security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         /*
 259          * As not all inode security structures are in a list, we check for
 260          * empty list outside of the lock to make sure that we won't waste
 261          * time taking a lock doing nothing.
 262          *
 263          * The list_del_init() function can be safely called more than once.
 264          * It should not be possible for this function to be called with
 265          * concurrent list_add(), but for better safety against future changes
 266          * in the code, we use list_empty_careful() here.
 267          */
 268         if (!list_empty_careful(&isec->list)) {
 269                 spin_lock(&sbsec->isec_lock);
 270                 list_del_init(&isec->list);
 271                 spin_unlock(&sbsec->isec_lock);
 272         }
 273
 274         /*
 275          * The inode may still be referenced in a path walk and
 276          * a call to selinux_inode_permission() can be made
 277          * after inode_free_security() is called. Ideally, the VFS
 278          * wouldn't do this, but fixing that is a much harder
 279          * job. For now, simply free the i_security via RCU, and
 280          * leave the current inode->i_security pointer intact.
 281          * The inode will be freed after the RCU grace period too.
 282          */
 283         call_rcu(&isec->rcu, inode_free_rcu);
 284 }
 285
 286 static int file_alloc_security(struct file *file)
 287 {
 288         struct file_security_struct *fsec;
 289         u32 sid = current_sid();
 290
 291         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 292         if (!fsec)
 293                 return -ENOMEM;
 294
 295         fsec->sid = sid;
 296         fsec->fown_sid = sid;
 297         file->f_security = fsec;
 298
 299         return 0;
 300 }
 301
 302 static void file_free_security(struct file *file)
 303 {
 304         struct file_security_struct *fsec = file->f_security;
 305         file->f_security = NULL;
 306         kmem_cache_free(file_security_cache, fsec);
 307 }
 308
 309 static int superblock_alloc_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec;
 312
 313         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 314         if (!sbsec)
 315                 return -ENOMEM;
 316
 317         mutex_init(&sbsec->lock);
 318         INIT_LIST_HEAD(&sbsec->isec_head);
 319         spin_lock_init(&sbsec->isec_lock);
 320         sbsec->sb = sb;
 321         sbsec->sid = SECINITSID_UNLABELED;
 322         sbsec->def_sid = SECINITSID_FILE;
 323         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 324         sb->s_security = sbsec;
 325
 326         return 0;
 327 }
 328
 329 static void superblock_free_security(struct super_block *sb)
 330 {
 331         struct superblock_security_struct *sbsec = sb->s_security;
 332         sb->s_security = NULL;
 333         kfree(sbsec);
 334 }
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_genfs_special_handling(struct super_block *sb)
 400 {
 401         /* Special handling. Genfs but also in-core setxattr handler */
 402         return  !strcmp(sb->s_type->name, "sysfs") ||
 403                 !strcmp(sb->s_type->name, "pstore") ||
 404                 !strcmp(sb->s_type->name, "debugfs") ||
 405                 !strcmp(sb->s_type->name, "rootfs");
 406 }
 407
 408 static int selinux_is_sblabel_mnt(struct super_block *sb)
 409 {
 410         struct superblock_security_struct *sbsec = sb->s_security;
 411
 412         /*
 413          * IMPORTANT: Double-check logic in this function when adding a new
 414          * SECURITY_FS_USE_* definition!
 415          */
 416         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 417
 418         switch (sbsec->behavior) {
 419         case SECURITY_FS_USE_XATTR:
 420         case SECURITY_FS_USE_TRANS:
 421         case SECURITY_FS_USE_TASK:
 422         case SECURITY_FS_USE_NATIVE:
 423                 return 1;
 424
 425         case SECURITY_FS_USE_GENFS:
 426                 return selinux_is_genfs_special_handling(sb);
 427
 428         /* Never allow relabeling on context mounts */
 429         case SECURITY_FS_USE_MNTPOINT:
 430         case SECURITY_FS_USE_NONE:
 431         default:
 432                 return 0;
 433         }
 434 }
 435
 436 static int sb_finish_set_opts(struct super_block *sb)
 437 {
 438         struct superblock_security_struct *sbsec = sb->s_security;
 439         struct dentry *root = sb->s_root;
 440         struct inode *root_inode = d_backing_inode(root);
 441         int rc = 0;
 442
 443         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 444                 /* Make sure that the xattr handler exists and that no
 445                    error other than -ENODATA is returned by getxattr on
 446                    the root directory.  -ENODATA is ok, as this may be
 447                    the first boot of the SELinux kernel before we have
 448                    assigned xattr values to the filesystem. */
 449                 if (!root_inode->i_op->getxattr) {
 450                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 451                                "xattr support\n", sb->s_id, sb->s_type->name);
 452                         rc = -EOPNOTSUPP;
 453                         goto out;
 454                 }
 455                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 456                 if (rc < 0 && rc != -ENODATA) {
 457                         if (rc == -EOPNOTSUPP)
 458                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 459                                        "%s) has no security xattr handler\n",
 460                                        sb->s_id, sb->s_type->name);
 461                         else
 462                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 463                                        "%s) getxattr errno %d\n", sb->s_id,
 464                                        sb->s_type->name, -rc);
 465                         goto out;
 466                 }
 467         }
 468
 469         sbsec->flags |= SE_SBINITIALIZED;
 470         if (selinux_is_sblabel_mnt(sb))
 471                 sbsec->flags |= SBLABEL_MNT;
 472
 473         /* Initialize the root inode. */
 474         rc = inode_doinit_with_dentry(root_inode, root);
 475
 476         /* Initialize any other inodes associated with the superblock, e.g.
 477            inodes created prior to initial policy load or inodes created
 478            during get_sb by a pseudo filesystem that directly
 479            populates itself. */
 480         spin_lock(&sbsec->isec_lock);
 481 next_inode:
 482         if (!list_empty(&sbsec->isec_head)) {
 483                 struct inode_security_struct *isec =
 484                                 list_entry(sbsec->isec_head.next,
 485                                            struct inode_security_struct, list);
 486                 struct inode *inode = isec->inode;
 487                 list_del_init(&isec->list);
 488                 spin_unlock(&sbsec->isec_lock);
 489                 inode = igrab(inode);
 490                 if (inode) {
 491                         if (!IS_PRIVATE(inode))
 492                                 inode_doinit(inode);
 493                         iput(inode);
 494                 }
 495                 spin_lock(&sbsec->isec_lock);
 496                 goto next_inode;
 497         }
 498         spin_unlock(&sbsec->isec_lock);
 499 out:
 500         return rc;
 501 }
 502
 503 /*
 504  * This function should allow an FS to ask what it's mount security
 505  * options were so it can use those later for submounts, displaying
 506  * mount options, or whatever.
 507  */
 508 static int selinux_get_mnt_opts(const struct super_block *sb,
 509                                 struct security_mnt_opts *opts)
 510 {
 511         int rc = 0, i;
 512         struct superblock_security_struct *sbsec = sb->s_security;
 513         char *context = NULL;
 514         u32 len;
 515         char tmp;
 516
 517         security_init_mnt_opts(opts);
 518
 519         if (!(sbsec->flags & SE_SBINITIALIZED))
 520                 return -EINVAL;
 521
 522         if (!ss_initialized)
 523                 return -EINVAL;
 524
 525         /* make sure we always check enough bits to cover the mask */
 526         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 527
 528         tmp = sbsec->flags & SE_MNTMASK;
 529         /* count the number of mount options for this sb */
 530         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 531                 if (tmp & 0x01)
 532                         opts->num_mnt_opts++;
 533                 tmp >>= 1;
 534         }
 535         /* Check if the Label support flag is set */
 536         if (sbsec->flags & SBLABEL_MNT)
 537                 opts->num_mnt_opts++;
 538
 539         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 540         if (!opts->mnt_opts) {
 541                 rc = -ENOMEM;
 542                 goto out_free;
 543         }
 544
 545         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 546         if (!opts->mnt_opts_flags) {
 547                 rc = -ENOMEM;
 548                 goto out_free;
 549         }
 550
 551         i = 0;
 552         if (sbsec->flags & FSCONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 558         }
 559         if (sbsec->flags & CONTEXT_MNT) {
 560                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 561                 if (rc)
 562                         goto out_free;
 563                 opts->mnt_opts[i] = context;
 564                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 565         }
 566         if (sbsec->flags & DEFCONTEXT_MNT) {
 567                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 568                 if (rc)
 569                         goto out_free;
 570                 opts->mnt_opts[i] = context;
 571                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 572         }
 573         if (sbsec->flags & ROOTCONTEXT_MNT) {
 574                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 575                 struct inode_security_struct *isec = root->i_security;
 576
 577                 rc = security_sid_to_context(isec->sid, &context, &len);
 578                 if (rc)
 579                         goto out_free;
 580                 opts->mnt_opts[i] = context;
 581                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 582         }
 583         if (sbsec->flags & SBLABEL_MNT) {
 584                 opts->mnt_opts[i] = NULL;
 585                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 586         }
 587
 588         BUG_ON(i != opts->num_mnt_opts);
 589
 590         return 0;
 591
 592 out_free:
 593         security_free_mnt_opts(opts);
 594         return rc;
 595 }
 596
 597 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 598                       u32 old_sid, u32 new_sid)
 599 {
 600         char mnt_flags = sbsec->flags & SE_MNTMASK;
 601
 602         /* check if the old mount command had the same options */
 603         if (sbsec->flags & SE_SBINITIALIZED)
 604                 if (!(sbsec->flags & flag) ||
 605                     (old_sid != new_sid))
 606                         return 1;
 607
 608         /* check if we were passed the same options twice,
 609          * aka someone passed context=a,context=b
 610          */
 611         if (!(sbsec->flags & SE_SBINITIALIZED))
 612                 if (mnt_flags & flag)
 613                         return 1;
 614         return 0;
 615 }
 616
 617 /*
 618  * Allow filesystems with binary mount data to explicitly set mount point
 619  * labeling information.
 620  */
 621 static int selinux_set_mnt_opts(struct super_block *sb,
 622                                 struct security_mnt_opts *opts,
 623                                 unsigned long kern_flags,
 624                                 unsigned long *set_kern_flags)
 625 {
 626         const struct cred *cred = current_cred();
 627         int rc = 0, i;
 628         struct superblock_security_struct *sbsec = sb->s_security;
 629         const char *name = sb->s_type->name;
 630         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 631         struct inode_security_struct *root_isec = inode->i_security;
 632         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 633         u32 defcontext_sid = 0;
 634         char **mount_options = opts->mnt_opts;
 635         int *flags = opts->mnt_opts_flags;
 636         int num_opts = opts->num_mnt_opts;
 637
 638         mutex_lock(&sbsec->lock);
 639
 640         if (!ss_initialized) {
 641                 if (!num_opts) {
 642                         /* Defer initialization until selinux_complete_init,
 643                            after the initial policy is loaded and the security
 644                            server is ready to handle calls. */
 645                         goto out;
 646                 }
 647                 rc = -EINVAL;
 648                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 649                         "before the security server is initialized\n");
 650                 goto out;
 651         }
 652         if (kern_flags && !set_kern_flags) {
 653                 /* Specifying internal flags without providing a place to
 654                  * place the results is not allowed */
 655                 rc = -EINVAL;
 656                 goto out;
 657         }
 658
 659         /*
 660          * Binary mount data FS will come through this function twice.  Once
 661          * from an explicit call and once from the generic calls from the vfs.
 662          * Since the generic VFS calls will not contain any security mount data
 663          * we need to skip the double mount verification.
 664          *
 665          * This does open a hole in which we will not notice if the first
 666          * mount using this sb set explict options and a second mount using
 667          * this sb does not set any security options.  (The first options
 668          * will be used for both mounts)
 669          */
 670         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 671             && (num_opts == 0))
 672                 goto out;
 673
 674         /*
 675          * parse the mount options, check if they are valid sids.
 676          * also check if someone is trying to mount the same sb more
 677          * than once with different security options.
 678          */
 679         for (i = 0; i < num_opts; i++) {
 680                 u32 sid;
 681
 682                 if (flags[i] == SBLABEL_MNT)
 683                         continue;
 684                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 685                 if (rc) {
 686                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 687                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 688                                mount_options[i], sb->s_id, name, rc);
 689                         goto out;
 690                 }
 691                 switch (flags[i]) {
 692                 case FSCONTEXT_MNT:
 693                         fscontext_sid = sid;
 694
 695                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 696                                         fscontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= FSCONTEXT_MNT;
 700                         break;
 701                 case CONTEXT_MNT:
 702                         context_sid = sid;
 703
 704                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 705                                         context_sid))
 706                                 goto out_double_mount;
 707
 708                         sbsec->flags |= CONTEXT_MNT;
 709                         break;
 710                 case ROOTCONTEXT_MNT:
 711                         rootcontext_sid = sid;
 712
 713                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 714                                         rootcontext_sid))
 715                                 goto out_double_mount;
 716
 717                         sbsec->flags |= ROOTCONTEXT_MNT;
 718
 719                         break;
 720                 case DEFCONTEXT_MNT:
 721                         defcontext_sid = sid;
 722
 723                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 724                                         defcontext_sid))
 725                                 goto out_double_mount;
 726
 727                         sbsec->flags |= DEFCONTEXT_MNT;
 728
 729                         break;
 730                 default:
 731                         rc = -EINVAL;
 732                         goto out;
 733                 }
 734         }
 735
 736         if (sbsec->flags & SE_SBINITIALIZED) {
 737                 /* previously mounted with options, but not on this attempt? */
 738                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 739                         goto out_double_mount;
 740                 rc = 0;
 741                 goto out;
 742         }
 743
 744         if (strcmp(sb->s_type->name, "proc") == 0)
 745                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 746
 747         if (!strcmp(sb->s_type->name, "debugfs") ||
 748             !strcmp(sb->s_type->name, "sysfs") ||
 749             !strcmp(sb->s_type->name, "pstore"))
 750                 sbsec->flags |= SE_SBGENFS;
 751
 752         if (!sbsec->behavior) {
 753                 /*
 754                  * Determine the labeling behavior to use for this
 755                  * filesystem type.
 756                  */
 757                 rc = security_fs_use(sb);
 758                 if (rc) {
 759                         printk(KERN_WARNING
 760                                 "%s: security_fs_use(%s) returned %d\n",
 761                                         __func__, sb->s_type->name, rc);
 762                         goto out;
 763                 }
 764         }
 765         /* sets the context of the superblock for the fs being mounted. */
 766         if (fscontext_sid) {
 767                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 768                 if (rc)
 769                         goto out;
 770
 771                 sbsec->sid = fscontext_sid;
 772         }
 773
 774         /*
 775          * Switch to using mount point labeling behavior.
 776          * sets the label used on all file below the mountpoint, and will set
 777          * the superblock context if not already set.
 778          */
 779         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 780                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 781                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 782         }
 783
 784         if (context_sid) {
 785                 if (!fscontext_sid) {
 786                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 787                                                           cred);
 788                         if (rc)
 789                                 goto out;
 790                         sbsec->sid = context_sid;
 791                 } else {
 792                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 793                                                              cred);
 794                         if (rc)
 795                                 goto out;
 796                 }
 797                 if (!rootcontext_sid)
 798                         rootcontext_sid = context_sid;
 799
 800                 sbsec->mntpoint_sid = context_sid;
 801                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 802         }
 803
 804         if (rootcontext_sid) {
 805                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 806                                                      cred);
 807                 if (rc)
 808                         goto out;
 809
 810                 root_isec->sid = rootcontext_sid;
 811                 root_isec->initialized = 1;
 812         }
 813
 814         if (defcontext_sid) {
 815                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 816                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 817                         rc = -EINVAL;
 818                         printk(KERN_WARNING "SELinux: defcontext option is "
 819                                "invalid for this filesystem type\n");
 820                         goto out;
 821                 }
 822
 823                 if (defcontext_sid != sbsec->def_sid) {
 824                         rc = may_context_mount_inode_relabel(defcontext_sid,
 825                                                              sbsec, cred);
 826                         if (rc)
 827                                 goto out;
 828                 }
 829
 830                 sbsec->def_sid = defcontext_sid;
 831         }
 832
 833         rc = sb_finish_set_opts(sb);
 834 out:
 835         mutex_unlock(&sbsec->lock);
 836         return rc;
 837 out_double_mount:
 838         rc = -EINVAL;
 839         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 840                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 841         goto out;
 842 }
 843
 844 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 845                                     const struct super_block *newsb)
 846 {
 847         struct superblock_security_struct *old = oldsb->s_security;
 848         struct superblock_security_struct *new = newsb->s_security;
 849         char oldflags = old->flags & SE_MNTMASK;
 850         char newflags = new->flags & SE_MNTMASK;
 851
 852         if (oldflags != newflags)
 853                 goto mismatch;
 854         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 855                 goto mismatch;
 856         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 857                 goto mismatch;
 858         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 859                 goto mismatch;
 860         if (oldflags & ROOTCONTEXT_MNT) {
 861                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 862                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 863                 if (oldroot->sid != newroot->sid)
 864                         goto mismatch;
 865         }
 866         return 0;
 867 mismatch:
 868         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 869                             "different security settings for (dev %s, "
 870                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 871         return -EBUSY;
 872 }
 873
 874 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 875                                         struct super_block *newsb)
 876 {
 877         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 878         struct superblock_security_struct *newsbsec = newsb->s_security;
 879
 880         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 881         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 882         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 883
 884         /*
 885          * if the parent was able to be mounted it clearly had no special lsm
 886          * mount options.  thus we can safely deal with this superblock later
 887          */
 888         if (!ss_initialized)
 889                 return 0;
 890
 891         /* how can we clone if the old one wasn't set up?? */
 892         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 893
 894         /* if fs is reusing a sb, make sure that the contexts match */
 895         if (newsbsec->flags & SE_SBINITIALIZED)
 896                 return selinux_cmp_sb_context(oldsb, newsb);
 897
 898         mutex_lock(&newsbsec->lock);
 899
 900         newsbsec->flags = oldsbsec->flags;
 901
 902         newsbsec->sid = oldsbsec->sid;
 903         newsbsec->def_sid = oldsbsec->def_sid;
 904         newsbsec->behavior = oldsbsec->behavior;
 905
 906         if (set_context) {
 907                 u32 sid = oldsbsec->mntpoint_sid;
 908
 909                 if (!set_fscontext)
 910                         newsbsec->sid = sid;
 911                 if (!set_rootcontext) {
 912                         struct inode *newinode = d_backing_inode(newsb->s_root);
 913                         struct inode_security_struct *newisec = newinode->i_security;
 914                         newisec->sid = sid;
 915                 }
 916                 newsbsec->mntpoint_sid = sid;
 917         }
 918         if (set_rootcontext) {
 919                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 920                 const struct inode_security_struct *oldisec = oldinode->i_security;
 921                 struct inode *newinode = d_backing_inode(newsb->s_root);
 922                 struct inode_security_struct *newisec = newinode->i_security;
 923
 924                 newisec->sid = oldisec->sid;
 925         }
 926
 927         sb_finish_set_opts(newsb);
 928         mutex_unlock(&newsbsec->lock);
 929         return 0;
 930 }
 931
 932 static int selinux_parse_opts_str(char *options,
 933                                   struct security_mnt_opts *opts)
 934 {
 935         char *p;
 936         char *context = NULL, *defcontext = NULL;
 937         char *fscontext = NULL, *rootcontext = NULL;
 938         int rc, num_mnt_opts = 0;
 939
 940         opts->num_mnt_opts = 0;
 941
 942         /* Standard string-based options. */
 943         while ((p = strsep(&options, "|")) != NULL) {
 944                 int token;
 945                 substring_t args[MAX_OPT_ARGS];
 946
 947                 if (!*p)
 948                         continue;
 949
 950                 token = match_token(p, tokens, args);
 951
 952                 switch (token) {
 953                 case Opt_context:
 954                         if (context || defcontext) {
 955                                 rc = -EINVAL;
 956                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 957                                 goto out_err;
 958                         }
 959                         context = match_strdup(&args[0]);
 960                         if (!context) {
 961                                 rc = -ENOMEM;
 962                                 goto out_err;
 963                         }
 964                         break;
 965
 966                 case Opt_fscontext:
 967                         if (fscontext) {
 968                                 rc = -EINVAL;
 969                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 970                                 goto out_err;
 971                         }
 972                         fscontext = match_strdup(&args[0]);
 973                         if (!fscontext) {
 974                                 rc = -ENOMEM;
 975                                 goto out_err;
 976                         }
 977                         break;
 978
 979                 case Opt_rootcontext:
 980                         if (rootcontext) {
 981                                 rc = -EINVAL;
 982                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 983                                 goto out_err;
 984                         }
 985                         rootcontext = match_strdup(&args[0]);
 986                         if (!rootcontext) {
 987                                 rc = -ENOMEM;
 988                                 goto out_err;
 989                         }
 990                         break;
 991
 992                 case Opt_defcontext:
 993                         if (context || defcontext) {
