksec->sclass = isec->sclass;
3565                 err = selinux_netlbl_socket_post_create(sock);
3566         }
3567
3568         return err;
3569 }
3570
3571 /* Range of port numbers used to automatically bind.
3572    Need to determine whether we should perform a name_bind
3573    permission check between the socket and the port number. */
3574
3575 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3576 {
3577         u16 family;
3578         int err;
3579
3580         err = socket_has_perm(current, sock, SOCKET__BIND);
3581         if (err)
3582                 goto out;
3583
3584         /*
3585          * If PF_INET or PF_INET6, check name_bind permission for the port.
3586          * Multiple address binding for SCTP is not supported yet: we just
3587          * check the first address now.
3588          */
3589         family = sock->sk->sk_family;
3590         if (family == PF_INET || family == PF_INET6) {
3591                 char *addrp;
3592                 struct inode_security_struct *isec;
3593                 struct task_security_struct *tsec;
3594                 struct avc_audit_data ad;
3595                 struct sockaddr_in *addr4 = NULL;
3596                 struct sockaddr_in6 *addr6 = NULL;
3597                 unsigned short snum;
3598                 struct sock *sk = sock->sk;
3599                 u32 sid, node_perm, addrlen;
3600
3601                 tsec = current->security;
3602                 isec = SOCK_INODE(sock)->i_security;
3603
3604                 if (family == PF_INET) {
3605                         addr4 = (struct sockaddr_in *)address;
3606                         snum = ntohs(addr4->sin_port);
3607                         addrlen = sizeof(addr4->sin_addr.s_addr);
3608                         addrp = (char *)&addr4->sin_addr.s_addr;
3609                 } else {
3610                         addr6 = (struct sockaddr_in6 *)address;
3611                         snum = ntohs(addr6->sin6_port);
3612                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3613                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3614                 }
3615
3616                 if (snum) {
3617                         int low, high;
3618
3619                         inet_get_local_port_range(&low, &high);
3620
3621                         if (snum < max(PROT_SOCK, low) || snum > high) {
3622                                 err = security_port_sid(sk->sk_family,
3623                                                         sk->sk_type,
3624                                                         sk->sk_protocol, snum,
3625                                                         &sid);
3626                                 if (err)
3627                                         goto out;
3628                                 AVC_AUDIT_DATA_INIT(&ad,NET);
3629                                 ad.u.net.sport = htons(snum);
3630                                 ad.u.net.family = family;
3631                                 err = avc_has_perm(isec->sid, sid,
3632                                                    isec->sclass,
3633                                                    SOCKET__NAME_BIND, &ad);
3634                                 if (err)
3635                                         goto out;
3636                         }
3637                 }
3638
3639                 switch(isec->sclass) {
3640                 case SECCLASS_TCP_SOCKET:
3641                         node_perm = TCP_SOCKET__NODE_BIND;
3642                         break;
3643
3644                 case SECCLASS_UDP_SOCKET:
3645                         node_perm = UDP_SOCKET__NODE_BIND;
3646                         break;
3647
3648                 case SECCLASS_DCCP_SOCKET:
3649                         node_perm = DCCP_SOCKET__NODE_BIND;
3650                         break;
3651
3652                 default:
3653                         node_perm = RAWIP_SOCKET__NODE_BIND;
3654                         break;
3655                 }
3656
3657                 err = sel_netnode_sid(addrp, family, &sid);
3658                 if (err)
3659                         goto out;
3660
3661                 AVC_AUDIT_DATA_INIT(&ad,NET);
3662                 ad.u.net.sport = htons(snum);
3663                 ad.u.net.family = family;
3664
3665                 if (family == PF_INET)
3666                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3667                 else
3668                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3669
3670                 err = avc_has_perm(isec->sid, sid,
3671                                    isec->sclass, node_perm, &ad);
3672                 if (err)
3673                         goto out;
3674         }
3675 out:
3676         return err;
3677 }
3678
3679 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3680 {
3681         struct inode_security_struct *isec;
3682         int err;
3683
3684         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3685         if (err)
3686                 return err;
3687
3688         /*
3689          * If a TCP or DCCP socket, check name_connect permission for the port.
3690          */
3691         isec = SOCK_INODE(sock)->i_security;
3692         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3693             isec->sclass == SECCLASS_DCCP_SOCKET) {
3694                 struct sock *sk = sock->sk;
3695                 struct avc_audit_data ad;
3696                 struct sockaddr_in *addr4 = NULL;
3697                 struct sockaddr_in6 *addr6 = NULL;
3698                 unsigned short snum;
3699                 u32 sid, perm;
3700
3701                 if (sk->sk_family == PF_INET) {
3702                         addr4 = (struct sockaddr_in *)address;
3703                         if (addrlen < sizeof(struct sockaddr_in))
3704                                 return -EINVAL;
3705                         snum = ntohs(addr4->sin_port);
3706                 } else {
3707                         addr6 = (struct sockaddr_in6 *)address;
3708                         if (addrlen < SIN6_LEN_RFC2133)
3709                                 return -EINVAL;
3710                         snum = ntohs(addr6->sin6_port);
3711                 }
3712
3713                 err = security_port_sid(sk->sk_family, sk->sk_type,
3714                                         sk->sk_protocol, snum, &sid);
3715                 if (err)
3716                         goto out;
3717
3718                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3719                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3720
3721                 AVC_AUDIT_DATA_INIT(&ad,NET);
3722                 ad.u.net.dport = htons(snum);
3723                 ad.u.net.family = sk->sk_family;
3724                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3725                 if (err)
3726                         goto out;
3727         }
3728
3729 out:
3730         return err;
3731 }
3732
3733 static int selinux_socket_listen(struct socket *sock, int backlog)
3734 {
3735         return socket_has_perm(current, sock, SOCKET__LISTEN);
3736 }
3737
3738 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3739 {
3740         int err;
3741         struct inode_security_struct *isec;
3742         struct inode_security_struct *newisec;
3743
3744         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3745         if (err)
3746                 return err;
3747
3748         newisec = SOCK_INODE(newsock)->i_security;
3749
3750         isec = SOCK_INODE(sock)->i_security;
3751         newisec->sclass = isec->sclass;
3752         newisec->sid = isec->sid;
3753         newisec->initialized = 1;
3754
3755         return 0;
3756 }
3757
3758 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3759                                   int size)
3760 {
3761         int rc;
3762
3763         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3764         if (rc)
3765                 return rc;
3766
3767         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3768 }
3769
3770 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3771                                   int size, int flags)
3772 {
3773         return socket_has_perm(current, sock, SOCKET__READ);
3774 }
3775
3776 static int selinux_socket_getsockname(struct socket *sock)
3777 {
3778         return socket_has_perm(current, sock, SOCKET__GETATTR);
3779 }
3780
3781 static int selinux_socket_getpeername(struct socket *sock)
3782 {
3783         return socket_has_perm(current, sock, SOCKET__GETATTR);
3784 }
3785
3786 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3787 {
3788         int err;
3789
3790         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3791         if (err)
3792                 return err;
3793
3794         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3795 }
3796
3797 static int selinux_socket_getsockopt(struct socket *sock, int level,
3798                                      int optname)
3799 {
3800         return socket_has_perm(current, sock, SOCKET__GETOPT);
3801 }
3802
3803 static int selinux_socket_shutdown(struct socket *sock, int how)
3804 {
3805         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3806 }
3807
3808 static int selinux_socket_unix_stream_connect(struct socket *sock,
3809                                               struct socket *other,
3810                                               struct sock *newsk)
3811 {
3812         struct sk_security_struct *ssec;
3813         struct inode_security_struct *isec;
3814         struct inode_security_struct *other_isec;
3815         struct avc_audit_data ad;
3816         int err;
3817
3818         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3819         if (err)
3820                 return err;
3821
3822         isec = SOCK_INODE(sock)->i_security;
3823         other_isec = SOCK_INODE(other)->i_security;
3824
3825         AVC_AUDIT_DATA_INIT(&ad,NET);
3826         ad.u.net.sk = other->sk;
3827
3828         err = avc_has_perm(isec->sid, other_isec->sid,
3829                            isec->sclass,
3830                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3831         if (err)
3832                 return err;
3833
3834         /* connecting socket */
3835         ssec = sock->sk->sk_security;
3836         ssec->peer_sid = other_isec->sid;
3837
3838         /* server child socket */
3839         ssec = newsk->sk_security;
3840         ssec->peer_sid = isec->sid;
3841         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3842
3843         return err;
3844 }
3845
3846 static int selinux_socket_unix_may_send(struct socket *sock,
3847                                         struct socket *other)
3848 {
3849         struct inode_security_struct *isec;
3850         struct inode_security_struct *other_isec;
3851         struct avc_audit_data ad;
3852         int err;
3853
3854         isec = SOCK_INODE(sock)->i_security;
3855         other_isec = SOCK_INODE(other)->i_security;
