security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
  16  *                     Paul Moore, <paul.moore@hp.com>
  17  *
  18  *      This program is free software; you can redistribute it and/or modify
  19  *      it under the terms of the GNU General Public License version 2,
  20  *      as published by the Free Software Foundation.
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/kernel.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/errno.h>
  28 #include <linux/sched.h>
  29 #include <linux/security.h>
  30 #include <linux/xattr.h>
  31 #include <linux/capability.h>
  32 #include <linux/unistd.h>
  33 #include <linux/mm.h>
  34 #include <linux/mman.h>
  35 #include <linux/slab.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/swap.h>
  38 #include <linux/smp_lock.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <asm/uaccess.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/dccp.h>
  62 #include <linux/quota.h>
  63 #include <linux/un.h>           /* for Unix socket types */
  64 #include <net/af_unix.h>        /* for Unix socket types */
  65 #include <linux/parser.h>
  66 #include <linux/nfs_mount.h>
  67 #include <net/ipv6.h>
  68 #include <linux/hugetlb.h>
  69 #include <linux/personality.h>
  70 #include <linux/sysctl.h>
  71 #include <linux/audit.h>
  72 #include <linux/string.h>
  73 #include <linux/selinux.h>
  74 #include <linux/mutex.h>
  75
  76 #include "avc.h"
  77 #include "objsec.h"
  78 #include "netif.h"
  79 #include "xfrm.h"
  80 #include "netlabel.h"
  81
  82 #define XATTR_SELINUX_SUFFIX "selinux"
  83 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  84
  85 extern unsigned int policydb_loaded_version;
  86 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  87 extern int selinux_compat_net;
  88
  89 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  90 int selinux_enforcing = 0;
  91
  92 static int __init enforcing_setup(char *str)
  93 {
  94         selinux_enforcing = simple_strtol(str,NULL,0);
  95         return 1;
  96 }
  97 __setup("enforcing=", enforcing_setup);
  98 #endif
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 101 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 102
 103 static int __init selinux_enabled_setup(char *str)
 104 {
 105         selinux_enabled = simple_strtol(str, NULL, 0);
 106         return 1;
 107 }
 108 __setup("selinux=", selinux_enabled_setup);
 109 #else
 110 int selinux_enabled = 1;
 111 #endif
 112
 113 /* Original (dummy) security module. */
 114 static struct security_operations *original_ops = NULL;
 115
 116 /* Minimal support for a secondary security module,
 117    just to allow the use of the dummy or capability modules.
 118    The owlsm module can alternatively be used as a secondary
 119    module as long as CONFIG_OWLSM_FD is not enabled. */
 120 static struct security_operations *secondary_ops = NULL;
 121
 122 /* Lists of inode and superblock security structures initialized
 123    before the policy was loaded. */
 124 static LIST_HEAD(superblock_security_head);
 125 static DEFINE_SPINLOCK(sb_security_lock);
 126
 127 static struct kmem_cache *sel_inode_cache;
 128
 129 /* Return security context for a given sid or just the context
 130    length if the buffer is null or length is 0 */
 131 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 132 {
 133         char *context;
 134         unsigned len;
 135         int rc;
 136
 137         rc = security_sid_to_context(sid, &context, &len);
 138         if (rc)
 139                 return rc;
 140
 141         if (!buffer || !size)
 142                 goto getsecurity_exit;
 143
 144         if (size < len) {
 145                 len = -ERANGE;
 146                 goto getsecurity_exit;
 147         }
 148         memcpy(buffer, context, len);
 149
 150 getsecurity_exit:
 151         kfree(context);
 152         return len;
 153 }
 154
 155 /* Allocate and free functions for each kind of security blob. */
 156
 157 static int task_alloc_security(struct task_struct *task)
 158 {
 159         struct task_security_struct *tsec;
 160
 161         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 162         if (!tsec)
 163                 return -ENOMEM;
 164
 165         tsec->task = task;
 166         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 167         task->security = tsec;
 168
 169         return 0;
 170 }
 171
 172 static void task_free_security(struct task_struct *task)
 173 {
 174         struct task_security_struct *tsec = task->security;
 175         task->security = NULL;
 176         kfree(tsec);
 177 }
 178
 179 static int inode_alloc_security(struct inode *inode)
 180 {
 181         struct task_security_struct *tsec = current->security;
 182         struct inode_security_struct *isec;
 183
 184         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 185         if (!isec)
 186                 return -ENOMEM;
 187
 188         mutex_init(&isec->lock);
 189         INIT_LIST_HEAD(&isec->list);
 190         isec->inode = inode;
 191         isec->sid = SECINITSID_UNLABELED;
 192         isec->sclass = SECCLASS_FILE;
 193         isec->task_sid = tsec->sid;
 194         inode->i_security = isec;
 195
 196         return 0;
 197 }
 198
 199 static void inode_free_security(struct inode *inode)
 200 {
 201         struct inode_security_struct *isec = inode->i_security;
 202         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 203
 204         spin_lock(&sbsec->isec_lock);
 205         if (!list_empty(&isec->list))
 206                 list_del_init(&isec->list);
 207         spin_unlock(&sbsec->isec_lock);
 208
 209         inode->i_security = NULL;
 210         kmem_cache_free(sel_inode_cache, isec);
 211 }
 212
 213 static int file_alloc_security(struct file *file)
 214 {
 215         struct task_security_struct *tsec = current->security;
 216         struct file_security_struct *fsec;
 217
 218         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 219         if (!fsec)
 220                 return -ENOMEM;
 221
 222         fsec->file = file;
 223         fsec->sid = tsec->sid;
 224         fsec->fown_sid = tsec->sid;
 225         file->f_security = fsec;
 226
 227         return 0;
 228 }
 229
 230 static void file_free_security(struct file *file)
 231 {
 232         struct file_security_struct *fsec = file->f_security;
 233         file->f_security = NULL;
 234         kfree(fsec);
 235 }
 236
 237 static int superblock_alloc_security(struct super_block *sb)
 238 {
 239         struct superblock_security_struct *sbsec;
 240
 241         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 242         if (!sbsec)
 243                 return -ENOMEM;
 244
 245         mutex_init(&sbsec->lock);
 246         INIT_LIST_HEAD(&sbsec->list);
 247         INIT_LIST_HEAD(&sbsec->isec_head);
 248         spin_lock_init(&sbsec->isec_lock);
 249         sbsec->sb = sb;
 250         sbsec->sid = SECINITSID_UNLABELED;
 251         sbsec->def_sid = SECINITSID_FILE;
 252         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 253         sb->s_security = sbsec;
 254
 255         return 0;
 256 }
 257
 258 static void superblock_free_security(struct super_block *sb)
 259 {
 260         struct superblock_security_struct *sbsec = sb->s_security;
 261
 262         spin_lock(&sb_security_lock);
 263         if (!list_empty(&sbsec->list))
 264                 list_del_init(&sbsec->list);
 265         spin_unlock(&sb_security_lock);
 266
 267         sb->s_security = NULL;
 268         kfree(sbsec);
 269 }
 270
 271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 272 {
 273         struct sk_security_struct *ssec;
 274
 275         ssec = kzalloc(sizeof(*ssec), priority);
 276         if (!ssec)
 277                 return -ENOMEM;
 278
 279         ssec->sk = sk;
 280         ssec->peer_sid = SECINITSID_UNLABELED;
 281         ssec->sid = SECINITSID_UNLABELED;
 282         sk->sk_security = ssec;
 283
 284         selinux_netlbl_sk_security_init(ssec, family);
 285
 286         return 0;
 287 }
 288
 289 static void sk_free_security(struct sock *sk)
 290 {
 291         struct sk_security_struct *ssec = sk->sk_security;
 292
 293         sk->sk_security = NULL;
 294         kfree(ssec);
 295 }
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323         Opt_rootcontext = 8,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331 };
 332
 333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 334
 335 static int may_context_mount_sb_relabel(u32 sid,
 336                         struct superblock_security_struct *sbsec,
 337                         struct task_security_struct *tsec)
 338 {
 339         int rc;
 340
 341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 342                           FILESYSTEM__RELABELFROM, NULL);
 343         if (rc)
 344                 return rc;
 345
 346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELTO, NULL);
 348         return rc;
 349 }
 350
 351 static int may_context_mount_inode_relabel(u32 sid,
 352                         struct superblock_security_struct *sbsec,
 353                         struct task_security_struct *tsec)
 354 {
 355         int rc;
 356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELFROM, NULL);
 358         if (rc)
 359                 return rc;
 360
 361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__ASSOCIATE, NULL);
 363         return rc;
 364 }
 365
 366 static int try_context_mount(struct super_block *sb, void *data)
 367 {
 368         char *context = NULL, *defcontext = NULL;
 369         char *fscontext = NULL, *rootcontext = NULL;
 370         const char *name;
 371         u32 sid;
 372         int alloc = 0, rc = 0, seen = 0;
 373         struct task_security_struct *tsec = current->security;
 374         struct superblock_security_struct *sbsec = sb->s_security;
 375
 376         if (!data)
 377                 goto out;
 378
 379         name = sb->s_type->name;
 380
 381         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 382
 383                 /* NFS we understand. */
 384                 if (!strcmp(name, "nfs")) {
 385                         struct nfs_mount_data *d = data;
 386
 387                         if (d->version <  NFS_MOUNT_VERSION)
 388                                 goto out;
 389
 390                         if (d->context[0]) {
 391                                 context = d->context;
 392                                 seen |= Opt_context;
 393                         }
 394                 } else
 395                         goto out;
 396
 397         } else {
 398                 /* Standard string-based options. */
 399                 char *p, *options = data;
 400
 401                 while ((p = strsep(&options, "|")) != NULL) {
 402                         int token;
 403                         substring_t args[MAX_OPT_ARGS];
 404
 405                         if (!*p)
 406                                 continue;
 407
 408                         token = match_token(p, tokens, args);
 409
 410                         switch (token) {
 411                         case Opt_context:
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 context = match_strdup(&args[0]);
 418                                 if (!context) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_context;
 425                                 break;
 426
 427                         case Opt_fscontext:
 428                                 if (seen & Opt_fscontext) {
 429                                         rc = -EINVAL;
 430                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 431                                         goto out_free;
 432                                 }
 433                                 fscontext = match_strdup(&args[0]);
 434                                 if (!fscontext) {
 435                                         rc = -ENOMEM;
 436                                         goto out_free;
 437                                 }
 438                                 if (!alloc)
 439                                         alloc = 1;
 440                                 seen |= Opt_fscontext;
 441                                 break;
 442
 443                         case Opt_rootcontext:
 444                                 if (seen & Opt_rootcontext) {
 445                                         rc = -EINVAL;
 446                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 447                                         goto out_free;
 448                                 }
 449                                 rootcontext = match_strdup(&args[0]);
 450                                 if (!rootcontext) {
 451                                         rc = -ENOMEM;
 452                                         goto out_free;
 453                                 }
 454                                 if (!alloc)
 455                                         alloc = 1;
 456                                 seen |= Opt_rootcontext;
 457                                 break;
 458
 459                         case Opt_defcontext:
 460                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 461                                         rc = -EINVAL;
 462                                         printk(KERN_WARNING "SELinux:  "
 463                                                "defcontext option is invalid "
 464                                                "for this filesystem type\n");
 465                                         goto out_free;
 466                                 }
 467                                 if (seen & (Opt_context|Opt_defcontext)) {
 468                                         rc = -EINVAL;
 469                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 470                                         goto out_free;
 471                                 }
 472                                 defcontext = match_strdup(&args[0]);
 473                                 if (!defcontext) {
 474                                         rc = -ENOMEM;
 475                                         goto out_free;
 476                                 }
 477                                 if (!alloc)
 478                                         alloc = 1;
 479                                 seen |= Opt_defcontext;
 480                                 break;
 481
 482                         default:
 483                                 rc = -EINVAL;
 484                                 printk(KERN_WARNING "SELinux:  unknown mount "
 485                                        "option\n");
 486                                 goto out_free;
 487
 488                         }
 489                 }
 490         }
 491
 492         if (!seen)
 493                 goto out;
 494
 495         /* sets the context of the superblock for the fs being mounted. */
 496         if (fscontext) {
 497                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 498                 if (rc) {
 499                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 500                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 501                                fscontext, sb->s_id, name, rc);
 502                         goto out_free;
 503                 }
 504
 505                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 506                 if (rc)
 507                         goto out_free;
 508
 509                 sbsec->sid = sid;
 510         }
 511
 512         /*
 513          * Switch to using mount point labeling behavior.
 514          * sets the label used on all file below the mountpoint, and will set
 515          * the superblock context if not already set.
 516          */
 517         if (context) {
 518                 rc = security_context_to_sid(context, strlen(context), &sid);
 519                 if (rc) {
 520                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 521                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 522                                context, sb->s_id, name, rc);
 523                         goto out_free;
 524                 }
 525
 526                 if (!fscontext) {
 527                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 528                         if (rc)
 529                                 goto out_free;
 530                         sbsec->sid = sid;
 531                 } else {
 532                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 533                         if (rc)
 534                                 goto out_free;
 535                 }
 536                 sbsec->mntpoint_sid = sid;
 537
 538                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 539         }
 540
 541         if (rootcontext) {
 542                 struct inode *inode = sb->s_root->d_inode;
 543                 struct inode_security_struct *isec = inode->i_security;
 544                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 545                 if (rc) {
 546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 548                                rootcontext, sb->s_id, name, rc);
 549                         goto out_free;
 550                 }
 551
 552                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 553                 if (rc)
 554                         goto out_free;
 555
 556                 isec->sid = sid;
 557                 isec->initialized = 1;
 558         }
 559
 560         if (defcontext) {
 561                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 562                 if (rc) {
 563                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 564                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 565                                defcontext, sb->s_id, name, rc);
 566                         goto out_free;
 567                 }
 568
 569                 if (sid == sbsec->def_sid)
 570                         goto out_free;
 571
 572                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 573                 if (rc)
 574                         goto out_free;
 575
 576                 sbsec->def_sid = sid;
 577         }
 578
 579 out_free:
 580         if (alloc) {
 581                 kfree(context);
 582                 kfree(defcontext);
 583                 kfree(fscontext);
 584                 kfree(rootcontext);
 585         }
 586 out:
 587         return rc;
 588 }
 589
 590 static int superblock_doinit(struct super_block *sb, void *data)
 591 {
 592         struct superblock_security_struct *sbsec = sb->s_security;
 593         struct dentry *root = sb->s_root;
 594         struct inode *inode = root->d_inode;
 595         int rc = 0;
 596
 597         mutex_lock(&sbsec->lock);
 598         if (sbsec->initialized)
 599                 goto out;
 600
 601         if (!ss_initialized) {
 602                 /* Defer initialization until selinux_complete_init,
 603                    after the initial policy is loaded and the security
 604                    server is ready to handle calls. */
 605                 spin_lock(&sb_security_lock);
 606                 if (list_empty(&sbsec->list))
 607                         list_add(&sbsec->list, &superblock_security_head);
 608                 spin_unlock(&sb_security_lock);
 609                 goto out;
 610         }
 611
 612         /* Determine the labeling behavior to use for this filesystem type. */
 613         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 614         if (rc) {
 615                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 616                        __FUNCTION__, sb->s_type->name, rc);
 617                 goto out;
 618         }
 619
 620         rc = try_context_mount(sb, data);
 621         if (rc)
 622                 goto out;
 623
 624         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 625                 /* Make sure that the xattr handler exists and that no
 626                    error other than -ENODATA is returned by getxattr on
 627                    the root directory.  -ENODATA is ok, as this may be
 628                    the first boot of the SELinux kernel before we have
 629                    assigned xattr values to the filesystem. */
 630                 if (!inode->i_op->getxattr) {
 631                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 632                                "xattr support\n", sb->s_id, sb->s_type->name);
 633                         rc = -EOPNOTSUPP;
 634                         goto out;
 635                 }
 636                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 637                 if (rc < 0 && rc != -ENODATA) {
 638                         if (rc == -EOPNOTSUPP)
 639                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 640                                        "%s) has no security xattr handler\n",
 641                                        sb->s_id, sb->s_type->name);
 642                         else
 643                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 644                                        "%s) getxattr errno %d\n", sb->s_id,
 645                                        sb->s_type->name, -rc);
 646                         goto out;
 647                 }
 648         }
 649
 650         if (strcmp(sb->s_type->name, "proc") == 0)
 651                 sbsec->proc = 1;
 652
 653         sbsec->initialized = 1;
 654
 655         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 656                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 657                        sb->s_id, sb->s_type->name);
 658         }
 659         else {
 660                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 661                        sb->s_id, sb->s_type->name,
 662                        labeling_behaviors[sbsec->behavior-1]);
 663         }
 664
 665         /* Initialize the root inode. */
 666         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 667
 668         /* Initialize any other inodes associated with the superblock, e.g.
