git.oblomov.eu Git - linux-2.6/blob - security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *                Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <asm/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "xfrm.h"
  84 #include "netlabel.h"
  85
  86 #define XATTR_SELINUX_SUFFIX "selinux"
  87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  88
  89 #define NUM_SEL_MNT_OPTS 4
  90
  91 extern unsigned int policydb_loaded_version;
  92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  93 extern int selinux_compat_net;
  94 extern struct security_operations *security_ops;
  95
  96 /* SECMARK reference count */
  97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 100 int selinux_enforcing = 0;
 101
 102 static int __init enforcing_setup(char *str)
 103 {
 104         selinux_enforcing = simple_strtol(str,NULL,0);
 105         return 1;
 106 }
 107 __setup("enforcing=", enforcing_setup);
 108 #endif
 109
 110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 112
 113 static int __init selinux_enabled_setup(char *str)
 114 {
 115         selinux_enabled = simple_strtol(str, NULL, 0);
 116         return 1;
 117 }
 118 __setup("selinux=", selinux_enabled_setup);
 119 #else
 120 int selinux_enabled = 1;
 121 #endif
 122
 123 /* Original (dummy) security module. */
 124 static struct security_operations *original_ops = NULL;
 125
 126 /* Minimal support for a secondary security module,
 127    just to allow the use of the dummy or capability modules.
 128    The owlsm module can alternatively be used as a secondary
 129    module as long as CONFIG_OWLSM_FD is not enabled. */
 130 static struct security_operations *secondary_ops = NULL;
 131
 132 /* Lists of inode and superblock security structures initialized
 133    before the policy was loaded. */
 134 static LIST_HEAD(superblock_security_head);
 135 static DEFINE_SPINLOCK(sb_security_lock);
 136
 137 static struct kmem_cache *sel_inode_cache;
 138
 139 /**
 140  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 141  *
 142  * Description:
 143  * This function checks the SECMARK reference counter to see if any SECMARK
 144  * targets are currently configured, if the reference counter is greater than
 145  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 146  * enabled, false (0) if SECMARK is disabled.
 147  *
 148  */
 149 static int selinux_secmark_enabled(void)
 150 {
 151         return (atomic_read(&selinux_secmark_refcount) > 0);
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_error = -1,
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 3,
 323         Opt_rootcontext = 4,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331         {Opt_error, NULL},
 332 };
 333
 334 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 335
 336 static int may_context_mount_sb_relabel(u32 sid,
 337                         struct superblock_security_struct *sbsec,
 338                         struct task_security_struct *tsec)
 339 {
 340         int rc;
 341
 342         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 343                           FILESYSTEM__RELABELFROM, NULL);
 344         if (rc)
 345                 return rc;
 346
 347         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELTO, NULL);
 349         return rc;
 350 }
 351
 352 static int may_context_mount_inode_relabel(u32 sid,
 353                         struct superblock_security_struct *sbsec,
 354                         struct task_security_struct *tsec)
 355 {
 356         int rc;
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__ASSOCIATE, NULL);
 364         return rc;
 365 }
 366
 367 static int sb_finish_set_opts(struct super_block *sb)
 368 {
 369         struct superblock_security_struct *sbsec = sb->s_security;
 370         struct dentry *root = sb->s_root;
 371         struct inode *root_inode = root->d_inode;
 372         int rc = 0;
 373
 374         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 375                 /* Make sure that the xattr handler exists and that no
 376                    error other than -ENODATA is returned by getxattr on
 377                    the root directory.  -ENODATA is ok, as this may be
 378                    the first boot of the SELinux kernel before we have
 379                    assigned xattr values to the filesystem. */
 380                 if (!root_inode->i_op->getxattr) {
 381                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 382                                "xattr support\n", sb->s_id, sb->s_type->name);
 383                         rc = -EOPNOTSUPP;
 384                         goto out;
 385                 }
 386                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 387                 if (rc < 0 && rc != -ENODATA) {
 388                         if (rc == -EOPNOTSUPP)
 389                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 390                                        "%s) has no security xattr handler\n",
 391                                        sb->s_id, sb->s_type->name);
 392                         else
 393                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 394                                        "%s) getxattr errno %d\n", sb->s_id,
 395                                        sb->s_type->name, -rc);
 396                         goto out;
 397                 }
 398         }
 399
 400         sbsec->initialized = 1;
 401
 402         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 404                        sb->s_id, sb->s_type->name);
 405         else
 406                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 407                        sb->s_id, sb->s_type->name,
 408                        labeling_behaviors[sbsec->behavior-1]);
 409
 410         /* Initialize the root inode. */
 411         rc = inode_doinit_with_dentry(root_inode, root);
 412
 413         /* Initialize any other inodes associated with the superblock, e.g.
 414            inodes created prior to initial policy load or inodes created
 415            during get_sb by a pseudo filesystem that directly
 416            populates itself. */
 417         spin_lock(&sbsec->isec_lock);
 418 next_inode:
 419         if (!list_empty(&sbsec->isec_head)) {
 420                 struct inode_security_struct *isec =
 421                                 list_entry(sbsec->isec_head.next,
 422                                            struct inode_security_struct, list);
 423                 struct inode *inode = isec->inode;
 424                 spin_unlock(&sbsec->isec_lock);
 425                 inode = igrab(inode);
 426                 if (inode) {
 427                         if (!IS_PRIVATE(inode))
 428                                 inode_doinit(inode);
 429                         iput(inode);
 430                 }
 431                 spin_lock(&sbsec->isec_lock);
 432                 list_del_init(&isec->list);
 433                 goto next_inode;
 434         }
 435         spin_unlock(&sbsec->isec_lock);
 436 out:
 437         return rc;
 438 }
 439
 440 /*
 441  * This function should allow an FS to ask what it's mount security
 442  * options were so it can use those later for submounts, displaying
 443  * mount options, or whatever.
 444  */
 445 static int selinux_get_mnt_opts(const struct super_block *sb,
 446                                 char ***mount_options, int **mnt_opts_flags,
 447                                 int *num_opts)
 448 {
 449         int rc = 0, i;
 450         struct superblock_security_struct *sbsec = sb->s_security;
 451         char *context = NULL;
 452         u32 len;
 453         char tmp;
 454
 455         *num_opts = 0;
 456         *mount_options = NULL;
 457         *mnt_opts_flags = NULL;
 458
 459         if (!sbsec->initialized)
 460                 return -EINVAL;
 461
 462         if (!ss_initialized)
 463                 return -EINVAL;
 464
 465         /*
 466          * if we ever use sbsec flags for anything other than tracking mount
 467          * settings this is going to need a mask
 468          */
 469         tmp = sbsec->flags;
 470         /* count the number of mount options for this sb */
 471         for (i = 0; i < 8; i++) {
 472                 if (tmp & 0x01)
 473                         (*num_opts)++;
 474                 tmp >>= 1;
 475         }
 476
 477         *mount_options = kcalloc(*num_opts, sizeof(char *), GFP_ATOMIC);
 478         if (!*mount_options) {
 479                 rc = -ENOMEM;
 480                 goto out_free;
 481         }
 482
 483         *mnt_opts_flags = kcalloc(*num_opts, sizeof(int), GFP_ATOMIC);
 484         if (!*mnt_opts_flags) {
 485                 rc = -ENOMEM;
 486                 goto out_free;
 487         }
 488
 489         i = 0;
 490         if (sbsec->flags & FSCONTEXT_MNT) {
 491                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 492                 if (rc)
 493                         goto out_free;
 494                 (*mount_options)[i] = context;
 495                 (*mnt_opts_flags)[i++] = FSCONTEXT_MNT;
 496         }
 497         if (sbsec->flags & CONTEXT_MNT) {
 498                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 499                 if (rc)
 500                         goto out_free;
 501                 (*mount_options)[i] = context;
 502                 (*mnt_opts_flags)[i++] = CONTEXT_MNT;
 503         }
 504         if (sbsec->flags & DEFCONTEXT_MNT) {
 505                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 506                 if (rc)
 507                         goto out_free;
 508                 (*mount_options)[i] = context;
 509                 (*mnt_opts_flags)[i++] = DEFCONTEXT_MNT;
 510         }
 511         if (sbsec->flags & ROOTCONTEXT_MNT) {
 512                 struct inode *root = sbsec->sb->s_root->d_inode;
 513                 struct inode_security_struct *isec = root->i_security;
 514
 515                 rc = security_sid_to_context(isec->sid, &context, &len);
 516                 if (rc)
 517                         goto out_free;
 518                 (*mount_options)[i] = context;
 519                 (*mnt_opts_flags)[i++] = ROOTCONTEXT_MNT;
 520         }
 521
 522         BUG_ON(i != *num_opts);
 523
 524         return 0;
 525
 526 out_free:
 527         /* don't leak context string if security_sid_to_context had an error */
 528         if (*mount_options && i)
 529                 for (; i > 0; i--)
 530                         kfree((*mount_options)[i-1]);
 531         kfree(*mount_options);
 532         *mount_options = NULL;
 533         kfree(*mnt_opts_flags);
 534         *mnt_opts_flags = NULL;
 535         *num_opts = 0;
 536         return rc;
 537 }
 538
 539 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 540                       u32 old_sid, u32 new_sid)
 541 {
 542         /* check if the old mount command had the same options */
 543         if (sbsec->initialized)
 544                 if (!(sbsec->flags & flag) ||
 545                     (old_sid != new_sid))
 546                         return 1;
 547
 548         /* check if we were passed the same options twice,
 549          * aka someone passed context=a,context=b
 550          */
 551         if (!sbsec->initialized)
 552                 if (sbsec->flags & flag)
 553                         return 1;
 554         return 0;
 555 }
 556 /*
 557  * Allow filesystems with binary mount data to explicitly set mount point
 558  * labeling information.
 559  */
 560 static int selinux_set_mnt_opts(struct super_block *sb, char **mount_options,
 561                                 int *flags, int num_opts)
 562 {
 563         int rc = 0, i;
 564         struct task_security_struct *tsec = current->security;
 565         struct superblock_security_struct *sbsec = sb->s_security;
 566         const char *name = sb->s_type->name;
 567         struct inode *inode = sbsec->sb->s_root->d_inode;
 568         struct inode_security_struct *root_isec = inode->i_security;
 569         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 570         u32 defcontext_sid = 0;
 571
 572         mutex_lock(&sbsec->lock);
 573
 574         if (!ss_initialized) {
 575                 if (!num_opts) {
 576                         /* Defer initialization until selinux_complete_init,
 577                            after the initial policy is loaded and the security
 578                            server is ready to handle calls. */
 579                         spin_lock(&sb_security_lock);
 580                         if (list_empty(&sbsec->list))
 581                                 list_add(&sbsec->list, &superblock_security_head);
 582                         spin_unlock(&sb_security_lock);
 583                         goto out;
 584                 }
 585                 rc = -EINVAL;
 586                 printk(KERN_WARNING "Unable to set superblock options before "
 587                        "the security server is initialized\n");
 588                 goto out;
 589         }
 590
 591         /*
 592          * parse the mount options, check if they are valid sids.
 593          * also check if someone is trying to mount the same sb more
 594          * than once with different security options.
 595          */
 596         for (i = 0; i < num_opts; i++) {
 597                 u32 sid;
 598                 rc = security_context_to_sid(mount_options[i],
 599                                              strlen(mount_options[i]), &sid);
 600                 if (rc) {
 601                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 602                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 603                                mount_options[i], sb->s_id, name, rc);
 604                         goto out;
 605                 }
 606                 switch (flags[i]) {
 607                 case FSCONTEXT_MNT:
 608                         fscontext_sid = sid;
 609
 610                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 611                                         fscontext_sid))
 612                                 goto out_double_mount;
 613
 614                         sbsec->flags |= FSCONTEXT_MNT;
 615                         break;
 616                 case CONTEXT_MNT:
 617                         context_sid = sid;
 618
 619                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 620                                         context_sid))
 621                                 goto out_double_mount;
 622
 623                         sbsec->flags |= CONTEXT_MNT;
 624                         break;
 625                 case ROOTCONTEXT_MNT:
 626                         rootcontext_sid = sid;
 627
 628                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 629                                         rootcontext_sid))
 630                                 goto out_double_mount;
 631
 632                         sbsec->flags |= ROOTCONTEXT_MNT;
 633
 634                         break;
 635                 case DEFCONTEXT_MNT:
 636                         defcontext_sid = sid;
 637
 638                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 639                                         defcontext_sid))
 640                                 goto out_double_mount;
 641
 642                         sbsec->flags |= DEFCONTEXT_MNT;
 643
 644                         break;
 645                 default:
 646                         rc = -EINVAL;
 647                         goto out;
 648                 }
 649         }
 650
 651         if (sbsec->initialized) {
 652                 /* previously mounted with options, but not on this attempt? */
 653                 if (sbsec->flags && !num_opts)
 654                         goto out_double_mount;
 655                 rc = 0;
 656                 goto out;
 657         }
 658
 659         if (strcmp(sb->s_type->name, "proc") == 0)
 660                 sbsec->proc = 1;
 661
 662         /* Determine the labeling behavior to use for this filesystem type. */
 663         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 664         if (rc) {
 665                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 666                        __FUNCTION__, sb->s_type->name, rc);
 667                 goto out;
 668         }
 669
 670         /* sets the context of the superblock for the fs being mounted. */
 671         if (fscontext_sid) {
 672
 673                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 674                 if (rc)
 675                         goto out;
 676
 677                 sbsec->sid = fscontext_sid;
 678         }
 679
 680         /*
 681          * Switch to using mount point labeling behavior.
 682          * sets the label used on all file below the mountpoint, and will set
 683          * the superblock context if not already set.