 994                                 rc = -EINVAL;
 995                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 996                                 goto out_err;
 997                         }
 998                         defcontext = match_strdup(&args[0]);
 999                         if (!defcontext) {
1000                                 rc = -ENOMEM;
1001                                 goto out_err;
1002                         }
1003                         break;
1004                 case Opt_labelsupport:
1005                         break;
1006                 default:
1007                         rc = -EINVAL;
1008                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1009                         goto out_err;
1010
1011                 }
1012         }
1013
1014         rc = -ENOMEM;
1015         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1016         if (!opts->mnt_opts)
1017                 goto out_err;
1018
1019         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1020         if (!opts->mnt_opts_flags) {
1021                 kfree(opts->mnt_opts);
1022                 goto out_err;
1023         }
1024
1025         if (fscontext) {
1026                 opts->mnt_opts[num_mnt_opts] = fscontext;
1027                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1028         }
1029         if (context) {
1030                 opts->mnt_opts[num_mnt_opts] = context;
1031                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1032         }
1033         if (rootcontext) {
1034                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1035                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1036         }
1037         if (defcontext) {
1038                 opts->mnt_opts[num_mnt_opts] = defcontext;
1039                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1040         }
1041
1042         opts->num_mnt_opts = num_mnt_opts;
1043         return 0;
1044
1045 out_err:
1046         kfree(context);
1047         kfree(defcontext);
1048         kfree(fscontext);
1049         kfree(rootcontext);
1050         return rc;
1051 }
1052 /*
1053  * string mount options parsing and call set the sbsec
1054  */
1055 static int superblock_doinit(struct super_block *sb, void *data)
1056 {
1057         int rc = 0;
1058         char *options = data;
1059         struct security_mnt_opts opts;
1060
1061         security_init_mnt_opts(&opts);
1062
1063         if (!data)
1064                 goto out;
1065
1066         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1067
1068         rc = selinux_parse_opts_str(options, &opts);
1069         if (rc)
1070                 goto out_err;
1071
1072 out:
1073         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1074
1075 out_err:
1076         security_free_mnt_opts(&opts);
1077         return rc;
1078 }
1079
1080 static void selinux_write_opts(struct seq_file *m,
1081                                struct security_mnt_opts *opts)
1082 {
1083         int i;
1084         char *prefix;
1085
1086         for (i = 0; i < opts->num_mnt_opts; i++) {
1087                 char *has_comma;
1088
1089                 if (opts->mnt_opts[i])
1090                         has_comma = strchr(opts->mnt_opts[i], ',');
1091                 else
1092                         has_comma = NULL;
1093
1094                 switch (opts->mnt_opts_flags[i]) {
1095                 case CONTEXT_MNT:
1096                         prefix = CONTEXT_STR;
1097                         break;
1098                 case FSCONTEXT_MNT:
1099                         prefix = FSCONTEXT_STR;
1100                         break;
1101                 case ROOTCONTEXT_MNT:
1102                         prefix = ROOTCONTEXT_STR;
1103                         break;
1104                 case DEFCONTEXT_MNT:
1105                         prefix = DEFCONTEXT_STR;
1106                         break;
1107                 case SBLABEL_MNT:
1108                         seq_putc(m, ',');
1109                         seq_puts(m, LABELSUPP_STR);
1110                         continue;
1111                 default:
1112                         BUG();
1113                         return;
1114                 };
1115                 /* we need a comma before each option */
1116                 seq_putc(m, ',');
1117                 seq_puts(m, prefix);
1118                 if (has_comma)
1119                         seq_putc(m, '\"');
1120                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1121                 if (has_comma)
1122                         seq_putc(m, '\"');
1123         }
1124 }
1125
1126 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1127 {
1128         struct security_mnt_opts opts;
1129         int rc;
1130
1131         rc = selinux_get_mnt_opts(sb, &opts);
1132         if (rc) {
1133                 /* before policy load we may get EINVAL, don't show anything */
1134                 if (rc == -EINVAL)
1135                         rc = 0;
1136                 return rc;
1137         }
1138
1139         selinux_write_opts(m, &opts);
1140
1141         security_free_mnt_opts(&opts);
1142
1143         return rc;
1144 }
1145
1146 static inline u16 inode_mode_to_security_class(umode_t mode)
1147 {
1148         switch (mode & S_IFMT) {
1149         case S_IFSOCK:
1150                 return SECCLASS_SOCK_FILE;
1151         case S_IFLNK:
1152                 return SECCLASS_LNK_FILE;
1153         case S_IFREG:
1154                 return SECCLASS_FILE;
1155         case S_IFBLK:
1156                 return SECCLASS_BLK_FILE;
1157         case S_IFDIR:
1158                 return SECCLASS_DIR;
1159         case S_IFCHR:
1160                 return SECCLASS_CHR_FILE;
1161         case S_IFIFO:
1162                 return SECCLASS_FIFO_FILE;
1163
1164         }
1165
1166         return SECCLASS_FILE;
1167 }
1168
1169 static inline int default_protocol_stream(int protocol)
1170 {
1171         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1172 }
1173
1174 static inline int default_protocol_dgram(int protocol)
1175 {
1176         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1177 }
1178
1179 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1180 {
1181         switch (family) {
1182         case PF_UNIX:
1183                 switch (type) {
1184                 case SOCK_STREAM:
1185                 case SOCK_SEQPACKET:
1186                         return SECCLASS_UNIX_STREAM_SOCKET;
1187                 case SOCK_DGRAM:
1188                         return SECCLASS_UNIX_DGRAM_SOCKET;
1189                 }
1190                 break;
1191         case PF_INET:
1192         case PF_INET6:
1193                 switch (type) {
1194                 case SOCK_STREAM:
1195                         if (default_protocol_stream(protocol))
1196                                 return SECCLASS_TCP_SOCKET;
1197                         else
1198                                 return SECCLASS_RAWIP_SOCKET;
1199                 case SOCK_DGRAM:
1200                         if (default_protocol_dgram(protocol))
1201                                 return SECCLASS_UDP_SOCKET;
1202                         else
1203                                 return SECCLASS_RAWIP_SOCKET;
1204                 case SOCK_DCCP:
1205                         return SECCLASS_DCCP_SOCKET;
1206                 default:
1207                         return SECCLASS_RAWIP_SOCKET;
1208                 }
1209                 break;
1210         case PF_NETLINK:
1211                 switch (protocol) {
1212                 case NETLINK_ROUTE:
1213                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1214                 case NETLINK_SOCK_DIAG:
1215                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1216                 case NETLINK_NFLOG:
1217                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1218                 case NETLINK_XFRM:
1219                         return SECCLASS_NETLINK_XFRM_SOCKET;
1220                 case NETLINK_SELINUX:
1221                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1222                 case NETLINK_ISCSI:
1223                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1224                 case NETLINK_AUDIT:
1225                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1226                 case NETLINK_FIB_LOOKUP:
1227                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1228                 case NETLINK_CONNECTOR:
1229                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1230                 case NETLINK_NETFILTER:
1231                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1232                 case NETLINK_DNRTMSG:
1233                         return SECCLASS_NETLINK_DNRT_SOCKET;
1234                 case NETLINK_KOBJECT_UEVENT:
1235                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1236                 case NETLINK_GENERIC:
1237                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1238                 case NETLINK_SCSITRANSPORT:
1239                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1240                 case NETLINK_RDMA:
1241                         return SECCLASS_NETLINK_RDMA_SOCKET;
1242                 case NETLINK_CRYPTO:
1243                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1244                 default:
1245                         return SECCLASS_NETLINK_SOCKET;
1246                 }
1247         case PF_PACKET:
1248                 return SECCLASS_PACKET_SOCKET;
1249         case PF_KEY:
1250                 return SECCLASS_KEY_SOCKET;
1251         case PF_APPLETALK:
1252                 return SECCLASS_APPLETALK_SOCKET;
1253         }
1254
1255         return SECCLASS_SOCKET;
1256 }
1257
1258 static int selinux_genfs_get_sid(struct dentry *dentry,
1259                                  u16 tclass,
1260                                  u16 flags,
1261                                  u32 *sid)
1262 {
1263         int rc;
1264         struct super_block *sb = dentry->d_inode->i_sb;
1265         char *buffer, *path;
1266
1267         buffer = (char *)__get_free_page(GFP_KERNEL);
1268         if (!buffer)
1269                 return -ENOMEM;
1270
1271         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1272         if (IS_ERR(path))
1273                 rc = PTR_ERR(path);
1274         else {
1275                 if (flags & SE_SBPROC) {
1276                         /* each process gets a /proc/PID/ entry. Strip off the
1277                          * PID part to get a valid selinux labeling.
1278                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1279                         while (path[1] >= '0' && path[1] <= '9') {
1280                                 path[1] = '/';
1281                                 path++;
1282                         }
1283                 }
1284                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1285         }
1286         free_page((unsigned long)buffer);
1287         return rc;
1288 }
1289
1290 /* The inode's security attributes must be initialized before first use. */
1291 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1292 {
1293         struct superblock_security_struct *sbsec = NULL;
1294         struct inode_security_struct *isec = inode->i_security;
1295         u32 sid;
1296         struct dentry *dentry;
1297 #define INITCONTEXTLEN 255
1298         char *context = NULL;
1299         unsigned len = 0;
1300         int rc = 0;
1301
1302         if (isec->initialized)
1303                 goto out;
1304
1305         mutex_lock(&isec->lock);
1306         if (isec->initialized)
1307                 goto out_unlock;
1308
1309         sbsec = inode->i_sb->s_security;
1310         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1311                 /* Defer initialization until selinux_complete_init,
1312                    after the initial policy is loaded and the security
1313                    server is ready to handle calls. */
1314                 spin_lock(&sbsec->isec_lock);
1315                 if (list_empty(&isec->list))
1316                         list_add(&isec->list, &sbsec->isec_head);
1317                 spin_unlock(&sbsec->isec_lock);
1318                 goto out_unlock;
1319         }
1320
1321         switch (sbsec->behavior) {
1322         case SECURITY_FS_USE_NATIVE:
1323                 break;
1324         case SECURITY_FS_USE_XATTR:
1325                 if (!inode->i_op->getxattr) {
1326                         isec->sid = sbsec->def_sid;
1327                         break;
1328                 }
1329
1330                 /* Need a dentry, since the xattr API requires one.
1331                    Life would be simpler if we could just pass the inode. */
1332                 if (opt_dentry) {
1333                         /* Called from d_instantiate or d_splice_alias. */
1334                         dentry = dget(opt_dentry);
1335                 } else {
1336                         /* Called from selinux_complete_init, try to find a dentry. */
1337                         dentry = d_find_alias(inode);
1338                 }
1339                 if (!dentry) {
1340                         /*
1341                          * this is can be hit on boot when a file is accessed
1342                          * before the policy is loaded.  When we load policy we
1343                          * may find inodes that have no dentry on the
1344                          * sbsec->isec_head list.  No reason to complain as these
1345                          * will get fixed up the next time we go through
1346                          * inode_doinit with a dentry, before these inodes could
1347                          * be used again by userspace.
1348                          */
1349                         goto out_unlock;
1350                 }
1351
1352                 len = INITCONTEXTLEN;
1353                 context = kmalloc(len+1, GFP_NOFS);
1354                 if (!context) {
1355                         rc = -ENOMEM;
1356                         dput(dentry);
1357                         goto out_unlock;
1358                 }
1359                 context[len] = '\0';
1360                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361                                            context, len);
1362                 if (rc == -ERANGE) {
1363                         kfree(context);
1364
1365                         /* Need a larger buffer.  Query for the right size. */
1366                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1367                                                    NULL, 0);
1368                         if (rc < 0) {
1369                                 dput(dentry);
1370                                 goto out_unlock;
1371                         }
1372                         len = rc;
1373                         context = kmalloc(len+1, GFP_NOFS);
1374                         if (!context) {
1375                                 rc = -ENOMEM;
1376                                 dput(dentry);
1377                                 goto out_unlock;
1378                         }
1379                         context[len] = '\0';
1380                         rc = inode->i_op->getxattr(dentry,
1381                                                    XATTR_NAME_SELINUX,
1382                                                    context, len);
1383                 }
1384                 dput(dentry);
1385                 if (rc < 0) {
1386                         if (rc != -ENODATA) {
1387                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1388                                        "%d for dev=%s ino=%ld\n", __func__,
1389                                        -rc, inode->i_sb->s_id, inode->i_ino);
1390                                 kfree(context);
1391                                 goto out_unlock;
1392                         }
1393                         /* Map ENODATA to the default file SID */
1394                         sid = sbsec->def_sid;
1395                         rc = 0;
1396                 } else {
1397                         rc = security_context_to_sid_default(context, rc, &sid,
1398                                                              sbsec->def_sid,
1399                                                              GFP_NOFS);
1400                         if (rc) {
1401                                 char *dev = inode->i_sb->s_id;
1402                                 unsigned long ino = inode->i_ino;
1403
1404                                 if (rc == -EINVAL) {
1405                                         if (printk_ratelimit())
1406                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1407                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1408                                                         "filesystem in question.\n", ino, dev, context);
1409                                 } else {
1410                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1411                                                "returned %d for dev=%s ino=%ld\n",
1412                                                __func__, context, -rc, dev, ino);
1413                                 }
1414                                 kfree(context);
1415                                 /* Leave with the unlabeled SID */
1416                                 rc = 0;
1417                                 break;
1418                         }
1419                 }
1420                 kfree(context);
1421                 isec->sid = sid;
1422                 break;
1423         case SECURITY_FS_USE_TASK:
1424                 isec->sid = isec->task_sid;
1425                 break;
1426         case SECURITY_FS_USE_TRANS:
1427                 /* Default to the fs SID. */
1428                 isec->sid = sbsec->sid;
1429
1430                 /* Try to obtain a transition SID. */
1431                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1432                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1433                                              isec->sclass, NULL, &sid);
1434                 if (rc)
1435                         goto out_unlock;
1436                 isec->sid = sid;
1437                 break;
1438         case SECURITY_FS_USE_MNTPOINT:
1439                 isec->sid = sbsec->mntpoint_sid;
1440                 break;
1441         default:
1442                 /* Default to the fs superblock SID. */
1443                 isec->sid = sbsec->sid;
1444
1445                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1446                         /* We must have a dentry to determine the label on
1447                          * procfs inodes */
1448                         if (opt_dentry)
1449                                 /* Called from d_instantiate or
1450                                  * d_splice_alias. */
1451                                 dentry = dget(opt_dentry);
1452                         else
1453                                 /* Called from selinux_complete_init, try to
1454                                  * find a dentry. */
1455                                 dentry = d_find_alias(inode);
1456                         /*
1457                          * This can be hit on boot when a file is accessed
1458                          * before the policy is loaded.  When we load policy we
1459                          * may find inodes that have no dentry on the
1460                          * sbsec->isec_head list.  No reason to complain as
1461                          * these will get fixed up the next time we go through
1462                          * inode_doinit() with a dentry, before these inodes
1463                          * could be used again by userspace.
1464                          */
1465                         if (!dentry)
1466                                 goto out_unlock;
1467                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1468                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1469                                                    sbsec->flags, &sid);
1470                         dput(dentry);
1471                         if (rc)
1472                                 goto out_unlock;
1473                         isec->sid = sid;
1474                 }
1475                 break;
1476         }
1477
1478         isec->initialized = 1;
1479
1480 out_unlock:
1481         mutex_unlock(&isec->lock);
1482 out:
1483         if (isec->sclass == SECCLASS_FILE)
1484                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1485         return rc;
1486 }
1487
1488 /* Convert a Linux signal to an access vector. */
1489 static inline u32 signal_to_av(int sig)
1490 {
1491         u32 perm = 0;
1492
1493         switch (sig) {
1494         case SIGCHLD:
1495                 /* Commonly granted from child to parent. */
1496                 perm = PROCESS__SIGCHLD;
1497                 break;
1498         case SIGKILL:
1499                 /* Cannot be caught or ignored */
1500                 perm = PROCESS__SIGKILL;
1501                 break;
1502         case SIGSTOP:
1503                 /* Cannot be caught or ignored */
1504                 perm = PROCESS__SIGSTOP;
1505                 break;
1506         default:
1507                 /* All other signals. */
1508                 perm = PROCESS__SIGNAL;
1509                 break;
1510         }
1511
1512         return perm;
1513 }
1514
1515 /*
1516  * Check permission between a pair of credentials
1517  * fork check, ptrace check, etc.
1518  */
1519 static int cred_has_perm(const struct cred *actor,
1520                          const struct cred *target,
1521                          u32 perms)
1522 {
1523         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1524
1525         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1526 }
1527
1528 /*
1529  * Check permission between a pair of tasks, e.g. signal checks,
1530  * fork check, ptrace check, etc.
1531  * tsk1 is the actor and tsk2 is the target
1532  * - this uses the default subjective creds of tsk1
1533  */
1534 static int task_has_perm(const struct task_struct *tsk1,
1535                          const struct task_struct *tsk2,
1536                          u32 perms)
1537 {
1538         const struct task_security_struct *__tsec1, *__tsec2;
1539         u32 sid1, sid2;
1540
1541         rcu_read_lock();
1542         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1543         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1544         rcu_read_unlock();
1545         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1546 }
1547
1548 /*
1549  * Check permission between current and another task, e.g. signal checks,
1550  * fork check, ptrace check, etc.
1551  * current is the actor and tsk2 is the target
1552  * - this uses current's subjective creds
1553  */
1554 static int current_has_perm(const struct task_struct *tsk,
1555                             u32 perms)
1556 {
1557         u32 sid, tsid;
1558
1559         sid = current_sid();
1560         tsid = task_sid(tsk);
1561         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1562 }
1563
1564 #if CAP_LAST_CAP > 63
1565 #error Fix SELinux to handle capabilities > 63.
1566 #endif
1567
1568 /* Check whether a task is allowed to use a capability. */
1569 static int cred_has_capability(const struct cred *cred,
1570                                int cap, int audit)
1571 {
1572         struct common_audit_data ad;
1573         struct av_decision avd;
1574         u16 sclass;
1575         u32 sid = cred_sid(cred);
1576         u32 av = CAP_TO_MASK(cap);
1577         int rc;
1578
1579         ad.type = LSM_AUDIT_DATA_CAP;
1580         ad.u.cap = cap;
1581
1582         switch (CAP_TO_INDEX(cap)) {
1583         case 0:
1584                 sclass = SECCLASS_CAPABILITY;
1585                 break;
1586         case 1:
1587                 sclass = SECCLASS_CAPABILITY2;
1588                 break;
1589         default:
1590                 printk(KERN_ERR
1591                        "SELinux:  out of range capability %d\n", cap);
1592                 BUG();
1593                 return -EINVAL;
1594         }
1595
1596         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1597         if (audit == SECURITY_CAP_AUDIT) {
1598                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1599                 if (rc2)
1600                         return rc2;
1601         }
1602         return rc;
1603 }
1604
1605 /* Check whether a task is allowed to use a system operation. */
1606 static int task_has_system(struct task_struct *tsk,
1607                            u32 perms)
1608 {
1609         u32 sid = task_sid(tsk);
1610
1611         return avc_has_perm(sid, SECINITSID_KERNEL,
1612                             SECCLASS_SYSTEM, perms, NULL);
1613 }
1614
1615 /* Check whether a task has a particular permission to an inode.
1616    The 'adp' parameter is optional and allows other audit
1617    data to be passed (e.g. the dentry). */
1618 static int inode_has_perm(const struct cred *cred,
1619                           struct inode *inode,
1620                           u32 perms,
1621                           struct common_audit_data *adp)
1622 {
1623         struct inode_security_struct *isec;
1624         u32 sid;
1625
1626         validate_creds(cred);
1627
1628         if (unlikely(IS_PRIVATE(inode)))
1629                 return 0;
1630
1631         sid = cred_sid(cred);
1632         isec = inode->i_security;
1633
1634         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1635 }
1636
1637 /* Same as inode_has_perm, but pass explicit audit data containing
1638    the dentry to help the auditing code to more easily generate the
1639    pathname if needed. */
1640 static inline int dentry_has_perm(const struct cred *cred,
1641                                   struct dentry *dentry,
1642                                   u32 av)
1643 {
1644         struct inode *inode = d_backing_inode(dentry);
1645         struct common_audit_data ad;
1646
1647         ad.type = LSM_AUDIT_DATA_DENTRY;
1648         ad.u.dentry = dentry;
1649         return inode_has_perm(cred, inode, av, &ad);
1650 }
1651
1652 /* Same as inode_has_perm, but pass explicit audit data containing
1653    the path to help the auditing code to more easily generate the
1654    pathname if needed. */
1655 static inline int path_has_perm(const struct cred *cred,
1656                                 const struct path *path,
1657                                 u32 av)
1658 {
1659         struct inode *inode = d_backing_inode(path->dentry);
1660         struct common_audit_data ad;
1661
1662         ad.type = LSM_AUDIT_DATA_PATH;
1663         ad.u.path = *path;
1664         return inode_has_perm(cred, inode, av, &ad);
1665 }
1666
1667 /* Same as path_has_perm, but uses the inode from the file struct. */
1668 static inline int file_path_has_perm(const struct cred *cred,
1669                                      struct file *file,
1670                                      u32 av)
1671 {
1672         struct common_audit_data ad;
1673
1674         ad.type = LSM_AUDIT_DATA_PATH;
1675         ad.u.path = file->f_path;
1676         return inode_has_perm(cred, file_inode(file), av, &ad);
1677 }
1678
1679 /* Check whether a task can use an open file descriptor to
1680    access an inode in a given way.  Check access to the
1681    descriptor itself, and then use dentry_has_perm to
1682    check a particular permission to the file.
