git.oblomov.eu Git - linux-2.6/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
  16  *                     Paul Moore, <paul.moore@hp.com>
  17  *
  18  *      This program is free software; you can redistribute it and/or modify
  19  *      it under the terms of the GNU General Public License version 2,
  20  *      as published by the Free Software Foundation.
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/kernel.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/errno.h>
  28 #include <linux/sched.h>
  29 #include <linux/security.h>
  30 #include <linux/xattr.h>
  31 #include <linux/capability.h>
  32 #include <linux/unistd.h>
  33 #include <linux/mm.h>
  34 #include <linux/mman.h>
  35 #include <linux/slab.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/swap.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/dccp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72 #include <linux/selinux.h>
  73 #include <linux/mutex.h>
  74
  75 #include "avc.h"
  76 #include "objsec.h"
  77 #include "netif.h"
  78 #include "xfrm.h"
  79 #include "netlabel.h"
  80
  81 #define XATTR_SELINUX_SUFFIX "selinux"
  82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  83
  84 extern unsigned int policydb_loaded_version;
  85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  86 extern int selinux_compat_net;
  87
  88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  89 int selinux_enforcing = 0;
  90
  91 static int __init enforcing_setup(char *str)
  92 {
  93         selinux_enforcing = simple_strtol(str,NULL,0);
  94         return 1;
  95 }
  96 __setup("enforcing=", enforcing_setup);
  97 #endif
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 101
 102 static int __init selinux_enabled_setup(char *str)
 103 {
 104         selinux_enabled = simple_strtol(str, NULL, 0);
 105         return 1;
 106 }
 107 __setup("selinux=", selinux_enabled_setup);
 108 #else
 109 int selinux_enabled = 1;
 110 #endif
 111
 112 /* Original (dummy) security module. */
 113 static struct security_operations *original_ops = NULL;
 114
 115 /* Minimal support for a secondary security module,
 116    just to allow the use of the dummy or capability modules.
 117    The owlsm module can alternatively be used as a secondary
 118    module as long as CONFIG_OWLSM_FD is not enabled. */
 119 static struct security_operations *secondary_ops = NULL;
 120
 121 /* Lists of inode and superblock security structures initialized
 122    before the policy was loaded. */
 123 static LIST_HEAD(superblock_security_head);
 124 static DEFINE_SPINLOCK(sb_security_lock);
 125
 126 static struct kmem_cache *sel_inode_cache;
 127
 128 /* Return security context for a given sid or just the context
 129    length if the buffer is null or length is 0 */
 130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 131 {
 132         char *context;
 133         unsigned len;
 134         int rc;
 135
 136         rc = security_sid_to_context(sid, &context, &len);
 137         if (rc)
 138                 return rc;
 139
 140         if (!buffer || !size)
 141                 goto getsecurity_exit;
 142
 143         if (size < len) {
 144                 len = -ERANGE;
 145                 goto getsecurity_exit;
 146         }
 147         memcpy(buffer, context, len);
 148
 149 getsecurity_exit:
 150         kfree(context);
 151         return len;
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_context = 1,
 320         Opt_fscontext = 2,
 321         Opt_defcontext = 4,
 322         Opt_rootcontext = 8,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329         {Opt_rootcontext, "rootcontext=%s"},
 330 };
 331
 332 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 333
 334 static int may_context_mount_sb_relabel(u32 sid,
 335                         struct superblock_security_struct *sbsec,
 336                         struct task_security_struct *tsec)
 337 {
 338         int rc;
 339
 340         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 341                           FILESYSTEM__RELABELFROM, NULL);
 342         if (rc)
 343                 return rc;
 344
 345         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELTO, NULL);
 347         return rc;
 348 }
 349
 350 static int may_context_mount_inode_relabel(u32 sid,
 351                         struct superblock_security_struct *sbsec,
 352                         struct task_security_struct *tsec)
 353 {
 354         int rc;
 355         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 356                           FILESYSTEM__RELABELFROM, NULL);
 357         if (rc)
 358                 return rc;
 359
 360         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 361                           FILESYSTEM__ASSOCIATE, NULL);
 362         return rc;
 363 }
 364
 365 static int try_context_mount(struct super_block *sb, void *data)
 366 {
 367         char *context = NULL, *defcontext = NULL;
 368         char *fscontext = NULL, *rootcontext = NULL;
 369         const char *name;
 370         u32 sid;
 371         int alloc = 0, rc = 0, seen = 0;
 372         struct task_security_struct *tsec = current->security;
 373         struct superblock_security_struct *sbsec = sb->s_security;
 374
 375         if (!data)
 376                 goto out;
 377
 378         name = sb->s_type->name;
 379
 380         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 381
 382                 /* NFS we understand. */
 383                 if (!strcmp(name, "nfs")) {
 384                         struct nfs_mount_data *d = data;
 385
 386                         if (d->version <  NFS_MOUNT_VERSION)
 387                                 goto out;
 388
 389                         if (d->context[0]) {
 390                                 context = d->context;
 391                                 seen |= Opt_context;
 392                         }
 393                 } else
 394                         goto out;
 395
 396         } else {
 397                 /* Standard string-based options. */
 398                 char *p, *options = data;
 399
 400                 while ((p = strsep(&options, "|")) != NULL) {
 401                         int token;
 402                         substring_t args[MAX_OPT_ARGS];
 403
 404                         if (!*p)
 405                                 continue;
 406
 407                         token = match_token(p, tokens, args);
 408
 409                         switch (token) {
 410                         case Opt_context:
 411                                 if (seen & (Opt_context|Opt_defcontext)) {
 412                                         rc = -EINVAL;
 413                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 414                                         goto out_free;
 415                                 }
 416                                 context = match_strdup(&args[0]);
 417                                 if (!context) {
 418                                         rc = -ENOMEM;
 419                                         goto out_free;
 420                                 }
 421                                 if (!alloc)
 422                                         alloc = 1;
 423                                 seen |= Opt_context;
 424                                 break;
 425
 426                         case Opt_fscontext:
 427                                 if (seen & Opt_fscontext) {
 428                                         rc = -EINVAL;
 429                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 430                                         goto out_free;
 431                                 }
 432                                 fscontext = match_strdup(&args[0]);
 433                                 if (!fscontext) {
 434                                         rc = -ENOMEM;
 435                                         goto out_free;
 436                                 }
 437                                 if (!alloc)
 438                                         alloc = 1;
 439                                 seen |= Opt_fscontext;
 440                                 break;
 441
 442                         case Opt_rootcontext:
 443                                 if (seen & Opt_rootcontext) {
 444                                         rc = -EINVAL;
 445                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 446                                         goto out_free;
 447                                 }
 448                                 rootcontext = match_strdup(&args[0]);
 449                                 if (!rootcontext) {
 450                                         rc = -ENOMEM;
 451                                         goto out_free;
 452                                 }
 453                                 if (!alloc)
 454                                         alloc = 1;
 455                                 seen |= Opt_rootcontext;
 456                                 break;
 457
 458                         case Opt_defcontext:
 459                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 460                                         rc = -EINVAL;
 461                                         printk(KERN_WARNING "SELinux:  "
 462                                                "defcontext option is invalid "
 463                                                "for this filesystem type\n");
 464                                         goto out_free;
 465                                 }
 466                                 if (seen & (Opt_context|Opt_defcontext)) {
 467                                         rc = -EINVAL;
 468                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 469                                         goto out_free;
 470                                 }
 471                                 defcontext = match_strdup(&args[0]);
 472                                 if (!defcontext) {
 473                                         rc = -ENOMEM;
 474                                         goto out_free;
 475                                 }
 476                                 if (!alloc)
 477                                         alloc = 1;
 478                                 seen |= Opt_defcontext;
 479                                 break;
 480
 481                         default:
 482                                 rc = -EINVAL;
 483                                 printk(KERN_WARNING "SELinux:  unknown mount "
 484                                        "option\n");
 485                                 goto out_free;
 486
 487                         }
 488                 }
 489         }
 490
 491         if (!seen)
 492                 goto out;
 493
 494         /* sets the context of the superblock for the fs being mounted. */
 495         if (fscontext) {
 496                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 497                 if (rc) {
 498                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 499                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 500                                fscontext, sb->s_id, name, rc);
 501                         goto out_free;
 502                 }
 503
 504                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 505                 if (rc)
 506                         goto out_free;
 507
 508                 sbsec->sid = sid;
 509         }
 510
 511         /*
 512          * Switch to using mount point labeling behavior.
 513          * sets the label used on all file below the mountpoint, and will set
 514          * the superblock context if not already set.
 515          */
 516         if (context) {
 517                 rc = security_context_to_sid(context, strlen(context), &sid);
 518                 if (rc) {
 519                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 520                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 521                                context, sb->s_id, name, rc);
 522                         goto out_free;
 523                 }
 524
 525                 if (!fscontext) {
 526                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 527                         if (rc)
 528                                 goto out_free;
 529                         sbsec->sid = sid;
 530                 } else {
 531                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 532                         if (rc)
 533                                 goto out_free;
 534                 }
 535                 sbsec->mntpoint_sid = sid;
 536
 537                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 538         }
 539
 540         if (rootcontext) {
 541                 struct inode *inode = sb->s_root->d_inode;
 542                 struct inode_security_struct *isec = inode->i_security;
 543                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 544                 if (rc) {
 545                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 546                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 547                                rootcontext, sb->s_id, name, rc);
 548                         goto out_free;
 549                 }
 550
 551                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 552                 if (rc)
 553                         goto out_free;
 554
 555                 isec->sid = sid;
 556                 isec->initialized = 1;
 557         }
 558
 559         if (defcontext) {
 560                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 561                 if (rc) {
 562                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 563                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 564                                defcontext, sb->s_id, name, rc);
 565                         goto out_free;
 566                 }
 567
 568                 if (sid == sbsec->def_sid)
 569                         goto out_free;
 570
 571                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 572                 if (rc)
 573                         goto out_free;
 574
 575                 sbsec->def_sid = sid;
 576         }
 577
 578 out_free:
 579         if (alloc) {
 580                 kfree(context);
 581                 kfree(defcontext);
 582                 kfree(fscontext);
 583                 kfree(rootcontext);
 584         }
 585 out:
 586         return rc;
 587 }
 588
 589 static int superblock_doinit(struct super_block *sb, void *data)
 590 {
 591         struct superblock_security_struct *sbsec = sb->s_security;
 592         struct dentry *root = sb->s_root;
 593         struct inode *inode = root->d_inode;
 594         int rc = 0;
 595
 596         mutex_lock(&sbsec->lock);
 597         if (sbsec->initialized)
 598                 goto out;
 599
 600         if (!ss_initialized) {
 601                 /* Defer initialization until selinux_complete_init,
 602                    after the initial policy is loaded and the security
 603                    server is ready to handle calls. */
 604                 spin_lock(&sb_security_lock);
 605                 if (list_empty(&sbsec->list))
 606                         list_add(&sbsec->list, &superblock_security_head);
 607                 spin_unlock(&sb_security_lock);
 608                 goto out;
 609         }
 610
 611         /* Determine the labeling behavior to use for this filesystem type. */
 612         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 613         if (rc) {
 614                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 615                        __FUNCTION__, sb->s_type->name, rc);
 616                 goto out;
 617         }
 618
 619         rc = try_context_mount(sb, data);
 620         if (rc)
 621                 goto out;
 622
 623         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 624                 /* Make sure that the xattr handler exists and that no
 625                    error other than -ENODATA is returned by getxattr on
 626                    the root directory.  -ENODATA is ok, as this may be
 627                    the first boot of the SELinux kernel before we have
 628                    assigned xattr values to the filesystem. */
 629                 if (!inode->i_op->getxattr) {
 630                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 631                                "xattr support\n", sb->s_id, sb->s_type->name);
 632                         rc = -EOPNOTSUPP;
 633                         goto out;
 634                 }
 635                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 636                 if (rc < 0 && rc != -ENODATA) {
 637                         if (rc == -EOPNOTSUPP)
 638                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 639                                        "%s) has no security xattr handler\n",
 640                                        sb->s_id, sb->s_type->name);
 641                         else
 642                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 643                                        "%s) getxattr errno %d\n", sb->s_id,
 644                                        sb->s_type->name, -rc);
 645                         goto out;
 646                 }
 647         }
 648
 649         if (strcmp(sb->s_type->name, "proc") == 0)
 650                 sbsec->proc = 1;
 651
 652         sbsec->initialized = 1;
 653
 654         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 655                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 656                        sb->s_id, sb->s_type->name);
 657         }
 658         else {
 659                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 660                        sb->s_id, sb->s_type->name,
 661                        labeling_behaviors[sbsec->behavior-1]);
 662         }
 663
 664         /* Initialize the root inode. */
 665         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 666
 667         /* Initialize any other inodes associated with the superblock, e.g.
 668            inodes created prior to initial policy load or inodes created
 669            during get_sb by a pseudo filesystem that directly
 670            populates itself. */
 671         spin_lock(&sbsec->isec_lock);
 672 next_inode:
 673         if (!list_empty(&sbsec->isec_head)) {
 674                 struct inode_security_struct *isec =
 675                                 list_entry(sbsec->isec_head.next,
 676                                            struct inode_security_struct, list);
 677                 struct inode *inode = isec->inode;
 678                 spin_unlock(&sbsec->isec_lock);
 679                 inode = igrab(inode);
 680                 if (inode) {
 681                         if (!IS_PRIVATE (inode))
 682                                 inode_doinit(inode);
 683                         iput(inode);
 684                 }
 685                 spin_lock(&sbsec->isec_lock);
 686                 list_del_init(&isec->list);
 687                 goto next_inode;
 688         }
 689         spin_unlock(&sbsec->isec_lock);
 690 out:
 691         mutex_unlock(&sbsec->lock);
 692         return rc;
 693 }
 694
 695 static inline u16 inode_mode_to_security_class(umode_t mode)
 696 {
 697         switch (mode & S_IFMT) {
 698         case S_IFSOCK:
 699                 return SECCLASS_SOCK_FILE;
 700         case S_IFLNK:
 701                 return SECCLASS_LNK_FILE;
 702         case S_IFREG:
 703                 return SECCLASS_FILE;
 704         case S_IFBLK:
 705                 return SECCLASS_BLK_FILE;
 706         case S_IFDIR:
 707                 return SECCLASS_DIR;
 708         case S_IFCHR:
 709                 return SECCLASS_CHR_FILE;
 710         case S_IFIFO:
 711                 return SECCLASS_FIFO_FILE;
 712
 713         }
 714
 715         return SECCLASS_FILE;
 716 }
 717
 718 static inline int default_protocol_stream(int protocol)
 719 {
 720         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 721 }
 722
 723 static inline int default_protocol_dgram(int protocol)
 724 {
 725         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 726 }
 727
 728 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 729 {
 730         switch (family) {
 731         case PF_UNIX:
 732                 switch (type) {
 733                 case SOCK_STREAM:
 734                 case SOCK_SEQPACKET:
 735                         return SECCLASS_UNIX_STREAM_SOCKET;
 736                 case SOCK_DGRAM:
 737                         return SECCLASS_UNIX_DGRAM_SOCKET;
 738                 }
 739                 break;
 740         case PF_INET:
 741         case PF_INET6:
 742                 switch (type) {
 743                 case SOCK_STREAM:
 744                         if (default_protocol_stream(protocol))
 745                                 return SECCLASS_TCP_SOCKET;
 746                         else
 747                                 return SECCLASS_RAWIP_SOCKET;
 748                 case SOCK_DGRAM:
 749                         if (default_protocol_dgram(protocol))
 750                                 return SECCLASS_UDP_SOCKET;
 751                         else
 752                                 return SECCLASS_RAWIP_SOCKET;
 753                 case SOCK_DCCP:
 754                         return SECCLASS_DCCP_SOCKET;
 755                 default:
 756                         return SECCLASS_RAWIP_SOCKET;
 757                 }
 758                 break;
 759         case PF_NETLINK:
 760                 switch (protocol) {
 761                 case NETLINK_ROUTE:
 762                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 763                 case NETLINK_FIREWALL:
 764                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 765                 case NETLINK_INET_DIAG:
 766                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 767                 case NETLINK_NFLOG:
 768                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 769                 case NETLINK_XFRM:
 770                         return SECCLASS_NETLINK_XFRM_SOCKET;
 771                 case NETLINK_SELINUX:
 772                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 773                 case NETLINK_AUDIT:
 774                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 775                 case NETLINK_IP6_FW:
 776                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 777                 case NETLINK_DNRTMSG:
 778                         return SECCLASS_NETLINK_DNRT_SOCKET;
 779                 case NETLINK_KOBJECT_UEVENT:
 780                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 781                 default:
 782                         return SECCLASS_NETLINK_SOCKET;
 783                 }
 784         case PF_PACKET:
 785                 return SECCLASS_PACKET_SOCKET;
 786         case PF_KEY:
 787                 return SECCLASS_KEY_SOCKET;
 788         case PF_APPLETALK:
 789                 return SECCLASS_APPLETALK_SOCKET;
 790         }
 791
 792         return SECCLASS_SOCKET;
 793 }
 794
 795 #ifdef CONFIG_PROC_FS
 796 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 797                                 u16 tclass,
 798                                 u32 *sid)
 799 {
 800         int buflen, rc;
 801         char *buffer, *path, *end;
 802
 803         buffer = (char*)__get_free_page(GFP_KERNEL);
 804         if (!buffer)
 805                 return -ENOMEM;
 806
 807         buflen = PAGE_SIZE;
 808         end = buffer+buflen;
 809         *--end = '\0';
 810         buflen--;
 811         path = end-1;
 812         *path = '/';
 813         while (de && de != de->parent) {
 814                 buflen -= de->namelen + 1;
 815                 if (buflen < 0)
 816                         break;
 817                 end -= de->namelen;
 818                 memcpy(end, de->name, de->namelen);
 819                 *--end = '/';
 820                 path = end;
 821                 de = de->parent;
 822         }
 823         rc = security_genfs_sid("proc", path, tclass, sid);
 824         free_page((unsigned long)buffer);
 825         return rc;
 826 }
 827 #else
 828 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 829                                 u16 tclass,
 830                                 u32 *sid)
 831 {
 832         return -EINVAL;
 833 }
 834 #endif
 835
 836 /* The inode's security attributes must be initialized before first use. */
 837 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 838 {
 839         struct superblock_security_struct *sbsec = NULL;
 840         struct inode_security_struct *isec = inode->i_security;
 841         u32 sid;
 842         struct dentry *dentry;
 843 #define INITCONTEXTLEN 255
 844         char *context = NULL;
 845         unsigned len = 0;
 846         int rc = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         mutex_lock(&isec->lock);
 852         if (isec->initialized)
 853                 goto out_unlock;
 854
 855         sbsec = inode->i_sb->s_security;
 856         if (!sbsec->initialized) {
 857                 /* Defer initialization until selinux_complete_init,
 858                    after the initial policy is loaded and the security
 859                    server is ready to handle calls. */
 860                 spin_lock(&sbsec->isec_lock);
 861                 if (list_empty(&isec->list))
 862                         list_add(&isec->list, &sbsec->isec_head);
 863                 spin_unlock(&sbsec->isec_lock);
 864                 goto out_unlock;
 865         }
 866
 867         switch (sbsec->behavior) {
 868         case SECURITY_FS_USE_XATTR:
 869                 if (!inode->i_op->getxattr) {
 870                         isec->sid = sbsec->def_sid;
 871                         break;
 872                 }
 873
 874                 /* Need a dentry, since the xattr API requires one.