 684          */
 685         if (context_sid) {
 686                 if (!fscontext_sid) {
 687                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 688                         if (rc)
 689                                 goto out;
 690                         sbsec->sid = context_sid;
 691                 } else {
 692                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 693                         if (rc)
 694                                 goto out;
 695                 }
 696                 if (!rootcontext_sid)
 697                         rootcontext_sid = context_sid;
 698
 699                 sbsec->mntpoint_sid = context_sid;
 700                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 701         }
 702
 703         if (rootcontext_sid) {
 704                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 705                 if (rc)
 706                         goto out;
 707
 708                 root_isec->sid = rootcontext_sid;
 709                 root_isec->initialized = 1;
 710         }
 711
 712         if (defcontext_sid) {
 713                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 714                         rc = -EINVAL;
 715                         printk(KERN_WARNING "SELinux: defcontext option is "
 716                                "invalid for this filesystem type\n");
 717                         goto out;
 718                 }
 719
 720                 if (defcontext_sid != sbsec->def_sid) {
 721                         rc = may_context_mount_inode_relabel(defcontext_sid,
 722                                                              sbsec, tsec);
 723                         if (rc)
 724                                 goto out;
 725                 }
 726
 727                 sbsec->def_sid = defcontext_sid;
 728         }
 729
 730         rc = sb_finish_set_opts(sb);
 731 out:
 732         mutex_unlock(&sbsec->lock);
 733         return rc;
 734 out_double_mount:
 735         rc = -EINVAL;
 736         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 737                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 738         goto out;
 739 }
 740
 741 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 742                                         struct super_block *newsb)
 743 {
 744         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 745         struct superblock_security_struct *newsbsec = newsb->s_security;
 746
 747         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 748         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 749         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 750
 751         /* we can't error, we can't save the info, this shouldn't get called
 752          * this early in the boot process. */
 753         BUG_ON(!ss_initialized);
 754
 755         /* this might go away sometime down the line if there is a new user
 756          * of clone, but for now, nfs better not get here... */
 757         BUG_ON(newsbsec->initialized);
 758
 759         /* how can we clone if the old one wasn't set up?? */
 760         BUG_ON(!oldsbsec->initialized);
 761
 762         mutex_lock(&newsbsec->lock);
 763
 764         newsbsec->flags = oldsbsec->flags;
 765
 766         newsbsec->sid = oldsbsec->sid;
 767         newsbsec->def_sid = oldsbsec->def_sid;
 768         newsbsec->behavior = oldsbsec->behavior;
 769
 770         if (set_context) {
 771                 u32 sid = oldsbsec->mntpoint_sid;
 772
 773                 if (!set_fscontext)
 774                         newsbsec->sid = sid;
 775                 if (!set_rootcontext) {
 776                         struct inode *newinode = newsb->s_root->d_inode;
 777                         struct inode_security_struct *newisec = newinode->i_security;
 778                         newisec->sid = sid;
 779                 }
 780                 newsbsec->mntpoint_sid = sid;
 781         }
 782         if (set_rootcontext) {
 783                 const struct inode *oldinode = oldsb->s_root->d_inode;
 784                 const struct inode_security_struct *oldisec = oldinode->i_security;
 785                 struct inode *newinode = newsb->s_root->d_inode;
 786                 struct inode_security_struct *newisec = newinode->i_security;
 787
 788                 newisec->sid = oldisec->sid;
 789         }
 790
 791         sb_finish_set_opts(newsb);
 792         mutex_unlock(&newsbsec->lock);
 793 }
 794
 795 /*
 796  * string mount options parsing and call set the sbsec
 797  */
 798 static int superblock_doinit(struct super_block *sb, void *data)
 799 {
 800         char *context = NULL, *defcontext = NULL;
 801         char *fscontext = NULL, *rootcontext = NULL;
 802         int rc = 0;
 803         char *p, *options = data;
 804         /* selinux only know about a fixed number of mount options */
 805         char *mnt_opts[NUM_SEL_MNT_OPTS];
 806         int mnt_opts_flags[NUM_SEL_MNT_OPTS], num_mnt_opts = 0;
 807
 808         if (!data)
 809                 goto out;
 810
 811         /* with the nfs patch this will become a goto out; */
 812         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 813                 const char *name = sb->s_type->name;
 814                 /* NFS we understand. */
 815                 if (!strcmp(name, "nfs")) {
 816                         struct nfs_mount_data *d = data;
 817
 818                         if (d->version !=  NFS_MOUNT_VERSION)
 819                                 goto out;
 820
 821                         if (d->context[0]) {
 822                                 context = kstrdup(d->context, GFP_KERNEL);
 823                                 if (!context) {
 824                                         rc = -ENOMEM;
 825                                         goto out;
 826                                 }
 827                         }
 828                         goto build_flags;
 829                 } else
 830                         goto out;
 831         }
 832
 833         /* Standard string-based options. */
 834         while ((p = strsep(&options, "|")) != NULL) {
 835                 int token;
 836                 substring_t args[MAX_OPT_ARGS];
 837
 838                 if (!*p)
 839                         continue;
 840
 841                 token = match_token(p, tokens, args);
 842
 843                 switch (token) {
 844                 case Opt_context:
 845                         if (context || defcontext) {
 846                                 rc = -EINVAL;
 847                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 848                                 goto out_err;
 849                         }
 850                         context = match_strdup(&args[0]);
 851                         if (!context) {
 852                                 rc = -ENOMEM;
 853                                 goto out_err;
 854                         }
 855                         break;
 856
 857                 case Opt_fscontext:
 858                         if (fscontext) {
 859                                 rc = -EINVAL;
 860                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 861                                 goto out_err;
 862                         }
 863                         fscontext = match_strdup(&args[0]);
 864                         if (!fscontext) {
 865                                 rc = -ENOMEM;
 866                                 goto out_err;
 867                         }
 868                         break;
 869
 870                 case Opt_rootcontext:
 871                         if (rootcontext) {
 872                                 rc = -EINVAL;
 873                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 874                                 goto out_err;
 875                         }
 876                         rootcontext = match_strdup(&args[0]);
 877                         if (!rootcontext) {
 878                                 rc = -ENOMEM;
 879                                 goto out_err;
 880                         }
 881                         break;
 882
 883                 case Opt_defcontext:
 884                         if (context || defcontext) {
 885                                 rc = -EINVAL;
 886                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 887                                 goto out_err;
 888                         }
 889                         defcontext = match_strdup(&args[0]);
 890                         if (!defcontext) {
 891                                 rc = -ENOMEM;
 892                                 goto out_err;
 893                         }
 894                         break;
 895
 896                 default:
 897                         rc = -EINVAL;
 898                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 899                         goto out_err;
 900
 901                 }
 902         }
 903
 904 build_flags:
 905         if (fscontext) {
 906                 mnt_opts[num_mnt_opts] = fscontext;
 907                 mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 908         }
 909         if (context) {
 910                 mnt_opts[num_mnt_opts] = context;
 911                 mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 912         }
 913         if (rootcontext) {
 914                 mnt_opts[num_mnt_opts] = rootcontext;
 915                 mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 916         }
 917         if (defcontext) {
 918                 mnt_opts[num_mnt_opts] = defcontext;
 919                 mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 920         }
 921
 922 out:
 923         rc = selinux_set_mnt_opts(sb, mnt_opts, mnt_opts_flags, num_mnt_opts);
 924 out_err:
 925         kfree(context);
 926         kfree(defcontext);
 927         kfree(fscontext);
 928         kfree(rootcontext);
 929         return rc;
 930 }
 931
 932 static inline u16 inode_mode_to_security_class(umode_t mode)
 933 {
 934         switch (mode & S_IFMT) {
 935         case S_IFSOCK:
 936                 return SECCLASS_SOCK_FILE;
 937         case S_IFLNK:
 938                 return SECCLASS_LNK_FILE;
 939         case S_IFREG:
 940                 return SECCLASS_FILE;
 941         case S_IFBLK:
 942                 return SECCLASS_BLK_FILE;
 943         case S_IFDIR:
 944                 return SECCLASS_DIR;
 945         case S_IFCHR:
 946                 return SECCLASS_CHR_FILE;
 947         case S_IFIFO:
 948                 return SECCLASS_FIFO_FILE;
 949
 950         }
 951
 952         return SECCLASS_FILE;
 953 }
 954
 955 static inline int default_protocol_stream(int protocol)
 956 {
 957         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 958 }
 959
 960 static inline int default_protocol_dgram(int protocol)
 961 {
 962         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 963 }
 964
 965 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 966 {
 967         switch (family) {
 968         case PF_UNIX:
 969                 switch (type) {
 970                 case SOCK_STREAM:
 971                 case SOCK_SEQPACKET:
 972                         return SECCLASS_UNIX_STREAM_SOCKET;
 973                 case SOCK_DGRAM:
 974                         return SECCLASS_UNIX_DGRAM_SOCKET;
 975                 }
 976                 break;
 977         case PF_INET:
 978         case PF_INET6:
 979                 switch (type) {
 980                 case SOCK_STREAM:
 981                         if (default_protocol_stream(protocol))
 982                                 return SECCLASS_TCP_SOCKET;
 983                         else
 984                                 return SECCLASS_RAWIP_SOCKET;
 985                 case SOCK_DGRAM:
 986                         if (default_protocol_dgram(protocol))
 987                                 return SECCLASS_UDP_SOCKET;
 988                         else
 989                                 return SECCLASS_RAWIP_SOCKET;
 990                 case SOCK_DCCP:
 991                         return SECCLASS_DCCP_SOCKET;
 992                 default:
 993                         return SECCLASS_RAWIP_SOCKET;
 994                 }
 995                 break;
 996         case PF_NETLINK:
 997                 switch (protocol) {
 998                 case NETLINK_ROUTE:
 999                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1000                 case NETLINK_FIREWALL:
1001                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1002                 case NETLINK_INET_DIAG:
1003                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1004                 case NETLINK_NFLOG:
1005                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1006                 case NETLINK_XFRM:
1007                         return SECCLASS_NETLINK_XFRM_SOCKET;
1008                 case NETLINK_SELINUX:
1009                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1010                 case NETLINK_AUDIT:
1011                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1012                 case NETLINK_IP6_FW:
1013                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1014                 case NETLINK_DNRTMSG:
1015                         return SECCLASS_NETLINK_DNRT_SOCKET;
1016                 case NETLINK_KOBJECT_UEVENT:
1017                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1018                 default:
1019                         return SECCLASS_NETLINK_SOCKET;
1020                 }
1021         case PF_PACKET:
1022                 return SECCLASS_PACKET_SOCKET;
1023         case PF_KEY:
1024                 return SECCLASS_KEY_SOCKET;
1025         case PF_APPLETALK:
1026                 return SECCLASS_APPLETALK_SOCKET;
1027         }
1028
1029         return SECCLASS_SOCKET;
1030 }
1031
1032 #ifdef CONFIG_PROC_FS
1033 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1034                                 u16 tclass,
1035                                 u32 *sid)
1036 {
1037         int buflen, rc;
1038         char *buffer, *path, *end;
1039
1040         buffer = (char*)__get_free_page(GFP_KERNEL);
1041         if (!buffer)
1042                 return -ENOMEM;
1043
1044         buflen = PAGE_SIZE;
1045         end = buffer+buflen;
1046         *--end = '\0';
1047         buflen--;
1048         path = end-1;
1049         *path = '/';
1050         while (de && de != de->parent) {
1051                 buflen -= de->namelen + 1;
1052                 if (buflen < 0)
1053                         break;
1054                 end -= de->namelen;
1055                 memcpy(end, de->name, de->namelen);
1056                 *--end = '/';
1057                 path = end;
1058                 de = de->parent;
1059         }
1060         rc = security_genfs_sid("proc", path, tclass, sid);
1061         free_page((unsigned long)buffer);
1062         return rc;
1063 }
1064 #else
1065 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1066                                 u16 tclass,
1067                                 u32 *sid)
1068 {
1069         return -EINVAL;
1070 }
1071 #endif
1072
1073 /* The inode's security attributes must be initialized before first use. */
1074 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1075 {
1076         struct superblock_security_struct *sbsec = NULL;
1077         struct inode_security_struct *isec = inode->i_security;
1078         u32 sid;
1079         struct dentry *dentry;
1080 #define INITCONTEXTLEN 255
1081         char *context = NULL;
1082         unsigned len = 0;
1083         int rc = 0;
1084
1085         if (isec->initialized)
1086                 goto out;
1087
1088         mutex_lock(&isec->lock);
1089         if (isec->initialized)
1090                 goto out_unlock;
1091
1092         sbsec = inode->i_sb->s_security;
1093         if (!sbsec->initialized) {
1094                 /* Defer initialization until selinux_complete_init,
1095                    after the initial policy is loaded and the security
1096                    server is ready to handle calls. */
1097                 spin_lock(&sbsec->isec_lock);
1098                 if (list_empty(&isec->list))
1099                         list_add(&isec->list, &sbsec->isec_head);
1100                 spin_unlock(&sbsec->isec_lock);
1101                 goto out_unlock;
1102         }
1103
1104         switch (sbsec->behavior) {
1105         case SECURITY_FS_USE_XATTR:
1106                 if (!inode->i_op->getxattr) {
1107                         isec->sid = sbsec->def_sid;
1108                         break;
1109                 }
1110
1111                 /* Need a dentry, since the xattr API requires one.
1112                    Life would be simpler if we could just pass the inode. */
1113                 if (opt_dentry) {
1114                         /* Called from d_instantiate or d_splice_alias. */
1115                         dentry = dget(opt_dentry);
1116                 } else {
1117                         /* Called from selinux_complete_init, try to find a dentry. */
1118                         dentry = d_find_alias(inode);
1119                 }
1120                 if (!dentry) {
1121                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
1122                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1123                                inode->i_ino);
1124                         goto out_unlock;
1125                 }
1126
1127                 len = INITCONTEXTLEN;
1128                 context = kmalloc(len, GFP_KERNEL);
1129                 if (!context) {
1130                         rc = -ENOMEM;
1131                         dput(dentry);
1132                         goto out_unlock;
1133                 }
1134                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1135                                            context, len);
1136                 if (rc == -ERANGE) {
1137                         /* Need a larger buffer.  Query for the right size. */
1138                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1139                                                    NULL, 0);
1140                         if (rc < 0) {
1141                                 dput(dentry);
1142                                 goto out_unlock;
1143                         }
1144                         kfree(context);
1145                         len = rc;
1146                         context = kmalloc(len, GFP_KERNEL);
1147                         if (!context) {
1148                                 rc = -ENOMEM;
1149                                 dput(dentry);
1150                                 goto out_unlock;
1151                         }
1152                         rc = inode->i_op->getxattr(dentry,
1153                                                    XATTR_NAME_SELINUX,
1154                                                    context, len);
1155                 }
1156                 dput(dentry);
1157                 if (rc < 0) {
1158                         if (rc != -ENODATA) {
1159                                 printk(KERN_WARNING "%s:  getxattr returned "
1160                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
1161                                        -rc, inode->i_sb->s_id, inode->i_ino);
1162                                 kfree(context);
1163                                 goto out_unlock;
1164                         }
1165                         /* Map ENODATA to the default file SID */
1166                         sid = sbsec->def_sid;
1167                         rc = 0;
1168                 } else {
1169                         rc = security_context_to_sid_default(context, rc, &sid,
1170                                                              sbsec->def_sid);
1171                         if (rc) {
1172                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
1173                                        "returned %d for dev=%s ino=%ld\n",
1174                                        __FUNCTION__, context, -rc,
1175                                        inode->i_sb->s_id, inode->i_ino);
1176                                 kfree(context);
1177                                 /* Leave with the unlabeled SID */
1178                                 rc = 0;
1179                                 break;
1180                         }
1181                 }
1182                 kfree(context);
1183                 isec->sid = sid;
1184                 break;
1185         case SECURITY_FS_USE_TASK:
1186                 isec->sid = isec->task_sid;
1187                 break;
1188         case SECURITY_FS_USE_TRANS:
1189                 /* Default to the fs SID. */
1190                 isec->sid = sbsec->sid;
1191
1192                 /* Try to obtain a transition SID. */
1193                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1194                 rc = security_transition_sid(isec->task_sid,
1195                                              sbsec->sid,
1196                                              isec->sclass,
1197                                              &sid);
1198                 if (rc)
1199                         goto out_unlock;
1200                 isec->sid = sid;
1201                 break;
1202         case SECURITY_FS_USE_MNTPOINT:
1203                 isec->sid = sbsec->mntpoint_sid;
1204                 break;
1205         default:
1206                 /* Default to the fs superblock SID. */
1207                 isec->sid = sbsec->sid;
1208
1209                 if (sbsec->proc) {
1210                         struct proc_inode *proci = PROC_I(inode);
1211                         if (proci->pde) {
1212                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1213                                 rc = selinux_proc_get_sid(proci->pde,
1214                                                           isec->sclass,
1215                                                           &sid);
1216                                 if (rc)
1217                                         goto out_unlock;
1218                                 isec->sid = sid;
1219                         }
1220                 }
1221                 break;
1222         }
1223
1224         isec->initialized = 1;
1225
1226 out_unlock:
1227         mutex_unlock(&isec->lock);
1228 out:
1229         if (isec->sclass == SECCLASS_FILE)
1230                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1231         return rc;
1232 }
1233
1234 /* Convert a Linux signal to an access vector. */
1235 static inline u32 signal_to_av(int sig)
1236 {
1237         u32 perm = 0;
1238
1239         switch (sig) {
1240         case SIGCHLD:
1241                 /* Commonly granted from child to parent. */
1242                 perm = PROCESS__SIGCHLD;
1243                 break;
1244         case SIGKILL:
1245                 /* Cannot be caught or ignored */
1246                 perm = PROCESS__SIGKILL;
1247                 break;
1248         case SIGSTOP:
1249                 /* Cannot be caught or ignored */
1250                 perm = PROCESS__SIGSTOP;
1251                 break;
1252         default:
1253                 /* All other signals. */
1254                 perm = PROCESS__SIGNAL;
1255                 break;
1256         }
1257
1258         return perm;
1259 }
1260
1261 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1262    fork check, ptrace check, etc. */
1263 static int task_has_perm(struct task_struct *tsk1,
1264                          struct task_struct *tsk2,
1265                          u32 perms)
1266 {
1267         struct task_security_struct *tsec1, *tsec2;
1268
1269         tsec1 = tsk1->security;
1270         tsec2 = tsk2->security;
1271         return avc_has_perm(tsec1->sid, tsec2->sid,
1272                             SECCLASS_PROCESS, perms, NULL);
1273 }
1274
1275 /* Check whether a task is allowed to use a capability. */
1276 static int task_has_capability(struct task_struct *tsk,
1277                                int cap)
1278 {
1279         struct task_security_struct *tsec;
1280         struct avc_audit_data ad;
1281
1282         tsec = tsk->security;
1283
1284         AVC_AUDIT_DATA_INIT(&ad,CAP);
1285         ad.tsk = tsk;
1286         ad.u.cap = cap;
1287
1288         return avc_has_perm(tsec->sid, tsec->sid,
1289                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1290 }
1291
1292 /* Check whether a task is allowed to use a system operation. */
1293 static int task_has_system(struct task_struct *tsk,
1294                            u32 perms)
1295 {
1296         struct task_security_struct *tsec;
1297
1298         tsec = tsk->security;
1299
1300         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1301                             SECCLASS_SYSTEM, perms, NULL);
1302 }
1303
1304 /* Check whether a task has a particular permission to an inode.