1683    Access to the descriptor is implicitly granted if it
1684    has the same SID as the process.  If av is zero, then
1685    access to the file is not checked, e.g. for cases
1686    where only the descriptor is affected like seek. */
1687 static int file_has_perm(const struct cred *cred,
1688                          struct file *file,
1689                          u32 av)
1690 {
1691         struct file_security_struct *fsec = file->f_security;
1692         struct inode *inode = file_inode(file);
1693         struct common_audit_data ad;
1694         u32 sid = cred_sid(cred);
1695         int rc;
1696
1697         ad.type = LSM_AUDIT_DATA_PATH;
1698         ad.u.path = file->f_path;
1699
1700         if (sid != fsec->sid) {
1701                 rc = avc_has_perm(sid, fsec->sid,
1702                                   SECCLASS_FD,
1703                                   FD__USE,
1704                                   &ad);
1705                 if (rc)
1706                         goto out;
1707         }
1708
1709         /* av is zero if only checking access to the descriptor. */
1710         rc = 0;
1711         if (av)
1712                 rc = inode_has_perm(cred, inode, av, &ad);
1713
1714 out:
1715         return rc;
1716 }
1717
1718 /*
1719  * Determine the label for an inode that might be unioned.
1720  */
1721 static int selinux_determine_inode_label(const struct inode *dir,
1722                                          const struct qstr *name,
1723                                          u16 tclass,
1724                                          u32 *_new_isid)
1725 {
1726         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1727         const struct inode_security_struct *dsec = dir->i_security;
1728         const struct task_security_struct *tsec = current_security();
1729
1730         if ((sbsec->flags & SE_SBINITIALIZED) &&
1731             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1732                 *_new_isid = sbsec->mntpoint_sid;
1733         } else if ((sbsec->flags & SBLABEL_MNT) &&
1734                    tsec->create_sid) {
1735                 *_new_isid = tsec->create_sid;
1736         } else {
1737                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1738                                                name, _new_isid);
1739         }
1740
1741         return 0;
1742 }
1743
1744 /* Check whether a task can create a file. */
1745 static int may_create(struct inode *dir,
1746                       struct dentry *dentry,
1747                       u16 tclass)
1748 {
1749         const struct task_security_struct *tsec = current_security();
1750         struct inode_security_struct *dsec;
1751         struct superblock_security_struct *sbsec;
1752         u32 sid, newsid;
1753         struct common_audit_data ad;
1754         int rc;
1755
1756         dsec = dir->i_security;
1757         sbsec = dir->i_sb->s_security;
1758
1759         sid = tsec->sid;
1760
1761         ad.type = LSM_AUDIT_DATA_DENTRY;
1762         ad.u.dentry = dentry;
1763
1764         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1765                           DIR__ADD_NAME | DIR__SEARCH,
1766                           &ad);
1767         if (rc)
1768                 return rc;
1769
1770         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1771                                            &newsid);
1772         if (rc)
1773                 return rc;
1774
1775         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1776         if (rc)
1777                 return rc;
1778
1779         return avc_has_perm(newsid, sbsec->sid,
1780                             SECCLASS_FILESYSTEM,
1781                             FILESYSTEM__ASSOCIATE, &ad);
1782 }
1783
1784 /* Check whether a task can create a key. */
1785 static int may_create_key(u32 ksid,
1786                           struct task_struct *ctx)
1787 {
1788         u32 sid = task_sid(ctx);
1789
1790         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1791 }
1792
1793 #define MAY_LINK        0
1794 #define MAY_UNLINK      1
1795 #define MAY_RMDIR       2
1796
1797 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1798 static int may_link(struct inode *dir,
1799                     struct dentry *dentry,
1800                     int kind)
1801
1802 {
1803         struct inode_security_struct *dsec, *isec;
1804         struct common_audit_data ad;
1805         u32 sid = current_sid();
1806         u32 av;
1807         int rc;
1808
1809         dsec = dir->i_security;
1810         isec = d_backing_inode(dentry)->i_security;
1811
1812         ad.type = LSM_AUDIT_DATA_DENTRY;
1813         ad.u.dentry = dentry;
1814
1815         av = DIR__SEARCH;
1816         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1817         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1818         if (rc)
1819                 return rc;
1820
1821         switch (kind) {
1822         case MAY_LINK:
1823                 av = FILE__LINK;
1824                 break;
1825         case MAY_UNLINK:
1826                 av = FILE__UNLINK;
1827                 break;
1828         case MAY_RMDIR:
1829                 av = DIR__RMDIR;
1830                 break;
1831         default:
1832                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1833                         __func__, kind);
1834                 return 0;
1835         }
1836
1837         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1838         return rc;
1839 }
1840
1841 static inline int may_rename(struct inode *old_dir,
1842                              struct dentry *old_dentry,
1843                              struct inode *new_dir,
1844                              struct dentry *new_dentry)
1845 {
1846         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1847         struct common_audit_data ad;
1848         u32 sid = current_sid();
1849         u32 av;
1850         int old_is_dir, new_is_dir;
1851         int rc;
1852
1853         old_dsec = old_dir->i_security;
1854         old_isec = d_backing_inode(old_dentry)->i_security;
1855         old_is_dir = d_is_dir(old_dentry);
1856         new_dsec = new_dir->i_security;
1857
1858         ad.type = LSM_AUDIT_DATA_DENTRY;
1859
1860         ad.u.dentry = old_dentry;
1861         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1862                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1863         if (rc)
1864                 return rc;
1865         rc = avc_has_perm(sid, old_isec->sid,
1866                           old_isec->sclass, FILE__RENAME, &ad);
1867         if (rc)
1868                 return rc;
1869         if (old_is_dir && new_dir != old_dir) {
1870                 rc = avc_has_perm(sid, old_isec->sid,
1871                                   old_isec->sclass, DIR__REPARENT, &ad);
1872                 if (rc)
1873                         return rc;
1874         }
1875
1876         ad.u.dentry = new_dentry;
1877         av = DIR__ADD_NAME | DIR__SEARCH;
1878         if (d_is_positive(new_dentry))
1879                 av |= DIR__REMOVE_NAME;
1880         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1881         if (rc)
1882                 return rc;
1883         if (d_is_positive(new_dentry)) {
1884                 new_isec = d_backing_inode(new_dentry)->i_security;
1885                 new_is_dir = d_is_dir(new_dentry);
1886                 rc = avc_has_perm(sid, new_isec->sid,
1887                                   new_isec->sclass,
1888                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1889                 if (rc)
1890                         return rc;
1891         }
1892
1893         return 0;
1894 }
1895
1896 /* Check whether a task can perform a filesystem operation. */
1897 static int superblock_has_perm(const struct cred *cred,
1898                                struct super_block *sb,
1899                                u32 perms,
1900                                struct common_audit_data *ad)
1901 {
1902         struct superblock_security_struct *sbsec;
1903         u32 sid = cred_sid(cred);
1904
1905         sbsec = sb->s_security;
1906         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1907 }
1908
1909 /* Convert a Linux mode and permission mask to an access vector. */
1910 static inline u32 file_mask_to_av(int mode, int mask)
1911 {
1912         u32 av = 0;
1913
1914         if (!S_ISDIR(mode)) {
1915                 if (mask & MAY_EXEC)
1916                         av |= FILE__EXECUTE;
1917                 if (mask & MAY_READ)
1918                         av |= FILE__READ;
1919
1920                 if (mask & MAY_APPEND)
1921                         av |= FILE__APPEND;
1922                 else if (mask & MAY_WRITE)
1923                         av |= FILE__WRITE;
1924
1925         } else {
1926                 if (mask & MAY_EXEC)
1927                         av |= DIR__SEARCH;
1928                 if (mask & MAY_WRITE)
1929                         av |= DIR__WRITE;
1930                 if (mask & MAY_READ)
1931                         av |= DIR__READ;
1932         }
1933
1934         return av;
1935 }
1936
1937 /* Convert a Linux file to an access vector. */
1938 static inline u32 file_to_av(struct file *file)
1939 {
1940         u32 av = 0;
1941
1942         if (file->f_mode & FMODE_READ)
1943                 av |= FILE__READ;
1944         if (file->f_mode & FMODE_WRITE) {
1945                 if (file->f_flags & O_APPEND)
1946                         av |= FILE__APPEND;
1947                 else
1948                         av |= FILE__WRITE;
1949         }
1950         if (!av) {
1951                 /*
1952                  * Special file opened with flags 3 for ioctl-only use.
1953                  */
1954                 av = FILE__IOCTL;
1955         }
1956
1957         return av;
1958 }
1959
1960 /*
1961  * Convert a file to an access vector and include the correct open
1962  * open permission.
1963  */
1964 static inline u32 open_file_to_av(struct file *file)
1965 {
1966         u32 av = file_to_av(file);
1967         struct inode *inode = file_inode(file);
1968
1969         if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
1970                 av |= FILE__OPEN;
1971
1972         return av;
1973 }
1974
1975 /* Hook functions begin here. */
1976
1977 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1978 {
1979         u32 mysid = current_sid();
1980         u32 mgrsid = task_sid(mgr);
1981
1982         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1983                             BINDER__SET_CONTEXT_MGR, NULL);
1984 }
1985
1986 static int selinux_binder_transaction(struct task_struct *from,
1987                                       struct task_struct *to)
1988 {
1989         u32 mysid = current_sid();
1990         u32 fromsid = task_sid(from);
1991         u32 tosid = task_sid(to);
1992         int rc;
1993
1994         if (mysid != fromsid) {
1995                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1996                                   BINDER__IMPERSONATE, NULL);
1997                 if (rc)
1998                         return rc;
1999         }
2000
2001         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2002                             NULL);
2003 }
2004
2005 static int selinux_binder_transfer_binder(struct task_struct *from,
2006                                           struct task_struct *to)
2007 {
2008         u32 fromsid = task_sid(from);
2009         u32 tosid = task_sid(to);
2010
2011         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2012                             NULL);
2013 }
2014
2015 static int selinux_binder_transfer_file(struct task_struct *from,
2016                                         struct task_struct *to,
2017                                         struct file *file)
2018 {
2019         u32 sid = task_sid(to);
2020         struct file_security_struct *fsec = file->f_security;
2021         struct inode *inode = d_backing_inode(file->f_path.dentry);
2022         struct inode_security_struct *isec = inode->i_security;
2023         struct common_audit_data ad;
2024         int rc;
2025
2026         ad.type = LSM_AUDIT_DATA_PATH;
2027         ad.u.path = file->f_path;
2028
2029         if (sid != fsec->sid) {
2030                 rc = avc_has_perm(sid, fsec->sid,
2031                                   SECCLASS_FD,
2032                                   FD__USE,
2033                                   &ad);
2034                 if (rc)
2035                         return rc;
2036         }
2037
2038         if (unlikely(IS_PRIVATE(inode)))
2039                 return 0;
2040
2041         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2042                             &ad);
2043 }
2044
2045 static int selinux_ptrace_access_check(struct task_struct *child,
2046                                      unsigned int mode)
2047 {
2048         if (mode & PTRACE_MODE_READ) {
2049                 u32 sid = current_sid();
2050                 u32 csid = task_sid(child);
2051                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2052         }
2053
2054         return current_has_perm(child, PROCESS__PTRACE);
2055 }
2056
2057 static int selinux_ptrace_traceme(struct task_struct *parent)
2058 {
2059         return task_has_perm(parent, current, PROCESS__PTRACE);
2060 }
2061
2062 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2063                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2064 {
2065         return current_has_perm(target, PROCESS__GETCAP);
2066 }
2067
2068 static int selinux_capset(struct cred *new, const struct cred *old,
2069                           const kernel_cap_t *effective,
2070                           const kernel_cap_t *inheritable,
2071                           const kernel_cap_t *permitted)
2072 {
2073         return cred_has_perm(old, new, PROCESS__SETCAP);
2074 }
2075
2076 /*
2077  * (This comment used to live with the selinux_task_setuid hook,
2078  * which was removed).
2079  *
2080  * Since setuid only affects the current process, and since the SELinux
2081  * controls are not based on the Linux identity attributes, SELinux does not
2082  * need to control this operation.  However, SELinux does control the use of
2083  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2084  */
2085
2086 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2087                            int cap, int audit)
2088 {
2089         return cred_has_capability(cred, cap, audit);
2090 }
2091
2092 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2093 {
2094         const struct cred *cred = current_cred();
2095         int rc = 0;
2096
2097         if (!sb)
2098                 return 0;
2099
2100         switch (cmds) {
2101         case Q_SYNC:
2102         case Q_QUOTAON:
2103         case Q_QUOTAOFF:
2104         case Q_SETINFO:
2105         case Q_SETQUOTA:
2106                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2107                 break;
2108         case Q_GETFMT:
2109         case Q_GETINFO:
2110         case Q_GETQUOTA:
2111                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2112                 break;
2113         default:
2114                 rc = 0;  /* let the kernel handle invalid cmds */
2115                 break;
2116         }
2117         return rc;
2118 }
2119
2120 static int selinux_quota_on(struct dentry *dentry)
2121 {
2122         const struct cred *cred = current_cred();
2123
2124         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2125 }
2126
2127 static int selinux_syslog(int type)
2128 {
2129         int rc;
2130
2131         switch (type) {
2132         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2133         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2134                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2135                 break;
2136         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2137         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2138         /* Set level of messages printed to console */
2139         case SYSLOG_ACTION_CONSOLE_LEVEL:
2140                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2141                 break;
2142         case SYSLOG_ACTION_CLOSE:       /* Close log */
2143         case SYSLOG_ACTION_OPEN:        /* Open log */
2144         case SYSLOG_ACTION_READ:        /* Read from log */
2145         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2146         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2147         default:
2148                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2149                 break;
2150         }
2151         return rc;
2152 }
2153
2154 /*
2155  * Check that a process has enough memory to allocate a new virtual
2156  * mapping. 0 means there is enough memory for the allocation to
2157  * succeed and -ENOMEM implies there is not.
2158  *
2159  * Do not audit the selinux permission check, as this is applied to all
2160  * processes that allocate mappings.
2161  */
2162 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2163 {
2164         int rc, cap_sys_admin = 0;
2165
2166         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2167                                         SECURITY_CAP_NOAUDIT);
2168         if (rc == 0)
2169                 cap_sys_admin = 1;
2170
2171         return cap_sys_admin;
2172 }
2173
2174 /* binprm security operations */
2175
2176 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2177                             const struct task_security_struct *old_tsec,
2178                             const struct task_security_struct *new_tsec)
2179 {
2180         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2181         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2182         int rc;
2183
2184         if (!nnp && !nosuid)
2185                 return 0; /* neither NNP nor nosuid */
2186
2187         if (new_tsec->sid == old_tsec->sid)
2188                 return 0; /* No change in credentials */
2189
2190         /*
2191          * The only transitions we permit under NNP or nosuid
2192          * are transitions to bounded SIDs, i.e. SIDs that are
2193          * guaranteed to only be allowed a subset of the permissions
2194          * of the current SID.
2195          */
2196         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2197         if (rc) {
2198                 /*
2199                  * On failure, preserve the errno values for NNP vs nosuid.
2200                  * NNP:  Operation not permitted for caller.
2201                  * nosuid:  Permission denied to file.
2202                  */
2203                 if (nnp)
2204                         return -EPERM;
2205                 else
2206                         return -EACCES;
2207         }
2208         return 0;
2209 }
2210
2211 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2212 {
2213         const struct task_security_struct *old_tsec;
2214         struct task_security_struct *new_tsec;
2215         struct inode_security_struct *isec;
2216         struct common_audit_data ad;
2217         struct inode *inode = file_inode(bprm->file);
2218         int rc;
2219
2220         /* SELinux context only depends on initial program or script and not
2221          * the script interpreter */
2222         if (bprm->cred_prepared)
2223                 return 0;
2224
2225         old_tsec = current_security();
2226         new_tsec = bprm->cred->security;
2227         isec = inode->i_security;
2228
2229         /* Default to the current task SID. */
2230         new_tsec->sid = old_tsec->sid;
2231         new_tsec->osid = old_tsec->sid;
2232
2233         /* Reset fs, key, and sock SIDs on execve. */
2234         new_tsec->create_sid = 0;
2235         new_tsec->keycreate_sid = 0;
2236         new_tsec->sockcreate_sid = 0;
2237
2238         if (old_tsec->exec_sid) {
2239                 new_tsec->sid = old_tsec->exec_sid;
2240                 /* Reset exec SID on execve. */
2241                 new_tsec->exec_sid = 0;
2242
2243                 /* Fail on NNP or nosuid if not an allowed transition. */
2244                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2245                 if (rc)
2246                         return rc;
2247         } else {
2248                 /* Check for a default transition on this program. */
2249                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2250                                              SECCLASS_PROCESS, NULL,
2251                                              &new_tsec->sid);
2252                 if (rc)
2253                         return rc;
2254
2255                 /*
2256                  * Fallback to old SID on NNP or nosuid if not an allowed
2257                  * transition.
2258                  */
2259                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2260                 if (rc)
2261                         new_tsec->sid = old_tsec->sid;
2262         }
2263
2264         ad.type = LSM_AUDIT_DATA_PATH;
2265         ad.u.path = bprm->file->f_path;
2266
2267         if (new_tsec->sid == old_tsec->sid) {
2268                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2269                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2270                 if (rc)
2271                         return rc;
2272         } else {
2273                 /* Check permissions for the transition. */
2274                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2275                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2276                 if (rc)
2277                         return rc;
2278
2279                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2280                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2281                 if (rc)
2282                         return rc;
2283
2284                 /* Check for shared state */
2285                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2286                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2287                                           SECCLASS_PROCESS, PROCESS__SHARE,
2288                                           NULL);
2289                         if (rc)
2290                                 return -EPERM;
2291                 }
2292
2293                 /* Make sure that anyone attempting to ptrace over a task that
2294                  * changes its SID has the appropriate permit */
2295                 if (bprm->unsafe &
2296                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2297                         struct task_struct *tracer;
2298                         struct task_security_struct *sec;
2299                         u32 ptsid = 0;
2300
2301                         rcu_read_lock();
2302                         tracer = ptrace_parent(current);
2303                         if (likely(tracer != NULL)) {
2304                                 sec = __task_cred(tracer)->security;
2305                                 ptsid = sec->sid;
2306                         }
2307                         rcu_read_unlock();
2308
2309                         if (ptsid != 0) {
2310                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2311                                                   SECCLASS_PROCESS,
2312                                                   PROCESS__PTRACE, NULL);
2313                                 if (rc)
2314                                         return -EPERM;
2315                         }
2316                 }
2317
2318                 /* Clear any possibly unsafe personality bits on exec: */
2319                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2320         }
2321
2322         return 0;
2323 }
2324
2325 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2326 {
2327         const struct task_security_struct *tsec = current_security();
2328         u32 sid, osid;
2329         int atsecure = 0;
2330
2331         sid = tsec->sid;
2332         osid = tsec->osid;
2333
2334         if (osid != sid) {
2335                 /* Enable secure mode for SIDs transitions unless
2336                    the noatsecure permission is granted between
2337                    the two SIDs, i.e. ahp returns 0. */
2338                 atsecure = avc_has_perm(osid, sid,
2339                                         SECCLASS_PROCESS,
2340                                         PROCESS__NOATSECURE, NULL);
2341         }
2342
2343         return !!atsecure;
2344 }
2345
2346 static int match_file(const void *p, struct file *file, unsigned fd)
2347 {
2348         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2349 }
2350
2351 /* Derived from fs/exec.c:flush_old_files. */
2352 static inline void flush_unauthorized_files(const struct cred *cred,
2353                                             struct files_struct *files)
2354 {
2355         struct file *file, *devnull = NULL;
2356         struct tty_struct *tty;
2357         int drop_tty = 0;
2358         unsigned n;
2359
2360         tty = get_current_tty();
2361         if (tty) {
2362                 spin_lock(&tty_files_lock);
2363                 if (!list_empty(&tty->tty_files)) {
2364                         struct tty_file_private *file_priv;
2365
2366                         /* Revalidate access to controlling tty.
2367                            Use file_path_has_perm on the tty path directly
2368                            rather than using file_has_perm, as this particular
2369                            open file may belong to another process and we are
2370                            only interested in the inode-based check here. */
2371                         file_priv = list_first_entry(&tty->tty_files,
2372                                                 struct tty_file_private, list);
2373                         file = file_priv->file;
2374                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2375                                 drop_tty = 1;
2376                 }
2377                 spin_unlock(&tty_files_lock);
2378                 tty_kref_put(tty);
2379         }
2380         /* Reset controlling tty. */
2381         if (drop_tty)
2382                 no_tty();
2383
2384         /* Revalidate access to inherited open files. */
2385         n = iterate_fd(files, 0, match_file, cred);
2386         if (!n) /* none found? */
2387                 return;
2388
2389         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2390         if (IS_ERR(devnull))
2391                 devnull = NULL;
2392         /* replace all the matching ones with this */
2393         do {
2394                 replace_fd(n - 1, devnull, 0);
2395         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2396         if (devnull)
2397                 fput(devnull);
2398 }
2399
2400 /*
2401  * Prepare a process for imminent new credential changes due to exec
2402  */
2403 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2404 {
2405         struct task_security_struct *new_tsec;
2406         struct rlimit *rlim, *initrlim;
2407         int rc, i;
2408
2409         new_tsec = bprm->cred->security;
2410         if (new_tsec->sid == new_tsec->osid)
2411                 return;
2412
2413         /* Close files for which the new task SID is not authorized. */
2414         flush_unauthorized_files(bprm->cred, current->files);
2415
2416         /* Always clear parent death signal on SID transitions. */
2417         current->pdeath_signal = 0;
2418
2419         /* Check whether the new SID can inherit resource limits from the old
2420          * SID.  If not, reset all soft limits to the lower of the current
2421          * task's hard limit and the init task's soft limit.