3856
3857         AVC_AUDIT_DATA_INIT(&ad,NET);
3858         ad.u.net.sk = other->sk;
3859
3860         err = avc_has_perm(isec->sid, other_isec->sid,
3861                            isec->sclass, SOCKET__SENDTO, &ad);
3862         if (err)
3863                 return err;
3864
3865         return 0;
3866 }
3867
3868 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3869                                     u32 peer_sid,
3870                                     struct avc_audit_data *ad)
3871 {
3872         int err;
3873         u32 if_sid;
3874         u32 node_sid;
3875
3876         err = sel_netif_sid(ifindex, &if_sid);
3877         if (err)
3878                 return err;
3879         err = avc_has_perm(peer_sid, if_sid,
3880                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3881         if (err)
3882                 return err;
3883
3884         err = sel_netnode_sid(addrp, family, &node_sid);
3885         if (err)
3886                 return err;
3887         return avc_has_perm(peer_sid, node_sid,
3888                             SECCLASS_NODE, NODE__RECVFROM, ad);
3889 }
3890
3891 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3892                                                 struct sk_buff *skb,
3893                                                 struct avc_audit_data *ad,
3894                                                 u16 family,
3895                                                 char *addrp)
3896 {
3897         int err;
3898         struct sk_security_struct *sksec = sk->sk_security;
3899         u16 sk_class;
3900         u32 netif_perm, node_perm, recv_perm;
3901         u32 port_sid, node_sid, if_sid, sk_sid;
3902
3903         sk_sid = sksec->sid;
3904         sk_class = sksec->sclass;
3905
3906         switch (sk_class) {
3907         case SECCLASS_UDP_SOCKET:
3908                 netif_perm = NETIF__UDP_RECV;
3909                 node_perm = NODE__UDP_RECV;
3910                 recv_perm = UDP_SOCKET__RECV_MSG;
3911                 break;
3912         case SECCLASS_TCP_SOCKET:
3913                 netif_perm = NETIF__TCP_RECV;
3914                 node_perm = NODE__TCP_RECV;
3915                 recv_perm = TCP_SOCKET__RECV_MSG;
3916                 break;
3917         case SECCLASS_DCCP_SOCKET:
3918                 netif_perm = NETIF__DCCP_RECV;
3919                 node_perm = NODE__DCCP_RECV;
3920                 recv_perm = DCCP_SOCKET__RECV_MSG;
3921                 break;
3922         default:
3923                 netif_perm = NETIF__RAWIP_RECV;
3924                 node_perm = NODE__RAWIP_RECV;
3925                 recv_perm = 0;
3926                 break;
3927         }
3928
3929         err = sel_netif_sid(skb->iif, &if_sid);
3930         if (err)
3931                 return err;
3932         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3933         if (err)
3934                 return err;
3935
3936         err = sel_netnode_sid(addrp, family, &node_sid);
3937         if (err)
3938                 return err;
3939         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3940         if (err)
3941                 return err;
3942
3943         if (!recv_perm)
3944                 return 0;
3945         err = security_port_sid(sk->sk_family, sk->sk_type,
3946                                 sk->sk_protocol, ntohs(ad->u.net.sport),
3947                                 &port_sid);
3948         if (unlikely(err)) {
3949                 printk(KERN_WARNING
3950                        "SELinux: failure in"
3951                        " selinux_sock_rcv_skb_iptables_compat(),"
3952                        " network port label not found\n");
3953                 return err;
3954         }
3955         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3956 }
3957
3958 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3959                                        struct avc_audit_data *ad,
3960                                        u16 family, char *addrp)
3961 {
3962         int err;
3963         struct sk_security_struct *sksec = sk->sk_security;
3964         u32 peer_sid;
3965         u32 sk_sid = sksec->sid;
3966
3967         if (selinux_compat_net)
3968                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3969                                                            family, addrp);
3970         else
3971                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3972                                    PACKET__RECV, ad);
3973         if (err)
3974                 return err;
3975
3976         if (selinux_policycap_netpeer) {
3977                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3978                 if (err)
3979                         return err;
3980                 err = avc_has_perm(sk_sid, peer_sid,
3981                                    SECCLASS_PEER, PEER__RECV, ad);
3982         } else {
3983                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
3984                 if (err)
3985                         return err;
3986                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
3987         }
3988
3989         return err;
3990 }
3991
3992 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3993 {
3994         int err;
3995         struct sk_security_struct *sksec = sk->sk_security;
3996         u16 family = sk->sk_family;
3997         u32 sk_sid = sksec->sid;
3998         struct avc_audit_data ad;
3999         char *addrp;
4000
4001         if (family != PF_INET && family != PF_INET6)
4002                 return 0;
4003
4004         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4005         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4006                 family = PF_INET;
4007
4008         AVC_AUDIT_DATA_INIT(&ad, NET);
4009         ad.u.net.netif = skb->iif;
4010         ad.u.net.family = family;
4011         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4012         if (err)
4013                 return err;
4014
4015         /* If any sort of compatibility mode is enabled then handoff processing
4016          * to the selinux_sock_rcv_skb_compat() function to deal with the
4017          * special handling.  We do this in an attempt to keep this function
4018          * as fast and as clean as possible. */
4019         if (selinux_compat_net || !selinux_policycap_netpeer)
4020                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4021                                                    family, addrp);
4022
4023         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4024                 u32 peer_sid;
4025
4026                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4027                 if (err)
4028                         return err;
4029                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4030                                                peer_sid, &ad);
4031                 if (err)
4032                         return err;
4033                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4034                                    PEER__RECV, &ad);
4035         }
4036
4037         if (selinux_secmark_enabled()) {
4038                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4039                                    PACKET__RECV, &ad);
4040                 if (err)
4041                         return err;
4042         }
4043
4044         return err;
4045 }
4046
4047 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4048                                             int __user *optlen, unsigned len)
4049 {
4050         int err = 0;
4051         char *scontext;
4052         u32 scontext_len;
4053         struct sk_security_struct *ssec;
4054         struct inode_security_struct *isec;
4055         u32 peer_sid = SECSID_NULL;
4056
4057         isec = SOCK_INODE(sock)->i_security;
4058
4059         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4060             isec->sclass == SECCLASS_TCP_SOCKET) {
4061                 ssec = sock->sk->sk_security;
4062                 peer_sid = ssec->peer_sid;
4063         }
4064         if (peer_sid == SECSID_NULL) {
4065                 err = -ENOPROTOOPT;
4066                 goto out;
4067         }
4068
4069         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4070
4071         if (err)
4072                 goto out;
4073
4074         if (scontext_len > len) {
4075                 err = -ERANGE;
4076                 goto out_len;
4077         }
4078
4079         if (copy_to_user(optval, scontext, scontext_len))
4080                 err = -EFAULT;
4081
4082 out_len:
4083         if (put_user(scontext_len, optlen))
4084                 err = -EFAULT;
4085
4086         kfree(scontext);
4087 out:
4088         return err;
4089 }
4090
4091 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4092 {
4093         u32 peer_secid = SECSID_NULL;
4094         u16 family;
4095
4096         if (sock)
4097                 family = sock->sk->sk_family;
4098         else if (skb && skb->sk)
4099                 family = skb->sk->sk_family;
4100         else
4101                 goto out;
4102
4103         if (sock && family == PF_UNIX)
4104                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4105         else if (skb)
4106                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4107
4108 out:
4109         *secid = peer_secid;
4110         if (peer_secid == SECSID_NULL)
4111                 return -EINVAL;
4112         return 0;
4113 }
4114
4115 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4116 {
4117         return sk_alloc_security(sk, family, priority);
4118 }
4119
4120 static void selinux_sk_free_security(struct sock *sk)
4121 {
4122         sk_free_security(sk);
4123 }
4124
4125 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4126 {
4127         struct sk_security_struct *ssec = sk->sk_security;
4128         struct sk_security_struct *newssec = newsk->sk_security;
4129
4130         newssec->sid = ssec->sid;
4131         newssec->peer_sid = ssec->peer_sid;
4132         newssec->sclass = ssec->sclass;
4133
4134         selinux_netlbl_sk_security_clone(ssec, newssec);
4135 }
4136
4137 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4138 {
4139         if (!sk)
4140                 *secid = SECINITSID_ANY_SOCKET;
4141         else {
4142                 struct sk_security_struct *sksec = sk->sk_security;
4143
4144                 *secid = sksec->sid;
4145         }
4146 }
4147
4148 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4149 {
4150         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4151         struct sk_security_struct *sksec = sk->sk_security;
4152
4153         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4154             sk->sk_family == PF_UNIX)
4155                 isec->sid = sksec->sid;
4156         sksec->sclass = isec->sclass;
4157
4158         selinux_netlbl_sock_graft(sk, parent);
4159 }
4160