1305    The 'adp' parameter is optional and allows other audit
1306    data to be passed (e.g. the dentry). */
1307 static int inode_has_perm(struct task_struct *tsk,
1308                           struct inode *inode,
1309                           u32 perms,
1310                           struct avc_audit_data *adp)
1311 {
1312         struct task_security_struct *tsec;
1313         struct inode_security_struct *isec;
1314         struct avc_audit_data ad;
1315
1316         if (unlikely (IS_PRIVATE (inode)))
1317                 return 0;
1318
1319         tsec = tsk->security;
1320         isec = inode->i_security;
1321
1322         if (!adp) {
1323                 adp = &ad;
1324                 AVC_AUDIT_DATA_INIT(&ad, FS);
1325                 ad.u.fs.inode = inode;
1326         }
1327
1328         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1329 }
1330
1331 /* Same as inode_has_perm, but pass explicit audit data containing
1332    the dentry to help the auditing code to more easily generate the
1333    pathname if needed. */
1334 static inline int dentry_has_perm(struct task_struct *tsk,
1335                                   struct vfsmount *mnt,
1336                                   struct dentry *dentry,
1337                                   u32 av)
1338 {
1339         struct inode *inode = dentry->d_inode;
1340         struct avc_audit_data ad;
1341         AVC_AUDIT_DATA_INIT(&ad,FS);
1342         ad.u.fs.mnt = mnt;
1343         ad.u.fs.dentry = dentry;
1344         return inode_has_perm(tsk, inode, av, &ad);
1345 }
1346
1347 /* Check whether a task can use an open file descriptor to
1348    access an inode in a given way.  Check access to the
1349    descriptor itself, and then use dentry_has_perm to
1350    check a particular permission to the file.
1351    Access to the descriptor is implicitly granted if it
1352    has the same SID as the process.  If av is zero, then
1353    access to the file is not checked, e.g. for cases
1354    where only the descriptor is affected like seek. */
1355 static int file_has_perm(struct task_struct *tsk,
1356                                 struct file *file,
1357                                 u32 av)
1358 {
1359         struct task_security_struct *tsec = tsk->security;
1360         struct file_security_struct *fsec = file->f_security;
1361         struct vfsmount *mnt = file->f_path.mnt;
1362         struct dentry *dentry = file->f_path.dentry;
1363         struct inode *inode = dentry->d_inode;
1364         struct avc_audit_data ad;
1365         int rc;
1366
1367         AVC_AUDIT_DATA_INIT(&ad, FS);
1368         ad.u.fs.mnt = mnt;
1369         ad.u.fs.dentry = dentry;
1370
1371         if (tsec->sid != fsec->sid) {
1372                 rc = avc_has_perm(tsec->sid, fsec->sid,
1373                                   SECCLASS_FD,
1374                                   FD__USE,
1375                                   &ad);
1376                 if (rc)
1377                         return rc;
1378         }
1379
1380         /* av is zero if only checking access to the descriptor. */
1381         if (av)
1382                 return inode_has_perm(tsk, inode, av, &ad);
1383
1384         return 0;
1385 }
1386
1387 /* Check whether a task can create a file. */
1388 static int may_create(struct inode *dir,
1389                       struct dentry *dentry,
1390                       u16 tclass)
1391 {
1392         struct task_security_struct *tsec;
1393         struct inode_security_struct *dsec;
1394         struct superblock_security_struct *sbsec;
1395         u32 newsid;
1396         struct avc_audit_data ad;
1397         int rc;
1398
1399         tsec = current->security;
1400         dsec = dir->i_security;
1401         sbsec = dir->i_sb->s_security;
1402
1403         AVC_AUDIT_DATA_INIT(&ad, FS);
1404         ad.u.fs.dentry = dentry;
1405
1406         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1407                           DIR__ADD_NAME | DIR__SEARCH,
1408                           &ad);
1409         if (rc)
1410                 return rc;
1411
1412         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1413                 newsid = tsec->create_sid;
1414         } else {
1415                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1416                                              &newsid);
1417                 if (rc)
1418                         return rc;
1419         }
1420
1421         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1422         if (rc)
1423                 return rc;
1424
1425         return avc_has_perm(newsid, sbsec->sid,
1426                             SECCLASS_FILESYSTEM,
1427                             FILESYSTEM__ASSOCIATE, &ad);
1428 }
1429
1430 /* Check whether a task can create a key. */
1431 static int may_create_key(u32 ksid,
1432                           struct task_struct *ctx)
1433 {
1434         struct task_security_struct *tsec;
1435
1436         tsec = ctx->security;
1437
1438         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1439 }
1440
1441 #define MAY_LINK   0
1442 #define MAY_UNLINK 1
1443 #define MAY_RMDIR  2
1444
1445 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1446 static int may_link(struct inode *dir,
1447                     struct dentry *dentry,
1448                     int kind)
1449
1450 {
1451         struct task_security_struct *tsec;
1452         struct inode_security_struct *dsec, *isec;
1453         struct avc_audit_data ad;
1454         u32 av;
1455         int rc;
1456
1457         tsec = current->security;
1458         dsec = dir->i_security;
1459         isec = dentry->d_inode->i_security;
1460
1461         AVC_AUDIT_DATA_INIT(&ad, FS);
1462         ad.u.fs.dentry = dentry;
1463
1464         av = DIR__SEARCH;
1465         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1466         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1467         if (rc)
1468                 return rc;
1469
1470         switch (kind) {
1471         case MAY_LINK:
1472                 av = FILE__LINK;
1473                 break;
1474         case MAY_UNLINK:
1475                 av = FILE__UNLINK;
1476                 break;
1477         case MAY_RMDIR:
1478                 av = DIR__RMDIR;
1479                 break;
1480         default:
1481                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1482                 return 0;
1483         }
1484
1485         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1486         return rc;
1487 }
1488
1489 static inline int may_rename(struct inode *old_dir,
1490                              struct dentry *old_dentry,
1491                              struct inode *new_dir,
1492                              struct dentry *new_dentry)
1493 {
1494         struct task_security_struct *tsec;
1495         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1496         struct avc_audit_data ad;
1497         u32 av;
1498         int old_is_dir, new_is_dir;
1499         int rc;
1500
1501         tsec = current->security;
1502         old_dsec = old_dir->i_security;
1503         old_isec = old_dentry->d_inode->i_security;
1504         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1505         new_dsec = new_dir->i_security;
1506
1507         AVC_AUDIT_DATA_INIT(&ad, FS);
1508
1509         ad.u.fs.dentry = old_dentry;
1510         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1511                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1512         if (rc)
1513                 return rc;
1514         rc = avc_has_perm(tsec->sid, old_isec->sid,
1515                           old_isec->sclass, FILE__RENAME, &ad);
1516         if (rc)
1517                 return rc;
1518         if (old_is_dir && new_dir != old_dir) {
1519                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1520                                   old_isec->sclass, DIR__REPARENT, &ad);
1521                 if (rc)
1522                         return rc;
1523         }
1524
1525         ad.u.fs.dentry = new_dentry;
1526         av = DIR__ADD_NAME | DIR__SEARCH;
1527         if (new_dentry->d_inode)
1528                 av |= DIR__REMOVE_NAME;
1529         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1530         if (rc)
1531                 return rc;
1532         if (new_dentry->d_inode) {
1533                 new_isec = new_dentry->d_inode->i_security;
1534                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1535                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1536                                   new_isec->sclass,
1537                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1538                 if (rc)
1539                         return rc;
1540         }
1541
1542         return 0;
1543 }
1544
1545 /* Check whether a task can perform a filesystem operation. */
1546 static int superblock_has_perm(struct task_struct *tsk,
1547                                struct super_block *sb,
1548                                u32 perms,
1549                                struct avc_audit_data *ad)
1550 {
1551         struct task_security_struct *tsec;
1552         struct superblock_security_struct *sbsec;
1553
1554         tsec = tsk->security;
1555         sbsec = sb->s_security;
1556         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1557                             perms, ad);
1558 }
1559
1560 /* Convert a Linux mode and permission mask to an access vector. */
1561 static inline u32 file_mask_to_av(int mode, int mask)
1562 {
1563         u32 av = 0;
1564
1565         if ((mode & S_IFMT) != S_IFDIR) {
1566                 if (mask & MAY_EXEC)
1567                         av |= FILE__EXECUTE;
1568                 if (mask & MAY_READ)
1569                         av |= FILE__READ;
1570
1571                 if (mask & MAY_APPEND)
1572                         av |= FILE__APPEND;
1573                 else if (mask & MAY_WRITE)
1574                         av |= FILE__WRITE;
1575
1576         } else {
1577                 if (mask & MAY_EXEC)
1578                         av |= DIR__SEARCH;
1579                 if (mask & MAY_WRITE)
1580                         av |= DIR__WRITE;
1581                 if (mask & MAY_READ)
1582                         av |= DIR__READ;
1583         }
1584
1585         return av;
1586 }
1587
1588 /* Convert a Linux file to an access vector. */
1589 static inline u32 file_to_av(struct file *file)
1590 {
1591         u32 av = 0;
1592
1593         if (file->f_mode & FMODE_READ)
1594                 av |= FILE__READ;
1595         if (file->f_mode & FMODE_WRITE) {
1596                 if (file->f_flags & O_APPEND)
1597                         av |= FILE__APPEND;
1598                 else
1599                         av |= FILE__WRITE;
1600         }
1601
1602         return av;
1603 }
1604
1605 /* Hook functions begin here. */
1606
1607 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1608 {
1609         struct task_security_struct *psec = parent->security;
1610         struct task_security_struct *csec = child->security;
1611         int rc;
1612
1613         rc = secondary_ops->ptrace(parent,child);
1614         if (rc)
1615                 return rc;
1616
1617         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1618         /* Save the SID of the tracing process for later use in apply_creds. */
1619         if (!(child->ptrace & PT_PTRACED) && !rc)
1620                 csec->ptrace_sid = psec->sid;
1621         return rc;
1622 }
1623
1624 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1625                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1626 {
1627         int error;
1628
1629         error = task_has_perm(current, target, PROCESS__GETCAP);
1630         if (error)
1631                 return error;
1632
1633         return secondary_ops->capget(target, effective, inheritable, permitted);
1634 }
1635
1636 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1637                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1638 {
1639         int error;
1640
1641         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1642         if (error)
1643                 return error;
1644
1645         return task_has_perm(current, target, PROCESS__SETCAP);
1646 }
1647
1648 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1649                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1650 {
1651         secondary_ops->capset_set(target, effective, inheritable, permitted);
1652 }
1653
1654 static int selinux_capable(struct task_struct *tsk, int cap)
1655 {
1656         int rc;
1657
1658         rc = secondary_ops->capable(tsk, cap);
1659         if (rc)
1660                 return rc;
1661
1662         return task_has_capability(tsk,cap);
1663 }
1664
1665 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1666 {
1667         int buflen, rc;
1668         char *buffer, *path, *end;
1669
1670         rc = -ENOMEM;
1671         buffer = (char*)__get_free_page(GFP_KERNEL);
1672         if (!buffer)
1673                 goto out;
1674
1675         buflen = PAGE_SIZE;
1676         end = buffer+buflen;
1677         *--end = '\0';
1678         buflen--;
1679         path = end-1;
1680         *path = '/';
1681         while (table) {
1682                 const char *name = table->procname;
1683                 size_t namelen = strlen(name);
1684                 buflen -= namelen + 1;
1685                 if (buflen < 0)
1686                         goto out_free;
1687                 end -= namelen;
1688                 memcpy(end, name, namelen);
1689                 *--end = '/';
1690                 path = end;
1691                 table = table->parent;
1692         }
1693         buflen -= 4;
1694         if (buflen < 0)
1695                 goto out_free;
1696         end -= 4;
1697         memcpy(end, "/sys", 4);
1698         path = end;
1699         rc = security_genfs_sid("proc", path, tclass, sid);
1700 out_free:
1701         free_page((unsigned long)buffer);
1702 out:
1703         return rc;
1704 }
1705
1706 static int selinux_sysctl(ctl_table *table, int op)
1707 {
1708         int error = 0;
1709         u32 av;
1710         struct task_security_struct *tsec;
1711         u32 tsid;
1712         int rc;
1713
1714         rc = secondary_ops->sysctl(table, op);
1715         if (rc)
1716                 return rc;
1717
1718         tsec = current->security;
1719
1720         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1721                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1722         if (rc) {
1723                 /* Default to the well-defined sysctl SID. */
1724                 tsid = SECINITSID_SYSCTL;
1725         }
1726
1727         /* The op values are "defined" in sysctl.c, thereby creating
1728          * a bad coupling between this module and sysctl.c */
1729         if(op == 001) {
1730                 error = avc_has_perm(tsec->sid, tsid,
1731                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1732         } else {
1733                 av = 0;
1734                 if (op & 004)
1735                         av |= FILE__READ;
1736                 if (op & 002)
1737                         av |= FILE__WRITE;
1738                 if (av)
1739                         error = avc_has_perm(tsec->sid, tsid,
1740                                              SECCLASS_FILE, av, NULL);
1741         }
1742
1743         return error;
1744 }
1745
1746 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1747 {
1748         int rc = 0;
1749
1750         if (!sb)
1751                 return 0;
1752
1753         switch (cmds) {
1754                 case Q_SYNC:
1755                 case Q_QUOTAON:
1756                 case Q_QUOTAOFF:
1757                 case Q_SETINFO:
1758                 case Q_SETQUOTA:
1759                         rc = superblock_has_perm(current,
1760                                                  sb,
1761                                                  FILESYSTEM__QUOTAMOD, NULL);
1762                         break;
1763                 case Q_GETFMT:
1764                 case Q_GETINFO:
1765                 case Q_GETQUOTA:
1766                         rc = superblock_has_perm(current,
1767                                                  sb,
1768                                                  FILESYSTEM__QUOTAGET, NULL);
1769                         break;
1770                 default:
1771                         rc = 0;  /* let the kernel handle invalid cmds */
1772                         break;
1773         }
1774         return rc;
1775 }
1776
1777 static int selinux_quota_on(struct dentry *dentry)
1778 {
1779         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1780 }
1781
1782 static int selinux_syslog(int type)
1783 {
1784         int rc;
1785
1786         rc = secondary_ops->syslog(type);
1787         if (rc)
1788                 return rc;
1789
1790         switch (type) {
1791                 case 3:         /* Read last kernel messages */
1792                 case 10:        /* Return size of the log buffer */
1793                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1794                         break;
1795                 case 6:         /* Disable logging to console */
1796                 case 7:         /* Enable logging to console */
1797                 case 8:         /* Set level of messages printed to console */
1798                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1799                         break;
1800                 case 0:         /* Close log */
1801                 case 1:         /* Open log */
1802                 case 2:         /* Read from log */
1803                 case 4:         /* Read/clear last kernel messages */
1804                 case 5:         /* Clear ring buffer */
1805                 default:
1806                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1807                         break;
1808         }
1809         return rc;
1810 }
1811
1812 /*
1813  * Check that a process has enough memory to allocate a new virtual
1814  * mapping. 0 means there is enough memory for the allocation to
1815  * succeed and -ENOMEM implies there is not.
1816  *
1817  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1818  * if the capability is granted, but __vm_enough_memory requires 1 if
1819  * the capability is granted.
1820  *
1821  * Do not audit the selinux permission check, as this is applied to all
1822  * processes that allocate mappings.