2422          *
2423          * Note that the setting of hard limits (even to lower them) can be
2424          * controlled by the setrlimit check.  The inclusion of the init task's
2425          * soft limit into the computation is to avoid resetting soft limits
2426          * higher than the default soft limit for cases where the default is
2427          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2428          */
2429         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2430                           PROCESS__RLIMITINH, NULL);
2431         if (rc) {
2432                 /* protect against do_prlimit() */
2433                 task_lock(current);
2434                 for (i = 0; i < RLIM_NLIMITS; i++) {
2435                         rlim = current->signal->rlim + i;
2436                         initrlim = init_task.signal->rlim + i;
2437                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2438                 }
2439                 task_unlock(current);
2440                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2441         }
2442 }
2443
2444 /*
2445  * Clean up the process immediately after the installation of new credentials
2446  * due to exec
2447  */
2448 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2449 {
2450         const struct task_security_struct *tsec = current_security();
2451         struct itimerval itimer;
2452         u32 osid, sid;
2453         int rc, i;
2454
2455         osid = tsec->osid;
2456         sid = tsec->sid;
2457
2458         if (sid == osid)
2459                 return;
2460
2461         /* Check whether the new SID can inherit signal state from the old SID.
2462          * If not, clear itimers to avoid subsequent signal generation and
2463          * flush and unblock signals.
2464          *
2465          * This must occur _after_ the task SID has been updated so that any
2466          * kill done after the flush will be checked against the new SID.
2467          */
2468         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2469         if (rc) {
2470                 memset(&itimer, 0, sizeof itimer);
2471                 for (i = 0; i < 3; i++)
2472                         do_setitimer(i, &itimer, NULL);
2473                 spin_lock_irq(&current->sighand->siglock);
2474                 if (!fatal_signal_pending(current)) {
2475                         flush_sigqueue(&current->pending);
2476                         flush_sigqueue(&current->signal->shared_pending);
2477                         flush_signal_handlers(current, 1);
2478                         sigemptyset(&current->blocked);
2479                         recalc_sigpending();
2480                 }
2481                 spin_unlock_irq(&current->sighand->siglock);
2482         }
2483
2484         /* Wake up the parent if it is waiting so that it can recheck
2485          * wait permission to the new task SID. */
2486         read_lock(&tasklist_lock);
2487         __wake_up_parent(current, current->real_parent);
2488         read_unlock(&tasklist_lock);
2489 }
2490
2491 /* superblock security operations */
2492
2493 static int selinux_sb_alloc_security(struct super_block *sb)
2494 {
2495         return superblock_alloc_security(sb);
2496 }
2497
2498 static void selinux_sb_free_security(struct super_block *sb)
2499 {
2500         superblock_free_security(sb);
2501 }
2502
2503 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2504 {
2505         if (plen > olen)
2506                 return 0;
2507
2508         return !memcmp(prefix, option, plen);
2509 }
2510
2511 static inline int selinux_option(char *option, int len)
2512 {
2513         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2514                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2515                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2516                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2517                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2518 }
2519
2520 static inline void take_option(char **to, char *from, int *first, int len)
2521 {
2522         if (!*first) {
2523                 **to = ',';
2524                 *to += 1;
2525         } else
2526                 *first = 0;
2527         memcpy(*to, from, len);
2528         *to += len;
2529 }
2530
2531 static inline void take_selinux_option(char **to, char *from, int *first,
2532                                        int len)
2533 {
2534         int current_size = 0;
2535
2536         if (!*first) {
2537                 **to = '|';
2538                 *to += 1;
2539         } else
2540                 *first = 0;
2541
2542         while (current_size < len) {
2543                 if (*from != '"') {
2544                         **to = *from;
2545                         *to += 1;
2546                 }
2547                 from += 1;
2548                 current_size += 1;
2549         }
2550 }
2551
2552 static int selinux_sb_copy_data(char *orig, char *copy)
2553 {
2554         int fnosec, fsec, rc = 0;
2555         char *in_save, *in_curr, *in_end;
2556         char *sec_curr, *nosec_save, *nosec;
2557         int open_quote = 0;
2558
2559         in_curr = orig;
2560         sec_curr = copy;
2561
2562         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2563         if (!nosec) {
2564                 rc = -ENOMEM;
2565                 goto out;
2566         }
2567
2568         nosec_save = nosec;
2569         fnosec = fsec = 1;
2570         in_save = in_end = orig;
2571
2572         do {
2573                 if (*in_end == '"')
2574                         open_quote = !open_quote;
2575                 if ((*in_end == ',' && open_quote == 0) ||
2576                                 *in_end == '\0') {
2577                         int len = in_end - in_curr;
2578
2579                         if (selinux_option(in_curr, len))
2580                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2581                         else
2582                                 take_option(&nosec, in_curr, &fnosec, len);
2583
2584                         in_curr = in_end + 1;
2585                 }
2586         } while (*in_end++);
2587
2588         strcpy(in_save, nosec_save);
2589         free_page((unsigned long)nosec_save);
2590 out:
2591         return rc;
2592 }
2593
2594 static int selinux_sb_remount(struct super_block *sb, void *data)
2595 {
2596         int rc, i, *flags;
2597         struct security_mnt_opts opts;
2598         char *secdata, **mount_options;
2599         struct superblock_security_struct *sbsec = sb->s_security;
2600
2601         if (!(sbsec->flags & SE_SBINITIALIZED))
2602                 return 0;
2603
2604         if (!data)
2605                 return 0;
2606
2607         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2608                 return 0;
2609
2610         security_init_mnt_opts(&opts);
2611         secdata = alloc_secdata();
2612         if (!secdata)
2613                 return -ENOMEM;
2614         rc = selinux_sb_copy_data(data, secdata);
2615         if (rc)
2616                 goto out_free_secdata;
2617
2618         rc = selinux_parse_opts_str(secdata, &opts);
2619         if (rc)
2620                 goto out_free_secdata;
2621
2622         mount_options = opts.mnt_opts;
2623         flags = opts.mnt_opts_flags;
2624
2625         for (i = 0; i < opts.num_mnt_opts; i++) {
2626                 u32 sid;
2627
2628                 if (flags[i] == SBLABEL_MNT)
2629                         continue;
2630                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2631                 if (rc) {
2632                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2633                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2634                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2635                         goto out_free_opts;
2636                 }
2637                 rc = -EINVAL;
2638                 switch (flags[i]) {
2639                 case FSCONTEXT_MNT:
2640                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2641                                 goto out_bad_option;
2642                         break;
2643                 case CONTEXT_MNT:
2644                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2645                                 goto out_bad_option;
2646                         break;
2647                 case ROOTCONTEXT_MNT: {
2648                         struct inode_security_struct *root_isec;
2649                         root_isec = d_backing_inode(sb->s_root)->i_security;
2650
2651                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2652                                 goto out_bad_option;
2653                         break;
2654                 }
2655                 case DEFCONTEXT_MNT:
2656                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2657                                 goto out_bad_option;
2658                         break;
2659                 default:
2660                         goto out_free_opts;
2661                 }
2662         }
2663
2664         rc = 0;
2665 out_free_opts:
2666         security_free_mnt_opts(&opts);
2667 out_free_secdata:
2668         free_secdata(secdata);
2669         return rc;
2670 out_bad_option:
2671         printk(KERN_WARNING "SELinux: unable to change security options "
2672                "during remount (dev %s, type=%s)\n", sb->s_id,
2673                sb->s_type->name);
2674         goto out_free_opts;
2675 }
2676
2677 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2678 {
2679         const struct cred *cred = current_cred();
2680         struct common_audit_data ad;
2681         int rc;
2682
2683         rc = superblock_doinit(sb, data);
2684         if (rc)
2685                 return rc;
2686
2687         /* Allow all mounts performed by the kernel */
2688         if (flags & MS_KERNMOUNT)
2689                 return 0;
2690
2691         ad.type = LSM_AUDIT_DATA_DENTRY;
2692         ad.u.dentry = sb->s_root;
2693         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2694 }
2695
2696 static int selinux_sb_statfs(struct dentry *dentry)
2697 {
2698         const struct cred *cred = current_cred();
2699         struct common_audit_data ad;
2700
2701         ad.type = LSM_AUDIT_DATA_DENTRY;
2702         ad.u.dentry = dentry->d_sb->s_root;
2703         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2704 }
2705
2706 static int selinux_mount(const char *dev_name,
2707                          struct path *path,
2708                          const char *type,
2709                          unsigned long flags,
2710                          void *data)
2711 {
2712         const struct cred *cred = current_cred();
2713
2714         if (flags & MS_REMOUNT)
2715                 return superblock_has_perm(cred, path->dentry->d_sb,
2716                                            FILESYSTEM__REMOUNT, NULL);
2717         else
2718                 return path_has_perm(cred, path, FILE__MOUNTON);
2719 }
2720
2721 static int selinux_umount(struct vfsmount *mnt, int flags)
2722 {
2723         const struct cred *cred = current_cred();
2724
2725         return superblock_has_perm(cred, mnt->mnt_sb,
2726                                    FILESYSTEM__UNMOUNT, NULL);
2727 }
2728
2729 /* inode security operations */
2730
2731 static int selinux_inode_alloc_security(struct inode *inode)
2732 {
2733         return inode_alloc_security(inode);
2734 }
2735
2736 static void selinux_inode_free_security(struct inode *inode)
2737 {
2738         inode_free_security(inode);
2739 }
2740
2741 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2742                                         struct qstr *name, void **ctx,
2743                                         u32 *ctxlen)
2744 {
2745         u32 newsid;
2746         int rc;
2747
2748         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2749                                            inode_mode_to_security_class(mode),
2750                                            &newsid);
2751         if (rc)
2752                 return rc;
2753
2754         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2755 }
2756
2757 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758                                        const struct qstr *qstr,
2759                                        const char **name,
2760                                        void **value, size_t *len)
2761 {
2762         const struct task_security_struct *tsec = current_security();
2763         struct inode_security_struct *dsec;
2764         struct superblock_security_struct *sbsec;
2765         u32 sid, newsid, clen;
2766         int rc;
2767         char *context;
2768
2769         dsec = dir->i_security;
2770         sbsec = dir->i_sb->s_security;
2771
2772         sid = tsec->sid;
2773         newsid = tsec->create_sid;
2774
2775         rc = selinux_determine_inode_label(
2776                 dir, qstr,
2777                 inode_mode_to_security_class(inode->i_mode),
2778                 &newsid);
2779         if (rc)
2780                 return rc;
2781
2782         /* Possibly defer initialization to selinux_complete_init. */
2783         if (sbsec->flags & SE_SBINITIALIZED) {
2784                 struct inode_security_struct *isec = inode->i_security;
2785                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2786                 isec->sid = newsid;
2787                 isec->initialized = 1;
2788         }
2789
2790         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2791                 return -EOPNOTSUPP;
2792
2793         if (name)
2794                 *name = XATTR_SELINUX_SUFFIX;
2795
2796         if (value && len) {
2797                 rc = security_sid_to_context_force(newsid, &context, &clen);
2798                 if (rc)
2799                         return rc;
2800                 *value = context;
2801                 *len = clen;
2802         }
2803
2804         return 0;
2805 }
2806
2807 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2808 {
2809         return may_create(dir, dentry, SECCLASS_FILE);
2810 }
2811
2812 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2813 {
2814         return may_link(dir, old_dentry, MAY_LINK);
2815 }
2816
2817 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2818 {
2819         return may_link(dir, dentry, MAY_UNLINK);
2820 }
2821
2822 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2823 {
2824         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2825 }
2826
2827 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2828 {
2829         return may_create(dir, dentry, SECCLASS_DIR);
2830 }
2831
2832 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2833 {
2834         return may_link(dir, dentry, MAY_RMDIR);
2835 }
2836
2837 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2838 {
2839         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2840 }
2841
2842 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2843                                 struct inode *new_inode, struct dentry *new_dentry)
2844 {
2845         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2846 }
2847
2848 static int selinux_inode_readlink(struct dentry *dentry)
2849 {
2850         const struct cred *cred = current_cred();
2851
2852         return dentry_has_perm(cred, dentry, FILE__READ);
2853 }
2854
2855 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2856                                      bool rcu)
2857 {
2858         const struct cred *cred = current_cred();
2859         struct common_audit_data ad;
2860         struct inode_security_struct *isec;
2861         u32 sid;
2862
2863         validate_creds(cred);
2864
2865         ad.type = LSM_AUDIT_DATA_DENTRY;
2866         ad.u.dentry = dentry;
2867         sid = cred_sid(cred);
2868         isec = inode->i_security;
2869
2870         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2871                                   rcu ? MAY_NOT_BLOCK : 0);
2872 }
2873
2874 static noinline int audit_inode_permission(struct inode *inode,
2875                                            u32 perms, u32 audited, u32 denied,
2876                                            int result,
2877                                            unsigned flags)
2878 {
2879         struct common_audit_data ad;
2880         struct inode_security_struct *isec = inode->i_security;
2881         int rc;
2882
2883         ad.type = LSM_AUDIT_DATA_INODE;
2884         ad.u.inode = inode;
2885
2886         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2887                             audited, denied, result, &ad, flags);
2888         if (rc)
2889                 return rc;
2890         return 0;
2891 }
2892
2893 static int selinux_inode_permission(struct inode *inode, int mask)
2894 {
2895         const struct cred *cred = current_cred();
2896         u32 perms;
2897         bool from_access;
2898         unsigned flags = mask & MAY_NOT_BLOCK;
2899         struct inode_security_struct *isec;
2900         u32 sid;
2901         struct av_decision avd;
2902         int rc, rc2;
2903         u32 audited, denied;
2904
2905         from_access = mask & MAY_ACCESS;
2906         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2907
2908         /* No permission to check.  Existence test. */
2909         if (!mask)
2910                 return 0;
2911
2912         validate_creds(cred);
2913
2914         if (unlikely(IS_PRIVATE(inode)))
2915                 return 0;
2916
2917         perms = file_mask_to_av(inode->i_mode, mask);
2918
2919         sid = cred_sid(cred);
2920         isec = inode->i_security;
2921
2922         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2923         audited = avc_audit_required(perms, &avd, rc,
2924                                      from_access ? FILE__AUDIT_ACCESS : 0,
2925                                      &denied);
2926         if (likely(!audited))
2927                 return rc;
2928
2929         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2930         if (rc2)
2931                 return rc2;
2932         return rc;
2933 }
2934
2935 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2936 {
2937         const struct cred *cred = current_cred();
2938         struct inode *inode = d_backing_inode(dentry);
2939         unsigned int ia_valid = iattr->ia_valid;
2940         __u32 av = FILE__WRITE;
2941
2942         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2943         if (ia_valid & ATTR_FORCE) {
2944                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2945                               ATTR_FORCE);
2946                 if (!ia_valid)
2947                         return 0;
2948         }
2949
2950         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2951                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2952                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2953
2954         if (selinux_policycap_openperm &&
2955             inode->i_sb->s_magic != SOCKFS_MAGIC &&
2956             (ia_valid & ATTR_SIZE) &&
2957             !(ia_valid & ATTR_FILE))
2958                 av |= FILE__OPEN;
2959
2960         return dentry_has_perm(cred, dentry, av);
2961 }
2962
2963 static int selinux_inode_getattr(const struct path *path)
2964 {
2965         return path_has_perm(current_cred(), path, FILE__GETATTR);
2966 }
2967
2968 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2969 {
2970         const struct cred *cred = current_cred();
2971
2972         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2973                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2974                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2975                         if (!capable(CAP_SETFCAP))
2976                                 return -EPERM;
2977                 } else if (!capable(CAP_SYS_ADMIN)) {
2978                         /* A different attribute in the security namespace.
2979                            Restrict to administrator. */
2980                         return -EPERM;
2981                 }
2982         }
2983
2984         /* Not an attribute we recognize, so just check the
2985            ordinary setattr permission. */
2986         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2987 }
2988
2989 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2990                                   const void *value, size_t size, int flags)
2991 {
2992         struct inode *inode = d_backing_inode(dentry);
2993         struct inode_security_struct *isec = inode->i_security;
2994         struct superblock_security_struct *sbsec;
2995         struct common_audit_data ad;
2996         u32 newsid, sid = current_sid();
2997         int rc = 0;
2998
2999         if (strcmp(name, XATTR_NAME_SELINUX))
3000                 return selinux_inode_setotherxattr(dentry, name);
3001
3002         sbsec = inode->i_sb->s_security;
3003         if (!(sbsec->flags & SBLABEL_MNT))
3004                 return -EOPNOTSUPP;
3005
3006         if (!inode_owner_or_capable(inode))
3007                 return -EPERM;
3008
3009         ad.type = LSM_AUDIT_DATA_DENTRY;
3010         ad.u.dentry = dentry;
3011
3012         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3013                           FILE__RELABELFROM, &ad);
3014         if (rc)
3015                 return rc;
3016
3017         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3018         if (rc == -EINVAL) {
3019                 if (!capable(CAP_MAC_ADMIN)) {
3020                         struct audit_buffer *ab;
3021                         size_t audit_size;
3022                         const char *str;
3023
3024                         /* We strip a nul only if it is at the end, otherwise the
3025                          * context contains a nul and we should audit that */
3026                         if (value) {
3027                                 str = value;
3028                                 if (str[size - 1] == '\0')
3029                                         audit_size = size - 1;
3030                                 else
3031                                         audit_size = size;
3032                         } else {
3033                                 str = "";
3034                                 audit_size = 0;
3035                         }
3036                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3037                         audit_log_format(ab, "op=setxattr invalid_context=");
3038                         audit_log_n_untrustedstring(ab, value, audit_size);
3039                         audit_log_end(ab);
3040
3041                         return rc;
3042                 }
3043                 rc = security_context_to_sid_force(value, size, &newsid);
3044         }
3045         if (rc)
3046                 return rc;
3047
3048         rc = avc_has_perm(sid, newsid, isec->sclass,
3049                           FILE__RELABELTO, &ad);
3050         if (rc)
3051                 return rc;
3052
3053         rc = security_validate_transition(isec->sid, newsid, sid,
3054                                           isec->sclass);
3055         if (rc)
3056                 return rc;
3057
3058         return avc_has_perm(newsid,
3059                             sbsec->sid,
3060                             SECCLASS_FILESYSTEM,
3061                             FILESYSTEM__ASSOCIATE,
3062                             &ad);
3063 }
3064
3065 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3066                                         const void *value, size_t size,
3067                                         int flags)
3068 {
3069         struct inode *inode = d_backing_inode(dentry);
3070         struct inode_security_struct *isec = inode->i_security;
3071         u32 newsid;
3072         int rc;
3073
3074         if (strcmp(name, XATTR_NAME_SELINUX)) {
3075                 /* Not an attribute we recognize, so nothing to do. */
3076                 return;
3077         }
3078
3079         rc = security_context_to_sid_force(value, size, &newsid);
3080         if (rc) {
3081                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3082                        "for (%s, %lu), rc=%d\n",
3083                        inode->i_sb->s_id, inode->i_ino, -rc);
3084                 return;
3085         }
3086
3087         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3088         isec->sid = newsid;
3089         isec->initialized = 1;
3090
3091         return;
3092 }
3093
3094 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3095 {
3096         const struct cred *cred = current_cred();
3097
3098         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3099 }
3100
3101 static int selinux_inode_listxattr(struct dentry *dentry)
3102 {
3103         const struct cred *cred = current_cred();
3104
3105         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3106 }
3107
3108 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3109 {
3110         if (strcmp(name, XATTR_NAME_SELINUX))
3111                 return selinux_inode_setotherxattr(dentry, name);
3112
3113         /* No one is allowed to remove a SELinux security label.
3114            You can change the label, but all data must be labeled. */
3115         return -EACCES;
3116 }
3117
3118 /*
3119  * Copy the inode security context value to the user.
3120  *
3121  * Permission check is handled by selinux_inode_getxattr hook.
3122  */
3123 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3124 {
3125         u32 size;
3126         int error;
3127         char *context = NULL;
3128         struct inode_security_struct *isec = inode->i_security;
3129
3130         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3131                 return -EOPNOTSUPP;
3132
3133         /*
3134          * If the caller has CAP_MAC_ADMIN, then get the raw context
3135          * value even if it is not defined by current policy; otherwise,
3136          * use the in-core value under current policy.
3137          * Use the non-auditing forms of the permission checks since
3138          * getxattr may be called by unprivileged processes commonly
3139          * and lack of permission just means that we fall back to the
3140          * in-core context value, not a denial.