 669            inodes created prior to initial policy load or inodes created
 670            during get_sb by a pseudo filesystem that directly
 671            populates itself. */
 672         spin_lock(&sbsec->isec_lock);
 673 next_inode:
 674         if (!list_empty(&sbsec->isec_head)) {
 675                 struct inode_security_struct *isec =
 676                                 list_entry(sbsec->isec_head.next,
 677                                            struct inode_security_struct, list);
 678                 struct inode *inode = isec->inode;
 679                 spin_unlock(&sbsec->isec_lock);
 680                 inode = igrab(inode);
 681                 if (inode) {
 682                         if (!IS_PRIVATE (inode))
 683                                 inode_doinit(inode);
 684                         iput(inode);
 685                 }
 686                 spin_lock(&sbsec->isec_lock);
 687                 list_del_init(&isec->list);
 688                 goto next_inode;
 689         }
 690         spin_unlock(&sbsec->isec_lock);
 691 out:
 692         mutex_unlock(&sbsec->lock);
 693         return rc;
 694 }
 695
 696 static inline u16 inode_mode_to_security_class(umode_t mode)
 697 {
 698         switch (mode & S_IFMT) {
 699         case S_IFSOCK:
 700                 return SECCLASS_SOCK_FILE;
 701         case S_IFLNK:
 702                 return SECCLASS_LNK_FILE;
 703         case S_IFREG:
 704                 return SECCLASS_FILE;
 705         case S_IFBLK:
 706                 return SECCLASS_BLK_FILE;
 707         case S_IFDIR:
 708                 return SECCLASS_DIR;
 709         case S_IFCHR:
 710                 return SECCLASS_CHR_FILE;
 711         case S_IFIFO:
 712                 return SECCLASS_FIFO_FILE;
 713
 714         }
 715
 716         return SECCLASS_FILE;
 717 }
 718
 719 static inline int default_protocol_stream(int protocol)
 720 {
 721         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 722 }
 723
 724 static inline int default_protocol_dgram(int protocol)
 725 {
 726         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 727 }
 728
 729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 730 {
 731         switch (family) {
 732         case PF_UNIX:
 733                 switch (type) {
 734                 case SOCK_STREAM:
 735                 case SOCK_SEQPACKET:
 736                         return SECCLASS_UNIX_STREAM_SOCKET;
 737                 case SOCK_DGRAM:
 738                         return SECCLASS_UNIX_DGRAM_SOCKET;
 739                 }
 740                 break;
 741         case PF_INET:
 742         case PF_INET6:
 743                 switch (type) {
 744                 case SOCK_STREAM:
 745                         if (default_protocol_stream(protocol))
 746                                 return SECCLASS_TCP_SOCKET;
 747                         else
 748                                 return SECCLASS_RAWIP_SOCKET;
 749                 case SOCK_DGRAM:
 750                         if (default_protocol_dgram(protocol))
 751                                 return SECCLASS_UDP_SOCKET;
 752                         else
 753                                 return SECCLASS_RAWIP_SOCKET;
 754                 case SOCK_DCCP:
 755                         return SECCLASS_DCCP_SOCKET;
 756                 default:
 757                         return SECCLASS_RAWIP_SOCKET;
 758                 }
 759                 break;
 760         case PF_NETLINK:
 761                 switch (protocol) {
 762                 case NETLINK_ROUTE:
 763                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 764                 case NETLINK_FIREWALL:
 765                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 766                 case NETLINK_INET_DIAG:
 767                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 768                 case NETLINK_NFLOG:
 769                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 770                 case NETLINK_XFRM:
 771                         return SECCLASS_NETLINK_XFRM_SOCKET;
 772                 case NETLINK_SELINUX:
 773                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 774                 case NETLINK_AUDIT:
 775                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 776                 case NETLINK_IP6_FW:
 777                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 778                 case NETLINK_DNRTMSG:
 779                         return SECCLASS_NETLINK_DNRT_SOCKET;
 780                 case NETLINK_KOBJECT_UEVENT:
 781                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 782                 default:
 783                         return SECCLASS_NETLINK_SOCKET;
 784                 }
 785         case PF_PACKET:
 786                 return SECCLASS_PACKET_SOCKET;
 787         case PF_KEY:
 788                 return SECCLASS_KEY_SOCKET;
 789         case PF_APPLETALK:
 790                 return SECCLASS_APPLETALK_SOCKET;
 791         }
 792
 793         return SECCLASS_SOCKET;
 794 }
 795
 796 #ifdef CONFIG_PROC_FS
 797 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 798                                 u16 tclass,
 799                                 u32 *sid)
 800 {
 801         int buflen, rc;
 802         char *buffer, *path, *end;
 803
 804         buffer = (char*)__get_free_page(GFP_KERNEL);
 805         if (!buffer)
 806                 return -ENOMEM;
 807
 808         buflen = PAGE_SIZE;
 809         end = buffer+buflen;
 810         *--end = '\0';
 811         buflen--;
 812         path = end-1;
 813         *path = '/';
 814         while (de && de != de->parent) {
 815                 buflen -= de->namelen + 1;
 816                 if (buflen < 0)
 817                         break;
 818                 end -= de->namelen;
 819                 memcpy(end, de->name, de->namelen);
 820                 *--end = '/';
 821                 path = end;
 822                 de = de->parent;
 823         }
 824         rc = security_genfs_sid("proc", path, tclass, sid);
 825         free_page((unsigned long)buffer);
 826         return rc;
 827 }
 828 #else
 829 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 830                                 u16 tclass,
 831                                 u32 *sid)
 832 {
 833         return -EINVAL;
 834 }
 835 #endif
 836
 837 /* The inode's security attributes must be initialized before first use. */
 838 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 839 {
 840         struct superblock_security_struct *sbsec = NULL;
 841         struct inode_security_struct *isec = inode->i_security;
 842         u32 sid;
 843         struct dentry *dentry;
 844 #define INITCONTEXTLEN 255
 845         char *context = NULL;
 846         unsigned len = 0;
 847         int rc = 0;
 848
 849         if (isec->initialized)
 850                 goto out;
 851
 852         mutex_lock(&isec->lock);
 853         if (isec->initialized)
 854                 goto out_unlock;
 855
 856         sbsec = inode->i_sb->s_security;
 857         if (!sbsec->initialized) {
 858                 /* Defer initialization until selinux_complete_init,
 859                    after the initial policy is loaded and the security
 860                    server is ready to handle calls. */
 861                 spin_lock(&sbsec->isec_lock);
 862                 if (list_empty(&isec->list))
 863                         list_add(&isec->list, &sbsec->isec_head);
 864                 spin_unlock(&sbsec->isec_lock);
 865                 goto out_unlock;
 866         }
 867
 868         switch (sbsec->behavior) {
 869         case SECURITY_FS_USE_XATTR:
 870                 if (!inode->i_op->getxattr) {
 871                         isec->sid = sbsec->def_sid;
 872                         break;
 873                 }
 874
 875                 /* Need a dentry, since the xattr API requires one.
 876                    Life would be simpler if we could just pass the inode. */
 877                 if (opt_dentry) {
 878                         /* Called from d_instantiate or d_splice_alias. */
 879                         dentry = dget(opt_dentry);
 880                 } else {
 881                         /* Called from selinux_complete_init, try to find a dentry. */
 882                         dentry = d_find_alias(inode);
 883                 }
 884                 if (!dentry) {
 885                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 886                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 887                                inode->i_ino);
 888                         goto out_unlock;
 889                 }
 890
 891                 len = INITCONTEXTLEN;
 892                 context = kmalloc(len, GFP_KERNEL);
 893                 if (!context) {
 894                         rc = -ENOMEM;
 895                         dput(dentry);
 896                         goto out_unlock;
 897                 }
 898                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 899                                            context, len);
 900                 if (rc == -ERANGE) {
 901                         /* Need a larger buffer.  Query for the right size. */
 902                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 903                                                    NULL, 0);
 904                         if (rc < 0) {
 905                                 dput(dentry);
 906                                 goto out_unlock;
 907                         }
 908                         kfree(context);
 909                         len = rc;
 910                         context = kmalloc(len, GFP_KERNEL);
 911                         if (!context) {
 912                                 rc = -ENOMEM;
 913                                 dput(dentry);
 914                                 goto out_unlock;
 915                         }
 916                         rc = inode->i_op->getxattr(dentry,
 917                                                    XATTR_NAME_SELINUX,
 918                                                    context, len);
 919                 }
 920                 dput(dentry);
 921                 if (rc < 0) {
 922                         if (rc != -ENODATA) {
 923                                 printk(KERN_WARNING "%s:  getxattr returned "
 924                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 925                                        -rc, inode->i_sb->s_id, inode->i_ino);
 926                                 kfree(context);
 927                                 goto out_unlock;
 928                         }
 929                         /* Map ENODATA to the default file SID */
 930                         sid = sbsec->def_sid;
 931                         rc = 0;
 932                 } else {
 933                         rc = security_context_to_sid_default(context, rc, &sid,
 934                                                              sbsec->def_sid);
 935                         if (rc) {
 936                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 937                                        "returned %d for dev=%s ino=%ld\n",
 938                                        __FUNCTION__, context, -rc,
 939                                        inode->i_sb->s_id, inode->i_ino);
 940                                 kfree(context);
 941                                 /* Leave with the unlabeled SID */
 942                                 rc = 0;
 943                                 break;
 944                         }
 945                 }
 946                 kfree(context);
 947                 isec->sid = sid;
 948                 break;
 949         case SECURITY_FS_USE_TASK:
 950                 isec->sid = isec->task_sid;
 951                 break;
 952         case SECURITY_FS_USE_TRANS:
 953                 /* Default to the fs SID. */
 954                 isec->sid = sbsec->sid;
 955
 956                 /* Try to obtain a transition SID. */
 957                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 958                 rc = security_transition_sid(isec->task_sid,
 959                                              sbsec->sid,
 960                                              isec->sclass,
 961                                              &sid);
 962                 if (rc)
 963                         goto out_unlock;
 964                 isec->sid = sid;
 965                 break;
 966         case SECURITY_FS_USE_MNTPOINT:
 967                 isec->sid = sbsec->mntpoint_sid;
 968                 break;
 969         default:
 970                 /* Default to the fs superblock SID. */
 971                 isec->sid = sbsec->sid;
 972
 973                 if (sbsec->proc) {
 974                         struct proc_inode *proci = PROC_I(inode);
 975                         if (proci->pde) {
 976                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 977                                 rc = selinux_proc_get_sid(proci->pde,
 978                                                           isec->sclass,
 979                                                           &sid);
 980                                 if (rc)
 981                                         goto out_unlock;
 982                                 isec->sid = sid;
 983                         }
 984                 }
 985                 break;
 986         }
 987
 988         isec->initialized = 1;
 989
 990 out_unlock:
 991         mutex_unlock(&isec->lock);
 992 out:
 993         if (isec->sclass == SECCLASS_FILE)
 994                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 995         return rc;
 996 }
 997
 998 /* Convert a Linux signal to an access vector. */
 999 static inline u32 signal_to_av(int sig)
1000 {
1001         u32 perm = 0;
1002
1003         switch (sig) {
1004         case SIGCHLD:
1005                 /* Commonly granted from child to parent. */
1006                 perm = PROCESS__SIGCHLD;
1007                 break;
1008         case SIGKILL:
1009                 /* Cannot be caught or ignored */
1010                 perm = PROCESS__SIGKILL;
1011                 break;
1012         case SIGSTOP:
1013                 /* Cannot be caught or ignored */
1014                 perm = PROCESS__SIGSTOP;
1015                 break;
1016         default:
1017                 /* All other signals. */
1018                 perm = PROCESS__SIGNAL;
1019                 break;
1020         }
1021
1022         return perm;
1023 }
1024
1025 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1026    fork check, ptrace check, etc. */
1027 static int task_has_perm(struct task_struct *tsk1,
1028                          struct task_struct *tsk2,
1029                          u32 perms)
1030 {
1031         struct task_security_struct *tsec1, *tsec2;
1032
1033         tsec1 = tsk1->security;
1034         tsec2 = tsk2->security;
1035         return avc_has_perm(tsec1->sid, tsec2->sid,
1036                             SECCLASS_PROCESS, perms, NULL);
1037 }
1038
1039 /* Check whether a task is allowed to use a capability. */
1040 static int task_has_capability(struct task_struct *tsk,
1041                                int cap)
1042 {
1043         struct task_security_struct *tsec;
1044         struct avc_audit_data ad;
1045
1046         tsec = tsk->security;
1047
1048         AVC_AUDIT_DATA_INIT(&ad,CAP);
1049         ad.tsk = tsk;
1050         ad.u.cap = cap;
1051
1052         return avc_has_perm(tsec->sid, tsec->sid,
1053                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054 }
1055
1056 /* Check whether a task is allowed to use a system operation. */
1057 static int task_has_system(struct task_struct *tsk,
1058                            u32 perms)
1059 {
1060         struct task_security_struct *tsec;
1061
1062         tsec = tsk->security;
1063
1064         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065                             SECCLASS_SYSTEM, perms, NULL);
1066 }
1067
1068 /* Check whether a task has a particular permission to an inode.
1069    The 'adp' parameter is optional and allows other audit
1070    data to be passed (e.g. the dentry). */
1071 static int inode_has_perm(struct task_struct *tsk,
1072                           struct inode *inode,
1073                           u32 perms,
1074                           struct avc_audit_data *adp)
1075 {
1076         struct task_security_struct *tsec;
1077         struct inode_security_struct *isec;
1078         struct avc_audit_data ad;
1079
1080         if (unlikely (IS_PRIVATE (inode)))
1081                 return 0;
1082
1083         tsec = tsk->security;
1084         isec = inode->i_security;
1085
1086         if (!adp) {
1087                 adp = &ad;
1088                 AVC_AUDIT_DATA_INIT(&ad, FS);
1089                 ad.u.fs.inode = inode;
1090         }
1091
1092         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 }
1094
1095 /* Same as inode_has_perm, but pass explicit audit data containing
1096    the dentry to help the auditing code to more easily generate the
1097    pathname if needed. */
1098 static inline int dentry_has_perm(struct task_struct *tsk,
1099                                   struct vfsmount *mnt,
1100                                   struct dentry *dentry,
1101                                   u32 av)
1102 {
1103         struct inode *inode = dentry->d_inode;
1104         struct avc_audit_data ad;
1105         AVC_AUDIT_DATA_INIT(&ad,FS);
1106         ad.u.fs.mnt = mnt;
1107         ad.u.fs.dentry = dentry;
1108         return inode_has_perm(tsk, inode, av, &ad);
1109 }
1110
1111 /* Check whether a task can use an open file descriptor to
1112    access an inode in a given way.  Check access to the
1113    descriptor itself, and then use dentry_has_perm to
1114    check a particular permission to the file.
