security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76
  77 #define XATTR_SELINUX_SUFFIX "selinux"
  78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  79
  80 extern unsigned int policydb_loaded_version;
  81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  82
  83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  84 int selinux_enforcing = 0;
  85
  86 static int __init enforcing_setup(char *str)
  87 {
  88         selinux_enforcing = simple_strtol(str,NULL,0);
  89         return 1;
  90 }
  91 __setup("enforcing=", enforcing_setup);
  92 #endif
  93
  94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  96
  97 static int __init selinux_enabled_setup(char *str)
  98 {
  99         selinux_enabled = simple_strtol(str, NULL, 0);
 100         return 1;
 101 }
 102 __setup("selinux=", selinux_enabled_setup);
 103 #endif
 104
 105 /* Original (dummy) security module. */
 106 static struct security_operations *original_ops = NULL;
 107
 108 /* Minimal support for a secondary security module,
 109    just to allow the use of the dummy or capability modules.
 110    The owlsm module can alternatively be used as a secondary
 111    module as long as CONFIG_OWLSM_FD is not enabled. */
 112 static struct security_operations *secondary_ops = NULL;
 113
 114 /* Lists of inode and superblock security structures initialized
 115    before the policy was loaded. */
 116 static LIST_HEAD(superblock_security_head);
 117 static DEFINE_SPINLOCK(sb_security_lock);
 118
 119 /* Allocate and free functions for each kind of security blob. */
 120
 121 static int task_alloc_security(struct task_struct *task)
 122 {
 123         struct task_security_struct *tsec;
 124
 125         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 126         if (!tsec)
 127                 return -ENOMEM;
 128
 129         memset(tsec, 0, sizeof(struct task_security_struct));
 130         tsec->magic = SELINUX_MAGIC;
 131         tsec->task = task;
 132         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 133         task->security = tsec;
 134
 135         return 0;
 136 }
 137
 138 static void task_free_security(struct task_struct *task)
 139 {
 140         struct task_security_struct *tsec = task->security;
 141
 142         if (!tsec || tsec->magic != SELINUX_MAGIC)
 143                 return;
 144
 145         task->security = NULL;
 146         kfree(tsec);
 147 }
 148
 149 static int inode_alloc_security(struct inode *inode)
 150 {
 151         struct task_security_struct *tsec = current->security;
 152         struct inode_security_struct *isec;
 153
 154         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 155         if (!isec)
 156                 return -ENOMEM;
 157
 158         memset(isec, 0, sizeof(struct inode_security_struct));
 159         init_MUTEX(&isec->sem);
 160         INIT_LIST_HEAD(&isec->list);
 161         isec->magic = SELINUX_MAGIC;
 162         isec->inode = inode;
 163         isec->sid = SECINITSID_UNLABELED;
 164         isec->sclass = SECCLASS_FILE;
 165         if (tsec && tsec->magic == SELINUX_MAGIC)
 166                 isec->task_sid = tsec->sid;
 167         else
 168                 isec->task_sid = SECINITSID_UNLABELED;
 169         inode->i_security = isec;
 170
 171         return 0;
 172 }
 173
 174 static void inode_free_security(struct inode *inode)
 175 {
 176         struct inode_security_struct *isec = inode->i_security;
 177         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 178
 179         if (!isec || isec->magic != SELINUX_MAGIC)
 180                 return;
 181
 182         spin_lock(&sbsec->isec_lock);
 183         if (!list_empty(&isec->list))
 184                 list_del_init(&isec->list);
 185         spin_unlock(&sbsec->isec_lock);
 186
 187         inode->i_security = NULL;
 188         kfree(isec);
 189 }
 190
 191 static int file_alloc_security(struct file *file)
 192 {
 193         struct task_security_struct *tsec = current->security;
 194         struct file_security_struct *fsec;
 195
 196         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 197         if (!fsec)
 198                 return -ENOMEM;
 199
 200         memset(fsec, 0, sizeof(struct file_security_struct));
 201         fsec->magic = SELINUX_MAGIC;
 202         fsec->file = file;
 203         if (tsec && tsec->magic == SELINUX_MAGIC) {
 204                 fsec->sid = tsec->sid;
 205                 fsec->fown_sid = tsec->sid;
 206         } else {
 207                 fsec->sid = SECINITSID_UNLABELED;
 208                 fsec->fown_sid = SECINITSID_UNLABELED;
 209         }
 210         file->f_security = fsec;
 211
 212         return 0;
 213 }
 214
 215 static void file_free_security(struct file *file)
 216 {
 217         struct file_security_struct *fsec = file->f_security;
 218
 219         if (!fsec || fsec->magic != SELINUX_MAGIC)
 220                 return;
 221
 222         file->f_security = NULL;
 223         kfree(fsec);
 224 }
 225
 226 static int superblock_alloc_security(struct super_block *sb)
 227 {
 228         struct superblock_security_struct *sbsec;
 229
 230         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 231         if (!sbsec)
 232                 return -ENOMEM;
 233
 234         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 235         init_MUTEX(&sbsec->sem);
 236         INIT_LIST_HEAD(&sbsec->list);
 237         INIT_LIST_HEAD(&sbsec->isec_head);
 238         spin_lock_init(&sbsec->isec_lock);
 239         sbsec->magic = SELINUX_MAGIC;
 240         sbsec->sb = sb;
 241         sbsec->sid = SECINITSID_UNLABELED;
 242         sbsec->def_sid = SECINITSID_FILE;
 243         sb->s_security = sbsec;
 244
 245         return 0;
 246 }
 247
 248 static void superblock_free_security(struct super_block *sb)
 249 {
 250         struct superblock_security_struct *sbsec = sb->s_security;
 251
 252         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 253                 return;
 254
 255         spin_lock(&sb_security_lock);
 256         if (!list_empty(&sbsec->list))
 257                 list_del_init(&sbsec->list);
 258         spin_unlock(&sb_security_lock);
 259
 260         sb->s_security = NULL;
 261         kfree(sbsec);
 262 }
 263
 264 #ifdef CONFIG_SECURITY_NETWORK
 265 static int sk_alloc_security(struct sock *sk, int family, int priority)
 266 {
 267         struct sk_security_struct *ssec;
 268
 269         if (family != PF_UNIX)
 270                 return 0;
 271
 272         ssec = kmalloc(sizeof(*ssec), priority);
 273         if (!ssec)
 274                 return -ENOMEM;
 275
 276         memset(ssec, 0, sizeof(*ssec));
 277         ssec->magic = SELINUX_MAGIC;
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         sk->sk_security = ssec;
 281
 282         return 0;
 283 }
 284
 285 static void sk_free_security(struct sock *sk)
 286 {
 287         struct sk_security_struct *ssec = sk->sk_security;
 288
 289         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 290                 return;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295 #endif  /* CONFIG_SECURITY_NETWORK */
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329 };
 330
 331 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 332
 333 static int try_context_mount(struct super_block *sb, void *data)
 334 {
 335         char *context = NULL, *defcontext = NULL;
 336         const char *name;
 337         u32 sid;
 338         int alloc = 0, rc = 0, seen = 0;
 339         struct task_security_struct *tsec = current->security;
 340         struct superblock_security_struct *sbsec = sb->s_security;
 341
 342         if (!data)
 343                 goto out;
 344
 345         name = sb->s_type->name;
 346
 347         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 348
 349                 /* NFS we understand. */
 350                 if (!strcmp(name, "nfs")) {
 351                         struct nfs_mount_data *d = data;
 352
 353                         if (d->version <  NFS_MOUNT_VERSION)
 354                                 goto out;
 355
 356                         if (d->context[0]) {
 357                                 context = d->context;
 358                                 seen |= Opt_context;
 359                         }
 360                 } else
 361                         goto out;
 362
 363         } else {
 364                 /* Standard string-based options. */
 365                 char *p, *options = data;
 366
 367                 while ((p = strsep(&options, ",")) != NULL) {
 368                         int token;
 369                         substring_t args[MAX_OPT_ARGS];
 370
 371                         if (!*p)
 372                                 continue;
 373
 374                         token = match_token(p, tokens, args);
 375
 376                         switch (token) {
 377                         case Opt_context:
 378                                 if (seen) {
 379                                         rc = -EINVAL;
 380                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 381                                         goto out_free;
 382                                 }
 383                                 context = match_strdup(&args[0]);
 384                                 if (!context) {
 385                                         rc = -ENOMEM;
 386                                         goto out_free;
 387                                 }
 388                                 if (!alloc)
 389                                         alloc = 1;
 390                                 seen |= Opt_context;
 391                                 break;
 392
 393                         case Opt_fscontext:
 394                                 if (seen & (Opt_context|Opt_fscontext)) {
 395                                         rc = -EINVAL;
 396                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 397                                         goto out_free;
 398                                 }
 399                                 context = match_strdup(&args[0]);
 400                                 if (!context) {
 401                                         rc = -ENOMEM;
 402                                         goto out_free;
 403                                 }
 404                                 if (!alloc)
 405                                         alloc = 1;
 406                                 seen |= Opt_fscontext;
 407                                 break;
 408
 409                         case Opt_defcontext:
 410                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 411                                         rc = -EINVAL;
 412                                         printk(KERN_WARNING "SELinux:  "
 413                                                "defcontext option is invalid "
 414                                                "for this filesystem type\n");
 415                                         goto out_free;
 416                                 }
 417                                 if (seen & (Opt_context|Opt_defcontext)) {
 418                                         rc = -EINVAL;
 419                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 420                                         goto out_free;
 421                                 }
 422                                 defcontext = match_strdup(&args[0]);
 423                                 if (!defcontext) {
 424                                         rc = -ENOMEM;
 425                                         goto out_free;
 426                                 }
 427                                 if (!alloc)
 428                                         alloc = 1;
 429                                 seen |= Opt_defcontext;
 430                                 break;
 431
 432                         default:
 433                                 rc = -EINVAL;
 434                                 printk(KERN_WARNING "SELinux:  unknown mount "
 435                                        "option\n");
 436                                 goto out_free;
 437
 438                         }
 439                 }
 440         }
 441
 442         if (!seen)
 443                 goto out;
 444
 445         if (context) {
 446                 rc = security_context_to_sid(context, strlen(context), &sid);
 447                 if (rc) {
 448                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 449                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 450                                context, sb->s_id, name, rc);
 451                         goto out_free;
 452                 }
 453
 454                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELFROM, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 460                                   FILESYSTEM__RELABELTO, NULL);
 461                 if (rc)
 462                         goto out_free;
 463
 464                 sbsec->sid = sid;
 465
 466                 if (seen & Opt_context)
 467                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 468         }
 469
 470         if (defcontext) {
 471                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 472                 if (rc) {
 473                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 474                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 475                                defcontext, sb->s_id, name, rc);
 476                         goto out_free;
 477                 }
 478
 479                 if (sid == sbsec->def_sid)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__RELABELFROM, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 488                                   FILESYSTEM__ASSOCIATE, NULL);
 489                 if (rc)
 490                         goto out_free;
 491
 492                 sbsec->def_sid = sid;
 493         }
 494
 495 out_free:
 496         if (alloc) {
 497                 kfree(context);
 498                 kfree(defcontext);
 499         }
 500 out:
 501         return rc;
 502 }
 503
 504 static int superblock_doinit(struct super_block *sb, void *data)
 505 {
 506         struct superblock_security_struct *sbsec = sb->s_security;
 507         struct dentry *root = sb->s_root;
 508         struct inode *inode = root->d_inode;
 509         int rc = 0;
 510
 511         down(&sbsec->sem);
 512         if (sbsec->initialized)
 513                 goto out;
 514
 515         if (!ss_initialized) {
 516                 /* Defer initialization until selinux_complete_init,
 517                    after the initial policy is loaded and the security
 518                    server is ready to handle calls. */
 519                 spin_lock(&sb_security_lock);
 520                 if (list_empty(&sbsec->list))
 521                         list_add(&sbsec->list, &superblock_security_head);
 522                 spin_unlock(&sb_security_lock);
 523                 goto out;
 524         }
 525
 526         /* Determine the labeling behavior to use for this filesystem type. */
 527         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 528         if (rc) {
 529                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 530                        __FUNCTION__, sb->s_type->name, rc);
 531                 goto out;
 532         }
 533
 534         rc = try_context_mount(sb, data);
 535         if (rc)
 536                 goto out;
 537
 538         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 539                 /* Make sure that the xattr handler exists and that no
 540                    error other than -ENODATA is returned by getxattr on
 541                    the root directory.  -ENODATA is ok, as this may be
 542                    the first boot of the SELinux kernel before we have
 543                    assigned xattr values to the filesystem. */
 544                 if (!inode->i_op->getxattr) {
 545                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 546                                "xattr support\n", sb->s_id, sb->s_type->name);
 547                         rc = -EOPNOTSUPP;
 548                         goto out;
 549                 }
 550                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 551                 if (rc < 0 && rc != -ENODATA) {
 552                         if (rc == -EOPNOTSUPP)
 553                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 554                                        "%s) has no security xattr handler\n",
 555                                        sb->s_id, sb->s_type->name);
 556                         else
 557                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 558                                        "%s) getxattr errno %d\n", sb->s_id,
 559                                        sb->s_type->name, -rc);
 560                         goto out;
 561                 }
 562         }
 563
 564         if (strcmp(sb->s_type->name, "proc") == 0)
 565                 sbsec->proc = 1;
 566
 567         sbsec->initialized = 1;
 568
 569         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 570                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 571                        sb->s_id, sb->s_type->name);
 572         }
 573         else {
 574                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 575                        sb->s_id, sb->s_type->name,
 576                        labeling_behaviors[sbsec->behavior-1]);
 577         }
 578
 579         /* Initialize the root inode. */
 580         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 581
 582         /* Initialize any other inodes associated with the superblock, e.g.