4161 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4162                                      struct request_sock *req)
4163 {
4164         struct sk_security_struct *sksec = sk->sk_security;
4165         int err;
4166         u32 newsid;
4167         u32 peersid;
4168
4169         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4170         if (err)
4171                 return err;
4172         if (peersid == SECSID_NULL) {
4173                 req->secid = sksec->sid;
4174                 req->peer_secid = SECSID_NULL;
4175                 return 0;
4176         }
4177
4178         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4179         if (err)
4180                 return err;
4181
4182         req->secid = newsid;
4183         req->peer_secid = peersid;
4184         return 0;
4185 }
4186
4187 static void selinux_inet_csk_clone(struct sock *newsk,
4188                                    const struct request_sock *req)
4189 {
4190         struct sk_security_struct *newsksec = newsk->sk_security;
4191
4192         newsksec->sid = req->secid;
4193         newsksec->peer_sid = req->peer_secid;
4194         /* NOTE: Ideally, we should also get the isec->sid for the
4195            new socket in sync, but we don't have the isec available yet.
4196            So we will wait until sock_graft to do it, by which
4197            time it will have been created and available. */
4198
4199         /* We don't need to take any sort of lock here as we are the only
4200          * thread with access to newsksec */
4201         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4202 }
4203
4204 static void selinux_inet_conn_established(struct sock *sk,
4205                                 struct sk_buff *skb)
4206 {
4207         struct sk_security_struct *sksec = sk->sk_security;
4208
4209         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4210 }
4211
4212 static void selinux_req_classify_flow(const struct request_sock *req,
4213                                       struct flowi *fl)
4214 {
4215         fl->secid = req->secid;
4216 }
4217
4218 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4219 {
4220         int err = 0;
4221         u32 perm;
4222         struct nlmsghdr *nlh;
4223         struct socket *sock = sk->sk_socket;
4224         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4225
4226         if (skb->len < NLMSG_SPACE(0)) {
4227                 err = -EINVAL;
4228                 goto out;
4229         }
4230         nlh = nlmsg_hdr(skb);
4231
4232         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4233         if (err) {
4234                 if (err == -EINVAL) {
4235                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4236                                   "SELinux:  unrecognized netlink message"
4237                                   " type=%hu for sclass=%hu\n",
4238                                   nlh->nlmsg_type, isec->sclass);
4239                         if (!selinux_enforcing)
4240                                 err = 0;
4241                 }
4242
4243                 /* Ignore */
4244                 if (err == -ENOENT)
4245                         err = 0;
4246                 goto out;
4247         }
4248
4249         err = socket_has_perm(current, sock, perm);
4250 out:
4251         return err;
4252 }
4253
4254 #ifdef CONFIG_NETFILTER
4255
4256 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4257                                        u16 family)
4258 {
4259         char *addrp;
4260         u32 peer_sid;
4261         struct avc_audit_data ad;
4262         u8 secmark_active;
4263         u8 peerlbl_active;
4264
4265         if (!selinux_policycap_netpeer)
4266                 return NF_ACCEPT;
4267
4268         secmark_active = selinux_secmark_enabled();
4269         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4270         if (!secmark_active && !peerlbl_active)
4271                 return NF_ACCEPT;
4272
4273         AVC_AUDIT_DATA_INIT(&ad, NET);
4274         ad.u.net.netif = ifindex;
4275         ad.u.net.family = family;
4276         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4277                 return NF_DROP;
4278
4279         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4280                 return NF_DROP;
4281
4282         if (peerlbl_active)
4283                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4284                                              peer_sid, &ad) != 0)
4285                         return NF_DROP;
4286
4287         if (secmark_active)
4288                 if (avc_has_perm(peer_sid, skb->secmark,
4289                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4290                         return NF_DROP;
4291
4292         return NF_ACCEPT;
4293 }
4294
4295 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4296                                          struct sk_buff *skb,
4297                                          const struct net_device *in,
4298                                          const struct net_device *out,
4299                                          int (*okfn)(struct sk_buff *))
4300 {
4301         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4302 }
4303
4304 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4305 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4306                                          struct sk_buff *skb,
4307                                          const struct net_device *in,
4308                                          const struct net_device *out,
4309                                          int (*okfn)(struct sk_buff *))
4310 {
4311         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4312 }
4313 #endif  /* IPV6 */
4314
4315 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4316                                                 int ifindex,
4317                                                 struct avc_audit_data *ad,
4318                                                 u16 family, char *addrp)
4319 {
4320         int err;
4321         struct sk_security_struct *sksec = sk->sk_security;
4322         u16 sk_class;
4323         u32 netif_perm, node_perm, send_perm;
4324         u32 port_sid, node_sid, if_sid, sk_sid;
4325
4326         sk_sid = sksec->sid;
4327         sk_class = sksec->sclass;
4328
4329         switch (sk_class) {
4330         case SECCLASS_UDP_SOCKET:
4331                 netif_perm = NETIF__UDP_SEND;
4332                 node_perm = NODE__UDP_SEND;
4333                 send_perm = UDP_SOCKET__SEND_MSG;
4334                 break;
4335         case SECCLASS_TCP_SOCKET:
4336                 netif_perm = NETIF__TCP_SEND;
4337                 node_perm = NODE__TCP_SEND;
4338                 send_perm = TCP_SOCKET__SEND_MSG;
4339                 break;
4340         case SECCLASS_DCCP_SOCKET:
4341                 netif_perm = NETIF__DCCP_SEND;
4342                 node_perm = NODE__DCCP_SEND;
4343                 send_perm = DCCP_SOCKET__SEND_MSG;
4344                 break;
4345         default:
4346                 netif_perm = NETIF__RAWIP_SEND;
4347                 node_perm = NODE__RAWIP_SEND;
4348                 send_perm = 0;
4349                 break;
4350         }
4351
4352         err = sel_netif_sid(ifindex, &if_sid);
4353         if (err)
4354                 return err;
4355         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4356                 return err;
4357
4358         err = sel_netnode_sid(addrp, family, &node_sid);
4359         if (err)
4360                 return err;
4361         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4362         if (err)
4363                 return err;
4364
4365         if (send_perm != 0)
4366                 return 0;
4367
4368         err = security_port_sid(sk->sk_family, sk->sk_type,
4369                                 sk->sk_protocol, ntohs(ad->u.net.dport),
4370                                 &port_sid);
4371         if (unlikely(err)) {
4372                 printk(KERN_WARNING
4373                        "SELinux: failure in"
4374                        " selinux_ip_postroute_iptables_compat(),"
4375                        " network port label not found\n");
4376                 return err;
4377         }
4378         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4379 }
4380
4381 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4382                                                 int ifindex,
4383                                                 struct avc_audit_data *ad,
4384                                                 u16 family,
4385                                                 char *addrp,
4386                                                 u8 proto)
4387 {
4388         struct sock *sk = skb->sk;
4389         struct sk_security_struct *sksec;
4390
4391         if (sk == NULL)
4392                 return NF_ACCEPT;
4393         sksec = sk->sk_security;
4394
4395         if (selinux_compat_net) {
4396                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4397                                                          ad, family, addrp))
4398                         return NF_DROP;
4399         } else {
4400                 if (avc_has_perm(sksec->sid, skb->secmark,
4401                                  SECCLASS_PACKET, PACKET__SEND, ad))
4402                         return NF_DROP;
4403         }
4404
4405         if (selinux_policycap_netpeer)
4406                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4407                         return NF_DROP;
4408
4409         return NF_ACCEPT;
4410 }
4411
4412 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4413                                          u16 family)
4414 {
4415         u32 secmark_perm;
4416         u32 peer_sid;
4417         struct sock *sk;
4418         struct avc_audit_data ad;
4419         char *addrp;
4420         u8 proto;
4421         u8 secmark_active;
4422         u8 peerlbl_active;
4423
4424         AVC_AUDIT_DATA_INIT(&ad, NET);
4425         ad.u.net.netif = ifindex;
4426         ad.u.net.family = family;
4427         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4428                 return NF_DROP;
4429
4430         /* If any sort of compatibility mode is enabled then handoff processing
4431          * to the selinux_ip_postroute_compat() function to deal with the
4432          * special handling.  We do this in an attempt to keep this function
4433          * as fast and as clean as possible. */
4434         if (selinux_compat_net || !selinux_policycap_netpeer)
4435                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4436                                                    family, addrp, proto);
4437
4438         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4439          * packet transformation so allow the packet to pass without any checks
4440          * since we'll have another chance to perform access control checks
4441          * when the packet is on it's final way out.