1115    Access to the descriptor is implicitly granted if it
1116    has the same SID as the process.  If av is zero, then
1117    access to the file is not checked, e.g. for cases
1118    where only the descriptor is affected like seek. */
1119 static int file_has_perm(struct task_struct *tsk,
1120                                 struct file *file,
1121                                 u32 av)
1122 {
1123         struct task_security_struct *tsec = tsk->security;
1124         struct file_security_struct *fsec = file->f_security;
1125         struct vfsmount *mnt = file->f_path.mnt;
1126         struct dentry *dentry = file->f_path.dentry;
1127         struct inode *inode = dentry->d_inode;
1128         struct avc_audit_data ad;
1129         int rc;
1130
1131         AVC_AUDIT_DATA_INIT(&ad, FS);
1132         ad.u.fs.mnt = mnt;
1133         ad.u.fs.dentry = dentry;
1134
1135         if (tsec->sid != fsec->sid) {
1136                 rc = avc_has_perm(tsec->sid, fsec->sid,
1137                                   SECCLASS_FD,
1138                                   FD__USE,
1139                                   &ad);
1140                 if (rc)
1141                         return rc;
1142         }
1143
1144         /* av is zero if only checking access to the descriptor. */
1145         if (av)
1146                 return inode_has_perm(tsk, inode, av, &ad);
1147
1148         return 0;
1149 }
1150
1151 /* Check whether a task can create a file. */
1152 static int may_create(struct inode *dir,
1153                       struct dentry *dentry,
1154                       u16 tclass)
1155 {
1156         struct task_security_struct *tsec;
1157         struct inode_security_struct *dsec;
1158         struct superblock_security_struct *sbsec;
1159         u32 newsid;
1160         struct avc_audit_data ad;
1161         int rc;
1162
1163         tsec = current->security;
1164         dsec = dir->i_security;
1165         sbsec = dir->i_sb->s_security;
1166
1167         AVC_AUDIT_DATA_INIT(&ad, FS);
1168         ad.u.fs.dentry = dentry;
1169
1170         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1171                           DIR__ADD_NAME | DIR__SEARCH,
1172                           &ad);
1173         if (rc)
1174                 return rc;
1175
1176         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1177                 newsid = tsec->create_sid;
1178         } else {
1179                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1180                                              &newsid);
1181                 if (rc)
1182                         return rc;
1183         }
1184
1185         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1186         if (rc)
1187                 return rc;
1188
1189         return avc_has_perm(newsid, sbsec->sid,
1190                             SECCLASS_FILESYSTEM,
1191                             FILESYSTEM__ASSOCIATE, &ad);
1192 }
1193
1194 /* Check whether a task can create a key. */
1195 static int may_create_key(u32 ksid,
1196                           struct task_struct *ctx)
1197 {
1198         struct task_security_struct *tsec;
1199
1200         tsec = ctx->security;
1201
1202         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1203 }
1204
1205 #define MAY_LINK   0
1206 #define MAY_UNLINK 1
1207 #define MAY_RMDIR  2
1208
1209 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1210 static int may_link(struct inode *dir,
1211                     struct dentry *dentry,
1212                     int kind)
1213
1214 {
1215         struct task_security_struct *tsec;
1216         struct inode_security_struct *dsec, *isec;
1217         struct avc_audit_data ad;
1218         u32 av;
1219         int rc;
1220
1221         tsec = current->security;
1222         dsec = dir->i_security;
1223         isec = dentry->d_inode->i_security;
1224
1225         AVC_AUDIT_DATA_INIT(&ad, FS);
1226         ad.u.fs.dentry = dentry;
1227
1228         av = DIR__SEARCH;
1229         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1230         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1231         if (rc)
1232                 return rc;
1233
1234         switch (kind) {
1235         case MAY_LINK:
1236                 av = FILE__LINK;
1237                 break;
1238         case MAY_UNLINK:
1239                 av = FILE__UNLINK;
1240                 break;
1241         case MAY_RMDIR:
1242                 av = DIR__RMDIR;
1243                 break;
1244         default:
1245                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1246                 return 0;
1247         }
1248
1249         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1250         return rc;
1251 }
1252
1253 static inline int may_rename(struct inode *old_dir,
1254                              struct dentry *old_dentry,
1255                              struct inode *new_dir,
1256                              struct dentry *new_dentry)
1257 {
1258         struct task_security_struct *tsec;
1259         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1260         struct avc_audit_data ad;
1261         u32 av;
1262         int old_is_dir, new_is_dir;
1263         int rc;
1264
1265         tsec = current->security;
1266         old_dsec = old_dir->i_security;
1267         old_isec = old_dentry->d_inode->i_security;
1268         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1269         new_dsec = new_dir->i_security;
1270
1271         AVC_AUDIT_DATA_INIT(&ad, FS);
1272
1273         ad.u.fs.dentry = old_dentry;
1274         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1275                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276         if (rc)
1277                 return rc;
1278         rc = avc_has_perm(tsec->sid, old_isec->sid,
1279                           old_isec->sclass, FILE__RENAME, &ad);
1280         if (rc)
1281                 return rc;
1282         if (old_is_dir && new_dir != old_dir) {
1283                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1284                                   old_isec->sclass, DIR__REPARENT, &ad);
1285                 if (rc)
1286                         return rc;
1287         }
1288
1289         ad.u.fs.dentry = new_dentry;
1290         av = DIR__ADD_NAME | DIR__SEARCH;
1291         if (new_dentry->d_inode)
1292                 av |= DIR__REMOVE_NAME;
1293         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294         if (rc)
1295                 return rc;
1296         if (new_dentry->d_inode) {
1297                 new_isec = new_dentry->d_inode->i_security;
1298                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1299                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1300                                   new_isec->sclass,
1301                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1302                 if (rc)
1303                         return rc;
1304         }
1305
1306         return 0;
1307 }
1308
1309 /* Check whether a task can perform a filesystem operation. */
1310 static int superblock_has_perm(struct task_struct *tsk,
1311                                struct super_block *sb,
1312                                u32 perms,
1313                                struct avc_audit_data *ad)
1314 {
1315         struct task_security_struct *tsec;
1316         struct superblock_security_struct *sbsec;
1317
1318         tsec = tsk->security;
1319         sbsec = sb->s_security;
1320         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1321                             perms, ad);
1322 }
1323
1324 /* Convert a Linux mode and permission mask to an access vector. */
1325 static inline u32 file_mask_to_av(int mode, int mask)
1326 {
1327         u32 av = 0;
1328
1329         if ((mode & S_IFMT) != S_IFDIR) {
1330                 if (mask & MAY_EXEC)
1331                         av |= FILE__EXECUTE;
1332                 if (mask & MAY_READ)
1333                         av |= FILE__READ;
1334
1335                 if (mask & MAY_APPEND)
1336                         av |= FILE__APPEND;
1337                 else if (mask & MAY_WRITE)
1338                         av |= FILE__WRITE;
1339
1340         } else {
1341                 if (mask & MAY_EXEC)
1342                         av |= DIR__SEARCH;
1343                 if (mask & MAY_WRITE)
1344                         av |= DIR__WRITE;
1345                 if (mask & MAY_READ)
1346                         av |= DIR__READ;
1347         }
1348
1349         return av;
1350 }
1351
1352 /* Convert a Linux file to an access vector. */
1353 static inline u32 file_to_av(struct file *file)
1354 {
1355         u32 av = 0;
1356
1357         if (file->f_mode & FMODE_READ)
1358                 av |= FILE__READ;
1359         if (file->f_mode & FMODE_WRITE) {
1360                 if (file->f_flags & O_APPEND)
1361                         av |= FILE__APPEND;
1362                 else
1363                         av |= FILE__WRITE;
1364         }
1365
1366         return av;
1367 }
1368
1369 /* Hook functions begin here. */
1370
1371 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1372 {
1373         struct task_security_struct *psec = parent->security;
1374         struct task_security_struct *csec = child->security;
1375         int rc;
1376
1377         rc = secondary_ops->ptrace(parent,child);
1378         if (rc)
1379                 return rc;
1380
1381         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1382         /* Save the SID of the tracing process for later use in apply_creds. */
1383         if (!(child->ptrace & PT_PTRACED) && !rc)
1384                 csec->ptrace_sid = psec->sid;
1385         return rc;
1386 }
1387
1388 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1389                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391         int error;
1392
1393         error = task_has_perm(current, target, PROCESS__GETCAP);
1394         if (error)
1395                 return error;
1396
1397         return secondary_ops->capget(target, effective, inheritable, permitted);
1398 }
1399
1400 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1401                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1402 {
1403         int error;
1404
1405         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1406         if (error)
1407                 return error;
1408
1409         return task_has_perm(current, target, PROCESS__SETCAP);
1410 }
1411
1412 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1413                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1414 {
1415         secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420         int rc;
1421
1422         rc = secondary_ops->capable(tsk, cap);
1423         if (rc)
1424                 return rc;
1425
1426         return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1430 {
1431         int buflen, rc;
1432         char *buffer, *path, *end;
1433
1434         rc = -ENOMEM;
1435         buffer = (char*)__get_free_page(GFP_KERNEL);
1436         if (!buffer)
1437                 goto out;
1438
1439         buflen = PAGE_SIZE;
1440         end = buffer+buflen;
1441         *--end = '\0';
1442         buflen--;
1443         path = end-1;
1444         *path = '/';
1445         while (table) {
1446                 const char *name = table->procname;
1447                 size_t namelen = strlen(name);
1448                 buflen -= namelen + 1;
1449                 if (buflen < 0)
1450                         goto out_free;
1451                 end -= namelen;
1452                 memcpy(end, name, namelen);
1453                 *--end = '/';
1454                 path = end;
1455                 table = table->parent;
1456         }
1457         buflen -= 4;
1458         if (buflen < 0)
1459                 goto out_free;
1460         end -= 4;
1461         memcpy(end, "/sys", 4);
1462         path = end;
1463         rc = security_genfs_sid("proc", path, tclass, sid);
1464 out_free:
1465         free_page((unsigned long)buffer);
1466 out:
1467         return rc;
1468 }
1469
1470 static int selinux_sysctl(ctl_table *table, int op)
1471 {
1472         int error = 0;
1473         u32 av;
1474         struct task_security_struct *tsec;
1475         u32 tsid;
1476         int rc;
1477
1478         rc = secondary_ops->sysctl(table, op);
1479         if (rc)
1480                 return rc;
1481
1482         tsec = current->security;
1483
1484         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1485                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1486         if (rc) {
1487                 /* Default to the well-defined sysctl SID. */
1488                 tsid = SECINITSID_SYSCTL;
1489         }
1490
1491         /* The op values are "defined" in sysctl.c, thereby creating
1492          * a bad coupling between this module and sysctl.c */
1493         if(op == 001) {
1494                 error = avc_has_perm(tsec->sid, tsid,
1495                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1496         } else {
1497                 av = 0;
1498                 if (op & 004)
1499                         av |= FILE__READ;
1500                 if (op & 002)
1501                         av |= FILE__WRITE;
1502                 if (av)
1503                         error = avc_has_perm(tsec->sid, tsid,
1504                                              SECCLASS_FILE, av, NULL);
1505         }
1506
1507         return error;
1508 }
1509
1510 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1511 {
1512         int rc = 0;
1513
1514         if (!sb)
1515                 return 0;
1516
1517         switch (cmds) {
1518                 case Q_SYNC:
1519                 case Q_QUOTAON:
1520                 case Q_QUOTAOFF:
1521                 case Q_SETINFO:
1522                 case Q_SETQUOTA:
1523                         rc = superblock_has_perm(current,
1524                                                  sb,
1525                                                  FILESYSTEM__QUOTAMOD, NULL);
1526                         break;
1527                 case Q_GETFMT:
1528                 case Q_GETINFO:
1529                 case Q_GETQUOTA:
1530                         rc = superblock_has_perm(current,
1531                                                  sb,
1532                                                  FILESYSTEM__QUOTAGET, NULL);
1533                         break;
1534                 default:
1535                         rc = 0;  /* let the kernel handle invalid cmds */
1536                         break;
1537         }
1538         return rc;
1539 }
1540
1541 static int selinux_quota_on(struct dentry *dentry)
1542 {
1543         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1544 }
1545
1546 static int selinux_syslog(int type)
1547 {
1548         int rc;
1549
1550         rc = secondary_ops->syslog(type);
1551         if (rc)
1552                 return rc;
1553
1554         switch (type) {
1555                 case 3:         /* Read last kernel messages */
1556                 case 10:        /* Return size of the log buffer */
1557                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1558                         break;
1559                 case 6:         /* Disable logging to console */
1560                 case 7:         /* Enable logging to console */
1561                 case 8:         /* Set level of messages printed to console */
1562                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1563                         break;
1564                 case 0:         /* Close log */
1565                 case 1:         /* Open log */
1566                 case 2:         /* Read from log */
1567                 case 4:         /* Read/clear last kernel messages */
1568                 case 5:         /* Clear ring buffer */
1569                 default:
1570                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1571                         break;
1572         }
1573         return rc;
1574 }
1575
1576 /*
1577  * Check that a process has enough memory to allocate a new virtual
1578  * mapping. 0 means there is enough memory for the allocation to
1579  * succeed and -ENOMEM implies there is not.
1580  *
1581  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1582  * if the capability is granted, but __vm_enough_memory requires 1 if
1583  * the capability is granted.
1584  *
1585  * Do not audit the selinux permission check, as this is applied to all
1586  * processes that allocate mappings.
1587  */
1588 static int selinux_vm_enough_memory(long pages)
1589 {
1590         int rc, cap_sys_admin = 0;
1591         struct task_security_struct *tsec = current->security;
1592
1593         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1594         if (rc == 0)
1595                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1596                                         SECCLASS_CAPABILITY,
1597                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1598                                         NULL);
1599
1600         if (rc == 0)
1601                 cap_sys_admin = 1;
1602
1603         return __vm_enough_memory(pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610         struct bprm_security_struct *bsec;
1611
1612         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613         if (!bsec)
1614                 return -ENOMEM;
1615
1616         bsec->bprm = bprm;
1617         bsec->sid = SECINITSID_UNLABELED;
1618         bsec->set = 0;
1619
1620         bprm->security = bsec;
1621         return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626         struct task_security_struct *tsec;
1627         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628         struct inode_security_struct *isec;
1629         struct bprm_security_struct *bsec;
1630         u32 newsid;
1631         struct avc_audit_data ad;
1632         int rc;
1633
1634         rc = secondary_ops->bprm_set_security(bprm);
1635         if (rc)
1636                 return rc;
1637
1638         bsec = bprm->security;
1639
1640         if (bsec->set)
1641                 return 0;
1642
1643         tsec = current->security;
1644         isec = inode->i_security;
1645
1646         /* Default to the current task SID. */
1647         bsec->sid = tsec->sid;
1648
1649         /* Reset fs, key, and sock SIDs on execve. */
1650         tsec->create_sid = 0;
1651         tsec->keycreate_sid = 0;
1652         tsec->sockcreate_sid = 0;
1653
1654         if (tsec->exec_sid) {
1655                 newsid = tsec->exec_sid;
1656                 /* Reset exec SID on execve. */
1657                 tsec->exec_sid = 0;
1658         } else {
1659                 /* Check for a default transition on this program. */
1660                 rc = security_transition_sid(tsec->sid, isec->sid,
1661                                              SECCLASS_PROCESS, &newsid);
1662                 if (rc)
1663                         return rc;
1664         }
1665
1666         AVC_AUDIT_DATA_INIT(&ad, FS);
1667         ad.u.fs.mnt = bprm->file->f_path.mnt;
1668         ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671                 newsid = tsec->sid;
1672
1673         if (tsec->sid == newsid) {
1674                 rc = avc_has_perm(tsec->sid, isec->sid,
1675                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676                 if (rc)
1677                         return rc;
1678         } else {
1679                 /* Check permissions for the transition. */
1680                 rc = avc_has_perm(tsec->sid, newsid,
1681                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682                 if (rc)
1683                         return rc;
1684
1685                 rc = avc_has_perm(newsid, isec->sid,
1686                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687                 if (rc)
1688                         return rc;
1689
1690                 /* Clear any possibly unsafe personality bits on exec: */
1691                 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693                 /* Set the security field to the new SID. */
1694                 bsec->sid = newsid;
1695         }
1696
1697         bsec->set = 1;
1698         return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703         return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709         struct task_security_struct *tsec = current->security;
1710         int atsecure = 0;
1711
1712         if (tsec->osid != tsec->sid) {
1713                 /* Enable secure mode for SIDs transitions unless
1714                    the noatsecure permission is granted between
1715                    the two SIDs, i.e. ahp returns 0. */
1716                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717                                          SECCLASS_PROCESS,
1718                                          PROCESS__NOATSECURE, NULL);
1719         }
1720
1721         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726         kfree(bprm->security);
1727         bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736         struct avc_audit_data ad;
1737         struct file *file, *devnull = NULL;
1738         struct tty_struct *tty;
1739         struct fdtable *fdt;
1740         long j = -1;
1741         int drop_tty = 0;
1742
1743         mutex_lock(&tty_mutex);
1744         tty = get_current_tty();
1745         if (tty) {
1746                 file_list_lock();
1747                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748                 if (file) {
1749                         /* Revalidate access to controlling tty.
1750                            Use inode_has_perm on the tty inode directly rather
1751                            than using file_has_perm, as this particular open
1752                            file may belong to another process and we are only
1753                            interested in the inode-based check here. */
1754                         struct inode *inode = file->f_path.dentry->d_inode;
1755                         if (inode_has_perm(current, inode,
1756                                            FILE__READ | FILE__WRITE, NULL)) {
1757                                 drop_tty = 1;
1758                         }
1759                 }
1760                 file_list_unlock();
1761
1762                 /* Reset controlling tty. */
1763                 if (drop_tty)
1764                         proc_set_tty(current, NULL);
1765         }
1766         mutex_unlock(&tty_mutex);
1767
1768         /* Revalidate access to inherited open files. */
1769
1770         AVC_AUDIT_DATA_INIT(&ad,FS);
1771
1772         spin_lock(&files->file_lock);
1773         for (;;) {
1774                 unsigned long set, i;
1775                 int fd;
1776
1777                 j++;
1778                 i = j * __NFDBITS;
1779                 fdt = files_fdtable(files);
1780                 if (i >= fdt->max_fds)
1781                         break;
1782                 set = fdt->open_fds->fds_bits[j];
1783                 if (!set)
1784                         continue;
1785                 spin_unlock(&files->file_lock);
1786                 for ( ; set ; i++,set >>= 1) {
1787                         if (set & 1) {
1788                                 file = fget(i);
1789                                 if (!file)
1790                                         continue;
1791                                 if (file_has_perm(current,
1792                                                   file,
1793                                                   file_to_av(file))) {
1794                                         sys_close(i);
1795                                         fd = get_unused_fd();
1796                                         if (fd != i) {
1797                                                 if (fd >= 0)
1798                                                         put_unused_fd(fd);
1799                                                 fput(file);
1800                                                 continue;
1801                                         }
1802                                         if (devnull) {
1803                                                 get_file(devnull);
1804                                         } else {
1805                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1806                                                 if (IS_ERR(devnull)) {
1807                                                         devnull = NULL;
1808                                                         put_unused_fd(fd);
1809                                                         fput(file);
1810                                                         continue;
1811                                                 }
1812                                         }
1813                                         fd_install(fd, devnull);
1814                                 }
1815                                 fput(file);
1816                         }
1817                 }
1818                 spin_lock(&files->file_lock);
1819
1820         }
1821         spin_unlock(&files->file_lock);
1822 }
1823
1824 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1825 {
1826         struct task_security_struct *tsec;
1827         struct bprm_security_struct *bsec;
1828         u32 sid;
1829         int rc;
1830
1831         secondary_ops->bprm_apply_creds(bprm, unsafe);
1832
1833         tsec = current->security;
1834
1835         bsec = bprm->security;
1836         sid = bsec->sid;
1837
1838         tsec->osid = tsec->sid;
1839         bsec->unsafe = 0;
1840         if (tsec->sid != sid) {
1841                 /* Check for shared state.  If not ok, leave SID
1842                    unchanged and kill. */
1843                 if (unsafe & LSM_UNSAFE_SHARE) {
1844                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1845                                         PROCESS__SHARE, NULL);
1846                         if (rc) {
1847                                 bsec->unsafe = 1;
1848                                 return;
1849                         }
1850                 }
1851
1852                 /* Check for ptracing, and update the task SID if ok.
1853                    Otherwise, leave SID unchanged and kill. */
1854                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1855                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1856                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1857                                           NULL);
1858                         if (rc) {
1859                                 bsec->unsafe = 1;
1860                                 return;
1861                         }
1862                 }
1863                 tsec->sid = sid;
1864         }
1865 }
1866
1867 /*
1868  * called after apply_creds without the task lock held
1869  */
1870 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1871 {
1872         struct task_security_struct *tsec;
1873         struct rlimit *rlim, *initrlim;
1874         struct itimerval itimer;
1875         struct bprm_security_struct *bsec;
1876         int rc, i;
1877
1878         tsec = current->security;
1879         bsec = bprm->security;
1880
1881         if (bsec->unsafe) {
1882                 force_sig_specific(SIGKILL, current);
1883                 return;
1884         }
1885         if (tsec->osid == tsec->sid)
1886                 return;
1887
1888         /* Close files for which the new task SID is not authorized. */
1889         flush_unauthorized_files(current->files);
1890
1891         /* Check whether the new SID can inherit signal state
1892            from the old SID.  If not, clear itimers to avoid
1893            subsequent signal generation and flush and unblock
1894            signals. This must occur _after_ the task SID has
1895           been updated so that any kill done after the flush
1896           will be checked against the new SID. */
1897         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1898                           PROCESS__SIGINH, NULL);
1899         if (rc) {
1900                 memset(&itimer, 0, sizeof itimer);
1901                 for (i = 0; i < 3; i++)
1902                         do_setitimer(i, &itimer, NULL);
1903                 flush_signals(current);
1904                 spin_lock_irq(&current->sighand->siglock);
1905                 flush_signal_handlers(current, 1);
1906                 sigemptyset(&current->blocked);
1907                 recalc_sigpending();
1908                 spin_unlock_irq(&current->sighand->siglock);
1909         }
1910
1911         /* Check whether the new SID can inherit resource limits
1912            from the old SID.  If not, reset all soft limits to
1913            the lower of the current task's hard limit and the init
1914            task's soft limit.  Note that the setting of hard limits
1915            (even to lower them) can be controlled by the setrlimit
1916            check. The inclusion of the init task's soft limit into
1917            the computation is to avoid resetting soft limits higher
1918            than the default soft limit for cases where the default
1919            is lower than the hard limit, e.g. RLIMIT_CORE or
1920            RLIMIT_STACK.*/
1921         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1922                           PROCESS__RLIMITINH, NULL);
1923         if (rc) {
1924                 for (i = 0; i < RLIM_NLIMITS; i++) {
1925                         rlim = current->signal->rlim + i;
1926                         initrlim = init_task.signal->rlim+i;
1927                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1928                 }
1929                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1930                         /*
1931                          * This will cause RLIMIT_CPU calculations
1932                          * to be refigured.