 875                    Life would be simpler if we could just pass the inode. */
 876                 if (opt_dentry) {
 877                         /* Called from d_instantiate or d_splice_alias. */
 878                         dentry = dget(opt_dentry);
 879                 } else {
 880                         /* Called from selinux_complete_init, try to find a dentry. */
 881                         dentry = d_find_alias(inode);
 882                 }
 883                 if (!dentry) {
 884                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 885                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 886                                inode->i_ino);
 887                         goto out_unlock;
 888                 }
 889
 890                 len = INITCONTEXTLEN;
 891                 context = kmalloc(len, GFP_KERNEL);
 892                 if (!context) {
 893                         rc = -ENOMEM;
 894                         dput(dentry);
 895                         goto out_unlock;
 896                 }
 897                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 898                                            context, len);
 899                 if (rc == -ERANGE) {
 900                         /* Need a larger buffer.  Query for the right size. */
 901                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 902                                                    NULL, 0);
 903                         if (rc < 0) {
 904                                 dput(dentry);
 905                                 goto out_unlock;
 906                         }
 907                         kfree(context);
 908                         len = rc;
 909                         context = kmalloc(len, GFP_KERNEL);
 910                         if (!context) {
 911                                 rc = -ENOMEM;
 912                                 dput(dentry);
 913                                 goto out_unlock;
 914                         }
 915                         rc = inode->i_op->getxattr(dentry,
 916                                                    XATTR_NAME_SELINUX,
 917                                                    context, len);
 918                 }
 919                 dput(dentry);
 920                 if (rc < 0) {
 921                         if (rc != -ENODATA) {
 922                                 printk(KERN_WARNING "%s:  getxattr returned "
 923                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 924                                        -rc, inode->i_sb->s_id, inode->i_ino);
 925                                 kfree(context);
 926                                 goto out_unlock;
 927                         }
 928                         /* Map ENODATA to the default file SID */
 929                         sid = sbsec->def_sid;
 930                         rc = 0;
 931                 } else {
 932                         rc = security_context_to_sid_default(context, rc, &sid,
 933                                                              sbsec->def_sid);
 934                         if (rc) {
 935                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 936                                        "returned %d for dev=%s ino=%ld\n",
 937                                        __FUNCTION__, context, -rc,
 938                                        inode->i_sb->s_id, inode->i_ino);
 939                                 kfree(context);
 940                                 /* Leave with the unlabeled SID */
 941                                 rc = 0;
 942                                 break;
 943                         }
 944                 }
 945                 kfree(context);
 946                 isec->sid = sid;
 947                 break;
 948         case SECURITY_FS_USE_TASK:
 949                 isec->sid = isec->task_sid;
 950                 break;
 951         case SECURITY_FS_USE_TRANS:
 952                 /* Default to the fs SID. */
 953                 isec->sid = sbsec->sid;
 954
 955                 /* Try to obtain a transition SID. */
 956                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 957                 rc = security_transition_sid(isec->task_sid,
 958                                              sbsec->sid,
 959                                              isec->sclass,
 960                                              &sid);
 961                 if (rc)
 962                         goto out_unlock;
 963                 isec->sid = sid;
 964                 break;
 965         case SECURITY_FS_USE_MNTPOINT:
 966                 isec->sid = sbsec->mntpoint_sid;
 967                 break;
 968         default:
 969                 /* Default to the fs superblock SID. */
 970                 isec->sid = sbsec->sid;
 971
 972                 if (sbsec->proc) {
 973                         struct proc_inode *proci = PROC_I(inode);
 974                         if (proci->pde) {
 975                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 976                                 rc = selinux_proc_get_sid(proci->pde,
 977                                                           isec->sclass,
 978                                                           &sid);
 979                                 if (rc)
 980                                         goto out_unlock;
 981                                 isec->sid = sid;
 982                         }
 983                 }
 984                 break;
 985         }
 986
 987         isec->initialized = 1;
 988
 989 out_unlock:
 990         mutex_unlock(&isec->lock);
 991 out:
 992         if (isec->sclass == SECCLASS_FILE)
 993                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 994         return rc;
 995 }
 996
 997 /* Convert a Linux signal to an access vector. */
 998 static inline u32 signal_to_av(int sig)
 999 {
1000         u32 perm = 0;
1001
1002         switch (sig) {
1003         case SIGCHLD:
1004                 /* Commonly granted from child to parent. */
1005                 perm = PROCESS__SIGCHLD;
1006                 break;
1007         case SIGKILL:
1008                 /* Cannot be caught or ignored */
1009                 perm = PROCESS__SIGKILL;
1010                 break;
1011         case SIGSTOP:
1012                 /* Cannot be caught or ignored */
1013                 perm = PROCESS__SIGSTOP;
1014                 break;
1015         default:
1016                 /* All other signals. */
1017                 perm = PROCESS__SIGNAL;
1018                 break;
1019         }
1020
1021         return perm;
1022 }
1023
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025    fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct *tsk1,
1027                          struct task_struct *tsk2,
1028                          u32 perms)
1029 {
1030         struct task_security_struct *tsec1, *tsec2;
1031
1032         tsec1 = tsk1->security;
1033         tsec2 = tsk2->security;
1034         return avc_has_perm(tsec1->sid, tsec2->sid,
1035                             SECCLASS_PROCESS, perms, NULL);
1036 }
1037
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct *tsk,
1040                                int cap)
1041 {
1042         struct task_security_struct *tsec;
1043         struct avc_audit_data ad;
1044
1045         tsec = tsk->security;
1046
1047         AVC_AUDIT_DATA_INIT(&ad,CAP);
1048         ad.tsk = tsk;
1049         ad.u.cap = cap;
1050
1051         return avc_has_perm(tsec->sid, tsec->sid,
1052                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053 }
1054
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct *tsk,
1057                            u32 perms)
1058 {
1059         struct task_security_struct *tsec;
1060
1061         tsec = tsk->security;
1062
1063         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064                             SECCLASS_SYSTEM, perms, NULL);
1065 }
1066
1067 /* Check whether a task has a particular permission to an inode.
1068    The 'adp' parameter is optional and allows other audit
1069    data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct *tsk,
1071                           struct inode *inode,
1072                           u32 perms,
1073                           struct avc_audit_data *adp)
1074 {
1075         struct task_security_struct *tsec;
1076         struct inode_security_struct *isec;
1077         struct avc_audit_data ad;
1078
1079         if (unlikely (IS_PRIVATE (inode)))
1080                 return 0;
1081
1082         tsec = tsk->security;
1083         isec = inode->i_security;
1084
1085         if (!adp) {
1086                 adp = &ad;
1087                 AVC_AUDIT_DATA_INIT(&ad, FS);
1088                 ad.u.fs.inode = inode;
1089         }
1090
1091         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092 }
1093
1094 /* Same as inode_has_perm, but pass explicit audit data containing
1095    the dentry to help the auditing code to more easily generate the
1096    pathname if needed. */
1097 static inline int dentry_has_perm(struct task_struct *tsk,
1098                                   struct vfsmount *mnt,
1099                                   struct dentry *dentry,
1100                                   u32 av)
1101 {
1102         struct inode *inode = dentry->d_inode;
1103         struct avc_audit_data ad;
1104         AVC_AUDIT_DATA_INIT(&ad,FS);
1105         ad.u.fs.mnt = mnt;
1106         ad.u.fs.dentry = dentry;
1107         return inode_has_perm(tsk, inode, av, &ad);
1108 }
1109
1110 /* Check whether a task can use an open file descriptor to
1111    access an inode in a given way.  Check access to the
1112    descriptor itself, and then use dentry_has_perm to
1113    check a particular permission to the file.
1114    Access to the descriptor is implicitly granted if it
1115    has the same SID as the process.  If av is zero, then
1116    access to the file is not checked, e.g. for cases
1117    where only the descriptor is affected like seek. */
1118 static int file_has_perm(struct task_struct *tsk,
1119                                 struct file *file,
1120                                 u32 av)
1121 {
1122         struct task_security_struct *tsec = tsk->security;
1123         struct file_security_struct *fsec = file->f_security;
1124         struct vfsmount *mnt = file->f_path.mnt;
1125         struct dentry *dentry = file->f_path.dentry;
1126         struct inode *inode = dentry->d_inode;
1127         struct avc_audit_data ad;
1128         int rc;
1129
1130         AVC_AUDIT_DATA_INIT(&ad, FS);
1131         ad.u.fs.mnt = mnt;
1132         ad.u.fs.dentry = dentry;
1133
1134         if (tsec->sid != fsec->sid) {
1135                 rc = avc_has_perm(tsec->sid, fsec->sid,
1136                                   SECCLASS_FD,
1137                                   FD__USE,
1138                                   &ad);
1139                 if (rc)
1140                         return rc;
1141         }
1142
1143         /* av is zero if only checking access to the descriptor. */
1144         if (av)
1145                 return inode_has_perm(tsk, inode, av, &ad);
1146
1147         return 0;
1148 }
1149
1150 /* Check whether a task can create a file. */
1151 static int may_create(struct inode *dir,
1152                       struct dentry *dentry,
1153                       u16 tclass)
1154 {
1155         struct task_security_struct *tsec;
1156         struct inode_security_struct *dsec;
1157         struct superblock_security_struct *sbsec;
1158         u32 newsid;
1159         struct avc_audit_data ad;
1160         int rc;
1161
1162         tsec = current->security;
1163         dsec = dir->i_security;
1164         sbsec = dir->i_sb->s_security;
1165
1166         AVC_AUDIT_DATA_INIT(&ad, FS);
1167         ad.u.fs.dentry = dentry;
1168
1169         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170                           DIR__ADD_NAME | DIR__SEARCH,
1171                           &ad);
1172         if (rc)
1173                 return rc;
1174
1175         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176                 newsid = tsec->create_sid;
1177         } else {
1178                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179                                              &newsid);
1180                 if (rc)
1181                         return rc;
1182         }
1183
1184         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185         if (rc)
1186                 return rc;
1187
1188         return avc_has_perm(newsid, sbsec->sid,
1189                             SECCLASS_FILESYSTEM,
1190                             FILESYSTEM__ASSOCIATE, &ad);
1191 }
1192
1193 /* Check whether a task can create a key. */
1194 static int may_create_key(u32 ksid,
1195                           struct task_struct *ctx)
1196 {
1197         struct task_security_struct *tsec;
1198
1199         tsec = ctx->security;
1200
1201         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202 }
1203
1204 #define MAY_LINK   0
1205 #define MAY_UNLINK 1
1206 #define MAY_RMDIR  2
1207
1208 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1209 static int may_link(struct inode *dir,
1210                     struct dentry *dentry,
1211                     int kind)
1212
1213 {
1214         struct task_security_struct *tsec;
1215         struct inode_security_struct *dsec, *isec;
1216         struct avc_audit_data ad;
1217         u32 av;
1218         int rc;
1219
1220         tsec = current->security;
1221         dsec = dir->i_security;
1222         isec = dentry->d_inode->i_security;
1223
1224         AVC_AUDIT_DATA_INIT(&ad, FS);
1225         ad.u.fs.dentry = dentry;
1226
1227         av = DIR__SEARCH;
1228         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230         if (rc)
1231                 return rc;
1232
1233         switch (kind) {
1234         case MAY_LINK:
1235                 av = FILE__LINK;
1236                 break;
1237         case MAY_UNLINK:
1238                 av = FILE__UNLINK;
1239                 break;
1240         case MAY_RMDIR:
1241                 av = DIR__RMDIR;
1242                 break;
1243         default:
1244                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1245                 return 0;
1246         }
1247
1248         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249         return rc;
1250 }
1251
1252 static inline int may_rename(struct inode *old_dir,
1253                              struct dentry *old_dentry,
1254                              struct inode *new_dir,
1255                              struct dentry *new_dentry)
1256 {
1257         struct task_security_struct *tsec;
1258         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259         struct avc_audit_data ad;
1260         u32 av;
1261         int old_is_dir, new_is_dir;
1262         int rc;
1263
1264         tsec = current->security;
1265         old_dsec = old_dir->i_security;
1266         old_isec = old_dentry->d_inode->i_security;
1267         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268         new_dsec = new_dir->i_security;
1269
1270         AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272         ad.u.fs.dentry = old_dentry;
1273         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275         if (rc)
1276                 return rc;
1277         rc = avc_has_perm(tsec->sid, old_isec->sid,
1278                           old_isec->sclass, FILE__RENAME, &ad);
1279         if (rc)
1280                 return rc;
1281         if (old_is_dir && new_dir != old_dir) {
1282                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283                                   old_isec->sclass, DIR__REPARENT, &ad);
1284                 if (rc)
1285                         return rc;
1286         }
1287
1288         ad.u.fs.dentry = new_dentry;
1289         av = DIR__ADD_NAME | DIR__SEARCH;
1290         if (new_dentry->d_inode)
1291                 av |= DIR__REMOVE_NAME;
1292         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293         if (rc)
1294                 return rc;
1295         if (new_dentry->d_inode) {
1296                 new_isec = new_dentry->d_inode->i_security;
1297                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299                                   new_isec->sclass,
1300                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301                 if (rc)
1302                         return rc;
1303         }
1304
1305         return 0;
1306 }
1307
1308 /* Check whether a task can perform a filesystem operation. */
1309 static int superblock_has_perm(struct task_struct *tsk,
1310                                struct super_block *sb,
1311                                u32 perms,
1312                                struct avc_audit_data *ad)
1313 {
1314         struct task_security_struct *tsec;
1315         struct superblock_security_struct *sbsec;
1316
1317         tsec = tsk->security;
1318         sbsec = sb->s_security;
1319         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320                             perms, ad);
1321 }
1322
1323 /* Convert a Linux mode and permission mask to an access vector. */
1324 static inline u32 file_mask_to_av(int mode, int mask)
1325 {
1326         u32 av = 0;
1327
1328         if ((mode & S_IFMT) != S_IFDIR) {
1329                 if (mask & MAY_EXEC)
1330                         av |= FILE__EXECUTE;
1331                 if (mask & MAY_READ)
1332                         av |= FILE__READ;
1333
1334                 if (mask & MAY_APPEND)
1335                         av |= FILE__APPEND;
1336                 else if (mask & MAY_WRITE)
1337                         av |= FILE__WRITE;
1338
1339         } else {
1340                 if (mask & MAY_EXEC)
1341                         av |= DIR__SEARCH;
1342                 if (mask & MAY_WRITE)
1343                         av |= DIR__WRITE;
1344                 if (mask & MAY_READ)
1345                         av |= DIR__READ;
1346         }
1347
1348         return av;
1349 }
1350
1351 /* Convert a Linux file to an access vector. */
1352 static inline u32 file_to_av(struct file *file)
1353 {
1354         u32 av = 0;
1355
1356         if (file->f_mode & FMODE_READ)
1357                 av |= FILE__READ;
1358         if (file->f_mode & FMODE_WRITE) {
1359                 if (file->f_flags & O_APPEND)
1360                         av |= FILE__APPEND;
1361                 else
1362                         av |= FILE__WRITE;
1363         }
1364
1365         return av;
1366 }
1367
1368 /* Hook functions begin here. */
1369
1370 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371 {
1372         struct task_security_struct *psec = parent->security;
1373         struct task_security_struct *csec = child->security;
1374         int rc;
1375
1376         rc = secondary_ops->ptrace(parent,child);
1377         if (rc)
1378                 return rc;
1379
1380         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381         /* Save the SID of the tracing process for later use in apply_creds. */
1382         if (!(child->ptrace & PT_PTRACED) && !rc)
1383                 csec->ptrace_sid = psec->sid;
1384         return rc;
1385 }
1386
1387 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389 {
1390         int error;
1391
1392         error = task_has_perm(current, target, PROCESS__GETCAP);
1393         if (error)
1394                 return error;
1395
1396         return secondary_ops->capget(target, effective, inheritable, permitted);
1397 }
1398
1399 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402         int error;
1403
1404         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405         if (error)
1406                 return error;
1407
1408         return task_has_perm(current, target, PROCESS__SETCAP);
1409 }
1410
1411 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414         secondary_ops->capset_set(target, effective, inheritable, permitted);
1415 }
1416
1417 static int selinux_capable(struct task_struct *tsk, int cap)
1418 {
1419         int rc;
1420
1421         rc = secondary_ops->capable(tsk, cap);
1422         if (rc)
1423                 return rc;
1424
1425         return task_has_capability(tsk,cap);
1426 }
1427
1428 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429 {
1430         int buflen, rc;
1431         char *buffer, *path, *end;
1432
1433         rc = -ENOMEM;
1434         buffer = (char*)__get_free_page(GFP_KERNEL);
1435         if (!buffer)
1436                 goto out;
1437
1438         buflen = PAGE_SIZE;
1439         end = buffer+buflen;
1440         *--end = '\0';
1441         buflen--;
1442         path = end-1;
1443         *path = '/';
1444         while (table) {
1445                 const char *name = table->procname;
1446                 size_t namelen = strlen(name);
1447                 buflen -= namelen + 1;
1448                 if (buflen < 0)
1449                         goto out_free;
1450                 end -= namelen;
1451                 memcpy(end, name, namelen);
1452                 *--end = '/';
1453                 path = end;
1454                 table = table->parent;
1455         }
1456         buflen -= 4;
1457         if (buflen < 0)
1458                 goto out_free;
1459         end -= 4;
1460         memcpy(end, "/sys", 4);
1461         path = end;
1462         rc = security_genfs_sid("proc", path, tclass, sid);
1463 out_free:
1464         free_page((unsigned long)buffer);
1465 out:
1466         return rc;
1467 }
1468
1469 static int selinux_sysctl(ctl_table *table, int op)
1470 {
1471         int error = 0;
1472         u32 av;
1473         struct task_security_struct *tsec;
1474         u32 tsid;
1475         int rc;
1476
1477         rc = secondary_ops->sysctl(table, op);
1478         if (rc)
1479                 return rc;
1480
1481         tsec = current->security;
1482
1483         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1485         if (rc) {
1486                 /* Default to the well-defined sysctl SID. */
1487                 tsid = SECINITSID_SYSCTL;
1488         }
1489
1490         /* The op values are "defined" in sysctl.c, thereby creating
1491          * a bad coupling between this module and sysctl.c */
1492         if(op == 001) {
1493                 error = avc_has_perm(tsec->sid, tsid,
1494                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1495         } else {
1496                 av = 0;
1497                 if (op & 004)
1498                         av |= FILE__READ;
1499                 if (op & 002)
1500                         av |= FILE__WRITE;
1501                 if (av)
1502                         error = avc_has_perm(tsec->sid, tsid,
1503                                              SECCLASS_FILE, av, NULL);
1504         }
1505
1506         return error;
1507 }
1508
1509 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510 {
1511         int rc = 0;
1512
1513         if (!sb)
1514                 return 0;
1515
1516         switch (cmds) {
1517                 case Q_SYNC:
1518                 case Q_QUOTAON:
1519                 case Q_QUOTAOFF:
1520                 case Q_SETINFO:
1521                 case Q_SETQUOTA:
1522                         rc = superblock_has_perm(current,
1523                                                  sb,
1524                                                  FILESYSTEM__QUOTAMOD, NULL);
1525                         break;
1526                 case Q_GETFMT:
1527                 case Q_GETINFO:
1528                 case Q_GETQUOTA:
1529                         rc = superblock_has_perm(current,
1530                                                  sb,
1531                                                  FILESYSTEM__QUOTAGET, NULL);
1532                         break;
1533                 default:
1534                         rc = 0;  /* let the kernel handle invalid cmds */
1535                         break;
1536         }
1537         return rc;
1538 }
1539
1540 static int selinux_quota_on(struct dentry *dentry)
1541 {
1542         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543 }
1544
1545 static int selinux_syslog(int type)
1546 {
1547         int rc;
1548
1549         rc = secondary_ops->syslog(type);
1550         if (rc)
1551                 return rc;
1552
1553         switch (type) {
1554                 case 3:         /* Read last kernel messages */
1555                 case 10:        /* Return size of the log buffer */
1556                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557                         break;
1558                 case 6:         /* Disable logging to console */
1559                 case 7:         /* Enable logging to console */
1560                 case 8:         /* Set level of messages printed to console */
1561                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562                         break;
1563                 case 0:         /* Close log */
1564                 case 1:         /* Open log */
1565                 case 2:         /* Read from log */
1566                 case 4:         /* Read/clear last kernel messages */
1567                 case 5:         /* Clear ring buffer */
1568                 default:
1569                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570                         break;
1571         }
1572         return rc;
1573 }
1574
1575 /*
1576  * Check that a process has enough memory to allocate a new virtual
1577  * mapping. 0 means there is enough memory for the allocation to
1578  * succeed and -ENOMEM implies there is not.