 583            inodes created prior to initial policy load or inodes created
 584            during get_sb by a pseudo filesystem that directly
 585            populates itself. */
 586         spin_lock(&sbsec->isec_lock);
 587 next_inode:
 588         if (!list_empty(&sbsec->isec_head)) {
 589                 struct inode_security_struct *isec =
 590                                 list_entry(sbsec->isec_head.next,
 591                                            struct inode_security_struct, list);
 592                 struct inode *inode = isec->inode;
 593                 spin_unlock(&sbsec->isec_lock);
 594                 inode = igrab(inode);
 595                 if (inode) {
 596                         if (!IS_PRIVATE (inode))
 597                                 inode_doinit(inode);
 598                         iput(inode);
 599                 }
 600                 spin_lock(&sbsec->isec_lock);
 601                 list_del_init(&isec->list);
 602                 goto next_inode;
 603         }
 604         spin_unlock(&sbsec->isec_lock);
 605 out:
 606         up(&sbsec->sem);
 607         return rc;
 608 }
 609
 610 static inline u16 inode_mode_to_security_class(umode_t mode)
 611 {
 612         switch (mode & S_IFMT) {
 613         case S_IFSOCK:
 614                 return SECCLASS_SOCK_FILE;
 615         case S_IFLNK:
 616                 return SECCLASS_LNK_FILE;
 617         case S_IFREG:
 618                 return SECCLASS_FILE;
 619         case S_IFBLK:
 620                 return SECCLASS_BLK_FILE;
 621         case S_IFDIR:
 622                 return SECCLASS_DIR;
 623         case S_IFCHR:
 624                 return SECCLASS_CHR_FILE;
 625         case S_IFIFO:
 626                 return SECCLASS_FIFO_FILE;
 627
 628         }
 629
 630         return SECCLASS_FILE;
 631 }
 632
 633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 634 {
 635         switch (family) {
 636         case PF_UNIX:
 637                 switch (type) {
 638                 case SOCK_STREAM:
 639                 case SOCK_SEQPACKET:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644                 break;
 645         case PF_INET:
 646         case PF_INET6:
 647                 switch (type) {
 648                 case SOCK_STREAM:
 649                         return SECCLASS_TCP_SOCKET;
 650                 case SOCK_DGRAM:
 651                         return SECCLASS_UDP_SOCKET;
 652                 case SOCK_RAW:
 653                         return SECCLASS_RAWIP_SOCKET;
 654                 }
 655                 break;
 656         case PF_NETLINK:
 657                 switch (protocol) {
 658                 case NETLINK_ROUTE:
 659                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 660                 case NETLINK_FIREWALL:
 661                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 662                 case NETLINK_INET_DIAG:
 663                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 664                 case NETLINK_NFLOG:
 665                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 666                 case NETLINK_XFRM:
 667                         return SECCLASS_NETLINK_XFRM_SOCKET;
 668                 case NETLINK_SELINUX:
 669                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 670                 case NETLINK_AUDIT:
 671                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 672                 case NETLINK_IP6_FW:
 673                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 674                 case NETLINK_DNRTMSG:
 675                         return SECCLASS_NETLINK_DNRT_SOCKET;
 676                 case NETLINK_KOBJECT_UEVENT:
 677                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 678                 default:
 679                         return SECCLASS_NETLINK_SOCKET;
 680                 }
 681         case PF_PACKET:
 682                 return SECCLASS_PACKET_SOCKET;
 683         case PF_KEY:
 684                 return SECCLASS_KEY_SOCKET;
 685         }
 686
 687         return SECCLASS_SOCKET;
 688 }
 689
 690 #ifdef CONFIG_PROC_FS
 691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 692                                 u16 tclass,
 693                                 u32 *sid)
 694 {
 695         int buflen, rc;
 696         char *buffer, *path, *end;
 697
 698         buffer = (char*)__get_free_page(GFP_KERNEL);
 699         if (!buffer)
 700                 return -ENOMEM;
 701
 702         buflen = PAGE_SIZE;
 703         end = buffer+buflen;
 704         *--end = '\0';
 705         buflen--;
 706         path = end-1;
 707         *path = '/';
 708         while (de && de != de->parent) {
 709                 buflen -= de->namelen + 1;
 710                 if (buflen < 0)
 711                         break;
 712                 end -= de->namelen;
 713                 memcpy(end, de->name, de->namelen);
 714                 *--end = '/';
 715                 path = end;
 716                 de = de->parent;
 717         }
 718         rc = security_genfs_sid("proc", path, tclass, sid);
 719         free_page((unsigned long)buffer);
 720         return rc;
 721 }
 722 #else
 723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 724                                 u16 tclass,
 725                                 u32 *sid)
 726 {
 727         return -EINVAL;
 728 }
 729 #endif
 730
 731 /* The inode's security attributes must be initialized before first use. */
 732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 733 {
 734         struct superblock_security_struct *sbsec = NULL;
 735         struct inode_security_struct *isec = inode->i_security;
 736         u32 sid;
 737         struct dentry *dentry;
 738 #define INITCONTEXTLEN 255
 739         char *context = NULL;
 740         unsigned len = 0;
 741         int rc = 0;
 742         int hold_sem = 0;
 743
 744         if (isec->initialized)
 745                 goto out;
 746
 747         down(&isec->sem);
 748         hold_sem = 1;
 749         if (isec->initialized)
 750                 goto out;
 751
 752         sbsec = inode->i_sb->s_security;
 753         if (!sbsec->initialized) {
 754                 /* Defer initialization until selinux_complete_init,
 755                    after the initial policy is loaded and the security
 756                    server is ready to handle calls. */
 757                 spin_lock(&sbsec->isec_lock);
 758                 if (list_empty(&isec->list))
 759                         list_add(&isec->list, &sbsec->isec_head);
 760                 spin_unlock(&sbsec->isec_lock);
 761                 goto out;
 762         }
 763
 764         switch (sbsec->behavior) {
 765         case SECURITY_FS_USE_XATTR:
 766                 if (!inode->i_op->getxattr) {
 767                         isec->sid = sbsec->def_sid;
 768                         break;
 769                 }
 770
 771                 /* Need a dentry, since the xattr API requires one.
 772                    Life would be simpler if we could just pass the inode. */
 773                 if (opt_dentry) {
 774                         /* Called from d_instantiate or d_splice_alias. */
 775                         dentry = dget(opt_dentry);
 776                 } else {
 777                         /* Called from selinux_complete_init, try to find a dentry. */
 778                         dentry = d_find_alias(inode);
 779                 }
 780                 if (!dentry) {
 781                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 782                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 783                                inode->i_ino);
 784                         goto out;
 785                 }
 786
 787                 len = INITCONTEXTLEN;
 788                 context = kmalloc(len, GFP_KERNEL);
 789                 if (!context) {
 790                         rc = -ENOMEM;
 791                         dput(dentry);
 792                         goto out;
 793                 }
 794                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                            context, len);
 796                 if (rc == -ERANGE) {
 797                         /* Need a larger buffer.  Query for the right size. */
 798                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 799                                                    NULL, 0);
 800                         if (rc < 0) {
 801                                 dput(dentry);
 802                                 goto out;
 803                         }
 804                         kfree(context);
 805                         len = rc;
 806                         context = kmalloc(len, GFP_KERNEL);
 807                         if (!context) {
 808                                 rc = -ENOMEM;
 809                                 dput(dentry);
 810                                 goto out;
 811                         }
 812                         rc = inode->i_op->getxattr(dentry,
 813                                                    XATTR_NAME_SELINUX,
 814                                                    context, len);
 815                 }
 816                 dput(dentry);
 817                 if (rc < 0) {
 818                         if (rc != -ENODATA) {
 819                                 printk(KERN_WARNING "%s:  getxattr returned "
 820                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 821                                        -rc, inode->i_sb->s_id, inode->i_ino);
 822                                 kfree(context);
 823                                 goto out;
 824                         }
 825                         /* Map ENODATA to the default file SID */
 826                         sid = sbsec->def_sid;
 827                         rc = 0;
 828                 } else {
 829                         rc = security_context_to_sid_default(context, rc, &sid,
 830                                                              sbsec->def_sid);
 831                         if (rc) {
 832                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 833                                        "returned %d for dev=%s ino=%ld\n",
 834                                        __FUNCTION__, context, -rc,
 835                                        inode->i_sb->s_id, inode->i_ino);
 836                                 kfree(context);
 837                                 /* Leave with the unlabeled SID */
 838                                 rc = 0;
 839                                 break;
 840                         }
 841                 }
 842                 kfree(context);
 843                 isec->sid = sid;
 844                 break;
 845         case SECURITY_FS_USE_TASK:
 846                 isec->sid = isec->task_sid;
 847                 break;
 848         case SECURITY_FS_USE_TRANS:
 849                 /* Default to the fs SID. */
 850                 isec->sid = sbsec->sid;
 851
 852                 /* Try to obtain a transition SID. */
 853                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 854                 rc = security_transition_sid(isec->task_sid,
 855                                              sbsec->sid,
 856                                              isec->sclass,
 857                                              &sid);
 858                 if (rc)
 859                         goto out;
 860                 isec->sid = sid;
 861                 break;
 862         default:
 863                 /* Default to the fs SID. */
 864                 isec->sid = sbsec->sid;
 865
 866                 if (sbsec->proc) {
 867                         struct proc_inode *proci = PROC_I(inode);
 868                         if (proci->pde) {
 869                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 870                                 rc = selinux_proc_get_sid(proci->pde,
 871                                                           isec->sclass,
 872                                                           &sid);
 873                                 if (rc)
 874                                         goto out;
 875                                 isec->sid = sid;
 876                         }
 877                 }
 878                 break;
 879         }
 880
 881         isec->initialized = 1;
 882
 883 out:
 884         if (isec->sclass == SECCLASS_FILE)
 885                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 886
 887         if (hold_sem)
 888                 up(&isec->sem);
 889         return rc;
 890 }
 891
 892 /* Convert a Linux signal to an access vector. */
 893 static inline u32 signal_to_av(int sig)
 894 {
 895         u32 perm = 0;
 896
 897         switch (sig) {
 898         case SIGCHLD:
 899                 /* Commonly granted from child to parent. */
 900                 perm = PROCESS__SIGCHLD;
 901                 break;
 902         case SIGKILL:
 903                 /* Cannot be caught or ignored */
 904                 perm = PROCESS__SIGKILL;
 905                 break;
 906         case SIGSTOP:
 907                 /* Cannot be caught or ignored */
 908                 perm = PROCESS__SIGSTOP;
 909                 break;
 910         default:
 911                 /* All other signals. */
 912                 perm = PROCESS__SIGNAL;
 913                 break;
 914         }
 915
 916         return perm;
 917 }
 918
 919 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 920    fork check, ptrace check, etc. */
 921 static int task_has_perm(struct task_struct *tsk1,
 922                          struct task_struct *tsk2,
 923                          u32 perms)
 924 {
 925         struct task_security_struct *tsec1, *tsec2;
 926
 927         tsec1 = tsk1->security;
 928         tsec2 = tsk2->security;
 929         return avc_has_perm(tsec1->sid, tsec2->sid,
 930                             SECCLASS_PROCESS, perms, NULL);
 931 }
 932
 933 /* Check whether a task is allowed to use a capability. */
 934 static int task_has_capability(struct task_struct *tsk,
 935                                int cap)
 936 {
 937         struct task_security_struct *tsec;
 938         struct avc_audit_data ad;
 939
 940         tsec = tsk->security;
 941
 942         AVC_AUDIT_DATA_INIT(&ad,CAP);
 943         ad.tsk = tsk;
 944         ad.u.cap = cap;
 945
 946         return avc_has_perm(tsec->sid, tsec->sid,
 947                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 948 }
 949
 950 /* Check whether a task is allowed to use a system operation. */
 951 static int task_has_system(struct task_struct *tsk,
 952                            u32 perms)
 953 {
 954         struct task_security_struct *tsec;
 955
 956         tsec = tsk->security;
 957
 958         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 959                             SECCLASS_SYSTEM, perms, NULL);
 960 }
 961
 962 /* Check whether a task has a particular permission to an inode.
 963    The 'adp' parameter is optional and allows other audit
 964    data to be passed (e.g. the dentry). */
 965 static int inode_has_perm(struct task_struct *tsk,
 966                           struct inode *inode,
 967                           u32 perms,
 968                           struct avc_audit_data *adp)
 969 {
 970         struct task_security_struct *tsec;
 971         struct inode_security_struct *isec;
 972         struct avc_audit_data ad;
 973
 974         tsec = tsk->security;
 975         isec = inode->i_security;
 976
 977         if (!adp) {
 978                 adp = &ad;
 979                 AVC_AUDIT_DATA_INIT(&ad, FS);
 980                 ad.u.fs.inode = inode;
 981         }
 982
 983         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 984 }
 985
 986 /* Same as inode_has_perm, but pass explicit audit data containing
 987    the dentry to help the auditing code to more easily generate the
 988    pathname if needed. */
 989 static inline int dentry_has_perm(struct task_struct *tsk,
 990                                   struct vfsmount *mnt,
 991                                   struct dentry *dentry,
 992                                   u32 av)
 993 {
 994         struct inode *inode = dentry->d_inode;
 995         struct avc_audit_data ad;
 996         AVC_AUDIT_DATA_INIT(&ad,FS);
 997         ad.u.fs.mnt = mnt;
 998         ad.u.fs.dentry = dentry;
 999         return inode_has_perm(tsk, inode, av, &ad);
1000 }
1001
1002 /* Check whether a task can use an open file descriptor to
1003    access an inode in a given way.  Check access to the
1004    descriptor itself, and then use dentry_has_perm to
1005    check a particular permission to the file.
1006    Access to the descriptor is implicitly granted if it
1007    has the same SID as the process.  If av is zero, then
1008    access to the file is not checked, e.g. for cases
1009    where only the descriptor is affected like seek. */
1010 static inline int file_has_perm(struct task_struct *tsk,
1011                                 struct file *file,
1012                                 u32 av)
1013 {
1014         struct task_security_struct *tsec = tsk->security;
1015         struct file_security_struct *fsec = file->f_security;
1016         struct vfsmount *mnt = file->f_vfsmnt;
1017         struct dentry *dentry = file->f_dentry;
1018         struct inode *inode = dentry->d_inode;
1019         struct avc_audit_data ad;
1020         int rc;
1021
1022         AVC_AUDIT_DATA_INIT(&ad, FS);
1023         ad.u.fs.mnt = mnt;
1024         ad.u.fs.dentry = dentry;
1025
1026         if (tsec->sid != fsec->sid) {
1027                 rc = avc_has_perm(tsec->sid, fsec->sid,
1028                                   SECCLASS_FD,
1029                                   FD__USE,
1030                                   &ad);
1031                 if (rc)
1032                         return rc;
1033         }
1034
1035         /* av is zero if only checking access to the descriptor. */
1036         if (av)
1037                 return inode_has_perm(tsk, inode, av, &ad);
1038
1039         return 0;
1040 }
1041
1042 /* Check whether a task can create a file. */
1043 static int may_create(struct inode *dir,
1044                       struct dentry *dentry,
1045                       u16 tclass)
1046 {
1047         struct task_security_struct *tsec;
1048         struct inode_security_struct *dsec;
1049         struct superblock_security_struct *sbsec;
1050         u32 newsid;
1051         struct avc_audit_data ad;
1052         int rc;
1053
1054         tsec = current->security;
1055         dsec = dir->i_security;
1056         sbsec = dir->i_sb->s_security;
1057
1058         AVC_AUDIT_DATA_INIT(&ad, FS);
1059         ad.u.fs.dentry = dentry;
1060
1061         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1062                           DIR__ADD_NAME | DIR__SEARCH,
1063                           &ad);
1064         if (rc)
1065                 return rc;
1066
1067         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1068                 newsid = tsec->create_sid;
1069         } else {
1070                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1071                                              &newsid);
1072                 if (rc)
1073                         return rc;
1074         }
1075
1076         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1077         if (rc)
1078                 return rc;
1079
1080         return avc_has_perm(newsid, sbsec->sid,
1081                             SECCLASS_FILESYSTEM,
1082                             FILESYSTEM__ASSOCIATE, &ad);
1083 }
1084
1085 #define MAY_LINK   0
1086 #define MAY_UNLINK 1
1087 #define MAY_RMDIR  2
1088
1089 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1090 static int may_link(struct inode *dir,
1091                     struct dentry *dentry,
1092                     int kind)
1093
1094 {
1095         struct task_security_struct *tsec;
1096         struct inode_security_struct *dsec, *isec;
1097         struct avc_audit_data ad;
1098         u32 av;
1099         int rc;
1100
1101         tsec = current->security;
1102         dsec = dir->i_security;
1103         isec = dentry->d_inode->i_security;
1104
1105         AVC_AUDIT_DATA_INIT(&ad, FS);
1106         ad.u.fs.dentry = dentry;
1107
1108         av = DIR__SEARCH;
1109         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1110         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1111         if (rc)
1112                 return rc;
1113
1114         switch (kind) {
1115         case MAY_LINK:
1116                 av = FILE__LINK;
1117                 break;
1118         case MAY_UNLINK:
1119                 av = FILE__UNLINK;
1120                 break;
1121         case MAY_RMDIR:
1122                 av = DIR__RMDIR;
1123                 break;
1124         default:
1125                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1126                 return 0;
1127         }
1128
1129         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1130         return rc;
1131 }
1132
1133 static inline int may_rename(struct inode *old_dir,
1134                              struct dentry *old_dentry,
1135                              struct inode *new_dir,