4442          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4443          *       is NULL, in this case go ahead and apply access control. */
4444         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4445                 return NF_ACCEPT;
4446
4447         secmark_active = selinux_secmark_enabled();
4448         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4449         if (!secmark_active && !peerlbl_active)
4450                 return NF_ACCEPT;
4451
4452         /* if the packet is locally generated (skb->sk != NULL) then use the
4453          * socket's label as the peer label, otherwise the packet is being
4454          * forwarded through this system and we need to fetch the peer label
4455          * directly from the packet */
4456         sk = skb->sk;
4457         if (sk) {
4458                 struct sk_security_struct *sksec = sk->sk_security;
4459                 peer_sid = sksec->sid;
4460                 secmark_perm = PACKET__SEND;
4461         } else {
4462                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4463                                 return NF_DROP;
4464                 secmark_perm = PACKET__FORWARD_OUT;
4465         }
4466
4467         if (secmark_active)
4468                 if (avc_has_perm(peer_sid, skb->secmark,
4469                                  SECCLASS_PACKET, secmark_perm, &ad))
4470                         return NF_DROP;
4471
4472         if (peerlbl_active) {
4473                 u32 if_sid;
4474                 u32 node_sid;
4475
4476                 if (sel_netif_sid(ifindex, &if_sid))
4477                         return NF_DROP;
4478                 if (avc_has_perm(peer_sid, if_sid,
4479                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4480                         return NF_DROP;
4481
4482                 if (sel_netnode_sid(addrp, family, &node_sid))
4483                         return NF_DROP;
4484                 if (avc_has_perm(peer_sid, node_sid,
4485                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4486                         return NF_DROP;
4487         }
4488
4489         return NF_ACCEPT;
4490 }
4491
4492 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4493                                            struct sk_buff *skb,
4494                                            const struct net_device *in,
4495                                            const struct net_device *out,
4496                                            int (*okfn)(struct sk_buff *))
4497 {
4498         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4499 }
4500
4501 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4502 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4503                                            struct sk_buff *skb,
4504                                            const struct net_device *in,
4505                                            const struct net_device *out,
4506                                            int (*okfn)(struct sk_buff *))
4507 {
4508         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4509 }
4510 #endif  /* IPV6 */
4511
4512 #endif  /* CONFIG_NETFILTER */
4513
4514 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4515 {
4516         int err;
4517
4518         err = secondary_ops->netlink_send(sk, skb);
4519         if (err)
4520                 return err;
4521
4522         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4523                 err = selinux_nlmsg_perm(sk, skb);
4524
4525         return err;
4526 }
4527
4528 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4529 {
4530         int err;
4531         struct avc_audit_data ad;
4532
4533         err = secondary_ops->netlink_recv(skb, capability);
4534         if (err)
4535                 return err;
4536
4537         AVC_AUDIT_DATA_INIT(&ad, CAP);
4538         ad.u.cap = capability;
4539
4540         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4541                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4542 }
4543
4544 static int ipc_alloc_security(struct task_struct *task,
4545                               struct kern_ipc_perm *perm,
4546                               u16 sclass)
4547 {
4548         struct task_security_struct *tsec = task->security;
4549         struct ipc_security_struct *isec;
4550
4551         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4552         if (!isec)
4553                 return -ENOMEM;
4554
4555         isec->sclass = sclass;
4556         isec->ipc_perm = perm;
4557         isec->sid = tsec->sid;
4558         perm->security = isec;
4559
4560         return 0;
4561 }
4562
4563 static void ipc_free_security(struct kern_ipc_perm *perm)
4564 {
4565         struct ipc_security_struct *isec = perm->security;
4566         perm->security = NULL;
4567         kfree(isec);
4568 }
4569
4570 static int msg_msg_alloc_security(struct msg_msg *msg)
4571 {
4572         struct msg_security_struct *msec;
4573
4574         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4575         if (!msec)
4576                 return -ENOMEM;
4577
4578         msec->msg = msg;
4579         msec->sid = SECINITSID_UNLABELED;
4580         msg->security = msec;
4581
4582         return 0;
4583 }
4584
4585 static void msg_msg_free_security(struct msg_msg *msg)
4586 {
4587         struct msg_security_struct *msec = msg->security;
4588
4589         msg->security = NULL;
4590         kfree(msec);
4591 }
4592
4593 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4594                         u32 perms)
4595 {
4596         struct task_security_struct *tsec;
4597         struct ipc_security_struct *isec;
4598         struct avc_audit_data ad;
4599
4600         tsec = current->security;
4601         isec = ipc_perms->security;
4602
4603         AVC_AUDIT_DATA_INIT(&ad, IPC);
4604         ad.u.ipc_id = ipc_perms->key;
4605
4606         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4607 }
4608
4609 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4610 {
4611         return msg_msg_alloc_security(msg);
4612 }
4613
4614 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4615 {
4616         msg_msg_free_security(msg);
4617 }
4618
4619 /* message queue security operations */
4620 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4621 {
4622         struct task_security_struct *tsec;
4623         struct ipc_security_struct *isec;
4624         struct avc_audit_data ad;
4625         int rc;
4626
4627         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4628         if (rc)
4629                 return rc;
4630
4631         tsec = current->security;
4632         isec = msq->q_perm.security;
4633
4634         AVC_AUDIT_DATA_INIT(&ad, IPC);
4635         ad.u.ipc_id = msq->q_perm.key;
4636
4637         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4638                           MSGQ__CREATE, &ad);
4639         if (rc) {
4640                 ipc_free_security(&msq->q_perm);
4641                 return rc;
4642         }
4643         return 0;
4644 }
4645
4646 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4647 {
4648         ipc_free_security(&msq->q_perm);
4649 }
4650
4651 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4652 {
4653         struct task_security_struct *tsec;
4654         struct ipc_security_struct *isec;
4655         struct avc_audit_data ad;
4656
4657         tsec = current->security;
4658         isec = msq->q_perm.security;
4659
4660         AVC_AUDIT_DATA_INIT(&ad, IPC);
4661         ad.u.ipc_id = msq->q_perm.key;
4662
4663         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4664                             MSGQ__ASSOCIATE, &ad);
4665 }
4666
4667 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4668 {
4669         int err;
4670         int perms;
4671
4672         switch(cmd) {
4673         case IPC_INFO:
4674         case MSG_INFO:
4675                 /* No specific object, just general system-wide information. */
4676                 return task_has_system(current, SYSTEM__IPC_INFO);
4677         case IPC_STAT:
4678         case MSG_STAT:
4679                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4680                 break;
4681         case IPC_SET:
4682                 perms = MSGQ__SETATTR;
4683                 break;
4684         case IPC_RMID:
4685                 perms = MSGQ__DESTROY;
4686                 break;
4687         default:
4688                 return 0;
4689         }
4690
4691         err = ipc_has_perm(&msq->q_perm, perms);
4692         return err;
4693 }
4694
4695 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4696 {
4697         struct task_security_struct *tsec;
4698         struct ipc_security_struct *isec;
4699         struct msg_security_struct *msec;
4700         struct avc_audit_data ad;
4701         int rc;
4702
4703         tsec = current->security;
4704         isec = msq->q_perm.security;
4705         msec = msg->security;
4706
4707         /*
4708          * First time through, need to assign label to the message
4709          */
4710         if (msec->sid == SECINITSID_UNLABELED) {
4711                 /*
4712                  * Compute new sid based on current process and
4713                  * message queue this message will be stored in
4714                  */
4715                 rc = security_transition_sid(tsec->sid,
4716                                              isec->sid,
4717                                              SECCLASS_MSG,
4718                                              &msec->sid);
4719                 if (rc)
4720                         return rc;
4721         }
4722
4723         AVC_AUDIT_DATA_INIT(&ad, IPC);
4724         ad.u.ipc_id = msq->q_perm.key;
4725
4726         /* Can this process write to the queue? */
4727         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4728                           MSGQ__WRITE, &ad);
4729         if (!rc)
4730                 /* Can this process send the message */
4731                 rc = avc_has_perm(tsec->sid, msec->sid,
4732                                   SECCLASS_MSG, MSG__SEND, &ad);
4733         if (!rc)
4734                 /* Can the message be put in the queue? */
4735                 rc = avc_has_perm(msec->sid, isec->sid,
4736                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4737
4738         return rc;
4739 }
4740
4741 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4742                                     struct task_struct *target,
4743                                     long type, int mode)
4744 {
4745         struct task_security_struct *tsec;
4746         struct ipc_security_struct *isec;
4747         struct msg_security_struct *msec;
4748         struct avc_audit_data ad;
4749         int rc;
4750
4751         tsec = target->security;
4752         isec = msq->q_perm.security;
4753         msec = msg->security;
4754
4755         AVC_AUDIT_DATA_INIT(&ad, IPC);
4756         ad.u.ipc_id = msq->q_perm.key;
4757
4758         rc = avc_has_perm(tsec->sid, isec->sid,
4759                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4760         if (!rc)
4761                 rc = avc_has_perm(tsec->sid, msec->sid,
4762                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4763         return rc;
4764 }
4765
4766 /* Shared Memory security operations */
4767 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4768 {
4769         struct task_security_struct *tsec;
4770         struct ipc_security_struct *isec;
4771         struct avc_audit_data ad;
4772         int rc;
4773
4774         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4775         if (rc)
4776                 return rc;
4777
4778         tsec = current->security;
4779         isec = shp->shm_perm.security;
4780
4781         AVC_AUDIT_DATA_INIT(&ad, IPC);
4782         ad.u.ipc_id = shp->shm_perm.key;
4783
4784         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4785                           SHM__CREATE, &ad);
4786         if (rc) {
4787                 ipc_free_security(&shp->shm_perm);
4788                 return rc;
4789         }
4790         return 0;
4791 }
4792
4793 static void selinux_shm_free_security(struct shmid_kernel *shp)
4794 {
4795         ipc_free_security(&shp->shm_perm);
4796 }
4797
4798 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4799 {
4800         struct task_security_struct *tsec;
4801         struct ipc_security_struct *isec;
4802         struct avc_audit_data ad;
4803
4804         tsec = current->security;
4805         isec = shp->shm_perm.security;
4806
4807         AVC_AUDIT_DATA_INIT(&ad, IPC);
4808         ad.u.ipc_id = shp->shm_perm.key;
4809
4810         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4811                             SHM__ASSOCIATE, &ad);
4812 }
4813
4814 /* Note, at this point, shp is locked down */
4815 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4816 {
4817         int perms;
4818         int err;
4819
4820         switch(cmd) {
4821         case IPC_INFO:
4822         case SHM_INFO:
4823                 /* No specific object, just general system-wide information. */
4824                 return task_has_system(current, SYSTEM__IPC_INFO);
4825         case IPC_STAT:
4826         case SHM_STAT:
4827                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4828                 break;
4829         case IPC_SET:
4830                 perms = SHM__SETATTR;
4831                 break;
4832         case SHM_LOCK:
4833         case SHM_UNLOCK:
4834                 perms = SHM__LOCK;
4835                 break;
4836         case IPC_RMID:
4837                 perms = SHM__DESTROY;
4838                 break;
4839         default:
4840                 return 0;
4841         }
4842
4843         err = ipc_has_perm(&shp->shm_perm, perms);
4844         return err;
4845 }
4846
4847 static int selinux_shm_shmat(struct shmid_kernel *shp,
4848                              char __user *shmaddr, int shmflg)
4849 {
4850         u32 perms;
4851         int rc;
4852
4853         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4854         if (rc)
4855                 return rc;
4856
4857         if (shmflg & SHM_RDONLY)
4858                 perms = SHM__READ;
4859         else
4860                 perms = SHM__READ | SHM__WRITE;
4861
4862         return ipc_has_perm(&shp->shm_perm, perms);
4863 }
4864
4865 /* Semaphore security operations */
4866 static int selinux_sem_alloc_security(struct sem_array *sma)
4867 {
4868         struct task_security_struct *tsec;
4869         struct ipc_security_struct *isec;
4870         struct avc_audit_data ad;
4871         int rc;
4872
4873         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4874         if (rc)
4875                 return rc;
4876
4877         tsec = current->security;
4878         isec = sma->sem_perm.security;
4879
4880         AVC_AUDIT_DATA_INIT(&ad, IPC);
4881         ad.u.ipc_id = sma->sem_perm.key;
4882
4883         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4884                           SEM__CREATE, &ad);
4885         if (rc) {
4886                 ipc_free_security(&sma->sem_perm);
4887                 return rc;
4888         }
4889         return 0;
4890 }
4891
4892 static void selinux_sem_free_security(struct sem_array *sma)
4893 {
4894         ipc_free_security(&sma->sem_perm);
4895 }
4896
4897 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4898 {
4899         struct task_security_struct *tsec;
4900         struct ipc_security_struct *isec;
4901         struct avc_audit_data ad;
4902
4903         tsec = current->security;
4904         isec = sma->sem_perm.security;
4905
4906         AVC_AUDIT_DATA_INIT(&ad, IPC);
4907         ad.u.ipc_id = sma->sem_perm.key;
4908
4909         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4910                             SEM__ASSOCIATE, &ad);
4911 }
4912
4913 /* Note, at this point, sma is locked down */
4914 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4915 {
4916         int err;
4917         u32 perms;
4918
4919         switch(cmd) {
4920         case IPC_INFO:
4921         case SEM_INFO:
4922                 /* No specific object, just general system-wide information. */
4923                 return task_has_system(current, SYSTEM__IPC_INFO);
4924         case GETPID:
4925         case GETNCNT:
4926         case GETZCNT:
4927                 perms = SEM__GETATTR;
4928                 break;
4929         case GETVAL:
4930         case GETALL:
4931                 perms = SEM__READ;
4932                 break;
4933         case SETVAL:
4934         case SETALL:
4935                 perms = SEM__WRITE;
4936                 break;
4937         case IPC_RMID:
4938                 perms = SEM__DESTROY;
4939                 break;
4940         case IPC_SET:
4941                 perms = SEM__SETATTR;
4942                 break;
4943         case IPC_STAT:
4944         case SEM_STAT:
4945                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4946                 break;
4947         default:
4948                 return 0;
4949         }
4950
4951         err = ipc_has_perm(&sma->sem_perm, perms);
4952         return err;
4953 }
4954
4955 static int selinux_sem_semop(struct sem_array *sma,
4956                              struct sembuf *sops, unsigned nsops, int alter)
4957 {
4958         u32 perms;
4959
4960         if (alter)
4961                 perms = SEM__READ | SEM__WRITE;
4962         else
4963                 perms = SEM__READ;
4964
4965         return ipc_has_perm(&sma->sem_perm, perms);
4966 }
4967
4968 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4969 {
4970         u32 av = 0;
4971
4972         av = 0;
4973         if (flag & S_IRUGO)
4974                 av |= IPC__UNIX_READ;
4975         if (flag & S_IWUGO)
4976                 av |= IPC__UNIX_WRITE;
4977
4978         if (av == 0)
4979                 return 0;
4980
4981         return ipc_has_perm(ipcp, av);
4982 }
4983
4984 /* module stacking operations */
4985 static int selinux_register_security (const char *name, struct security_operations *ops)
4986 {
4987         if (secondary_ops != original_ops) {
4988                 printk(KERN_ERR "%s:  There is already a secondary security "
4989                        "module registered.\n", __FUNCTION__);
4990                 return -EINVAL;
4991         }
4992
4993         secondary_ops = ops;
4994
4995         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4996                __FUNCTION__,
4997                name);
4998
4999         return 0;
5000 }
5001
5002 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5003 {
5004         if (inode)
5005                 inode_doinit_with_dentry(inode, dentry);
5006 }
5007
5008 static int selinux_getprocattr(struct task_struct *p,
5009                                char *name, char **value)
5010 {
5011         struct task_security_struct *tsec;
5012         u32 sid;
5013         int error;
5014         unsigned len;
5015
5016         if (current != p) {
5017                 error = task_has_perm(current, p, PROCESS__GETATTR);
5018                 if (error)
5019                         return error;
5020         }
5021
5022         tsec = p->security;
5023
5024         if (!strcmp(name, "current"))
5025                 sid = tsec->sid;
5026         else if (!strcmp(name, "prev"))
5027                 sid = tsec->osid;
5028         else if (!strcmp(name, "exec"))
5029                 sid = tsec->exec_sid;
5030         else if (!strcmp(name, "fscreate"))
5031                 sid = tsec->create_sid;
5032         else if (!strcmp(name, "keycreate"))
5033                 sid = tsec->keycreate_sid;
5034         else if (!strcmp(name, "sockcreate"))
5035                 sid = tsec->sockcreate_sid;
5036         else
5037                 return -EINVAL;
5038
5039         if (!sid)
5040                 return 0;
5041
5042         error = security_sid_to_context(sid, value, &len);
5043         if (error)
5044                 return error;
5045         return len;
5046 }
5047
5048 static int selinux_setprocattr(struct task_struct *p,
5049                                char *name, void *value, size_t size)
5050 {
5051         struct task_security_struct *tsec;
5052         u32 sid = 0;
5053         int error;
5054         char *str = value;
5055
5056         if (current != p) {
5057                 /* SELinux only allows a process to change its own
5058                    security attributes. */
5059                 return -EACCES;
5060         }
5061
5062         /*
5063          * Basic control over ability to set these attributes at all.
5064          * current == p, but we'll pass them separately in case the
5065          * above restriction is ever removed.
5066          */
5067         if (!strcmp(name, "exec"))
5068                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5069         else if (!strcmp(name, "fscreate"))
5070                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5071         else if (!strcmp(name, "keycreate"))
5072                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5073         else if (!strcmp(name, "sockcreate"))
5074                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5075         else if (!strcmp(name, "current"))
5076                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5077         else
5078                 error = -EINVAL;
5079         if (error)
5080                 return error;
5081
5082         /* Obtain a SID for the context, if one was specified. */
5083         if (size && str[1] && str[1] != '\n') {
5084                 if (str[size-1] == '\n') {
5085                         str[size-1] = 0;
5086                         size--;
5087                 }
5088                 error = security_context_to_sid(value, size, &sid);
5089                 if (error)
5090                         return error;
5091         }
5092
5093         /* Permission checking based on the specified context is
5094            performed during the actual operation (execve,
5095            open/mkdir/...), when we know the full context of the
5096            operation.  See selinux_bprm_set_security for the execve
5097            checks and may_create for the file creation checks. The
5098            operation will then fail if the context is not permitted. */
5099         tsec = p->security;
5100         if (!strcmp(name, "exec"))
5101                 tsec->exec_sid = sid;
5102         else if (!strcmp(name, "fscreate"))
5103                 tsec->create_sid = sid;
5104         else if (!strcmp(name, "keycreate")) {
5105                 error = may_create_key(sid, p);
5106                 if (error)
5107                         return error;
5108                 tsec->keycreate_sid = sid;
5109         } else if (!strcmp(name, "sockcreate"))
5110                 tsec->sockcreate_sid = sid;
5111         else if (!strcmp(name, "current")) {
5112                 struct av_decision avd;
5113
5114                 if (sid == 0)
5115                         return -EINVAL;
5116
5117                 /* Only allow single threaded processes to change context */
5118                 if (atomic_read(&p->mm->mm_users) != 1) {
5119                         struct task_struct *g, *t;
5120                         struct mm_struct *mm = p->mm;
5121                         read_lock(&tasklist_lock);
5122                         do_each_thread(g, t)
5123                                 if (t->mm == mm && t != p) {
5124                                         read_unlock(&tasklist_lock);
5125                                         return -EPERM;
5126                                 }
5127                         while_each_thread(g, t);
5128                         read_unlock(&tasklist_lock);
5129                 }
5130
5131                 /* Check permissions for the transition. */
5132                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5133                                      PROCESS__DYNTRANSITION, NULL);
5134                 if (error)
5135                         return error;
5136
5137                 /* Check for ptracing, and update the task SID if ok.
