Merge master.kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6
[sfrench/cifs-2.6.git] / security / selinux / hooks.c
index 9f9463000683e94f942dc29bdbadf08087603ecf..6e4937fe062b40f2c4b3c05baaa9cc96f85c4cd8 100644 (file)
@@ -659,7 +659,7 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
                        return SECCLASS_NETLINK_ROUTE_SOCKET;
                case NETLINK_FIREWALL:
                        return SECCLASS_NETLINK_FIREWALL_SOCKET;
-               case NETLINK_TCPDIAG:
+               case NETLINK_INET_DIAG:
                        return SECCLASS_NETLINK_TCPDIAG_SOCKET;
                case NETLINK_NFLOG:
                        return SECCLASS_NETLINK_NFLOG_SOCKET;
@@ -1265,85 +1265,6 @@ static int inode_security_set_sid(struct inode *inode, u32 sid)
        return 0;
 }
 
-/* Set the security attributes on a newly created file. */
-static int post_create(struct inode *dir,
-                      struct dentry *dentry)
-{
-
-       struct task_security_struct *tsec;
-       struct inode *inode;
-       struct inode_security_struct *dsec;
-       struct superblock_security_struct *sbsec;
-       u32 newsid;
-       char *context;
-       unsigned int len;
-       int rc;
-
-       tsec = current->security;
-       dsec = dir->i_security;
-       sbsec = dir->i_sb->s_security;
-
-       inode = dentry->d_inode;
-       if (!inode) {
-               /* Some file system types (e.g. NFS) may not instantiate
-                  a dentry for all create operations (e.g. symlink),
-                  so we have to check to see if the inode is non-NULL. */
-               printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
-                      "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
-               return 0;
-       }
-
-       if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
-               newsid = tsec->create_sid;
-       } else {
-               rc = security_transition_sid(tsec->sid, dsec->sid,
-                                            inode_mode_to_security_class(inode->i_mode),
-                                            &newsid);
-               if (rc) {
-                       printk(KERN_WARNING "post_create:  "
-                              "security_transition_sid failed, rc=%d (dev=%s "
-                              "ino=%ld)\n",
-                              -rc, inode->i_sb->s_id, inode->i_ino);
-                       return rc;
-               }
-       }
-
-       rc = inode_security_set_sid(inode, newsid);
-       if (rc) {
-               printk(KERN_WARNING "post_create:  inode_security_set_sid "
-                      "failed, rc=%d (dev=%s ino=%ld)\n",
-                      -rc, inode->i_sb->s_id, inode->i_ino);
-               return rc;
-       }
-
-       if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
-           inode->i_op->setxattr) {
-               /* Use extended attributes. */
-               rc = security_sid_to_context(newsid, &context, &len);
-               if (rc) {
-                       printk(KERN_WARNING "post_create:  sid_to_context "
-                              "failed, rc=%d (dev=%s ino=%ld)\n",
-                              -rc, inode->i_sb->s_id, inode->i_ino);
-                       return rc;
-               }
-               down(&inode->i_sem);
-               rc = inode->i_op->setxattr(dentry,
-                                          XATTR_NAME_SELINUX,
-                                          context, len, 0);
-               up(&inode->i_sem);
-               kfree(context);
-               if (rc < 0) {
-                       printk(KERN_WARNING "post_create:  setxattr failed, "
-                              "rc=%d (dev=%s ino=%ld)\n",
-                              -rc, inode->i_sb->s_id, inode->i_ino);
-                       return rc;
-               }
-       }
-
-       return 0;
-}
-
-
 /* Hook functions begin here. */
 
 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
@@ -1673,6 +1594,7 @@ static inline void flush_unauthorized_files(struct files_struct * files)
        struct avc_audit_data ad;
        struct file *file, *devnull = NULL;
        struct tty_struct *tty = current->signal->tty;
+       struct fdtable *fdt;
        long j = -1;
 
        if (tty) {
@@ -1706,9 +1628,10 @@ static inline void flush_unauthorized_files(struct files_struct * files)
 
                j++;
                i = j * __NFDBITS;
-               if (i >= files->max_fds || i >= files->max_fdset)
+               fdt = files_fdtable(files);
+               if (i >= fdt->max_fds || i >= fdt->max_fdset)
                        break;
-               set = files->open_fds->fds_bits[j];
+               set = fdt->open_fds->fds_bits[j];
                if (!set)
                        continue;
                spin_unlock(&files->file_lock);
@@ -1729,7 +1652,7 @@ static inline void flush_unauthorized_files(struct files_struct * files)
                                                continue;
                                        }
                                        if (devnull) {
-                                               atomic_inc(&devnull->f_count);
+                                               rcuref_inc(&devnull->f_count);
                                        } else {
                                                devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
                                                if (!devnull) {
@@ -2018,14 +1941,64 @@ static void selinux_inode_free_security(struct inode *inode)
        inode_free_security(inode);
 }
 