1136                              struct dentry *new_dentry)
1137 {
1138         struct task_security_struct *tsec;
1139         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1140         struct avc_audit_data ad;
1141         u32 av;
1142         int old_is_dir, new_is_dir;
1143         int rc;
1144
1145         tsec = current->security;
1146         old_dsec = old_dir->i_security;
1147         old_isec = old_dentry->d_inode->i_security;
1148         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1149         new_dsec = new_dir->i_security;
1150
1151         AVC_AUDIT_DATA_INIT(&ad, FS);
1152
1153         ad.u.fs.dentry = old_dentry;
1154         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1155                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1156         if (rc)
1157                 return rc;
1158         rc = avc_has_perm(tsec->sid, old_isec->sid,
1159                           old_isec->sclass, FILE__RENAME, &ad);
1160         if (rc)
1161                 return rc;
1162         if (old_is_dir && new_dir != old_dir) {
1163                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1164                                   old_isec->sclass, DIR__REPARENT, &ad);
1165                 if (rc)
1166                         return rc;
1167         }
1168
1169         ad.u.fs.dentry = new_dentry;
1170         av = DIR__ADD_NAME | DIR__SEARCH;
1171         if (new_dentry->d_inode)
1172                 av |= DIR__REMOVE_NAME;
1173         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1174         if (rc)
1175                 return rc;
1176         if (new_dentry->d_inode) {
1177                 new_isec = new_dentry->d_inode->i_security;
1178                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1179                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1180                                   new_isec->sclass,
1181                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1182                 if (rc)
1183                         return rc;
1184         }
1185
1186         return 0;
1187 }
1188
1189 /* Check whether a task can perform a filesystem operation. */
1190 static int superblock_has_perm(struct task_struct *tsk,
1191                                struct super_block *sb,
1192                                u32 perms,
1193                                struct avc_audit_data *ad)
1194 {
1195         struct task_security_struct *tsec;
1196         struct superblock_security_struct *sbsec;
1197
1198         tsec = tsk->security;
1199         sbsec = sb->s_security;
1200         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1201                             perms, ad);
1202 }
1203
1204 /* Convert a Linux mode and permission mask to an access vector. */
1205 static inline u32 file_mask_to_av(int mode, int mask)
1206 {
1207         u32 av = 0;
1208
1209         if ((mode & S_IFMT) != S_IFDIR) {
1210                 if (mask & MAY_EXEC)
1211                         av |= FILE__EXECUTE;
1212                 if (mask & MAY_READ)
1213                         av |= FILE__READ;
1214
1215                 if (mask & MAY_APPEND)
1216                         av |= FILE__APPEND;
1217                 else if (mask & MAY_WRITE)
1218                         av |= FILE__WRITE;
1219
1220         } else {
1221                 if (mask & MAY_EXEC)
1222                         av |= DIR__SEARCH;
1223                 if (mask & MAY_WRITE)
1224                         av |= DIR__WRITE;
1225                 if (mask & MAY_READ)
1226                         av |= DIR__READ;
1227         }
1228
1229         return av;
1230 }
1231
1232 /* Convert a Linux file to an access vector. */
1233 static inline u32 file_to_av(struct file *file)
1234 {
1235         u32 av = 0;
1236
1237         if (file->f_mode & FMODE_READ)
1238                 av |= FILE__READ;
1239         if (file->f_mode & FMODE_WRITE) {
1240                 if (file->f_flags & O_APPEND)
1241                         av |= FILE__APPEND;
1242                 else
1243                         av |= FILE__WRITE;
1244         }
1245
1246         return av;
1247 }
1248
1249 /* Set an inode's SID to a specified value. */
1250 static int inode_security_set_sid(struct inode *inode, u32 sid)
1251 {
1252         struct inode_security_struct *isec = inode->i_security;
1253         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1254
1255         if (!sbsec->initialized) {
1256                 /* Defer initialization to selinux_complete_init. */
1257                 return 0;
1258         }
1259
1260         down(&isec->sem);
1261         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1262         isec->sid = sid;
1263         isec->initialized = 1;
1264         up(&isec->sem);
1265         return 0;
1266 }
1267
1268 /* Hook functions begin here. */
1269
1270 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1271 {
1272         struct task_security_struct *psec = parent->security;
1273         struct task_security_struct *csec = child->security;
1274         int rc;
1275
1276         rc = secondary_ops->ptrace(parent,child);
1277         if (rc)
1278                 return rc;
1279
1280         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1281         /* Save the SID of the tracing process for later use in apply_creds. */
1282         if (!rc)
1283                 csec->ptrace_sid = psec->sid;
1284         return rc;
1285 }
1286
1287 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1288                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1289 {
1290         int error;
1291
1292         error = task_has_perm(current, target, PROCESS__GETCAP);
1293         if (error)
1294                 return error;
1295
1296         return secondary_ops->capget(target, effective, inheritable, permitted);
1297 }
1298
1299 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1300                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1301 {
1302         int error;
1303
1304         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1305         if (error)
1306                 return error;
1307
1308         return task_has_perm(current, target, PROCESS__SETCAP);
1309 }
1310
1311 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1312                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1313 {
1314         secondary_ops->capset_set(target, effective, inheritable, permitted);
1315 }
1316
1317 static int selinux_capable(struct task_struct *tsk, int cap)
1318 {
1319         int rc;
1320
1321         rc = secondary_ops->capable(tsk, cap);
1322         if (rc)
1323                 return rc;
1324
1325         return task_has_capability(tsk,cap);
1326 }
1327
1328 static int selinux_sysctl(ctl_table *table, int op)
1329 {
1330         int error = 0;
1331         u32 av;
1332         struct task_security_struct *tsec;
1333         u32 tsid;
1334         int rc;
1335
1336         rc = secondary_ops->sysctl(table, op);
1337         if (rc)
1338                 return rc;
1339
1340         tsec = current->security;
1341
1342         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1343                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1344         if (rc) {
1345                 /* Default to the well-defined sysctl SID. */
1346                 tsid = SECINITSID_SYSCTL;
1347         }
1348
1349         /* The op values are "defined" in sysctl.c, thereby creating
1350          * a bad coupling between this module and sysctl.c */
1351         if(op == 001) {
1352                 error = avc_has_perm(tsec->sid, tsid,
1353                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1354         } else {
1355                 av = 0;
1356                 if (op & 004)
1357                         av |= FILE__READ;
1358                 if (op & 002)
1359                         av |= FILE__WRITE;
1360                 if (av)
1361                         error = avc_has_perm(tsec->sid, tsid,
1362                                              SECCLASS_FILE, av, NULL);
1363         }
1364
1365         return error;
1366 }
1367
1368 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1369 {
1370         int rc = 0;
1371
1372         if (!sb)
1373                 return 0;
1374
1375         switch (cmds) {
1376                 case Q_SYNC:
1377                 case Q_QUOTAON:
1378                 case Q_QUOTAOFF:
1379                 case Q_SETINFO:
1380                 case Q_SETQUOTA:
1381                         rc = superblock_has_perm(current,
1382                                                  sb,
1383                                                  FILESYSTEM__QUOTAMOD, NULL);
1384                         break;
1385                 case Q_GETFMT:
1386                 case Q_GETINFO:
1387                 case Q_GETQUOTA:
1388                         rc = superblock_has_perm(current,
1389                                                  sb,
1390                                                  FILESYSTEM__QUOTAGET, NULL);
1391                         break;
1392                 default:
1393                         rc = 0;  /* let the kernel handle invalid cmds */
1394                         break;
1395         }
1396         return rc;
1397 }
1398
1399 static int selinux_quota_on(struct dentry *dentry)
1400 {
1401         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1402 }
1403
1404 static int selinux_syslog(int type)
1405 {
1406         int rc;
1407
1408         rc = secondary_ops->syslog(type);
1409         if (rc)
1410                 return rc;
1411
1412         switch (type) {
1413                 case 3:         /* Read last kernel messages */
1414                 case 10:        /* Return size of the log buffer */
1415                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1416                         break;
1417                 case 6:         /* Disable logging to console */
1418                 case 7:         /* Enable logging to console */
1419                 case 8:         /* Set level of messages printed to console */
1420                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1421                         break;
1422                 case 0:         /* Close log */
1423                 case 1:         /* Open log */
1424                 case 2:         /* Read from log */
1425                 case 4:         /* Read/clear last kernel messages */
1426                 case 5:         /* Clear ring buffer */
1427                 default:
1428                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1429                         break;
1430         }
1431         return rc;
1432 }
1433
1434 /*
1435  * Check that a process has enough memory to allocate a new virtual
1436  * mapping. 0 means there is enough memory for the allocation to
1437  * succeed and -ENOMEM implies there is not.
1438  *
1439  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1440  * if the capability is granted, but __vm_enough_memory requires 1 if
1441  * the capability is granted.
1442  *
1443  * Do not audit the selinux permission check, as this is applied to all
1444  * processes that allocate mappings.
1445  */
1446 static int selinux_vm_enough_memory(long pages)
1447 {
1448         int rc, cap_sys_admin = 0;
1449         struct task_security_struct *tsec = current->security;
1450
1451         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1452         if (rc == 0)
1453                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1454                                         SECCLASS_CAPABILITY,
1455                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1456                                         NULL);
1457
1458         if (rc == 0)
1459                 cap_sys_admin = 1;
1460
1461         return __vm_enough_memory(pages, cap_sys_admin);
1462 }
1463
1464 /* binprm security operations */
1465
1466 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1467 {
1468         struct bprm_security_struct *bsec;
1469
1470         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1471         if (!bsec)
1472                 return -ENOMEM;
1473
1474         memset(bsec, 0, sizeof *bsec);
1475         bsec->magic = SELINUX_MAGIC;
1476         bsec->bprm = bprm;
1477         bsec->sid = SECINITSID_UNLABELED;
1478         bsec->set = 0;
1479
1480         bprm->security = bsec;
1481         return 0;
1482 }
1483
1484 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1485 {
1486         struct task_security_struct *tsec;
1487         struct inode *inode = bprm->file->f_dentry->d_inode;
1488         struct inode_security_struct *isec;
1489         struct bprm_security_struct *bsec;
1490         u32 newsid;
1491         struct avc_audit_data ad;
1492         int rc;
1493
1494         rc = secondary_ops->bprm_set_security(bprm);
1495         if (rc)
1496                 return rc;
1497
1498         bsec = bprm->security;
1499
1500         if (bsec->set)
1501                 return 0;
1502
1503         tsec = current->security;
1504         isec = inode->i_security;
1505
1506         /* Default to the current task SID. */
1507         bsec->sid = tsec->sid;
1508
1509         /* Reset create SID on execve. */
1510         tsec->create_sid = 0;
1511
1512         if (tsec->exec_sid) {
1513                 newsid = tsec->exec_sid;
1514                 /* Reset exec SID on execve. */
1515                 tsec->exec_sid = 0;
1516         } else {
1517                 /* Check for a default transition on this program. */
1518                 rc = security_transition_sid(tsec->sid, isec->sid,
1519                                              SECCLASS_PROCESS, &newsid);
1520                 if (rc)
1521                         return rc;
1522         }
1523
1524         AVC_AUDIT_DATA_INIT(&ad, FS);
1525         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1526         ad.u.fs.dentry = bprm->file->f_dentry;
1527
1528         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1529                 newsid = tsec->sid;
1530
1531         if (tsec->sid == newsid) {
1532                 rc = avc_has_perm(tsec->sid, isec->sid,
1533                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1534                 if (rc)
1535                         return rc;
1536         } else {
1537                 /* Check permissions for the transition. */
1538                 rc = avc_has_perm(tsec->sid, newsid,
1539                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1540                 if (rc)
1541                         return rc;
1542
1543                 rc = avc_has_perm(newsid, isec->sid,
1544                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1545                 if (rc)
1546                         return rc;
1547
1548                 /* Clear any possibly unsafe personality bits on exec: */
1549                 current->personality &= ~PER_CLEAR_ON_SETID;
1550
1551                 /* Set the security field to the new SID. */
1552                 bsec->sid = newsid;
1553         }
1554
1555         bsec->set = 1;
1556         return 0;
1557 }
1558
1559 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1560 {
1561         return secondary_ops->bprm_check_security(bprm);
1562 }
1563
1564
1565 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1566 {
1567         struct task_security_struct *tsec = current->security;
1568         int atsecure = 0;
1569
1570         if (tsec->osid != tsec->sid) {
1571                 /* Enable secure mode for SIDs transitions unless
1572                    the noatsecure permission is granted between
1573                    the two SIDs, i.e. ahp returns 0. */
1574                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1575                                          SECCLASS_PROCESS,
1576                                          PROCESS__NOATSECURE, NULL);
1577         }
1578
1579         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1580 }
1581
1582 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1583 {
1584         kfree(bprm->security);
1585         bprm->security = NULL;
1586 }
1587
1588 extern struct vfsmount *selinuxfs_mount;
1589 extern struct dentry *selinux_null;
1590
1591 /* Derived from fs/exec.c:flush_old_files. */
1592 static inline void flush_unauthorized_files(struct files_struct * files)
1593 {
1594         struct avc_audit_data ad;
1595         struct file *file, *devnull = NULL;
1596         struct tty_struct *tty = current->signal->tty;
1597         struct fdtable *fdt;
1598         long j = -1;
1599
1600         if (tty) {
1601                 file_list_lock();
1602                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1603                 if (file) {
1604                         /* Revalidate access to controlling tty.
1605                            Use inode_has_perm on the tty inode directly rather
1606                            than using file_has_perm, as this particular open
1607                            file may belong to another process and we are only
1608                            interested in the inode-based check here. */
1609                         struct inode *inode = file->f_dentry->d_inode;
1610                         if (inode_has_perm(current, inode,
1611                                            FILE__READ | FILE__WRITE, NULL)) {
1612                                 /* Reset controlling tty. */
1613                                 current->signal->tty = NULL;
1614                                 current->signal->tty_old_pgrp = 0;
1615                         }
1616                 }
1617                 file_list_unlock();
1618         }
1619
1620         /* Revalidate access to inherited open files. */
1621
1622         AVC_AUDIT_DATA_INIT(&ad,FS);
1623
1624         spin_lock(&files->file_lock);
1625         for (;;) {
1626                 unsigned long set, i;
1627                 int fd;
1628
1629                 j++;
1630                 i = j * __NFDBITS;
1631                 fdt = files_fdtable(files);
1632                 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1633                         break;
1634                 set = fdt->open_fds->fds_bits[j];
1635                 if (!set)
1636                         continue;
1637                 spin_unlock(&files->file_lock);
1638                 for ( ; set ; i++,set >>= 1) {
1639                         if (set & 1) {
1640                                 file = fget(i);
1641                                 if (!file)
1642                                         continue;
1643                                 if (file_has_perm(current,
1644                                                   file,
1645                                                   file_to_av(file))) {
1646                                         sys_close(i);
1647                                         fd = get_unused_fd();
1648                                         if (fd != i) {
1649                                                 if (fd >= 0)
1650                                                         put_unused_fd(fd);
1651                                                 fput(file);
1652                                                 continue;
1653                                         }
1654                                         if (devnull) {
1655                                                 rcuref_inc(&devnull->f_count);
1656                                         } else {
1657                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1658                                                 if (!devnull) {
1659                                                         put_unused_fd(fd);
1660                                                         fput(file);
1661                                                         continue;
1662                                                 }
1663                                         }
1664                                         fd_install(fd, devnull);
1665                                 }
1666                                 fput(file);
1667                         }
1668                 }
1669                 spin_lock(&files->file_lock);
1670
1671         }
1672         spin_unlock(&files->file_lock);
1673 }
1674
1675 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1676 {
1677         struct task_security_struct *tsec;
1678         struct bprm_security_struct *bsec;
1679         u32 sid;
1680         int rc;
1681
1682         secondary_ops->bprm_apply_creds(bprm, unsafe);
1683
1684         tsec = current->security;
1685
1686         bsec = bprm->security;
1687         sid = bsec->sid;
1688
1689         tsec->osid = tsec->sid;
1690         bsec->unsafe = 0;
1691         if (tsec->sid != sid) {
1692                 /* Check for shared state.  If not ok, leave SID
1693                    unchanged and kill. */
1694                 if (unsafe & LSM_UNSAFE_SHARE) {
1695                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1696                                         PROCESS__SHARE, NULL);
1697                         if (rc) {
1698                                 bsec->unsafe = 1;
1699                                 return;
1700                         }
1701                 }
1702
1703                 /* Check for ptracing, and update the task SID if ok.