1579  *
1580  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581  * if the capability is granted, but __vm_enough_memory requires 1 if
1582  * the capability is granted.
1583  *
1584  * Do not audit the selinux permission check, as this is applied to all
1585  * processes that allocate mappings.
1586  */
1587 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1588 {
1589         int rc, cap_sys_admin = 0;
1590         struct task_security_struct *tsec = current->security;
1591
1592         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593         if (rc == 0)
1594                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595                                           SECCLASS_CAPABILITY,
1596                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1597                                           0,
1598                                           NULL);
1599
1600         if (rc == 0)
1601                 cap_sys_admin = 1;
1602
1603         return __vm_enough_memory(mm, pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610         struct bprm_security_struct *bsec;
1611
1612         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613         if (!bsec)
1614                 return -ENOMEM;
1615
1616         bsec->bprm = bprm;
1617         bsec->sid = SECINITSID_UNLABELED;
1618         bsec->set = 0;
1619
1620         bprm->security = bsec;
1621         return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626         struct task_security_struct *tsec;
1627         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628         struct inode_security_struct *isec;
1629         struct bprm_security_struct *bsec;
1630         u32 newsid;
1631         struct avc_audit_data ad;
1632         int rc;
1633
1634         rc = secondary_ops->bprm_set_security(bprm);
1635         if (rc)
1636                 return rc;
1637
1638         bsec = bprm->security;
1639
1640         if (bsec->set)
1641                 return 0;
1642
1643         tsec = current->security;
1644         isec = inode->i_security;
1645
1646         /* Default to the current task SID. */
1647         bsec->sid = tsec->sid;
1648
1649         /* Reset fs, key, and sock SIDs on execve. */
1650         tsec->create_sid = 0;
1651         tsec->keycreate_sid = 0;
1652         tsec->sockcreate_sid = 0;
1653
1654         if (tsec->exec_sid) {
1655                 newsid = tsec->exec_sid;
1656                 /* Reset exec SID on execve. */
1657                 tsec->exec_sid = 0;
1658         } else {
1659                 /* Check for a default transition on this program. */
1660                 rc = security_transition_sid(tsec->sid, isec->sid,
1661                                              SECCLASS_PROCESS, &newsid);
1662                 if (rc)
1663                         return rc;
1664         }
1665
1666         AVC_AUDIT_DATA_INIT(&ad, FS);
1667         ad.u.fs.mnt = bprm->file->f_path.mnt;
1668         ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671                 newsid = tsec->sid;
1672
1673         if (tsec->sid == newsid) {
1674                 rc = avc_has_perm(tsec->sid, isec->sid,
1675                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676                 if (rc)
1677                         return rc;
1678         } else {
1679                 /* Check permissions for the transition. */
1680                 rc = avc_has_perm(tsec->sid, newsid,
1681                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682                 if (rc)
1683                         return rc;
1684
1685                 rc = avc_has_perm(newsid, isec->sid,
1686                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687                 if (rc)
1688                         return rc;
1689
1690                 /* Clear any possibly unsafe personality bits on exec: */
1691                 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693                 /* Set the security field to the new SID. */
1694                 bsec->sid = newsid;
1695         }
1696
1697         bsec->set = 1;
1698         return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703         return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709         struct task_security_struct *tsec = current->security;
1710         int atsecure = 0;
1711
1712         if (tsec->osid != tsec->sid) {
1713                 /* Enable secure mode for SIDs transitions unless
1714                    the noatsecure permission is granted between
1715                    the two SIDs, i.e. ahp returns 0. */
1716                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717                                          SECCLASS_PROCESS,
1718                                          PROCESS__NOATSECURE, NULL);
1719         }
1720
1721         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726         kfree(bprm->security);
1727         bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736         struct avc_audit_data ad;
1737         struct file *file, *devnull = NULL;
1738         struct tty_struct *tty;
1739         struct fdtable *fdt;
1740         long j = -1;
1741         int drop_tty = 0;
1742
1743         mutex_lock(&tty_mutex);
1744         tty = get_current_tty();
1745         if (tty) {
1746                 file_list_lock();
1747                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748                 if (file) {
1749                         /* Revalidate access to controlling tty.
1750                            Use inode_has_perm on the tty inode directly rather
1751                            than using file_has_perm, as this particular open
1752                            file may belong to another process and we are only
1753                            interested in the inode-based check here. */
1754                         struct inode *inode = file->f_path.dentry->d_inode;
1755                         if (inode_has_perm(current, inode,
1756                                            FILE__READ | FILE__WRITE, NULL)) {
1757                                 drop_tty = 1;
1758                         }
1759                 }
1760                 file_list_unlock();
1761         }
1762         mutex_unlock(&tty_mutex);
1763         /* Reset controlling tty. */
1764         if (drop_tty)
1765                 no_tty();
1766
1767         /* Revalidate access to inherited open files. */
1768
1769         AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771         spin_lock(&files->file_lock);
1772         for (;;) {
1773                 unsigned long set, i;
1774                 int fd;
1775
1776                 j++;
1777                 i = j * __NFDBITS;
1778                 fdt = files_fdtable(files);
1779                 if (i >= fdt->max_fds)
1780                         break;
1781                 set = fdt->open_fds->fds_bits[j];
1782                 if (!set)
1783                         continue;
1784                 spin_unlock(&files->file_lock);
1785                 for ( ; set ; i++,set >>= 1) {
1786                         if (set & 1) {
1787                                 file = fget(i);
1788                                 if (!file)
1789                                         continue;
1790                                 if (file_has_perm(current,
1791                                                   file,
1792                                                   file_to_av(file))) {
1793                                         sys_close(i);
1794                                         fd = get_unused_fd();
1795                                         if (fd != i) {
1796                                                 if (fd >= 0)
1797                                                         put_unused_fd(fd);
1798                                                 fput(file);
1799                                                 continue;
1800                                         }
1801                                         if (devnull) {
1802                                                 get_file(devnull);
1803                                         } else {
1804                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1805                                                 if (IS_ERR(devnull)) {
1806                                                         devnull = NULL;
1807                                                         put_unused_fd(fd);
1808                                                         fput(file);
1809                                                         continue;
1810                                                 }
1811                                         }
1812                                         fd_install(fd, devnull);
1813                                 }
1814                                 fput(file);
1815                         }
1816                 }
1817                 spin_lock(&files->file_lock);
1818
1819         }
1820         spin_unlock(&files->file_lock);
1821 }
1822
1823 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824 {
1825         struct task_security_struct *tsec;
1826         struct bprm_security_struct *bsec;
1827         u32 sid;
1828         int rc;
1829
1830         secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832         tsec = current->security;
1833
1834         bsec = bprm->security;
1835         sid = bsec->sid;
1836
1837         tsec->osid = tsec->sid;
1838         bsec->unsafe = 0;
1839         if (tsec->sid != sid) {
1840                 /* Check for shared state.  If not ok, leave SID
1841                    unchanged and kill. */
1842                 if (unsafe & LSM_UNSAFE_SHARE) {
1843                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844                                         PROCESS__SHARE, NULL);
1845                         if (rc) {
1846                                 bsec->unsafe = 1;
1847                                 return;
1848                         }
1849                 }
1850
1851                 /* Check for ptracing, and update the task SID if ok.
1852                    Otherwise, leave SID unchanged and kill. */
1853                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1855                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1856                                           NULL);
1857                         if (rc) {
1858                                 bsec->unsafe = 1;
1859                                 return;
1860                         }
1861                 }
1862                 tsec->sid = sid;
1863         }
1864 }
1865
1866 /*
1867  * called after apply_creds without the task lock held
1868  */
1869 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870 {
1871         struct task_security_struct *tsec;
1872         struct rlimit *rlim, *initrlim;
1873         struct itimerval itimer;
1874         struct bprm_security_struct *bsec;
1875         int rc, i;
1876
1877         tsec = current->security;
1878         bsec = bprm->security;
1879
1880         if (bsec->unsafe) {
1881                 force_sig_specific(SIGKILL, current);
1882                 return;
1883         }
1884         if (tsec->osid == tsec->sid)
1885                 return;
1886
1887         /* Close files for which the new task SID is not authorized. */
1888         flush_unauthorized_files(current->files);
1889
1890         /* Check whether the new SID can inherit signal state
1891            from the old SID.  If not, clear itimers to avoid
1892            subsequent signal generation and flush and unblock
1893            signals. This must occur _after_ the task SID has
1894           been updated so that any kill done after the flush
1895           will be checked against the new SID. */
1896         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897                           PROCESS__SIGINH, NULL);
1898         if (rc) {
1899                 memset(&itimer, 0, sizeof itimer);
1900                 for (i = 0; i < 3; i++)
1901                         do_setitimer(i, &itimer, NULL);
1902                 flush_signals(current);
1903                 spin_lock_irq(&current->sighand->siglock);
1904                 flush_signal_handlers(current, 1);
1905                 sigemptyset(&current->blocked);
1906                 recalc_sigpending();
1907                 spin_unlock_irq(&current->sighand->siglock);
1908         }
1909
1910         /* Always clear parent death signal on SID transitions. */
1911         current->pdeath_signal = 0;
1912
1913         /* Check whether the new SID can inherit resource limits
1914            from the old SID.  If not, reset all soft limits to
1915            the lower of the current task's hard limit and the init
1916            task's soft limit.  Note that the setting of hard limits
1917            (even to lower them) can be controlled by the setrlimit
1918            check. The inclusion of the init task's soft limit into
1919            the computation is to avoid resetting soft limits higher
1920            than the default soft limit for cases where the default
1921            is lower than the hard limit, e.g. RLIMIT_CORE or
1922            RLIMIT_STACK.*/
1923         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1924                           PROCESS__RLIMITINH, NULL);
1925         if (rc) {
1926                 for (i = 0; i < RLIM_NLIMITS; i++) {
1927                         rlim = current->signal->rlim + i;
1928                         initrlim = init_task.signal->rlim+i;
1929                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1930                 }
1931                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1932                         /*
1933                          * This will cause RLIMIT_CPU calculations
1934                          * to be refigured.