3141          */
3142         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3143                             SECURITY_CAP_NOAUDIT);
3144         if (!error)
3145                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3146                                             SECURITY_CAP_NOAUDIT);
3147         if (!error)
3148                 error = security_sid_to_context_force(isec->sid, &context,
3149                                                       &size);
3150         else
3151                 error = security_sid_to_context(isec->sid, &context, &size);
3152         if (error)
3153                 return error;
3154         error = size;
3155         if (alloc) {
3156                 *buffer = context;
3157                 goto out_nofree;
3158         }
3159         kfree(context);
3160 out_nofree:
3161         return error;
3162 }
3163
3164 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3165                                      const void *value, size_t size, int flags)
3166 {
3167         struct inode_security_struct *isec = inode->i_security;
3168         u32 newsid;
3169         int rc;
3170
3171         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3172                 return -EOPNOTSUPP;
3173
3174         if (!value || !size)
3175                 return -EACCES;
3176
3177         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3178         if (rc)
3179                 return rc;
3180
3181         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3182         isec->sid = newsid;
3183         isec->initialized = 1;
3184         return 0;
3185 }
3186
3187 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3188 {
3189         const int len = sizeof(XATTR_NAME_SELINUX);
3190         if (buffer && len <= buffer_size)
3191                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3192         return len;
3193 }
3194
3195 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3196 {
3197         struct inode_security_struct *isec = inode->i_security;
3198         *secid = isec->sid;
3199 }
3200
3201 /* file security operations */
3202
3203 static int selinux_revalidate_file_permission(struct file *file, int mask)
3204 {
3205         const struct cred *cred = current_cred();
3206         struct inode *inode = file_inode(file);
3207
3208         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3209         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3210                 mask |= MAY_APPEND;
3211
3212         return file_has_perm(cred, file,
3213                              file_mask_to_av(inode->i_mode, mask));
3214 }
3215
3216 static int selinux_file_permission(struct file *file, int mask)
3217 {
3218         struct inode *inode = file_inode(file);
3219         struct file_security_struct *fsec = file->f_security;
3220         struct inode_security_struct *isec = inode->i_security;
3221         u32 sid = current_sid();
3222
3223         if (!mask)
3224                 /* No permission to check.  Existence test. */
3225                 return 0;
3226
3227         if (sid == fsec->sid && fsec->isid == isec->sid &&
3228             fsec->pseqno == avc_policy_seqno())
3229                 /* No change since file_open check. */
3230                 return 0;
3231
3232         return selinux_revalidate_file_permission(file, mask);
3233 }
3234
3235 static int selinux_file_alloc_security(struct file *file)
3236 {
3237         return file_alloc_security(file);
3238 }
3239
3240 static void selinux_file_free_security(struct file *file)
3241 {
3242         file_free_security(file);
3243 }
3244
3245 /*
3246  * Check whether a task has the ioctl permission and cmd
3247  * operation to an inode.
3248  */
3249 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3250                 u32 requested, u16 cmd)
3251 {
3252         struct common_audit_data ad;
3253         struct file_security_struct *fsec = file->f_security;
3254         struct inode *inode = file_inode(file);
3255         struct inode_security_struct *isec = inode->i_security;
3256         struct lsm_ioctlop_audit ioctl;
3257         u32 ssid = cred_sid(cred);
3258         int rc;
3259         u8 driver = cmd >> 8;
3260         u8 xperm = cmd & 0xff;
3261
3262         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3263         ad.u.op = &ioctl;
3264         ad.u.op->cmd = cmd;
3265         ad.u.op->path = file->f_path;
3266
3267         if (ssid != fsec->sid) {
3268                 rc = avc_has_perm(ssid, fsec->sid,
3269                                 SECCLASS_FD,
3270                                 FD__USE,
3271                                 &ad);
3272                 if (rc)
3273                         goto out;
3274         }
3275
3276         if (unlikely(IS_PRIVATE(inode)))
3277                 return 0;
3278
3279         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3280                         requested, driver, xperm, &ad);
3281 out:
3282         return rc;
3283 }
3284
3285 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3286                               unsigned long arg)
3287 {
3288         const struct cred *cred = current_cred();
3289         int error = 0;
3290
3291         switch (cmd) {
3292         case FIONREAD:
3293         /* fall through */
3294         case FIBMAP:
3295         /* fall through */
3296         case FIGETBSZ:
3297         /* fall through */
3298         case FS_IOC_GETFLAGS:
3299         /* fall through */
3300         case FS_IOC_GETVERSION:
3301                 error = file_has_perm(cred, file, FILE__GETATTR);
3302                 break;
3303
3304         case FS_IOC_SETFLAGS:
3305         /* fall through */
3306         case FS_IOC_SETVERSION:
3307                 error = file_has_perm(cred, file, FILE__SETATTR);
3308                 break;
3309
3310         /* sys_ioctl() checks */
3311         case FIONBIO:
3312         /* fall through */
3313         case FIOASYNC:
3314                 error = file_has_perm(cred, file, 0);
3315                 break;
3316
3317         case KDSKBENT:
3318         case KDSKBSENT:
3319                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3320                                             SECURITY_CAP_AUDIT);
3321                 break;
3322
3323         /* default case assumes that the command will go
3324          * to the file's ioctl() function.
3325          */
3326         default:
3327                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3328         }
3329         return error;
3330 }
3331
3332 static int default_noexec;
3333
3334 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3335 {
3336         const struct cred *cred = current_cred();
3337         int rc = 0;
3338
3339         if (default_noexec &&
3340             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3341                                    (!shared && (prot & PROT_WRITE)))) {
3342                 /*
3343                  * We are making executable an anonymous mapping or a
3344                  * private file mapping that will also be writable.
3345                  * This has an additional check.
3346                  */
3347                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3348                 if (rc)
3349                         goto error;
3350         }
3351
3352         if (file) {
3353                 /* read access is always possible with a mapping */
3354                 u32 av = FILE__READ;
3355
3356                 /* write access only matters if the mapping is shared */
3357                 if (shared && (prot & PROT_WRITE))
3358                         av |= FILE__WRITE;
3359
3360                 if (prot & PROT_EXEC)
3361                         av |= FILE__EXECUTE;
3362
3363                 return file_has_perm(cred, file, av);
3364         }
3365
3366 error:
3367         return rc;
3368 }
3369
3370 static int selinux_mmap_addr(unsigned long addr)
3371 {
3372         int rc = 0;
3373
3374         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3375                 u32 sid = current_sid();
3376                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3377                                   MEMPROTECT__MMAP_ZERO, NULL);
3378         }
3379
3380         return rc;
3381 }
3382
3383 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3384                              unsigned long prot, unsigned long flags)
3385 {
3386         if (selinux_checkreqprot)
3387                 prot = reqprot;
3388
3389         return file_map_prot_check(file, prot,
3390                                    (flags & MAP_TYPE) == MAP_SHARED);
3391 }
3392
3393 static int selinux_file_mprotect(struct vm_area_struct *vma,
3394                                  unsigned long reqprot,
3395                                  unsigned long prot)
3396 {
3397         const struct cred *cred = current_cred();
3398
3399         if (selinux_checkreqprot)
3400                 prot = reqprot;
3401
3402         if (default_noexec &&
3403             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3404                 int rc = 0;
3405                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3406                     vma->vm_end <= vma->vm_mm->brk) {
3407                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3408                 } else if (!vma->vm_file &&
3409                            vma->vm_start <= vma->vm_mm->start_stack &&
3410                            vma->vm_end >= vma->vm_mm->start_stack) {
3411                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3412                 } else if (vma->vm_file && vma->anon_vma) {
3413                         /*
3414                          * We are making executable a file mapping that has
3415                          * had some COW done. Since pages might have been
3416                          * written, check ability to execute the possibly
3417                          * modified content.  This typically should only
3418                          * occur for text relocations.
3419                          */
3420                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3421                 }
3422                 if (rc)
3423                         return rc;
3424         }
3425
3426         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3427 }
3428
3429 static int selinux_file_lock(struct file *file, unsigned int cmd)
3430 {
3431         const struct cred *cred = current_cred();
3432
3433         return file_has_perm(cred, file, FILE__LOCK);
3434 }
3435
3436 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3437                               unsigned long arg)
3438 {
3439         const struct cred *cred = current_cred();
3440         int err = 0;
3441
3442         switch (cmd) {
3443         case F_SETFL:
3444                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3445                         err = file_has_perm(cred, file, FILE__WRITE);
3446                         break;
3447                 }
3448                 /* fall through */
3449         case F_SETOWN:
3450         case F_SETSIG:
3451         case F_GETFL:
3452         case F_GETOWN:
3453         case F_GETSIG:
3454         case F_GETOWNER_UIDS:
3455                 /* Just check FD__USE permission */
3456                 err = file_has_perm(cred, file, 0);
3457                 break;
3458         case F_GETLK:
3459         case F_SETLK:
3460         case F_SETLKW:
3461         case F_OFD_GETLK:
3462         case F_OFD_SETLK:
3463         case F_OFD_SETLKW:
3464 #if BITS_PER_LONG == 32
3465         case F_GETLK64:
3466         case F_SETLK64:
3467         case F_SETLKW64:
3468 #endif
3469                 err = file_has_perm(cred, file, FILE__LOCK);
3470                 break;
3471         }
3472
3473         return err;
3474 }
3475
3476 static void selinux_file_set_fowner(struct file *file)
3477 {
3478         struct file_security_struct *fsec;
3479
3480         fsec = file->f_security;
3481         fsec->fown_sid = current_sid();
3482 }
3483
3484 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3485                                        struct fown_struct *fown, int signum)
3486 {
3487         struct file *file;
3488         u32 sid = task_sid(tsk);
3489         u32 perm;
3490         struct file_security_struct *fsec;
3491
3492         /* struct fown_struct is never outside the context of a struct file */
3493         file = container_of(fown, struct file, f_owner);
3494
3495         fsec = file->f_security;
3496
3497         if (!signum)
3498                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3499         else
3500                 perm = signal_to_av(signum);
3501
3502         return avc_has_perm(fsec->fown_sid, sid,
3503                             SECCLASS_PROCESS, perm, NULL);
3504 }
3505
3506 static int selinux_file_receive(struct file *file)
3507 {
3508         const struct cred *cred = current_cred();
3509
3510         return file_has_perm(cred, file, file_to_av(file));
3511 }
3512
3513 static int selinux_file_open(struct file *file, const struct cred *cred)
3514 {
3515         struct file_security_struct *fsec;
3516         struct inode_security_struct *isec;
3517
3518         fsec = file->f_security;
3519         isec = file_inode(file)->i_security;
3520         /*
3521          * Save inode label and policy sequence number
3522          * at open-time so that selinux_file_permission
3523          * can determine whether revalidation is necessary.
3524          * Task label is already saved in the file security
3525          * struct as its SID.
3526          */
3527         fsec->isid = isec->sid;
3528         fsec->pseqno = avc_policy_seqno();
3529         /*
3530          * Since the inode label or policy seqno may have changed
3531          * between the selinux_inode_permission check and the saving
3532          * of state above, recheck that access is still permitted.
3533          * Otherwise, access might never be revalidated against the
3534          * new inode label or new policy.
3535          * This check is not redundant - do not remove.
3536          */
3537         return file_path_has_perm(cred, file, open_file_to_av(file));
3538 }
3539
3540 /* task security operations */
3541
3542 static int selinux_task_create(unsigned long clone_flags)
3543 {
3544         return current_has_perm(current, PROCESS__FORK);
3545 }
3546
3547 /*
3548  * allocate the SELinux part of blank credentials
3549  */
3550 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3551 {
3552         struct task_security_struct *tsec;
3553
3554         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3555         if (!tsec)
3556                 return -ENOMEM;
3557
3558         cred->security = tsec;
3559         return 0;
3560 }
3561
3562 /*
3563  * detach and free the LSM part of a set of credentials
3564  */
3565 static void selinux_cred_free(struct cred *cred)
3566 {
3567         struct task_security_struct *tsec = cred->security;
3568
3569         /*
3570          * cred->security == NULL if security_cred_alloc_blank() or
3571          * security_prepare_creds() returned an error.
3572          */
3573         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3574         cred->security = (void *) 0x7UL;
3575         kfree(tsec);
3576 }
3577
3578 /*
3579  * prepare a new set of credentials for modification
3580  */
3581 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3582                                 gfp_t gfp)
3583 {
3584         const struct task_security_struct *old_tsec;
3585         struct task_security_struct *tsec;
3586
3587         old_tsec = old->security;
3588
3589         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3590         if (!tsec)
3591                 return -ENOMEM;
3592
3593         new->security = tsec;
3594         return 0;
3595 }
3596
3597 /*
3598  * transfer the SELinux data to a blank set of creds
3599  */
3600 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3601 {
3602         const struct task_security_struct *old_tsec = old->security;
3603         struct task_security_struct *tsec = new->security;
3604
3605         *tsec = *old_tsec;
3606 }
3607
3608 /*
3609  * set the security data for a kernel service
3610  * - all the creation contexts are set to unlabelled
3611  */
3612 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3613 {
3614         struct task_security_struct *tsec = new->security;
3615         u32 sid = current_sid();
3616         int ret;
3617
3618         ret = avc_has_perm(sid, secid,
3619                            SECCLASS_KERNEL_SERVICE,
3620                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3621                            NULL);
3622         if (ret == 0) {
3623                 tsec->sid = secid;
3624                 tsec->create_sid = 0;
3625                 tsec->keycreate_sid = 0;
3626                 tsec->sockcreate_sid = 0;
3627         }
3628         return ret;
3629 }
3630
3631 /*
3632  * set the file creation context in a security record to the same as the
3633  * objective context of the specified inode
3634  */
3635 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3636 {
3637         struct inode_security_struct *isec = inode->i_security;
3638         struct task_security_struct *tsec = new->security;
3639         u32 sid = current_sid();
3640         int ret;
3641
3642         ret = avc_has_perm(sid, isec->sid,
3643                            SECCLASS_KERNEL_SERVICE,
3644                            KERNEL_SERVICE__CREATE_FILES_AS,
3645                            NULL);
3646
3647         if (ret == 0)
3648                 tsec->create_sid = isec->sid;
3649         return ret;
3650 }
3651
3652 static int selinux_kernel_module_request(char *kmod_name)
3653 {
3654         u32 sid;
3655         struct common_audit_data ad;
3656
3657         sid = task_sid(current);
3658
3659         ad.type = LSM_AUDIT_DATA_KMOD;
3660         ad.u.kmod_name = kmod_name;
3661
3662         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3663                             SYSTEM__MODULE_REQUEST, &ad);
3664 }
3665
3666 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3667 {
3668         return current_has_perm(p, PROCESS__SETPGID);
3669 }
3670
3671 static int selinux_task_getpgid(struct task_struct *p)
3672 {
3673         return current_has_perm(p, PROCESS__GETPGID);
3674 }
3675
3676 static int selinux_task_getsid(struct task_struct *p)
3677 {
3678         return current_has_perm(p, PROCESS__GETSESSION);
3679 }
3680
3681 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3682 {
3683         *secid = task_sid(p);
3684 }
3685
3686 static int selinux_task_setnice(struct task_struct *p, int nice)
3687 {
3688         return current_has_perm(p, PROCESS__SETSCHED);
3689 }
3690
3691 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3692 {
3693         return current_has_perm(p, PROCESS__SETSCHED);
3694 }
3695
3696 static int selinux_task_getioprio(struct task_struct *p)
3697 {
3698         return current_has_perm(p, PROCESS__GETSCHED);
3699 }
3700
3701 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3702                 struct rlimit *new_rlim)
3703 {
3704         struct rlimit *old_rlim = p->signal->rlim + resource;
3705
3706         /* Control the ability to change the hard limit (whether
3707            lowering or raising it), so that the hard limit can
3708            later be used as a safe reset point for the soft limit
3709            upon context transitions.  See selinux_bprm_committing_creds. */
3710         if (old_rlim->rlim_max != new_rlim->rlim_max)
3711                 return current_has_perm(p, PROCESS__SETRLIMIT);
3712
3713         return 0;
3714 }
3715
3716 static int selinux_task_setscheduler(struct task_struct *p)
3717 {
3718         return current_has_perm(p, PROCESS__SETSCHED);
3719 }
3720
3721 static int selinux_task_getscheduler(struct task_struct *p)
3722 {
3723         return current_has_perm(p, PROCESS__GETSCHED);
3724 }
3725
3726 static int selinux_task_movememory(struct task_struct *p)
3727 {
3728         return current_has_perm(p, PROCESS__SETSCHED);
3729 }
3730
3731 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3732                                 int sig, u32 secid)
3733 {
3734         u32 perm;
3735         int rc;
3736
3737         if (!sig)
3738                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3739         else
3740                 perm = signal_to_av(sig);
3741         if (secid)
3742                 rc = avc_has_perm(secid, task_sid(p),
3743                                   SECCLASS_PROCESS, perm, NULL);
3744         else
3745                 rc = current_has_perm(p, perm);
3746         return rc;
3747 }
3748
3749 static int selinux_task_wait(struct task_struct *p)
3750 {
3751         return task_has_perm(p, current, PROCESS__SIGCHLD);
3752 }
3753
3754 static void selinux_task_to_inode(struct task_struct *p,
3755                                   struct inode *inode)
3756 {
3757         struct inode_security_struct *isec = inode->i_security;
3758         u32 sid = task_sid(p);
3759
3760         isec->sid = sid;
3761         isec->initialized = 1;
3762 }
3763
3764 /* Returns error only if unable to parse addresses */
3765 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3766                         struct common_audit_data *ad, u8 *proto)
3767 {
3768         int offset, ihlen, ret = -EINVAL;
3769         struct iphdr _iph, *ih;
3770
3771         offset = skb_network_offset(skb);
3772         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3773         if (ih == NULL)
3774                 goto out;
3775
3776         ihlen = ih->ihl * 4;
3777         if (ihlen < sizeof(_iph))
3778                 goto out;
3779
3780         ad->u.net->v4info.saddr = ih->saddr;
3781         ad->u.net->v4info.daddr = ih->daddr;
3782         ret = 0;
3783
3784         if (proto)
3785                 *proto = ih->protocol;
3786
3787         switch (ih->protocol) {
3788         case IPPROTO_TCP: {
3789                 struct tcphdr _tcph, *th;
3790
3791                 if (ntohs(ih->frag_off) & IP_OFFSET)
3792                         break;
3793
3794                 offset += ihlen;
3795                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3796                 if (th == NULL)
3797                         break;
3798
3799                 ad->u.net->sport = th->source;
3800                 ad->u.net->dport = th->dest;
3801                 break;
3802         }
3803
3804         case IPPROTO_UDP: {
3805                 struct udphdr _udph, *uh;
3806
3807                 if (ntohs(ih->frag_off) & IP_OFFSET)
3808                         break;
3809
3810                 offset += ihlen;
3811                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3812                 if (uh == NULL)
3813                         break;
3814
3815                 ad->u.net->sport = uh->source;
3816                 ad->u.net->dport = uh->dest;
3817                 break;
3818         }
3819
3820         case IPPROTO_DCCP: {
3821                 struct dccp_hdr _dccph, *dh;
3822
3823                 if (ntohs(ih->frag_off) & IP_OFFSET)
3824                         break;
3825
3826                 offset += ihlen;
3827                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3828                 if (dh == NULL)
3829                         break;
3830
3831                 ad->u.net->sport = dh->dccph_sport;
3832                 ad->u.net->dport = dh->dccph_dport;
3833                 break;
3834         }
3835
3836         default:
3837                 break;
3838         }
3839 out:
3840         return ret;
3841 }
3842
3843 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3844
3845 /* Returns error only if unable to parse addresses */
3846 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3847                         struct common_audit_data *ad, u8 *proto)
3848 {
3849         u8 nexthdr;
3850         int ret = -EINVAL, offset;
3851         struct ipv6hdr _ipv6h, *ip6;
3852         __be16 frag_off;
3853
3854         offset = skb_network_offset(skb);
3855         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3856         if (ip6 == NULL)
3857                 goto out;
3858
3859         ad->u.net->v6info.saddr = ip6->saddr;
3860         ad->u.net->v6info.daddr = ip6->daddr;
3861         ret = 0;
3862
3863         nexthdr = ip6->nexthdr;
3864         offset += sizeof(_ipv6h);
3865         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3866         if (offset < 0)
3867                 goto out;
3868
3869         if (proto)
3870                 *proto = nexthdr;
3871
3872         switch (nexthdr) {
3873         case IPPROTO_TCP: {
3874                 struct tcphdr _tcph, *th;
3875
3876                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3877                 if (th == NULL)
3878                         break;
3879
3880                 ad->u.net->sport = th->source;
3881                 ad->u.net->dport = th->dest;
3882                 break;
3883         }
3884
3885         case IPPROTO_UDP: {
3886                 struct udphdr _udph, *uh;
3887
3888                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3889                 if (uh == NULL)
3890                         break;
3891
3892                 ad->u.net->sport = uh->source;
3893                 ad->u.net->dport = uh->dest;
3894                 break;
3895         }
3896
3897         case IPPROTO_DCCP: {
3898                 struct dccp_hdr _dccph, *dh;
3899
3900                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3901                 if (dh == NULL)
3902                         break;
3903
3904                 ad->u.net->sport = dh->dccph_sport;
3905                 ad->u.net->dport = dh->dccph_dport;
3906                 break;
3907         }
3908
3909         /* includes fragments */
3910         default:
3911                 break;
3912         }
3913 out:
3914         return ret;
3915 }
3916
3917 #endif /* IPV6 */
3918
3919 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3920                              char **_addrp, int src, u8 *proto)
3921 {
3922         char *addrp;
3923         int ret;
3924
3925         switch (ad->u.net->family) {
3926         case PF_INET:
3927                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3928                 if (ret)
3929                         goto parse_error;
3930                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3931                                        &ad->u.net->v4info.daddr);
3932                 goto okay;
3933
3934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3935         case PF_INET6:
3936                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3937                 if (ret)
3938                         goto parse_error;
3939                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3940                                        &ad->u.net->v6info.daddr);
3941                 goto okay;
3942 #endif  /* IPV6 */
3943         default:
3944                 addrp = NULL;
3945                 goto okay;
3946         }
3947
3948 parse_error:
3949         printk(KERN_WARNING
3950                "SELinux: failure in selinux_parse_skb(),"
3951                " unable to parse packet\n");
3952         return ret;
3953
3954 okay:
3955         if (_addrp)
3956                 *_addrp = addrp;
3957         return 0;
3958 }
3959
3960 /**
3961  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3962  * @skb: the packet
3963  * @family: protocol family
3964  * @sid: the packet's peer label SID
3965  *
3966  * Description:
3967  * Check the various different forms of network peer labeling and determine
3968  * the peer label/SID for the packet; most of the magic actually occurs in
3969  * the security server function security_net_peersid_cmp().  The function
3970  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3971  * or -EACCES if @sid is invalid due to inconsistencies with the different
3972  * peer labels.