1933                          */
1934                         current->it_prof_expires = jiffies_to_cputime(1);
1935                 }
1936         }
1937
1938         /* Wake up the parent if it is waiting so that it can
1939            recheck wait permission to the new task SID. */
1940         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1941 }
1942
1943 /* superblock security operations */
1944
1945 static int selinux_sb_alloc_security(struct super_block *sb)
1946 {
1947         return superblock_alloc_security(sb);
1948 }
1949
1950 static void selinux_sb_free_security(struct super_block *sb)
1951 {
1952         superblock_free_security(sb);
1953 }
1954
1955 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1956 {
1957         if (plen > olen)
1958                 return 0;
1959
1960         return !memcmp(prefix, option, plen);
1961 }
1962
1963 static inline int selinux_option(char *option, int len)
1964 {
1965         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1966                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1967                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1968                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1969 }
1970
1971 static inline void take_option(char **to, char *from, int *first, int len)
1972 {
1973         if (!*first) {
1974                 **to = ',';
1975                 *to += 1;
1976         } else
1977                 *first = 0;
1978         memcpy(*to, from, len);
1979         *to += len;
1980 }
1981
1982 static inline void take_selinux_option(char **to, char *from, int *first,
1983                                        int len)
1984 {
1985         int current_size = 0;
1986
1987         if (!*first) {
1988                 **to = '|';
1989                 *to += 1;
1990         }
1991         else
1992                 *first = 0;
1993
1994         while (current_size < len) {
1995                 if (*from != '"') {
1996                         **to = *from;
1997                         *to += 1;
1998                 }
1999                 from += 1;
2000                 current_size += 1;
2001         }
2002 }
2003
2004 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2005 {
2006         int fnosec, fsec, rc = 0;
2007         char *in_save, *in_curr, *in_end;
2008         char *sec_curr, *nosec_save, *nosec;
2009         int open_quote = 0;
2010
2011         in_curr = orig;
2012         sec_curr = copy;
2013
2014         /* Binary mount data: just copy */
2015         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2016                 copy_page(sec_curr, in_curr);
2017                 goto out;
2018         }
2019
2020         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2021         if (!nosec) {
2022                 rc = -ENOMEM;
2023                 goto out;
2024         }
2025
2026         nosec_save = nosec;
2027         fnosec = fsec = 1;
2028         in_save = in_end = orig;
2029
2030         do {
2031                 if (*in_end == '"')
2032                         open_quote = !open_quote;
2033                 if ((*in_end == ',' && open_quote == 0) ||
2034                                 *in_end == '\0') {
2035                         int len = in_end - in_curr;
2036
2037                         if (selinux_option(in_curr, len))
2038                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2039                         else
2040                                 take_option(&nosec, in_curr, &fnosec, len);
2041
2042                         in_curr = in_end + 1;
2043                 }
2044         } while (*in_end++);
2045
2046         strcpy(in_save, nosec_save);
2047         free_page((unsigned long)nosec_save);
2048 out:
2049         return rc;
2050 }
2051
2052 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2053 {
2054         struct avc_audit_data ad;
2055         int rc;
2056
2057         rc = superblock_doinit(sb, data);
2058         if (rc)
2059                 return rc;
2060
2061         AVC_AUDIT_DATA_INIT(&ad,FS);
2062         ad.u.fs.dentry = sb->s_root;
2063         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2064 }
2065
2066 static int selinux_sb_statfs(struct dentry *dentry)
2067 {
2068         struct avc_audit_data ad;
2069
2070         AVC_AUDIT_DATA_INIT(&ad,FS);
2071         ad.u.fs.dentry = dentry->d_sb->s_root;
2072         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2073 }
2074
2075 static int selinux_mount(char * dev_name,
2076                          struct nameidata *nd,
2077                          char * type,
2078                          unsigned long flags,
2079                          void * data)
2080 {
2081         int rc;
2082
2083         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2084         if (rc)
2085                 return rc;
2086
2087         if (flags & MS_REMOUNT)
2088                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2089                                            FILESYSTEM__REMOUNT, NULL);
2090         else
2091                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2092                                        FILE__MOUNTON);
2093 }
2094
2095 static int selinux_umount(struct vfsmount *mnt, int flags)
2096 {
2097         int rc;
2098
2099         rc = secondary_ops->sb_umount(mnt, flags);
2100         if (rc)
2101                 return rc;
2102
2103         return superblock_has_perm(current,mnt->mnt_sb,
2104                                    FILESYSTEM__UNMOUNT,NULL);
2105 }
2106
2107 /* inode security operations */
2108
2109 static int selinux_inode_alloc_security(struct inode *inode)
2110 {
2111         return inode_alloc_security(inode);
2112 }
2113
2114 static void selinux_inode_free_security(struct inode *inode)
2115 {
2116         inode_free_security(inode);
2117 }
2118
2119 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2120                                        char **name, void **value,
2121                                        size_t *len)
2122 {
2123         struct task_security_struct *tsec;
2124         struct inode_security_struct *dsec;
2125         struct superblock_security_struct *sbsec;
2126         u32 newsid, clen;
2127         int rc;
2128         char *namep = NULL, *context;
2129
2130         tsec = current->security;
2131         dsec = dir->i_security;
2132         sbsec = dir->i_sb->s_security;
2133
2134         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2135                 newsid = tsec->create_sid;
2136         } else {
2137                 rc = security_transition_sid(tsec->sid, dsec->sid,
2138                                              inode_mode_to_security_class(inode->i_mode),
2139                                              &newsid);
2140                 if (rc) {
2141                         printk(KERN_WARNING "%s:  "
2142                                "security_transition_sid failed, rc=%d (dev=%s "
2143                                "ino=%ld)\n",
2144                                __FUNCTION__,
2145                                -rc, inode->i_sb->s_id, inode->i_ino);
2146                         return rc;
2147                 }
2148         }
2149
2150         /* Possibly defer initialization to selinux_complete_init. */
2151         if (sbsec->initialized) {
2152                 struct inode_security_struct *isec = inode->i_security;
2153                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2154                 isec->sid = newsid;
2155                 isec->initialized = 1;
2156         }
2157
2158         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2159                 return -EOPNOTSUPP;
2160
2161         if (name) {
2162                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2163                 if (!namep)
2164                         return -ENOMEM;
2165                 *name = namep;
2166         }
2167
2168         if (value && len) {
2169                 rc = security_sid_to_context(newsid, &context, &clen);
2170                 if (rc) {
2171                         kfree(namep);
2172                         return rc;
2173                 }
2174                 *value = context;
2175                 *len = clen;
2176         }
2177
2178         return 0;
2179 }
2180
2181 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2182 {
2183         return may_create(dir, dentry, SECCLASS_FILE);
2184 }
2185
2186 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2187 {
2188         int rc;
2189
2190         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2191         if (rc)
2192                 return rc;
2193         return may_link(dir, old_dentry, MAY_LINK);
2194 }
2195
2196 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2197 {
2198         int rc;
2199
2200         rc = secondary_ops->inode_unlink(dir, dentry);
2201         if (rc)
2202                 return rc;
2203         return may_link(dir, dentry, MAY_UNLINK);
2204 }
2205
2206 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2207 {
2208         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2209 }
2210
2211 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2212 {
2213         return may_create(dir, dentry, SECCLASS_DIR);
2214 }
2215
2216 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2217 {
2218         return may_link(dir, dentry, MAY_RMDIR);
2219 }
2220
2221 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2222 {
2223         int rc;
2224
2225         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2226         if (rc)
2227                 return rc;
2228
2229         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2230 }
2231
2232 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2233                                 struct inode *new_inode, struct dentry *new_dentry)
2234 {
2235         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2236 }
2237
2238 static int selinux_inode_readlink(struct dentry *dentry)
2239 {
2240         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2241 }
2242
2243 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2244 {
2245         int rc;
2246
2247         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2248         if (rc)
2249                 return rc;
2250         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2251 }
2252
2253 static int selinux_inode_permission(struct inode *inode, int mask,
2254                                     struct nameidata *nd)
2255 {
2256         int rc;
2257
2258         rc = secondary_ops->inode_permission(inode, mask, nd);
2259         if (rc)
2260                 return rc;
2261
2262         if (!mask) {
2263                 /* No permission to check.  Existence test. */
2264                 return 0;
2265         }
2266
2267         return inode_has_perm(current, inode,
2268                                file_mask_to_av(inode->i_mode, mask), NULL);
2269 }
2270
2271 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2272 {
2273         int rc;
2274
2275         rc = secondary_ops->inode_setattr(dentry, iattr);
2276         if (rc)
2277                 return rc;
2278
2279         if (iattr->ia_valid & ATTR_FORCE)
2280                 return 0;
2281
2282         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2283                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2284                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2285
2286         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2287 }
2288
2289 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2290 {
2291         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2292 }
2293
2294 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2295 {
2296         struct task_security_struct *tsec = current->security;
2297         struct inode *inode = dentry->d_inode;
2298         struct inode_security_struct *isec = inode->i_security;
2299         struct superblock_security_struct *sbsec;
2300         struct avc_audit_data ad;
2301         u32 newsid;
2302         int rc = 0;
2303
2304         if (strcmp(name, XATTR_NAME_SELINUX)) {
2305                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2306                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2307                     !capable(CAP_SYS_ADMIN)) {
2308                         /* A different attribute in the security namespace.
2309                            Restrict to administrator. */
2310                         return -EPERM;
2311                 }
2312
2313                 /* Not an attribute we recognize, so just check the
2314                    ordinary setattr permission. */
2315                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2316         }
2317
2318         sbsec = inode->i_sb->s_security;
2319         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2320                 return -EOPNOTSUPP;
2321
2322         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2323                 return -EPERM;
2324
2325         AVC_AUDIT_DATA_INIT(&ad,FS);
2326         ad.u.fs.dentry = dentry;
2327
2328         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2329                           FILE__RELABELFROM, &ad);
2330         if (rc)
2331                 return rc;
2332
2333         rc = security_context_to_sid(value, size, &newsid);
2334         if (rc)
2335                 return rc;
2336
2337         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2338                           FILE__RELABELTO, &ad);
2339         if (rc)
2340                 return rc;
2341
2342         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2343                                           isec->sclass);
2344         if (rc)
2345                 return rc;
2346
2347         return avc_has_perm(newsid,
2348                             sbsec->sid,
2349                             SECCLASS_FILESYSTEM,
2350                             FILESYSTEM__ASSOCIATE,
2351                             &ad);
2352 }
2353
2354 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2355                                         void *value, size_t size, int flags)
2356 {
2357         struct inode *inode = dentry->d_inode;
2358         struct inode_security_struct *isec = inode->i_security;
2359         u32 newsid;
2360         int rc;
2361
2362         if (strcmp(name, XATTR_NAME_SELINUX)) {
2363                 /* Not an attribute we recognize, so nothing to do. */
2364                 return;
2365         }
2366
2367         rc = security_context_to_sid(value, size, &newsid);
2368         if (rc) {
2369                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2370                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2371                 return;
2372         }
2373
2374         isec->sid = newsid;
2375         return;
2376 }
2377
2378 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2379 {
2380         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2381 }
2382
2383 static int selinux_inode_listxattr (struct dentry *dentry)
2384 {
2385         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2386 }
2387
2388 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2389 {
2390         if (strcmp(name, XATTR_NAME_SELINUX)) {
2391                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2392                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2393                     !capable(CAP_SYS_ADMIN)) {
2394                         /* A different attribute in the security namespace.
2395                            Restrict to administrator. */
2396                         return -EPERM;
2397                 }
2398
2399                 /* Not an attribute we recognize, so just check the
2400                    ordinary setattr permission. Might want a separate
2401                    permission for removexattr. */
2402                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2403         }
2404
2405         /* No one is allowed to remove a SELinux security label.
2406            You can change the label, but all data must be labeled. */
2407         return -EACCES;
2408 }
2409
2410 static const char *selinux_inode_xattr_getsuffix(void)
2411 {
2412       return XATTR_SELINUX_SUFFIX;
2413 }
2414
2415 /*
2416  * Copy the in-core inode security context value to the user.  If the
2417  * getxattr() prior to this succeeded, check to see if we need to
2418  * canonicalize the value to be finally returned to the user.
2419  *
2420  * Permission check is handled by selinux_inode_getxattr hook.
2421  */
2422 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2423 {
2424         struct inode_security_struct *isec = inode->i_security;
2425
2426         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2427                 return -EOPNOTSUPP;
2428
2429         return selinux_getsecurity(isec->sid, buffer, size);
2430 }
2431
2432 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2433                                      const void *value, size_t size, int flags)
2434 {
2435         struct inode_security_struct *isec = inode->i_security;
2436         u32 newsid;
2437         int rc;
2438
2439         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2440                 return -EOPNOTSUPP;
2441
2442         if (!value || !size)
2443                 return -EACCES;
2444
2445         rc = security_context_to_sid((void*)value, size, &newsid);
2446         if (rc)
2447                 return rc;
2448
2449         isec->sid = newsid;
2450         return 0;
2451 }
2452
2453 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2454 {
2455         const int len = sizeof(XATTR_NAME_SELINUX);
2456         if (buffer && len <= buffer_size)
2457                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2458         return len;
2459 }
2460
2461 /* file security operations */
2462
2463 static int selinux_file_permission(struct file *file, int mask)
2464 {
2465         int rc;
2466         struct inode *inode = file->f_path.dentry->d_inode;
2467
2468         if (!mask) {
2469                 /* No permission to check.  Existence test. */
2470                 return 0;
2471         }
2472
2473         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2474         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2475                 mask |= MAY_APPEND;
2476
2477         rc = file_has_perm(current, file,
2478                            file_mask_to_av(inode->i_mode, mask));
2479         if (rc)
2480                 return rc;
2481
2482         return selinux_netlbl_inode_permission(inode, mask);
2483 }
2484
2485 static int selinux_file_alloc_security(struct file *file)
2486 {
2487         return file_alloc_security(file);
2488 }
2489
2490 static void selinux_file_free_security(struct file *file)
2491 {
2492         file_free_security(file);
2493 }
2494
2495 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2496                               unsigned long arg)
2497 {
2498         int error = 0;
2499
2500         switch (cmd) {
2501                 case FIONREAD:
2502                 /* fall through */
2503                 case FIBMAP:
2504                 /* fall through */
2505                 case FIGETBSZ:
2506                 /* fall through */
2507                 case EXT2_IOC_GETFLAGS:
2508                 /* fall through */
2509                 case EXT2_IOC_GETVERSION:
2510                         error = file_has_perm(current, file, FILE__GETATTR);
2511                         break;
2512
2513                 case EXT2_IOC_SETFLAGS:
2514                 /* fall through */
2515                 case EXT2_IOC_SETVERSION:
2516                         error = file_has_perm(current, file, FILE__SETATTR);
2517                         break;
2518
2519                 /* sys_ioctl() checks */
2520                 case FIONBIO:
2521                 /* fall through */
2522                 case FIOASYNC:
2523                         error = file_has_perm(current, file, 0);
2524                         break;
2525
2526                 case KDSKBENT:
2527                 case KDSKBSENT:
2528                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2529                         break;
2530
2531                 /* default case assumes that the command will go
2532                  * to the file's ioctl() function.
2533                  */
2534                 default:
2535                         error = file_has_perm(current, file, FILE__IOCTL);
2536
2537         }
2538         return error;
2539 }
2540
2541 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2542 {
2543 #ifndef CONFIG_PPC32
2544         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2545                 /*
2546                  * We are making executable an anonymous mapping or a
2547                  * private file mapping that will also be writable.
2548                  * This has an additional check.
2549                  */
2550                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2551                 if (rc)
2552                         return rc;
2553         }
2554 #endif
2555
2556         if (file) {
2557                 /* read access is always possible with a mapping */
2558                 u32 av = FILE__READ;
2559
2560                 /* write access only matters if the mapping is shared */
2561                 if (shared && (prot & PROT_WRITE))
2562                         av |= FILE__WRITE;
2563
2564                 if (prot & PROT_EXEC)
2565                         av |= FILE__EXECUTE;
2566
2567                 return file_has_perm(current, file, av);
2568         }
2569         return 0;
2570 }
2571
2572 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2573                              unsigned long prot, unsigned long flags)
2574 {
2575         int rc;
2576
2577         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2578         if (rc)
2579                 return rc;
2580
2581         if (selinux_checkreqprot)
2582                 prot = reqprot;
2583
2584         return file_map_prot_check(file, prot,
2585                                    (flags & MAP_TYPE) == MAP_SHARED);
2586 }
2587
2588 static int selinux_file_mprotect(struct vm_area_struct *vma,
2589                                  unsigned long reqprot,
2590                                  unsigned long prot)
2591 {
2592         int rc;
2593
2594         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2595         if (rc)
2596                 return rc;
2597
2598         if (selinux_checkreqprot)
2599                 prot = reqprot;
2600
2601 #ifndef CONFIG_PPC32
2602         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2603                 rc = 0;
2604                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2605                     vma->vm_end <= vma->vm_mm->brk) {
2606                         rc = task_has_perm(current, current,
2607                                            PROCESS__EXECHEAP);
2608                 } else if (!vma->vm_file &&
2609                            vma->vm_start <= vma->vm_mm->start_stack &&
2610                            vma->vm_end >= vma->vm_mm->start_stack) {
2611                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2612                 } else if (vma->vm_file && vma->anon_vma) {
2613                         /*
2614                          * We are making executable a file mapping that has
2615                          * had some COW done. Since pages might have been
2616                          * written, check ability to execute the possibly
2617                          * modified content.  This typically should only
2618                          * occur for text relocations.