1935                          */
1936                         current->it_prof_expires = jiffies_to_cputime(1);
1937                 }
1938         }
1939
1940         /* Wake up the parent if it is waiting so that it can
1941            recheck wait permission to the new task SID. */
1942         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1943 }
1944
1945 /* superblock security operations */
1946
1947 static int selinux_sb_alloc_security(struct super_block *sb)
1948 {
1949         return superblock_alloc_security(sb);
1950 }
1951
1952 static void selinux_sb_free_security(struct super_block *sb)
1953 {
1954         superblock_free_security(sb);
1955 }
1956
1957 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1958 {
1959         if (plen > olen)
1960                 return 0;
1961
1962         return !memcmp(prefix, option, plen);
1963 }
1964
1965 static inline int selinux_option(char *option, int len)
1966 {
1967         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1968                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1969                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1970                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1971 }
1972
1973 static inline void take_option(char **to, char *from, int *first, int len)
1974 {
1975         if (!*first) {
1976                 **to = ',';
1977                 *to += 1;
1978         } else
1979                 *first = 0;
1980         memcpy(*to, from, len);
1981         *to += len;
1982 }
1983
1984 static inline void take_selinux_option(char **to, char *from, int *first,
1985                                        int len)
1986 {
1987         int current_size = 0;
1988
1989         if (!*first) {
1990                 **to = '|';
1991                 *to += 1;
1992         }
1993         else
1994                 *first = 0;
1995
1996         while (current_size < len) {
1997                 if (*from != '"') {
1998                         **to = *from;
1999                         *to += 1;
2000                 }
2001                 from += 1;
2002                 current_size += 1;
2003         }
2004 }
2005
2006 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2007 {
2008         int fnosec, fsec, rc = 0;
2009         char *in_save, *in_curr, *in_end;
2010         char *sec_curr, *nosec_save, *nosec;
2011         int open_quote = 0;
2012
2013         in_curr = orig;
2014         sec_curr = copy;
2015
2016         /* Binary mount data: just copy */
2017         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2018                 copy_page(sec_curr, in_curr);
2019                 goto out;
2020         }
2021
2022         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2023         if (!nosec) {
2024                 rc = -ENOMEM;
2025                 goto out;
2026         }
2027
2028         nosec_save = nosec;
2029         fnosec = fsec = 1;
2030         in_save = in_end = orig;
2031
2032         do {
2033                 if (*in_end == '"')
2034                         open_quote = !open_quote;
2035                 if ((*in_end == ',' && open_quote == 0) ||
2036                                 *in_end == '\0') {
2037                         int len = in_end - in_curr;
2038
2039                         if (selinux_option(in_curr, len))
2040                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2041                         else
2042                                 take_option(&nosec, in_curr, &fnosec, len);
2043
2044                         in_curr = in_end + 1;
2045                 }
2046         } while (*in_end++);
2047
2048         strcpy(in_save, nosec_save);
2049         free_page((unsigned long)nosec_save);
2050 out:
2051         return rc;
2052 }
2053
2054 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2055 {
2056         struct avc_audit_data ad;
2057         int rc;
2058
2059         rc = superblock_doinit(sb, data);
2060         if (rc)
2061                 return rc;
2062
2063         AVC_AUDIT_DATA_INIT(&ad,FS);
2064         ad.u.fs.dentry = sb->s_root;
2065         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2066 }
2067
2068 static int selinux_sb_statfs(struct dentry *dentry)
2069 {
2070         struct avc_audit_data ad;
2071
2072         AVC_AUDIT_DATA_INIT(&ad,FS);
2073         ad.u.fs.dentry = dentry->d_sb->s_root;
2074         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2075 }
2076
2077 static int selinux_mount(char * dev_name,
2078                          struct nameidata *nd,
2079                          char * type,
2080                          unsigned long flags,
2081                          void * data)
2082 {
2083         int rc;
2084
2085         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2086         if (rc)
2087                 return rc;
2088
2089         if (flags & MS_REMOUNT)
2090                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2091                                            FILESYSTEM__REMOUNT, NULL);
2092         else
2093                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2094                                        FILE__MOUNTON);
2095 }
2096
2097 static int selinux_umount(struct vfsmount *mnt, int flags)
2098 {
2099         int rc;
2100
2101         rc = secondary_ops->sb_umount(mnt, flags);
2102         if (rc)
2103                 return rc;
2104
2105         return superblock_has_perm(current,mnt->mnt_sb,
2106                                    FILESYSTEM__UNMOUNT,NULL);
2107 }
2108
2109 /* inode security operations */
2110
2111 static int selinux_inode_alloc_security(struct inode *inode)
2112 {
2113         return inode_alloc_security(inode);
2114 }
2115
2116 static void selinux_inode_free_security(struct inode *inode)
2117 {
2118         inode_free_security(inode);
2119 }
2120
2121 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2122                                        char **name, void **value,
2123                                        size_t *len)
2124 {
2125         struct task_security_struct *tsec;
2126         struct inode_security_struct *dsec;
2127         struct superblock_security_struct *sbsec;
2128         u32 newsid, clen;
2129         int rc;
2130         char *namep = NULL, *context;
2131
2132         tsec = current->security;
2133         dsec = dir->i_security;
2134         sbsec = dir->i_sb->s_security;
2135
2136         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2137                 newsid = tsec->create_sid;
2138         } else {
2139                 rc = security_transition_sid(tsec->sid, dsec->sid,
2140                                              inode_mode_to_security_class(inode->i_mode),
2141                                              &newsid);
2142                 if (rc) {
2143                         printk(KERN_WARNING "%s:  "
2144                                "security_transition_sid failed, rc=%d (dev=%s "
2145                                "ino=%ld)\n",
2146                                __FUNCTION__,
2147                                -rc, inode->i_sb->s_id, inode->i_ino);
2148                         return rc;
2149                 }
2150         }
2151
2152         /* Possibly defer initialization to selinux_complete_init. */
2153         if (sbsec->initialized) {
2154                 struct inode_security_struct *isec = inode->i_security;
2155                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2156                 isec->sid = newsid;
2157                 isec->initialized = 1;
2158         }
2159
2160         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2161                 return -EOPNOTSUPP;
2162
2163         if (name) {
2164                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2165                 if (!namep)
2166                         return -ENOMEM;
2167                 *name = namep;
2168         }
2169
2170         if (value && len) {
2171                 rc = security_sid_to_context(newsid, &context, &clen);
2172                 if (rc) {
2173                         kfree(namep);
2174                         return rc;
2175                 }
2176                 *value = context;
2177                 *len = clen;
2178         }
2179
2180         return 0;
2181 }
2182
2183 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2184 {
2185         return may_create(dir, dentry, SECCLASS_FILE);
2186 }
2187
2188 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2189 {
2190         int rc;
2191
2192         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2193         if (rc)
2194                 return rc;
2195         return may_link(dir, old_dentry, MAY_LINK);
2196 }
2197
2198 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2199 {
2200         int rc;
2201
2202         rc = secondary_ops->inode_unlink(dir, dentry);
2203         if (rc)
2204                 return rc;
2205         return may_link(dir, dentry, MAY_UNLINK);
2206 }
2207
2208 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2209 {
2210         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2211 }
2212
2213 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2214 {
2215         return may_create(dir, dentry, SECCLASS_DIR);
2216 }
2217
2218 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2219 {
2220         return may_link(dir, dentry, MAY_RMDIR);
2221 }
2222
2223 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2224 {
2225         int rc;
2226
2227         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2228         if (rc)
2229                 return rc;
2230
2231         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2232 }
2233
2234 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2235                                 struct inode *new_inode, struct dentry *new_dentry)
2236 {
2237         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2238 }
2239
2240 static int selinux_inode_readlink(struct dentry *dentry)
2241 {
2242         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2243 }
2244
2245 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2246 {
2247         int rc;
2248
2249         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2250         if (rc)
2251                 return rc;
2252         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2253 }
2254
2255 static int selinux_inode_permission(struct inode *inode, int mask,
2256                                     struct nameidata *nd)
2257 {
2258         int rc;
2259
2260         rc = secondary_ops->inode_permission(inode, mask, nd);
2261         if (rc)
2262                 return rc;
2263
2264         if (!mask) {
2265                 /* No permission to check.  Existence test. */
2266                 return 0;
2267         }
2268
2269         return inode_has_perm(current, inode,
2270                                file_mask_to_av(inode->i_mode, mask), NULL);
2271 }
2272
2273 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2274 {
2275         int rc;
2276
2277         rc = secondary_ops->inode_setattr(dentry, iattr);
2278         if (rc)
2279                 return rc;
2280
2281         if (iattr->ia_valid & ATTR_FORCE)
2282                 return 0;
2283
2284         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2285                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2286                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2287
2288         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2289 }
2290
2291 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2292 {
2293         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2294 }
2295
2296 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2297 {
2298         struct task_security_struct *tsec = current->security;
2299         struct inode *inode = dentry->d_inode;
2300         struct inode_security_struct *isec = inode->i_security;
2301         struct superblock_security_struct *sbsec;
2302         struct avc_audit_data ad;
2303         u32 newsid;
2304         int rc = 0;
2305
2306         if (strcmp(name, XATTR_NAME_SELINUX)) {
2307                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2308                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2309                     !capable(CAP_SYS_ADMIN)) {
2310                         /* A different attribute in the security namespace.
2311                            Restrict to administrator. */
2312                         return -EPERM;
2313                 }
2314
2315                 /* Not an attribute we recognize, so just check the
2316                    ordinary setattr permission. */
2317                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2318         }
2319
2320         sbsec = inode->i_sb->s_security;
2321         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2322                 return -EOPNOTSUPP;
2323
2324         if (!is_owner_or_cap(inode))
2325                 return -EPERM;
2326
2327         AVC_AUDIT_DATA_INIT(&ad,FS);
2328         ad.u.fs.dentry = dentry;
2329
2330         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2331                           FILE__RELABELFROM, &ad);
2332         if (rc)
2333                 return rc;
2334
2335         rc = security_context_to_sid(value, size, &newsid);
2336         if (rc)
2337                 return rc;
2338
2339         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2340                           FILE__RELABELTO, &ad);
2341         if (rc)
2342                 return rc;
2343
2344         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2345                                           isec->sclass);
2346         if (rc)
2347                 return rc;
2348
2349         return avc_has_perm(newsid,
2350                             sbsec->sid,
2351                             SECCLASS_FILESYSTEM,
2352                             FILESYSTEM__ASSOCIATE,
2353                             &ad);
2354 }
2355
2356 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2357                                         void *value, size_t size, int flags)
2358 {
2359         struct inode *inode = dentry->d_inode;
2360         struct inode_security_struct *isec = inode->i_security;
2361         u32 newsid;
2362         int rc;
2363
2364         if (strcmp(name, XATTR_NAME_SELINUX)) {
2365                 /* Not an attribute we recognize, so nothing to do. */
2366                 return;
2367         }
2368
2369         rc = security_context_to_sid(value, size, &newsid);
2370         if (rc) {
2371                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2372                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2373                 return;
2374         }
2375
2376         isec->sid = newsid;
2377         return;
2378 }
2379
2380 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2381 {
2382         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2383 }
2384
2385 static int selinux_inode_listxattr (struct dentry *dentry)
2386 {
2387         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2388 }
2389
2390 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2391 {
2392         if (strcmp(name, XATTR_NAME_SELINUX)) {
2393                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2394                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2395                     !capable(CAP_SYS_ADMIN)) {
2396                         /* A different attribute in the security namespace.
2397                            Restrict to administrator. */
2398                         return -EPERM;
2399                 }
2400
2401                 /* Not an attribute we recognize, so just check the
2402                    ordinary setattr permission. Might want a separate
2403                    permission for removexattr. */
2404                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2405         }
2406
2407         /* No one is allowed to remove a SELinux security label.
2408            You can change the label, but all data must be labeled. */
2409         return -EACCES;
2410 }
2411
2412 static const char *selinux_inode_xattr_getsuffix(void)
2413 {
2414       return XATTR_SELINUX_SUFFIX;
2415 }
2416
2417 /*
2418  * Copy the in-core inode security context value to the user.  If the
2419  * getxattr() prior to this succeeded, check to see if we need to
2420  * canonicalize the value to be finally returned to the user.
2421  *
2422  * Permission check is handled by selinux_inode_getxattr hook.
2423  */
2424 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2425 {
2426         struct inode_security_struct *isec = inode->i_security;
2427
2428         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2429                 return -EOPNOTSUPP;
2430
2431         return selinux_getsecurity(isec->sid, buffer, size);
2432 }
2433
2434 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2435                                      const void *value, size_t size, int flags)
2436 {
2437         struct inode_security_struct *isec = inode->i_security;
2438         u32 newsid;
2439         int rc;
2440
2441         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2442                 return -EOPNOTSUPP;
2443
2444         if (!value || !size)
2445                 return -EACCES;
2446
2447         rc = security_context_to_sid((void*)value, size, &newsid);
2448         if (rc)
2449                 return rc;
2450
2451         isec->sid = newsid;
2452         return 0;
2453 }
2454
2455 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2456 {
2457         const int len = sizeof(XATTR_NAME_SELINUX);
2458         if (buffer && len <= buffer_size)
2459                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2460         return len;
2461 }
2462
2463 /* file security operations */
2464
2465 static int selinux_file_permission(struct file *file, int mask)
2466 {
2467         int rc;
2468         struct inode *inode = file->f_path.dentry->d_inode;
2469
2470         if (!mask) {
2471                 /* No permission to check.  Existence test. */
2472                 return 0;
2473         }
2474
2475         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2476         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2477                 mask |= MAY_APPEND;
2478
2479         rc = file_has_perm(current, file,
2480                            file_mask_to_av(inode->i_mode, mask));
2481         if (rc)
2482                 return rc;
2483
2484         return selinux_netlbl_inode_permission(inode, mask);
2485 }
2486
2487 static int selinux_file_alloc_security(struct file *file)
2488 {
2489         return file_alloc_security(file);
2490 }
2491
2492 static void selinux_file_free_security(struct file *file)
2493 {
2494         file_free_security(file);
2495 }
2496
2497 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2498                               unsigned long arg)
2499 {
2500         int error = 0;
2501
2502         switch (cmd) {
2503                 case FIONREAD:
2504                 /* fall through */
2505                 case FIBMAP:
2506                 /* fall through */
2507                 case FIGETBSZ:
2508                 /* fall through */
2509                 case EXT2_IOC_GETFLAGS:
2510                 /* fall through */
2511                 case EXT2_IOC_GETVERSION:
2512                         error = file_has_perm(current, file, FILE__GETATTR);
2513                         break;
2514
2515                 case EXT2_IOC_SETFLAGS:
2516                 /* fall through */
2517                 case EXT2_IOC_SETVERSION:
2518                         error = file_has_perm(current, file, FILE__SETATTR);
2519                         break;
2520
2521                 /* sys_ioctl() checks */
2522                 case FIONBIO:
2523                 /* fall through */
2524                 case FIOASYNC:
2525                         error = file_has_perm(current, file, 0);
2526                         break;
2527
2528                 case KDSKBENT:
2529                 case KDSKBSENT:
2530                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2531                         break;
2532
2533                 /* default case assumes that the command will go
2534                  * to the file's ioctl() function.
2535                  */
2536                 default:
2537                         error = file_has_perm(current, file, FILE__IOCTL);
2538
2539         }
2540         return error;
2541 }
2542
2543 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2544 {
2545 #ifndef CONFIG_PPC32
2546         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2547                 /*
2548                  * We are making executable an anonymous mapping or a
2549                  * private file mapping that will also be writable.
2550                  * This has an additional check.
2551                  */
2552                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2553                 if (rc)
2554                         return rc;
2555         }
2556 #endif
2557
2558         if (file) {
2559                 /* read access is always possible with a mapping */
2560                 u32 av = FILE__READ;
2561
2562                 /* write access only matters if the mapping is shared */
2563                 if (shared && (prot & PROT_WRITE))
2564                         av |= FILE__WRITE;
2565
2566                 if (prot & PROT_EXEC)
2567                         av |= FILE__EXECUTE;
2568
2569                 return file_has_perm(current, file, av);
2570         }
2571         return 0;
2572 }
2573
2574 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2575                              unsigned long prot, unsigned long flags,
2576                              unsigned long addr, unsigned long addr_only)
2577 {
2578         int rc = 0;
2579         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2580
2581         if (addr < mmap_min_addr)
2582                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2583                                   MEMPROTECT__MMAP_ZERO, NULL);
2584         if (rc || addr_only)
2585                 return rc;
2586
2587         if (selinux_checkreqprot)
2588                 prot = reqprot;
2589
2590         return file_map_prot_check(file, prot,
2591                                    (flags & MAP_TYPE) == MAP_SHARED);
2592 }
2593
2594 static int selinux_file_mprotect(struct vm_area_struct *vma,
2595                                  unsigned long reqprot,
2596                                  unsigned long prot)
2597 {
2598         int rc;
2599
2600         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2601         if (rc)
2602                 return rc;
2603
2604         if (selinux_checkreqprot)
2605                 prot = reqprot;
2606
2607 #ifndef CONFIG_PPC32
2608         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2609                 rc = 0;
2610                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2611                     vma->vm_end <= vma->vm_mm->brk) {
2612                         rc = task_has_perm(current, current,
2613                                            PROCESS__EXECHEAP);
2614                 } else if (!vma->vm_file &&
2615                            vma->vm_start <= vma->vm_mm->start_stack &&
2616                            vma->vm_end >= vma->vm_mm->start_stack) {
2617                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2618                 } else if (vma->vm_file && vma->anon_vma) {
2619                         /*
2620                          * We are making executable a file mapping that has
2621                          * had some COW done. Since pages might have been
2622                          * written, check ability to execute the possibly
2623                          * modified content.  This typically should only
2624                          * occur for text relocations.
2625                          */
2626                         rc = file_has_perm(current, vma->vm_file,
2627                                            FILE__EXECMOD);
2628                 }
2629                 if (rc)
2630                         return rc;
2631         }
2632 #endif
2633
2634         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2635 }
2636
2637 static int selinux_file_lock(struct file *file, unsigned int cmd)
2638 {
2639         return file_has_perm(current, file, FILE__LOCK);
2640 }
2641
2642 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2643                               unsigned long arg)
2644 {
2645         int err = 0;
2646
2647         switch (cmd) {
2648                 case F_SETFL:
2649                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2650                                 err = -EINVAL;
2651                                 break;
2652                         }
2653
2654                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2655                                 err = file_has_perm(current, file,FILE__WRITE);
2656                                 break;
2657                         }
2658                         /* fall through */
2659                 case F_SETOWN:
2660                 case F_SETSIG:
2661                 case F_GETFL:
2662                 case F_GETOWN:
2663                 case F_GETSIG:
2664                         /* Just check FD__USE permission */
2665                         err = file_has_perm(current, file, 0);
2666                         break;
2667                 case F_GETLK:
2668                 case F_SETLK:
2669                 case F_SETLKW:
2670 #if BITS_PER_LONG == 32
2671                 case F_GETLK64:
2672                 case F_SETLK64:
2673                 case F_SETLKW64:
2674 #endif
2675                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2676                                 err = -EINVAL;
2677                                 break;
2678                         }
2679                         err = file_has_perm(current, file, FILE__LOCK);
2680                         break;
2681         }
2682
2683         return err;
2684 }
2685
2686 static int selinux_file_set_fowner(struct file *file)
2687 {
2688         struct task_security_struct *tsec;
2689         struct file_security_struct *fsec;
2690
2691         tsec = current->security;
2692         fsec = file->f_security;
2693         fsec->fown_sid = tsec->sid;
2694
2695         return 0;
2696 }
2697
2698 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2699                                        struct fown_struct *fown, int signum)
2700 {
2701         struct file *file;
2702         u32 perm;
2703         struct task_security_struct *tsec;
2704         struct file_security_struct *fsec;
2705
2706         /* struct fown_struct is never outside the context of a struct file */
2707         file = container_of(fown, struct file, f_owner);
2708
2709         tsec = tsk->security;
2710         fsec = file->f_security;
2711
2712         if (!signum)
2713                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2714         else
2715                 perm = signal_to_av(signum);
2716
2717         return avc_has_perm(fsec->fown_sid, tsec->sid,
2718                             SECCLASS_PROCESS, perm, NULL);
2719 }
2720
2721 static int selinux_file_receive(struct file *file)
2722 {
2723         return file_has_perm(current, file, file_to_av(file));
2724 }
2725
2726 /* task security operations */
2727
2728 static int selinux_task_create(unsigned long clone_flags)
2729 {
2730         int rc;
2731
2732         rc = secondary_ops->task_create(clone_flags);
2733         if (rc)
2734                 return rc;
2735
2736         return task_has_perm(current, current, PROCESS__FORK);
2737 }
2738
2739 static int selinux_task_alloc_security(struct task_struct *tsk)
2740 {
2741         struct task_security_struct *tsec1, *tsec2;
2742         int rc;
2743
2744         tsec1 = current->security;
2745
2746         rc = task_alloc_security(tsk);
2747         if (rc)
2748                 return rc;
2749         tsec2 = tsk->security;
2750
2751         tsec2->osid = tsec1->osid;
2752         tsec2->sid = tsec1->sid;
2753
2754         /* Retain the exec, fs, key, and sock SIDs across fork */
2755         tsec2->exec_sid = tsec1->exec_sid;
2756         tsec2->create_sid = tsec1->create_sid;
2757         tsec2->keycreate_sid = tsec1->keycreate_sid;
2758         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2759
2760         /* Retain ptracer SID across fork, if any.