1704                    Otherwise, leave SID unchanged and kill. */
1705                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1706                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1707                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1708                                           NULL);
1709                         if (rc) {
1710                                 bsec->unsafe = 1;
1711                                 return;
1712                         }
1713                 }
1714                 tsec->sid = sid;
1715         }
1716 }
1717
1718 /*
1719  * called after apply_creds without the task lock held
1720  */
1721 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1722 {
1723         struct task_security_struct *tsec;
1724         struct rlimit *rlim, *initrlim;
1725         struct itimerval itimer;
1726         struct bprm_security_struct *bsec;
1727         int rc, i;
1728
1729         tsec = current->security;
1730         bsec = bprm->security;
1731
1732         if (bsec->unsafe) {
1733                 force_sig_specific(SIGKILL, current);
1734                 return;
1735         }
1736         if (tsec->osid == tsec->sid)
1737                 return;
1738
1739         /* Close files for which the new task SID is not authorized. */
1740         flush_unauthorized_files(current->files);
1741
1742         /* Check whether the new SID can inherit signal state
1743            from the old SID.  If not, clear itimers to avoid
1744            subsequent signal generation and flush and unblock
1745            signals. This must occur _after_ the task SID has
1746           been updated so that any kill done after the flush
1747           will be checked against the new SID. */
1748         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1749                           PROCESS__SIGINH, NULL);
1750         if (rc) {
1751                 memset(&itimer, 0, sizeof itimer);
1752                 for (i = 0; i < 3; i++)
1753                         do_setitimer(i, &itimer, NULL);
1754                 flush_signals(current);
1755                 spin_lock_irq(&current->sighand->siglock);
1756                 flush_signal_handlers(current, 1);
1757                 sigemptyset(&current->blocked);
1758                 recalc_sigpending();
1759                 spin_unlock_irq(&current->sighand->siglock);
1760         }
1761
1762         /* Check whether the new SID can inherit resource limits
1763            from the old SID.  If not, reset all soft limits to
1764            the lower of the current task's hard limit and the init
1765            task's soft limit.  Note that the setting of hard limits
1766            (even to lower them) can be controlled by the setrlimit
1767            check. The inclusion of the init task's soft limit into
1768            the computation is to avoid resetting soft limits higher
1769            than the default soft limit for cases where the default
1770            is lower than the hard limit, e.g. RLIMIT_CORE or
1771            RLIMIT_STACK.*/
1772         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1773                           PROCESS__RLIMITINH, NULL);
1774         if (rc) {
1775                 for (i = 0; i < RLIM_NLIMITS; i++) {
1776                         rlim = current->signal->rlim + i;
1777                         initrlim = init_task.signal->rlim+i;
1778                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1779                 }
1780                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1781                         /*
1782                          * This will cause RLIMIT_CPU calculations
1783                          * to be refigured.
1784                          */
1785                         current->it_prof_expires = jiffies_to_cputime(1);
1786                 }
1787         }
1788
1789         /* Wake up the parent if it is waiting so that it can
1790            recheck wait permission to the new task SID. */
1791         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1792 }
1793
1794 /* superblock security operations */
1795
1796 static int selinux_sb_alloc_security(struct super_block *sb)
1797 {
1798         return superblock_alloc_security(sb);
1799 }
1800
1801 static void selinux_sb_free_security(struct super_block *sb)
1802 {
1803         superblock_free_security(sb);
1804 }
1805
1806 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1807 {
1808         if (plen > olen)
1809                 return 0;
1810
1811         return !memcmp(prefix, option, plen);
1812 }
1813
1814 static inline int selinux_option(char *option, int len)
1815 {
1816         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1817                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1818                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1819 }
1820
1821 static inline void take_option(char **to, char *from, int *first, int len)
1822 {
1823         if (!*first) {
1824                 **to = ',';
1825                 *to += 1;
1826         }
1827         else
1828                 *first = 0;
1829         memcpy(*to, from, len);
1830         *to += len;
1831 }
1832
1833 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1834 {
1835         int fnosec, fsec, rc = 0;
1836         char *in_save, *in_curr, *in_end;
1837         char *sec_curr, *nosec_save, *nosec;
1838
1839         in_curr = orig;
1840         sec_curr = copy;
1841
1842         /* Binary mount data: just copy */
1843         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1844                 copy_page(sec_curr, in_curr);
1845                 goto out;
1846         }
1847
1848         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1849         if (!nosec) {
1850                 rc = -ENOMEM;
1851                 goto out;
1852         }
1853
1854         nosec_save = nosec;
1855         fnosec = fsec = 1;
1856         in_save = in_end = orig;
1857
1858         do {
1859                 if (*in_end == ',' || *in_end == '\0') {
1860                         int len = in_end - in_curr;
1861
1862                         if (selinux_option(in_curr, len))
1863                                 take_option(&sec_curr, in_curr, &fsec, len);
1864                         else
1865                                 take_option(&nosec, in_curr, &fnosec, len);
1866
1867                         in_curr = in_end + 1;
1868                 }
1869         } while (*in_end++);
1870
1871         strcpy(in_save, nosec_save);
1872         free_page((unsigned long)nosec_save);
1873 out:
1874         return rc;
1875 }
1876
1877 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1878 {
1879         struct avc_audit_data ad;
1880         int rc;
1881
1882         rc = superblock_doinit(sb, data);
1883         if (rc)
1884                 return rc;
1885
1886         AVC_AUDIT_DATA_INIT(&ad,FS);
1887         ad.u.fs.dentry = sb->s_root;
1888         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1889 }
1890
1891 static int selinux_sb_statfs(struct super_block *sb)
1892 {
1893         struct avc_audit_data ad;
1894
1895         AVC_AUDIT_DATA_INIT(&ad,FS);
1896         ad.u.fs.dentry = sb->s_root;
1897         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1898 }
1899
1900 static int selinux_mount(char * dev_name,
1901                          struct nameidata *nd,
1902                          char * type,
1903                          unsigned long flags,
1904                          void * data)
1905 {
1906         int rc;
1907
1908         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1909         if (rc)
1910                 return rc;
1911
1912         if (flags & MS_REMOUNT)
1913                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1914                                            FILESYSTEM__REMOUNT, NULL);
1915         else
1916                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1917                                        FILE__MOUNTON);
1918 }
1919
1920 static int selinux_umount(struct vfsmount *mnt, int flags)
1921 {
1922         int rc;
1923
1924         rc = secondary_ops->sb_umount(mnt, flags);
1925         if (rc)
1926                 return rc;
1927
1928         return superblock_has_perm(current,mnt->mnt_sb,
1929                                    FILESYSTEM__UNMOUNT,NULL);
1930 }
1931
1932 /* inode security operations */
1933
1934 static int selinux_inode_alloc_security(struct inode *inode)
1935 {
1936         return inode_alloc_security(inode);
1937 }
1938
1939 static void selinux_inode_free_security(struct inode *inode)
1940 {
1941         inode_free_security(inode);
1942 }
1943
1944 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1945                                        char **name, void **value,
1946                                        size_t *len)
1947 {
1948         struct task_security_struct *tsec;
1949         struct inode_security_struct *dsec;
1950         struct superblock_security_struct *sbsec;
1951         struct inode_security_struct *isec;
1952         u32 newsid, clen;
1953         int rc;
1954         char *namep = NULL, *context;
1955
1956         tsec = current->security;
1957         dsec = dir->i_security;
1958         sbsec = dir->i_sb->s_security;
1959         isec = inode->i_security;
1960
1961         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1962                 newsid = tsec->create_sid;
1963         } else {
1964                 rc = security_transition_sid(tsec->sid, dsec->sid,
1965                                              inode_mode_to_security_class(inode->i_mode),
1966                                              &newsid);
1967                 if (rc) {
1968                         printk(KERN_WARNING "%s:  "
1969                                "security_transition_sid failed, rc=%d (dev=%s "
1970                                "ino=%ld)\n",
1971                                __FUNCTION__,
1972                                -rc, inode->i_sb->s_id, inode->i_ino);
1973                         return rc;
1974                 }
1975         }
1976
1977         inode_security_set_sid(inode, newsid);
1978
1979         if (name) {
1980                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
1981                 if (!namep)
1982                         return -ENOMEM;
1983                 *name = namep;
1984         }
1985
1986         if (value && len) {
1987                 rc = security_sid_to_context(newsid, &context, &clen);
1988                 if (rc) {
1989                         kfree(namep);
1990                         return rc;
1991                 }
1992                 *value = context;
1993                 *len = clen;
1994         }
1995
1996         return 0;
1997 }
1998
1999 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2000 {
2001         return may_create(dir, dentry, SECCLASS_FILE);
2002 }
2003
2004 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2005 {
2006         int rc;
2007
2008         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2009         if (rc)
2010                 return rc;
2011         return may_link(dir, old_dentry, MAY_LINK);
2012 }
2013
2014 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2015 {
2016         int rc;
2017
2018         rc = secondary_ops->inode_unlink(dir, dentry);
2019         if (rc)
2020                 return rc;
2021         return may_link(dir, dentry, MAY_UNLINK);
2022 }
2023
2024 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2025 {
2026         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2027 }
2028
2029 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2030 {
2031         return may_create(dir, dentry, SECCLASS_DIR);
2032 }
2033
2034 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2035 {
2036         return may_link(dir, dentry, MAY_RMDIR);
2037 }
2038
2039 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2040 {
2041         int rc;
2042
2043         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2044         if (rc)
2045                 return rc;
2046
2047         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2048 }
2049
2050 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2051                                 struct inode *new_inode, struct dentry *new_dentry)
2052 {
2053         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2054 }
2055
2056 static int selinux_inode_readlink(struct dentry *dentry)
2057 {
2058         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2059 }
2060
2061 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2062 {
2063         int rc;
2064
2065         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2066         if (rc)
2067                 return rc;
2068         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2069 }
2070
2071 static int selinux_inode_permission(struct inode *inode, int mask,
2072                                     struct nameidata *nd)
2073 {
2074         int rc;
2075
2076         rc = secondary_ops->inode_permission(inode, mask, nd);
2077         if (rc)
2078                 return rc;
2079
2080         if (!mask) {
2081                 /* No permission to check.  Existence test. */
2082                 return 0;
2083         }
2084
2085         return inode_has_perm(current, inode,
2086                                file_mask_to_av(inode->i_mode, mask), NULL);
2087 }
2088
2089 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2090 {
2091         int rc;
2092
2093         rc = secondary_ops->inode_setattr(dentry, iattr);
2094         if (rc)
2095                 return rc;
2096
2097         if (iattr->ia_valid & ATTR_FORCE)
2098                 return 0;
2099
2100         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2101                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2102                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2103
2104         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2105 }
2106
2107 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2108 {
2109         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2110 }
2111
2112 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2113 {
2114         struct task_security_struct *tsec = current->security;
2115         struct inode *inode = dentry->d_inode;
2116         struct inode_security_struct *isec = inode->i_security;
2117         struct superblock_security_struct *sbsec;
2118         struct avc_audit_data ad;
2119         u32 newsid;
2120         int rc = 0;
2121
2122         if (strcmp(name, XATTR_NAME_SELINUX)) {
2123                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2124                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2125                     !capable(CAP_SYS_ADMIN)) {
2126                         /* A different attribute in the security namespace.
2127                            Restrict to administrator. */
2128                         return -EPERM;
2129                 }
2130
2131                 /* Not an attribute we recognize, so just check the
2132                    ordinary setattr permission. */
2133                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2134         }
2135
2136         sbsec = inode->i_sb->s_security;
2137         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2138                 return -EOPNOTSUPP;
2139
2140         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2141                 return -EPERM;
2142
2143         AVC_AUDIT_DATA_INIT(&ad,FS);
2144         ad.u.fs.dentry = dentry;
2145
2146         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2147                           FILE__RELABELFROM, &ad);
2148         if (rc)
2149                 return rc;
2150
2151         rc = security_context_to_sid(value, size, &newsid);
2152         if (rc)
2153                 return rc;
2154
2155         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2156                           FILE__RELABELTO, &ad);
2157         if (rc)
2158                 return rc;
2159
2160         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2161                                           isec->sclass);
2162         if (rc)
2163                 return rc;
2164
2165         return avc_has_perm(newsid,
2166                             sbsec->sid,
2167                             SECCLASS_FILESYSTEM,
2168                             FILESYSTEM__ASSOCIATE,
2169                             &ad);
2170 }
2171
2172 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2173                                         void *value, size_t size, int flags)
2174 {
2175         struct inode *inode = dentry->d_inode;
2176         struct inode_security_struct *isec = inode->i_security;
2177         u32 newsid;
2178         int rc;
2179
2180         if (strcmp(name, XATTR_NAME_SELINUX)) {
2181                 /* Not an attribute we recognize, so nothing to do. */
2182                 return;
2183         }
2184
2185         rc = security_context_to_sid(value, size, &newsid);
2186         if (rc) {
2187                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2188                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2189                 return;
2190         }
2191
2192         isec->sid = newsid;
2193         return;
2194 }
2195
2196 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2197 {
2198         struct inode *inode = dentry->d_inode;
2199         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2200
2201         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2202                 return -EOPNOTSUPP;
2203
2204         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2205 }
2206
2207 static int selinux_inode_listxattr (struct dentry *dentry)
2208 {
2209         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2210 }
2211
2212 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2213 {
2214         if (strcmp(name, XATTR_NAME_SELINUX)) {
2215                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2216                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2217                     !capable(CAP_SYS_ADMIN)) {
2218                         /* A different attribute in the security namespace.
2219                            Restrict to administrator. */
2220                         return -EPERM;
2221                 }
2222
2223                 /* Not an attribute we recognize, so just check the
2224                    ordinary setattr permission. Might want a separate
2225                    permission for removexattr. */
2226                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2227         }
2228
2229         /* No one is allowed to remove a SELinux security label.
2230            You can change the label, but all data must be labeled. */
2231         return -EACCES;
2232 }
2233
2234 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2235 {
2236         struct inode_security_struct *isec = inode->i_security;
2237         char *context;
2238         unsigned len;
2239         int rc;
2240
2241         /* Permission check handled by selinux_inode_getxattr hook.*/
2242
2243         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2244                 return -EOPNOTSUPP;
2245
2246         rc = security_sid_to_context(isec->sid, &context, &len);
2247         if (rc)
2248                 return rc;
2249
2250         if (!buffer || !size) {
2251                 kfree(context);
2252                 return len;
2253         }
2254         if (size < len) {
2255                 kfree(context);
2256                 return -ERANGE;
2257         }
2258         memcpy(buffer, context, len);
2259         kfree(context);
2260         return len;
2261 }
2262
2263 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2264                                      const void *value, size_t size, int flags)
2265 {
2266         struct inode_security_struct *isec = inode->i_security;
2267         u32 newsid;
2268         int rc;
2269
2270         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2271                 return -EOPNOTSUPP;
2272
2273         if (!value || !size)
2274                 return -EACCES;
2275
2276         rc = security_context_to_sid((void*)value, size, &newsid);
2277         if (rc)
2278                 return rc;
2279
2280         isec->sid = newsid;
2281         return 0;
2282 }
2283
2284 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2285 {
2286         const int len = sizeof(XATTR_NAME_SELINUX);
2287         if (buffer && len <= buffer_size)
2288                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2289         return len;
2290 }
2291
2292 /* file security operations */
2293
2294 static int selinux_file_permission(struct file *file, int mask)
2295 {
2296         struct inode *inode = file->f_dentry->d_inode;
2297
2298         if (!mask) {
2299                 /* No permission to check.  Existence test. */
2300                 return 0;
2301         }
2302
2303         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2304         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2305                 mask |= MAY_APPEND;
2306
2307         return file_has_perm(current, file,
2308                              file_mask_to_av(inode->i_mode, mask));
2309 }
2310
2311 static int selinux_file_alloc_security(struct file *file)
2312 {
2313         return file_alloc_security(file);
2314 }
2315
2316 static void selinux_file_free_security(struct file *file)
2317 {
2318         file_free_security(file);
2319 }
2320
2321 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2322                               unsigned long arg)
2323 {
2324         int error = 0;
2325
2326         switch (cmd) {
2327                 case FIONREAD:
2328                 /* fall through */
2329                 case FIBMAP:
2330                 /* fall through */
2331                 case FIGETBSZ:
2332                 /* fall through */
2333                 case EXT2_IOC_GETFLAGS:
2334                 /* fall through */
2335                 case EXT2_IOC_GETVERSION:
2336                         error = file_has_perm(current, file, FILE__GETATTR);
2337                         break;
2338
2339                 case EXT2_IOC_SETFLAGS:
2340                 /* fall through */
2341                 case EXT2_IOC_SETVERSION:
2342                         error = file_has_perm(current, file, FILE__SETATTR);
2343                         break;
2344
2345                 /* sys_ioctl() checks */
2346                 case FIONBIO:
2347                 /* fall through */
2348                 case FIOASYNC:
2349                         error = file_has_perm(current, file, 0);
2350                         break;
2351
2352                 case KDSKBENT:
2353                 case KDSKBSENT:
2354                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2355                         break;
2356
2357                 /* default case assumes that the command will go
2358                  * to the file's ioctl() function.