2619                          */
2620                         rc = file_has_perm(current, vma->vm_file,
2621                                            FILE__EXECMOD);
2622                 }
2623                 if (rc)
2624                         return rc;
2625         }
2626 #endif
2627
2628         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2629 }
2630
2631 static int selinux_file_lock(struct file *file, unsigned int cmd)
2632 {
2633         return file_has_perm(current, file, FILE__LOCK);
2634 }
2635
2636 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2637                               unsigned long arg)
2638 {
2639         int err = 0;
2640
2641         switch (cmd) {
2642                 case F_SETFL:
2643                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2644                                 err = -EINVAL;
2645                                 break;
2646                         }
2647
2648                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2649                                 err = file_has_perm(current, file,FILE__WRITE);
2650                                 break;
2651                         }
2652                         /* fall through */
2653                 case F_SETOWN:
2654                 case F_SETSIG:
2655                 case F_GETFL:
2656                 case F_GETOWN:
2657                 case F_GETSIG:
2658                         /* Just check FD__USE permission */
2659                         err = file_has_perm(current, file, 0);
2660                         break;
2661                 case F_GETLK:
2662                 case F_SETLK:
2663                 case F_SETLKW:
2664 #if BITS_PER_LONG == 32
2665                 case F_GETLK64:
2666                 case F_SETLK64:
2667                 case F_SETLKW64:
2668 #endif
2669                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2670                                 err = -EINVAL;
2671                                 break;
2672                         }
2673                         err = file_has_perm(current, file, FILE__LOCK);
2674                         break;
2675         }
2676
2677         return err;
2678 }
2679
2680 static int selinux_file_set_fowner(struct file *file)
2681 {
2682         struct task_security_struct *tsec;
2683         struct file_security_struct *fsec;
2684
2685         tsec = current->security;
2686         fsec = file->f_security;
2687         fsec->fown_sid = tsec->sid;
2688
2689         return 0;
2690 }
2691
2692 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2693                                        struct fown_struct *fown, int signum)
2694 {
2695         struct file *file;
2696         u32 perm;
2697         struct task_security_struct *tsec;
2698         struct file_security_struct *fsec;
2699
2700         /* struct fown_struct is never outside the context of a struct file */
2701         file = container_of(fown, struct file, f_owner);
2702
2703         tsec = tsk->security;
2704         fsec = file->f_security;
2705
2706         if (!signum)
2707                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2708         else
2709                 perm = signal_to_av(signum);
2710
2711         return avc_has_perm(fsec->fown_sid, tsec->sid,
2712                             SECCLASS_PROCESS, perm, NULL);
2713 }
2714
2715 static int selinux_file_receive(struct file *file)
2716 {
2717         return file_has_perm(current, file, file_to_av(file));
2718 }
2719
2720 /* task security operations */
2721
2722 static int selinux_task_create(unsigned long clone_flags)
2723 {
2724         int rc;
2725
2726         rc = secondary_ops->task_create(clone_flags);
2727         if (rc)
2728                 return rc;
2729
2730         return task_has_perm(current, current, PROCESS__FORK);
2731 }
2732
2733 static int selinux_task_alloc_security(struct task_struct *tsk)
2734 {
2735         struct task_security_struct *tsec1, *tsec2;
2736         int rc;
2737
2738         tsec1 = current->security;
2739
2740         rc = task_alloc_security(tsk);
2741         if (rc)
2742                 return rc;
2743         tsec2 = tsk->security;
2744
2745         tsec2->osid = tsec1->osid;
2746         tsec2->sid = tsec1->sid;
2747
2748         /* Retain the exec, fs, key, and sock SIDs across fork */
2749         tsec2->exec_sid = tsec1->exec_sid;
2750         tsec2->create_sid = tsec1->create_sid;
2751         tsec2->keycreate_sid = tsec1->keycreate_sid;
2752         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2753
2754         /* Retain ptracer SID across fork, if any.
2755            This will be reset by the ptrace hook upon any
2756            subsequent ptrace_attach operations. */
2757         tsec2->ptrace_sid = tsec1->ptrace_sid;
2758
2759         return 0;
2760 }
2761
2762 static void selinux_task_free_security(struct task_struct *tsk)
2763 {
2764         task_free_security(tsk);
2765 }
2766
2767 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2768 {
2769         /* Since setuid only affects the current process, and
2770            since the SELinux controls are not based on the Linux
2771            identity attributes, SELinux does not need to control
2772            this operation.  However, SELinux does control the use
2773            of the CAP_SETUID and CAP_SETGID capabilities using the
2774            capable hook. */
2775         return 0;
2776 }
2777
2778 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2779 {
2780         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2781 }
2782
2783 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2784 {
2785         /* See the comment for setuid above. */
2786         return 0;
2787 }
2788
2789 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2790 {
2791         return task_has_perm(current, p, PROCESS__SETPGID);
2792 }
2793
2794 static int selinux_task_getpgid(struct task_struct *p)
2795 {
2796         return task_has_perm(current, p, PROCESS__GETPGID);
2797 }
2798
2799 static int selinux_task_getsid(struct task_struct *p)
2800 {
2801         return task_has_perm(current, p, PROCESS__GETSESSION);
2802 }
2803
2804 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2805 {
2806         selinux_get_task_sid(p, secid);
2807 }
2808
2809 static int selinux_task_setgroups(struct group_info *group_info)
2810 {
2811         /* See the comment for setuid above. */
2812         return 0;
2813 }
2814
2815 static int selinux_task_setnice(struct task_struct *p, int nice)
2816 {
2817         int rc;
2818
2819         rc = secondary_ops->task_setnice(p, nice);
2820         if (rc)
2821                 return rc;
2822
2823         return task_has_perm(current,p, PROCESS__SETSCHED);
2824 }
2825
2826 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2827 {
2828         return task_has_perm(current, p, PROCESS__SETSCHED);
2829 }
2830
2831 static int selinux_task_getioprio(struct task_struct *p)
2832 {
2833         return task_has_perm(current, p, PROCESS__GETSCHED);
2834 }
2835
2836 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2837 {
2838         struct rlimit *old_rlim = current->signal->rlim + resource;
2839         int rc;
2840
2841         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2842         if (rc)
2843                 return rc;
2844
2845         /* Control the ability to change the hard limit (whether
2846            lowering or raising it), so that the hard limit can
2847            later be used as a safe reset point for the soft limit
2848            upon context transitions. See selinux_bprm_apply_creds. */
2849         if (old_rlim->rlim_max != new_rlim->rlim_max)
2850                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2851
2852         return 0;
2853 }
2854
2855 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2856 {
2857         return task_has_perm(current, p, PROCESS__SETSCHED);
2858 }
2859
2860 static int selinux_task_getscheduler(struct task_struct *p)
2861 {
2862         return task_has_perm(current, p, PROCESS__GETSCHED);
2863 }
2864
2865 static int selinux_task_movememory(struct task_struct *p)
2866 {
2867         return task_has_perm(current, p, PROCESS__SETSCHED);
2868 }
2869
2870 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2871                                 int sig, u32 secid)
2872 {
2873         u32 perm;
2874         int rc;
2875         struct task_security_struct *tsec;
2876
2877         rc = secondary_ops->task_kill(p, info, sig, secid);
2878         if (rc)
2879                 return rc;
2880
2881         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2882                 return 0;
2883
2884         if (!sig)
2885                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2886         else
2887                 perm = signal_to_av(sig);
2888         tsec = p->security;
2889         if (secid)
2890                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2891         else
2892                 rc = task_has_perm(current, p, perm);
2893         return rc;
2894 }
2895
2896 static int selinux_task_prctl(int option,
2897                               unsigned long arg2,
2898                               unsigned long arg3,
2899                               unsigned long arg4,
2900                               unsigned long arg5)
2901 {
2902         /* The current prctl operations do not appear to require
2903            any SELinux controls since they merely observe or modify
2904            the state of the current process. */
2905         return 0;
2906 }
2907
2908 static int selinux_task_wait(struct task_struct *p)
2909 {
2910         u32 perm;
2911
2912         perm = signal_to_av(p->exit_signal);
2913
2914         return task_has_perm(p, current, perm);
2915 }
2916
2917 static void selinux_task_reparent_to_init(struct task_struct *p)
2918 {
2919         struct task_security_struct *tsec;
2920
2921         secondary_ops->task_reparent_to_init(p);
2922
2923         tsec = p->security;
2924         tsec->osid = tsec->sid;
2925         tsec->sid = SECINITSID_KERNEL;
2926         return;
2927 }
2928
2929 static void selinux_task_to_inode(struct task_struct *p,
2930                                   struct inode *inode)
2931 {
2932         struct task_security_struct *tsec = p->security;
2933         struct inode_security_struct *isec = inode->i_security;
2934
2935         isec->sid = tsec->sid;
2936         isec->initialized = 1;
2937         return;
2938 }
2939
2940 /* Returns error only if unable to parse addresses */
2941 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2942                         struct avc_audit_data *ad, u8 *proto)
2943 {
2944         int offset, ihlen, ret = -EINVAL;
2945         struct iphdr _iph, *ih;
2946
2947         offset = skb_network_offset(skb);
2948         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2949         if (ih == NULL)
2950                 goto out;
2951
2952         ihlen = ih->ihl * 4;
2953         if (ihlen < sizeof(_iph))
2954                 goto out;
2955
2956         ad->u.net.v4info.saddr = ih->saddr;
2957         ad->u.net.v4info.daddr = ih->daddr;
2958         ret = 0;
2959
2960         if (proto)
2961                 *proto = ih->protocol;
2962
2963         switch (ih->protocol) {
2964         case IPPROTO_TCP: {
2965                 struct tcphdr _tcph, *th;
2966
2967                 if (ntohs(ih->frag_off) & IP_OFFSET)
2968                         break;
2969
2970                 offset += ihlen;
2971                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2972                 if (th == NULL)
2973                         break;
2974
2975                 ad->u.net.sport = th->source;
2976                 ad->u.net.dport = th->dest;
2977                 break;
2978         }
2979
2980         case IPPROTO_UDP: {
2981                 struct udphdr _udph, *uh;
2982
2983                 if (ntohs(ih->frag_off) & IP_OFFSET)
2984                         break;
2985
2986                 offset += ihlen;
2987                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2988                 if (uh == NULL)
2989                         break;
2990
2991                 ad->u.net.sport = uh->source;
2992                 ad->u.net.dport = uh->dest;
2993                 break;
2994         }
2995
2996         case IPPROTO_DCCP: {
2997                 struct dccp_hdr _dccph, *dh;
2998
2999                 if (ntohs(ih->frag_off) & IP_OFFSET)
3000                         break;
3001
3002                 offset += ihlen;
3003                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3004                 if (dh == NULL)
3005                         break;
3006
3007                 ad->u.net.sport = dh->dccph_sport;
3008                 ad->u.net.dport = dh->dccph_dport;
3009                 break;
3010         }
3011
3012         default:
3013                 break;
3014         }
3015 out:
3016         return ret;
3017 }
3018
3019 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3020
3021 /* Returns error only if unable to parse addresses */
3022 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3023                         struct avc_audit_data *ad, u8 *proto)
3024 {
3025         u8 nexthdr;
3026         int ret = -EINVAL, offset;
3027         struct ipv6hdr _ipv6h, *ip6;
3028
3029         offset = skb_network_offset(skb);
3030         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3031         if (ip6 == NULL)
3032                 goto out;
3033
3034         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3035         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3036         ret = 0;
3037
3038         nexthdr = ip6->nexthdr;
3039         offset += sizeof(_ipv6h);
3040         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3041         if (offset < 0)
3042                 goto out;
3043
3044         if (proto)
3045                 *proto = nexthdr;
3046
3047         switch (nexthdr) {
3048         case IPPROTO_TCP: {
3049                 struct tcphdr _tcph, *th;
3050
3051                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3052                 if (th == NULL)
3053                         break;
3054
3055                 ad->u.net.sport = th->source;
3056                 ad->u.net.dport = th->dest;
3057                 break;
3058         }
3059
3060         case IPPROTO_UDP: {
3061                 struct udphdr _udph, *uh;
3062
3063                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3064                 if (uh == NULL)
3065                         break;
3066
3067                 ad->u.net.sport = uh->source;
3068                 ad->u.net.dport = uh->dest;
3069                 break;
3070         }
3071
3072         case IPPROTO_DCCP: {
3073                 struct dccp_hdr _dccph, *dh;
3074
3075                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3076                 if (dh == NULL)
3077                         break;
3078
3079                 ad->u.net.sport = dh->dccph_sport;
3080                 ad->u.net.dport = dh->dccph_dport;
3081                 break;
3082         }
3083
3084         /* includes fragments */
3085         default:
3086                 break;
3087         }
3088 out:
3089         return ret;
3090 }
3091
3092 #endif /* IPV6 */
3093
3094 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3095                              char **addrp, int *len, int src, u8 *proto)
3096 {
3097         int ret = 0;
3098
3099         switch (ad->u.net.family) {
3100         case PF_INET:
3101                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3102                 if (ret || !addrp)
3103                         break;
3104                 *len = 4;
3105                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3106                                         &ad->u.net.v4info.daddr);
3107                 break;
3108
3109 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3110         case PF_INET6:
3111                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3112                 if (ret || !addrp)
3113                         break;
3114                 *len = 16;
3115                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3116                                         &ad->u.net.v6info.daddr);
3117                 break;
3118 #endif  /* IPV6 */
3119         default:
3120                 break;
3121         }
3122
3123         return ret;
3124 }
3125
3126 /**
3127  * selinux_skb_extlbl_sid - Determine the external label of a packet
3128  * @skb: the packet
3129  * @base_sid: the SELinux SID to use as a context for MLS only external labels
3130  * @sid: the packet's SID
3131  *
3132  * Description:
3133  * Check the various different forms of external packet labeling and determine
3134  * the external SID for the packet.
3135  *
3136  */
3137 static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3138                                    u32 base_sid,
3139                                    u32 *sid)
3140 {
3141         u32 xfrm_sid;
3142         u32 nlbl_sid;
3143
3144         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3145         if (selinux_netlbl_skbuff_getsid(skb,
3146                                          (xfrm_sid == SECSID_NULL ?
3147                                           base_sid : xfrm_sid),
3148                                          &nlbl_sid) != 0)
3149                 nlbl_sid = SECSID_NULL;
3150
3151         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3152 }
3153
3154 /* socket security operations */
3155 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3156                            u32 perms)
3157 {
3158         struct inode_security_struct *isec;
3159         struct task_security_struct *tsec;
3160         struct avc_audit_data ad;
3161         int err = 0;
3162
3163         tsec = task->security;
3164         isec = SOCK_INODE(sock)->i_security;
3165
3166         if (isec->sid == SECINITSID_KERNEL)
3167                 goto out;
3168
3169         AVC_AUDIT_DATA_INIT(&ad,NET);
3170         ad.u.net.sk = sock->sk;
3171         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3172
3173 out:
3174         return err;
3175 }
3176
3177 static int selinux_socket_create(int family, int type,
3178                                  int protocol, int kern)
3179 {
3180         int err = 0;
3181         struct task_security_struct *tsec;
3182         u32 newsid;
3183
3184         if (kern)
3185                 goto out;
3186
3187         tsec = current->security;
3188         newsid = tsec->sockcreate_sid ? : tsec->sid;
3189         err = avc_has_perm(tsec->sid, newsid,
3190                            socket_type_to_security_class(family, type,
3191                            protocol), SOCKET__CREATE, NULL);
3192
3193 out:
3194         return err;
3195 }
3196
3197 static int selinux_socket_post_create(struct socket *sock, int family,
3198                                       int type, int protocol, int kern)
3199 {
3200         int err = 0;
3201         struct inode_security_struct *isec;
3202         struct task_security_struct *tsec;
3203         struct sk_security_struct *sksec;
3204         u32 newsid;
3205
3206         isec = SOCK_INODE(sock)->i_security;
3207
3208         tsec = current->security;
3209         newsid = tsec->sockcreate_sid ? : tsec->sid;
3210         isec->sclass = socket_type_to_security_class(family, type, protocol);
3211         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3212         isec->initialized = 1;
3213
3214         if (sock->sk) {
3215                 sksec = sock->sk->sk_security;
3216                 sksec->sid = isec->sid;
3217                 err = selinux_netlbl_socket_post_create(sock);
3218         }
3219
3220         return err;
3221 }
3222
3223 /* Range of port numbers used to automatically bind.
3224    Need to determine whether we should perform a name_bind
3225    permission check between the socket and the port number. */
3226 #define ip_local_port_range_0 sysctl_local_port_range[0]
3227 #define ip_local_port_range_1 sysctl_local_port_range[1]
3228
3229 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3230 {
3231         u16 family;
3232         int err;
3233
3234         err = socket_has_perm(current, sock, SOCKET__BIND);
3235         if (err)
3236                 goto out;
3237
3238         /*
3239          * If PF_INET or PF_INET6, check name_bind permission for the port.
3240          * Multiple address binding for SCTP is not supported yet: we just
3241          * check the first address now.