2761            This will be reset by the ptrace hook upon any
2762            subsequent ptrace_attach operations. */
2763         tsec2->ptrace_sid = tsec1->ptrace_sid;
2764
2765         return 0;
2766 }
2767
2768 static void selinux_task_free_security(struct task_struct *tsk)
2769 {
2770         task_free_security(tsk);
2771 }
2772
2773 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2774 {
2775         /* Since setuid only affects the current process, and
2776            since the SELinux controls are not based on the Linux
2777            identity attributes, SELinux does not need to control
2778            this operation.  However, SELinux does control the use
2779            of the CAP_SETUID and CAP_SETGID capabilities using the
2780            capable hook. */
2781         return 0;
2782 }
2783
2784 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2785 {
2786         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2787 }
2788
2789 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2790 {
2791         /* See the comment for setuid above. */
2792         return 0;
2793 }
2794
2795 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2796 {
2797         return task_has_perm(current, p, PROCESS__SETPGID);
2798 }
2799
2800 static int selinux_task_getpgid(struct task_struct *p)
2801 {
2802         return task_has_perm(current, p, PROCESS__GETPGID);
2803 }
2804
2805 static int selinux_task_getsid(struct task_struct *p)
2806 {
2807         return task_has_perm(current, p, PROCESS__GETSESSION);
2808 }
2809
2810 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2811 {
2812         selinux_get_task_sid(p, secid);
2813 }
2814
2815 static int selinux_task_setgroups(struct group_info *group_info)
2816 {
2817         /* See the comment for setuid above. */
2818         return 0;
2819 }
2820
2821 static int selinux_task_setnice(struct task_struct *p, int nice)
2822 {
2823         int rc;
2824
2825         rc = secondary_ops->task_setnice(p, nice);
2826         if (rc)
2827                 return rc;
2828
2829         return task_has_perm(current,p, PROCESS__SETSCHED);
2830 }
2831
2832 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2833 {
2834         return task_has_perm(current, p, PROCESS__SETSCHED);
2835 }
2836
2837 static int selinux_task_getioprio(struct task_struct *p)
2838 {
2839         return task_has_perm(current, p, PROCESS__GETSCHED);
2840 }
2841
2842 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2843 {
2844         struct rlimit *old_rlim = current->signal->rlim + resource;
2845         int rc;
2846
2847         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2848         if (rc)
2849                 return rc;
2850
2851         /* Control the ability to change the hard limit (whether
2852            lowering or raising it), so that the hard limit can
2853            later be used as a safe reset point for the soft limit
2854            upon context transitions. See selinux_bprm_apply_creds. */
2855         if (old_rlim->rlim_max != new_rlim->rlim_max)
2856                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2857
2858         return 0;
2859 }
2860
2861 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2862 {
2863         return task_has_perm(current, p, PROCESS__SETSCHED);
2864 }
2865
2866 static int selinux_task_getscheduler(struct task_struct *p)
2867 {
2868         return task_has_perm(current, p, PROCESS__GETSCHED);
2869 }
2870
2871 static int selinux_task_movememory(struct task_struct *p)
2872 {
2873         return task_has_perm(current, p, PROCESS__SETSCHED);
2874 }
2875
2876 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2877                                 int sig, u32 secid)
2878 {
2879         u32 perm;
2880         int rc;
2881         struct task_security_struct *tsec;
2882
2883         rc = secondary_ops->task_kill(p, info, sig, secid);
2884         if (rc)
2885                 return rc;
2886
2887         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2888                 return 0;
2889
2890         if (!sig)
2891                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2892         else
2893                 perm = signal_to_av(sig);
2894         tsec = p->security;
2895         if (secid)
2896                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2897         else
2898                 rc = task_has_perm(current, p, perm);
2899         return rc;
2900 }
2901
2902 static int selinux_task_prctl(int option,
2903                               unsigned long arg2,
2904                               unsigned long arg3,
2905                               unsigned long arg4,
2906                               unsigned long arg5)
2907 {
2908         /* The current prctl operations do not appear to require
2909            any SELinux controls since they merely observe or modify
2910            the state of the current process. */
2911         return 0;
2912 }
2913
2914 static int selinux_task_wait(struct task_struct *p)
2915 {
2916         u32 perm;
2917
2918         perm = signal_to_av(p->exit_signal);
2919
2920         return task_has_perm(p, current, perm);
2921 }
2922
2923 static void selinux_task_reparent_to_init(struct task_struct *p)
2924 {
2925         struct task_security_struct *tsec;
2926
2927         secondary_ops->task_reparent_to_init(p);
2928
2929         tsec = p->security;
2930         tsec->osid = tsec->sid;
2931         tsec->sid = SECINITSID_KERNEL;
2932         return;
2933 }
2934
2935 static void selinux_task_to_inode(struct task_struct *p,
2936                                   struct inode *inode)
2937 {
2938         struct task_security_struct *tsec = p->security;
2939         struct inode_security_struct *isec = inode->i_security;
2940
2941         isec->sid = tsec->sid;
2942         isec->initialized = 1;
2943         return;
2944 }
2945
2946 /* Returns error only if unable to parse addresses */
2947 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2948                         struct avc_audit_data *ad, u8 *proto)
2949 {
2950         int offset, ihlen, ret = -EINVAL;
2951         struct iphdr _iph, *ih;
2952
2953         offset = skb_network_offset(skb);
2954         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2955         if (ih == NULL)
2956                 goto out;
2957
2958         ihlen = ih->ihl * 4;
2959         if (ihlen < sizeof(_iph))
2960                 goto out;
2961
2962         ad->u.net.v4info.saddr = ih->saddr;
2963         ad->u.net.v4info.daddr = ih->daddr;
2964         ret = 0;
2965
2966         if (proto)
2967                 *proto = ih->protocol;
2968
2969         switch (ih->protocol) {
2970         case IPPROTO_TCP: {
2971                 struct tcphdr _tcph, *th;
2972
2973                 if (ntohs(ih->frag_off) & IP_OFFSET)
2974                         break;
2975
2976                 offset += ihlen;
2977                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2978                 if (th == NULL)
2979                         break;
2980
2981                 ad->u.net.sport = th->source;
2982                 ad->u.net.dport = th->dest;
2983                 break;
2984         }
2985
2986         case IPPROTO_UDP: {
2987                 struct udphdr _udph, *uh;
2988
2989                 if (ntohs(ih->frag_off) & IP_OFFSET)
2990                         break;
2991
2992                 offset += ihlen;
2993                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2994                 if (uh == NULL)
2995                         break;
2996
2997                 ad->u.net.sport = uh->source;
2998                 ad->u.net.dport = uh->dest;
2999                 break;
3000         }
3001
3002         case IPPROTO_DCCP: {
3003                 struct dccp_hdr _dccph, *dh;
3004
3005                 if (ntohs(ih->frag_off) & IP_OFFSET)
3006                         break;
3007
3008                 offset += ihlen;
3009                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3010                 if (dh == NULL)
3011                         break;
3012
3013                 ad->u.net.sport = dh->dccph_sport;
3014                 ad->u.net.dport = dh->dccph_dport;
3015                 break;
3016         }
3017
3018         default:
3019                 break;
3020         }
3021 out:
3022         return ret;
3023 }
3024
3025 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3026
3027 /* Returns error only if unable to parse addresses */
3028 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3029                         struct avc_audit_data *ad, u8 *proto)
3030 {
3031         u8 nexthdr;
3032         int ret = -EINVAL, offset;
3033         struct ipv6hdr _ipv6h, *ip6;
3034
3035         offset = skb_network_offset(skb);
3036         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3037         if (ip6 == NULL)
3038                 goto out;
3039
3040         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3041         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3042         ret = 0;
3043
3044         nexthdr = ip6->nexthdr;
3045         offset += sizeof(_ipv6h);
3046         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3047         if (offset < 0)
3048                 goto out;
3049
3050         if (proto)
3051                 *proto = nexthdr;
3052
3053         switch (nexthdr) {
3054         case IPPROTO_TCP: {
3055                 struct tcphdr _tcph, *th;
3056
3057                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3058                 if (th == NULL)
3059                         break;
3060
3061                 ad->u.net.sport = th->source;
3062                 ad->u.net.dport = th->dest;
3063                 break;
3064         }
3065
3066         case IPPROTO_UDP: {
3067                 struct udphdr _udph, *uh;
3068
3069                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3070                 if (uh == NULL)
3071                         break;
3072
3073                 ad->u.net.sport = uh->source;
3074                 ad->u.net.dport = uh->dest;
3075                 break;
3076         }
3077
3078         case IPPROTO_DCCP: {
3079                 struct dccp_hdr _dccph, *dh;
3080
3081                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3082                 if (dh == NULL)
3083                         break;
3084
3085                 ad->u.net.sport = dh->dccph_sport;
3086                 ad->u.net.dport = dh->dccph_dport;
3087                 break;
3088         }
3089
3090         /* includes fragments */
3091         default:
3092                 break;
3093         }
3094 out:
3095         return ret;
3096 }
3097
3098 #endif /* IPV6 */
3099
3100 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3101                              char **addrp, int *len, int src, u8 *proto)
3102 {
3103         int ret = 0;
3104
3105         switch (ad->u.net.family) {
3106         case PF_INET:
3107                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3108                 if (ret || !addrp)
3109                         break;
3110                 *len = 4;
3111                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3112                                         &ad->u.net.v4info.daddr);
3113                 break;
3114
3115 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3116         case PF_INET6:
3117                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3118                 if (ret || !addrp)
3119                         break;
3120                 *len = 16;
3121                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3122                                         &ad->u.net.v6info.daddr);
3123                 break;
3124 #endif  /* IPV6 */
3125         default:
3126                 break;
3127         }
3128
3129         return ret;
3130 }
3131
3132 /**
3133  * selinux_skb_extlbl_sid - Determine the external label of a packet
3134  * @skb: the packet
3135  * @sid: the packet's SID
3136  *
3137  * Description:
3138  * Check the various different forms of external packet labeling and determine
3139  * the external SID for the packet.  If only one form of external labeling is
3140  * present then it is used, if both labeled IPsec and NetLabel labels are
3141  * present then the SELinux type information is taken from the labeled IPsec
3142  * SA and the MLS sensitivity label information is taken from the NetLabel
3143  * security attributes.  This bit of "magic" is done in the call to
3144  * selinux_netlbl_skbuff_getsid().
3145  *
3146  */
3147 static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
3148 {
3149         u32 xfrm_sid;
3150         u32 nlbl_sid;
3151
3152         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3153         if (selinux_netlbl_skbuff_getsid(skb,
3154                                          (xfrm_sid == SECSID_NULL ?
3155                                           SECINITSID_NETMSG : xfrm_sid),
3156                                          &nlbl_sid) != 0)
3157                 nlbl_sid = SECSID_NULL;
3158         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3159 }
3160
3161 /* socket security operations */
3162 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3163                            u32 perms)
3164 {
3165         struct inode_security_struct *isec;
3166         struct task_security_struct *tsec;
3167         struct avc_audit_data ad;
3168         int err = 0;
3169
3170         tsec = task->security;
3171         isec = SOCK_INODE(sock)->i_security;
3172
3173         if (isec->sid == SECINITSID_KERNEL)
3174                 goto out;
3175
3176         AVC_AUDIT_DATA_INIT(&ad,NET);
3177         ad.u.net.sk = sock->sk;
3178         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3179
3180 out:
3181         return err;
3182 }
3183
3184 static int selinux_socket_create(int family, int type,
3185                                  int protocol, int kern)
3186 {
3187         int err = 0;
3188         struct task_security_struct *tsec;
3189         u32 newsid;
3190
3191         if (kern)
3192                 goto out;
3193
3194         tsec = current->security;
3195         newsid = tsec->sockcreate_sid ? : tsec->sid;
3196         err = avc_has_perm(tsec->sid, newsid,
3197                            socket_type_to_security_class(family, type,
3198                            protocol), SOCKET__CREATE, NULL);
3199
3200 out:
3201         return err;
3202 }
3203
3204 static int selinux_socket_post_create(struct socket *sock, int family,
3205                                       int type, int protocol, int kern)
3206 {
3207         int err = 0;
3208         struct inode_security_struct *isec;
3209         struct task_security_struct *tsec;
3210         struct sk_security_struct *sksec;
3211         u32 newsid;
3212
3213         isec = SOCK_INODE(sock)->i_security;
3214
3215         tsec = current->security;
3216         newsid = tsec->sockcreate_sid ? : tsec->sid;
3217         isec->sclass = socket_type_to_security_class(family, type, protocol);
3218         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3219         isec->initialized = 1;
3220
3221         if (sock->sk) {
3222                 sksec = sock->sk->sk_security;
3223                 sksec->sid = isec->sid;
3224                 err = selinux_netlbl_socket_post_create(sock);
3225         }
3226
3227         return err;
3228 }
3229
3230 /* Range of port numbers used to automatically bind.
3231    Need to determine whether we should perform a name_bind
3232    permission check between the socket and the port number. */
3233 #define ip_local_port_range_0 sysctl_local_port_range[0]
3234 #define ip_local_port_range_1 sysctl_local_port_range[1]
3235
3236 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3237 {
3238         u16 family;
3239         int err;
3240
3241         err = socket_has_perm(current, sock, SOCKET__BIND);
3242         if (err)
3243                 goto out;
3244
3245         /*
3246          * If PF_INET or PF_INET6, check name_bind permission for the port.
3247          * Multiple address binding for SCTP is not supported yet: we just
3248          * check the first address now.
3249          */
3250         family = sock->sk->sk_family;
3251         if (family == PF_INET || family == PF_INET6) {
3252                 char *addrp;
3253                 struct inode_security_struct *isec;
3254                 struct task_security_struct *tsec;
3255                 struct avc_audit_data ad;
3256                 struct sockaddr_in *addr4 = NULL;
3257                 struct sockaddr_in6 *addr6 = NULL;
3258                 unsigned short snum;
3259                 struct sock *sk = sock->sk;
3260                 u32 sid, node_perm, addrlen;
3261
3262                 tsec = current->security;
3263                 isec = SOCK_INODE(sock)->i_security;
3264
3265                 if (family == PF_INET) {
3266                         addr4 = (struct sockaddr_in *)address;
3267                         snum = ntohs(addr4->sin_port);
3268                         addrlen = sizeof(addr4->sin_addr.s_addr);
3269                         addrp = (char *)&addr4->sin_addr.s_addr;
3270                 } else {
3271                         addr6 = (struct sockaddr_in6 *)address;
3272                         snum = ntohs(addr6->sin6_port);
3273                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3274                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3275                 }
3276
3277                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3278                            snum > ip_local_port_range_1)) {
3279                         err = security_port_sid(sk->sk_family, sk->sk_type,
3280                                                 sk->sk_protocol, snum, &sid);
3281                         if (err)
3282                                 goto out;
3283                         AVC_AUDIT_DATA_INIT(&ad,NET);
3284                         ad.u.net.sport = htons(snum);
3285                         ad.u.net.family = family;
3286                         err = avc_has_perm(isec->sid, sid,
3287                                            isec->sclass,
3288                                            SOCKET__NAME_BIND, &ad);
3289                         if (err)
3290                                 goto out;
3291                 }
3292
3293                 switch(isec->sclass) {
3294                 case SECCLASS_TCP_SOCKET:
3295                         node_perm = TCP_SOCKET__NODE_BIND;
3296                         break;
3297
3298                 case SECCLASS_UDP_SOCKET:
3299                         node_perm = UDP_SOCKET__NODE_BIND;
3300                         break;
3301
3302                 case SECCLASS_DCCP_SOCKET:
3303                         node_perm = DCCP_SOCKET__NODE_BIND;
3304                         break;
3305
3306                 default:
3307                         node_perm = RAWIP_SOCKET__NODE_BIND;
3308                         break;
3309                 }
3310
3311                 err = security_node_sid(family, addrp, addrlen, &sid);
3312                 if (err)
3313                         goto out;
3314
3315                 AVC_AUDIT_DATA_INIT(&ad,NET);
3316                 ad.u.net.sport = htons(snum);
3317                 ad.u.net.family = family;
3318
3319                 if (family == PF_INET)
3320                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3321                 else
3322                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3323
3324                 err = avc_has_perm(isec->sid, sid,
3325                                    isec->sclass, node_perm, &ad);
3326                 if (err)
3327                         goto out;
3328         }
3329 out:
3330         return err;
3331 }
3332
3333 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3334 {
3335         struct inode_security_struct *isec;
3336         int err;
3337
3338         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3339         if (err)
3340                 return err;
3341
3342         /*
3343          * If a TCP or DCCP socket, check name_connect permission for the port.