3973  *
3974  */
3975 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3976 {
3977         int err;
3978         u32 xfrm_sid;
3979         u32 nlbl_sid;
3980         u32 nlbl_type;
3981
3982         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3983         if (unlikely(err))
3984                 return -EACCES;
3985         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3986         if (unlikely(err))
3987                 return -EACCES;
3988
3989         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3990         if (unlikely(err)) {
3991                 printk(KERN_WARNING
3992                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3993                        " unable to determine packet's peer label\n");
3994                 return -EACCES;
3995         }
3996
3997         return 0;
3998 }
3999
4000 /**
4001  * selinux_conn_sid - Determine the child socket label for a connection
4002  * @sk_sid: the parent socket's SID
4003  * @skb_sid: the packet's SID
4004  * @conn_sid: the resulting connection SID
4005  *
4006  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4007  * combined with the MLS information from @skb_sid in order to create
4008  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4009  * of @sk_sid.  Returns zero on success, negative values on failure.
4010  *
4011  */
4012 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4013 {
4014         int err = 0;
4015
4016         if (skb_sid != SECSID_NULL)
4017                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4018         else
4019                 *conn_sid = sk_sid;
4020
4021         return err;
4022 }
4023
4024 /* socket security operations */
4025
4026 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4027                                  u16 secclass, u32 *socksid)
4028 {
4029         if (tsec->sockcreate_sid > SECSID_NULL) {
4030                 *socksid = tsec->sockcreate_sid;
4031                 return 0;
4032         }
4033
4034         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4035                                        socksid);
4036 }
4037
4038 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4039 {
4040         struct sk_security_struct *sksec = sk->sk_security;
4041         struct common_audit_data ad;
4042         struct lsm_network_audit net = {0,};
4043         u32 tsid = task_sid(task);
4044
4045         if (!sksec)
4046                 return -EFAULT;
4047         if (sksec->sid == SECINITSID_KERNEL)
4048                 return 0;
4049
4050         ad.type = LSM_AUDIT_DATA_NET;
4051         ad.u.net = &net;
4052         ad.u.net->sk = sk;
4053
4054         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4055 }
4056
4057 static int selinux_socket_create(int family, int type,
4058                                  int protocol, int kern)
4059 {
4060         const struct task_security_struct *tsec = current_security();
4061         u32 newsid;
4062         u16 secclass;
4063         int rc;
4064
4065         if (kern)
4066                 return 0;
4067
4068         secclass = socket_type_to_security_class(family, type, protocol);
4069         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4070         if (rc)
4071                 return rc;
4072
4073         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4074 }
4075
4076 static int selinux_socket_post_create(struct socket *sock, int family,
4077                                       int type, int protocol, int kern)
4078 {
4079         const struct task_security_struct *tsec = current_security();
4080         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4081         struct sk_security_struct *sksec;
4082         int err = 0;
4083
4084         isec->sclass = socket_type_to_security_class(family, type, protocol);
4085
4086         if (kern)
4087                 isec->sid = SECINITSID_KERNEL;
4088         else {
4089                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4090                 if (err)
4091                         return err;
4092         }
4093
4094         isec->initialized = 1;
4095
4096         if (sock->sk) {
4097                 sksec = sock->sk->sk_security;
4098                 sksec->sid = isec->sid;
4099                 sksec->sclass = isec->sclass;
4100                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4101         }
4102
4103         return err;
4104 }
4105
4106 /* Range of port numbers used to automatically bind.
4107    Need to determine whether we should perform a name_bind
4108    permission check between the socket and the port number. */
4109
4110 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4111 {
4112         struct sock *sk = sock->sk;
4113         u16 family;
4114         int err;
4115
4116         err = sock_has_perm(current, sk, SOCKET__BIND);
4117         if (err)
4118                 goto out;
4119
4120         /*
4121          * If PF_INET or PF_INET6, check name_bind permission for the port.
4122          * Multiple address binding for SCTP is not supported yet: we just
4123          * check the first address now.
4124          */
4125         family = sk->sk_family;
4126         if (family == PF_INET || family == PF_INET6) {
4127                 char *addrp;
4128                 struct sk_security_struct *sksec = sk->sk_security;
4129                 struct common_audit_data ad;
4130                 struct lsm_network_audit net = {0,};
4131                 struct sockaddr_in *addr4 = NULL;
4132                 struct sockaddr_in6 *addr6 = NULL;
4133                 unsigned short snum;
4134                 u32 sid, node_perm;
4135
4136                 if (family == PF_INET) {
4137                         if (addrlen < sizeof(struct sockaddr_in)) {
4138                                 err = -EINVAL;
4139                                 goto out;
4140                         }
4141                         addr4 = (struct sockaddr_in *)address;
4142                         snum = ntohs(addr4->sin_port);
4143                         addrp = (char *)&addr4->sin_addr.s_addr;
4144                 } else {
4145                         if (addrlen < SIN6_LEN_RFC2133) {
4146                                 err = -EINVAL;
4147                                 goto out;
4148                         }
4149                         addr6 = (struct sockaddr_in6 *)address;
4150                         snum = ntohs(addr6->sin6_port);
4151                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4152                 }
4153
4154                 if (snum) {
4155                         int low, high;
4156
4157                         inet_get_local_port_range(sock_net(sk), &low, &high);
4158
4159                         if (snum < max(PROT_SOCK, low) || snum > high) {
4160                                 err = sel_netport_sid(sk->sk_protocol,
4161                                                       snum, &sid);
4162                                 if (err)
4163                                         goto out;
4164                                 ad.type = LSM_AUDIT_DATA_NET;
4165                                 ad.u.net = &net;
4166                                 ad.u.net->sport = htons(snum);
4167                                 ad.u.net->family = family;
4168                                 err = avc_has_perm(sksec->sid, sid,
4169                                                    sksec->sclass,
4170                                                    SOCKET__NAME_BIND, &ad);
4171                                 if (err)
4172                                         goto out;
4173                         }
4174                 }
4175
4176                 switch (sksec->sclass) {
4177                 case SECCLASS_TCP_SOCKET:
4178                         node_perm = TCP_SOCKET__NODE_BIND;
4179                         break;
4180
4181                 case SECCLASS_UDP_SOCKET:
4182                         node_perm = UDP_SOCKET__NODE_BIND;
4183                         break;
4184
4185                 case SECCLASS_DCCP_SOCKET:
4186                         node_perm = DCCP_SOCKET__NODE_BIND;
4187                         break;
4188
4189                 default:
4190                         node_perm = RAWIP_SOCKET__NODE_BIND;
4191                         break;
4192                 }
4193
4194                 err = sel_netnode_sid(addrp, family, &sid);
4195                 if (err)
4196                         goto out;
4197
4198                 ad.type = LSM_AUDIT_DATA_NET;
4199                 ad.u.net = &net;
4200                 ad.u.net->sport = htons(snum);
4201                 ad.u.net->family = family;
4202
4203                 if (family == PF_INET)
4204                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4205                 else
4206                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4207
4208                 err = avc_has_perm(sksec->sid, sid,
4209                                    sksec->sclass, node_perm, &ad);
4210                 if (err)
4211                         goto out;
4212         }
4213 out:
4214         return err;
4215 }
4216
4217 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4218 {
4219         struct sock *sk = sock->sk;
4220         struct sk_security_struct *sksec = sk->sk_security;
4221         int err;
4222
4223         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4224         if (err)
4225                 return err;
4226
4227         /*
4228          * If a TCP or DCCP socket, check name_connect permission for the port.
4229          */
4230         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4231             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4232                 struct common_audit_data ad;
4233                 struct lsm_network_audit net = {0,};
4234                 struct sockaddr_in *addr4 = NULL;
4235                 struct sockaddr_in6 *addr6 = NULL;
4236                 unsigned short snum;
4237                 u32 sid, perm;
4238
4239                 if (sk->sk_family == PF_INET) {
4240                         addr4 = (struct sockaddr_in *)address;
4241                         if (addrlen < sizeof(struct sockaddr_in))
4242                                 return -EINVAL;
4243                         snum = ntohs(addr4->sin_port);
4244                 } else {
4245                         addr6 = (struct sockaddr_in6 *)address;
4246                         if (addrlen < SIN6_LEN_RFC2133)
4247                                 return -EINVAL;
4248                         snum = ntohs(addr6->sin6_port);
4249                 }
4250
4251                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4252                 if (err)
4253                         goto out;
4254
4255                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4256                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4257
4258                 ad.type = LSM_AUDIT_DATA_NET;
4259                 ad.u.net = &net;
4260                 ad.u.net->dport = htons(snum);
4261                 ad.u.net->family = sk->sk_family;
4262                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4263                 if (err)
4264                         goto out;
4265         }
4266
4267         err = selinux_netlbl_socket_connect(sk, address);
4268
4269 out:
4270         return err;
4271 }
4272
4273 static int selinux_socket_listen(struct socket *sock, int backlog)
4274 {
4275         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4276 }
4277
4278 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4279 {
4280         int err;
4281         struct inode_security_struct *isec;
4282         struct inode_security_struct *newisec;
4283
4284         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4285         if (err)
4286                 return err;
4287
4288         newisec = SOCK_INODE(newsock)->i_security;
4289
4290         isec = SOCK_INODE(sock)->i_security;
4291         newisec->sclass = isec->sclass;
4292         newisec->sid = isec->sid;
4293         newisec->initialized = 1;
4294
4295         return 0;
4296 }
4297
4298 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4299                                   int size)
4300 {
4301         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4302 }
4303
4304 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4305                                   int size, int flags)
4306 {
4307         return sock_has_perm(current, sock->sk, SOCKET__READ);
4308 }
4309
4310 static int selinux_socket_getsockname(struct socket *sock)
4311 {
4312         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4313 }
4314
4315 static int selinux_socket_getpeername(struct socket *sock)
4316 {
4317         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4318 }
4319
4320 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4321 {
4322         int err;
4323
4324         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4325         if (err)
4326                 return err;
4327
4328         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4329 }
4330
4331 static int selinux_socket_getsockopt(struct socket *sock, int level,
4332                                      int optname)
4333 {
4334         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4335 }
4336
4337 static int selinux_socket_shutdown(struct socket *sock, int how)
4338 {
4339         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4340 }
4341
4342 static int selinux_socket_unix_stream_connect(struct sock *sock,
4343                                               struct sock *other,
4344                                               struct sock *newsk)
4345 {
4346         struct sk_security_struct *sksec_sock = sock->sk_security;
4347         struct sk_security_struct *sksec_other = other->sk_security;
4348         struct sk_security_struct *sksec_new = newsk->sk_security;
4349         struct common_audit_data ad;
4350         struct lsm_network_audit net = {0,};
4351         int err;
4352
4353         ad.type = LSM_AUDIT_DATA_NET;
4354         ad.u.net = &net;
4355         ad.u.net->sk = other;
4356
4357         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4358                            sksec_other->sclass,
4359                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4360         if (err)
4361                 return err;
4362
4363         /* server child socket */
4364         sksec_new->peer_sid = sksec_sock->sid;
4365         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4366                                     &sksec_new->sid);
4367         if (err)
4368                 return err;
4369
4370         /* connecting socket */
4371         sksec_sock->peer_sid = sksec_new->sid;
4372
4373         return 0;
4374 }
4375
4376 static int selinux_socket_unix_may_send(struct socket *sock,
4377                                         struct socket *other)
4378 {
4379         struct sk_security_struct *ssec = sock->sk->sk_security;
4380         struct sk_security_struct *osec = other->sk->sk_security;
4381         struct common_audit_data ad;
4382         struct lsm_network_audit net = {0,};
4383
4384         ad.type = LSM_AUDIT_DATA_NET;
4385         ad.u.net = &net;
4386         ad.u.net->sk = other->sk;
4387
4388         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4389                             &ad);
4390 }
4391
4392 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4393                                     char *addrp, u16 family, u32 peer_sid,
4394                                     struct common_audit_data *ad)
4395 {
4396         int err;
4397         u32 if_sid;
4398         u32 node_sid;
4399
4400         err = sel_netif_sid(ns, ifindex, &if_sid);
4401         if (err)
4402                 return err;
4403         err = avc_has_perm(peer_sid, if_sid,
4404                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4405         if (err)
4406                 return err;
4407
4408         err = sel_netnode_sid(addrp, family, &node_sid);
4409         if (err)
4410                 return err;
4411         return avc_has_perm(peer_sid, node_sid,
4412                             SECCLASS_NODE, NODE__RECVFROM, ad);
4413 }
4414
4415 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4416                                        u16 family)
4417 {
4418         int err = 0;
4419         struct sk_security_struct *sksec = sk->sk_security;
4420         u32 sk_sid = sksec->sid;
4421         struct common_audit_data ad;
4422         struct lsm_network_audit net = {0,};
4423         char *addrp;
4424
4425         ad.type = LSM_AUDIT_DATA_NET;
4426         ad.u.net = &net;
4427         ad.u.net->netif = skb->skb_iif;
4428         ad.u.net->family = family;
4429         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4430         if (err)
4431                 return err;
4432
4433         if (selinux_secmark_enabled()) {
4434                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4435                                    PACKET__RECV, &ad);
4436                 if (err)
4437                         return err;
4438         }
4439
4440         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4441         if (err)
4442                 return err;
4443         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4444
4445         return err;
4446 }
4447
4448 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4449 {
4450         int err;
4451         struct sk_security_struct *sksec = sk->sk_security;
4452         u16 family = sk->sk_family;
4453         u32 sk_sid = sksec->sid;
4454         struct common_audit_data ad;
4455         struct lsm_network_audit net = {0,};
4456         char *addrp;
4457         u8 secmark_active;
4458         u8 peerlbl_active;
4459
4460         if (family != PF_INET && family != PF_INET6)
4461                 return 0;
4462
4463         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4464         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4465                 family = PF_INET;
4466
4467         /* If any sort of compatibility mode is enabled then handoff processing
4468          * to the selinux_sock_rcv_skb_compat() function to deal with the
4469          * special handling.  We do this in an attempt to keep this function
4470          * as fast and as clean as possible. */
4471         if (!selinux_policycap_netpeer)
4472                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4473
4474         secmark_active = selinux_secmark_enabled();
4475         peerlbl_active = selinux_peerlbl_enabled();
4476         if (!secmark_active && !peerlbl_active)
4477                 return 0;
4478
4479         ad.type = LSM_AUDIT_DATA_NET;
4480         ad.u.net = &net;
4481         ad.u.net->netif = skb->skb_iif;
4482         ad.u.net->family = family;
4483         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4484         if (err)
4485                 return err;
4486
4487         if (peerlbl_active) {
4488                 u32 peer_sid;
4489
4490                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4491                 if (err)
4492                         return err;
4493                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4494                                                addrp, family, peer_sid, &ad);
4495                 if (err) {
4496                         selinux_netlbl_err(skb, err, 0);
4497                         return err;
4498                 }
4499                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4500                                    PEER__RECV, &ad);
4501                 if (err) {
4502                         selinux_netlbl_err(skb, err, 0);
4503                         return err;
4504                 }
4505         }
4506
4507         if (secmark_active) {
4508                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4509                                    PACKET__RECV, &ad);
4510                 if (err)
4511                         return err;
4512         }
4513
4514         return err;
4515 }
4516
4517 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4518                                             int __user *optlen, unsigned len)
4519 {
4520         int err = 0;
4521         char *scontext;
4522         u32 scontext_len;
4523         struct sk_security_struct *sksec = sock->sk->sk_security;
4524         u32 peer_sid = SECSID_NULL;
4525
4526         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4527             sksec->sclass == SECCLASS_TCP_SOCKET)
4528                 peer_sid = sksec->peer_sid;
4529         if (peer_sid == SECSID_NULL)
4530                 return -ENOPROTOOPT;
4531
4532         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4533         if (err)
4534                 return err;
4535
4536         if (scontext_len > len) {
4537                 err = -ERANGE;
4538                 goto out_len;
4539         }
4540
4541         if (copy_to_user(optval, scontext, scontext_len))
4542                 err = -EFAULT;
4543
4544 out_len:
4545         if (put_user(scontext_len, optlen))
4546                 err = -EFAULT;
4547         kfree(scontext);
4548         return err;
4549 }
4550
4551 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4552 {
4553         u32 peer_secid = SECSID_NULL;
4554         u16 family;
4555
4556         if (skb && skb->protocol == htons(ETH_P_IP))
4557                 family = PF_INET;
4558         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4559                 family = PF_INET6;
4560         else if (sock)
4561                 family = sock->sk->sk_family;
4562         else
4563                 goto out;
4564
4565         if (sock && family == PF_UNIX)
4566                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4567         else if (skb)
4568                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4569
4570 out:
4571         *secid = peer_secid;
4572         if (peer_secid == SECSID_NULL)
4573                 return -EINVAL;
4574         return 0;
4575 }
4576
4577 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4578 {
4579         struct sk_security_struct *sksec;
4580
4581         sksec = kzalloc(sizeof(*sksec), priority);
4582         if (!sksec)
4583                 return -ENOMEM;
4584
4585         sksec->peer_sid = SECINITSID_UNLABELED;
4586         sksec->sid = SECINITSID_UNLABELED;
4587         sksec->sclass = SECCLASS_SOCKET;
4588         selinux_netlbl_sk_security_reset(sksec);
4589         sk->sk_security = sksec;
4590
4591         return 0;
4592 }
4593
4594 static void selinux_sk_free_security(struct sock *sk)
4595 {
4596         struct sk_security_struct *sksec = sk->sk_security;
4597
4598         sk->sk_security = NULL;
4599         selinux_netlbl_sk_security_free(sksec);
4600         kfree(sksec);
4601 }
4602
4603 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4604 {
4605         struct sk_security_struct *sksec = sk->sk_security;
4606         struct sk_security_struct *newsksec = newsk->sk_security;
4607
4608         newsksec->sid = sksec->sid;
4609         newsksec->peer_sid = sksec->peer_sid;
4610         newsksec->sclass = sksec->sclass;
4611
4612         selinux_netlbl_sk_security_reset(newsksec);
4613 }
4614
4615 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4616 {
4617         if (!sk)
4618                 *secid = SECINITSID_ANY_SOCKET;
4619         else {
4620                 struct sk_security_struct *sksec = sk->sk_security;
4621
4622                 *secid = sksec->sid;
4623         }
4624 }
4625
4626 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4627 {
4628         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4629         struct sk_security_struct *sksec = sk->sk_security;
4630
4631         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4632             sk->sk_family == PF_UNIX)
4633                 isec->sid = sksec->sid;
4634         sksec->sclass = isec->sclass;
4635 }
4636
4637 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4638                                      struct request_sock *req)
4639 {
4640         struct sk_security_struct *sksec = sk->sk_security;
4641         int err;
4642         u16 family = req->rsk_ops->family;
4643         u32 connsid;
4644         u32 peersid;
4645
4646         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4647         if (err)
4648                 return err;
4649         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4650         if (err)
4651                 return err;
4652         req->secid = connsid;
4653         req->peer_secid = peersid;
4654
4655         return selinux_netlbl_inet_conn_request(req, family);
4656 }
4657
4658 static void selinux_inet_csk_clone(struct sock *newsk,
4659                                    const struct request_sock *req)
4660 {
4661         struct sk_security_struct *newsksec = newsk->sk_security;
4662
4663         newsksec->sid = req->secid;
4664         newsksec->peer_sid = req->peer_secid;
4665         /* NOTE: Ideally, we should also get the isec->sid for the
4666            new socket in sync, but we don't have the isec available yet.