1823  */
1824 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1825 {
1826         int rc, cap_sys_admin = 0;
1827         struct task_security_struct *tsec = current->security;
1828
1829         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1830         if (rc == 0)
1831                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1832                                           SECCLASS_CAPABILITY,
1833                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1834                                           0,
1835                                           NULL);
1836
1837         if (rc == 0)
1838                 cap_sys_admin = 1;
1839
1840         return __vm_enough_memory(mm, pages, cap_sys_admin);
1841 }
1842
1843 /* binprm security operations */
1844
1845 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1846 {
1847         struct bprm_security_struct *bsec;
1848
1849         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1850         if (!bsec)
1851                 return -ENOMEM;
1852
1853         bsec->bprm = bprm;
1854         bsec->sid = SECINITSID_UNLABELED;
1855         bsec->set = 0;
1856
1857         bprm->security = bsec;
1858         return 0;
1859 }
1860
1861 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1862 {
1863         struct task_security_struct *tsec;
1864         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1865         struct inode_security_struct *isec;
1866         struct bprm_security_struct *bsec;
1867         u32 newsid;
1868         struct avc_audit_data ad;
1869         int rc;
1870
1871         rc = secondary_ops->bprm_set_security(bprm);
1872         if (rc)
1873                 return rc;
1874
1875         bsec = bprm->security;
1876
1877         if (bsec->set)
1878                 return 0;
1879
1880         tsec = current->security;
1881         isec = inode->i_security;
1882
1883         /* Default to the current task SID. */
1884         bsec->sid = tsec->sid;
1885
1886         /* Reset fs, key, and sock SIDs on execve. */
1887         tsec->create_sid = 0;
1888         tsec->keycreate_sid = 0;
1889         tsec->sockcreate_sid = 0;
1890
1891         if (tsec->exec_sid) {
1892                 newsid = tsec->exec_sid;
1893                 /* Reset exec SID on execve. */
1894                 tsec->exec_sid = 0;
1895         } else {
1896                 /* Check for a default transition on this program. */
1897                 rc = security_transition_sid(tsec->sid, isec->sid,
1898                                              SECCLASS_PROCESS, &newsid);
1899                 if (rc)
1900                         return rc;
1901         }
1902
1903         AVC_AUDIT_DATA_INIT(&ad, FS);
1904         ad.u.fs.mnt = bprm->file->f_path.mnt;
1905         ad.u.fs.dentry = bprm->file->f_path.dentry;
1906
1907         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1908                 newsid = tsec->sid;
1909
1910         if (tsec->sid == newsid) {
1911                 rc = avc_has_perm(tsec->sid, isec->sid,
1912                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1913                 if (rc)
1914                         return rc;
1915         } else {
1916                 /* Check permissions for the transition. */
1917                 rc = avc_has_perm(tsec->sid, newsid,
1918                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1919                 if (rc)
1920                         return rc;
1921
1922                 rc = avc_has_perm(newsid, isec->sid,
1923                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1924                 if (rc)
1925                         return rc;
1926
1927                 /* Clear any possibly unsafe personality bits on exec: */
1928                 current->personality &= ~PER_CLEAR_ON_SETID;
1929
1930                 /* Set the security field to the new SID. */
1931                 bsec->sid = newsid;
1932         }
1933
1934         bsec->set = 1;
1935         return 0;
1936 }
1937
1938 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1939 {
1940         return secondary_ops->bprm_check_security(bprm);
1941 }
1942
1943
1944 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1945 {
1946         struct task_security_struct *tsec = current->security;
1947         int atsecure = 0;
1948
1949         if (tsec->osid != tsec->sid) {
1950                 /* Enable secure mode for SIDs transitions unless
1951                    the noatsecure permission is granted between
1952                    the two SIDs, i.e. ahp returns 0. */
1953                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1954                                          SECCLASS_PROCESS,
1955                                          PROCESS__NOATSECURE, NULL);
1956         }
1957
1958         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1959 }
1960
1961 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1962 {
1963         kfree(bprm->security);
1964         bprm->security = NULL;
1965 }
1966
1967 extern struct vfsmount *selinuxfs_mount;
1968 extern struct dentry *selinux_null;
1969
1970 /* Derived from fs/exec.c:flush_old_files. */
1971 static inline void flush_unauthorized_files(struct files_struct * files)
1972 {
1973         struct avc_audit_data ad;
1974         struct file *file, *devnull = NULL;
1975         struct tty_struct *tty;
1976         struct fdtable *fdt;
1977         long j = -1;
1978         int drop_tty = 0;
1979
1980         mutex_lock(&tty_mutex);
1981         tty = get_current_tty();
1982         if (tty) {
1983                 file_list_lock();
1984                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1985                 if (file) {
1986                         /* Revalidate access to controlling tty.
1987                            Use inode_has_perm on the tty inode directly rather
1988                            than using file_has_perm, as this particular open
1989                            file may belong to another process and we are only
1990                            interested in the inode-based check here. */
1991                         struct inode *inode = file->f_path.dentry->d_inode;
1992                         if (inode_has_perm(current, inode,
1993                                            FILE__READ | FILE__WRITE, NULL)) {
1994                                 drop_tty = 1;
1995                         }
1996                 }
1997                 file_list_unlock();
1998         }
1999         mutex_unlock(&tty_mutex);
2000         /* Reset controlling tty. */
2001         if (drop_tty)
2002                 no_tty();
2003
2004         /* Revalidate access to inherited open files. */
2005
2006         AVC_AUDIT_DATA_INIT(&ad,FS);
2007
2008         spin_lock(&files->file_lock);
2009         for (;;) {
2010                 unsigned long set, i;
2011                 int fd;
2012
2013                 j++;
2014                 i = j * __NFDBITS;
2015                 fdt = files_fdtable(files);
2016                 if (i >= fdt->max_fds)
2017                         break;
2018                 set = fdt->open_fds->fds_bits[j];
2019                 if (!set)
2020                         continue;
2021                 spin_unlock(&files->file_lock);
2022                 for ( ; set ; i++,set >>= 1) {
2023                         if (set & 1) {
2024                                 file = fget(i);
2025                                 if (!file)
2026                                         continue;
2027                                 if (file_has_perm(current,
2028                                                   file,
2029                                                   file_to_av(file))) {
2030                                         sys_close(i);
2031                                         fd = get_unused_fd();
2032                                         if (fd != i) {
2033                                                 if (fd >= 0)
2034                                                         put_unused_fd(fd);
2035                                                 fput(file);
2036                                                 continue;
2037                                         }
2038                                         if (devnull) {
2039                                                 get_file(devnull);
2040                                         } else {
2041                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2042                                                 if (IS_ERR(devnull)) {
2043                                                         devnull = NULL;
2044                                                         put_unused_fd(fd);
2045                                                         fput(file);
2046                                                         continue;
2047                                                 }
2048                                         }
2049                                         fd_install(fd, devnull);
2050                                 }
2051                                 fput(file);
2052                         }
2053                 }
2054                 spin_lock(&files->file_lock);
2055
2056         }
2057         spin_unlock(&files->file_lock);
2058 }
2059
2060 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2061 {
2062         struct task_security_struct *tsec;
2063         struct bprm_security_struct *bsec;
2064         u32 sid;
2065         int rc;
2066
2067         secondary_ops->bprm_apply_creds(bprm, unsafe);
2068
2069         tsec = current->security;
2070
2071         bsec = bprm->security;
2072         sid = bsec->sid;
2073
2074         tsec->osid = tsec->sid;
2075         bsec->unsafe = 0;
2076         if (tsec->sid != sid) {
2077                 /* Check for shared state.  If not ok, leave SID
2078                    unchanged and kill. */
2079                 if (unsafe & LSM_UNSAFE_SHARE) {
2080                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2081                                         PROCESS__SHARE, NULL);
2082                         if (rc) {
2083                                 bsec->unsafe = 1;
2084                                 return;
2085                         }
2086                 }
2087
2088                 /* Check for ptracing, and update the task SID if ok.
2089                    Otherwise, leave SID unchanged and kill. */
2090                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2091                         rc = avc_has_perm(tsec->ptrace_sid, sid,
2092                                           SECCLASS_PROCESS, PROCESS__PTRACE,
2093                                           NULL);
2094                         if (rc) {
2095                                 bsec->unsafe = 1;
2096                                 return;
2097                         }
2098                 }
2099                 tsec->sid = sid;
2100         }
2101 }
2102
2103 /*
2104  * called after apply_creds without the task lock held
2105  */
2106 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2107 {
2108         struct task_security_struct *tsec;
2109         struct rlimit *rlim, *initrlim;
2110         struct itimerval itimer;
2111         struct bprm_security_struct *bsec;
2112         int rc, i;
2113
2114         tsec = current->security;
2115         bsec = bprm->security;
2116
2117         if (bsec->unsafe) {
2118                 force_sig_specific(SIGKILL, current);
2119                 return;
2120         }
2121         if (tsec->osid == tsec->sid)
2122                 return;
2123
2124         /* Close files for which the new task SID is not authorized. */
2125         flush_unauthorized_files(current->files);
2126
2127         /* Check whether the new SID can inherit signal state
2128            from the old SID.  If not, clear itimers to avoid
2129            subsequent signal generation and flush and unblock
2130            signals. This must occur _after_ the task SID has
2131           been updated so that any kill done after the flush
2132           will be checked against the new SID. */
2133         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2134                           PROCESS__SIGINH, NULL);
2135         if (rc) {
2136                 memset(&itimer, 0, sizeof itimer);
2137                 for (i = 0; i < 3; i++)
2138                         do_setitimer(i, &itimer, NULL);
2139                 flush_signals(current);
2140                 spin_lock_irq(&current->sighand->siglock);
2141                 flush_signal_handlers(current, 1);
2142                 sigemptyset(&current->blocked);
2143                 recalc_sigpending();
2144                 spin_unlock_irq(&current->sighand->siglock);
2145         }
2146
2147         /* Always clear parent death signal on SID transitions. */
2148         current->pdeath_signal = 0;
2149
2150         /* Check whether the new SID can inherit resource limits
2151            from the old SID.  If not, reset all soft limits to
2152            the lower of the current task's hard limit and the init
2153            task's soft limit.  Note that the setting of hard limits
2154            (even to lower them) can be controlled by the setrlimit
2155            check. The inclusion of the init task's soft limit into
2156            the computation is to avoid resetting soft limits higher
2157            than the default soft limit for cases where the default
2158            is lower than the hard limit, e.g. RLIMIT_CORE or
2159            RLIMIT_STACK.*/
2160         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2161                           PROCESS__RLIMITINH, NULL);
2162         if (rc) {
2163                 for (i = 0; i < RLIM_NLIMITS; i++) {
2164                         rlim = current->signal->rlim + i;
2165                         initrlim = init_task.signal->rlim+i;
2166                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2167                 }
2168                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2169                         /*
2170                          * This will cause RLIMIT_CPU calculations
2171                          * to be refigured.
2172                          */
2173                         current->it_prof_expires = jiffies_to_cputime(1);
2174                 }
2175         }
2176
2177         /* Wake up the parent if it is waiting so that it can
2178            recheck wait permission to the new task SID. */
2179         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2180 }
2181
2182 /* superblock security operations */
2183
2184 static int selinux_sb_alloc_security(struct super_block *sb)
2185 {
2186         return superblock_alloc_security(sb);
2187 }
2188
2189 static void selinux_sb_free_security(struct super_block *sb)
2190 {
2191         superblock_free_security(sb);
2192 }
2193
2194 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2195 {
2196         if (plen > olen)
2197                 return 0;
2198
2199         return !memcmp(prefix, option, plen);
2200 }
2201
2202 static inline int selinux_option(char *option, int len)
2203 {
2204         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2205                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2206                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2207                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2208 }
2209
2210 static inline void take_option(char **to, char *from, int *first, int len)
2211 {
2212         if (!*first) {
2213                 **to = ',';
2214                 *to += 1;
2215         } else
2216                 *first = 0;
2217         memcpy(*to, from, len);
2218         *to += len;
2219 }
2220
2221 static inline void take_selinux_option(char **to, char *from, int *first,
2222                                        int len)
2223 {
2224         int current_size = 0;
2225
2226         if (!*first) {
2227                 **to = '|';
2228                 *to += 1;
2229         }
2230         else
2231                 *first = 0;
2232
2233         while (current_size < len) {
2234                 if (*from != '"') {
2235                         **to = *from;
2236                         *to += 1;
2237                 }
2238                 from += 1;
2239                 current_size += 1;
2240         }
2241 }
2242
2243 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2244 {
2245         int fnosec, fsec, rc = 0;
2246         char *in_save, *in_curr, *in_end;
2247         char *sec_curr, *nosec_save, *nosec;
2248         int open_quote = 0;
2249
2250         in_curr = orig;
2251         sec_curr = copy;
2252
2253         /* Binary mount data: just copy */
2254         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2255                 copy_page(sec_curr, in_curr);
2256                 goto out;
2257         }
2258
2259         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2260         if (!nosec) {
2261                 rc = -ENOMEM;
2262                 goto out;
2263         }
2264
2265         nosec_save = nosec;
2266         fnosec = fsec = 1;
2267         in_save = in_end = orig;
2268
2269         do {
2270                 if (*in_end == '"')
2271                         open_quote = !open_quote;
2272                 if ((*in_end == ',' && open_quote == 0) ||
2273                                 *in_end == '\0') {
2274                         int len = in_end - in_curr;
2275
2276                         if (selinux_option(in_curr, len))
2277                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2278                         else
2279                                 take_option(&nosec, in_curr, &fnosec, len);
2280
2281                         in_curr = in_end + 1;
2282                 }
2283         } while (*in_end++);
2284
2285         strcpy(in_save, nosec_save);
2286         free_page((unsigned long)nosec_save);
2287 out:
2288         return rc;
2289 }
2290
2291 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2292 {
2293         struct avc_audit_data ad;
2294         int rc;
2295
2296         rc = superblock_doinit(sb, data);
2297         if (rc)
2298                 return rc;
2299
2300         AVC_AUDIT_DATA_INIT(&ad,FS);
2301         ad.u.fs.dentry = sb->s_root;
2302         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2303 }
2304
2305 static int selinux_sb_statfs(struct dentry *dentry)
2306 {
2307         struct avc_audit_data ad;
2308
2309         AVC_AUDIT_DATA_INIT(&ad,FS);
2310         ad.u.fs.dentry = dentry->d_sb->s_root;
2311         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2312 }
2313
2314 static int selinux_mount(char * dev_name,
2315                          struct nameidata *nd,
2316                          char * type,
2317                          unsigned long flags,
2318                          void * data)
2319 {
2320         int rc;
2321
2322         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2323         if (rc)
2324                 return rc;
2325
2326         if (flags & MS_REMOUNT)
2327                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2328                                            FILESYSTEM__REMOUNT, NULL);
2329         else
2330                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2331                                        FILE__MOUNTON);
2332 }
2333
2334 static int selinux_umount(struct vfsmount *mnt, int flags)
2335 {
2336         int rc;
2337
2338         rc = secondary_ops->sb_umount(mnt, flags);
2339         if (rc)
2340                 return rc;
2341
2342         return superblock_has_perm(current,mnt->mnt_sb,
2343                                    FILESYSTEM__UNMOUNT,NULL);
2344 }
2345
2346 /* inode security operations */
2347
2348 static int selinux_inode_alloc_security(struct inode *inode)
2349 {
2350         return inode_alloc_security(inode);
2351 }
2352
2353 static void selinux_inode_free_security(struct inode *inode)
2354 {
2355         inode_free_security(inode);
2356 }
2357
2358 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2359                                        char **name, void **value,
2360                                        size_t *len)
2361 {
2362         struct task_security_struct *tsec;
2363         struct inode_security_struct *dsec;
2364         struct superblock_security_struct *sbsec;
2365         u32 newsid, clen;
2366         int rc;
2367         char *namep = NULL, *context;
2368
2369         tsec = current->security;
2370         dsec = dir->i_security;
2371         sbsec = dir->i_sb->s_security;
2372
2373         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2374                 newsid = tsec->create_sid;
2375         } else {
2376                 rc = security_transition_sid(tsec->sid, dsec->sid,
2377                                              inode_mode_to_security_class(inode->i_mode),
2378                                              &newsid);
2379                 if (rc) {
2380                         printk(KERN_WARNING "%s:  "
2381                                "security_transition_sid failed, rc=%d (dev=%s "
2382                                "ino=%ld)\n",
2383                                __FUNCTION__,
2384                                -rc, inode->i_sb->s_id, inode->i_ino);
2385                         return rc;
2386                 }
2387         }
2388
2389         /* Possibly defer initialization to selinux_complete_init. */
2390         if (sbsec->initialized) {
2391                 struct inode_security_struct *isec = inode->i_security;
2392                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2393                 isec->sid = newsid;
2394                 isec->initialized = 1;
2395         }
2396
2397         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2398                 return -EOPNOTSUPP;
2399
2400         if (name) {
2401                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2402                 if (!namep)
2403                         return -ENOMEM;
2404                 *name = namep;
2405         }
2406
2407         if (value && len) {
2408                 rc = security_sid_to_context(newsid, &context, &clen);
2409                 if (rc) {
2410                         kfree(namep);
2411                         return rc;
2412                 }
2413                 *value = context;
2414                 *len = clen;
2415         }
2416
2417         return 0;
2418 }
2419
2420 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2421 {
2422         return may_create(dir, dentry, SECCLASS_FILE);
2423 }
2424
2425 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2426 {
2427         int rc;
2428
2429         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2430         if (rc)
2431                 return rc;
2432         return may_link(dir, old_dentry, MAY_LINK);
2433 }
2434
2435 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2436 {
2437         int rc;
2438
2439         rc = secondary_ops->inode_unlink(dir, dentry);
2440         if (rc)
2441                 return rc;
2442         return may_link(dir, dentry, MAY_UNLINK);
2443 }
2444
2445 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2446 {
2447         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2448 }
2449
2450 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2451 {
2452         return may_create(dir, dentry, SECCLASS_DIR);
2453 }
2454
2455 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2456 {
2457         return may_link(dir, dentry, MAY_RMDIR);
2458 }
2459
2460 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2461 {
2462         int rc;
2463
2464         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2465         if (rc)
2466                 return rc;
2467
2468         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2469 }
2470
2471 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2472                                 struct inode *new_inode, struct dentry *new_dentry)
2473 {
2474         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2475 }
2476
2477 static int selinux_inode_readlink(struct dentry *dentry)
2478 {
2479         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2480 }
2481
2482 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2483 {
2484         int rc;
2485
2486         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2487         if (rc)
2488                 return rc;
2489         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2490 }
2491
2492 static int selinux_inode_permission(struct inode *inode, int mask,
2493                                     struct nameidata *nd)
2494 {
2495         int rc;
2496
2497         rc = secondary_ops->inode_permission(inode, mask, nd);
2498         if (rc)
2499                 return rc;
2500
2501         if (!mask) {
2502                 /* No permission to check.  Existence test. */
2503                 return 0;
2504         }
2505
2506         return inode_has_perm(current, inode,
2507                                file_mask_to_av(inode->i_mode, mask), NULL);
2508 }
2509
2510 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2511 {
2512         int rc;
2513
2514         rc = secondary_ops->inode_setattr(dentry, iattr);
2515         if (rc)
2516                 return rc;
2517
2518         if (iattr->ia_valid & ATTR_FORCE)
2519                 return 0;
2520
2521         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2522                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2523                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2524
2525         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2526 }
2527
2528 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2529 {
2530         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2531 }
2532
2533 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2534 {
2535         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2536                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2537                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2538                         if (!capable(CAP_SETFCAP))
2539                                 return -EPERM;
2540                 } else if (!capable(CAP_SYS_ADMIN)) {
2541                         /* A different attribute in the security namespace.