3344          */
3345         isec = SOCK_INODE(sock)->i_security;
3346         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3347             isec->sclass == SECCLASS_DCCP_SOCKET) {
3348                 struct sock *sk = sock->sk;
3349                 struct avc_audit_data ad;
3350                 struct sockaddr_in *addr4 = NULL;
3351                 struct sockaddr_in6 *addr6 = NULL;
3352                 unsigned short snum;
3353                 u32 sid, perm;
3354
3355                 if (sk->sk_family == PF_INET) {
3356                         addr4 = (struct sockaddr_in *)address;
3357                         if (addrlen < sizeof(struct sockaddr_in))
3358                                 return -EINVAL;
3359                         snum = ntohs(addr4->sin_port);
3360                 } else {
3361                         addr6 = (struct sockaddr_in6 *)address;
3362                         if (addrlen < SIN6_LEN_RFC2133)
3363                                 return -EINVAL;
3364                         snum = ntohs(addr6->sin6_port);
3365                 }
3366
3367                 err = security_port_sid(sk->sk_family, sk->sk_type,
3368                                         sk->sk_protocol, snum, &sid);
3369                 if (err)
3370                         goto out;
3371
3372                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3373                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3374
3375                 AVC_AUDIT_DATA_INIT(&ad,NET);
3376                 ad.u.net.dport = htons(snum);
3377                 ad.u.net.family = sk->sk_family;
3378                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3379                 if (err)
3380                         goto out;
3381         }
3382
3383 out:
3384         return err;
3385 }
3386
3387 static int selinux_socket_listen(struct socket *sock, int backlog)
3388 {
3389         return socket_has_perm(current, sock, SOCKET__LISTEN);
3390 }
3391
3392 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3393 {
3394         int err;
3395         struct inode_security_struct *isec;
3396         struct inode_security_struct *newisec;
3397
3398         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3399         if (err)
3400                 return err;
3401
3402         newisec = SOCK_INODE(newsock)->i_security;
3403
3404         isec = SOCK_INODE(sock)->i_security;
3405         newisec->sclass = isec->sclass;
3406         newisec->sid = isec->sid;
3407         newisec->initialized = 1;
3408
3409         return 0;
3410 }
3411
3412 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3413                                   int size)
3414 {
3415         int rc;
3416
3417         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3418         if (rc)
3419                 return rc;
3420
3421         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3422 }
3423
3424 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3425                                   int size, int flags)
3426 {
3427         return socket_has_perm(current, sock, SOCKET__READ);
3428 }
3429
3430 static int selinux_socket_getsockname(struct socket *sock)
3431 {
3432         return socket_has_perm(current, sock, SOCKET__GETATTR);
3433 }
3434
3435 static int selinux_socket_getpeername(struct socket *sock)
3436 {
3437         return socket_has_perm(current, sock, SOCKET__GETATTR);
3438 }
3439
3440 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3441 {
3442         int err;
3443
3444         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3445         if (err)
3446                 return err;
3447
3448         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3449 }
3450
3451 static int selinux_socket_getsockopt(struct socket *sock, int level,
3452                                      int optname)
3453 {
3454         return socket_has_perm(current, sock, SOCKET__GETOPT);
3455 }
3456
3457 static int selinux_socket_shutdown(struct socket *sock, int how)
3458 {
3459         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3460 }
3461
3462 static int selinux_socket_unix_stream_connect(struct socket *sock,
3463                                               struct socket *other,
3464                                               struct sock *newsk)
3465 {
3466         struct sk_security_struct *ssec;
3467         struct inode_security_struct *isec;
3468         struct inode_security_struct *other_isec;
3469         struct avc_audit_data ad;
3470         int err;
3471
3472         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3473         if (err)
3474                 return err;
3475
3476         isec = SOCK_INODE(sock)->i_security;
3477         other_isec = SOCK_INODE(other)->i_security;
3478
3479         AVC_AUDIT_DATA_INIT(&ad,NET);
3480         ad.u.net.sk = other->sk;
3481
3482         err = avc_has_perm(isec->sid, other_isec->sid,
3483                            isec->sclass,
3484                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3485         if (err)
3486                 return err;
3487
3488         /* connecting socket */
3489         ssec = sock->sk->sk_security;
3490         ssec->peer_sid = other_isec->sid;
3491
3492         /* server child socket */
3493         ssec = newsk->sk_security;
3494         ssec->peer_sid = isec->sid;
3495         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3496
3497         return err;
3498 }
3499
3500 static int selinux_socket_unix_may_send(struct socket *sock,
3501                                         struct socket *other)
3502 {
3503         struct inode_security_struct *isec;
3504         struct inode_security_struct *other_isec;
3505         struct avc_audit_data ad;
3506         int err;
3507
3508         isec = SOCK_INODE(sock)->i_security;
3509         other_isec = SOCK_INODE(other)->i_security;
3510
3511         AVC_AUDIT_DATA_INIT(&ad,NET);
3512         ad.u.net.sk = other->sk;
3513
3514         err = avc_has_perm(isec->sid, other_isec->sid,
3515                            isec->sclass, SOCKET__SENDTO, &ad);
3516         if (err)
3517                 return err;
3518
3519         return 0;
3520 }
3521
3522 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3523                 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3524 {
3525         int err = 0;
3526         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3527         struct socket *sock;
3528         u16 sock_class = 0;
3529         u32 sock_sid = 0;
3530
3531         read_lock_bh(&sk->sk_callback_lock);
3532         sock = sk->sk_socket;
3533         if (sock) {
3534                 struct inode *inode;
3535                 inode = SOCK_INODE(sock);
3536                 if (inode) {
3537                         struct inode_security_struct *isec;
3538                         isec = inode->i_security;
3539                         sock_sid = isec->sid;
3540                         sock_class = isec->sclass;
3541                 }
3542         }
3543         read_unlock_bh(&sk->sk_callback_lock);
3544         if (!sock_sid)
3545                 goto out;
3546
3547         if (!skb->dev)
3548                 goto out;
3549
3550         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3551         if (err)
3552                 goto out;
3553
3554         switch (sock_class) {
3555         case SECCLASS_UDP_SOCKET:
3556                 netif_perm = NETIF__UDP_RECV;
3557                 node_perm = NODE__UDP_RECV;
3558                 recv_perm = UDP_SOCKET__RECV_MSG;
3559                 break;
3560
3561         case SECCLASS_TCP_SOCKET:
3562                 netif_perm = NETIF__TCP_RECV;
3563                 node_perm = NODE__TCP_RECV;
3564                 recv_perm = TCP_SOCKET__RECV_MSG;
3565                 break;
3566
3567         case SECCLASS_DCCP_SOCKET:
3568                 netif_perm = NETIF__DCCP_RECV;
3569                 node_perm = NODE__DCCP_RECV;
3570                 recv_perm = DCCP_SOCKET__RECV_MSG;
3571                 break;
3572
3573         default:
3574                 netif_perm = NETIF__RAWIP_RECV;
3575                 node_perm = NODE__RAWIP_RECV;
3576                 break;
3577         }
3578
3579         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3580         if (err)
3581                 goto out;
3582
3583         err = security_node_sid(family, addrp, len, &node_sid);
3584         if (err)
3585                 goto out;
3586
3587         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3588         if (err)
3589                 goto out;
3590
3591         if (recv_perm) {
3592                 u32 port_sid;
3593
3594                 err = security_port_sid(sk->sk_family, sk->sk_type,
3595                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3596                                         &port_sid);
3597                 if (err)
3598                         goto out;
3599
3600                 err = avc_has_perm(sock_sid, port_sid,
3601                                    sock_class, recv_perm, ad);
3602         }
3603
3604 out:
3605         return err;
3606 }
3607
3608 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3609 {
3610         u16 family;
3611         char *addrp;
3612         int len, err = 0;
3613         struct avc_audit_data ad;
3614         struct sk_security_struct *sksec = sk->sk_security;
3615
3616         family = sk->sk_family;
3617         if (family != PF_INET && family != PF_INET6)
3618                 goto out;
3619
3620         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3621         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3622                 family = PF_INET;
3623
3624         AVC_AUDIT_DATA_INIT(&ad, NET);
3625         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3626         ad.u.net.family = family;
3627
3628         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3629         if (err)
3630                 goto out;
3631
3632         if (selinux_compat_net)
3633                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3634                                                   addrp, len);
3635         else
3636                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3637                                    PACKET__RECV, &ad);
3638         if (err)
3639                 goto out;
3640
3641         err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3642         if (err)
3643                 goto out;
3644
3645         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3646 out:
3647         return err;
3648 }
3649
3650 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3651                                             int __user *optlen, unsigned len)
3652 {
3653         int err = 0;
3654         char *scontext;
3655         u32 scontext_len;
3656         struct sk_security_struct *ssec;
3657         struct inode_security_struct *isec;
3658         u32 peer_sid = SECSID_NULL;
3659
3660         isec = SOCK_INODE(sock)->i_security;
3661
3662         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3663             isec->sclass == SECCLASS_TCP_SOCKET) {
3664                 ssec = sock->sk->sk_security;
3665                 peer_sid = ssec->peer_sid;
3666         }
3667         if (peer_sid == SECSID_NULL) {
3668                 err = -ENOPROTOOPT;
3669                 goto out;
3670         }
3671
3672         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3673
3674         if (err)
3675                 goto out;
3676
3677         if (scontext_len > len) {
3678                 err = -ERANGE;
3679                 goto out_len;
3680         }
3681
3682         if (copy_to_user(optval, scontext, scontext_len))
3683                 err = -EFAULT;
3684
3685 out_len:
3686         if (put_user(scontext_len, optlen))
3687                 err = -EFAULT;
3688
3689         kfree(scontext);
3690 out:
3691         return err;
3692 }
3693
3694 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3695 {
3696         u32 peer_secid = SECSID_NULL;
3697         int err = 0;
3698
3699         if (sock && sock->sk->sk_family == PF_UNIX)
3700                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3701         else if (skb)
3702                 selinux_skb_extlbl_sid(skb, &peer_secid);
3703
3704         if (peer_secid == SECSID_NULL)
3705                 err = -EINVAL;
3706         *secid = peer_secid;
3707
3708         return err;
3709 }
3710
3711 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3712 {
3713         return sk_alloc_security(sk, family, priority);
3714 }
3715
3716 static void selinux_sk_free_security(struct sock *sk)
3717 {
3718         sk_free_security(sk);
3719 }
3720
3721 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3722 {
3723         struct sk_security_struct *ssec = sk->sk_security;
3724         struct sk_security_struct *newssec = newsk->sk_security;
3725
3726         newssec->sid = ssec->sid;
3727         newssec->peer_sid = ssec->peer_sid;
3728
3729         selinux_netlbl_sk_security_clone(ssec, newssec);
3730 }
3731
3732 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3733 {
3734         if (!sk)
3735                 *secid = SECINITSID_ANY_SOCKET;
3736         else {
3737                 struct sk_security_struct *sksec = sk->sk_security;
3738
3739                 *secid = sksec->sid;
3740         }
3741 }
3742
3743 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3744 {
3745         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3746         struct sk_security_struct *sksec = sk->sk_security;
3747
3748         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3749             sk->sk_family == PF_UNIX)
3750                 isec->sid = sksec->sid;
3751
3752         selinux_netlbl_sock_graft(sk, parent);
3753 }
3754
3755 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3756                                      struct request_sock *req)
3757 {
3758         struct sk_security_struct *sksec = sk->sk_security;
3759         int err;
3760         u32 newsid;
3761         u32 peersid;
3762
3763         selinux_skb_extlbl_sid(skb, &peersid);
3764         if (peersid == SECSID_NULL) {
3765                 req->secid = sksec->sid;
3766                 req->peer_secid = SECSID_NULL;
3767                 return 0;
3768         }
3769
3770         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3771         if (err)
3772                 return err;
3773
3774         req->secid = newsid;
3775         req->peer_secid = peersid;
3776         return 0;
3777 }
3778
3779 static void selinux_inet_csk_clone(struct sock *newsk,
3780                                    const struct request_sock *req)
3781 {
3782         struct sk_security_struct *newsksec = newsk->sk_security;
3783
3784         newsksec->sid = req->secid;
3785         newsksec->peer_sid = req->peer_secid;
3786         /* NOTE: Ideally, we should also get the isec->sid for the
3787            new socket in sync, but we don't have the isec available yet.