4667            So we will wait until sock_graft to do it, by which
4668            time it will have been created and available. */
4669
4670         /* We don't need to take any sort of lock here as we are the only
4671          * thread with access to newsksec */
4672         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4673 }
4674
4675 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4676 {
4677         u16 family = sk->sk_family;
4678         struct sk_security_struct *sksec = sk->sk_security;
4679
4680         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4681         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4682                 family = PF_INET;
4683
4684         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4685 }
4686
4687 static int selinux_secmark_relabel_packet(u32 sid)
4688 {
4689         const struct task_security_struct *__tsec;
4690         u32 tsid;
4691
4692         __tsec = current_security();
4693         tsid = __tsec->sid;
4694
4695         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4696 }
4697
4698 static void selinux_secmark_refcount_inc(void)
4699 {
4700         atomic_inc(&selinux_secmark_refcount);
4701 }
4702
4703 static void selinux_secmark_refcount_dec(void)
4704 {
4705         atomic_dec(&selinux_secmark_refcount);
4706 }
4707
4708 static void selinux_req_classify_flow(const struct request_sock *req,
4709                                       struct flowi *fl)
4710 {
4711         fl->flowi_secid = req->secid;
4712 }
4713
4714 static int selinux_tun_dev_alloc_security(void **security)
4715 {
4716         struct tun_security_struct *tunsec;
4717
4718         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4719         if (!tunsec)
4720                 return -ENOMEM;
4721         tunsec->sid = current_sid();
4722
4723         *security = tunsec;
4724         return 0;
4725 }
4726
4727 static void selinux_tun_dev_free_security(void *security)
4728 {
4729         kfree(security);
4730 }
4731
4732 static int selinux_tun_dev_create(void)
4733 {
4734         u32 sid = current_sid();
4735
4736         /* we aren't taking into account the "sockcreate" SID since the socket
4737          * that is being created here is not a socket in the traditional sense,
4738          * instead it is a private sock, accessible only to the kernel, and
4739          * representing a wide range of network traffic spanning multiple
4740          * connections unlike traditional sockets - check the TUN driver to
4741          * get a better understanding of why this socket is special */
4742
4743         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4744                             NULL);
4745 }
4746
4747 static int selinux_tun_dev_attach_queue(void *security)
4748 {
4749         struct tun_security_struct *tunsec = security;
4750
4751         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4752                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4753 }
4754
4755 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4756 {
4757         struct tun_security_struct *tunsec = security;
4758         struct sk_security_struct *sksec = sk->sk_security;
4759
4760         /* we don't currently perform any NetLabel based labeling here and it
4761          * isn't clear that we would want to do so anyway; while we could apply
4762          * labeling without the support of the TUN user the resulting labeled
4763          * traffic from the other end of the connection would almost certainly
4764          * cause confusion to the TUN user that had no idea network labeling
4765          * protocols were being used */
4766
4767         sksec->sid = tunsec->sid;
4768         sksec->sclass = SECCLASS_TUN_SOCKET;
4769
4770         return 0;
4771 }
4772
4773 static int selinux_tun_dev_open(void *security)
4774 {
4775         struct tun_security_struct *tunsec = security;
4776         u32 sid = current_sid();
4777         int err;
4778
4779         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4780                            TUN_SOCKET__RELABELFROM, NULL);
4781         if (err)
4782                 return err;
4783         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4784                            TUN_SOCKET__RELABELTO, NULL);
4785         if (err)
4786                 return err;
4787         tunsec->sid = sid;
4788
4789         return 0;
4790 }
4791
4792 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4793 {
4794         int rc = 0;
4795         unsigned int msg_len;
4796         unsigned int data_len = skb->len;
4797         unsigned char *data = skb->data;
4798         struct nlmsghdr *nlh;
4799         struct sk_security_struct *sksec = sk->sk_security;
4800         u16 sclass = sksec->sclass;
4801         u32 perm;
4802
4803         while (data_len >= nlmsg_total_size(0)) {
4804                 nlh = (struct nlmsghdr *)data;
4805
4806                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
4807                  *       users which means we can't reject skb's with bogus
4808                  *       length fields; our solution is to follow what
4809                  *       netlink_rcv_skb() does and simply skip processing at
4810                  *       messages with length fields that are clearly junk
4811                  */
4812                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
4813                         return 0;
4814
4815                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
4816                 if (rc == 0) {
4817                         rc = sock_has_perm(current, sk, perm);
4818                         if (rc)
4819                                 return rc;
4820                 } else if (rc == -EINVAL) {
4821                         /* -EINVAL is a missing msg/perm mapping */
4822                         pr_warn_ratelimited("SELinux: unrecognized netlink"
4823                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4824                                 " pid=%d comm=%s\n",
4825                                 sk->sk_protocol, nlh->nlmsg_type,
4826                                 secclass_map[sclass - 1].name,
4827                                 task_pid_nr(current), current->comm);
4828                         if (selinux_enforcing && !security_get_allow_unknown())
4829                                 return rc;
4830                         rc = 0;
4831                 } else if (rc == -ENOENT) {
4832                         /* -ENOENT is a missing socket/class mapping, ignore */
4833                         rc = 0;
4834                 } else {
4835                         return rc;
4836                 }
4837
4838                 /* move to the next message after applying netlink padding */
4839                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
4840                 if (msg_len >= data_len)
4841                         return 0;
4842                 data_len -= msg_len;
4843                 data += msg_len;
4844         }
4845
4846         return rc;
4847 }
4848
4849 #ifdef CONFIG_NETFILTER
4850
4851 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4852                                        const struct net_device *indev,
4853                                        u16 family)
4854 {
4855         int err;
4856         char *addrp;
4857         u32 peer_sid;
4858         struct common_audit_data ad;
4859         struct lsm_network_audit net = {0,};
4860         u8 secmark_active;
4861         u8 netlbl_active;
4862         u8 peerlbl_active;
4863
4864         if (!selinux_policycap_netpeer)
4865                 return NF_ACCEPT;
4866
4867         secmark_active = selinux_secmark_enabled();
4868         netlbl_active = netlbl_enabled();
4869         peerlbl_active = selinux_peerlbl_enabled();
4870         if (!secmark_active && !peerlbl_active)
4871                 return NF_ACCEPT;
4872
4873         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4874                 return NF_DROP;
4875
4876         ad.type = LSM_AUDIT_DATA_NET;
4877         ad.u.net = &net;
4878         ad.u.net->netif = indev->ifindex;
4879         ad.u.net->family = family;
4880         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4881                 return NF_DROP;
4882
4883         if (peerlbl_active) {
4884                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4885                                                addrp, family, peer_sid, &ad);
4886                 if (err) {
4887                         selinux_netlbl_err(skb, err, 1);
4888                         return NF_DROP;
4889                 }
4890         }
4891
4892         if (secmark_active)
4893                 if (avc_has_perm(peer_sid, skb->secmark,
4894                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4895                         return NF_DROP;
4896
4897         if (netlbl_active)
4898                 /* we do this in the FORWARD path and not the POST_ROUTING
4899                  * path because we want to make sure we apply the necessary
4900                  * labeling before IPsec is applied so we can leverage AH
4901                  * protection */
4902                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4903                         return NF_DROP;
4904
4905         return NF_ACCEPT;
4906 }
4907
4908 static unsigned int selinux_ipv4_forward(void *priv,
4909                                          struct sk_buff *skb,
4910                                          const struct nf_hook_state *state)
4911 {
4912         return selinux_ip_forward(skb, state->in, PF_INET);
4913 }
4914
4915 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4916 static unsigned int selinux_ipv6_forward(void *priv,
4917                                          struct sk_buff *skb,
4918                                          const struct nf_hook_state *state)
4919 {
4920         return selinux_ip_forward(skb, state->in, PF_INET6);
4921 }
4922 #endif  /* IPV6 */
4923
4924 static unsigned int selinux_ip_output(struct sk_buff *skb,
4925                                       u16 family)
4926 {
4927         struct sock *sk;
4928         u32 sid;
4929
4930         if (!netlbl_enabled())
4931                 return NF_ACCEPT;
4932
4933         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4934          * because we want to make sure we apply the necessary labeling
4935          * before IPsec is applied so we can leverage AH protection */
4936         sk = skb->sk;
4937         if (sk) {
4938                 struct sk_security_struct *sksec;
4939
4940                 if (sk_listener(sk))
4941                         /* if the socket is the listening state then this
4942                          * packet is a SYN-ACK packet which means it needs to
4943                          * be labeled based on the connection/request_sock and
4944                          * not the parent socket.  unfortunately, we can't
4945                          * lookup the request_sock yet as it isn't queued on
4946                          * the parent socket until after the SYN-ACK is sent.
4947                          * the "solution" is to simply pass the packet as-is
4948                          * as any IP option based labeling should be copied
4949                          * from the initial connection request (in the IP
4950                          * layer).  it is far from ideal, but until we get a
4951                          * security label in the packet itself this is the
4952                          * best we can do. */
4953                         return NF_ACCEPT;
4954
4955                 /* standard practice, label using the parent socket */
4956                 sksec = sk->sk_security;
4957                 sid = sksec->sid;
4958         } else
4959                 sid = SECINITSID_KERNEL;
4960         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4961                 return NF_DROP;
4962
4963         return NF_ACCEPT;
4964 }
4965
4966 static unsigned int selinux_ipv4_output(void *priv,
4967                                         struct sk_buff *skb,
4968                                         const struct nf_hook_state *state)
4969 {
4970         return selinux_ip_output(skb, PF_INET);
4971 }
4972
4973 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4974                                                 int ifindex,
4975                                                 u16 family)
4976 {
4977         struct sock *sk = skb_to_full_sk(skb);
4978         struct sk_security_struct *sksec;
4979         struct common_audit_data ad;
4980         struct lsm_network_audit net = {0,};
4981         char *addrp;
4982         u8 proto;
4983
4984         if (sk == NULL)
4985                 return NF_ACCEPT;
4986         sksec = sk->sk_security;
4987
4988         ad.type = LSM_AUDIT_DATA_NET;
4989         ad.u.net = &net;
4990         ad.u.net->netif = ifindex;
4991         ad.u.net->family = family;
4992         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4993                 return NF_DROP;
4994
4995         if (selinux_secmark_enabled())
4996                 if (avc_has_perm(sksec->sid, skb->secmark,
4997                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4998                         return NF_DROP_ERR(-ECONNREFUSED);
4999
5000         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5001                 return NF_DROP_ERR(-ECONNREFUSED);
5002
5003         return NF_ACCEPT;
5004 }
5005
5006 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5007                                          const struct net_device *outdev,
5008                                          u16 family)
5009 {
5010         u32 secmark_perm;
5011         u32 peer_sid;
5012         int ifindex = outdev->ifindex;
5013         struct sock *sk;
5014         struct common_audit_data ad;
5015         struct lsm_network_audit net = {0,};
5016         char *addrp;
5017         u8 secmark_active;
5018         u8 peerlbl_active;
5019
5020         /* If any sort of compatibility mode is enabled then handoff processing
5021          * to the selinux_ip_postroute_compat() function to deal with the
5022          * special handling.  We do this in an attempt to keep this function
5023          * as fast and as clean as possible. */
5024         if (!selinux_policycap_netpeer)
5025                 return selinux_ip_postroute_compat(skb, ifindex, family);
5026
5027         secmark_active = selinux_secmark_enabled();
5028         peerlbl_active = selinux_peerlbl_enabled();
5029         if (!secmark_active && !peerlbl_active)
5030                 return NF_ACCEPT;
5031
5032         sk = skb_to_full_sk(skb);
5033
5034 #ifdef CONFIG_XFRM
5035         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5036          * packet transformation so allow the packet to pass without any checks
5037          * since we'll have another chance to perform access control checks
5038          * when the packet is on it's final way out.
5039          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5040          *       is NULL, in this case go ahead and apply access control.
5041          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5042          *       TCP listening state we cannot wait until the XFRM processing
5043          *       is done as we will miss out on the SA label if we do;
5044          *       unfortunately, this means more work, but it is only once per
5045          *       connection. */
5046         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5047             !(sk && sk_listener(sk)))
5048                 return NF_ACCEPT;
5049 #endif
5050
5051         if (sk == NULL) {
5052                 /* Without an associated socket the packet is either coming
5053                  * from the kernel or it is being forwarded; check the packet
5054                  * to determine which and if the packet is being forwarded
5055                  * query the packet directly to determine the security label. */
5056                 if (skb->skb_iif) {
5057                         secmark_perm = PACKET__FORWARD_OUT;
5058                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5059                                 return NF_DROP;
5060                 } else {
5061                         secmark_perm = PACKET__SEND;
5062                         peer_sid = SECINITSID_KERNEL;
5063                 }
5064         } else if (sk_listener(sk)) {
5065                 /* Locally generated packet but the associated socket is in the
5066                  * listening state which means this is a SYN-ACK packet.  In
5067                  * this particular case the correct security label is assigned
5068                  * to the connection/request_sock but unfortunately we can't
5069                  * query the request_sock as it isn't queued on the parent
5070                  * socket until after the SYN-ACK packet is sent; the only
5071                  * viable choice is to regenerate the label like we do in
5072                  * selinux_inet_conn_request().  See also selinux_ip_output()
5073                  * for similar problems. */
5074                 u32 skb_sid;
5075                 struct sk_security_struct *sksec;
5076
5077                 sksec = sk->sk_security;
5078                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5079                         return NF_DROP;
5080                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5081                  * and the packet has been through at least one XFRM
5082                  * transformation then we must be dealing with the "final"
5083                  * form of labeled IPsec packet; since we've already applied
5084                  * all of our access controls on this packet we can safely
5085                  * pass the packet. */
5086                 if (skb_sid == SECSID_NULL) {
5087                         switch (family) {
5088                         case PF_INET:
5089                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5090                                         return NF_ACCEPT;
5091                                 break;
5092                         case PF_INET6:
5093                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5094                                         return NF_ACCEPT;
5095                                 break;
5096                         default:
5097                                 return NF_DROP_ERR(-ECONNREFUSED);
5098                         }
5099                 }
5100                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5101                         return NF_DROP;
5102                 secmark_perm = PACKET__SEND;
5103         } else {
5104                 /* Locally generated packet, fetch the security label from the
5105                  * associated socket. */
5106                 struct sk_security_struct *sksec = sk->sk_security;
5107                 peer_sid = sksec->sid;
5108                 secmark_perm = PACKET__SEND;
5109         }
5110
5111         ad.type = LSM_AUDIT_DATA_NET;
5112         ad.u.net = &net;
5113         ad.u.net->netif = ifindex;
5114         ad.u.net->family = family;
5115         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5116                 return NF_DROP;
5117
5118         if (secmark_active)
5119                 if (avc_has_perm(peer_sid, skb->secmark,
5120                                  SECCLASS_PACKET, secmark_perm, &ad))
5121                         return NF_DROP_ERR(-ECONNREFUSED);
5122
5123         if (peerlbl_active) {
5124                 u32 if_sid;
5125                 u32 node_sid;
5126
5127                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5128                         return NF_DROP;
5129                 if (avc_has_perm(peer_sid, if_sid,
5130                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5131                         return NF_DROP_ERR(-ECONNREFUSED);
5132
5133                 if (sel_netnode_sid(addrp, family, &node_sid))
5134                         return NF_DROP;
5135                 if (avc_has_perm(peer_sid, node_sid,
5136                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5137                         return NF_DROP_ERR(-ECONNREFUSED);
5138         }
5139
5140         return NF_ACCEPT;
5141 }
5142
5143 static unsigned int selinux_ipv4_postroute(void *priv,
5144                                            struct sk_buff *skb,
5145                                            const struct nf_hook_state *state)
5146 {
5147         return selinux_ip_postroute(skb, state->out, PF_INET);
5148 }
5149
5150 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5151 static unsigned int selinux_ipv6_postroute(void *priv,
5152                                            struct sk_buff *skb,
5153                                            const struct nf_hook_state *state)
5154 {
5155         return selinux_ip_postroute(skb, state->out, PF_INET6);
5156 }
5157 #endif  /* IPV6 */
5158
5159 #endif  /* CONFIG_NETFILTER */
5160
5161 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5162 {
5163         return selinux_nlmsg_perm(sk, skb);
5164 }
5165
5166 static int ipc_alloc_security(struct task_struct *task,
5167                               struct kern_ipc_perm *perm,
5168                               u16 sclass)
5169 {
5170         struct ipc_security_struct *isec;
5171         u32 sid;
5172
5173         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5174         if (!isec)
5175                 return -ENOMEM;
5176
5177         sid = task_sid(task);
5178         isec->sclass = sclass;
5179         isec->sid = sid;
5180         perm->security = isec;
5181
5182         return 0;
5183 }
5184
5185 static void ipc_free_security(struct kern_ipc_perm *perm)
5186 {
5187         struct ipc_security_struct *isec = perm->security;
5188         perm->security = NULL;
5189         kfree(isec);
5190 }
5191
5192 static int msg_msg_alloc_security(struct msg_msg *msg)
5193 {
5194         struct msg_security_struct *msec;
5195
5196         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5197         if (!msec)
5198                 return -ENOMEM;
5199
5200         msec->sid = SECINITSID_UNLABELED;
5201         msg->security = msec;
5202
5203         return 0;
5204 }
5205
5206 static void msg_msg_free_security(struct msg_msg *msg)
5207 {
5208         struct msg_security_struct *msec = msg->security;
5209
5210         msg->security = NULL;
5211         kfree(msec);
5212 }
5213
5214 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5215                         u32 perms)
5216 {
5217         struct ipc_security_struct *isec;
5218         struct common_audit_data ad;
5219         u32 sid = current_sid();
5220
5221         isec = ipc_perms->security;
5222
5223         ad.type = LSM_AUDIT_DATA_IPC;
5224         ad.u.ipc_id = ipc_perms->key;
5225
5226         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5227 }
5228
5229 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5230 {
5231         return msg_msg_alloc_security(msg);
5232 }
5233
5234 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5235 {
5236         msg_msg_free_security(msg);
5237 }
5238
5239 /* message queue security operations */
5240 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5241 {
5242         struct ipc_security_struct *isec;
5243         struct common_audit_data ad;
5244         u32 sid = current_sid();
5245         int rc;
5246
5247         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5248         if (rc)
5249                 return rc;
5250
5251         isec = msq->q_perm.security;
5252
5253         ad.type = LSM_AUDIT_DATA_IPC;
5254         ad.u.ipc_id = msq->q_perm.key;
5255
5256         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5257                           MSGQ__CREATE, &ad);
5258         if (rc) {
5259                 ipc_free_security(&msq->q_perm);
5260                 return rc;
5261         }
5262         return 0;
5263 }
5264
5265 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5266 {
5267         ipc_free_security(&msq->q_perm);
5268 }
5269
5270 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5271 {
5272         struct ipc_security_struct *isec;
5273         struct common_audit_data ad;
5274         u32 sid = current_sid();
5275
5276         isec = msq->q_perm.security;
5277
5278         ad.type = LSM_AUDIT_DATA_IPC;
5279         ad.u.ipc_id = msq->q_perm.key;
5280
5281         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5282                             MSGQ__ASSOCIATE, &ad);
5283 }
5284
5285 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5286 {
5287         int err;
5288         int perms;
5289
5290         switch (cmd) {
5291         case IPC_INFO:
5292         case MSG_INFO:
5293                 /* No specific object, just general system-wide information. */
5294                 return task_has_system(current, SYSTEM__IPC_INFO);
5295         case IPC_STAT:
5296         case MSG_STAT:
5297                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5298                 break;
5299         case IPC_SET:
5300                 perms = MSGQ__SETATTR;
5301                 break;
5302         case IPC_RMID:
5303                 perms = MSGQ__DESTROY;
5304                 break;
5305         default:
5306                 return 0;
5307         }
5308
5309         err = ipc_has_perm(&msq->q_perm, perms);
5310         return err;
5311 }
5312
5313 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5314 {
5315         struct ipc_security_struct *isec;
5316         struct msg_security_struct *msec;
5317         struct common_audit_data ad;
5318         u32 sid = current_sid();
5319         int rc;
5320
5321         isec = msq->q_perm.security;
5322         msec = msg->security;
5323
5324         /*
5325          * First time through, need to assign label to the message
5326          */
5327         if (msec->sid == SECINITSID_UNLABELED) {
5328                 /*
5329                  * Compute new sid based on current process and
5330                  * message queue this message will be stored in
5331                  */
5332                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5333                                              NULL, &msec->sid);
5334                 if (rc)
5335                         return rc;
5336         }
5337
5338         ad.type = LSM_AUDIT_DATA_IPC;
5339         ad.u.ipc_id = msq->q_perm.key;
5340
5341         /* Can this process write to the queue? */
5342         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5343                           MSGQ__WRITE, &ad);
5344         if (!rc)
5345                 /* Can this process send the message */
5346                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5347                                   MSG__SEND, &ad);
5348         if (!rc)
5349                 /* Can the message be put in the queue? */
5350                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5351                                   MSGQ__ENQUEUE, &ad);
5352
5353         return rc;
5354 }
5355
5356 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5357                                     struct task_struct *target,
5358                                     long type, int mode)
5359 {
5360         struct ipc_security_struct *isec;
5361         struct msg_security_struct *msec;
5362         struct common_audit_data ad;
5363         u32 sid = task_sid(target);
5364         int rc;
5365
5366         isec = msq->q_perm.security;
5367         msec = msg->security;
5368
5369         ad.type = LSM_AUDIT_DATA_IPC;
5370         ad.u.ipc_id = msq->q_perm.key;
5371
5372         rc = avc_has_perm(sid, isec->sid,
5373                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5374         if (!rc)
5375                 rc = avc_has_perm(sid, msec->sid,
5376                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5377         return rc;
5378 }
5379
5380 /* Shared Memory security operations */
5381 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5382 {
5383         struct ipc_security_struct *isec;
5384         struct common_audit_data ad;
5385         u32 sid = current_sid();
5386         int rc;
5387
5388         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5389         if (rc)
5390                 return rc;
5391
5392         isec = shp->shm_perm.security;
5393
5394         ad.type = LSM_AUDIT_DATA_IPC;
5395         ad.u.ipc_id = shp->shm_perm.key;
5396
5397         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5398                           SHM__CREATE, &ad);
5399         if (rc) {
5400                 ipc_free_security(&shp->shm_perm);
5401                 return rc;
5402         }
5403         return 0;
5404 }
5405
5406 static void selinux_shm_free_security(struct shmid_kernel *shp)
5407 {
5408         ipc_free_security(&shp->shm_perm);
5409 }
5410
5411 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5412 {
5413         struct ipc_security_struct *isec;
5414         struct common_audit_data ad;
5415         u32 sid = current_sid();
5416
5417         isec = shp->shm_perm.security;
5418
5419         ad.type = LSM_AUDIT_DATA_IPC;
5420         ad.u.ipc_id = shp->shm_perm.key;
5421
5422         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5423                             SHM__ASSOCIATE, &ad);
5424 }
5425
5426 /* Note, at this point, shp is locked down */
5427 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5428 {
5429         int perms;
5430         int err;
5431
5432         switch (cmd) {
5433         case IPC_INFO:
5434         case SHM_INFO:
5435                 /* No specific object, just general system-wide information. */
5436                 return task_has_system(current, SYSTEM__IPC_INFO);
5437         case IPC_STAT:
5438         case SHM_STAT:
5439                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5440                 break;
5441         case IPC_SET:
5442                 perms = SHM__SETATTR;
5443                 break;
5444         case SHM_LOCK:
5445         case SHM_UNLOCK:
5446                 perms = SHM__LOCK;
5447                 break;
5448         case IPC_RMID:
5449                 perms = SHM__DESTROY;
5450                 break;
5451         default:
5452                 return 0;
5453         }
5454
5455         err = ipc_has_perm(&shp->shm_perm, perms);
5456         return err;
5457 }
5458
5459 static int selinux_shm_shmat(struct shmid_kernel *shp,
5460                              char __user *shmaddr, int shmflg)
5461 {
5462         u32 perms;
5463
5464         if (shmflg & SHM_RDONLY)
5465                 perms = SHM__READ;
5466         else
5467                 perms = SHM__READ | SHM__WRITE;
5468
5469         return ipc_has_perm(&shp->shm_perm, perms);
5470 }
5471
5472 /* Semaphore security operations */
5473 static int selinux_sem_alloc_security(struct sem_array *sma)
5474 {
5475         struct ipc_security_struct *isec;
5476         struct common_audit_data ad;
5477         u32 sid = current_sid();
5478         int rc;
5479
5480         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5481         if (rc)
5482                 return rc;
5483
5484         isec = sma->sem_perm.security;
5485
5486         ad.type = LSM_AUDIT_DATA_IPC;
5487         ad.u.ipc_id = sma->sem_perm.key;
5488
5489         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5490                           SEM__CREATE, &ad);
5491         if (rc) {
5492                 ipc_free_security(&sma->sem_perm);