2542                            Restrict to administrator. */
2543                         return -EPERM;
2544                 }
2545         }
2546
2547         /* Not an attribute we recognize, so just check the
2548            ordinary setattr permission. */
2549         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2550 }
2551
2552 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2553 {
2554         struct task_security_struct *tsec = current->security;
2555         struct inode *inode = dentry->d_inode;
2556         struct inode_security_struct *isec = inode->i_security;
2557         struct superblock_security_struct *sbsec;
2558         struct avc_audit_data ad;
2559         u32 newsid;
2560         int rc = 0;
2561
2562         if (strcmp(name, XATTR_NAME_SELINUX))
2563                 return selinux_inode_setotherxattr(dentry, name);
2564
2565         sbsec = inode->i_sb->s_security;
2566         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2567                 return -EOPNOTSUPP;
2568
2569         if (!is_owner_or_cap(inode))
2570                 return -EPERM;
2571
2572         AVC_AUDIT_DATA_INIT(&ad,FS);
2573         ad.u.fs.dentry = dentry;
2574
2575         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2576                           FILE__RELABELFROM, &ad);
2577         if (rc)
2578                 return rc;
2579
2580         rc = security_context_to_sid(value, size, &newsid);
2581         if (rc)
2582                 return rc;
2583
2584         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2585                           FILE__RELABELTO, &ad);
2586         if (rc)
2587                 return rc;
2588
2589         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2590                                           isec->sclass);
2591         if (rc)
2592                 return rc;
2593
2594         return avc_has_perm(newsid,
2595                             sbsec->sid,
2596                             SECCLASS_FILESYSTEM,
2597                             FILESYSTEM__ASSOCIATE,
2598                             &ad);
2599 }
2600
2601 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2602                                         void *value, size_t size, int flags)
2603 {
2604         struct inode *inode = dentry->d_inode;
2605         struct inode_security_struct *isec = inode->i_security;
2606         u32 newsid;
2607         int rc;
2608
2609         if (strcmp(name, XATTR_NAME_SELINUX)) {
2610                 /* Not an attribute we recognize, so nothing to do. */
2611                 return;
2612         }
2613
2614         rc = security_context_to_sid(value, size, &newsid);
2615         if (rc) {
2616                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2617                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2618                 return;
2619         }
2620
2621         isec->sid = newsid;
2622         return;
2623 }
2624
2625 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2626 {
2627         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2628 }
2629
2630 static int selinux_inode_listxattr (struct dentry *dentry)
2631 {
2632         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2633 }
2634
2635 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2636 {
2637         if (strcmp(name, XATTR_NAME_SELINUX))
2638                 return selinux_inode_setotherxattr(dentry, name);
2639
2640         /* No one is allowed to remove a SELinux security label.
2641            You can change the label, but all data must be labeled. */
2642         return -EACCES;
2643 }
2644
2645 /*
2646  * Copy the in-core inode security context value to the user.  If the
2647  * getxattr() prior to this succeeded, check to see if we need to
2648  * canonicalize the value to be finally returned to the user.
2649  *
2650  * Permission check is handled by selinux_inode_getxattr hook.
2651  */
2652 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2653 {
2654         u32 size;
2655         int error;
2656         char *context = NULL;
2657         struct inode_security_struct *isec = inode->i_security;
2658
2659         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2660                 return -EOPNOTSUPP;
2661
2662         error = security_sid_to_context(isec->sid, &context, &size);
2663         if (error)
2664                 return error;
2665         error = size;
2666         if (alloc) {
2667                 *buffer = context;
2668                 goto out_nofree;
2669         }
2670         kfree(context);
2671 out_nofree:
2672         return error;
2673 }
2674
2675 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2676                                      const void *value, size_t size, int flags)
2677 {
2678         struct inode_security_struct *isec = inode->i_security;
2679         u32 newsid;
2680         int rc;
2681
2682         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2683                 return -EOPNOTSUPP;
2684
2685         if (!value || !size)
2686                 return -EACCES;
2687
2688         rc = security_context_to_sid((void*)value, size, &newsid);
2689         if (rc)
2690                 return rc;
2691
2692         isec->sid = newsid;
2693         return 0;
2694 }
2695
2696 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2697 {
2698         const int len = sizeof(XATTR_NAME_SELINUX);
2699         if (buffer && len <= buffer_size)
2700                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2701         return len;
2702 }
2703
2704 static int selinux_inode_need_killpriv(struct dentry *dentry)
2705 {
2706         return secondary_ops->inode_need_killpriv(dentry);
2707 }
2708
2709 static int selinux_inode_killpriv(struct dentry *dentry)
2710 {
2711         return secondary_ops->inode_killpriv(dentry);
2712 }
2713
2714 /* file security operations */
2715
2716 static int selinux_revalidate_file_permission(struct file *file, int mask)
2717 {
2718         int rc;
2719         struct inode *inode = file->f_path.dentry->d_inode;
2720
2721         if (!mask) {
2722                 /* No permission to check.  Existence test. */
2723                 return 0;
2724         }
2725
2726         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2727         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2728                 mask |= MAY_APPEND;
2729
2730         rc = file_has_perm(current, file,
2731                            file_mask_to_av(inode->i_mode, mask));
2732         if (rc)
2733                 return rc;
2734
2735         return selinux_netlbl_inode_permission(inode, mask);
2736 }
2737
2738 static int selinux_file_permission(struct file *file, int mask)
2739 {
2740         struct inode *inode = file->f_path.dentry->d_inode;
2741         struct task_security_struct *tsec = current->security;
2742         struct file_security_struct *fsec = file->f_security;
2743         struct inode_security_struct *isec = inode->i_security;
2744
2745         if (!mask) {
2746                 /* No permission to check.  Existence test. */
2747                 return 0;
2748         }
2749
2750         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2751             && fsec->pseqno == avc_policy_seqno())
2752                 return selinux_netlbl_inode_permission(inode, mask);
2753
2754         return selinux_revalidate_file_permission(file, mask);
2755 }
2756
2757 static int selinux_file_alloc_security(struct file *file)
2758 {
2759         return file_alloc_security(file);
2760 }
2761
2762 static void selinux_file_free_security(struct file *file)
2763 {
2764         file_free_security(file);
2765 }
2766
2767 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2768                               unsigned long arg)
2769 {
2770         int error = 0;
2771
2772         switch (cmd) {
2773                 case FIONREAD:
2774                 /* fall through */
2775                 case FIBMAP:
2776                 /* fall through */
2777                 case FIGETBSZ:
2778                 /* fall through */
2779                 case EXT2_IOC_GETFLAGS:
2780                 /* fall through */
2781                 case EXT2_IOC_GETVERSION:
2782                         error = file_has_perm(current, file, FILE__GETATTR);
2783                         break;
2784
2785                 case EXT2_IOC_SETFLAGS:
2786                 /* fall through */
2787                 case EXT2_IOC_SETVERSION:
2788                         error = file_has_perm(current, file, FILE__SETATTR);
2789                         break;
2790
2791                 /* sys_ioctl() checks */
2792                 case FIONBIO:
2793                 /* fall through */
2794                 case FIOASYNC:
2795                         error = file_has_perm(current, file, 0);
2796                         break;
2797
2798                 case KDSKBENT:
2799                 case KDSKBSENT:
2800                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2801                         break;
2802
2803                 /* default case assumes that the command will go
2804                  * to the file's ioctl() function.
2805                  */
2806                 default:
2807                         error = file_has_perm(current, file, FILE__IOCTL);
2808
2809         }
2810         return error;
2811 }
2812
2813 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2814 {
2815 #ifndef CONFIG_PPC32
2816         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2817                 /*
2818                  * We are making executable an anonymous mapping or a
2819                  * private file mapping that will also be writable.
2820                  * This has an additional check.
2821                  */
2822                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2823                 if (rc)
2824                         return rc;
2825         }
2826 #endif
2827
2828         if (file) {
2829                 /* read access is always possible with a mapping */
2830                 u32 av = FILE__READ;
2831
2832                 /* write access only matters if the mapping is shared */
2833                 if (shared && (prot & PROT_WRITE))
2834                         av |= FILE__WRITE;
2835
2836                 if (prot & PROT_EXEC)
2837                         av |= FILE__EXECUTE;
2838
2839                 return file_has_perm(current, file, av);
2840         }
2841         return 0;
2842 }
2843
2844 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2845                              unsigned long prot, unsigned long flags,
2846                              unsigned long addr, unsigned long addr_only)
2847 {
2848         int rc = 0;
2849         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2850
2851         if (addr < mmap_min_addr)
2852                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2853                                   MEMPROTECT__MMAP_ZERO, NULL);
2854         if (rc || addr_only)
2855                 return rc;
2856
2857         if (selinux_checkreqprot)
2858                 prot = reqprot;
2859
2860         return file_map_prot_check(file, prot,
2861                                    (flags & MAP_TYPE) == MAP_SHARED);
2862 }
2863
2864 static int selinux_file_mprotect(struct vm_area_struct *vma,
2865                                  unsigned long reqprot,
2866                                  unsigned long prot)
2867 {
2868         int rc;
2869
2870         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2871         if (rc)
2872                 return rc;
2873
2874         if (selinux_checkreqprot)
2875                 prot = reqprot;
2876
2877 #ifndef CONFIG_PPC32
2878         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2879                 rc = 0;
2880                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2881                     vma->vm_end <= vma->vm_mm->brk) {
2882                         rc = task_has_perm(current, current,
2883                                            PROCESS__EXECHEAP);
2884                 } else if (!vma->vm_file &&
2885                            vma->vm_start <= vma->vm_mm->start_stack &&
2886                            vma->vm_end >= vma->vm_mm->start_stack) {
2887                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2888                 } else if (vma->vm_file && vma->anon_vma) {
2889                         /*
2890                          * We are making executable a file mapping that has
2891                          * had some COW done. Since pages might have been
2892                          * written, check ability to execute the possibly
2893                          * modified content.  This typically should only
2894                          * occur for text relocations.
2895                          */
2896                         rc = file_has_perm(current, vma->vm_file,
2897                                            FILE__EXECMOD);
2898                 }
2899                 if (rc)
2900                         return rc;
2901         }
2902 #endif
2903
2904         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2905 }
2906
2907 static int selinux_file_lock(struct file *file, unsigned int cmd)
2908 {
2909         return file_has_perm(current, file, FILE__LOCK);
2910 }
2911
2912 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2913                               unsigned long arg)
2914 {
2915         int err = 0;
2916
2917         switch (cmd) {
2918                 case F_SETFL:
2919                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2920                                 err = -EINVAL;
2921                                 break;
2922                         }
2923
2924                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2925                                 err = file_has_perm(current, file,FILE__WRITE);
2926                                 break;
2927                         }
2928                         /* fall through */
2929                 case F_SETOWN:
2930                 case F_SETSIG:
2931                 case F_GETFL:
2932                 case F_GETOWN:
2933                 case F_GETSIG:
2934                         /* Just check FD__USE permission */
2935                         err = file_has_perm(current, file, 0);
2936                         break;
2937                 case F_GETLK:
2938                 case F_SETLK:
2939                 case F_SETLKW:
2940 #if BITS_PER_LONG == 32
2941                 case F_GETLK64:
2942                 case F_SETLK64:
2943                 case F_SETLKW64:
2944 #endif
2945                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2946                                 err = -EINVAL;
2947                                 break;
2948                         }
2949                         err = file_has_perm(current, file, FILE__LOCK);
2950                         break;
2951         }
2952
2953         return err;
2954 }
2955
2956 static int selinux_file_set_fowner(struct file *file)
2957 {
2958         struct task_security_struct *tsec;
2959         struct file_security_struct *fsec;
2960
2961         tsec = current->security;
2962         fsec = file->f_security;
2963         fsec->fown_sid = tsec->sid;
2964
2965         return 0;
2966 }
2967
2968 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2969                                        struct fown_struct *fown, int signum)
2970 {
2971         struct file *file;
2972         u32 perm;
2973         struct task_security_struct *tsec;
2974         struct file_security_struct *fsec;
2975
2976         /* struct fown_struct is never outside the context of a struct file */
2977         file = container_of(fown, struct file, f_owner);
2978
2979         tsec = tsk->security;
2980         fsec = file->f_security;
2981
2982         if (!signum)
2983                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2984         else
2985                 perm = signal_to_av(signum);
2986
2987         return avc_has_perm(fsec->fown_sid, tsec->sid,
2988                             SECCLASS_PROCESS, perm, NULL);
2989 }
2990
2991 static int selinux_file_receive(struct file *file)
2992 {
2993         return file_has_perm(current, file, file_to_av(file));
2994 }
2995
2996 static int selinux_dentry_open(struct file *file)
2997 {
2998         struct file_security_struct *fsec;
2999         struct inode *inode;
3000         struct inode_security_struct *isec;
3001         inode = file->f_path.dentry->d_inode;
3002         fsec = file->f_security;
3003         isec = inode->i_security;
3004         /*
3005          * Save inode label and policy sequence number
3006          * at open-time so that selinux_file_permission
3007          * can determine whether revalidation is necessary.
3008          * Task label is already saved in the file security
3009          * struct as its SID.
3010          */
3011         fsec->isid = isec->sid;
3012         fsec->pseqno = avc_policy_seqno();
3013         /*
3014          * Since the inode label or policy seqno may have changed
3015          * between the selinux_inode_permission check and the saving
3016          * of state above, recheck that access is still permitted.
3017          * Otherwise, access might never be revalidated against the
3018          * new inode label or new policy.
3019          * This check is not redundant - do not remove.
3020          */
3021         return inode_has_perm(current, inode, file_to_av(file), NULL);
3022 }
3023
3024 /* task security operations */
3025
3026 static int selinux_task_create(unsigned long clone_flags)
3027 {
3028         int rc;
3029
3030         rc = secondary_ops->task_create(clone_flags);
3031         if (rc)
3032                 return rc;
3033
3034         return task_has_perm(current, current, PROCESS__FORK);
3035 }
3036
3037 static int selinux_task_alloc_security(struct task_struct *tsk)
3038 {
3039         struct task_security_struct *tsec1, *tsec2;
3040         int rc;
3041
3042         tsec1 = current->security;
3043
3044         rc = task_alloc_security(tsk);
3045         if (rc)
3046                 return rc;
3047         tsec2 = tsk->security;
3048
3049         tsec2->osid = tsec1->osid;
3050         tsec2->sid = tsec1->sid;
3051
3052         /* Retain the exec, fs, key, and sock SIDs across fork */
3053         tsec2->exec_sid = tsec1->exec_sid;
3054         tsec2->create_sid = tsec1->create_sid;
3055         tsec2->keycreate_sid = tsec1->keycreate_sid;
3056         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3057
3058         /* Retain ptracer SID across fork, if any.