3788            So we will wait until sock_graft to do it, by which
3789            time it will have been created and available. */
3790
3791         /* We don't need to take any sort of lock here as we are the only
3792          * thread with access to newsksec */
3793         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3794 }
3795
3796 static void selinux_inet_conn_established(struct sock *sk,
3797                                 struct sk_buff *skb)
3798 {
3799         struct sk_security_struct *sksec = sk->sk_security;
3800
3801         selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
3802 }
3803
3804 static void selinux_req_classify_flow(const struct request_sock *req,
3805                                       struct flowi *fl)
3806 {
3807         fl->secid = req->secid;
3808 }
3809
3810 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3811 {
3812         int err = 0;
3813         u32 perm;
3814         struct nlmsghdr *nlh;
3815         struct socket *sock = sk->sk_socket;
3816         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3817
3818         if (skb->len < NLMSG_SPACE(0)) {
3819                 err = -EINVAL;
3820                 goto out;
3821         }
3822         nlh = nlmsg_hdr(skb);
3823
3824         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3825         if (err) {
3826                 if (err == -EINVAL) {
3827                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3828                                   "SELinux:  unrecognized netlink message"
3829                                   " type=%hu for sclass=%hu\n",
3830                                   nlh->nlmsg_type, isec->sclass);
3831                         if (!selinux_enforcing)
3832                                 err = 0;
3833                 }
3834
3835                 /* Ignore */
3836                 if (err == -ENOENT)
3837                         err = 0;
3838                 goto out;
3839         }
3840
3841         err = socket_has_perm(current, sock, perm);
3842 out:
3843         return err;
3844 }
3845
3846 #ifdef CONFIG_NETFILTER
3847
3848 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3849                                             struct avc_audit_data *ad,
3850                                             u16 family, char *addrp, int len)
3851 {
3852         int err = 0;
3853         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3854         struct socket *sock;
3855         struct inode *inode;
3856         struct inode_security_struct *isec;
3857
3858         sock = sk->sk_socket;
3859         if (!sock)
3860                 goto out;
3861
3862         inode = SOCK_INODE(sock);
3863         if (!inode)
3864                 goto out;
3865
3866         isec = inode->i_security;
3867
3868         err = sel_netif_sids(dev, &if_sid, NULL);
3869         if (err)
3870                 goto out;
3871
3872         switch (isec->sclass) {
3873         case SECCLASS_UDP_SOCKET:
3874                 netif_perm = NETIF__UDP_SEND;
3875                 node_perm = NODE__UDP_SEND;
3876                 send_perm = UDP_SOCKET__SEND_MSG;
3877                 break;
3878
3879         case SECCLASS_TCP_SOCKET:
3880                 netif_perm = NETIF__TCP_SEND;
3881                 node_perm = NODE__TCP_SEND;
3882                 send_perm = TCP_SOCKET__SEND_MSG;
3883                 break;
3884
3885         case SECCLASS_DCCP_SOCKET:
3886                 netif_perm = NETIF__DCCP_SEND;
3887                 node_perm = NODE__DCCP_SEND;
3888                 send_perm = DCCP_SOCKET__SEND_MSG;
3889                 break;
3890
3891         default:
3892                 netif_perm = NETIF__RAWIP_SEND;
3893                 node_perm = NODE__RAWIP_SEND;
3894                 break;
3895         }
3896
3897         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3898         if (err)
3899                 goto out;
3900
3901         err = security_node_sid(family, addrp, len, &node_sid);
3902         if (err)
3903                 goto out;
3904
3905         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3906         if (err)
3907                 goto out;
3908
3909         if (send_perm) {
3910                 u32 port_sid;
3911
3912                 err = security_port_sid(sk->sk_family,
3913                                         sk->sk_type,
3914                                         sk->sk_protocol,
3915                                         ntohs(ad->u.net.dport),
3916                                         &port_sid);
3917                 if (err)
3918                         goto out;
3919
3920                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3921                                    send_perm, ad);
3922         }
3923 out:
3924         return err;
3925 }
3926
3927 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3928                                               struct sk_buff **pskb,
3929                                               const struct net_device *in,
3930                                               const struct net_device *out,
3931                                               int (*okfn)(struct sk_buff *),
3932                                               u16 family)
3933 {
3934         char *addrp;
3935         int len, err = 0;
3936         struct sock *sk;
3937         struct sk_buff *skb = *pskb;
3938         struct avc_audit_data ad;
3939         struct net_device *dev = (struct net_device *)out;
3940         struct sk_security_struct *sksec;
3941         u8 proto;
3942
3943         sk = skb->sk;
3944         if (!sk)
3945                 goto out;
3946
3947         sksec = sk->sk_security;
3948
3949         AVC_AUDIT_DATA_INIT(&ad, NET);
3950         ad.u.net.netif = dev->name;
3951         ad.u.net.family = family;
3952
3953         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3954         if (err)
3955                 goto out;
3956
3957         if (selinux_compat_net)
3958                 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3959                                                        family, addrp, len);
3960         else
3961                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3962                                    PACKET__SEND, &ad);
3963
3964         if (err)
3965                 goto out;
3966
3967         err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3968 out:
3969         return err ? NF_DROP : NF_ACCEPT;
3970 }
3971
3972 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3973                                                 struct sk_buff **pskb,
3974                                                 const struct net_device *in,
3975                                                 const struct net_device *out,
3976                                                 int (*okfn)(struct sk_buff *))
3977 {
3978         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3979 }
3980
3981 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3982
3983 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3984                                                 struct sk_buff **pskb,
3985                                                 const struct net_device *in,
3986                                                 const struct net_device *out,
3987                                                 int (*okfn)(struct sk_buff *))
3988 {
3989         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3990 }
3991
3992 #endif  /* IPV6 */
3993
3994 #endif  /* CONFIG_NETFILTER */
3995
3996 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3997 {
3998         int err;
3999
4000         err = secondary_ops->netlink_send(sk, skb);
4001         if (err)
4002                 return err;
4003
4004         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4005                 err = selinux_nlmsg_perm(sk, skb);
4006
4007         return err;
4008 }
4009
4010 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4011 {
4012         int err;
4013         struct avc_audit_data ad;
4014
4015         err = secondary_ops->netlink_recv(skb, capability);
4016         if (err)
4017                 return err;
4018
4019         AVC_AUDIT_DATA_INIT(&ad, CAP);
4020         ad.u.cap = capability;
4021
4022         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4023                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4024 }
4025
4026 static int ipc_alloc_security(struct task_struct *task,
4027                               struct kern_ipc_perm *perm,
4028                               u16 sclass)
4029 {
4030         struct task_security_struct *tsec = task->security;
4031         struct ipc_security_struct *isec;
4032
4033         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4034         if (!isec)
4035                 return -ENOMEM;
4036
4037         isec->sclass = sclass;
4038         isec->ipc_perm = perm;
4039         isec->sid = tsec->sid;
4040         perm->security = isec;
4041
4042         return 0;
4043 }
4044
4045 static void ipc_free_security(struct kern_ipc_perm *perm)
4046 {
4047         struct ipc_security_struct *isec = perm->security;
4048         perm->security = NULL;
4049         kfree(isec);
4050 }
4051
4052 static int msg_msg_alloc_security(struct msg_msg *msg)
4053 {
4054         struct msg_security_struct *msec;
4055
4056         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4057         if (!msec)
4058                 return -ENOMEM;
4059
4060         msec->msg = msg;
4061         msec->sid = SECINITSID_UNLABELED;
4062         msg->security = msec;
4063
4064         return 0;
4065 }
4066
4067 static void msg_msg_free_security(struct msg_msg *msg)
4068 {
4069         struct msg_security_struct *msec = msg->security;
4070
4071         msg->security = NULL;
4072         kfree(msec);
4073 }
4074
4075 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4076                         u32 perms)
4077 {
4078         struct task_security_struct *tsec;
4079         struct ipc_security_struct *isec;
4080         struct avc_audit_data ad;
4081
4082         tsec = current->security;
4083         isec = ipc_perms->security;
4084
4085         AVC_AUDIT_DATA_INIT(&ad, IPC);
4086         ad.u.ipc_id = ipc_perms->key;
4087
4088         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4089 }
4090
4091 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4092 {
4093         return msg_msg_alloc_security(msg);
4094 }
4095
4096 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4097 {
4098         msg_msg_free_security(msg);
4099 }
4100
4101 /* message queue security operations */
4102 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4103 {
4104         struct task_security_struct *tsec;
4105         struct ipc_security_struct *isec;
4106         struct avc_audit_data ad;
4107         int rc;
4108
4109         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4110         if (rc)
4111                 return rc;
4112
4113         tsec = current->security;
4114         isec = msq->q_perm.security;
4115
4116         AVC_AUDIT_DATA_INIT(&ad, IPC);
4117         ad.u.ipc_id = msq->q_perm.key;
4118
4119         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4120                           MSGQ__CREATE, &ad);
4121         if (rc) {
4122                 ipc_free_security(&msq->q_perm);
4123                 return rc;
4124         }
4125         return 0;
4126 }
4127
4128 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4129 {
4130         ipc_free_security(&msq->q_perm);
4131 }
4132
4133 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4134 {
4135         struct task_security_struct *tsec;
4136         struct ipc_security_struct *isec;
4137         struct avc_audit_data ad;
4138
4139         tsec = current->security;
4140         isec = msq->q_perm.security;
4141
4142         AVC_AUDIT_DATA_INIT(&ad, IPC);
4143         ad.u.ipc_id = msq->q_perm.key;
4144
4145         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4146                             MSGQ__ASSOCIATE, &ad);
4147 }
4148
4149 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4150 {
4151         int err;
4152         int perms;
4153
4154         switch(cmd) {
4155         case IPC_INFO:
4156         case MSG_INFO:
4157                 /* No specific object, just general system-wide information. */
4158                 return task_has_system(current, SYSTEM__IPC_INFO);
4159         case IPC_STAT:
4160         case MSG_STAT:
4161                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4162                 break;
4163         case IPC_SET:
4164                 perms = MSGQ__SETATTR;
4165                 break;
4166         case IPC_RMID:
4167                 perms = MSGQ__DESTROY;
4168                 break;
4169         default:
4170                 return 0;
4171         }
4172
4173         err = ipc_has_perm(&msq->q_perm, perms);
4174         return err;
4175 }
4176
4177 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4178 {
4179         struct task_security_struct *tsec;
4180         struct ipc_security_struct *isec;
4181         struct msg_security_struct *msec;
4182         struct avc_audit_data ad;
4183         int rc;
4184
4185         tsec = current->security;
4186         isec = msq->q_perm.security;
4187         msec = msg->security;
4188
4189         /*
4190          * First time through, need to assign label to the message
4191          */
4192         if (msec->sid == SECINITSID_UNLABELED) {
4193                 /*
4194                  * Compute new sid based on current process and
4195                  * message queue this message will be stored in
4196                  */
4197                 rc = security_transition_sid(tsec->sid,
4198                                              isec->sid,
4199                                              SECCLASS_MSG,
4200                                              &msec->sid);
4201                 if (rc)
4202                         return rc;
4203         }
4204
4205         AVC_AUDIT_DATA_INIT(&ad, IPC);
4206         ad.u.ipc_id = msq->q_perm.key;
4207
4208         /* Can this process write to the queue? */
4209         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4210                           MSGQ__WRITE, &ad);
4211         if (!rc)
4212                 /* Can this process send the message */
4213                 rc = avc_has_perm(tsec->sid, msec->sid,
4214                                   SECCLASS_MSG, MSG__SEND, &ad);
4215         if (!rc)
4216                 /* Can the message be put in the queue? */
4217                 rc = avc_has_perm(msec->sid, isec->sid,
4218                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4219
4220         return rc;
4221 }
4222
4223 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4224                                     struct task_struct *target,
4225                                     long type, int mode)
4226 {
4227         struct task_security_struct *tsec;
4228         struct ipc_security_struct *isec;
4229         struct msg_security_struct *msec;
4230         struct avc_audit_data ad;
4231         int rc;
4232
4233         tsec = target->security;
4234         isec = msq->q_perm.security;
4235         msec = msg->security;
4236
4237         AVC_AUDIT_DATA_INIT(&ad, IPC);
4238         ad.u.ipc_id = msq->q_perm.key;
4239
4240         rc = avc_has_perm(tsec->sid, isec->sid,
4241                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4242         if (!rc)
4243                 rc = avc_has_perm(tsec->sid, msec->sid,
4244                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4245         return rc;
4246 }
4247
4248 /* Shared Memory security operations */
4249 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4250 {
4251         struct task_security_struct *tsec;
4252         struct ipc_security_struct *isec;
4253         struct avc_audit_data ad;
4254         int rc;
4255
4256         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4257         if (rc)
4258                 return rc;
4259
4260         tsec = current->security;
4261         isec = shp->shm_perm.security;
4262
4263         AVC_AUDIT_DATA_INIT(&ad, IPC);
4264         ad.u.ipc_id = shp->shm_perm.key;
4265
4266         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4267                           SHM__CREATE, &ad);
4268         if (rc) {
4269                 ipc_free_security(&shp->shm_perm);
4270                 return rc;
4271         }
4272         return 0;
4273 }
4274
4275 static void selinux_shm_free_security(struct shmid_kernel *shp)
4276 {
4277         ipc_free_security(&shp->shm_perm);
4278 }
4279
4280 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4281 {
4282         struct task_security_struct *tsec;
4283         struct ipc_security_struct *isec;
4284         struct avc_audit_data ad;
4285
4286         tsec = current->security;
4287         isec = shp->shm_perm.security;
4288
4289         AVC_AUDIT_DATA_INIT(&ad, IPC);
4290         ad.u.ipc_id = shp->shm_perm.key;
4291
4292         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4293                             SHM__ASSOCIATE, &ad);
4294 }
4295
4296 /* Note, at this point, shp is locked down */
4297 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4298 {
4299         int perms;
4300         int err;
4301
4302         switch(cmd) {
4303         case IPC_INFO:
4304         case SHM_INFO:
4305                 /* No specific object, just general system-wide information. */
4306                 return task_has_system(current, SYSTEM__IPC_INFO);
4307         case IPC_STAT:
4308         case SHM_STAT:
4309                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4310                 break;
4311         case IPC_SET:
4312                 perms = SHM__SETATTR;
4313                 break;
4314         case SHM_LOCK:
4315         case SHM_UNLOCK:
4316                 perms = SHM__LOCK;
4317                 break;
4318         case IPC_RMID:
4319                 perms = SHM__DESTROY;
4320                 break;
4321         default:
4322                 return 0;
4323         }
4324
4325         err = ipc_has_perm(&shp->shm_perm, perms);
4326         return err;
4327 }
4328
4329 static int selinux_shm_shmat(struct shmid_kernel *shp,
4330                              char __user *shmaddr, int shmflg)
4331 {
4332         u32 perms;
4333         int rc;
4334
4335         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4336         if (rc)
4337                 return rc;
4338
4339         if (shmflg & SHM_RDONLY)
4340                 perms = SHM__READ;
4341         else
4342                 perms = SHM__READ | SHM__WRITE;
4343
4344         return ipc_has_perm(&shp->shm_perm, perms);
4345 }
4346
4347 /* Semaphore security operations */
4348 static int selinux_sem_alloc_security(struct sem_array *sma)
4349 {
4350         struct task_security_struct *tsec;
4351         struct ipc_security_struct *isec;
4352         struct avc_audit_data ad;
4353         int rc;
4354
4355         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4356         if (rc)
4357                 return rc;
4358
4359         tsec = current->security;
4360         isec = sma->sem_perm.security;
4361
4362         AVC_AUDIT_DATA_INIT(&ad, IPC);
4363         ad.u.ipc_id = sma->sem_perm.key;
4364
4365         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4366                           SEM__CREATE, &ad);
4367         if (rc) {
4368                 ipc_free_security(&sma->sem_perm);
4369                 return rc;
4370         }
4371         return 0;
4372 }
4373
4374 static void selinux_sem_free_security(struct sem_array *sma)
4375 {
4376         ipc_free_security(&sma->sem_perm);
4377 }
4378
4379 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4380 {
4381         struct task_security_struct *tsec;
4382         struct ipc_security_struct *isec;
4383         struct avc_audit_data ad;
4384
4385         tsec = current->security;
4386         isec = sma->sem_perm.security;
4387
4388         AVC_AUDIT_DATA_INIT(&ad, IPC);
4389         ad.u.ipc_id = sma->sem_perm.key;
4390
4391         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4392                             SEM__ASSOCIATE, &ad);
4393 }
4394
4395 /* Note, at this point, sma is locked down */
4396 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4397 {
4398         int err;
4399         u32 perms;
4400
4401         switch(cmd) {
4402         case IPC_INFO:
4403         case SEM_INFO:
4404                 /* No specific object, just general system-wide information. */
4405                 return task_has_system(current, SYSTEM__IPC_INFO);
4406         case GETPID:
4407         case GETNCNT:
4408         case GETZCNT:
4409                 perms = SEM__GETATTR;
4410                 break;
4411         case GETVAL:
4412         case GETALL:
4413                 perms = SEM__READ;
4414                 break;
4415         case SETVAL:
4416         case SETALL:
4417                 perms = SEM__WRITE;
4418                 break;
4419         case IPC_RMID:
4420                 perms = SEM__DESTROY;
4421                 break;
4422         case IPC_SET:
4423                 perms = SEM__SETATTR;
4424                 break;
4425         case IPC_STAT:
4426         case SEM_STAT:
4427                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4428                 break;
4429         default:
4430                 return 0;
4431         }
4432
4433         err = ipc_has_perm(&sma->sem_perm, perms);
4434         return err;
4435 }
4436
4437 static int selinux_sem_semop(struct sem_array *sma,
4438                              struct sembuf *sops, unsigned nsops, int alter)
4439 {
4440         u32 perms;
4441
4442         if (alter)
4443                 perms = SEM__READ | SEM__WRITE;
4444         else
4445                 perms = SEM__READ;
4446
4447         return ipc_has_perm(&sma->sem_perm, perms);
4448 }
4449
4450 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4451 {
4452         u32 av = 0;
4453
4454         av = 0;
4455         if (flag & S_IRUGO)
4456                 av |= IPC__UNIX_READ;
4457         if (flag & S_IWUGO)
4458                 av |= IPC__UNIX_WRITE;
4459
4460         if (av == 0)
4461                 return 0;
4462
4463         return ipc_has_perm(ipcp, av);
4464 }
4465
4466 /* module stacking operations */
4467 static int selinux_register_security (const char *name, struct security_operations *ops)
4468 {
4469         if (secondary_ops != original_ops) {
4470                 printk(KERN_ERR "%s:  There is already a secondary security "
4471                        "module registered.\n", __FUNCTION__);
4472                 return -EINVAL;
4473         }
4474
4475         secondary_ops = ops;
4476
4477         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4478                __FUNCTION__,
4479                name);
4480
4481         return 0;
4482 }
4483
4484 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4485 {
4486         if (ops != secondary_ops) {
4487                 printk(KERN_ERR "%s:  trying to unregister a security module "
4488                         "that is not registered.\n", __FUNCTION__);
4489                 return -EINVAL;
4490         }
4491
4492         secondary_ops = original_ops;
4493
4494         return 0;
4495 }
4496
4497 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4498 {
4499         if (inode)
4500                 inode_doinit_with_dentry(inode, dentry);
4501 }
4502
4503 static int selinux_getprocattr(struct task_struct *p,
4504                                char *name, char **value)
4505 {
4506         struct task_security_struct *tsec;
4507         u32 sid;
4508         int error;
4509         unsigned len;
4510
4511         if (current != p) {
4512                 error = task_has_perm(current, p, PROCESS__GETATTR);
4513                 if (error)
4514                         return error;
4515         }
4516
4517         tsec = p->security;
4518
4519         if (!strcmp(name, "current"))
4520                 sid = tsec->sid;
4521         else if (!strcmp(name, "prev"))
4522                 sid = tsec->osid;
4523         else if (!strcmp(name, "exec"))
4524                 sid = tsec->exec_sid;
4525         else if (!strcmp(name, "fscreate"))
4526                 sid = tsec->create_sid;
4527         else if (!strcmp(name, "keycreate"))
4528                 sid = tsec->keycreate_sid;
4529         else if (!strcmp(name, "sockcreate"))
4530                 sid = tsec->sockcreate_sid;
4531         else
4532                 return -EINVAL;
4533
4534         if (!sid)
4535                 return 0;
4536
4537         error = security_sid_to_context(sid, value, &len);
4538         if (error)
4539                 return error;
4540         return len;
4541 }
4542
4543 static int selinux_setprocattr(struct task_struct *p,
4544                                char *name, void *value, size_t size)
4545 {
4546         struct task_security_struct *tsec;
4547         u32 sid = 0;
4548         int error;
4549         char *str = value;
4550
4551         if (current != p) {
4552                 /* SELinux only allows a process to change its own
4553                    security attributes. */
4554                 return -EACCES;
4555         }
4556
4557         /*
4558          * Basic control over ability to set these attributes at all.
4559          * current == p, but we'll pass them separately in case the
4560          * above restriction is ever removed.