3242          */
3243         family = sock->sk->sk_family;
3244         if (family == PF_INET || family == PF_INET6) {
3245                 char *addrp;
3246                 struct inode_security_struct *isec;
3247                 struct task_security_struct *tsec;
3248                 struct avc_audit_data ad;
3249                 struct sockaddr_in *addr4 = NULL;
3250                 struct sockaddr_in6 *addr6 = NULL;
3251                 unsigned short snum;
3252                 struct sock *sk = sock->sk;
3253                 u32 sid, node_perm, addrlen;
3254
3255                 tsec = current->security;
3256                 isec = SOCK_INODE(sock)->i_security;
3257
3258                 if (family == PF_INET) {
3259                         addr4 = (struct sockaddr_in *)address;
3260                         snum = ntohs(addr4->sin_port);
3261                         addrlen = sizeof(addr4->sin_addr.s_addr);
3262                         addrp = (char *)&addr4->sin_addr.s_addr;
3263                 } else {
3264                         addr6 = (struct sockaddr_in6 *)address;
3265                         snum = ntohs(addr6->sin6_port);
3266                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3267                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3268                 }
3269
3270                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3271                            snum > ip_local_port_range_1)) {
3272                         err = security_port_sid(sk->sk_family, sk->sk_type,
3273                                                 sk->sk_protocol, snum, &sid);
3274                         if (err)
3275                                 goto out;
3276                         AVC_AUDIT_DATA_INIT(&ad,NET);
3277                         ad.u.net.sport = htons(snum);
3278                         ad.u.net.family = family;
3279                         err = avc_has_perm(isec->sid, sid,
3280                                            isec->sclass,
3281                                            SOCKET__NAME_BIND, &ad);
3282                         if (err)
3283                                 goto out;
3284                 }
3285
3286                 switch(isec->sclass) {
3287                 case SECCLASS_TCP_SOCKET:
3288                         node_perm = TCP_SOCKET__NODE_BIND;
3289                         break;
3290
3291                 case SECCLASS_UDP_SOCKET:
3292                         node_perm = UDP_SOCKET__NODE_BIND;
3293                         break;
3294
3295                 case SECCLASS_DCCP_SOCKET:
3296                         node_perm = DCCP_SOCKET__NODE_BIND;
3297                         break;
3298
3299                 default:
3300                         node_perm = RAWIP_SOCKET__NODE_BIND;
3301                         break;
3302                 }
3303
3304                 err = security_node_sid(family, addrp, addrlen, &sid);
3305                 if (err)
3306                         goto out;
3307
3308                 AVC_AUDIT_DATA_INIT(&ad,NET);
3309                 ad.u.net.sport = htons(snum);
3310                 ad.u.net.family = family;
3311
3312                 if (family == PF_INET)
3313                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3314                 else
3315                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3316
3317                 err = avc_has_perm(isec->sid, sid,
3318                                    isec->sclass, node_perm, &ad);
3319                 if (err)
3320                         goto out;
3321         }
3322 out:
3323         return err;
3324 }
3325
3326 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3327 {
3328         struct inode_security_struct *isec;
3329         int err;
3330
3331         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3332         if (err)
3333                 return err;
3334
3335         /*
3336          * If a TCP or DCCP socket, check name_connect permission for the port.
3337          */
3338         isec = SOCK_INODE(sock)->i_security;
3339         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3340             isec->sclass == SECCLASS_DCCP_SOCKET) {
3341                 struct sock *sk = sock->sk;
3342                 struct avc_audit_data ad;
3343                 struct sockaddr_in *addr4 = NULL;
3344                 struct sockaddr_in6 *addr6 = NULL;
3345                 unsigned short snum;
3346                 u32 sid, perm;
3347
3348                 if (sk->sk_family == PF_INET) {
3349                         addr4 = (struct sockaddr_in *)address;
3350                         if (addrlen < sizeof(struct sockaddr_in))
3351                                 return -EINVAL;
3352                         snum = ntohs(addr4->sin_port);
3353                 } else {
3354                         addr6 = (struct sockaddr_in6 *)address;
3355                         if (addrlen < SIN6_LEN_RFC2133)
3356                                 return -EINVAL;
3357                         snum = ntohs(addr6->sin6_port);
3358                 }
3359
3360                 err = security_port_sid(sk->sk_family, sk->sk_type,
3361                                         sk->sk_protocol, snum, &sid);
3362                 if (err)
3363                         goto out;
3364
3365                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3366                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3367
3368                 AVC_AUDIT_DATA_INIT(&ad,NET);
3369                 ad.u.net.dport = htons(snum);
3370                 ad.u.net.family = sk->sk_family;
3371                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3372                 if (err)
3373                         goto out;
3374         }
3375
3376 out:
3377         return err;
3378 }
3379
3380 static int selinux_socket_listen(struct socket *sock, int backlog)
3381 {
3382         return socket_has_perm(current, sock, SOCKET__LISTEN);
3383 }
3384
3385 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3386 {
3387         int err;
3388         struct inode_security_struct *isec;
3389         struct inode_security_struct *newisec;
3390
3391         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3392         if (err)
3393                 return err;
3394
3395         newisec = SOCK_INODE(newsock)->i_security;
3396
3397         isec = SOCK_INODE(sock)->i_security;
3398         newisec->sclass = isec->sclass;
3399         newisec->sid = isec->sid;
3400         newisec->initialized = 1;
3401
3402         return 0;
3403 }
3404
3405 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3406                                   int size)
3407 {
3408         int rc;
3409
3410         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3411         if (rc)
3412                 return rc;
3413
3414         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3415 }
3416
3417 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3418                                   int size, int flags)
3419 {
3420         return socket_has_perm(current, sock, SOCKET__READ);
3421 }
3422
3423 static int selinux_socket_getsockname(struct socket *sock)
3424 {
3425         return socket_has_perm(current, sock, SOCKET__GETATTR);
3426 }
3427
3428 static int selinux_socket_getpeername(struct socket *sock)
3429 {
3430         return socket_has_perm(current, sock, SOCKET__GETATTR);
3431 }
3432
3433 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3434 {
3435         int err;
3436
3437         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3438         if (err)
3439                 return err;
3440
3441         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3442 }
3443
3444 static int selinux_socket_getsockopt(struct socket *sock, int level,
3445                                      int optname)
3446 {
3447         return socket_has_perm(current, sock, SOCKET__GETOPT);
3448 }
3449
3450 static int selinux_socket_shutdown(struct socket *sock, int how)
3451 {
3452         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3453 }
3454
3455 static int selinux_socket_unix_stream_connect(struct socket *sock,
3456                                               struct socket *other,
3457                                               struct sock *newsk)
3458 {
3459         struct sk_security_struct *ssec;
3460         struct inode_security_struct *isec;
3461         struct inode_security_struct *other_isec;
3462         struct avc_audit_data ad;
3463         int err;
3464
3465         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3466         if (err)
3467                 return err;
3468
3469         isec = SOCK_INODE(sock)->i_security;
3470         other_isec = SOCK_INODE(other)->i_security;
3471
3472         AVC_AUDIT_DATA_INIT(&ad,NET);
3473         ad.u.net.sk = other->sk;
3474
3475         err = avc_has_perm(isec->sid, other_isec->sid,
3476                            isec->sclass,
3477                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3478         if (err)
3479                 return err;
3480
3481         /* connecting socket */
3482         ssec = sock->sk->sk_security;
3483         ssec->peer_sid = other_isec->sid;
3484
3485         /* server child socket */
3486         ssec = newsk->sk_security;
3487         ssec->peer_sid = isec->sid;
3488         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3489
3490         return err;
3491 }
3492
3493 static int selinux_socket_unix_may_send(struct socket *sock,
3494                                         struct socket *other)
3495 {
3496         struct inode_security_struct *isec;
3497         struct inode_security_struct *other_isec;
3498         struct avc_audit_data ad;
3499         int err;
3500
3501         isec = SOCK_INODE(sock)->i_security;
3502         other_isec = SOCK_INODE(other)->i_security;
3503
3504         AVC_AUDIT_DATA_INIT(&ad,NET);
3505         ad.u.net.sk = other->sk;
3506
3507         err = avc_has_perm(isec->sid, other_isec->sid,
3508                            isec->sclass, SOCKET__SENDTO, &ad);
3509         if (err)
3510                 return err;
3511
3512         return 0;
3513 }
3514
3515 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3516                 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3517 {
3518         int err = 0;
3519         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3520         struct socket *sock;
3521         u16 sock_class = 0;
3522         u32 sock_sid = 0;
3523
3524         read_lock_bh(&sk->sk_callback_lock);
3525         sock = sk->sk_socket;
3526         if (sock) {
3527                 struct inode *inode;
3528                 inode = SOCK_INODE(sock);
3529                 if (inode) {
3530                         struct inode_security_struct *isec;
3531                         isec = inode->i_security;
3532                         sock_sid = isec->sid;
3533                         sock_class = isec->sclass;
3534                 }
3535         }
3536         read_unlock_bh(&sk->sk_callback_lock);
3537         if (!sock_sid)
3538                 goto out;
3539
3540         if (!skb->dev)
3541                 goto out;
3542
3543         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3544         if (err)
3545                 goto out;
3546
3547         switch (sock_class) {
3548         case SECCLASS_UDP_SOCKET:
3549                 netif_perm = NETIF__UDP_RECV;
3550                 node_perm = NODE__UDP_RECV;
3551                 recv_perm = UDP_SOCKET__RECV_MSG;
3552                 break;
3553
3554         case SECCLASS_TCP_SOCKET:
3555                 netif_perm = NETIF__TCP_RECV;
3556                 node_perm = NODE__TCP_RECV;
3557                 recv_perm = TCP_SOCKET__RECV_MSG;
3558                 break;
3559
3560         case SECCLASS_DCCP_SOCKET:
3561                 netif_perm = NETIF__DCCP_RECV;
3562                 node_perm = NODE__DCCP_RECV;
3563                 recv_perm = DCCP_SOCKET__RECV_MSG;
3564                 break;
3565
3566         default:
3567                 netif_perm = NETIF__RAWIP_RECV;
3568                 node_perm = NODE__RAWIP_RECV;
3569                 break;
3570         }
3571
3572         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3573         if (err)
3574                 goto out;
3575
3576         err = security_node_sid(family, addrp, len, &node_sid);
3577         if (err)
3578                 goto out;
3579
3580         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3581         if (err)
3582                 goto out;
3583
3584         if (recv_perm) {
3585                 u32 port_sid;
3586
3587                 err = security_port_sid(sk->sk_family, sk->sk_type,
3588                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3589                                         &port_sid);
3590                 if (err)
3591                         goto out;
3592
3593                 err = avc_has_perm(sock_sid, port_sid,
3594                                    sock_class, recv_perm, ad);
3595         }
3596
3597 out:
3598         return err;
3599 }
3600
3601 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3602 {
3603         u16 family;
3604         char *addrp;
3605         int len, err = 0;
3606         struct avc_audit_data ad;
3607         struct sk_security_struct *sksec = sk->sk_security;
3608
3609         family = sk->sk_family;
3610         if (family != PF_INET && family != PF_INET6)
3611                 goto out;
3612
3613         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3614         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3615                 family = PF_INET;
3616
3617         AVC_AUDIT_DATA_INIT(&ad, NET);
3618         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3619         ad.u.net.family = family;
3620
3621         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3622         if (err)
3623                 goto out;
3624
3625         if (selinux_compat_net)
3626                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3627                                                   addrp, len);
3628         else
3629                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3630                                    PACKET__RECV, &ad);
3631         if (err)
3632                 goto out;
3633
3634         err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3635         if (err)
3636                 goto out;
3637
3638         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3639 out:
3640         return err;
3641 }
3642
3643 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3644                                             int __user *optlen, unsigned len)
3645 {
3646         int err = 0;
3647         char *scontext;
3648         u32 scontext_len;
3649         struct sk_security_struct *ssec;
3650         struct inode_security_struct *isec;
3651         u32 peer_sid = SECSID_NULL;
3652
3653         isec = SOCK_INODE(sock)->i_security;
3654
3655         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3656             isec->sclass == SECCLASS_TCP_SOCKET) {
3657                 ssec = sock->sk->sk_security;
3658                 peer_sid = ssec->peer_sid;
3659         }
3660         if (peer_sid == SECSID_NULL) {
3661                 err = -ENOPROTOOPT;
3662                 goto out;
3663         }
3664
3665         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3666
3667         if (err)
3668                 goto out;
3669
3670         if (scontext_len > len) {
3671                 err = -ERANGE;
3672                 goto out_len;
3673         }
3674
3675         if (copy_to_user(optval, scontext, scontext_len))
3676                 err = -EFAULT;
3677
3678 out_len:
3679         if (put_user(scontext_len, optlen))
3680                 err = -EFAULT;
3681
3682         kfree(scontext);
3683 out:
3684         return err;
3685 }
3686
3687 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3688 {
3689         u32 peer_secid = SECSID_NULL;
3690         int err = 0;
3691
3692         if (sock && sock->sk->sk_family == PF_UNIX)
3693                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3694         else if (skb)
3695                 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3696
3697         if (peer_secid == SECSID_NULL)
3698                 err = -EINVAL;
3699         *secid = peer_secid;
3700
3701         return err;
3702 }
3703
3704 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3705 {
3706         return sk_alloc_security(sk, family, priority);
3707 }
3708
3709 static void selinux_sk_free_security(struct sock *sk)
3710 {
3711         sk_free_security(sk);
3712 }
3713
3714 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3715 {
3716         struct sk_security_struct *ssec = sk->sk_security;
3717         struct sk_security_struct *newssec = newsk->sk_security;
3718
3719         newssec->sid = ssec->sid;
3720         newssec->peer_sid = ssec->peer_sid;
3721
3722         selinux_netlbl_sk_security_clone(ssec, newssec);
3723 }
3724
3725 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3726 {
3727         if (!sk)
3728                 *secid = SECINITSID_ANY_SOCKET;
3729         else {
3730                 struct sk_security_struct *sksec = sk->sk_security;
3731
3732                 *secid = sksec->sid;
3733         }
3734 }
3735
3736 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3737 {
3738         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3739         struct sk_security_struct *sksec = sk->sk_security;
3740
3741         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3742             sk->sk_family == PF_UNIX)
3743                 isec->sid = sksec->sid;
3744
3745         selinux_netlbl_sock_graft(sk, parent);
3746 }
3747
3748 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3749                                      struct request_sock *req)
3750 {
3751         struct sk_security_struct *sksec = sk->sk_security;
3752         int err;
3753         u32 newsid;
3754         u32 peersid;
3755
3756         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3757         if (peersid == SECSID_NULL) {
3758                 req->secid = sksec->sid;
3759                 req->peer_secid = SECSID_NULL;
3760                 return 0;
3761         }
3762
3763         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3764         if (err)
3765                 return err;
3766
3767         req->secid = newsid;
3768         req->peer_secid = peersid;
3769         return 0;
3770 }
3771
3772 static void selinux_inet_csk_clone(struct sock *newsk,
3773                                    const struct request_sock *req)
3774 {
3775         struct sk_security_struct *newsksec = newsk->sk_security;
3776
3777         newsksec->sid = req->secid;
3778         newsksec->peer_sid = req->peer_secid;
3779         /* NOTE: Ideally, we should also get the isec->sid for the
3780            new socket in sync, but we don't have the isec available yet.