3059            This will be reset by the ptrace hook upon any
3060            subsequent ptrace_attach operations. */
3061         tsec2->ptrace_sid = tsec1->ptrace_sid;
3062
3063         return 0;
3064 }
3065
3066 static void selinux_task_free_security(struct task_struct *tsk)
3067 {
3068         task_free_security(tsk);
3069 }
3070
3071 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3072 {
3073         /* Since setuid only affects the current process, and
3074            since the SELinux controls are not based on the Linux
3075            identity attributes, SELinux does not need to control
3076            this operation.  However, SELinux does control the use
3077            of the CAP_SETUID and CAP_SETGID capabilities using the
3078            capable hook. */
3079         return 0;
3080 }
3081
3082 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3083 {
3084         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3085 }
3086
3087 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3088 {
3089         /* See the comment for setuid above. */
3090         return 0;
3091 }
3092
3093 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3094 {
3095         return task_has_perm(current, p, PROCESS__SETPGID);
3096 }
3097
3098 static int selinux_task_getpgid(struct task_struct *p)
3099 {
3100         return task_has_perm(current, p, PROCESS__GETPGID);
3101 }
3102
3103 static int selinux_task_getsid(struct task_struct *p)
3104 {
3105         return task_has_perm(current, p, PROCESS__GETSESSION);
3106 }
3107
3108 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3109 {
3110         selinux_get_task_sid(p, secid);
3111 }
3112
3113 static int selinux_task_setgroups(struct group_info *group_info)
3114 {
3115         /* See the comment for setuid above. */
3116         return 0;
3117 }
3118
3119 static int selinux_task_setnice(struct task_struct *p, int nice)
3120 {
3121         int rc;
3122
3123         rc = secondary_ops->task_setnice(p, nice);
3124         if (rc)
3125                 return rc;
3126
3127         return task_has_perm(current,p, PROCESS__SETSCHED);
3128 }
3129
3130 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3131 {
3132         int rc;
3133
3134         rc = secondary_ops->task_setioprio(p, ioprio);
3135         if (rc)
3136                 return rc;
3137
3138         return task_has_perm(current, p, PROCESS__SETSCHED);
3139 }
3140
3141 static int selinux_task_getioprio(struct task_struct *p)
3142 {
3143         return task_has_perm(current, p, PROCESS__GETSCHED);
3144 }
3145
3146 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3147 {
3148         struct rlimit *old_rlim = current->signal->rlim + resource;
3149         int rc;
3150
3151         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3152         if (rc)
3153                 return rc;
3154
3155         /* Control the ability to change the hard limit (whether
3156            lowering or raising it), so that the hard limit can
3157            later be used as a safe reset point for the soft limit
3158            upon context transitions. See selinux_bprm_apply_creds. */
3159         if (old_rlim->rlim_max != new_rlim->rlim_max)
3160                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3161
3162         return 0;
3163 }
3164
3165 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3166 {
3167         int rc;
3168
3169         rc = secondary_ops->task_setscheduler(p, policy, lp);
3170         if (rc)
3171                 return rc;
3172
3173         return task_has_perm(current, p, PROCESS__SETSCHED);
3174 }
3175
3176 static int selinux_task_getscheduler(struct task_struct *p)
3177 {
3178         return task_has_perm(current, p, PROCESS__GETSCHED);
3179 }
3180
3181 static int selinux_task_movememory(struct task_struct *p)
3182 {
3183         return task_has_perm(current, p, PROCESS__SETSCHED);
3184 }
3185
3186 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3187                                 int sig, u32 secid)
3188 {
3189         u32 perm;
3190         int rc;
3191         struct task_security_struct *tsec;
3192
3193         rc = secondary_ops->task_kill(p, info, sig, secid);
3194         if (rc)
3195                 return rc;
3196
3197         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3198                 return 0;
3199
3200         if (!sig)
3201                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3202         else
3203                 perm = signal_to_av(sig);
3204         tsec = p->security;
3205         if (secid)
3206                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3207         else
3208                 rc = task_has_perm(current, p, perm);
3209         return rc;
3210 }
3211
3212 static int selinux_task_prctl(int option,
3213                               unsigned long arg2,
3214                               unsigned long arg3,
3215                               unsigned long arg4,
3216                               unsigned long arg5)
3217 {
3218         /* The current prctl operations do not appear to require
3219            any SELinux controls since they merely observe or modify
3220            the state of the current process. */
3221         return 0;
3222 }
3223
3224 static int selinux_task_wait(struct task_struct *p)
3225 {
3226         return task_has_perm(p, current, PROCESS__SIGCHLD);
3227 }
3228
3229 static void selinux_task_reparent_to_init(struct task_struct *p)
3230 {
3231         struct task_security_struct *tsec;
3232
3233         secondary_ops->task_reparent_to_init(p);
3234
3235         tsec = p->security;
3236         tsec->osid = tsec->sid;
3237         tsec->sid = SECINITSID_KERNEL;
3238         return;
3239 }
3240
3241 static void selinux_task_to_inode(struct task_struct *p,
3242                                   struct inode *inode)
3243 {
3244         struct task_security_struct *tsec = p->security;
3245         struct inode_security_struct *isec = inode->i_security;
3246
3247         isec->sid = tsec->sid;
3248         isec->initialized = 1;
3249         return;
3250 }
3251
3252 /* Returns error only if unable to parse addresses */
3253 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3254                         struct avc_audit_data *ad, u8 *proto)
3255 {
3256         int offset, ihlen, ret = -EINVAL;
3257         struct iphdr _iph, *ih;
3258
3259         offset = skb_network_offset(skb);
3260         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3261         if (ih == NULL)
3262                 goto out;
3263
3264         ihlen = ih->ihl * 4;
3265         if (ihlen < sizeof(_iph))
3266                 goto out;
3267
3268         ad->u.net.v4info.saddr = ih->saddr;
3269         ad->u.net.v4info.daddr = ih->daddr;
3270         ret = 0;
3271
3272         if (proto)
3273                 *proto = ih->protocol;
3274
3275         switch (ih->protocol) {
3276         case IPPROTO_TCP: {
3277                 struct tcphdr _tcph, *th;
3278
3279                 if (ntohs(ih->frag_off) & IP_OFFSET)
3280                         break;
3281
3282                 offset += ihlen;
3283                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3284                 if (th == NULL)
3285                         break;
3286
3287                 ad->u.net.sport = th->source;
3288                 ad->u.net.dport = th->dest;
3289                 break;
3290         }
3291
3292         case IPPROTO_UDP: {
3293                 struct udphdr _udph, *uh;
3294
3295                 if (ntohs(ih->frag_off) & IP_OFFSET)
3296                         break;
3297
3298                 offset += ihlen;
3299                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3300                 if (uh == NULL)
3301                         break;
3302
3303                 ad->u.net.sport = uh->source;
3304                 ad->u.net.dport = uh->dest;
3305                 break;
3306         }
3307
3308         case IPPROTO_DCCP: {
3309                 struct dccp_hdr _dccph, *dh;
3310
3311                 if (ntohs(ih->frag_off) & IP_OFFSET)
3312                         break;
3313
3314                 offset += ihlen;
3315                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3316                 if (dh == NULL)
3317                         break;
3318
3319                 ad->u.net.sport = dh->dccph_sport;
3320                 ad->u.net.dport = dh->dccph_dport;
3321                 break;
3322         }
3323
3324         default:
3325                 break;
3326         }
3327 out:
3328         return ret;
3329 }
3330
3331 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3332
3333 /* Returns error only if unable to parse addresses */
3334 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3335                         struct avc_audit_data *ad, u8 *proto)
3336 {
3337         u8 nexthdr;
3338         int ret = -EINVAL, offset;
3339         struct ipv6hdr _ipv6h, *ip6;
3340
3341         offset = skb_network_offset(skb);
3342         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3343         if (ip6 == NULL)
3344                 goto out;
3345
3346         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3347         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3348         ret = 0;
3349
3350         nexthdr = ip6->nexthdr;
3351         offset += sizeof(_ipv6h);
3352         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3353         if (offset < 0)
3354                 goto out;
3355
3356         if (proto)
3357                 *proto = nexthdr;
3358
3359         switch (nexthdr) {
3360         case IPPROTO_TCP: {
3361                 struct tcphdr _tcph, *th;
3362
3363                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3364                 if (th == NULL)
3365                         break;
3366
3367                 ad->u.net.sport = th->source;
3368                 ad->u.net.dport = th->dest;
3369                 break;
3370         }
3371
3372         case IPPROTO_UDP: {
3373                 struct udphdr _udph, *uh;
3374
3375                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3376                 if (uh == NULL)
3377                         break;
3378
3379                 ad->u.net.sport = uh->source;
3380                 ad->u.net.dport = uh->dest;
3381                 break;
3382         }
3383
3384         case IPPROTO_DCCP: {
3385                 struct dccp_hdr _dccph, *dh;
3386
3387                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3388                 if (dh == NULL)
3389                         break;
3390
3391                 ad->u.net.sport = dh->dccph_sport;
3392                 ad->u.net.dport = dh->dccph_dport;
3393                 break;
3394         }
3395
3396         /* includes fragments */
3397         default:
3398                 break;
3399         }
3400 out:
3401         return ret;
3402 }
3403
3404 #endif /* IPV6 */
3405
3406 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3407                              char **addrp, int src, u8 *proto)
3408 {
3409         int ret = 0;
3410
3411         switch (ad->u.net.family) {
3412         case PF_INET:
3413                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3414                 if (ret || !addrp)
3415                         break;
3416                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3417                                         &ad->u.net.v4info.daddr);
3418                 break;
3419
3420 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3421         case PF_INET6:
3422                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3423                 if (ret || !addrp)
3424                         break;
3425                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3426                                         &ad->u.net.v6info.daddr);
3427                 break;
3428 #endif  /* IPV6 */
3429         default:
3430                 break;
3431         }
3432
3433         if (unlikely(ret))
3434                 printk(KERN_WARNING
3435                        "SELinux: failure in selinux_parse_skb(),"
3436                        " unable to parse packet\n");
3437
3438         return ret;
3439 }
3440
3441 /**
3442  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3443  * @skb: the packet
3444  * @family: protocol family
3445  * @sid: the packet's peer label SID
3446  *
3447  * Description:
3448  * Check the various different forms of network peer labeling and determine
3449  * the peer label/SID for the packet; most of the magic actually occurs in
3450  * the security server function security_net_peersid_cmp().  The function
3451  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3452  * or -EACCES if @sid is invalid due to inconsistencies with the different
3453  * peer labels.
3454  *
3455  */
3456 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3457 {
3458         int err;
3459         u32 xfrm_sid;
3460         u32 nlbl_sid;
3461         u32 nlbl_type;
3462
3463         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3464         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3465
3466         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3467         if (unlikely(err)) {
3468                 printk(KERN_WARNING
3469                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3470                        " unable to determine packet's peer label\n");
3471                 return -EACCES;
3472         }
3473
3474         return 0;
3475 }
3476
3477 /* socket security operations */
3478 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3479                            u32 perms)
3480 {
3481         struct inode_security_struct *isec;
3482         struct task_security_struct *tsec;
3483         struct avc_audit_data ad;
3484         int err = 0;
3485
3486         tsec = task->security;
3487         isec = SOCK_INODE(sock)->i_security;
3488
3489         if (isec->sid == SECINITSID_KERNEL)
3490                 goto out;
3491
3492         AVC_AUDIT_DATA_INIT(&ad,NET);
3493         ad.u.net.sk = sock->sk;
3494         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3495
3496 out:
3497         return err;
3498 }
3499
3500 static int selinux_socket_create(int family, int type,
3501                                  int protocol, int kern)
3502 {
3503         int err = 0;
3504         struct task_security_struct *tsec;
3505         u32 newsid;
3506
3507         if (kern)
3508                 goto out;
3509
3510         tsec = current->security;
3511         newsid = tsec->sockcreate_sid ? : tsec->sid;
3512         err = avc_has_perm(tsec->sid, newsid,
3513                            socket_type_to_security_class(family, type,
3514                            protocol), SOCKET__CREATE, NULL);
3515
3516 out:
3517         return err;
3518 }
3519
3520 static int selinux_socket_post_create(struct socket *sock, int family,
3521                                       int type, int protocol, int kern)
3522 {
3523         int err = 0;
3524         struct inode_security_struct *isec;
3525         struct task_security_struct *tsec;
3526         struct sk_security_struct *sksec;
3527         u32 newsid;
3528
3529         isec = SOCK_INODE(sock)->i_security;
3530
3531         tsec = current->security;
3532         newsid = tsec->sockcreate_sid ? : tsec->sid;
3533         isec->sclass = socket_type_to_security_class(family, type, protocol);
3534         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3535         isec->initialized = 1;
3536
3537         if (sock->sk) {
3538                 sksec = sock->sk->sk_security;
3539                 sksec->sid = isec->sid;
3540                 sksec->sclass = isec->sclass;
3541                 err = selinux_netlbl_socket_post_create(sock);
3542         }
3543
3544         return err;
3545 }
3546
3547 /* Range of port numbers used to automatically bind.
3548    Need to determine whether we should perform a name_bind
3549    permission check between the socket and the port number. */
3550
3551 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3552 {
3553         u16 family;
3554         int err;
3555
3556         err = socket_has_perm(current, sock, SOCKET__BIND);
3557         if (err)
3558                 goto out;
3559
3560         /*
3561          * If PF_INET or PF_INET6, check name_bind permission for the port.
3562          * Multiple address binding for SCTP is not supported yet: we just
3563          * check the first address now.
3564          */
3565         family = sock->sk->sk_family;
3566         if (family == PF_INET || family == PF_INET6) {
3567                 char *addrp;
3568                 struct inode_security_struct *isec;
3569                 struct task_security_struct *tsec;
3570                 struct avc_audit_data ad;
3571                 struct sockaddr_in *addr4 = NULL;
3572                 struct sockaddr_in6 *addr6 = NULL;
3573                 unsigned short snum;
3574                 struct sock *sk = sock->sk;
3575                 u32 sid, node_perm, addrlen;
3576
3577                 tsec = current->security;
3578                 isec = SOCK_INODE(sock)->i_security;
3579
3580                 if (family == PF_INET) {
3581                         addr4 = (struct sockaddr_in *)address;
3582                         snum = ntohs(addr4->sin_port);
3583                         addrlen = sizeof(addr4->sin_addr.s_addr);
3584                         addrp = (char *)&addr4->sin_addr.s_addr;
3585                 } else {
3586                         addr6 = (struct sockaddr_in6 *)address;
3587                         snum = ntohs(addr6->sin6_port);
3588                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3589                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3590                 }
3591
3592                 if (snum) {
3593                         int low, high;
3594
3595                         inet_get_local_port_range(&low, &high);
3596
3597                         if (snum < max(PROT_SOCK, low) || snum > high) {
3598                                 err = security_port_sid(sk->sk_family,
3599                                                         sk->sk_type,
3600                                                         sk->sk_protocol, snum,
3601                                                         &sid);
3602                                 if (err)
3603                                         goto out;
3604                                 AVC_AUDIT_DATA_INIT(&ad,NET);
3605                                 ad.u.net.sport = htons(snum);
3606                                 ad.u.net.family = family;
3607                                 err = avc_has_perm(isec->sid, sid,
3608                                                    isec->sclass,
3609                                                    SOCKET__NAME_BIND, &ad);
3610                                 if (err)
3611                                         goto out;
3612                         }
3613                 }
3614
3615                 switch(isec->sclass) {
3616                 case SECCLASS_TCP_SOCKET:
3617                         node_perm = TCP_SOCKET__NODE_BIND;
3618                         break;
3619
3620                 case SECCLASS_UDP_SOCKET:
3621                         node_perm = UDP_SOCKET__NODE_BIND;
3622                         break;
3623
3624                 case SECCLASS_DCCP_SOCKET:
3625                         node_perm = DCCP_SOCKET__NODE_BIND;
3626                         break;
3627
3628                 default:
3629                         node_perm = RAWIP_SOCKET__NODE_BIND;
3630                         break;
3631                 }
3632
3633                 err = sel_netnode_sid(addrp, family, &sid);
3634                 if (err)
3635                         goto out;
3636
3637                 AVC_AUDIT_DATA_INIT(&ad,NET);
3638                 ad.u.net.sport = htons(snum);
3639                 ad.u.net.family = family;
3640
3641                 if (family == PF_INET)
3642                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3643                 else
3644                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3645
3646                 err = avc_has_perm(isec->sid, sid,
3647                                    isec->sclass, node_perm, &ad);
3648                 if (err)
3649                         goto out;
3650         }
3651 out:
3652         return err;
3653 }
3654
3655 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3656 {
3657         struct inode_security_struct *isec;
3658         int err;
3659
3660         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3661         if (err)
3662                 return err;
3663
3664         /*
3665          * If a TCP or DCCP socket, check name_connect permission for the port.