4561          */
4562         if (!strcmp(name, "exec"))
4563                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4564         else if (!strcmp(name, "fscreate"))
4565                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4566         else if (!strcmp(name, "keycreate"))
4567                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4568         else if (!strcmp(name, "sockcreate"))
4569                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4570         else if (!strcmp(name, "current"))
4571                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4572         else
4573                 error = -EINVAL;
4574         if (error)
4575                 return error;
4576
4577         /* Obtain a SID for the context, if one was specified. */
4578         if (size && str[1] && str[1] != '\n') {
4579                 if (str[size-1] == '\n') {
4580                         str[size-1] = 0;
4581                         size--;
4582                 }
4583                 error = security_context_to_sid(value, size, &sid);
4584                 if (error)
4585                         return error;
4586         }
4587
4588         /* Permission checking based on the specified context is
4589            performed during the actual operation (execve,
4590            open/mkdir/...), when we know the full context of the
4591            operation.  See selinux_bprm_set_security for the execve
4592            checks and may_create for the file creation checks. The
4593            operation will then fail if the context is not permitted. */
4594         tsec = p->security;
4595         if (!strcmp(name, "exec"))
4596                 tsec->exec_sid = sid;
4597         else if (!strcmp(name, "fscreate"))
4598                 tsec->create_sid = sid;
4599         else if (!strcmp(name, "keycreate")) {
4600                 error = may_create_key(sid, p);
4601                 if (error)
4602                         return error;
4603                 tsec->keycreate_sid = sid;
4604         } else if (!strcmp(name, "sockcreate"))
4605                 tsec->sockcreate_sid = sid;
4606         else if (!strcmp(name, "current")) {
4607                 struct av_decision avd;
4608
4609                 if (sid == 0)
4610                         return -EINVAL;
4611
4612                 /* Only allow single threaded processes to change context */
4613                 if (atomic_read(&p->mm->mm_users) != 1) {
4614                         struct task_struct *g, *t;
4615                         struct mm_struct *mm = p->mm;
4616                         read_lock(&tasklist_lock);
4617                         do_each_thread(g, t)
4618                                 if (t->mm == mm && t != p) {
4619                                         read_unlock(&tasklist_lock);
4620                                         return -EPERM;
4621                                 }
4622                         while_each_thread(g, t);
4623                         read_unlock(&tasklist_lock);
4624                 }
4625
4626                 /* Check permissions for the transition. */
4627                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4628                                      PROCESS__DYNTRANSITION, NULL);
4629                 if (error)
4630                         return error;
4631
4632                 /* Check for ptracing, and update the task SID if ok.
4633                    Otherwise, leave SID unchanged and fail. */
4634                 task_lock(p);
4635                 if (p->ptrace & PT_PTRACED) {
4636                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4637                                                      SECCLASS_PROCESS,
4638                                                      PROCESS__PTRACE, 0, &avd);
4639                         if (!error)
4640                                 tsec->sid = sid;
4641                         task_unlock(p);
4642                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4643                                   PROCESS__PTRACE, &avd, error, NULL);
4644                         if (error)
4645                                 return error;
4646                 } else {
4647                         tsec->sid = sid;
4648                         task_unlock(p);
4649                 }
4650         }
4651         else
4652                 return -EINVAL;
4653
4654         return size;
4655 }
4656
4657 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4658 {
4659         return security_sid_to_context(secid, secdata, seclen);
4660 }
4661
4662 static void selinux_release_secctx(char *secdata, u32 seclen)
4663 {
4664         kfree(secdata);
4665 }
4666
4667 #ifdef CONFIG_KEYS
4668
4669 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4670                              unsigned long flags)
4671 {
4672         struct task_security_struct *tsec = tsk->security;
4673         struct key_security_struct *ksec;
4674
4675         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4676         if (!ksec)
4677                 return -ENOMEM;
4678
4679         ksec->obj = k;
4680         if (tsec->keycreate_sid)
4681                 ksec->sid = tsec->keycreate_sid;
4682         else
4683                 ksec->sid = tsec->sid;
4684         k->security = ksec;
4685
4686         return 0;
4687 }
4688
4689 static void selinux_key_free(struct key *k)
4690 {
4691         struct key_security_struct *ksec = k->security;
4692
4693         k->security = NULL;
4694         kfree(ksec);
4695 }
4696
4697 static int selinux_key_permission(key_ref_t key_ref,
4698                             struct task_struct *ctx,
4699                             key_perm_t perm)
4700 {
4701         struct key *key;
4702         struct task_security_struct *tsec;
4703         struct key_security_struct *ksec;
4704
4705         key = key_ref_to_ptr(key_ref);
4706
4707         tsec = ctx->security;
4708         ksec = key->security;
4709
4710         /* if no specific permissions are requested, we skip the
4711            permission check. No serious, additional covert channels
4712            appear to be created. */
4713         if (perm == 0)
4714                 return 0;
4715
4716         return avc_has_perm(tsec->sid, ksec->sid,
4717                             SECCLASS_KEY, perm, NULL);
4718 }
4719
4720 #endif
4721
4722 static struct security_operations selinux_ops = {
4723         .ptrace =                       selinux_ptrace,
4724         .capget =                       selinux_capget,
4725         .capset_check =                 selinux_capset_check,
4726         .capset_set =                   selinux_capset_set,
4727         .sysctl =                       selinux_sysctl,
4728         .capable =                      selinux_capable,
4729         .quotactl =                     selinux_quotactl,
4730         .quota_on =                     selinux_quota_on,
4731         .syslog =                       selinux_syslog,
4732         .vm_enough_memory =             selinux_vm_enough_memory,
4733
4734         .netlink_send =                 selinux_netlink_send,
4735         .netlink_recv =                 selinux_netlink_recv,
4736
4737         .bprm_alloc_security =          selinux_bprm_alloc_security,
4738         .bprm_free_security =           selinux_bprm_free_security,
4739         .bprm_apply_creds =             selinux_bprm_apply_creds,
4740         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4741         .bprm_set_security =            selinux_bprm_set_security,
4742         .bprm_check_security =          selinux_bprm_check_security,
4743         .bprm_secureexec =              selinux_bprm_secureexec,
4744
4745         .sb_alloc_security =            selinux_sb_alloc_security,
4746         .sb_free_security =             selinux_sb_free_security,
4747         .sb_copy_data =                 selinux_sb_copy_data,
4748         .sb_kern_mount =                selinux_sb_kern_mount,
4749         .sb_statfs =                    selinux_sb_statfs,
4750         .sb_mount =                     selinux_mount,
4751         .sb_umount =                    selinux_umount,
4752
4753         .inode_alloc_security =         selinux_inode_alloc_security,
4754         .inode_free_security =          selinux_inode_free_security,
4755         .inode_init_security =          selinux_inode_init_security,
4756         .inode_create =                 selinux_inode_create,
4757         .inode_link =                   selinux_inode_link,
4758         .inode_unlink =                 selinux_inode_unlink,
4759         .inode_symlink =                selinux_inode_symlink,
4760         .inode_mkdir =                  selinux_inode_mkdir,
4761         .inode_rmdir =                  selinux_inode_rmdir,
4762         .inode_mknod =                  selinux_inode_mknod,
4763         .inode_rename =                 selinux_inode_rename,
4764         .inode_readlink =               selinux_inode_readlink,
4765         .inode_follow_link =            selinux_inode_follow_link,
4766         .inode_permission =             selinux_inode_permission,
4767         .inode_setattr =                selinux_inode_setattr,
4768         .inode_getattr =                selinux_inode_getattr,
4769         .inode_setxattr =               selinux_inode_setxattr,
4770         .inode_post_setxattr =          selinux_inode_post_setxattr,
4771         .inode_getxattr =               selinux_inode_getxattr,
4772         .inode_listxattr =              selinux_inode_listxattr,
4773         .inode_removexattr =            selinux_inode_removexattr,
4774         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4775         .inode_getsecurity =            selinux_inode_getsecurity,
4776         .inode_setsecurity =            selinux_inode_setsecurity,
4777         .inode_listsecurity =           selinux_inode_listsecurity,
4778
4779         .file_permission =              selinux_file_permission,
4780         .file_alloc_security =          selinux_file_alloc_security,
4781         .file_free_security =           selinux_file_free_security,
4782         .file_ioctl =                   selinux_file_ioctl,
4783         .file_mmap =                    selinux_file_mmap,
4784         .file_mprotect =                selinux_file_mprotect,
4785         .file_lock =                    selinux_file_lock,
4786         .file_fcntl =                   selinux_file_fcntl,
4787         .file_set_fowner =              selinux_file_set_fowner,
4788         .file_send_sigiotask =          selinux_file_send_sigiotask,
4789         .file_receive =                 selinux_file_receive,
4790
4791         .task_create =                  selinux_task_create,
4792         .task_alloc_security =          selinux_task_alloc_security,
4793         .task_free_security =           selinux_task_free_security,
4794         .task_setuid =                  selinux_task_setuid,
4795         .task_post_setuid =             selinux_task_post_setuid,
4796         .task_setgid =                  selinux_task_setgid,
4797         .task_setpgid =                 selinux_task_setpgid,
4798         .task_getpgid =                 selinux_task_getpgid,
4799         .task_getsid =                  selinux_task_getsid,
4800         .task_getsecid =                selinux_task_getsecid,
4801         .task_setgroups =               selinux_task_setgroups,
4802         .task_setnice =                 selinux_task_setnice,
4803         .task_setioprio =               selinux_task_setioprio,
4804         .task_getioprio =               selinux_task_getioprio,
4805         .task_setrlimit =               selinux_task_setrlimit,
4806         .task_setscheduler =            selinux_task_setscheduler,
4807         .task_getscheduler =            selinux_task_getscheduler,
4808         .task_movememory =              selinux_task_movememory,
4809         .task_kill =                    selinux_task_kill,
4810         .task_wait =                    selinux_task_wait,
4811         .task_prctl =                   selinux_task_prctl,
4812         .task_reparent_to_init =        selinux_task_reparent_to_init,
4813         .task_to_inode =                selinux_task_to_inode,
4814
4815         .ipc_permission =               selinux_ipc_permission,
4816
4817         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4818         .msg_msg_free_security =        selinux_msg_msg_free_security,
4819
4820         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4821         .msg_queue_free_security =      selinux_msg_queue_free_security,
4822         .msg_queue_associate =          selinux_msg_queue_associate,
4823         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4824         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4825         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4826
4827         .shm_alloc_security =           selinux_shm_alloc_security,
4828         .shm_free_security =            selinux_shm_free_security,
4829         .shm_associate =                selinux_shm_associate,
4830         .shm_shmctl =                   selinux_shm_shmctl,
4831         .shm_shmat =                    selinux_shm_shmat,
4832
4833         .sem_alloc_security =           selinux_sem_alloc_security,
4834         .sem_free_security =            selinux_sem_free_security,
4835         .sem_associate =                selinux_sem_associate,
4836         .sem_semctl =                   selinux_sem_semctl,
4837         .sem_semop =                    selinux_sem_semop,
4838
4839         .register_security =            selinux_register_security,
4840         .unregister_security =          selinux_unregister_security,
4841
4842         .d_instantiate =                selinux_d_instantiate,
4843
4844         .getprocattr =                  selinux_getprocattr,
4845         .setprocattr =                  selinux_setprocattr,
4846
4847         .secid_to_secctx =              selinux_secid_to_secctx,
4848         .release_secctx =               selinux_release_secctx,
4849
4850         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4851         .unix_may_send =                selinux_socket_unix_may_send,
4852
4853         .socket_create =                selinux_socket_create,
4854         .socket_post_create =           selinux_socket_post_create,
4855         .socket_bind =                  selinux_socket_bind,
4856         .socket_connect =               selinux_socket_connect,
4857         .socket_listen =                selinux_socket_listen,
4858         .socket_accept =                selinux_socket_accept,
4859         .socket_sendmsg =               selinux_socket_sendmsg,
4860         .socket_recvmsg =               selinux_socket_recvmsg,
4861         .socket_getsockname =           selinux_socket_getsockname,
4862         .socket_getpeername =           selinux_socket_getpeername,
4863         .socket_getsockopt =            selinux_socket_getsockopt,
4864         .socket_setsockopt =            selinux_socket_setsockopt,
4865         .socket_shutdown =              selinux_socket_shutdown,
4866         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4867         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4868         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4869         .sk_alloc_security =            selinux_sk_alloc_security,
4870         .sk_free_security =             selinux_sk_free_security,
4871         .sk_clone_security =            selinux_sk_clone_security,
4872         .sk_getsecid =                  selinux_sk_getsecid,
4873         .sock_graft =                   selinux_sock_graft,
4874         .inet_conn_request =            selinux_inet_conn_request,
4875         .inet_csk_clone =               selinux_inet_csk_clone,
4876         .inet_conn_established =        selinux_inet_conn_established,
4877         .req_classify_flow =            selinux_req_classify_flow,
4878
4879 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4880         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4881         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4882         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4883         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4884         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4885         .xfrm_state_free_security =     selinux_xfrm_state_free,
4886         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4887         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4888         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
4889         .xfrm_decode_session =          selinux_xfrm_decode_session,
4890 #endif
4891
4892 #ifdef CONFIG_KEYS
4893         .key_alloc =                    selinux_key_alloc,
4894         .key_free =                     selinux_key_free,
4895         .key_permission =               selinux_key_permission,
4896 #endif
4897 };
4898
4899 static __init int selinux_init(void)
4900 {
4901         struct task_security_struct *tsec;
4902
4903         if (!selinux_enabled) {
4904                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4905                 return 0;
4906         }
4907
4908         printk(KERN_INFO "SELinux:  Initializing.\n");
4909
4910         /* Set the security state for the initial task. */
4911         if (task_alloc_security(current))
4912                 panic("SELinux:  Failed to initialize initial task.\n");
4913         tsec = current->security;
4914         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4915
4916         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4917                                             sizeof(struct inode_security_struct),
4918                                             0, SLAB_PANIC, NULL);
4919         avc_init();
4920
4921         original_ops = secondary_ops = security_ops;
4922         if (!secondary_ops)
4923                 panic ("SELinux: No initial security operations\n");
4924         if (register_security (&selinux_ops))
4925                 panic("SELinux: Unable to register with kernel.\n");
4926
4927         if (selinux_enforcing) {
4928                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
4929         } else {
4930                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
4931         }
4932
4933 #ifdef CONFIG_KEYS
4934         /* Add security information to initial keyrings */
4935         selinux_key_alloc(&root_user_keyring, current,
4936                           KEY_ALLOC_NOT_IN_QUOTA);
4937         selinux_key_alloc(&root_session_keyring, current,
4938                           KEY_ALLOC_NOT_IN_QUOTA);
4939 #endif
4940
4941         return 0;
4942 }
4943
4944 void selinux_complete_init(void)
4945 {
4946         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
4947
4948         /* Set up any superblocks initialized prior to the policy load. */
4949         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
4950         spin_lock(&sb_lock);
4951         spin_lock(&sb_security_lock);
4952 next_sb:
4953         if (!list_empty(&superblock_security_head)) {
4954                 struct superblock_security_struct *sbsec =
4955                                 list_entry(superblock_security_head.next,
4956                                            struct superblock_security_struct,
4957                                            list);
4958                 struct super_block *sb = sbsec->sb;
4959                 sb->s_count++;
4960                 spin_unlock(&sb_security_lock);
4961                 spin_unlock(&sb_lock);
4962                 down_read(&sb->s_umount);
4963                 if (sb->s_root)
4964                         superblock_doinit(sb, NULL);
4965                 drop_super(sb);
4966                 spin_lock(&sb_lock);
4967                 spin_lock(&sb_security_lock);
4968                 list_del_init(&sbsec->list);
4969                 goto next_sb;
4970         }
4971         spin_unlock(&sb_security_lock);
4972         spin_unlock(&sb_lock);
4973 }
4974
4975 /* SELinux requires early initialization in order to label
4976    all processes and objects when they are created. */
4977 security_initcall(selinux_init);
4978
4979 #if defined(CONFIG_NETFILTER)
4980
4981 static struct nf_hook_ops selinux_ipv4_op = {
4982         .hook =         selinux_ipv4_postroute_last,
4983         .owner =        THIS_MODULE,
4984         .pf =           PF_INET,
4985         .hooknum =      NF_IP_POST_ROUTING,
4986         .priority =     NF_IP_PRI_SELINUX_LAST,
4987 };
4988
4989 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4990
4991 static struct nf_hook_ops selinux_ipv6_op = {
4992         .hook =         selinux_ipv6_postroute_last,
4993         .owner =        THIS_MODULE,
4994         .pf =           PF_INET6,
4995         .hooknum =      NF_IP6_POST_ROUTING,
4996         .priority =     NF_IP6_PRI_SELINUX_LAST,
4997 };
4998
4999 #endif  /* IPV6 */
5000
5001 static int __init selinux_nf_ip_init(void)
5002 {
5003         int err = 0;
5004
5005         if (!selinux_enabled)
5006                 goto out;
5007
5008         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5009
5010         err = nf_register_hook(&selinux_ipv4_op);
5011         if (err)
5012                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5013
5014 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5015
5016         err = nf_register_hook(&selinux_ipv6_op);
5017         if (err)
5018                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5019
5020 #endif  /* IPV6 */
5021
5022 out:
5023         return err;
5024 }
5025
5026 __initcall(selinux_nf_ip_init);
5027
5028 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5029 static void selinux_nf_ip_exit(void)
5030 {
5031         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5032
5033         nf_unregister_hook(&selinux_ipv4_op);
5034 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5035         nf_unregister_hook(&selinux_ipv6_op);
5036 #endif  /* IPV6 */
5037 }
5038 #endif
5039
5040 #else /* CONFIG_NETFILTER */
5041
5042 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5043 #define selinux_nf_ip_exit()
5044 #endif
5045
5046 #endif /* CONFIG_NETFILTER */
5047
5048 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5049 int selinux_disable(void)
5050 {
5051         extern void exit_sel_fs(void);
5052         static int selinux_disabled = 0;
5053
5054         if (ss_initialized) {
5055                 /* Not permitted after initial policy load. */
5056                 return -EINVAL;
5057         }
5058
5059         if (selinux_disabled) {
5060                 /* Only do this once. */
5061                 return -EINVAL;
5062         }
5063
5064         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5065
5066         selinux_disabled = 1;
5067         selinux_enabled = 0;
5068
5069         /* Reset security_ops to the secondary module, dummy or capability. */
5070         security_ops = secondary_ops;
5071
5072         /* Unregister netfilter hooks. */
5073         selinux_nf_ip_exit();
5074
5075         /* Unregister selinuxfs. */
5076         exit_sel_fs();
5077
5078         return 0;
5079 }
5080 #endif
5081
5082