-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
+                                      char **name, void **value,
+                                      size_t *len)
 {
-       return may_create(dir, dentry, SECCLASS_FILE);
+       struct task_security_struct *tsec;
+       struct inode_security_struct *dsec;
+       struct superblock_security_struct *sbsec;
+       struct inode_security_struct *isec;
+       u32 newsid, clen;
+       int rc;
+       char *namep = NULL, *context;
+
+       tsec = current->security;
+       dsec = dir->i_security;
+       sbsec = dir->i_sb->s_security;
+       isec = inode->i_security;
+
+       if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
+               newsid = tsec->create_sid;
+       } else {
+               rc = security_transition_sid(tsec->sid, dsec->sid,
+                                            inode_mode_to_security_class(inode->i_mode),
+                                            &newsid);
+               if (rc) {
+                       printk(KERN_WARNING "%s:  "
+                              "security_transition_sid failed, rc=%d (dev=%s "
+                              "ino=%ld)\n",
+                              __FUNCTION__,
+                              -rc, inode->i_sb->s_id, inode->i_ino);
+                       return rc;
+               }
+       }
+
+       inode_security_set_sid(inode, newsid);
+
+       if (name) {
+               namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
+               if (!namep)
+                       return -ENOMEM;
+               *name = namep;
+       }
+
+       if (value && len) {
+               rc = security_sid_to_context(newsid, &context, &clen);
+               if (rc) {
+                       kfree(namep);
+                       return rc;
+               }
+               *value = context;
+               *len = clen;
+       }
+
+       return 0;
 }
 
-static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
 {
-       post_create(dir, dentry);
+       return may_create(dir, dentry, SECCLASS_FILE);
 }
 
 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
@@ -2038,11 +2011,6 @@ static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, stru
        return may_link(dir, old_dentry, MAY_LINK);
 }
 
-static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
-{
-       return;
-}
-
 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
 {
        int rc;
@@ -2058,21 +2026,11 @@ static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const
        return may_create(dir, dentry, SECCLASS_LNK_FILE);
 }
 
-static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
-{
-       post_create(dir, dentry);
-}
-
 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
 {
        return may_create(dir, dentry, SECCLASS_DIR);
 }
 
-static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
-{
-       post_create(dir, dentry);
-}
-
 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
 {
        return may_link(dir, dentry, MAY_RMDIR);
@@ -2089,23 +2047,12 @@ static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mod
        return may_create(dir, dentry, inode_mode_to_security_class(mode));
 }
 
-static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
-{
-       post_create(dir, dentry);
-}
-
 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
                                 struct inode *new_inode, struct dentry *new_dentry)
 {
        return may_rename(old_inode, old_dentry, new_inode, new_dentry);
 }
 
-static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
-                                      struct inode *new_inode, struct dentry *new_dentry)
-{
-       return;
-}
-
 static int selinux_inode_readlink(struct dentry *dentry)
 {
        return dentry_has_perm(current, NULL, dentry, FILE__READ);
@@ -4298,20 +4245,15 @@ static struct security_operations selinux_ops = {
 
        .inode_alloc_security =         selinux_inode_alloc_security,
        .inode_free_security =          selinux_inode_free_security,
+       .inode_init_security =          selinux_inode_init_security,
        .inode_create =                 selinux_inode_create,
-       .inode_post_create =            selinux_inode_post_create,
        .inode_link =                   selinux_inode_link,
-       .inode_post_link =              selinux_inode_post_link,
        .inode_unlink =                 selinux_inode_unlink,
        .inode_symlink =                selinux_inode_symlink,
-       .inode_post_symlink =           selinux_inode_post_symlink,
        .inode_mkdir =                  selinux_inode_mkdir,
-       .inode_post_mkdir =             selinux_inode_post_mkdir,
        .inode_rmdir =                  selinux_inode_rmdir,
        .inode_mknod =                  selinux_inode_mknod,
-       .inode_post_mknod =             selinux_inode_post_mknod,
        .inode_rename =                 selinux_inode_rename,
-       .inode_post_rename =            selinux_inode_post_rename,
        .inode_readlink =               selinux_inode_readlink,
        .inode_follow_link =            selinux_inode_follow_link,
        .inode_permission =             selinux_inode_permission,