5493                 return rc;
5494         }
5495         return 0;
5496 }
5497
5498 static void selinux_sem_free_security(struct sem_array *sma)
5499 {
5500         ipc_free_security(&sma->sem_perm);
5501 }
5502
5503 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5504 {
5505         struct ipc_security_struct *isec;
5506         struct common_audit_data ad;
5507         u32 sid = current_sid();
5508
5509         isec = sma->sem_perm.security;
5510
5511         ad.type = LSM_AUDIT_DATA_IPC;
5512         ad.u.ipc_id = sma->sem_perm.key;
5513
5514         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5515                             SEM__ASSOCIATE, &ad);
5516 }
5517
5518 /* Note, at this point, sma is locked down */
5519 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5520 {
5521         int err;
5522         u32 perms;
5523
5524         switch (cmd) {
5525         case IPC_INFO:
5526         case SEM_INFO:
5527                 /* No specific object, just general system-wide information. */
5528                 return task_has_system(current, SYSTEM__IPC_INFO);
5529         case GETPID:
5530         case GETNCNT:
5531         case GETZCNT:
5532                 perms = SEM__GETATTR;
5533                 break;
5534         case GETVAL:
5535         case GETALL:
5536                 perms = SEM__READ;
5537                 break;
5538         case SETVAL:
5539         case SETALL:
5540                 perms = SEM__WRITE;
5541                 break;
5542         case IPC_RMID:
5543                 perms = SEM__DESTROY;
5544                 break;
5545         case IPC_SET:
5546                 perms = SEM__SETATTR;
5547                 break;
5548         case IPC_STAT:
5549         case SEM_STAT:
5550                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5551                 break;
5552         default:
5553                 return 0;
5554         }
5555
5556         err = ipc_has_perm(&sma->sem_perm, perms);
5557         return err;
5558 }
5559
5560 static int selinux_sem_semop(struct sem_array *sma,
5561                              struct sembuf *sops, unsigned nsops, int alter)
5562 {
5563         u32 perms;
5564
5565         if (alter)
5566                 perms = SEM__READ | SEM__WRITE;
5567         else
5568                 perms = SEM__READ;
5569
5570         return ipc_has_perm(&sma->sem_perm, perms);
5571 }
5572
5573 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5574 {
5575         u32 av = 0;
5576
5577         av = 0;
5578         if (flag & S_IRUGO)
5579                 av |= IPC__UNIX_READ;
5580         if (flag & S_IWUGO)
5581                 av |= IPC__UNIX_WRITE;
5582
5583         if (av == 0)
5584                 return 0;
5585
5586         return ipc_has_perm(ipcp, av);
5587 }
5588
5589 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5590 {
5591         struct ipc_security_struct *isec = ipcp->security;
5592         *secid = isec->sid;
5593 }
5594
5595 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5596 {
5597         if (inode)
5598                 inode_doinit_with_dentry(inode, dentry);
5599 }
5600
5601 static int selinux_getprocattr(struct task_struct *p,
5602                                char *name, char **value)
5603 {
5604         const struct task_security_struct *__tsec;
5605         u32 sid;
5606         int error;
5607         unsigned len;
5608
5609         if (current != p) {
5610                 error = current_has_perm(p, PROCESS__GETATTR);
5611                 if (error)
5612                         return error;
5613         }
5614
5615         rcu_read_lock();
5616         __tsec = __task_cred(p)->security;
5617
5618         if (!strcmp(name, "current"))
5619                 sid = __tsec->sid;
5620         else if (!strcmp(name, "prev"))
5621                 sid = __tsec->osid;
5622         else if (!strcmp(name, "exec"))
5623                 sid = __tsec->exec_sid;
5624         else if (!strcmp(name, "fscreate"))
5625                 sid = __tsec->create_sid;
5626         else if (!strcmp(name, "keycreate"))
5627                 sid = __tsec->keycreate_sid;
5628         else if (!strcmp(name, "sockcreate"))
5629                 sid = __tsec->sockcreate_sid;
5630         else
5631                 goto invalid;
5632         rcu_read_unlock();
5633
5634         if (!sid)
5635                 return 0;
5636
5637         error = security_sid_to_context(sid, value, &len);
5638         if (error)
5639                 return error;
5640         return len;
5641
5642 invalid:
5643         rcu_read_unlock();
5644         return -EINVAL;
5645 }
5646
5647 static int selinux_setprocattr(struct task_struct *p,
5648                                char *name, void *value, size_t size)
5649 {
5650         struct task_security_struct *tsec;
5651         struct task_struct *tracer;
5652         struct cred *new;
5653         u32 sid = 0, ptsid;
5654         int error;
5655         char *str = value;
5656
5657         if (current != p) {
5658                 /* SELinux only allows a process to change its own
5659                    security attributes. */
5660                 return -EACCES;
5661         }
5662
5663         /*
5664          * Basic control over ability to set these attributes at all.
5665          * current == p, but we'll pass them separately in case the
5666          * above restriction is ever removed.
5667          */
5668         if (!strcmp(name, "exec"))
5669                 error = current_has_perm(p, PROCESS__SETEXEC);
5670         else if (!strcmp(name, "fscreate"))
5671                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5672         else if (!strcmp(name, "keycreate"))
5673                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5674         else if (!strcmp(name, "sockcreate"))
5675                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5676         else if (!strcmp(name, "current"))
5677                 error = current_has_perm(p, PROCESS__SETCURRENT);
5678         else
5679                 error = -EINVAL;
5680         if (error)
5681                 return error;
5682
5683         /* Obtain a SID for the context, if one was specified. */
5684         if (size && str[0] && str[0] != '\n') {
5685                 if (str[size-1] == '\n') {
5686                         str[size-1] = 0;
5687                         size--;
5688                 }
5689                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5690                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5691                         if (!capable(CAP_MAC_ADMIN)) {
5692                                 struct audit_buffer *ab;
5693                                 size_t audit_size;
5694
5695                                 /* We strip a nul only if it is at the end, otherwise the
5696                                  * context contains a nul and we should audit that */
5697                                 if (str[size - 1] == '\0')
5698                                         audit_size = size - 1;
5699                                 else
5700                                         audit_size = size;
5701                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5702                                 audit_log_format(ab, "op=fscreate invalid_context=");
5703                                 audit_log_n_untrustedstring(ab, value, audit_size);
5704                                 audit_log_end(ab);
5705
5706                                 return error;
5707                         }
5708                         error = security_context_to_sid_force(value, size,
5709                                                               &sid);
5710                 }
5711                 if (error)
5712                         return error;
5713         }
5714
5715         new = prepare_creds();
5716         if (!new)
5717                 return -ENOMEM;
5718
5719         /* Permission checking based on the specified context is
5720            performed during the actual operation (execve,
5721            open/mkdir/...), when we know the full context of the
5722            operation.  See selinux_bprm_set_creds for the execve
5723            checks and may_create for the file creation checks. The
5724            operation will then fail if the context is not permitted. */
5725         tsec = new->security;
5726         if (!strcmp(name, "exec")) {
5727                 tsec->exec_sid = sid;
5728         } else if (!strcmp(name, "fscreate")) {
5729                 tsec->create_sid = sid;
5730         } else if (!strcmp(name, "keycreate")) {
5731                 error = may_create_key(sid, p);
5732                 if (error)
5733                         goto abort_change;
5734                 tsec->keycreate_sid = sid;
5735         } else if (!strcmp(name, "sockcreate")) {
5736                 tsec->sockcreate_sid = sid;
5737         } else if (!strcmp(name, "current")) {
5738                 error = -EINVAL;
5739                 if (sid == 0)
5740                         goto abort_change;
5741
5742                 /* Only allow single threaded processes to change context */
5743                 error = -EPERM;
5744                 if (!current_is_single_threaded()) {
5745                         error = security_bounded_transition(tsec->sid, sid);
5746                         if (error)
5747                                 goto abort_change;
5748                 }
5749
5750                 /* Check permissions for the transition. */
5751                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5752                                      PROCESS__DYNTRANSITION, NULL);
5753                 if (error)
5754                         goto abort_change;
5755
5756                 /* Check for ptracing, and update the task SID if ok.
5757                    Otherwise, leave SID unchanged and fail. */
5758                 ptsid = 0;
5759                 rcu_read_lock();
5760                 tracer = ptrace_parent(p);
5761                 if (tracer)
5762                         ptsid = task_sid(tracer);
5763                 rcu_read_unlock();
5764
5765                 if (tracer) {
5766                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5767                                              PROCESS__PTRACE, NULL);
5768                         if (error)
5769                                 goto abort_change;
5770                 }
5771
5772                 tsec->sid = sid;
5773         } else {
5774                 error = -EINVAL;
5775                 goto abort_change;
5776         }
5777
5778         commit_creds(new);
5779         return size;
5780
5781 abort_change:
5782         abort_creds(new);
5783         return error;
5784 }
5785
5786 static int selinux_ismaclabel(const char *name)
5787 {
5788         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5789 }
5790
5791 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5792 {
5793         return security_sid_to_context(secid, secdata, seclen);
5794 }
5795
5796 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5797 {
5798         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5799 }
5800
5801 static void selinux_release_secctx(char *secdata, u32 seclen)
5802 {
5803         kfree(secdata);
5804 }
5805
5806 /*
5807  *      called with inode->i_mutex locked
5808  */
5809 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5810 {
5811         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5812 }
5813
5814 /*
5815  *      called with inode->i_mutex locked
5816  */
5817 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5818 {
5819         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5820 }
5821
5822 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5823 {
5824         int len = 0;
5825         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5826                                                 ctx, true);
5827         if (len < 0)
5828                 return len;
5829         *ctxlen = len;
5830         return 0;
5831 }
5832 #ifdef CONFIG_KEYS
5833
5834 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5835                              unsigned long flags)
5836 {
5837         const struct task_security_struct *tsec;
5838         struct key_security_struct *ksec;
5839
5840         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5841         if (!ksec)
5842                 return -ENOMEM;
5843
5844         tsec = cred->security;
5845         if (tsec->keycreate_sid)
5846                 ksec->sid = tsec->keycreate_sid;
5847         else
5848                 ksec->sid = tsec->sid;
5849
5850         k->security = ksec;
5851         return 0;
5852 }
5853
5854 static void selinux_key_free(struct key *k)
5855 {
5856         struct key_security_struct *ksec = k->security;
5857
5858         k->security = NULL;
5859         kfree(ksec);
5860 }
5861
5862 static int selinux_key_permission(key_ref_t key_ref,
5863                                   const struct cred *cred,
5864                                   unsigned perm)
5865 {
5866         struct key *key;
5867         struct key_security_struct *ksec;
5868         u32 sid;
5869
5870         /* if no specific permissions are requested, we skip the
5871            permission check. No serious, additional covert channels
5872            appear to be created. */
5873         if (perm == 0)
5874                 return 0;
5875
5876         sid = cred_sid(cred);
5877
5878         key = key_ref_to_ptr(key_ref);
5879         ksec = key->security;
5880
5881         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5882 }
5883
5884 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5885 {
5886         struct key_security_struct *ksec = key->security;
5887         char *context = NULL;
5888         unsigned len;
5889         int rc;
5890
5891         rc = security_sid_to_context(ksec->sid, &context, &len);
5892         if (!rc)
5893                 rc = len;
5894         *_buffer = context;
5895         return rc;
5896 }
5897
5898 #endif
5899
5900 static struct security_hook_list selinux_hooks[] = {
5901         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5902         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5903         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5904         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5905
5906         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5907         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5908         LSM_HOOK_INIT(capget, selinux_capget),
5909         LSM_HOOK_INIT(capset, selinux_capset),
5910         LSM_HOOK_INIT(capable, selinux_capable),
5911         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5912         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5913         LSM_HOOK_INIT(syslog, selinux_syslog),
5914         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5915
5916         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5917
5918         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5919         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5920         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5921         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5922
5923         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5924         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5925         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5926         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5927         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5928         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5929         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5930         LSM_HOOK_INIT(sb_mount, selinux_mount),
5931         LSM_HOOK_INIT(sb_umount, selinux_umount),
5932         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5933         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5934         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5935
5936         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5937
5938         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5939         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5940         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5941         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5942         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5943         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5944         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5945         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5946         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5947         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5948         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5949         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5950         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5951         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5952         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5953         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5954         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5955         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5956         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5957         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5958         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5959         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5960         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5961         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5962         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5963
5964         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5965         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5966         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5967         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5968         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5969         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5970         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5971         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5972         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5973         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5974         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5975         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5976
5977         LSM_HOOK_INIT(file_open, selinux_file_open),
5978
5979         LSM_HOOK_INIT(task_create, selinux_task_create),
5980         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5981         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5982         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5983         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5984         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5985         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5986         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5987         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5988         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5989         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5990         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5991         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5992         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5993         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5994         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5995         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5996         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5997         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5998         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5999         LSM_HOOK_INIT(task_wait, selinux_task_wait),
6000         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6001
6002         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6003         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6004
6005         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6006         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6007
6008         LSM_HOOK_INIT(msg_queue_alloc_security,
6009                         selinux_msg_queue_alloc_security),
6010         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6011         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6012         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6013         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6014         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6015
6016         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6017         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6018         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6019         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6020         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6021
6022         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6023         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6024         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6025         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6026         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6027
6028         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6029
6030         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6031         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6032
6033         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6034         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6035         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6036         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6037         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6038         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6039         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6040
6041         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6042         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6043
6044         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6045         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6046         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6047         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6048         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6049         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6050         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6051         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6052         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6053         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6054         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6055         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6056         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6057         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6058         LSM_HOOK_INIT(socket_getpeersec_stream,
6059                         selinux_socket_getpeersec_stream),
6060         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6061         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6062         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6063         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6064         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6065         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6066         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6067         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6068         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6069         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6070         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6071         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6072         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6073         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6074         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6075         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6076         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6077         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6078         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6079
6080 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6081         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6082         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6083         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6084         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6085         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6086         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6087                         selinux_xfrm_state_alloc_acquire),
6088         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6089         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6090         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6091         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6092                         selinux_xfrm_state_pol_flow_match),
6093         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6094 #endif
6095
6096 #ifdef CONFIG_KEYS
6097         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6098         LSM_HOOK_INIT(key_free, selinux_key_free),
6099         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6100         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6101 #endif
6102
6103 #ifdef CONFIG_AUDIT
6104         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6105         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6106         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6107         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6108 #endif
6109 };
6110
6111 static __init int selinux_init(void)
6112 {
6113         if (!security_module_enable("selinux")) {
6114                 selinux_enabled = 0;
6115                 return 0;
6116         }
6117
6118         if (!selinux_enabled) {
6119                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6120                 return 0;
6121         }
6122
6123         printk(KERN_INFO "SELinux:  Initializing.\n");
6124
6125         /* Set the security state for the initial task. */
6126         cred_init_security();
6127
6128         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6129
6130         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6131                                             sizeof(struct inode_security_struct),
6132                                             0, SLAB_PANIC, NULL);
6133         file_security_cache = kmem_cache_create("selinux_file_security",
6134                                             sizeof(struct file_security_struct),
6135                                             0, SLAB_PANIC, NULL);
6136         avc_init();
6137
6138         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6139
6140         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6141                 panic("SELinux: Unable to register AVC netcache callback\n");
6142
6143         if (selinux_enforcing)
6144                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6145         else
6146                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6147
6148         return 0;
6149 }
6150
6151 static void delayed_superblock_init(struct super_block *sb, void *unused)
6152 {
6153         superblock_doinit(sb, NULL);
6154 }
6155
6156 void selinux_complete_init(void)
6157 {
6158         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6159
6160         /* Set up any superblocks initialized prior to the policy load. */
6161         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6162         iterate_supers(delayed_superblock_init, NULL);
6163 }
6164
6165 /* SELinux requires early initialization in order to label
6166    all processes and objects when they are created. */
6167 security_initcall(selinux_init);
6168
6169 #if defined(CONFIG_NETFILTER)
6170
6171 static struct nf_hook_ops selinux_nf_ops[] = {
6172         {
6173                 .hook =         selinux_ipv4_postroute,
6174                 .pf =           NFPROTO_IPV4,
6175                 .hooknum =      NF_INET_POST_ROUTING,
6176                 .priority =     NF_IP_PRI_SELINUX_LAST,
6177         },
6178         {
6179                 .hook =         selinux_ipv4_forward,
6180                 .pf =           NFPROTO_IPV4,
6181                 .hooknum =      NF_INET_FORWARD,
6182                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6183         },
6184         {
6185                 .hook =         selinux_ipv4_output,
6186                 .pf =           NFPROTO_IPV4,
6187                 .hooknum =      NF_INET_LOCAL_OUT,
6188                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6189         },
6190 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6191         {
6192                 .hook =         selinux_ipv6_postroute,
6193                 .pf =           NFPROTO_IPV6,
6194                 .hooknum =      NF_INET_POST_ROUTING,
6195                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6196         },
6197         {
6198                 .hook =         selinux_ipv6_forward,
6199                 .pf =           NFPROTO_IPV6,
6200                 .hooknum =      NF_INET_FORWARD,
6201                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6202         },
6203 #endif  /* IPV6 */
6204 };
6205
6206 static int __init selinux_nf_ip_init(void)
6207 {
6208         int err;
6209
6210         if (!selinux_enabled)
6211                 return 0;
6212
6213         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6214
6215         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6216         if (err)
6217                 panic("SELinux: nf_register_hooks: error %d\n", err);
6218
6219         return 0;
6220 }
6221
6222 __initcall(selinux_nf_ip_init);
6223
6224 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6225 static void selinux_nf_ip_exit(void)
6226 {
6227         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6228
6229         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6230 }
6231 #endif
6232
6233 #else /* CONFIG_NETFILTER */
6234
6235 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6236 #define selinux_nf_ip_exit()
6237 #endif
6238
6239 #endif /* CONFIG_NETFILTER */
6240
6241 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6242 static int selinux_disabled;
6243
6244 int selinux_disable(void)
6245 {
6246         if (ss_initialized) {
6247                 /* Not permitted after initial policy load. */
6248                 return -EINVAL;
6249         }
6250
6251         if (selinux_disabled) {
6252                 /* Only do this once. */
6253                 return -EINVAL;
6254         }
6255
6256         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6257
6258         selinux_disabled = 1;
6259         selinux_enabled = 0;
6260
6261         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6262
6263         /* Try to destroy the avc node cache */
6264         avc_disable();
6265
6266         /* Unregister netfilter hooks. */
6267         selinux_nf_ip_exit();
6268
6269         /* Unregister selinuxfs. */
6270         exit_sel_fs();
6271
6272         return 0;
6273 }
6274 #endif