2359                  */
2360                 default:
2361                         error = file_has_perm(current, file, FILE__IOCTL);
2362
2363         }
2364         return error;
2365 }
2366
2367 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2368 {
2369 #ifndef CONFIG_PPC32
2370         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2371                 /*
2372                  * We are making executable an anonymous mapping or a
2373                  * private file mapping that will also be writable.
2374                  * This has an additional check.
2375                  */
2376                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2377                 if (rc)
2378                         return rc;
2379         }
2380 #endif
2381
2382         if (file) {
2383                 /* read access is always possible with a mapping */
2384                 u32 av = FILE__READ;
2385
2386                 /* write access only matters if the mapping is shared */
2387                 if (shared && (prot & PROT_WRITE))
2388                         av |= FILE__WRITE;
2389
2390                 if (prot & PROT_EXEC)
2391                         av |= FILE__EXECUTE;
2392
2393                 return file_has_perm(current, file, av);
2394         }
2395         return 0;
2396 }
2397
2398 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2399                              unsigned long prot, unsigned long flags)
2400 {
2401         int rc;
2402
2403         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2404         if (rc)
2405                 return rc;
2406
2407         if (selinux_checkreqprot)
2408                 prot = reqprot;
2409
2410         return file_map_prot_check(file, prot,
2411                                    (flags & MAP_TYPE) == MAP_SHARED);
2412 }
2413
2414 static int selinux_file_mprotect(struct vm_area_struct *vma,
2415                                  unsigned long reqprot,
2416                                  unsigned long prot)
2417 {
2418         int rc;
2419
2420         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2421         if (rc)
2422                 return rc;
2423
2424         if (selinux_checkreqprot)
2425                 prot = reqprot;
2426
2427 #ifndef CONFIG_PPC32
2428         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2429            (vma->vm_start >= vma->vm_mm->start_brk &&
2430             vma->vm_end <= vma->vm_mm->brk)) {
2431                 /*
2432                  * We are making an executable mapping in the brk region.
2433                  * This has an additional execheap check.
2434                  */
2435                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2436                 if (rc)
2437                         return rc;
2438         }
2439         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2440                 /*
2441                  * We are making executable a file mapping that has
2442                  * had some COW done. Since pages might have been written,
2443                  * check ability to execute the possibly modified content.
2444                  * This typically should only occur for text relocations.
2445                  */
2446                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2447                 if (rc)
2448                         return rc;
2449         }
2450         if (!vma->vm_file && (prot & PROT_EXEC) &&
2451                 vma->vm_start <= vma->vm_mm->start_stack &&
2452                 vma->vm_end >= vma->vm_mm->start_stack) {
2453                 /* Attempt to make the process stack executable.
2454                  * This has an additional execstack check.
2455                  */
2456                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2457                 if (rc)
2458                         return rc;
2459         }
2460 #endif
2461
2462         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2463 }
2464
2465 static int selinux_file_lock(struct file *file, unsigned int cmd)
2466 {
2467         return file_has_perm(current, file, FILE__LOCK);
2468 }
2469
2470 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2471                               unsigned long arg)
2472 {
2473         int err = 0;
2474
2475         switch (cmd) {
2476                 case F_SETFL:
2477                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2478                                 err = -EINVAL;
2479                                 break;
2480                         }
2481
2482                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2483                                 err = file_has_perm(current, file,FILE__WRITE);
2484                                 break;
2485                         }
2486                         /* fall through */
2487                 case F_SETOWN:
2488                 case F_SETSIG:
2489                 case F_GETFL:
2490                 case F_GETOWN:
2491                 case F_GETSIG:
2492                         /* Just check FD__USE permission */
2493                         err = file_has_perm(current, file, 0);
2494                         break;
2495                 case F_GETLK:
2496                 case F_SETLK:
2497                 case F_SETLKW:
2498 #if BITS_PER_LONG == 32
2499                 case F_GETLK64:
2500                 case F_SETLK64:
2501                 case F_SETLKW64:
2502 #endif
2503                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2504                                 err = -EINVAL;
2505                                 break;
2506                         }
2507                         err = file_has_perm(current, file, FILE__LOCK);
2508                         break;
2509         }
2510
2511         return err;
2512 }
2513
2514 static int selinux_file_set_fowner(struct file *file)
2515 {
2516         struct task_security_struct *tsec;
2517         struct file_security_struct *fsec;
2518
2519         tsec = current->security;
2520         fsec = file->f_security;
2521         fsec->fown_sid = tsec->sid;
2522
2523         return 0;
2524 }
2525
2526 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2527                                        struct fown_struct *fown, int signum)
2528 {
2529         struct file *file;
2530         u32 perm;
2531         struct task_security_struct *tsec;
2532         struct file_security_struct *fsec;
2533
2534         /* struct fown_struct is never outside the context of a struct file */
2535         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2536
2537         tsec = tsk->security;
2538         fsec = file->f_security;
2539
2540         if (!signum)
2541                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2542         else
2543                 perm = signal_to_av(signum);
2544
2545         return avc_has_perm(fsec->fown_sid, tsec->sid,
2546                             SECCLASS_PROCESS, perm, NULL);
2547 }
2548
2549 static int selinux_file_receive(struct file *file)
2550 {
2551         return file_has_perm(current, file, file_to_av(file));
2552 }
2553
2554 /* task security operations */
2555
2556 static int selinux_task_create(unsigned long clone_flags)
2557 {
2558         int rc;
2559
2560         rc = secondary_ops->task_create(clone_flags);
2561         if (rc)
2562                 return rc;
2563
2564         return task_has_perm(current, current, PROCESS__FORK);
2565 }
2566
2567 static int selinux_task_alloc_security(struct task_struct *tsk)
2568 {
2569         struct task_security_struct *tsec1, *tsec2;
2570         int rc;
2571
2572         tsec1 = current->security;
2573
2574         rc = task_alloc_security(tsk);
2575         if (rc)
2576                 return rc;
2577         tsec2 = tsk->security;
2578
2579         tsec2->osid = tsec1->osid;
2580         tsec2->sid = tsec1->sid;
2581
2582         /* Retain the exec and create SIDs across fork */
2583         tsec2->exec_sid = tsec1->exec_sid;
2584         tsec2->create_sid = tsec1->create_sid;
2585
2586         /* Retain ptracer SID across fork, if any.
2587            This will be reset by the ptrace hook upon any
2588            subsequent ptrace_attach operations. */
2589         tsec2->ptrace_sid = tsec1->ptrace_sid;
2590
2591         return 0;
2592 }
2593
2594 static void selinux_task_free_security(struct task_struct *tsk)
2595 {
2596         task_free_security(tsk);
2597 }
2598
2599 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2600 {
2601         /* Since setuid only affects the current process, and
2602            since the SELinux controls are not based on the Linux
2603            identity attributes, SELinux does not need to control
2604            this operation.  However, SELinux does control the use
2605            of the CAP_SETUID and CAP_SETGID capabilities using the
2606            capable hook. */
2607         return 0;
2608 }
2609
2610 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2611 {
2612         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2613 }
2614
2615 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2616 {
2617         /* See the comment for setuid above. */
2618         return 0;
2619 }
2620
2621 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2622 {
2623         return task_has_perm(current, p, PROCESS__SETPGID);
2624 }
2625
2626 static int selinux_task_getpgid(struct task_struct *p)
2627 {
2628         return task_has_perm(current, p, PROCESS__GETPGID);
2629 }
2630
2631 static int selinux_task_getsid(struct task_struct *p)
2632 {
2633         return task_has_perm(current, p, PROCESS__GETSESSION);
2634 }
2635
2636 static int selinux_task_setgroups(struct group_info *group_info)
2637 {
2638         /* See the comment for setuid above. */
2639         return 0;
2640 }
2641
2642 static int selinux_task_setnice(struct task_struct *p, int nice)
2643 {
2644         int rc;
2645
2646         rc = secondary_ops->task_setnice(p, nice);
2647         if (rc)
2648                 return rc;
2649
2650         return task_has_perm(current,p, PROCESS__SETSCHED);
2651 }
2652
2653 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2654 {
2655         struct rlimit *old_rlim = current->signal->rlim + resource;
2656         int rc;
2657
2658         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2659         if (rc)
2660                 return rc;
2661
2662         /* Control the ability to change the hard limit (whether
2663            lowering or raising it), so that the hard limit can
2664            later be used as a safe reset point for the soft limit
2665            upon context transitions. See selinux_bprm_apply_creds. */
2666         if (old_rlim->rlim_max != new_rlim->rlim_max)
2667                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2668
2669         return 0;
2670 }
2671
2672 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2673 {
2674         return task_has_perm(current, p, PROCESS__SETSCHED);
2675 }
2676
2677 static int selinux_task_getscheduler(struct task_struct *p)
2678 {
2679         return task_has_perm(current, p, PROCESS__GETSCHED);
2680 }
2681
2682 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2683 {
2684         u32 perm;
2685         int rc;
2686
2687         rc = secondary_ops->task_kill(p, info, sig);
2688         if (rc)
2689                 return rc;
2690
2691         if (info && ((unsigned long)info == 1 ||
2692                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2693                 return 0;
2694
2695         if (!sig)
2696                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2697         else
2698                 perm = signal_to_av(sig);
2699
2700         return task_has_perm(current, p, perm);
2701 }
2702
2703 static int selinux_task_prctl(int option,
2704                               unsigned long arg2,
2705                               unsigned long arg3,
2706                               unsigned long arg4,
2707                               unsigned long arg5)
2708 {
2709         /* The current prctl operations do not appear to require
2710            any SELinux controls since they merely observe or modify
2711            the state of the current process. */
2712         return 0;
2713 }
2714
2715 static int selinux_task_wait(struct task_struct *p)
2716 {
2717         u32 perm;
2718
2719         perm = signal_to_av(p->exit_signal);
2720
2721         return task_has_perm(p, current, perm);
2722 }
2723
2724 static void selinux_task_reparent_to_init(struct task_struct *p)
2725 {
2726         struct task_security_struct *tsec;
2727
2728         secondary_ops->task_reparent_to_init(p);
2729
2730         tsec = p->security;
2731         tsec->osid = tsec->sid;
2732         tsec->sid = SECINITSID_KERNEL;
2733         return;
2734 }
2735
2736 static void selinux_task_to_inode(struct task_struct *p,
2737                                   struct inode *inode)
2738 {
2739         struct task_security_struct *tsec = p->security;
2740         struct inode_security_struct *isec = inode->i_security;
2741
2742         isec->sid = tsec->sid;
2743         isec->initialized = 1;
2744         return;
2745 }
2746
2747 #ifdef CONFIG_SECURITY_NETWORK
2748
2749 /* Returns error only if unable to parse addresses */
2750 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2751 {
2752         int offset, ihlen, ret = -EINVAL;
2753         struct iphdr _iph, *ih;
2754
2755         offset = skb->nh.raw - skb->data;
2756         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2757         if (ih == NULL)
2758                 goto out;
2759
2760         ihlen = ih->ihl * 4;
2761         if (ihlen < sizeof(_iph))
2762                 goto out;
2763
2764         ad->u.net.v4info.saddr = ih->saddr;
2765         ad->u.net.v4info.daddr = ih->daddr;
2766         ret = 0;
2767
2768         switch (ih->protocol) {
2769         case IPPROTO_TCP: {
2770                 struct tcphdr _tcph, *th;
2771
2772                 if (ntohs(ih->frag_off) & IP_OFFSET)
2773                         break;
2774
2775                 offset += ihlen;
2776                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2777                 if (th == NULL)
2778                         break;
2779
2780                 ad->u.net.sport = th->source;
2781                 ad->u.net.dport = th->dest;
2782                 break;
2783         }
2784
2785         case IPPROTO_UDP: {
2786                 struct udphdr _udph, *uh;
2787
2788                 if (ntohs(ih->frag_off) & IP_OFFSET)
2789                         break;
2790
2791                 offset += ihlen;
2792                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2793                 if (uh == NULL)
2794                         break;
2795
2796                 ad->u.net.sport = uh->source;
2797                 ad->u.net.dport = uh->dest;
2798                 break;
2799         }
2800
2801         default:
2802                 break;
2803         }
2804 out:
2805         return ret;
2806 }
2807
2808 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2809
2810 /* Returns error only if unable to parse addresses */
2811 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2812 {
2813         u8 nexthdr;
2814         int ret = -EINVAL, offset;
2815         struct ipv6hdr _ipv6h, *ip6;
2816
2817         offset = skb->nh.raw - skb->data;
2818         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2819         if (ip6 == NULL)
2820                 goto out;
2821
2822         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2823         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2824         ret = 0;
2825
2826         nexthdr = ip6->nexthdr;
2827         offset += sizeof(_ipv6h);
2828         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2829         if (offset < 0)
2830                 goto out;
2831
2832         switch (nexthdr) {
2833         case IPPROTO_TCP: {
2834                 struct tcphdr _tcph, *th;
2835
2836                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2837                 if (th == NULL)
2838                         break;
2839
2840                 ad->u.net.sport = th->source;
2841                 ad->u.net.dport = th->dest;
2842                 break;
2843         }
2844
2845         case IPPROTO_UDP: {
2846                 struct udphdr _udph, *uh;
2847
2848                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2849                 if (uh == NULL)
2850                         break;
2851
2852                 ad->u.net.sport = uh->source;
2853                 ad->u.net.dport = uh->dest;
2854                 break;
2855         }
2856
2857         /* includes fragments */
2858         default:
2859                 break;
2860         }
2861 out:
2862         return ret;
2863 }
2864
2865 #endif /* IPV6 */
2866
2867 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2868                              char **addrp, int *len, int src)
2869 {
2870         int ret = 0;
2871
2872         switch (ad->u.net.family) {
2873         case PF_INET:
2874                 ret = selinux_parse_skb_ipv4(skb, ad);
2875                 if (ret || !addrp)
2876                         break;
2877                 *len = 4;
2878                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2879                                         &ad->u.net.v4info.daddr);
2880                 break;
2881
2882 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2883         case PF_INET6:
2884                 ret = selinux_parse_skb_ipv6(skb, ad);
2885                 if (ret || !addrp)
2886                         break;
2887                 *len = 16;
2888                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2889                                         &ad->u.net.v6info.daddr);
2890                 break;
2891 #endif  /* IPV6 */
2892         default:
2893                 break;
2894         }
2895
2896         return ret;
2897 }
2898
2899 /* socket security operations */
2900 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2901                            u32 perms)
2902 {
2903         struct inode_security_struct *isec;
2904         struct task_security_struct *tsec;
2905         struct avc_audit_data ad;
2906         int err = 0;
2907
2908         tsec = task->security;
2909         isec = SOCK_INODE(sock)->i_security;
2910
2911         if (isec->sid == SECINITSID_KERNEL)
2912                 goto out;
2913
2914         AVC_AUDIT_DATA_INIT(&ad,NET);
2915         ad.u.net.sk = sock->sk;
2916         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2917
2918 out:
2919         return err;
2920 }
2921
2922 static int selinux_socket_create(int family, int type,
2923                                  int protocol, int kern)
2924 {
2925         int err = 0;
2926         struct task_security_struct *tsec;
2927
2928         if (kern)
2929                 goto out;
2930
2931         tsec = current->security;
2932         err = avc_has_perm(tsec->sid, tsec->sid,
2933                            socket_type_to_security_class(family, type,
2934                            protocol), SOCKET__CREATE, NULL);
2935
2936 out:
2937         return err;
2938 }
2939
2940 static void selinux_socket_post_create(struct socket *sock, int family,
2941                                        int type, int protocol, int kern)
2942 {
2943         struct inode_security_struct *isec;
2944         struct task_security_struct *tsec;
2945
2946         isec = SOCK_INODE(sock)->i_security;
2947
2948         tsec = current->security;
2949         isec->sclass = socket_type_to_security_class(family, type, protocol);
2950         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2951         isec->initialized = 1;
2952
2953         return;
2954 }
2955
2956 /* Range of port numbers used to automatically bind.