3666          */
3667         isec = SOCK_INODE(sock)->i_security;
3668         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3669             isec->sclass == SECCLASS_DCCP_SOCKET) {
3670                 struct sock *sk = sock->sk;
3671                 struct avc_audit_data ad;
3672                 struct sockaddr_in *addr4 = NULL;
3673                 struct sockaddr_in6 *addr6 = NULL;
3674                 unsigned short snum;
3675                 u32 sid, perm;
3676
3677                 if (sk->sk_family == PF_INET) {
3678                         addr4 = (struct sockaddr_in *)address;
3679                         if (addrlen < sizeof(struct sockaddr_in))
3680                                 return -EINVAL;
3681                         snum = ntohs(addr4->sin_port);
3682                 } else {
3683                         addr6 = (struct sockaddr_in6 *)address;
3684                         if (addrlen < SIN6_LEN_RFC2133)
3685                                 return -EINVAL;
3686                         snum = ntohs(addr6->sin6_port);
3687                 }
3688
3689                 err = security_port_sid(sk->sk_family, sk->sk_type,
3690                                         sk->sk_protocol, snum, &sid);
3691                 if (err)
3692                         goto out;
3693
3694                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3695                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3696
3697                 AVC_AUDIT_DATA_INIT(&ad,NET);
3698                 ad.u.net.dport = htons(snum);
3699                 ad.u.net.family = sk->sk_family;
3700                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3701                 if (err)
3702                         goto out;
3703         }
3704
3705 out:
3706         return err;
3707 }
3708
3709 static int selinux_socket_listen(struct socket *sock, int backlog)
3710 {
3711         return socket_has_perm(current, sock, SOCKET__LISTEN);
3712 }
3713
3714 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3715 {
3716         int err;
3717         struct inode_security_struct *isec;
3718         struct inode_security_struct *newisec;
3719
3720         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3721         if (err)
3722                 return err;
3723
3724         newisec = SOCK_INODE(newsock)->i_security;
3725
3726         isec = SOCK_INODE(sock)->i_security;
3727         newisec->sclass = isec->sclass;
3728         newisec->sid = isec->sid;
3729         newisec->initialized = 1;
3730
3731         return 0;
3732 }
3733
3734 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3735                                   int size)
3736 {
3737         int rc;
3738
3739         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3740         if (rc)
3741                 return rc;
3742
3743         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3744 }
3745
3746 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3747                                   int size, int flags)
3748 {
3749         return socket_has_perm(current, sock, SOCKET__READ);
3750 }
3751
3752 static int selinux_socket_getsockname(struct socket *sock)
3753 {
3754         return socket_has_perm(current, sock, SOCKET__GETATTR);
3755 }
3756
3757 static int selinux_socket_getpeername(struct socket *sock)
3758 {
3759         return socket_has_perm(current, sock, SOCKET__GETATTR);
3760 }
3761
3762 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3763 {
3764         int err;
3765
3766         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3767         if (err)
3768                 return err;
3769
3770         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3771 }
3772
3773 static int selinux_socket_getsockopt(struct socket *sock, int level,
3774                                      int optname)
3775 {
3776         return socket_has_perm(current, sock, SOCKET__GETOPT);
3777 }
3778
3779 static int selinux_socket_shutdown(struct socket *sock, int how)
3780 {
3781         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3782 }
3783
3784 static int selinux_socket_unix_stream_connect(struct socket *sock,
3785                                               struct socket *other,
3786                                               struct sock *newsk)
3787 {
3788         struct sk_security_struct *ssec;
3789         struct inode_security_struct *isec;
3790         struct inode_security_struct *other_isec;
3791         struct avc_audit_data ad;
3792         int err;
3793
3794         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3795         if (err)
3796                 return err;
3797
3798         isec = SOCK_INODE(sock)->i_security;
3799         other_isec = SOCK_INODE(other)->i_security;
3800
3801         AVC_AUDIT_DATA_INIT(&ad,NET);
3802         ad.u.net.sk = other->sk;
3803
3804         err = avc_has_perm(isec->sid, other_isec->sid,
3805                            isec->sclass,
3806                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3807         if (err)
3808                 return err;
3809
3810         /* connecting socket */
3811         ssec = sock->sk->sk_security;
3812         ssec->peer_sid = other_isec->sid;
3813
3814         /* server child socket */
3815         ssec = newsk->sk_security;
3816         ssec->peer_sid = isec->sid;
3817         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3818
3819         return err;
3820 }
3821
3822 static int selinux_socket_unix_may_send(struct socket *sock,
3823                                         struct socket *other)
3824 {
3825         struct inode_security_struct *isec;
3826         struct inode_security_struct *other_isec;
3827         struct avc_audit_data ad;
3828         int err;
3829
3830         isec = SOCK_INODE(sock)->i_security;
3831         other_isec = SOCK_INODE(other)->i_security;
3832
3833         AVC_AUDIT_DATA_INIT(&ad,NET);
3834         ad.u.net.sk = other->sk;
3835
3836         err = avc_has_perm(isec->sid, other_isec->sid,
3837                            isec->sclass, SOCKET__SENDTO, &ad);
3838         if (err)
3839                 return err;
3840
3841         return 0;
3842 }
3843
3844 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3845                                     u32 peer_sid,
3846                                     struct avc_audit_data *ad)
3847 {
3848         int err;
3849         u32 if_sid;
3850         u32 node_sid;
3851
3852         err = sel_netif_sid(ifindex, &if_sid);
3853         if (err)
3854                 return err;
3855         err = avc_has_perm(peer_sid, if_sid,
3856                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3857         if (err)
3858                 return err;
3859
3860         err = sel_netnode_sid(addrp, family, &node_sid);
3861         if (err)
3862                 return err;
3863         return avc_has_perm(peer_sid, node_sid,
3864                             SECCLASS_NODE, NODE__RECVFROM, ad);
3865 }
3866
3867 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3868                                                 struct sk_buff *skb,
3869                                                 struct avc_audit_data *ad,
3870                                                 u16 family,
3871                                                 char *addrp)
3872 {
3873         int err;
3874         struct sk_security_struct *sksec = sk->sk_security;
3875         u16 sk_class;
3876         u32 netif_perm, node_perm, recv_perm;
3877         u32 port_sid, node_sid, if_sid, sk_sid;
3878
3879         sk_sid = sksec->sid;
3880         sk_class = sksec->sclass;
3881
3882         switch (sk_class) {
3883         case SECCLASS_UDP_SOCKET:
3884                 netif_perm = NETIF__UDP_RECV;
3885                 node_perm = NODE__UDP_RECV;
3886                 recv_perm = UDP_SOCKET__RECV_MSG;
3887                 break;
3888         case SECCLASS_TCP_SOCKET:
3889                 netif_perm = NETIF__TCP_RECV;
3890                 node_perm = NODE__TCP_RECV;
3891                 recv_perm = TCP_SOCKET__RECV_MSG;
3892                 break;
3893         case SECCLASS_DCCP_SOCKET:
3894                 netif_perm = NETIF__DCCP_RECV;
3895                 node_perm = NODE__DCCP_RECV;
3896                 recv_perm = DCCP_SOCKET__RECV_MSG;
3897                 break;
3898         default:
3899                 netif_perm = NETIF__RAWIP_RECV;
3900                 node_perm = NODE__RAWIP_RECV;
3901                 recv_perm = 0;
3902                 break;
3903         }
3904
3905         err = sel_netif_sid(skb->iif, &if_sid);
3906         if (err)
3907                 return err;
3908         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3909         if (err)
3910                 return err;
3911
3912         err = sel_netnode_sid(addrp, family, &node_sid);
3913         if (err)
3914                 return err;
3915         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3916         if (err)
3917                 return err;
3918
3919         if (!recv_perm)
3920                 return 0;
3921         err = security_port_sid(sk->sk_family, sk->sk_type,
3922                                 sk->sk_protocol, ntohs(ad->u.net.sport),
3923                                 &port_sid);
3924         if (unlikely(err)) {
3925                 printk(KERN_WARNING
3926                        "SELinux: failure in"
3927                        " selinux_sock_rcv_skb_iptables_compat(),"
3928                        " network port label not found\n");
3929                 return err;
3930         }
3931         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3932 }
3933
3934 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3935                                        struct avc_audit_data *ad,
3936                                        u16 family, char *addrp)
3937 {
3938         int err;
3939         struct sk_security_struct *sksec = sk->sk_security;
3940         u32 peer_sid;
3941         u32 sk_sid = sksec->sid;
3942
3943         if (selinux_compat_net)
3944                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3945                                                            family, addrp);
3946         else
3947                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3948                                    PACKET__RECV, ad);
3949         if (err)
3950                 return err;
3951
3952         if (selinux_policycap_netpeer) {
3953                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3954                 if (err)
3955                         return err;
3956                 err = avc_has_perm(sk_sid, peer_sid,
3957                                    SECCLASS_PEER, PEER__RECV, ad);
3958         } else {
3959                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
3960                 if (err)
3961                         return err;
3962                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
3963         }
3964
3965         return err;
3966 }
3967
3968 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3969 {
3970         int err;
3971         struct sk_security_struct *sksec = sk->sk_security;
3972         u16 family = sk->sk_family;
3973         u32 sk_sid = sksec->sid;
3974         struct avc_audit_data ad;
3975         char *addrp;
3976
3977         if (family != PF_INET && family != PF_INET6)
3978                 return 0;
3979
3980         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3981         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3982                 family = PF_INET;
3983
3984         AVC_AUDIT_DATA_INIT(&ad, NET);
3985         ad.u.net.netif = skb->iif;
3986         ad.u.net.family = family;
3987         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
3988         if (err)
3989                 return err;
3990
3991         /* If any sort of compatibility mode is enabled then handoff processing
3992          * to the selinux_sock_rcv_skb_compat() function to deal with the
3993          * special handling.  We do this in an attempt to keep this function
3994          * as fast and as clean as possible. */
3995         if (selinux_compat_net || !selinux_policycap_netpeer)
3996                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
3997                                                    family, addrp);
3998
3999         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4000                 u32 peer_sid;
4001
4002                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4003                 if (err)
4004                         return err;
4005                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4006                                                peer_sid, &ad);
4007                 if (err)
4008                         return err;
4009                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4010                                    PEER__RECV, &ad);
4011         }
4012
4013         if (selinux_secmark_enabled()) {
4014                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4015                                    PACKET__RECV, &ad);
4016                 if (err)
4017                         return err;
4018         }
4019
4020         return err;
4021 }
4022
4023 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4024                                             int __user *optlen, unsigned len)
4025 {
4026         int err = 0;
4027         char *scontext;
4028         u32 scontext_len;
4029         struct sk_security_struct *ssec;
4030         struct inode_security_struct *isec;
4031         u32 peer_sid = SECSID_NULL;
4032
4033         isec = SOCK_INODE(sock)->i_security;
4034
4035         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4036             isec->sclass == SECCLASS_TCP_SOCKET) {
4037                 ssec = sock->sk->sk_security;
4038                 peer_sid = ssec->peer_sid;
4039         }
4040         if (peer_sid == SECSID_NULL) {
4041                 err = -ENOPROTOOPT;
4042                 goto out;
4043         }
4044
4045         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4046
4047         if (err)
4048                 goto out;
4049
4050         if (scontext_len > len) {
4051                 err = -ERANGE;
4052                 goto out_len;
4053         }
4054
4055         if (copy_to_user(optval, scontext, scontext_len))
4056                 err = -EFAULT;
4057
4058 out_len:
4059         if (put_user(scontext_len, optlen))
4060                 err = -EFAULT;
4061
4062         kfree(scontext);
4063 out:
4064         return err;
4065 }
4066
4067 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4068 {
4069         u32 peer_secid = SECSID_NULL;
4070         u16 family;
4071
4072         if (sock)
4073                 family = sock->sk->sk_family;
4074         else if (skb && skb->sk)
4075                 family = skb->sk->sk_family;
4076         else
4077                 goto out;
4078
4079         if (sock && family == PF_UNIX)
4080                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4081         else if (skb)
4082                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4083
4084 out:
4085         *secid = peer_secid;
4086         if (peer_secid == SECSID_NULL)
4087                 return -EINVAL;
4088         return 0;
4089 }
4090
4091 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4092 {
4093         return sk_alloc_security(sk, family, priority);
4094 }
4095
4096 static void selinux_sk_free_security(struct sock *sk)
4097 {
4098         sk_free_security(sk);
4099 }
4100
4101 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4102 {
4103         struct sk_security_struct *ssec = sk->sk_security;
4104         struct sk_security_struct *newssec = newsk->sk_security;
4105
4106         newssec->sid = ssec->sid;
4107         newssec->peer_sid = ssec->peer_sid;
4108         newssec->sclass = ssec->sclass;
4109
4110         selinux_netlbl_sk_security_clone(ssec, newssec);
4111 }
4112
4113 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4114 {
4115         if (!sk)
4116                 *secid = SECINITSID_ANY_SOCKET;
4117         else {
4118                 struct sk_security_struct *sksec = sk->sk_security;
4119
4120                 *secid = sksec->sid;
4121         }
4122 }
4123
4124 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4125 {
4126         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4127         struct sk_security_struct *sksec = sk->sk_security;
4128
4129         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4130             sk->sk_family == PF_UNIX)
4131                 isec->sid = sksec->sid;
4132         sksec->sclass = isec->sclass;
4133
4134         selinux_netlbl_sock_graft(sk, parent);
4135 }
4136
4137 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4138                                      struct request_sock *req)
4139 {
4140         struct sk_security_struct *sksec = sk->sk_security;
4141         int err;
4142         u32 newsid;
4143         u32 peersid;
4144
4145         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4146         if (err)
4147                 return err;
4148         if (peersid == SECSID_NULL) {
4149                 req->secid = sksec->sid;
4150                 req->peer_secid = SECSID_NULL;
4151                 return 0;
4152         }
4153
4154         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4155         if (err)
4156                 return err;
4157
4158         req->secid = newsid;
4159         req->peer_secid = peersid;
4160         return 0;
4161 }
4162
4163 static void selinux_inet_csk_clone(struct sock *newsk,
4164                                    const struct request_sock *req)
4165 {
4166         struct sk_security_struct *newsksec = newsk->sk_security;
4167
4168         newsksec->sid = req->secid;
4169         newsksec->peer_sid = req->peer_secid;
4170         /* NOTE: Ideally, we should also get the isec->sid for the
4171            new socket in sync, but we don't have the isec available yet.