3781            So we will wait until sock_graft to do it, by which
3782            time it will have been created and available. */
3783
3784         /* We don't need to take any sort of lock here as we are the only
3785          * thread with access to newsksec */
3786         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3787 }
3788
3789 static void selinux_inet_conn_established(struct sock *sk,
3790                                 struct sk_buff *skb)
3791 {
3792         struct sk_security_struct *sksec = sk->sk_security;
3793
3794         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3795 }
3796
3797 static void selinux_req_classify_flow(const struct request_sock *req,
3798                                       struct flowi *fl)
3799 {
3800         fl->secid = req->secid;
3801 }
3802
3803 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3804 {
3805         int err = 0;
3806         u32 perm;
3807         struct nlmsghdr *nlh;
3808         struct socket *sock = sk->sk_socket;
3809         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3810
3811         if (skb->len < NLMSG_SPACE(0)) {
3812                 err = -EINVAL;
3813                 goto out;
3814         }
3815         nlh = nlmsg_hdr(skb);
3816
3817         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3818         if (err) {
3819                 if (err == -EINVAL) {
3820                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3821                                   "SELinux:  unrecognized netlink message"
3822                                   " type=%hu for sclass=%hu\n",
3823                                   nlh->nlmsg_type, isec->sclass);
3824                         if (!selinux_enforcing)
3825                                 err = 0;
3826                 }
3827
3828                 /* Ignore */
3829                 if (err == -ENOENT)
3830                         err = 0;
3831                 goto out;
3832         }
3833
3834         err = socket_has_perm(current, sock, perm);
3835 out:
3836         return err;
3837 }
3838
3839 #ifdef CONFIG_NETFILTER
3840
3841 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3842                                             struct avc_audit_data *ad,
3843                                             u16 family, char *addrp, int len)
3844 {
3845         int err = 0;
3846         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3847         struct socket *sock;
3848         struct inode *inode;
3849         struct inode_security_struct *isec;
3850
3851         sock = sk->sk_socket;
3852         if (!sock)
3853                 goto out;
3854
3855         inode = SOCK_INODE(sock);
3856         if (!inode)
3857                 goto out;
3858
3859         isec = inode->i_security;
3860
3861         err = sel_netif_sids(dev, &if_sid, NULL);
3862         if (err)
3863                 goto out;
3864
3865         switch (isec->sclass) {
3866         case SECCLASS_UDP_SOCKET:
3867                 netif_perm = NETIF__UDP_SEND;
3868                 node_perm = NODE__UDP_SEND;
3869                 send_perm = UDP_SOCKET__SEND_MSG;
3870                 break;
3871
3872         case SECCLASS_TCP_SOCKET:
3873                 netif_perm = NETIF__TCP_SEND;
3874                 node_perm = NODE__TCP_SEND;
3875                 send_perm = TCP_SOCKET__SEND_MSG;
3876                 break;
3877
3878         case SECCLASS_DCCP_SOCKET:
3879                 netif_perm = NETIF__DCCP_SEND;
3880                 node_perm = NODE__DCCP_SEND;
3881                 send_perm = DCCP_SOCKET__SEND_MSG;
3882                 break;
3883
3884         default:
3885                 netif_perm = NETIF__RAWIP_SEND;
3886                 node_perm = NODE__RAWIP_SEND;
3887                 break;
3888         }
3889
3890         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3891         if (err)
3892                 goto out;
3893
3894         err = security_node_sid(family, addrp, len, &node_sid);
3895         if (err)
3896                 goto out;
3897
3898         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3899         if (err)
3900                 goto out;
3901
3902         if (send_perm) {
3903                 u32 port_sid;
3904
3905                 err = security_port_sid(sk->sk_family,
3906                                         sk->sk_type,
3907                                         sk->sk_protocol,
3908                                         ntohs(ad->u.net.dport),
3909                                         &port_sid);
3910                 if (err)
3911                         goto out;
3912
3913                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3914                                    send_perm, ad);
3915         }
3916 out:
3917         return err;
3918 }
3919
3920 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3921                                               struct sk_buff **pskb,
3922                                               const struct net_device *in,
3923                                               const struct net_device *out,
3924                                               int (*okfn)(struct sk_buff *),
3925                                               u16 family)
3926 {
3927         char *addrp;
3928         int len, err = 0;
3929         struct sock *sk;
3930         struct sk_buff *skb = *pskb;
3931         struct avc_audit_data ad;
3932         struct net_device *dev = (struct net_device *)out;
3933         struct sk_security_struct *sksec;
3934         u8 proto;
3935
3936         sk = skb->sk;
3937         if (!sk)
3938                 goto out;
3939
3940         sksec = sk->sk_security;
3941
3942         AVC_AUDIT_DATA_INIT(&ad, NET);
3943         ad.u.net.netif = dev->name;
3944         ad.u.net.family = family;
3945
3946         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3947         if (err)
3948                 goto out;
3949
3950         if (selinux_compat_net)
3951                 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3952                                                        family, addrp, len);
3953         else
3954                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3955                                    PACKET__SEND, &ad);
3956
3957         if (err)
3958                 goto out;
3959
3960         err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3961 out:
3962         return err ? NF_DROP : NF_ACCEPT;
3963 }
3964
3965 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3966                                                 struct sk_buff **pskb,
3967                                                 const struct net_device *in,
3968                                                 const struct net_device *out,
3969                                                 int (*okfn)(struct sk_buff *))
3970 {
3971         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3972 }
3973
3974 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3975
3976 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3977                                                 struct sk_buff **pskb,
3978                                                 const struct net_device *in,
3979                                                 const struct net_device *out,
3980                                                 int (*okfn)(struct sk_buff *))
3981 {
3982         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3983 }
3984
3985 #endif  /* IPV6 */
3986
3987 #endif  /* CONFIG_NETFILTER */
3988
3989 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3990 {
3991         int err;
3992
3993         err = secondary_ops->netlink_send(sk, skb);
3994         if (err)
3995                 return err;
3996
3997         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3998                 err = selinux_nlmsg_perm(sk, skb);
3999
4000         return err;
4001 }
4002
4003 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4004 {
4005         int err;
4006         struct avc_audit_data ad;
4007
4008         err = secondary_ops->netlink_recv(skb, capability);
4009         if (err)
4010                 return err;
4011
4012         AVC_AUDIT_DATA_INIT(&ad, CAP);
4013         ad.u.cap = capability;
4014
4015         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4016                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4017 }
4018
4019 static int ipc_alloc_security(struct task_struct *task,
4020                               struct kern_ipc_perm *perm,
4021                               u16 sclass)
4022 {
4023         struct task_security_struct *tsec = task->security;
4024         struct ipc_security_struct *isec;
4025
4026         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4027         if (!isec)
4028                 return -ENOMEM;
4029
4030         isec->sclass = sclass;
4031         isec->ipc_perm = perm;
4032         isec->sid = tsec->sid;
4033         perm->security = isec;
4034
4035         return 0;
4036 }
4037
4038 static void ipc_free_security(struct kern_ipc_perm *perm)
4039 {
4040         struct ipc_security_struct *isec = perm->security;
4041         perm->security = NULL;
4042         kfree(isec);
4043 }
4044
4045 static int msg_msg_alloc_security(struct msg_msg *msg)
4046 {
4047         struct msg_security_struct *msec;
4048
4049         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4050         if (!msec)
4051                 return -ENOMEM;
4052
4053         msec->msg = msg;
4054         msec->sid = SECINITSID_UNLABELED;
4055         msg->security = msec;
4056
4057         return 0;
4058 }
4059
4060 static void msg_msg_free_security(struct msg_msg *msg)
4061 {
4062         struct msg_security_struct *msec = msg->security;
4063
4064         msg->security = NULL;
4065         kfree(msec);
4066 }
4067
4068 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4069                         u32 perms)
4070 {
4071         struct task_security_struct *tsec;
4072         struct ipc_security_struct *isec;
4073         struct avc_audit_data ad;
4074
4075         tsec = current->security;
4076         isec = ipc_perms->security;
4077
4078         AVC_AUDIT_DATA_INIT(&ad, IPC);
4079         ad.u.ipc_id = ipc_perms->key;
4080
4081         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4082 }
4083
4084 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4085 {
4086         return msg_msg_alloc_security(msg);
4087 }
4088
4089 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4090 {
4091         msg_msg_free_security(msg);
4092 }
4093
4094 /* message queue security operations */
4095 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4096 {
4097         struct task_security_struct *tsec;
4098         struct ipc_security_struct *isec;
4099         struct avc_audit_data ad;
4100         int rc;
4101
4102         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4103         if (rc)
4104                 return rc;
4105
4106         tsec = current->security;
4107         isec = msq->q_perm.security;
4108
4109         AVC_AUDIT_DATA_INIT(&ad, IPC);
4110         ad.u.ipc_id = msq->q_perm.key;
4111
4112         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4113                           MSGQ__CREATE, &ad);
4114         if (rc) {
4115                 ipc_free_security(&msq->q_perm);
4116                 return rc;
4117         }
4118         return 0;
4119 }
4120
4121 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4122 {
4123         ipc_free_security(&msq->q_perm);
4124 }
4125
4126 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4127 {
4128         struct task_security_struct *tsec;
4129         struct ipc_security_struct *isec;
4130         struct avc_audit_data ad;
4131
4132         tsec = current->security;
4133         isec = msq->q_perm.security;
4134
4135         AVC_AUDIT_DATA_INIT(&ad, IPC);
4136         ad.u.ipc_id = msq->q_perm.key;
4137
4138         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4139                             MSGQ__ASSOCIATE, &ad);
4140 }
4141
4142 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4143 {
4144         int err;
4145         int perms;
4146
4147         switch(cmd) {
4148         case IPC_INFO:
4149         case MSG_INFO:
4150                 /* No specific object, just general system-wide information. */
4151                 return task_has_system(current, SYSTEM__IPC_INFO);
4152         case IPC_STAT:
4153         case MSG_STAT:
4154                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4155                 break;
4156         case IPC_SET:
4157                 perms = MSGQ__SETATTR;
4158                 break;
4159         case IPC_RMID:
4160                 perms = MSGQ__DESTROY;
4161                 break;
4162         default:
4163                 return 0;
4164         }
4165
4166         err = ipc_has_perm(&msq->q_perm, perms);
4167         return err;
4168 }
4169
4170 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4171 {
4172         struct task_security_struct *tsec;
4173         struct ipc_security_struct *isec;
4174         struct msg_security_struct *msec;
4175         struct avc_audit_data ad;
4176         int rc;
4177
4178         tsec = current->security;
4179         isec = msq->q_perm.security;
4180         msec = msg->security;
4181
4182         /*
4183          * First time through, need to assign label to the message
4184          */
4185         if (msec->sid == SECINITSID_UNLABELED) {
4186                 /*
4187                  * Compute new sid based on current process and
4188                  * message queue this message will be stored in
4189                  */
4190                 rc = security_transition_sid(tsec->sid,
4191                                              isec->sid,
4192                                              SECCLASS_MSG,
4193                                              &msec->sid);
4194                 if (rc)
4195                         return rc;
4196         }
4197
4198         AVC_AUDIT_DATA_INIT(&ad, IPC);
4199         ad.u.ipc_id = msq->q_perm.key;
4200
4201         /* Can this process write to the queue? */
4202         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4203                           MSGQ__WRITE, &ad);
4204         if (!rc)
4205                 /* Can this process send the message */
4206                 rc = avc_has_perm(tsec->sid, msec->sid,
4207                                   SECCLASS_MSG, MSG__SEND, &ad);
4208         if (!rc)
4209                 /* Can the message be put in the queue? */
4210                 rc = avc_has_perm(msec->sid, isec->sid,
4211                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4212
4213         return rc;
4214 }
4215
4216 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4217                                     struct task_struct *target,
4218                                     long type, int mode)
4219 {
4220         struct task_security_struct *tsec;
4221         struct ipc_security_struct *isec;
4222         struct msg_security_struct *msec;
4223         struct avc_audit_data ad;
4224         int rc;
4225
4226         tsec = target->security;
4227         isec = msq->q_perm.security;
4228         msec = msg->security;
4229
4230         AVC_AUDIT_DATA_INIT(&ad, IPC);
4231         ad.u.ipc_id = msq->q_perm.key;
4232
4233         rc = avc_has_perm(tsec->sid, isec->sid,
4234                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4235         if (!rc)
4236                 rc = avc_has_perm(tsec->sid, msec->sid,
4237                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4238         return rc;
4239 }
4240
4241 /* Shared Memory security operations */
4242 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4243 {
4244         struct task_security_struct *tsec;
4245         struct ipc_security_struct *isec;
4246         struct avc_audit_data ad;
4247         int rc;
4248
4249         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4250         if (rc)
4251                 return rc;
4252
4253         tsec = current->security;
4254         isec = shp->shm_perm.security;
4255
4256         AVC_AUDIT_DATA_INIT(&ad, IPC);
4257         ad.u.ipc_id = shp->shm_perm.key;
4258
4259         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4260                           SHM__CREATE, &ad);
4261         if (rc) {
4262                 ipc_free_security(&shp->shm_perm);
4263                 return rc;
4264         }
4265         return 0;
4266 }
4267
4268 static void selinux_shm_free_security(struct shmid_kernel *shp)
4269 {
4270         ipc_free_security(&shp->shm_perm);
4271 }
4272
4273 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4274 {
4275         struct task_security_struct *tsec;
4276         struct ipc_security_struct *isec;
4277         struct avc_audit_data ad;
4278
4279         tsec = current->security;
4280         isec = shp->shm_perm.security;
4281
4282         AVC_AUDIT_DATA_INIT(&ad, IPC);
4283         ad.u.ipc_id = shp->shm_perm.key;
4284
4285         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4286                             SHM__ASSOCIATE, &ad);
4287 }
4288
4289 /* Note, at this point, shp is locked down */
4290 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4291 {
4292         int perms;
4293         int err;
4294
4295         switch(cmd) {
4296         case IPC_INFO:
4297         case SHM_INFO:
4298                 /* No specific object, just general system-wide information. */
4299                 return task_has_system(current, SYSTEM__IPC_INFO);
4300         case IPC_STAT:
4301         case SHM_STAT:
4302                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4303                 break;
4304         case IPC_SET:
4305                 perms = SHM__SETATTR;
4306                 break;
4307         case SHM_LOCK:
4308         case SHM_UNLOCK:
4309                 perms = SHM__LOCK;
4310                 break;
4311         case IPC_RMID:
4312                 perms = SHM__DESTROY;
4313                 break;
4314         default:
4315                 return 0;
4316         }
4317
4318         err = ipc_has_perm(&shp->shm_perm, perms);
4319         return err;
4320 }
4321
4322 static int selinux_shm_shmat(struct shmid_kernel *shp,
4323                              char __user *shmaddr, int shmflg)
4324 {
4325         u32 perms;
4326         int rc;
4327
4328         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4329         if (rc)
4330                 return rc;
4331
4332         if (shmflg & SHM_RDONLY)
4333                 perms = SHM__READ;
4334         else
4335                 perms = SHM__READ | SHM__WRITE;
4336
4337         return ipc_has_perm(&shp->shm_perm, perms);
4338 }
4339
4340 /* Semaphore security operations */
4341 static int selinux_sem_alloc_security(struct sem_array *sma)
4342 {
4343         struct task_security_struct *tsec;
4344         struct ipc_security_struct *isec;
4345         struct avc_audit_data ad;
4346         int rc;
4347
4348         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4349         if (rc)
4350                 return rc;
4351
4352         tsec = current->security;
4353         isec = sma->sem_perm.security;
4354
4355         AVC_AUDIT_DATA_INIT(&ad, IPC);
4356         ad.u.ipc_id = sma->sem_perm.key;
4357
4358         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4359                           SEM__CREATE, &ad);
4360         if (rc) {
4361                 ipc_free_security(&sma->sem_perm);
4362                 return rc;
4363         }
4364         return 0;
4365 }
4366
4367 static void selinux_sem_free_security(struct sem_array *sma)
4368 {
4369         ipc_free_security(&sma->sem_perm);
4370 }
4371
4372 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4373 {
4374         struct task_security_struct *tsec;
4375         struct ipc_security_struct *isec;
4376         struct avc_audit_data ad;
4377
4378         tsec = current->security;
4379         isec = sma->sem_perm.security;
4380
4381         AVC_AUDIT_DATA_INIT(&ad, IPC);
4382         ad.u.ipc_id = sma->sem_perm.key;
4383
4384         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4385                             SEM__ASSOCIATE, &ad);
4386 }
4387
4388 /* Note, at this point, sma is locked down */
4389 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4390 {
4391         int err;
4392         u32 perms;
4393
4394         switch(cmd) {
4395         case IPC_INFO:
4396         case SEM_INFO:
4397                 /* No specific object, just general system-wide information. */
4398                 return task_has_system(current, SYSTEM__IPC_INFO);
4399         case GETPID:
4400         case GETNCNT:
4401         case GETZCNT:
4402                 perms = SEM__GETATTR;
4403                 break;
4404         case GETVAL:
4405         case GETALL:
4406                 perms = SEM__READ;
4407                 break;
4408         case SETVAL:
4409         case SETALL:
4410                 perms = SEM__WRITE;
4411                 break;
4412         case IPC_RMID:
4413                 perms = SEM__DESTROY;
4414                 break;
4415         case IPC_SET:
4416                 perms = SEM__SETATTR;
4417                 break;
4418         case IPC_STAT:
4419         case SEM_STAT:
4420                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4421                 break;
4422         default:
4423                 return 0;
4424         }
4425
4426         err = ipc_has_perm(&sma->sem_perm, perms);
4427         return err;
4428 }
4429
4430 static int selinux_sem_semop(struct sem_array *sma,
4431                              struct sembuf *sops, unsigned nsops, int alter)
4432 {
4433         u32 perms;
4434
4435         if (alter)
4436                 perms = SEM__READ | SEM__WRITE;
4437         else
4438                 perms = SEM__READ;
4439
4440         return ipc_has_perm(&sma->sem_perm, perms);
4441 }
4442
4443 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4444 {
4445         u32 av = 0;
4446
4447         av = 0;
4448         if (flag & S_IRUGO)
4449                 av |= IPC__UNIX_READ;
4450         if (flag & S_IWUGO)
4451                 av |= IPC__UNIX_WRITE;
4452
4453         if (av == 0)
4454                 return 0;
4455
4456         return ipc_has_perm(ipcp, av);
4457 }
4458
4459 /* module stacking operations */
4460 static int selinux_register_security (const char *name, struct security_operations *ops)
4461 {
4462         if (secondary_ops != original_ops) {
4463                 printk(KERN_ERR "%s:  There is already a secondary security "
4464                        "module registered.\n", __FUNCTION__);
4465                 return -EINVAL;
4466         }
4467
4468         secondary_ops = ops;
4469
4470         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4471                __FUNCTION__,
4472                name);
4473
4474         return 0;
4475 }
4476
4477 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4478 {
4479         if (ops != secondary_ops) {
4480                 printk(KERN_ERR "%s:  trying to unregister a security module "
4481                         "that is not registered.\n", __FUNCTION__);
4482                 return -EINVAL;
4483         }
4484
4485         secondary_ops = original_ops;
4486
4487         return 0;
4488 }
4489
4490 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4491 {
4492         if (inode)
4493                 inode_doinit_with_dentry(inode, dentry);
4494 }
4495
4496 static int selinux_getprocattr(struct task_struct *p,
4497                                char *name, char **value)
4498 {
4499         struct task_security_struct *tsec;
4500         u32 sid;
4501         int error;
4502         unsigned len;
4503
4504         if (current != p) {
4505                 error = task_has_perm(current, p, PROCESS__GETATTR);
4506                 if (error)
4507                         return error;
4508         }
4509
4510         tsec = p->security;
4511
4512         if (!strcmp(name, "current"))
4513                 sid = tsec->sid;
4514         else if (!strcmp(name, "prev"))
4515                 sid = tsec->osid;
4516         else if (!strcmp(name, "exec"))
4517                 sid = tsec->exec_sid;
4518         else if (!strcmp(name, "fscreate"))
4519                 sid = tsec->create_sid;
4520         else if (!strcmp(name, "keycreate"))
4521                 sid = tsec->keycreate_sid;
4522         else if (!strcmp(name, "sockcreate"))
4523                 sid = tsec->sockcreate_sid;
4524         else
4525                 return -EINVAL;
4526
4527         if (!sid)
4528                 return 0;
4529
4530         error = security_sid_to_context(sid, value, &len);
4531         if (error)
4532                 return error;
4533         return len;
4534 }
4535
4536 static int selinux_setprocattr(struct task_struct *p,
4537                                char *name, void *value, size_t size)
4538 {
4539         struct task_security_struct *tsec;
4540         u32 sid = 0;
4541         int error;
4542         char *str = value;
4543
4544         if (current != p) {
4545                 /* SELinux only allows a process to change its own
4546                    security attributes. */
4547                 return -EACCES;
4548         }
4549
4550         /*
4551          * Basic control over ability to set these attributes at all.
4552          * current == p, but we'll pass them separately in case the
4553          * above restriction is ever removed.