2957    Need to determine whether we should perform a name_bind
2958    permission check between the socket and the port number. */
2959 #define ip_local_port_range_0 sysctl_local_port_range[0]
2960 #define ip_local_port_range_1 sysctl_local_port_range[1]
2961
2962 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2963 {
2964         u16 family;
2965         int err;
2966
2967         err = socket_has_perm(current, sock, SOCKET__BIND);
2968         if (err)
2969                 goto out;
2970
2971         /*
2972          * If PF_INET or PF_INET6, check name_bind permission for the port.
2973          */
2974         family = sock->sk->sk_family;
2975         if (family == PF_INET || family == PF_INET6) {
2976                 char *addrp;
2977                 struct inode_security_struct *isec;
2978                 struct task_security_struct *tsec;
2979                 struct avc_audit_data ad;
2980                 struct sockaddr_in *addr4 = NULL;
2981                 struct sockaddr_in6 *addr6 = NULL;
2982                 unsigned short snum;
2983                 struct sock *sk = sock->sk;
2984                 u32 sid, node_perm, addrlen;
2985
2986                 tsec = current->security;
2987                 isec = SOCK_INODE(sock)->i_security;
2988
2989                 if (family == PF_INET) {
2990                         addr4 = (struct sockaddr_in *)address;
2991                         snum = ntohs(addr4->sin_port);
2992                         addrlen = sizeof(addr4->sin_addr.s_addr);
2993                         addrp = (char *)&addr4->sin_addr.s_addr;
2994                 } else {
2995                         addr6 = (struct sockaddr_in6 *)address;
2996                         snum = ntohs(addr6->sin6_port);
2997                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
2998                         addrp = (char *)&addr6->sin6_addr.s6_addr;
2999                 }
3000
3001                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3002                            snum > ip_local_port_range_1)) {
3003                         err = security_port_sid(sk->sk_family, sk->sk_type,
3004                                                 sk->sk_protocol, snum, &sid);
3005                         if (err)
3006                                 goto out;
3007                         AVC_AUDIT_DATA_INIT(&ad,NET);
3008                         ad.u.net.sport = htons(snum);
3009                         ad.u.net.family = family;
3010                         err = avc_has_perm(isec->sid, sid,
3011                                            isec->sclass,
3012                                            SOCKET__NAME_BIND, &ad);
3013                         if (err)
3014                                 goto out;
3015                 }
3016
3017                 switch(sk->sk_protocol) {
3018                 case IPPROTO_TCP:
3019                         node_perm = TCP_SOCKET__NODE_BIND;
3020                         break;
3021
3022                 case IPPROTO_UDP:
3023                         node_perm = UDP_SOCKET__NODE_BIND;
3024                         break;
3025
3026                 default:
3027                         node_perm = RAWIP_SOCKET__NODE_BIND;
3028                         break;
3029                 }
3030
3031                 err = security_node_sid(family, addrp, addrlen, &sid);
3032                 if (err)
3033                         goto out;
3034
3035                 AVC_AUDIT_DATA_INIT(&ad,NET);
3036                 ad.u.net.sport = htons(snum);
3037                 ad.u.net.family = family;
3038
3039                 if (family == PF_INET)
3040                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3041                 else
3042                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3043
3044                 err = avc_has_perm(isec->sid, sid,
3045                                    isec->sclass, node_perm, &ad);
3046                 if (err)
3047                         goto out;
3048         }
3049 out:
3050         return err;
3051 }
3052
3053 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3054 {
3055         struct inode_security_struct *isec;
3056         int err;
3057
3058         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3059         if (err)
3060                 return err;
3061
3062         /*
3063          * If a TCP socket, check name_connect permission for the port.
3064          */
3065         isec = SOCK_INODE(sock)->i_security;
3066         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3067                 struct sock *sk = sock->sk;
3068                 struct avc_audit_data ad;
3069                 struct sockaddr_in *addr4 = NULL;
3070                 struct sockaddr_in6 *addr6 = NULL;
3071                 unsigned short snum;
3072                 u32 sid;
3073
3074                 if (sk->sk_family == PF_INET) {
3075                         addr4 = (struct sockaddr_in *)address;
3076                         if (addrlen < sizeof(struct sockaddr_in))
3077                                 return -EINVAL;
3078                         snum = ntohs(addr4->sin_port);
3079                 } else {
3080                         addr6 = (struct sockaddr_in6 *)address;
3081                         if (addrlen < SIN6_LEN_RFC2133)
3082                                 return -EINVAL;
3083                         snum = ntohs(addr6->sin6_port);
3084                 }
3085
3086                 err = security_port_sid(sk->sk_family, sk->sk_type,
3087                                         sk->sk_protocol, snum, &sid);
3088                 if (err)
3089                         goto out;
3090
3091                 AVC_AUDIT_DATA_INIT(&ad,NET);
3092                 ad.u.net.dport = htons(snum);
3093                 ad.u.net.family = sk->sk_family;
3094                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3095                                    TCP_SOCKET__NAME_CONNECT, &ad);
3096                 if (err)
3097                         goto out;
3098         }
3099
3100 out:
3101         return err;
3102 }
3103
3104 static int selinux_socket_listen(struct socket *sock, int backlog)
3105 {
3106         return socket_has_perm(current, sock, SOCKET__LISTEN);
3107 }
3108
3109 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3110 {
3111         int err;
3112         struct inode_security_struct *isec;
3113         struct inode_security_struct *newisec;
3114
3115         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3116         if (err)
3117                 return err;
3118
3119         newisec = SOCK_INODE(newsock)->i_security;
3120
3121         isec = SOCK_INODE(sock)->i_security;
3122         newisec->sclass = isec->sclass;
3123         newisec->sid = isec->sid;
3124         newisec->initialized = 1;
3125
3126         return 0;
3127 }
3128
3129 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3130                                   int size)
3131 {
3132         return socket_has_perm(current, sock, SOCKET__WRITE);
3133 }
3134
3135 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3136                                   int size, int flags)
3137 {
3138         return socket_has_perm(current, sock, SOCKET__READ);
3139 }
3140
3141 static int selinux_socket_getsockname(struct socket *sock)
3142 {
3143         return socket_has_perm(current, sock, SOCKET__GETATTR);
3144 }
3145
3146 static int selinux_socket_getpeername(struct socket *sock)
3147 {
3148         return socket_has_perm(current, sock, SOCKET__GETATTR);
3149 }
3150
3151 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3152 {
3153         return socket_has_perm(current, sock, SOCKET__SETOPT);
3154 }
3155
3156 static int selinux_socket_getsockopt(struct socket *sock, int level,
3157                                      int optname)
3158 {
3159         return socket_has_perm(current, sock, SOCKET__GETOPT);
3160 }
3161
3162 static int selinux_socket_shutdown(struct socket *sock, int how)
3163 {
3164         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3165 }
3166
3167 static int selinux_socket_unix_stream_connect(struct socket *sock,
3168                                               struct socket *other,
3169                                               struct sock *newsk)
3170 {
3171         struct sk_security_struct *ssec;
3172         struct inode_security_struct *isec;
3173         struct inode_security_struct *other_isec;
3174         struct avc_audit_data ad;
3175         int err;
3176
3177         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3178         if (err)
3179                 return err;
3180
3181         isec = SOCK_INODE(sock)->i_security;
3182         other_isec = SOCK_INODE(other)->i_security;
3183
3184         AVC_AUDIT_DATA_INIT(&ad,NET);
3185         ad.u.net.sk = other->sk;
3186
3187         err = avc_has_perm(isec->sid, other_isec->sid,
3188                            isec->sclass,
3189                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3190         if (err)
3191                 return err;
3192
3193         /* connecting socket */
3194         ssec = sock->sk->sk_security;
3195         ssec->peer_sid = other_isec->sid;
3196
3197         /* server child socket */
3198         ssec = newsk->sk_security;
3199         ssec->peer_sid = isec->sid;
3200
3201         return 0;
3202 }
3203
3204 static int selinux_socket_unix_may_send(struct socket *sock,
3205                                         struct socket *other)
3206 {
3207         struct inode_security_struct *isec;
3208         struct inode_security_struct *other_isec;
3209         struct avc_audit_data ad;
3210         int err;
3211
3212         isec = SOCK_INODE(sock)->i_security;
3213         other_isec = SOCK_INODE(other)->i_security;
3214
3215         AVC_AUDIT_DATA_INIT(&ad,NET);
3216         ad.u.net.sk = other->sk;
3217
3218         err = avc_has_perm(isec->sid, other_isec->sid,
3219                            isec->sclass, SOCKET__SENDTO, &ad);
3220         if (err)
3221                 return err;
3222
3223         return 0;
3224 }
3225
3226 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3227 {
3228         u16 family;
3229         char *addrp;
3230         int len, err = 0;
3231         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3232         u32 sock_sid = 0;
3233         u16 sock_class = 0;
3234         struct socket *sock;
3235         struct net_device *dev;
3236         struct avc_audit_data ad;
3237
3238         family = sk->sk_family;
3239         if (family != PF_INET && family != PF_INET6)
3240                 goto out;
3241
3242         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3243         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3244                 family = PF_INET;
3245
3246         read_lock_bh(&sk->sk_callback_lock);
3247         sock = sk->sk_socket;
3248         if (sock) {
3249                 struct inode *inode;
3250                 inode = SOCK_INODE(sock);
3251                 if (inode) {
3252                         struct inode_security_struct *isec;
3253                         isec = inode->i_security;
3254                         sock_sid = isec->sid;
3255                         sock_class = isec->sclass;
3256                 }
3257         }
3258         read_unlock_bh(&sk->sk_callback_lock);
3259         if (!sock_sid)
3260                 goto out;
3261
3262         dev = skb->dev;
3263         if (!dev)
3264                 goto out;
3265
3266         err = sel_netif_sids(dev, &if_sid, NULL);
3267         if (err)
3268                 goto out;
3269
3270         switch (sock_class) {
3271         case SECCLASS_UDP_SOCKET:
3272                 netif_perm = NETIF__UDP_RECV;
3273                 node_perm = NODE__UDP_RECV;
3274                 recv_perm = UDP_SOCKET__RECV_MSG;
3275                 break;
3276
3277         case SECCLASS_TCP_SOCKET:
3278                 netif_perm = NETIF__TCP_RECV;
3279                 node_perm = NODE__TCP_RECV;
3280                 recv_perm = TCP_SOCKET__RECV_MSG;
3281                 break;
3282
3283         default:
3284                 netif_perm = NETIF__RAWIP_RECV;
3285                 node_perm = NODE__RAWIP_RECV;
3286                 break;
3287         }
3288
3289         AVC_AUDIT_DATA_INIT(&ad, NET);
3290         ad.u.net.netif = dev->name;
3291         ad.u.net.family = family;
3292
3293         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3294         if (err)
3295                 goto out;
3296
3297         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3298         if (err)
3299                 goto out;
3300
3301         /* Fixme: this lookup is inefficient */
3302         err = security_node_sid(family, addrp, len, &node_sid);
3303         if (err)
3304                 goto out;
3305
3306         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3307         if (err)
3308                 goto out;
3309
3310         if (recv_perm) {
3311                 u32 port_sid;
3312
3313                 /* Fixme: make this more efficient */
3314                 err = security_port_sid(sk->sk_family, sk->sk_type,
3315                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3316                                         &port_sid);
3317                 if (err)
3318                         goto out;
3319
3320                 err = avc_has_perm(sock_sid, port_sid,
3321                                    sock_class, recv_perm, &ad);
3322         }
3323 out:
3324         return err;
3325 }
3326
3327 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3328                                      int __user *optlen, unsigned len)
3329 {
3330         int err = 0;
3331         char *scontext;
3332         u32 scontext_len;
3333         struct sk_security_struct *ssec;
3334         struct inode_security_struct *isec;
3335
3336         isec = SOCK_INODE(sock)->i_security;
3337         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3338                 err = -ENOPROTOOPT;
3339                 goto out;
3340         }
3341
3342         ssec = sock->sk->sk_security;
3343
3344         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3345         if (err)
3346                 goto out;
3347
3348         if (scontext_len > len) {
3349                 err = -ERANGE;
3350                 goto out_len;
3351         }
3352
3353         if (copy_to_user(optval, scontext, scontext_len))
3354                 err = -EFAULT;
3355
3356 out_len:
3357         if (put_user(scontext_len, optlen))
3358                 err = -EFAULT;
3359
3360         kfree(scontext);
3361 out:
3362         return err;
3363 }
3364
3365 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3366 {
3367         return sk_alloc_security(sk, family, priority);
3368 }
3369
3370 static void selinux_sk_free_security(struct sock *sk)
3371 {
3372         sk_free_security(sk);
3373 }
3374
3375 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3376 {
3377         int err = 0;
3378         u32 perm;
3379         struct nlmsghdr *nlh;
3380         struct socket *sock = sk->sk_socket;
3381         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3382
3383         if (skb->len < NLMSG_SPACE(0)) {
3384                 err = -EINVAL;
3385                 goto out;
3386         }
3387         nlh = (struct nlmsghdr *)skb->data;
3388
3389         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3390         if (err) {
3391                 if (err == -EINVAL) {
3392                         audit_log(current->audit_context, AUDIT_SELINUX_ERR,
3393                                   "SELinux:  unrecognized netlink message"
3394                                   " type=%hu for sclass=%hu\n",
3395                                   nlh->nlmsg_type, isec->sclass);
3396                         if (!selinux_enforcing)
3397                                 err = 0;
3398                 }
3399
3400                 /* Ignore */
3401                 if (err == -ENOENT)
3402                         err = 0;
3403                 goto out;
3404         }
3405
3406         err = socket_has_perm(current, sock, perm);
3407 out:
3408         return err;
3409 }
3410
3411 #ifdef CONFIG_NETFILTER
3412
3413 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3414                                               struct sk_buff **pskb,
3415                                               const struct net_device *in,
3416                                               const struct net_device *out,
3417                                               int (*okfn)(struct sk_buff *),
3418                                               u16 family)
3419 {
3420         char *addrp;
3421         int len, err = NF_ACCEPT;
3422         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3423         struct sock *sk;
3424         struct socket *sock;
3425         struct inode *inode;
3426         struct sk_buff *skb = *pskb;
3427         struct inode_security_struct *isec;
3428         struct avc_audit_data ad;
3429         struct net_device *dev = (struct net_device *)out;
3430
3431         sk = skb->sk;
3432         if (!sk)
3433                 goto out;
3434
3435         sock = sk->sk_socket;
3436         if (!sock)
3437                 goto out;
3438
3439         inode = SOCK_INODE(sock);
3440         if (!inode)
3441                 goto out;
3442
3443         err = sel_netif_sids(dev, &if_sid, NULL);
3444         if (err)
3445                 goto out;
3446
3447         isec = inode->i_security;
3448
3449         switch (isec->sclass) {
3450         case SECCLASS_UDP_SOCKET:
3451                 netif_perm = NETIF__UDP_SEND;
3452                 node_perm = NODE__UDP_SEND;
3453                 send_perm = UDP_SOCKET__SEND_MSG;
3454                 break;
3455
3456         case SECCLASS_TCP_SOCKET:
3457                 netif_perm = NETIF__TCP_SEND;
3458                 node_perm = NODE__TCP_SEND;
3459                 send_perm = TCP_SOCKET__SEND_MSG;
3460                 break;
3461
3462         default:
3463                 netif_perm = NETIF__RAWIP_SEND;
3464                 node_perm = NODE__RAWIP_SEND;
3465                 break;
3466         }
3467
3468
3469         AVC_AUDIT_DATA_INIT(&ad, NET);
3470         ad.u.net.netif = dev->name;
3471         ad.u.net.family = family;
3472
3473         err = selinux_parse_skb(skb, &ad, &addrp,
3474                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3475         if (err != NF_ACCEPT)
3476                 goto out;
3477
3478         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3479                            netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3480         if (err != NF_ACCEPT)
3481                 goto out;
3482
3483         /* Fixme: this lookup is inefficient */
3484         err = security_node_sid(family, addrp, len,
3485                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3486         if (err != NF_ACCEPT)
3487                 goto out;
3488
3489         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3490                            node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3491         if (err != NF_ACCEPT)
3492                 goto out;
3493
3494         if (send_perm) {
3495                 u32 port_sid;
3496
3497                 /* Fixme: make this more efficient */
3498                 err = security_port_sid(sk->sk_family,
3499                                         sk->sk_type,
3500                                         sk->sk_protocol,
3501                                         ntohs(ad.u.net.dport),
3502                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3503                 if (err != NF_ACCEPT)
3504                         goto out;
3505
3506                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3507                                    send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3508         }