5138                    Otherwise, leave SID unchanged and fail. */
5139                 task_lock(p);
5140                 if (p->ptrace & PT_PTRACED) {
5141                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5142                                                      SECCLASS_PROCESS,
5143                                                      PROCESS__PTRACE, 0, &avd);
5144                         if (!error)
5145                                 tsec->sid = sid;
5146                         task_unlock(p);
5147                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5148                                   PROCESS__PTRACE, &avd, error, NULL);
5149                         if (error)
5150                                 return error;
5151                 } else {
5152                         tsec->sid = sid;
5153                         task_unlock(p);
5154                 }
5155         }
5156         else
5157                 return -EINVAL;
5158
5159         return size;
5160 }
5161
5162 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5163 {
5164         return security_sid_to_context(secid, secdata, seclen);
5165 }
5166
5167 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5168 {
5169         return security_context_to_sid(secdata, seclen, secid);
5170 }
5171
5172 static void selinux_release_secctx(char *secdata, u32 seclen)
5173 {
5174         kfree(secdata);
5175 }
5176
5177 #ifdef CONFIG_KEYS
5178
5179 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5180                              unsigned long flags)
5181 {
5182         struct task_security_struct *tsec = tsk->security;
5183         struct key_security_struct *ksec;
5184
5185         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5186         if (!ksec)
5187                 return -ENOMEM;
5188
5189         ksec->obj = k;
5190         if (tsec->keycreate_sid)
5191                 ksec->sid = tsec->keycreate_sid;
5192         else
5193                 ksec->sid = tsec->sid;
5194         k->security = ksec;
5195
5196         return 0;
5197 }
5198
5199 static void selinux_key_free(struct key *k)
5200 {
5201         struct key_security_struct *ksec = k->security;
5202
5203         k->security = NULL;
5204         kfree(ksec);
5205 }
5206
5207 static int selinux_key_permission(key_ref_t key_ref,
5208                             struct task_struct *ctx,
5209                             key_perm_t perm)
5210 {
5211         struct key *key;
5212         struct task_security_struct *tsec;
5213         struct key_security_struct *ksec;
5214
5215         key = key_ref_to_ptr(key_ref);
5216
5217         tsec = ctx->security;
5218         ksec = key->security;
5219
5220         /* if no specific permissions are requested, we skip the
5221            permission check. No serious, additional covert channels
5222            appear to be created. */
5223         if (perm == 0)
5224                 return 0;
5225
5226         return avc_has_perm(tsec->sid, ksec->sid,
5227                             SECCLASS_KEY, perm, NULL);
5228 }
5229
5230 #endif
5231
5232 static struct security_operations selinux_ops = {
5233         .ptrace =                       selinux_ptrace,
5234         .capget =                       selinux_capget,
5235         .capset_check =                 selinux_capset_check,
5236         .capset_set =                   selinux_capset_set,
5237         .sysctl =                       selinux_sysctl,
5238         .capable =                      selinux_capable,
5239         .quotactl =                     selinux_quotactl,
5240         .quota_on =                     selinux_quota_on,
5241         .syslog =                       selinux_syslog,
5242         .vm_enough_memory =             selinux_vm_enough_memory,
5243
5244         .netlink_send =                 selinux_netlink_send,
5245         .netlink_recv =                 selinux_netlink_recv,
5246
5247         .bprm_alloc_security =          selinux_bprm_alloc_security,
5248         .bprm_free_security =           selinux_bprm_free_security,
5249         .bprm_apply_creds =             selinux_bprm_apply_creds,
5250         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5251         .bprm_set_security =            selinux_bprm_set_security,
5252         .bprm_check_security =          selinux_bprm_check_security,
5253         .bprm_secureexec =              selinux_bprm_secureexec,
5254
5255         .sb_alloc_security =            selinux_sb_alloc_security,
5256         .sb_free_security =             selinux_sb_free_security,
5257         .sb_copy_data =                 selinux_sb_copy_data,
5258         .sb_kern_mount =                selinux_sb_kern_mount,
5259         .sb_statfs =                    selinux_sb_statfs,
5260         .sb_mount =                     selinux_mount,
5261         .sb_umount =                    selinux_umount,
5262         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5263         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5264         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5265         .sb_parse_opts_str =            selinux_parse_opts_str,
5266
5267
5268         .inode_alloc_security =         selinux_inode_alloc_security,
5269         .inode_free_security =          selinux_inode_free_security,
5270         .inode_init_security =          selinux_inode_init_security,
5271         .inode_create =                 selinux_inode_create,
5272         .inode_link =                   selinux_inode_link,
5273         .inode_unlink =                 selinux_inode_unlink,
5274         .inode_symlink =                selinux_inode_symlink,
5275         .inode_mkdir =                  selinux_inode_mkdir,
5276         .inode_rmdir =                  selinux_inode_rmdir,
5277         .inode_mknod =                  selinux_inode_mknod,
5278         .inode_rename =                 selinux_inode_rename,
5279         .inode_readlink =               selinux_inode_readlink,
5280         .inode_follow_link =            selinux_inode_follow_link,
5281         .inode_permission =             selinux_inode_permission,
5282         .inode_setattr =                selinux_inode_setattr,
5283         .inode_getattr =                selinux_inode_getattr,
5284         .inode_setxattr =               selinux_inode_setxattr,
5285         .inode_post_setxattr =          selinux_inode_post_setxattr,
5286         .inode_getxattr =               selinux_inode_getxattr,
5287         .inode_listxattr =              selinux_inode_listxattr,
5288         .inode_removexattr =            selinux_inode_removexattr,
5289         .inode_getsecurity =            selinux_inode_getsecurity,
5290         .inode_setsecurity =            selinux_inode_setsecurity,
5291         .inode_listsecurity =           selinux_inode_listsecurity,
5292         .inode_need_killpriv =          selinux_inode_need_killpriv,
5293         .inode_killpriv =               selinux_inode_killpriv,
5294
5295         .file_permission =              selinux_file_permission,
5296         .file_alloc_security =          selinux_file_alloc_security,
5297         .file_free_security =           selinux_file_free_security,
5298         .file_ioctl =                   selinux_file_ioctl,
5299         .file_mmap =                    selinux_file_mmap,
5300         .file_mprotect =                selinux_file_mprotect,
5301         .file_lock =                    selinux_file_lock,
5302         .file_fcntl =                   selinux_file_fcntl,
5303         .file_set_fowner =              selinux_file_set_fowner,
5304         .file_send_sigiotask =          selinux_file_send_sigiotask,
5305         .file_receive =                 selinux_file_receive,
5306
5307         .dentry_open =                  selinux_dentry_open,
5308
5309         .task_create =                  selinux_task_create,
5310         .task_alloc_security =          selinux_task_alloc_security,
5311         .task_free_security =           selinux_task_free_security,
5312         .task_setuid =                  selinux_task_setuid,
5313         .task_post_setuid =             selinux_task_post_setuid,
5314         .task_setgid =                  selinux_task_setgid,
5315         .task_setpgid =                 selinux_task_setpgid,
5316         .task_getpgid =                 selinux_task_getpgid,
5317         .task_getsid =                  selinux_task_getsid,
5318         .task_getsecid =                selinux_task_getsecid,
5319         .task_setgroups =               selinux_task_setgroups,
5320         .task_setnice =                 selinux_task_setnice,
5321         .task_setioprio =               selinux_task_setioprio,
5322         .task_getioprio =               selinux_task_getioprio,
5323         .task_setrlimit =               selinux_task_setrlimit,
5324         .task_setscheduler =            selinux_task_setscheduler,
5325         .task_getscheduler =            selinux_task_getscheduler,
5326         .task_movememory =              selinux_task_movememory,
5327         .task_kill =                    selinux_task_kill,
5328         .task_wait =                    selinux_task_wait,
5329         .task_prctl =                   selinux_task_prctl,
5330         .task_reparent_to_init =        selinux_task_reparent_to_init,
5331         .task_to_inode =                selinux_task_to_inode,
5332
5333         .ipc_permission =               selinux_ipc_permission,
5334
5335         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5336         .msg_msg_free_security =        selinux_msg_msg_free_security,
5337
5338         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5339         .msg_queue_free_security =      selinux_msg_queue_free_security,
5340         .msg_queue_associate =          selinux_msg_queue_associate,
5341         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5342         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5343         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5344
5345         .shm_alloc_security =           selinux_shm_alloc_security,
5346         .shm_free_security =            selinux_shm_free_security,
5347         .shm_associate =                selinux_shm_associate,
5348         .shm_shmctl =                   selinux_shm_shmctl,
5349         .shm_shmat =                    selinux_shm_shmat,
5350
5351         .sem_alloc_security =           selinux_sem_alloc_security,
5352         .sem_free_security =            selinux_sem_free_security,
5353         .sem_associate =                selinux_sem_associate,
5354         .sem_semctl =                   selinux_sem_semctl,
5355         .sem_semop =                    selinux_sem_semop,
5356
5357         .register_security =            selinux_register_security,
5358
5359         .d_instantiate =                selinux_d_instantiate,