4554          */
4555         if (!strcmp(name, "exec"))
4556                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4557         else if (!strcmp(name, "fscreate"))
4558                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4559         else if (!strcmp(name, "keycreate"))
4560                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4561         else if (!strcmp(name, "sockcreate"))
4562                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4563         else if (!strcmp(name, "current"))
4564                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4565         else
4566                 error = -EINVAL;
4567         if (error)
4568                 return error;
4569
4570         /* Obtain a SID for the context, if one was specified. */
4571         if (size && str[1] && str[1] != '\n') {
4572                 if (str[size-1] == '\n') {
4573                         str[size-1] = 0;
4574                         size--;
4575                 }
4576                 error = security_context_to_sid(value, size, &sid);
4577                 if (error)
4578                         return error;
4579         }
4580
4581         /* Permission checking based on the specified context is
4582            performed during the actual operation (execve,
4583            open/mkdir/...), when we know the full context of the
4584            operation.  See selinux_bprm_set_security for the execve
4585            checks and may_create for the file creation checks. The
4586            operation will then fail if the context is not permitted. */
4587         tsec = p->security;
4588         if (!strcmp(name, "exec"))
4589                 tsec->exec_sid = sid;
4590         else if (!strcmp(name, "fscreate"))
4591                 tsec->create_sid = sid;
4592         else if (!strcmp(name, "keycreate")) {
4593                 error = may_create_key(sid, p);
4594                 if (error)
4595                         return error;
4596                 tsec->keycreate_sid = sid;
4597         } else if (!strcmp(name, "sockcreate"))
4598                 tsec->sockcreate_sid = sid;
4599         else if (!strcmp(name, "current")) {
4600                 struct av_decision avd;
4601
4602                 if (sid == 0)
4603                         return -EINVAL;
4604
4605                 /* Only allow single threaded processes to change context */
4606                 if (atomic_read(&p->mm->mm_users) != 1) {
4607                         struct task_struct *g, *t;
4608                         struct mm_struct *mm = p->mm;
4609                         read_lock(&tasklist_lock);
4610                         do_each_thread(g, t)
4611                                 if (t->mm == mm && t != p) {
4612                                         read_unlock(&tasklist_lock);
4613                                         return -EPERM;
4614                                 }
4615                         while_each_thread(g, t);
4616                         read_unlock(&tasklist_lock);
4617                 }
4618
4619                 /* Check permissions for the transition. */
4620                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4621                                      PROCESS__DYNTRANSITION, NULL);
4622                 if (error)
4623                         return error;
4624
4625                 /* Check for ptracing, and update the task SID if ok.
4626                    Otherwise, leave SID unchanged and fail. */
4627                 task_lock(p);
4628                 if (p->ptrace & PT_PTRACED) {
4629                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4630                                                      SECCLASS_PROCESS,
4631                                                      PROCESS__PTRACE, &avd);
4632                         if (!error)
4633                                 tsec->sid = sid;
4634                         task_unlock(p);
4635                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4636                                   PROCESS__PTRACE, &avd, error, NULL);
4637                         if (error)
4638                                 return error;
4639                 } else {
4640                         tsec->sid = sid;
4641                         task_unlock(p);
4642                 }
4643         }
4644         else
4645                 return -EINVAL;
4646
4647         return size;
4648 }
4649
4650 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4651 {
4652         return security_sid_to_context(secid, secdata, seclen);
4653 }
4654
4655 static void selinux_release_secctx(char *secdata, u32 seclen)
4656 {
4657         if (secdata)
4658                 kfree(secdata);
4659 }
4660
4661 #ifdef CONFIG_KEYS
4662
4663 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4664                              unsigned long flags)
4665 {
4666         struct task_security_struct *tsec = tsk->security;
4667         struct key_security_struct *ksec;
4668
4669         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4670         if (!ksec)
4671                 return -ENOMEM;
4672
4673         ksec->obj = k;
4674         if (tsec->keycreate_sid)
4675                 ksec->sid = tsec->keycreate_sid;
4676         else
4677                 ksec->sid = tsec->sid;
4678         k->security = ksec;
4679
4680         return 0;
4681 }
4682
4683 static void selinux_key_free(struct key *k)
4684 {
4685         struct key_security_struct *ksec = k->security;
4686
4687         k->security = NULL;
4688         kfree(ksec);
4689 }
4690
4691 static int selinux_key_permission(key_ref_t key_ref,
4692                             struct task_struct *ctx,
4693                             key_perm_t perm)
4694 {
4695         struct key *key;
4696         struct task_security_struct *tsec;
4697         struct key_security_struct *ksec;
4698
4699         key = key_ref_to_ptr(key_ref);
4700
4701         tsec = ctx->security;
4702         ksec = key->security;
4703
4704         /* if no specific permissions are requested, we skip the
4705            permission check. No serious, additional covert channels
4706            appear to be created. */
4707         if (perm == 0)
4708                 return 0;
4709
4710         return avc_has_perm(tsec->sid, ksec->sid,
4711                             SECCLASS_KEY, perm, NULL);
4712 }
4713
4714 #endif
4715
4716 static struct security_operations selinux_ops = {
4717         .ptrace =                       selinux_ptrace,
4718         .capget =                       selinux_capget,
4719         .capset_check =                 selinux_capset_check,
4720         .capset_set =                   selinux_capset_set,
4721         .sysctl =                       selinux_sysctl,
4722         .capable =                      selinux_capable,
4723         .quotactl =                     selinux_quotactl,
4724         .quota_on =                     selinux_quota_on,
4725         .syslog =                       selinux_syslog,
4726         .vm_enough_memory =             selinux_vm_enough_memory,
4727
4728         .netlink_send =                 selinux_netlink_send,
4729         .netlink_recv =                 selinux_netlink_recv,
4730
4731         .bprm_alloc_security =          selinux_bprm_alloc_security,
4732         .bprm_free_security =           selinux_bprm_free_security,
4733         .bprm_apply_creds =             selinux_bprm_apply_creds,
4734         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4735         .bprm_set_security =            selinux_bprm_set_security,
4736         .bprm_check_security =          selinux_bprm_check_security,
4737         .bprm_secureexec =              selinux_bprm_secureexec,
4738
4739         .sb_alloc_security =            selinux_sb_alloc_security,
4740         .sb_free_security =             selinux_sb_free_security,
4741         .sb_copy_data =                 selinux_sb_copy_data,
4742         .sb_kern_mount =                selinux_sb_kern_mount,
4743         .sb_statfs =                    selinux_sb_statfs,
4744         .sb_mount =                     selinux_mount,
4745         .sb_umount =                    selinux_umount,
4746
4747         .inode_alloc_security =         selinux_inode_alloc_security,
4748         .inode_free_security =          selinux_inode_free_security,
4749         .inode_init_security =          selinux_inode_init_security,
4750         .inode_create =                 selinux_inode_create,
4751         .inode_link =                   selinux_inode_link,
4752         .inode_unlink =                 selinux_inode_unlink,
4753         .inode_symlink =                selinux_inode_symlink,
4754         .inode_mkdir =                  selinux_inode_mkdir,
4755         .inode_rmdir =                  selinux_inode_rmdir,
4756         .inode_mknod =                  selinux_inode_mknod,
4757         .inode_rename =                 selinux_inode_rename,
4758         .inode_readlink =               selinux_inode_readlink,
4759         .inode_follow_link =            selinux_inode_follow_link,
4760         .inode_permission =             selinux_inode_permission,
4761         .inode_setattr =                selinux_inode_setattr,
4762         .inode_getattr =                selinux_inode_getattr,
4763         .inode_setxattr =               selinux_inode_setxattr,
4764         .inode_post_setxattr =          selinux_inode_post_setxattr,
4765         .inode_getxattr =               selinux_inode_getxattr,
4766         .inode_listxattr =              selinux_inode_listxattr,
4767         .inode_removexattr =            selinux_inode_removexattr,
4768         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4769         .inode_getsecurity =            selinux_inode_getsecurity,
4770         .inode_setsecurity =            selinux_inode_setsecurity,
4771         .inode_listsecurity =           selinux_inode_listsecurity,
4772
4773         .file_permission =              selinux_file_permission,
4774         .file_alloc_security =          selinux_file_alloc_security,
4775         .file_free_security =           selinux_file_free_security,
4776         .file_ioctl =                   selinux_file_ioctl,
4777         .file_mmap =                    selinux_file_mmap,
4778         .file_mprotect =                selinux_file_mprotect,
4779         .file_lock =                    selinux_file_lock,
4780         .file_fcntl =                   selinux_file_fcntl,
4781         .file_set_fowner =              selinux_file_set_fowner,
4782         .file_send_sigiotask =          selinux_file_send_sigiotask,
4783         .file_receive =                 selinux_file_receive,
4784
4785         .task_create =                  selinux_task_create,
4786         .task_alloc_security =          selinux_task_alloc_security,
4787         .task_free_security =           selinux_task_free_security,
4788         .task_setuid =                  selinux_task_setuid,
4789         .task_post_setuid =             selinux_task_post_setuid,
4790         .task_setgid =                  selinux_task_setgid,
4791         .task_setpgid =                 selinux_task_setpgid,
4792         .task_getpgid =                 selinux_task_getpgid,
4793         .task_getsid =                  selinux_task_getsid,
4794         .task_getsecid =                selinux_task_getsecid,
4795         .task_setgroups =               selinux_task_setgroups,
4796         .task_setnice =                 selinux_task_setnice,
4797         .task_setioprio =               selinux_task_setioprio,
4798         .task_getioprio =               selinux_task_getioprio,
4799         .task_setrlimit =               selinux_task_setrlimit,
4800         .task_setscheduler =            selinux_task_setscheduler,
4801         .task_getscheduler =            selinux_task_getscheduler,
4802         .task_movememory =              selinux_task_movememory,
4803         .task_kill =                    selinux_task_kill,
4804         .task_wait =                    selinux_task_wait,
4805         .task_prctl =                   selinux_task_prctl,
4806         .task_reparent_to_init =        selinux_task_reparent_to_init,
4807         .task_to_inode =                selinux_task_to_inode,
4808
4809         .ipc_permission =               selinux_ipc_permission,
4810
4811         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4812         .msg_msg_free_security =        selinux_msg_msg_free_security,
4813
4814         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4815         .msg_queue_free_security =      selinux_msg_queue_free_security,
4816         .msg_queue_associate =          selinux_msg_queue_associate,
4817         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4818         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4819         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4820
4821         .shm_alloc_security =           selinux_shm_alloc_security,
4822         .shm_free_security =            selinux_shm_free_security,
4823         .shm_associate =                selinux_shm_associate,
4824         .shm_shmctl =                   selinux_shm_shmctl,
4825         .shm_shmat =                    selinux_shm_shmat,
4826
4827         .sem_alloc_security =           selinux_sem_alloc_security,
4828         .sem_free_security =            selinux_sem_free_security,
4829         .sem_associate =                selinux_sem_associate,
4830         .sem_semctl =                   selinux_sem_semctl,
4831         .sem_semop =                    selinux_sem_semop,
4832
4833         .register_security =            selinux_register_security,
4834         .unregister_security =          selinux_unregister_security,
4835
4836         .d_instantiate =                selinux_d_instantiate,
4837
4838         .getprocattr =                  selinux_getprocattr,
4839         .setprocattr =                  selinux_setprocattr,
4840
4841         .secid_to_secctx =              selinux_secid_to_secctx,
4842         .release_secctx =               selinux_release_secctx,
4843
4844         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4845         .unix_may_send =                selinux_socket_unix_may_send,
4846
4847         .socket_create =                selinux_socket_create,
4848         .socket_post_create =           selinux_socket_post_create,
4849         .socket_bind =                  selinux_socket_bind,
4850         .socket_connect =               selinux_socket_connect,
4851         .socket_listen =                selinux_socket_listen,
4852         .socket_accept =                selinux_socket_accept,
4853         .socket_sendmsg =               selinux_socket_sendmsg,
4854         .socket_recvmsg =               selinux_socket_recvmsg,
4855         .socket_getsockname =           selinux_socket_getsockname,
4856         .socket_getpeername =           selinux_socket_getpeername,
4857         .socket_getsockopt =            selinux_socket_getsockopt,
4858         .socket_setsockopt =            selinux_socket_setsockopt,
4859         .socket_shutdown =              selinux_socket_shutdown,
4860         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4861         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4862         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4863         .sk_alloc_security =            selinux_sk_alloc_security,
4864         .sk_free_security =             selinux_sk_free_security,
4865         .sk_clone_security =            selinux_sk_clone_security,
4866         .sk_getsecid =                  selinux_sk_getsecid,
4867         .sock_graft =                   selinux_sock_graft,
4868         .inet_conn_request =            selinux_inet_conn_request,
4869         .inet_csk_clone =               selinux_inet_csk_clone,
4870         .inet_conn_established =        selinux_inet_conn_established,
4871         .req_classify_flow =            selinux_req_classify_flow,
4872
4873 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4874         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4875         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4876         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4877         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4878         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4879         .xfrm_state_free_security =     selinux_xfrm_state_free,
4880         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4881         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4882         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
4883         .xfrm_decode_session =          selinux_xfrm_decode_session,
4884 #endif
4885
4886 #ifdef CONFIG_KEYS
4887         .key_alloc =                    selinux_key_alloc,
4888         .key_free =                     selinux_key_free,
4889         .key_permission =               selinux_key_permission,
4890 #endif
4891 };
4892
4893 static __init int selinux_init(void)
4894 {
4895         struct task_security_struct *tsec;
4896
4897         if (!selinux_enabled) {
4898                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4899                 return 0;
4900         }
4901
4902         printk(KERN_INFO "SELinux:  Initializing.\n");
4903
4904         /* Set the security state for the initial task. */
4905         if (task_alloc_security(current))
4906                 panic("SELinux:  Failed to initialize initial task.\n");
4907         tsec = current->security;
4908         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4909
4910         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4911                                             sizeof(struct inode_security_struct),
4912                                             0, SLAB_PANIC, NULL, NULL);
4913         avc_init();
4914
4915         original_ops = secondary_ops = security_ops;
4916         if (!secondary_ops)
4917                 panic ("SELinux: No initial security operations\n");
4918         if (register_security (&selinux_ops))
4919                 panic("SELinux: Unable to register with kernel.\n");
4920
4921         if (selinux_enforcing) {
4922                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
4923         } else {
4924                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
4925         }
4926
4927 #ifdef CONFIG_KEYS
4928         /* Add security information to initial keyrings */
4929         selinux_key_alloc(&root_user_keyring, current,
4930                           KEY_ALLOC_NOT_IN_QUOTA);
4931         selinux_key_alloc(&root_session_keyring, current,
4932                           KEY_ALLOC_NOT_IN_QUOTA);
4933 #endif
4934
4935         return 0;
4936 }
4937
4938 void selinux_complete_init(void)
4939 {
4940         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
4941
4942         /* Set up any superblocks initialized prior to the policy load. */
4943         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
4944         spin_lock(&sb_lock);
4945         spin_lock(&sb_security_lock);
4946 next_sb:
4947         if (!list_empty(&superblock_security_head)) {
4948                 struct superblock_security_struct *sbsec =
4949                                 list_entry(superblock_security_head.next,
4950                                            struct superblock_security_struct,
4951                                            list);
4952                 struct super_block *sb = sbsec->sb;
4953                 sb->s_count++;
4954                 spin_unlock(&sb_security_lock);
4955                 spin_unlock(&sb_lock);
4956                 down_read(&sb->s_umount);
4957                 if (sb->s_root)
4958                         superblock_doinit(sb, NULL);
4959                 drop_super(sb);
4960                 spin_lock(&sb_lock);
4961                 spin_lock(&sb_security_lock);
4962                 list_del_init(&sbsec->list);
4963                 goto next_sb;
4964         }
4965         spin_unlock(&sb_security_lock);
4966         spin_unlock(&sb_lock);
4967 }
4968
4969 /* SELinux requires early initialization in order to label
4970    all processes and objects when they are created. */
4971 security_initcall(selinux_init);
4972
4973 #if defined(CONFIG_NETFILTER)
4974
4975 static struct nf_hook_ops selinux_ipv4_op = {
4976         .hook =         selinux_ipv4_postroute_last,
4977         .owner =        THIS_MODULE,
4978         .pf =           PF_INET,
4979         .hooknum =      NF_IP_POST_ROUTING,
4980         .priority =     NF_IP_PRI_SELINUX_LAST,
4981 };
4982
4983 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4984
4985 static struct nf_hook_ops selinux_ipv6_op = {
4986         .hook =         selinux_ipv6_postroute_last,
4987         .owner =        THIS_MODULE,
4988         .pf =           PF_INET6,
4989         .hooknum =      NF_IP6_POST_ROUTING,
4990         .priority =     NF_IP6_PRI_SELINUX_LAST,
4991 };
4992
4993 #endif  /* IPV6 */
4994
4995 static int __init selinux_nf_ip_init(void)
4996 {
4997         int err = 0;
4998
4999         if (!selinux_enabled)
5000                 goto out;
5001
5002         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5003
5004         err = nf_register_hook(&selinux_ipv4_op);
5005         if (err)
5006                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5007
5008 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5009
5010         err = nf_register_hook(&selinux_ipv6_op);
5011         if (err)
5012                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5013
5014 #endif  /* IPV6 */
5015
5016 out:
5017         return err;
5018 }
5019
5020 __initcall(selinux_nf_ip_init);
5021
5022 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5023 static void selinux_nf_ip_exit(void)
5024 {
5025         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5026
5027         nf_unregister_hook(&selinux_ipv4_op);
5028 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5029         nf_unregister_hook(&selinux_ipv6_op);
5030 #endif  /* IPV6 */
5031 }
5032 #endif
5033
5034 #else /* CONFIG_NETFILTER */
5035
5036 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5037 #define selinux_nf_ip_exit()
5038 #endif
5039
5040 #endif /* CONFIG_NETFILTER */
5041
5042 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5043 int selinux_disable(void)
5044 {
5045         extern void exit_sel_fs(void);
5046         static int selinux_disabled = 0;
5047
5048         if (ss_initialized) {
5049                 /* Not permitted after initial policy load. */
5050                 return -EINVAL;
5051         }
5052
5053         if (selinux_disabled) {
5054                 /* Only do this once. */
5055                 return -EINVAL;
5056         }
5057
5058         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5059
5060         selinux_disabled = 1;
5061         selinux_enabled = 0;
5062
5063         /* Reset security_ops to the secondary module, dummy or capability. */
5064         security_ops = secondary_ops;
5065
5066         /* Unregister netfilter hooks. */
5067         selinux_nf_ip_exit();
5068
5069         /* Unregister selinuxfs. */
5070         exit_sel_fs();
5071
5072         return 0;
5073 }
5074 #endif
5075
5076