3509
3510 out:
3511         return err;
3512 }
3513
3514 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3515                                                 struct sk_buff **pskb,
3516                                                 const struct net_device *in,
3517                                                 const struct net_device *out,
3518                                                 int (*okfn)(struct sk_buff *))
3519 {
3520         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3521 }
3522
3523 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3524
3525 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3526                                                 struct sk_buff **pskb,
3527                                                 const struct net_device *in,
3528                                                 const struct net_device *out,
3529                                                 int (*okfn)(struct sk_buff *))
3530 {
3531         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3532 }
3533
3534 #endif  /* IPV6 */
3535
3536 #endif  /* CONFIG_NETFILTER */
3537
3538 #else
3539
3540 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3541 {
3542         return 0;
3543 }
3544
3545 #endif  /* CONFIG_SECURITY_NETWORK */
3546
3547 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3548 {
3549         struct task_security_struct *tsec;
3550         struct av_decision avd;
3551         int err;
3552
3553         err = secondary_ops->netlink_send(sk, skb);
3554         if (err)
3555                 return err;
3556
3557         tsec = current->security;
3558
3559         avd.allowed = 0;
3560         avc_has_perm_noaudit(tsec->sid, tsec->sid,
3561                                 SECCLASS_CAPABILITY, ~0, &avd);
3562         cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3563
3564         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3565                 err = selinux_nlmsg_perm(sk, skb);
3566
3567         return err;
3568 }
3569
3570 static int selinux_netlink_recv(struct sk_buff *skb)
3571 {
3572         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3573                 return -EPERM;
3574         return 0;
3575 }
3576
3577 static int ipc_alloc_security(struct task_struct *task,
3578                               struct kern_ipc_perm *perm,
3579                               u16 sclass)
3580 {
3581         struct task_security_struct *tsec = task->security;
3582         struct ipc_security_struct *isec;
3583
3584         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3585         if (!isec)
3586                 return -ENOMEM;
3587
3588         memset(isec, 0, sizeof(struct ipc_security_struct));
3589         isec->magic = SELINUX_MAGIC;
3590         isec->sclass = sclass;
3591         isec->ipc_perm = perm;
3592         if (tsec) {
3593                 isec->sid = tsec->sid;
3594         } else {
3595                 isec->sid = SECINITSID_UNLABELED;
3596         }
3597         perm->security = isec;
3598
3599         return 0;
3600 }
3601
3602 static void ipc_free_security(struct kern_ipc_perm *perm)
3603 {
3604         struct ipc_security_struct *isec = perm->security;
3605         if (!isec || isec->magic != SELINUX_MAGIC)
3606                 return;
3607
3608         perm->security = NULL;
3609         kfree(isec);
3610 }
3611
3612 static int msg_msg_alloc_security(struct msg_msg *msg)
3613 {
3614         struct msg_security_struct *msec;
3615
3616         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3617         if (!msec)
3618                 return -ENOMEM;
3619
3620         memset(msec, 0, sizeof(struct msg_security_struct));
3621         msec->magic = SELINUX_MAGIC;
3622         msec->msg = msg;
3623         msec->sid = SECINITSID_UNLABELED;
3624         msg->security = msec;
3625
3626         return 0;
3627 }
3628
3629 static void msg_msg_free_security(struct msg_msg *msg)
3630 {
3631         struct msg_security_struct *msec = msg->security;
3632         if (!msec || msec->magic != SELINUX_MAGIC)
3633                 return;
3634
3635         msg->security = NULL;
3636         kfree(msec);
3637 }
3638
3639 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3640                         u32 perms)
3641 {
3642         struct task_security_struct *tsec;
3643         struct ipc_security_struct *isec;
3644         struct avc_audit_data ad;
3645
3646         tsec = current->security;
3647         isec = ipc_perms->security;
3648
3649         AVC_AUDIT_DATA_INIT(&ad, IPC);
3650         ad.u.ipc_id = ipc_perms->key;
3651
3652         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3653 }
3654
3655 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3656 {
3657         return msg_msg_alloc_security(msg);
3658 }
3659
3660 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3661 {
3662         msg_msg_free_security(msg);
3663 }
3664
3665 /* message queue security operations */
3666 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3667 {
3668         struct task_security_struct *tsec;
3669         struct ipc_security_struct *isec;
3670         struct avc_audit_data ad;
3671         int rc;
3672
3673         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3674         if (rc)
3675                 return rc;
3676
3677         tsec = current->security;
3678         isec = msq->q_perm.security;
3679
3680         AVC_AUDIT_DATA_INIT(&ad, IPC);
3681         ad.u.ipc_id = msq->q_perm.key;
3682
3683         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3684                           MSGQ__CREATE, &ad);
3685         if (rc) {
3686                 ipc_free_security(&msq->q_perm);
3687                 return rc;
3688         }
3689         return 0;
3690 }
3691
3692 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3693 {
3694         ipc_free_security(&msq->q_perm);
3695 }
3696
3697 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3698 {
3699         struct task_security_struct *tsec;
3700         struct ipc_security_struct *isec;
3701         struct avc_audit_data ad;
3702
3703         tsec = current->security;
3704         isec = msq->q_perm.security;
3705
3706         AVC_AUDIT_DATA_INIT(&ad, IPC);
3707         ad.u.ipc_id = msq->q_perm.key;
3708
3709         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3710                             MSGQ__ASSOCIATE, &ad);
3711 }
3712
3713 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3714 {
3715         int err;
3716         int perms;
3717
3718         switch(cmd) {
3719         case IPC_INFO:
3720         case MSG_INFO:
3721                 /* No specific object, just general system-wide information. */
3722                 return task_has_system(current, SYSTEM__IPC_INFO);
3723         case IPC_STAT:
3724         case MSG_STAT:
3725                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3726                 break;
3727         case IPC_SET:
3728                 perms = MSGQ__SETATTR;
3729                 break;
3730         case IPC_RMID:
3731                 perms = MSGQ__DESTROY;
3732                 break;
3733         default:
3734                 return 0;
3735         }
3736
3737         err = ipc_has_perm(&msq->q_perm, perms);
3738         return err;
3739 }
3740
3741 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3742 {
3743         struct task_security_struct *tsec;
3744         struct ipc_security_struct *isec;
3745         struct msg_security_struct *msec;
3746         struct avc_audit_data ad;
3747         int rc;
3748
3749         tsec = current->security;
3750         isec = msq->q_perm.security;
3751         msec = msg->security;
3752
3753         /*
3754          * First time through, need to assign label to the message
3755          */
3756         if (msec->sid == SECINITSID_UNLABELED) {
3757                 /*
3758                  * Compute new sid based on current process and
3759                  * message queue this message will be stored in
3760                  */
3761                 rc = security_transition_sid(tsec->sid,
3762                                              isec->sid,
3763                                              SECCLASS_MSG,
3764                                              &msec->sid);
3765                 if (rc)
3766                         return rc;
3767         }
3768
3769         AVC_AUDIT_DATA_INIT(&ad, IPC);
3770         ad.u.ipc_id = msq->q_perm.key;
3771
3772         /* Can this process write to the queue? */
3773         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3774                           MSGQ__WRITE, &ad);
3775         if (!rc)
3776                 /* Can this process send the message */
3777                 rc = avc_has_perm(tsec->sid, msec->sid,
3778                                   SECCLASS_MSG, MSG__SEND, &ad);
3779         if (!rc)
3780                 /* Can the message be put in the queue? */
3781                 rc = avc_has_perm(msec->sid, isec->sid,
3782                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3783
3784         return rc;
3785 }
3786
3787 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3788                                     struct task_struct *target,
3789                                     long type, int mode)
3790 {
3791         struct task_security_struct *tsec;
3792         struct ipc_security_struct *isec;
3793         struct msg_security_struct *msec;
3794         struct avc_audit_data ad;
3795         int rc;
3796
3797         tsec = target->security;
3798         isec = msq->q_perm.security;
3799         msec = msg->security;
3800
3801         AVC_AUDIT_DATA_INIT(&ad, IPC);
3802         ad.u.ipc_id = msq->q_perm.key;
3803
3804         rc = avc_has_perm(tsec->sid, isec->sid,
3805                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3806         if (!rc)
3807                 rc = avc_has_perm(tsec->sid, msec->sid,
3808                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3809         return rc;
3810 }
3811
3812 /* Shared Memory security operations */
3813 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3814 {
3815         struct task_security_struct *tsec;
3816         struct ipc_security_struct *isec;
3817         struct avc_audit_data ad;
3818         int rc;
3819
3820         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3821         if (rc)
3822                 return rc;
3823
3824         tsec = current->security;
3825         isec = shp->shm_perm.security;
3826
3827         AVC_AUDIT_DATA_INIT(&ad, IPC);
3828         ad.u.ipc_id = shp->shm_perm.key;
3829
3830         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3831                           SHM__CREATE, &ad);
3832         if (rc) {
3833                 ipc_free_security(&shp->shm_perm);
3834                 return rc;
3835         }
3836         return 0;
3837 }
3838
3839 static void selinux_shm_free_security(struct shmid_kernel *shp)
3840 {
3841         ipc_free_security(&shp->shm_perm);
3842 }
3843
3844 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3845 {
3846         struct task_security_struct *tsec;
3847         struct ipc_security_struct *isec;
3848         struct avc_audit_data ad;
3849
3850         tsec = current->security;
3851         isec = shp->shm_perm.security;
3852
3853         AVC_AUDIT_DATA_INIT(&ad, IPC);
3854         ad.u.ipc_id = shp->shm_perm.key;
3855
3856         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3857                             SHM__ASSOCIATE, &ad);
3858 }
3859
3860 /* Note, at this point, shp is locked down */
3861 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3862 {
3863         int perms;
3864         int err;
3865
3866         switch(cmd) {
3867         case IPC_INFO:
3868         case SHM_INFO:
3869                 /* No specific object, just general system-wide information. */
3870                 return task_has_system(current, SYSTEM__IPC_INFO);
3871         case IPC_STAT:
3872         case SHM_STAT:
3873                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3874                 break;
3875         case IPC_SET:
3876                 perms = SHM__SETATTR;
3877                 break;
3878         case SHM_LOCK:
3879         case SHM_UNLOCK:
3880                 perms = SHM__LOCK;
3881                 break;
3882         case IPC_RMID:
3883                 perms = SHM__DESTROY;
3884                 break;
3885         default:
3886                 return 0;
3887         }
3888
3889         err = ipc_has_perm(&shp->shm_perm, perms);
3890         return err;
3891 }
3892
3893 static int selinux_shm_shmat(struct shmid_kernel *shp,
3894                              char __user *shmaddr, int shmflg)
3895 {
3896         u32 perms;
3897         int rc;
3898
3899         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3900         if (rc)
3901                 return rc;
3902
3903         if (shmflg & SHM_RDONLY)
3904                 perms = SHM__READ;
3905         else
3906                 perms = SHM__READ | SHM__WRITE;
3907
3908         return ipc_has_perm(&shp->shm_perm, perms);
3909 }
3910
3911 /* Semaphore security operations */
3912 static int selinux_sem_alloc_security(struct sem_array *sma)
3913 {
3914         struct task_security_struct *tsec;
3915         struct ipc_security_struct *isec;
3916         struct avc_audit_data ad;
3917         int rc;
3918
3919         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3920         if (rc)
3921                 return rc;
3922
3923         tsec = current->security;
3924         isec = sma->sem_perm.security;
3925
3926         AVC_AUDIT_DATA_INIT(&ad, IPC);
3927         ad.u.ipc_id = sma->sem_perm.key;
3928
3929         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3930                           SEM__CREATE, &ad);
3931         if (rc) {
3932                 ipc_free_security(&sma->sem_perm);
3933                 return rc;
3934         }
3935         return 0;
3936 }
3937
3938 static void selinux_sem_free_security(struct sem_array *sma)
3939 {
3940         ipc_free_security(&sma->sem_perm);
3941 }
3942
3943 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3944 {
3945         struct task_security_struct *tsec;
3946         struct ipc_security_struct *isec;
3947         struct avc_audit_data ad;
3948
3949         tsec = current->security;
3950         isec = sma->sem_perm.security;
3951
3952         AVC_AUDIT_DATA_INIT(&ad, IPC);
3953         ad.u.ipc_id = sma->sem_perm.key;
3954
3955         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3956                             SEM__ASSOCIATE, &ad);
3957 }
3958
3959 /* Note, at this point, sma is locked down */
3960 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3961 {
3962         int err;
3963         u32 perms;
3964
3965         switch(cmd) {
3966         case IPC_INFO:
3967         case SEM_INFO:
3968                 /* No specific object, just general system-wide information. */
3969                 return task_has_system(current, SYSTEM__IPC_INFO);
3970         case GETPID:
3971         case GETNCNT:
3972         case GETZCNT:
3973                 perms = SEM__GETATTR;
3974                 break;
3975         case GETVAL:
3976         case GETALL:
3977                 perms = SEM__READ;
3978                 break;
3979         case SETVAL:
3980         case SETALL:
3981                 perms = SEM__WRITE;
3982                 break;
3983         case IPC_RMID:
3984                 perms = SEM__DESTROY;
3985                 break;
3986         case IPC_SET:
3987                 perms = SEM__SETATTR;
3988                 break;
3989         case IPC_STAT:
3990         case SEM_STAT:
3991                 perms = SEM__GETATTR | SEM__ASSOCIATE;
3992                 break;
3993         default:
3994                 return 0;
3995         }
3996
3997         err = ipc_has_perm(&sma->sem_perm, perms);
3998         return err;
3999 }
4000
4001 static int selinux_sem_semop(struct sem_array *sma,
4002                              struct sembuf *sops, unsigned nsops, int alter)
4003 {
4004         u32 perms;
4005
4006         if (alter)
4007                 perms = SEM__READ | SEM__WRITE;
4008         else
4009                 perms = SEM__READ;
4010
4011         return ipc_has_perm(&sma->sem_perm, perms);
4012 }
4013
4014 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4015 {
4016         u32 av = 0;
4017
4018         av = 0;
4019         if (flag & S_IRUGO)
4020                 av |= IPC__UNIX_READ;
4021         if (flag & S_IWUGO)
4022                 av |= IPC__UNIX_WRITE;
4023
4024         if (av == 0)
4025                 return 0;
4026
4027         return ipc_has_perm(ipcp, av);
4028 }
4029
4030 /* module stacking operations */
4031 static int selinux_register_security (const char *name, struct security_operations *ops)
4032 {
4033         if (secondary_ops != original_ops) {
4034                 printk(KERN_INFO "%s:  There is already a secondary security "
4035                        "module registered.\n", __FUNCTION__);
4036                 return -EINVAL;
4037         }
4038
4039         secondary_ops = ops;
4040
4041         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4042                __FUNCTION__,
4043                name);
4044
4045         return 0;
4046 }
4047
4048 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4049 {
4050         if (ops != secondary_ops) {
4051                 printk (KERN_INFO "%s:  trying to unregister a security module "
4052                         "that is not registered.\n", __FUNCTION__);
4053                 return -EINVAL;
4054         }
4055
4056         secondary_ops = original_ops;
4057
4058         return 0;
4059 }
4060
4061 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4062 {
4063         if (inode)
4064                 inode_doinit_with_dentry(inode, dentry);
4065 }
4066
4067 static int selinux_getprocattr(struct task_struct *p,
4068                                char *name, void *value, size_t size)
4069 {
4070         struct task_security_struct *tsec;
4071         u32 sid, len;
4072         char *context;
4073         int error;
4074
4075         if (current != p) {
4076                 error = task_has_perm(current, p, PROCESS__GETATTR);
4077                 if (error)
4078                         return error;
4079         }
4080
4081         if (!size)
4082                 return -ERANGE;
4083
4084         tsec = p->security;
4085
4086         if (!strcmp(name, "current"))
4087                 sid = tsec->sid;
4088         else if (!strcmp(name, "prev"))
4089                 sid = tsec->osid;
4090         else if (!strcmp(name, "exec"))
4091                 sid = tsec->exec_sid;
4092         else if (!strcmp(name, "fscreate"))
4093                 sid = tsec->create_sid;
4094         else
4095                 return -EINVAL;
4096
4097         if (!sid)
4098                 return 0;
4099
4100         error = security_sid_to_context(sid, &context, &len);
4101         if (error)
4102                 return error;
4103         if (len > size) {
4104                 kfree(context);
4105                 return -ERANGE;
4106         }
4107         memcpy(value, context, len);
4108         kfree(context);
4109         return len;
4110 }
4111
4112 static int selinux_setprocattr(struct task_struct *p,
4113                                char *name, void *value, size_t size)
4114 {
4115         struct task_security_struct *tsec;
4116         u32 sid = 0;
4117         int error;
4118         char *str = value;
4119
4120         if (current != p) {
4121                 /* SELinux only allows a process to change its own
4122                    security attributes. */
4123                 return -EACCES;
4124         }
4125
4126         /*
4127          * Basic control over ability to set these attributes at all.