5360
5361         .getprocattr =                  selinux_getprocattr,
5362         .setprocattr =                  selinux_setprocattr,
5363
5364         .secid_to_secctx =              selinux_secid_to_secctx,
5365         .secctx_to_secid =              selinux_secctx_to_secid,
5366         .release_secctx =               selinux_release_secctx,
5367
5368         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5369         .unix_may_send =                selinux_socket_unix_may_send,
5370
5371         .socket_create =                selinux_socket_create,
5372         .socket_post_create =           selinux_socket_post_create,
5373         .socket_bind =                  selinux_socket_bind,
5374         .socket_connect =               selinux_socket_connect,
5375         .socket_listen =                selinux_socket_listen,
5376         .socket_accept =                selinux_socket_accept,
5377         .socket_sendmsg =               selinux_socket_sendmsg,
5378         .socket_recvmsg =               selinux_socket_recvmsg,
5379         .socket_getsockname =           selinux_socket_getsockname,
5380         .socket_getpeername =           selinux_socket_getpeername,
5381         .socket_getsockopt =            selinux_socket_getsockopt,
5382         .socket_setsockopt =            selinux_socket_setsockopt,
5383         .socket_shutdown =              selinux_socket_shutdown,
5384         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5385         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5386         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5387         .sk_alloc_security =            selinux_sk_alloc_security,
5388         .sk_free_security =             selinux_sk_free_security,
5389         .sk_clone_security =            selinux_sk_clone_security,
5390         .sk_getsecid =                  selinux_sk_getsecid,
5391         .sock_graft =                   selinux_sock_graft,
5392         .inet_conn_request =            selinux_inet_conn_request,
5393         .inet_csk_clone =               selinux_inet_csk_clone,
5394         .inet_conn_established =        selinux_inet_conn_established,
5395         .req_classify_flow =            selinux_req_classify_flow,
5396
5397 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5398         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5399         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5400         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5401         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5402         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5403         .xfrm_state_free_security =     selinux_xfrm_state_free,
5404         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5405         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5406         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5407         .xfrm_decode_session =          selinux_xfrm_decode_session,
5408 #endif
5409
5410 #ifdef CONFIG_KEYS
5411         .key_alloc =                    selinux_key_alloc,
5412         .key_free =                     selinux_key_free,
5413         .key_permission =               selinux_key_permission,
5414 #endif
5415 };
5416
5417 static __init int selinux_init(void)
5418 {
5419         struct task_security_struct *tsec;
5420
5421         if (!selinux_enabled) {
5422                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5423                 return 0;
5424         }
5425
5426         printk(KERN_INFO "SELinux:  Initializing.\n");
5427
5428         /* Set the security state for the initial task. */
5429         if (task_alloc_security(current))
5430                 panic("SELinux:  Failed to initialize initial task.\n");
5431         tsec = current->security;
5432         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5433
5434         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5435                                             sizeof(struct inode_security_struct),
5436                                             0, SLAB_PANIC, NULL);
5437         avc_init();
5438
5439         original_ops = secondary_ops = security_ops;
5440         if (!secondary_ops)
5441                 panic ("SELinux: No initial security operations\n");
5442         if (register_security (&selinux_ops))
5443                 panic("SELinux: Unable to register with kernel.\n");
5444
5445         if (selinux_enforcing) {
5446                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5447         } else {
5448                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5449         }
5450
5451 #ifdef CONFIG_KEYS
5452         /* Add security information to initial keyrings */
5453         selinux_key_alloc(&root_user_keyring, current,
5454                           KEY_ALLOC_NOT_IN_QUOTA);
5455         selinux_key_alloc(&root_session_keyring, current,
5456                           KEY_ALLOC_NOT_IN_QUOTA);
5457 #endif
5458
5459         return 0;
5460 }
5461
5462 void selinux_complete_init(void)
5463 {
5464         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5465
5466         /* Set up any superblocks initialized prior to the policy load. */
5467         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5468         spin_lock(&sb_lock);
5469         spin_lock(&sb_security_lock);
5470 next_sb:
5471         if (!list_empty(&superblock_security_head)) {
5472                 struct superblock_security_struct *sbsec =
5473                                 list_entry(superblock_security_head.next,
5474                                            struct superblock_security_struct,
5475                                            list);
5476                 struct super_block *sb = sbsec->sb;
5477                 sb->s_count++;
5478                 spin_unlock(&sb_security_lock);
5479                 spin_unlock(&sb_lock);
5480                 down_read(&sb->s_umount);
5481                 if (sb->s_root)
5482                         superblock_doinit(sb, NULL);
5483                 drop_super(sb);
5484                 spin_lock(&sb_lock);
5485                 spin_lock(&sb_security_lock);
5486                 list_del_init(&sbsec->list);
5487                 goto next_sb;
5488         }
5489         spin_unlock(&sb_security_lock);
5490         spin_unlock(&sb_lock);
5491 }
5492
5493 /* SELinux requires early initialization in order to label
5494    all processes and objects when they are created. */
5495 security_initcall(selinux_init);
5496
5497 #if defined(CONFIG_NETFILTER)
5498
5499 static struct nf_hook_ops selinux_ipv4_ops[] = {
5500         {
5501                 .hook =         selinux_ipv4_postroute,
5502                 .owner =        THIS_MODULE,
5503                 .pf =           PF_INET,
5504                 .hooknum =      NF_INET_POST_ROUTING,
5505                 .priority =     NF_IP_PRI_SELINUX_LAST,
5506         },
5507         {
5508                 .hook =         selinux_ipv4_forward,
5509                 .owner =        THIS_MODULE,
5510                 .pf =           PF_INET,
5511                 .hooknum =      NF_INET_FORWARD,
5512                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5513         }
5514 };
5515
5516 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5517
5518 static struct nf_hook_ops selinux_ipv6_ops[] = {
5519         {
5520                 .hook =         selinux_ipv6_postroute,
5521                 .owner =        THIS_MODULE,
5522                 .pf =           PF_INET6,
5523                 .hooknum =      NF_INET_POST_ROUTING,
5524                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5525         },
5526         {
5527                 .hook =         selinux_ipv6_forward,
5528                 .owner =        THIS_MODULE,
5529                 .pf =           PF_INET6,
5530                 .hooknum =      NF_INET_FORWARD,
5531                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5532         }
5533 };
5534
5535 #endif  /* IPV6 */
5536
5537 static int __init selinux_nf_ip_init(void)
5538 {
5539         int err = 0;
5540         u32 iter;
5541
5542         if (!selinux_enabled)
5543                 goto out;
5544
5545         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5546
5547         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5548                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5549                 if (err)
5550                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5551                               err);
5552         }
5553
5554 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5555         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5556                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5557                 if (err)
5558                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5559                               err);
5560         }
5561 #endif  /* IPV6 */
5562
5563 out:
5564         return err;
5565 }
5566
5567 __initcall(selinux_nf_ip_init);
5568
5569 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5570 static void selinux_nf_ip_exit(void)
5571 {
5572         u32 iter;
5573
5574         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5575
5576         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5577                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5578 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5579         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5580                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5581 #endif  /* IPV6 */
5582 }
5583 #endif
5584
5585 #else /* CONFIG_NETFILTER */
5586
5587 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5588 #define selinux_nf_ip_exit()
5589 #endif
5590
5591 #endif /* CONFIG_NETFILTER */
5592
5593 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5594 int selinux_disable(void)
5595 {
5596         extern void exit_sel_fs(void);
5597         static int selinux_disabled = 0;
5598
5599         if (ss_initialized) {
5600                 /* Not permitted after initial policy load. */
5601                 return -EINVAL;
5602         }
5603
5604         if (selinux_disabled) {
5605                 /* Only do this once. */
5606                 return -EINVAL;
5607         }
5608
5609         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5610
5611         selinux_disabled = 1;
5612         selinux_enabled = 0;
5613
5614         /* Reset security_ops to the secondary module, dummy or capability. */
5615         security_ops = secondary_ops;
5616
5617         /* Unregister netfilter hooks. */
5618         selinux_nf_ip_exit();
5619
5620         /* Unregister selinuxfs. */
5621         exit_sel_fs();
5622
5623         return 0;
5624 }
5625 #endif
5626
5627