4128          * current == p, but we'll pass them separately in case the
4129          * above restriction is ever removed.
4130          */
4131         if (!strcmp(name, "exec"))
4132                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4133         else if (!strcmp(name, "fscreate"))
4134                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4135         else if (!strcmp(name, "current"))
4136                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4137         else
4138                 error = -EINVAL;
4139         if (error)
4140                 return error;
4141
4142         /* Obtain a SID for the context, if one was specified. */
4143         if (size && str[1] && str[1] != '\n') {
4144                 if (str[size-1] == '\n') {
4145                         str[size-1] = 0;
4146                         size--;
4147                 }
4148                 error = security_context_to_sid(value, size, &sid);
4149                 if (error)
4150                         return error;
4151         }
4152
4153         /* Permission checking based on the specified context is
4154            performed during the actual operation (execve,
4155            open/mkdir/...), when we know the full context of the
4156            operation.  See selinux_bprm_set_security for the execve
4157            checks and may_create for the file creation checks. The
4158            operation will then fail if the context is not permitted. */
4159         tsec = p->security;
4160         if (!strcmp(name, "exec"))
4161                 tsec->exec_sid = sid;
4162         else if (!strcmp(name, "fscreate"))
4163                 tsec->create_sid = sid;
4164         else if (!strcmp(name, "current")) {
4165                 struct av_decision avd;
4166
4167                 if (sid == 0)
4168                         return -EINVAL;
4169
4170                 /* Only allow single threaded processes to change context */
4171                 if (atomic_read(&p->mm->mm_users) != 1) {
4172                         struct task_struct *g, *t;
4173                         struct mm_struct *mm = p->mm;
4174                         read_lock(&tasklist_lock);
4175                         do_each_thread(g, t)
4176                                 if (t->mm == mm && t != p) {
4177                                         read_unlock(&tasklist_lock);
4178                                         return -EPERM;
4179                                 }
4180                         while_each_thread(g, t);
4181                         read_unlock(&tasklist_lock);
4182                 }
4183
4184                 /* Check permissions for the transition. */
4185                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4186                                      PROCESS__DYNTRANSITION, NULL);
4187                 if (error)
4188                         return error;
4189
4190                 /* Check for ptracing, and update the task SID if ok.
4191                    Otherwise, leave SID unchanged and fail. */
4192                 task_lock(p);
4193                 if (p->ptrace & PT_PTRACED) {
4194                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4195                                                      SECCLASS_PROCESS,
4196                                                      PROCESS__PTRACE, &avd);
4197                         if (!error)
4198                                 tsec->sid = sid;
4199                         task_unlock(p);
4200                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4201                                   PROCESS__PTRACE, &avd, error, NULL);
4202                         if (error)
4203                                 return error;
4204                 } else {
4205                         tsec->sid = sid;
4206                         task_unlock(p);
4207                 }
4208         }
4209         else
4210                 return -EINVAL;
4211
4212         return size;
4213 }
4214
4215 static struct security_operations selinux_ops = {
4216         .ptrace =                       selinux_ptrace,
4217         .capget =                       selinux_capget,
4218         .capset_check =                 selinux_capset_check,
4219         .capset_set =                   selinux_capset_set,
4220         .sysctl =                       selinux_sysctl,
4221         .capable =                      selinux_capable,
4222         .quotactl =                     selinux_quotactl,
4223         .quota_on =                     selinux_quota_on,
4224         .syslog =                       selinux_syslog,
4225         .vm_enough_memory =             selinux_vm_enough_memory,
4226
4227         .netlink_send =                 selinux_netlink_send,
4228         .netlink_recv =                 selinux_netlink_recv,
4229
4230         .bprm_alloc_security =          selinux_bprm_alloc_security,
4231         .bprm_free_security =           selinux_bprm_free_security,
4232         .bprm_apply_creds =             selinux_bprm_apply_creds,
4233         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4234         .bprm_set_security =            selinux_bprm_set_security,
4235         .bprm_check_security =          selinux_bprm_check_security,
4236         .bprm_secureexec =              selinux_bprm_secureexec,
4237
4238         .sb_alloc_security =            selinux_sb_alloc_security,
4239         .sb_free_security =             selinux_sb_free_security,
4240         .sb_copy_data =                 selinux_sb_copy_data,
4241         .sb_kern_mount =                selinux_sb_kern_mount,
4242         .sb_statfs =                    selinux_sb_statfs,
4243         .sb_mount =                     selinux_mount,
4244         .sb_umount =                    selinux_umount,
4245
4246         .inode_alloc_security =         selinux_inode_alloc_security,
4247         .inode_free_security =          selinux_inode_free_security,
4248         .inode_init_security =          selinux_inode_init_security,
4249         .inode_create =                 selinux_inode_create,
4250         .inode_link =                   selinux_inode_link,
4251         .inode_unlink =                 selinux_inode_unlink,
4252         .inode_symlink =                selinux_inode_symlink,
4253         .inode_mkdir =                  selinux_inode_mkdir,
4254         .inode_rmdir =                  selinux_inode_rmdir,
4255         .inode_mknod =                  selinux_inode_mknod,
4256         .inode_rename =                 selinux_inode_rename,
4257         .inode_readlink =               selinux_inode_readlink,
4258         .inode_follow_link =            selinux_inode_follow_link,
4259         .inode_permission =             selinux_inode_permission,
4260         .inode_setattr =                selinux_inode_setattr,
4261         .inode_getattr =                selinux_inode_getattr,
4262         .inode_setxattr =               selinux_inode_setxattr,
4263         .inode_post_setxattr =          selinux_inode_post_setxattr,
4264         .inode_getxattr =               selinux_inode_getxattr,
4265         .inode_listxattr =              selinux_inode_listxattr,
4266         .inode_removexattr =            selinux_inode_removexattr,
4267         .inode_getsecurity =            selinux_inode_getsecurity,
4268         .inode_setsecurity =            selinux_inode_setsecurity,
4269         .inode_listsecurity =           selinux_inode_listsecurity,
4270
4271         .file_permission =              selinux_file_permission,
4272         .file_alloc_security =          selinux_file_alloc_security,
4273         .file_free_security =           selinux_file_free_security,
4274         .file_ioctl =                   selinux_file_ioctl,
4275         .file_mmap =                    selinux_file_mmap,
4276         .file_mprotect =                selinux_file_mprotect,
4277         .file_lock =                    selinux_file_lock,
4278         .file_fcntl =                   selinux_file_fcntl,
4279         .file_set_fowner =              selinux_file_set_fowner,
4280         .file_send_sigiotask =          selinux_file_send_sigiotask,
4281         .file_receive =                 selinux_file_receive,
4282
4283         .task_create =                  selinux_task_create,
4284         .task_alloc_security =          selinux_task_alloc_security,
4285         .task_free_security =           selinux_task_free_security,
4286         .task_setuid =                  selinux_task_setuid,
4287         .task_post_setuid =             selinux_task_post_setuid,
4288         .task_setgid =                  selinux_task_setgid,
4289         .task_setpgid =                 selinux_task_setpgid,
4290         .task_getpgid =                 selinux_task_getpgid,
4291         .task_getsid =                  selinux_task_getsid,
4292         .task_setgroups =               selinux_task_setgroups,
4293         .task_setnice =                 selinux_task_setnice,
4294         .task_setrlimit =               selinux_task_setrlimit,
4295         .task_setscheduler =            selinux_task_setscheduler,
4296         .task_getscheduler =            selinux_task_getscheduler,
4297         .task_kill =                    selinux_task_kill,
4298         .task_wait =                    selinux_task_wait,
4299         .task_prctl =                   selinux_task_prctl,
4300         .task_reparent_to_init =        selinux_task_reparent_to_init,
4301         .task_to_inode =                selinux_task_to_inode,
4302
4303         .ipc_permission =               selinux_ipc_permission,
4304
4305         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4306         .msg_msg_free_security =        selinux_msg_msg_free_security,
4307
4308         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4309         .msg_queue_free_security =      selinux_msg_queue_free_security,
4310         .msg_queue_associate =          selinux_msg_queue_associate,
4311         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4312         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4313         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4314
4315         .shm_alloc_security =           selinux_shm_alloc_security,
4316         .shm_free_security =            selinux_shm_free_security,
4317         .shm_associate =                selinux_shm_associate,
4318         .shm_shmctl =                   selinux_shm_shmctl,
4319         .shm_shmat =                    selinux_shm_shmat,
4320
4321         .sem_alloc_security =           selinux_sem_alloc_security,
4322         .sem_free_security =            selinux_sem_free_security,
4323         .sem_associate =                selinux_sem_associate,
4324         .sem_semctl =                   selinux_sem_semctl,
4325         .sem_semop =                    selinux_sem_semop,
4326
4327         .register_security =            selinux_register_security,
4328         .unregister_security =          selinux_unregister_security,
4329
4330         .d_instantiate =                selinux_d_instantiate,
4331
4332         .getprocattr =                  selinux_getprocattr,
4333         .setprocattr =                  selinux_setprocattr,
4334
4335 #ifdef CONFIG_SECURITY_NETWORK
4336         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4337         .unix_may_send =                selinux_socket_unix_may_send,
4338
4339         .socket_create =                selinux_socket_create,
4340         .socket_post_create =           selinux_socket_post_create,
4341         .socket_bind =                  selinux_socket_bind,
4342         .socket_connect =               selinux_socket_connect,
4343         .socket_listen =                selinux_socket_listen,
4344         .socket_accept =                selinux_socket_accept,
4345         .socket_sendmsg =               selinux_socket_sendmsg,
4346         .socket_recvmsg =               selinux_socket_recvmsg,
4347         .socket_getsockname =           selinux_socket_getsockname,
4348         .socket_getpeername =           selinux_socket_getpeername,
4349         .socket_getsockopt =            selinux_socket_getsockopt,
4350         .socket_setsockopt =            selinux_socket_setsockopt,
4351         .socket_shutdown =              selinux_socket_shutdown,
4352         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4353         .socket_getpeersec =            selinux_socket_getpeersec,
4354         .sk_alloc_security =            selinux_sk_alloc_security,
4355         .sk_free_security =             selinux_sk_free_security,
4356 #endif
4357 };
4358
4359 static __init int selinux_init(void)
4360 {
4361         struct task_security_struct *tsec;
4362
4363         if (!selinux_enabled) {
4364                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4365                 return 0;
4366         }
4367
4368         printk(KERN_INFO "SELinux:  Initializing.\n");
4369
4370         /* Set the security state for the initial task. */
4371         if (task_alloc_security(current))
4372                 panic("SELinux:  Failed to initialize initial task.\n");
4373         tsec = current->security;
4374         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4375
4376         avc_init();
4377
4378         original_ops = secondary_ops = security_ops;
4379         if (!secondary_ops)
4380                 panic ("SELinux: No initial security operations\n");
4381         if (register_security (&selinux_ops))
4382                 panic("SELinux: Unable to register with kernel.\n");
4383
4384         if (selinux_enforcing) {
4385                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4386         } else {
4387                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4388         }
4389         return 0;
4390 }
4391
4392 void selinux_complete_init(void)
4393 {
4394         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4395
4396         /* Set up any superblocks initialized prior to the policy load. */
4397         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4398         spin_lock(&sb_security_lock);
4399 next_sb:
4400         if (!list_empty(&superblock_security_head)) {
4401                 struct superblock_security_struct *sbsec =
4402                                 list_entry(superblock_security_head.next,
4403                                            struct superblock_security_struct,
4404                                            list);
4405                 struct super_block *sb = sbsec->sb;
4406                 spin_lock(&sb_lock);
4407                 sb->s_count++;
4408                 spin_unlock(&sb_lock);
4409                 spin_unlock(&sb_security_lock);
4410                 down_read(&sb->s_umount);
4411                 if (sb->s_root)
4412                         superblock_doinit(sb, NULL);
4413                 drop_super(sb);
4414                 spin_lock(&sb_security_lock);
4415                 list_del_init(&sbsec->list);
4416                 goto next_sb;
4417         }
4418         spin_unlock(&sb_security_lock);
4419 }
4420
4421 /* SELinux requires early initialization in order to label
4422    all processes and objects when they are created. */
4423 security_initcall(selinux_init);
4424
4425 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4426
4427 static struct nf_hook_ops selinux_ipv4_op = {
4428         .hook =         selinux_ipv4_postroute_last,
4429         .owner =        THIS_MODULE,
4430         .pf =           PF_INET,
4431         .hooknum =      NF_IP_POST_ROUTING,
4432         .priority =     NF_IP_PRI_SELINUX_LAST,
4433 };
4434
4435 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4436
4437 static struct nf_hook_ops selinux_ipv6_op = {
4438         .hook =         selinux_ipv6_postroute_last,
4439         .owner =        THIS_MODULE,
4440         .pf =           PF_INET6,
4441         .hooknum =      NF_IP6_POST_ROUTING,
4442         .priority =     NF_IP6_PRI_SELINUX_LAST,
4443 };
4444
4445 #endif  /* IPV6 */
4446
4447 static int __init selinux_nf_ip_init(void)
4448 {
4449         int err = 0;
4450
4451         if (!selinux_enabled)
4452                 goto out;
4453
4454         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4455
4456         err = nf_register_hook(&selinux_ipv4_op);
4457         if (err)
4458                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4459
4460 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4461
4462         err = nf_register_hook(&selinux_ipv6_op);
4463         if (err)
4464                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4465
4466 #endif  /* IPV6 */
4467 out:
4468         return err;
4469 }
4470
4471 __initcall(selinux_nf_ip_init);
4472
4473 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4474 static void selinux_nf_ip_exit(void)
4475 {
4476         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4477
4478         nf_unregister_hook(&selinux_ipv4_op);
4479 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4480         nf_unregister_hook(&selinux_ipv6_op);
4481 #endif  /* IPV6 */
4482 }
4483 #endif
4484
4485 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4486
4487 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4488 #define selinux_nf_ip_exit()
4489 #endif
4490
4491 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4492
4493 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4494 int selinux_disable(void)
4495 {
4496         extern void exit_sel_fs(void);
4497         static int selinux_disabled = 0;
4498
4499         if (ss_initialized) {
4500                 /* Not permitted after initial policy load. */
4501                 return -EINVAL;
4502         }
4503
4504         if (selinux_disabled) {
4505                 /* Only do this once. */
4506                 return -EINVAL;
4507         }
4508
4509         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4510
4511         selinux_disabled = 1;
4512
4513         /* Reset security_ops to the secondary module, dummy or capability. */
4514         security_ops = secondary_ops;
4515
4516         /* Unregister netfilter hooks. */
4517         selinux_nf_ip_exit();
4518
4519         /* Unregister selinuxfs. */
4520         exit_sel_fs();
4521
4522         return 0;
4523 }
4524 #endif
4525
4526