4172            So we will wait until sock_graft to do it, by which
4173            time it will have been created and available. */
4174
4175         /* We don't need to take any sort of lock here as we are the only
4176          * thread with access to newsksec */
4177         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4178 }
4179
4180 static void selinux_inet_conn_established(struct sock *sk,
4181                                 struct sk_buff *skb)
4182 {
4183         struct sk_security_struct *sksec = sk->sk_security;
4184
4185         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4186 }
4187
4188 static void selinux_req_classify_flow(const struct request_sock *req,
4189                                       struct flowi *fl)
4190 {
4191         fl->secid = req->secid;
4192 }
4193
4194 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4195 {
4196         int err = 0;
4197         u32 perm;
4198         struct nlmsghdr *nlh;
4199         struct socket *sock = sk->sk_socket;
4200         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4201
4202         if (skb->len < NLMSG_SPACE(0)) {
4203                 err = -EINVAL;
4204                 goto out;
4205         }
4206         nlh = nlmsg_hdr(skb);
4207
4208         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4209         if (err) {
4210                 if (err == -EINVAL) {
4211                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4212                                   "SELinux:  unrecognized netlink message"
4213                                   " type=%hu for sclass=%hu\n",
4214                                   nlh->nlmsg_type, isec->sclass);
4215                         if (!selinux_enforcing)
4216                                 err = 0;
4217                 }
4218
4219                 /* Ignore */
4220                 if (err == -ENOENT)
4221                         err = 0;
4222                 goto out;
4223         }
4224
4225         err = socket_has_perm(current, sock, perm);
4226 out:
4227         return err;
4228 }
4229
4230 #ifdef CONFIG_NETFILTER
4231
4232 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4233                                        u16 family)
4234 {
4235         char *addrp;
4236         u32 peer_sid;
4237         struct avc_audit_data ad;
4238         u8 secmark_active;
4239         u8 peerlbl_active;
4240
4241         if (!selinux_policycap_netpeer)
4242                 return NF_ACCEPT;
4243
4244         secmark_active = selinux_secmark_enabled();
4245         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4246         if (!secmark_active && !peerlbl_active)
4247                 return NF_ACCEPT;
4248
4249         AVC_AUDIT_DATA_INIT(&ad, NET);
4250         ad.u.net.netif = ifindex;
4251         ad.u.net.family = family;
4252         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4253                 return NF_DROP;
4254
4255         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4256                 return NF_DROP;
4257
4258         if (peerlbl_active)
4259                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4260                                              peer_sid, &ad) != 0)
4261                         return NF_DROP;
4262
4263         if (secmark_active)
4264                 if (avc_has_perm(peer_sid, skb->secmark,
4265                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4266                         return NF_DROP;
4267
4268         return NF_ACCEPT;
4269 }
4270
4271 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4272                                          struct sk_buff *skb,
4273                                          const struct net_device *in,
4274                                          const struct net_device *out,
4275                                          int (*okfn)(struct sk_buff *))
4276 {
4277         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4278 }
4279
4280 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4281 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4282                                          struct sk_buff *skb,
4283                                          const struct net_device *in,
4284                                          const struct net_device *out,
4285                                          int (*okfn)(struct sk_buff *))
4286 {
4287         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4288 }
4289 #endif  /* IPV6 */
4290
4291 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4292                                                 int ifindex,
4293                                                 struct avc_audit_data *ad,
4294                                                 u16 family, char *addrp)
4295 {
4296         int err;
4297         struct sk_security_struct *sksec = sk->sk_security;
4298         u16 sk_class;
4299         u32 netif_perm, node_perm, send_perm;
4300         u32 port_sid, node_sid, if_sid, sk_sid;
4301
4302         sk_sid = sksec->sid;
4303         sk_class = sksec->sclass;
4304
4305         switch (sk_class) {
4306         case SECCLASS_UDP_SOCKET:
4307                 netif_perm = NETIF__UDP_SEND;
4308                 node_perm = NODE__UDP_SEND;
4309                 send_perm = UDP_SOCKET__SEND_MSG;
4310                 break;
4311         case SECCLASS_TCP_SOCKET:
4312                 netif_perm = NETIF__TCP_SEND;
4313                 node_perm = NODE__TCP_SEND;
4314                 send_perm = TCP_SOCKET__SEND_MSG;
4315                 break;
4316         case SECCLASS_DCCP_SOCKET:
4317                 netif_perm = NETIF__DCCP_SEND;
4318                 node_perm = NODE__DCCP_SEND;
4319                 send_perm = DCCP_SOCKET__SEND_MSG;
4320                 break;
4321         default:
4322                 netif_perm = NETIF__RAWIP_SEND;
4323                 node_perm = NODE__RAWIP_SEND;
4324                 send_perm = 0;
4325                 break;
4326         }
4327
4328         err = sel_netif_sid(ifindex, &if_sid);
4329         if (err)
4330                 return err;
4331         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4332                 return err;
4333
4334         err = sel_netnode_sid(addrp, family, &node_sid);
4335         if (err)
4336                 return err;
4337         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4338         if (err)
4339                 return err;
4340
4341         if (send_perm != 0)
4342                 return 0;
4343
4344         err = security_port_sid(sk->sk_family, sk->sk_type,
4345                                 sk->sk_protocol, ntohs(ad->u.net.dport),
4346                                 &port_sid);
4347         if (unlikely(err)) {
4348                 printk(KERN_WARNING
4349                        "SELinux: failure in"
4350                        " selinux_ip_postroute_iptables_compat(),"
4351                        " network port label not found\n");
4352                 return err;
4353         }
4354         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4355 }
4356
4357 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4358                                                 int ifindex,
4359                                                 struct avc_audit_data *ad,
4360                                                 u16 family,
4361                                                 char *addrp,
4362                                                 u8 proto)
4363 {
4364         struct sock *sk = skb->sk;
4365         struct sk_security_struct *sksec;
4366
4367         if (sk == NULL)
4368                 return NF_ACCEPT;
4369         sksec = sk->sk_security;
4370
4371         if (selinux_compat_net) {
4372                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4373                                                          ad, family, addrp))
4374                         return NF_DROP;
4375         } else {
4376                 if (avc_has_perm(sksec->sid, skb->secmark,
4377                                  SECCLASS_PACKET, PACKET__SEND, ad))
4378                         return NF_DROP;
4379         }
4380
4381         if (selinux_policycap_netpeer)
4382                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4383                         return NF_DROP;
4384
4385         return NF_ACCEPT;
4386 }
4387
4388 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4389                                          u16 family)
4390 {
4391         u32 secmark_perm;
4392         u32 peer_sid;
4393         struct sock *sk;
4394         struct avc_audit_data ad;
4395         char *addrp;
4396         u8 proto;
4397         u8 secmark_active;
4398         u8 peerlbl_active;
4399
4400         AVC_AUDIT_DATA_INIT(&ad, NET);
4401         ad.u.net.netif = ifindex;
4402         ad.u.net.family = family;
4403         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4404                 return NF_DROP;
4405
4406         /* If any sort of compatibility mode is enabled then handoff processing
4407          * to the selinux_ip_postroute_compat() function to deal with the
4408          * special handling.  We do this in an attempt to keep this function
4409          * as fast and as clean as possible. */
4410         if (selinux_compat_net || !selinux_policycap_netpeer)
4411                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4412                                                    family, addrp, proto);
4413
4414         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4415          * packet transformation so allow the packet to pass without any checks
4416          * since we'll have another chance to perform access control checks
4417          * when the packet is on it's final way out.
4418          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4419          *       is NULL, in this case go ahead and apply access control. */
4420         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4421                 return NF_ACCEPT;
4422
4423         secmark_active = selinux_secmark_enabled();
4424         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4425         if (!secmark_active && !peerlbl_active)
4426                 return NF_ACCEPT;
4427
4428         /* if the packet is locally generated (skb->sk != NULL) then use the
4429          * socket's label as the peer label, otherwise the packet is being
4430          * forwarded through this system and we need to fetch the peer label
4431          * directly from the packet */
4432         sk = skb->sk;
4433         if (sk) {
4434                 struct sk_security_struct *sksec = sk->sk_security;
4435                 peer_sid = sksec->sid;
4436                 secmark_perm = PACKET__SEND;
4437         } else {
4438                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4439                                 return NF_DROP;
4440                 secmark_perm = PACKET__FORWARD_OUT;
4441         }
4442
4443         if (secmark_active)
4444                 if (avc_has_perm(peer_sid, skb->secmark,
4445                                  SECCLASS_PACKET, secmark_perm, &ad))
4446                         return NF_DROP;
4447
4448         if (peerlbl_active) {
4449                 u32 if_sid;
4450                 u32 node_sid;
4451
4452                 if (sel_netif_sid(ifindex, &if_sid))
4453                         return NF_DROP;
4454                 if (avc_has_perm(peer_sid, if_sid,
4455                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4456                         return NF_DROP;
4457
4458                 if (sel_netnode_sid(addrp, family, &node_sid))
4459                         return NF_DROP;
4460                 if (avc_has_perm(peer_sid, node_sid,
4461                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4462                         return NF_DROP;
4463         }
4464
4465         return NF_ACCEPT;
4466 }
4467
4468 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4469                                            struct sk_buff *skb,
4470                                            const struct net_device *in,
4471                                            const struct net_device *out,
4472                                            int (*okfn)(struct sk_buff *))
4473 {
4474         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4475 }
4476
4477 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4478 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4479                                            struct sk_buff *skb,
4480                                            const struct net_device *in,
4481                                            const struct net_device *out,
4482                                            int (*okfn)(struct sk_buff *))
4483 {
4484         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4485 }
4486 #endif  /* IPV6 */
4487
4488 #endif  /* CONFIG_NETFILTER */
4489
4490 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4491 {
4492         int err;
4493
4494         err = secondary_ops->netlink_send(sk, skb);
4495         if (err)
4496                 return err;
4497
4498         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4499                 err = selinux_nlmsg_perm(sk, skb);
4500
4501         return err;
4502 }
4503
4504 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4505 {
4506         int err;
4507         struct avc_audit_data ad;
4508
4509         err = secondary_ops->netlink_recv(skb, capability);
4510         if (err)
4511                 return err;
4512
4513         AVC_AUDIT_DATA_INIT(&ad, CAP);
4514         ad.u.cap = capability;
4515
4516         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4517                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4518 }
4519
4520 static int ipc_alloc_security(struct task_struct *task,
4521                               struct kern_ipc_perm *perm,
4522                               u16 sclass)
4523 {
4524         struct task_security_struct *tsec = task->security;
4525         struct ipc_security_struct *isec;
4526
4527         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4528         if (!isec)
4529                 return -ENOMEM;
4530
4531         isec->sclass = sclass;
4532         isec->ipc_perm = perm;
4533         isec->sid = tsec->sid;
4534         perm->security = isec;
4535
4536         return 0;
4537 }
4538
4539 static void ipc_free_security(struct kern_ipc_perm *perm)
4540 {
4541         struct ipc_security_struct *isec = perm->security;
4542         perm->security = NULL;
4543         kfree(isec);
4544 }
4545
4546 static int msg_msg_alloc_security(struct msg_msg *msg)
4547 {
4548         struct msg_security_struct *msec;
4549
4550         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4551         if (!msec)
4552                 return -ENOMEM;
4553
4554         msec->msg = msg;
4555         msec->sid = SECINITSID_UNLABELED;
4556         msg->security = msec;
4557
4558         return 0;
4559 }
4560
4561 static void msg_msg_free_security(struct msg_msg *msg)
4562 {
4563         struct msg_security_struct *msec = msg->security;
4564
4565         msg->security = NULL;
4566         kfree(msec);
4567 }
4568
4569 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4570                         u32 perms)
4571 {
4572         struct task_security_struct *tsec;
4573         struct ipc_security_struct *isec;
4574         struct avc_audit_data ad;
4575
4576         tsec = current->security;
4577         isec = ipc_perms->security;
4578
4579         AVC_AUDIT_DATA_INIT(&ad, IPC);
4580         ad.u.ipc_id = ipc_perms->key;
4581
4582         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4583 }
4584
4585 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4586 {
4587         return msg_msg_alloc_security(msg);
4588 }
4589
4590 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4591 {
4592         msg_msg_free_security(msg);
4593 }
4594
4595 /* message queue security operations */
4596 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4597 {
4598         struct task_security_struct *tsec;
4599         struct ipc_security_struct *isec;
4600         struct avc_audit_data ad;
4601         int rc;
4602
4603         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4604         if (rc)
4605                 return rc;
4606
4607         tsec = current->security;
4608         isec = msq->q_perm.security;
4609
4610         AVC_AUDIT_DATA_INIT(&ad, IPC);
4611         ad.u.ipc_id = msq->q_perm.key;
4612
4613         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4614                           MSGQ__CREATE, &ad);
4615         if (rc) {
4616                 ipc_free_security(&msq->q_perm);
4617                 return rc;
4618         }
4619         return 0;
4620 }
4621
4622 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4623 {
4624         ipc_free_security(&msq->q_perm);
4625 }
4626
4627 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4628 {
4629         struct task_security_struct *tsec;
4630         struct ipc_security_struct *isec;
4631         struct avc_audit_data ad;
4632
4633         tsec = current->security;
4634         isec = msq->q_perm.security;
4635
4636         AVC_AUDIT_DATA_INIT(&ad, IPC);
4637         ad.u.ipc_id = msq->q_perm.key;
4638
4639         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4640                             MSGQ__ASSOCIATE, &ad);
4641 }
4642
4643 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4644 {
4645         int err;
4646         int perms;
4647
4648         switch(cmd) {
4649         case IPC_INFO:
4650         case MSG_INFO:
4651                 /* No specific object, just general system-wide information. */
4652                 return task_has_system(current, SYSTEM__IPC_INFO);
4653         case IPC_STAT:
4654         case MSG_STAT:
4655                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4656                 break;
4657         case IPC_SET:
4658                 perms = MSGQ__SETATTR;
4659                 break;
4660         case IPC_RMID:
4661                 perms = MSGQ__DESTROY;
4662                 break;
4663         default:
4664                 return 0;
4665         }
4666
4667         err = ipc_has_perm(&msq->q_perm, perms);
4668         return err;
4669 }
4670
4671 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4672 {
4673         struct task_security_struct *tsec;
4674         struct ipc_security_struct *isec;
4675         struct msg_security_struct *msec;
4676         struct avc_audit_data ad;
4677         int rc;
4678
4679         tsec = current->security;
4680         isec = msq->q_perm.security;
4681         msec = msg->security;
4682
4683         /*
4684          * First time through, need to assign label to the message
4685          */
4686         if (msec->sid == SECINITSID_UNLABELED) {
4687                 /*
4688                  * Compute new sid based on current process and
4689                  * message queue this message will be stored in
4690                  */
4691                 rc = security_transition_sid(tsec->sid,
4692                                              isec->sid,
4693                                              SECCLASS_MSG,
4694                                              &msec->sid);
4695                 if (rc)
4696                         return rc;
4697         }
4698
4699         AVC_AUDIT_DATA_INIT(&ad, IPC);
4700         ad.u.ipc_id = msq->q_perm.key;
4701
4702         /* Can this process write to the queue? */
4703         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4704                           MSGQ__WRITE, &ad);
4705         if (!rc)
4706                 /* Can this process send the message */
4707                 rc = avc_has_perm(tsec->sid, msec->sid,
4708                                   SECCLASS_MSG, MSG__SEND, &ad);
4709         if (!rc)
4710                 /* Can the message be put in the queue? */
4711                 rc = avc_has_perm(msec->sid, isec->sid,
4712                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4713
4714         return rc;
4715 }
4716
4717 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4718                                     struct task_struct *target,
4719                                     long type, int mode)
4720 {
4721         struct task_security_struct *tsec;
4722         struct ipc_security_struct *isec;
4723         struct msg_security_struct *msec;
4724         struct avc_audit_data ad;
4725         int rc;
4726
4727         tsec = target->security;
4728         isec = msq->q_perm.security;
4729         msec = msg->security;
4730
4731         AVC_AUDIT_DATA_INIT(&ad, IPC);
4732         ad.u.ipc_id = msq->q_perm.key;
4733
4734         rc = avc_has_perm(tsec->sid, isec->sid,
4735                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4736         if (!rc)
4737                 rc = avc_has_perm(tsec->sid, msec->sid,
4738                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4739         return rc;
4740 }
4741
4742 /* Shared Memory security operations */
4743 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4744 {
4745         struct task_security_struct *tsec;
4746         struct ipc_security_struct *isec;
4747         struct avc_audit_data ad;
4748         int rc;
4749
4750         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4751         if (rc)
4752                 return rc;
4753
4754         tsec = current->security;
4755         isec = shp->shm_perm.security;
4756
4757         AVC_AUDIT_DATA_INIT(&ad, IPC);
4758         ad.u.ipc_id = shp->shm_perm.key;
4759
4760         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4761                           SHM__CREATE, &ad);
4762         if (rc) {
4763                 ipc_free_security(&shp->shm_perm);
4764                 return rc;
4765         }
4766         return 0;
4767 }
4768
4769 static void selinux_shm_free_security(struct shmid_kernel *shp)
4770 {
4771         ipc_free_security(&shp->shm_perm);
4772 }
4773
4774 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4775 {
4776         struct task_security_struct *tsec;
4777         struct ipc_security_struct *isec;
4778         struct avc_audit_data ad;
4779
4780         tsec = current->security;
4781         isec = shp->shm_perm.security;
4782
4783         AVC_AUDIT_DATA_INIT(&ad, IPC);
4784         ad.u.ipc_id = shp->shm_perm.key;
4785
4786         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4787                             SHM__ASSOCIATE, &ad);
4788 }
4789
4790 /* Note, at this point, shp is locked down */
4791 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4792 {
4793         int perms;
4794         int err;
4795
4796         switch(cmd) {
4797         case IPC_INFO:
4798         case SHM_INFO:
4799                 /* No specific object, just general system-wide information. */
4800                 return task_has_system(current, SYSTEM__IPC_INFO);
4801         case IPC_STAT:
4802         case SHM_STAT:
4803                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4804                 break;
4805         case IPC_SET:
4806                 perms = SHM__SETATTR;
4807                 break;
4808         case SHM_LOCK:
4809         case SHM_UNLOCK:
4810                 perms = SHM__LOCK;
4811                 break;
4812         case IPC_RMID:
4813                 perms = SHM__DESTROY;
4814                 break;
4815         default:
4816                 return 0;
4817         }
4818
4819         err = ipc_has_perm(&shp->shm_perm, perms);
4820         return err;
4821 }
4822
4823 static int selinux_shm_shmat(struct shmid_kernel *shp,
4824                              char __user *shmaddr, int shmflg)
4825 {
4826         u32 perms;
4827         int rc;
4828
4829         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4830         if (rc)
4831                 return rc;
4832
4833         if (shmflg & SHM_RDONLY)
4834                 perms = SHM__READ;
4835         else
4836                 perms = SHM__READ | SHM__WRITE;
4837
4838         return ipc_has_perm(&shp->shm_perm, perms);
4839 }
4840
4841 /* Semaphore security operations */
4842 static int selinux_sem_alloc_security(struct sem_array *sma)
4843 {
4844         struct task_security_struct *tsec;
4845         struct ipc_security_struct *isec;
4846         struct avc_audit_data ad;
4847         int rc;
4848
4849         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4850         if (rc)
4851                 return rc;
4852
4853         tsec = current->security;
4854         isec = sma->sem_perm.security;
4855
4856         AVC_AUDIT_DATA_INIT(&ad, IPC);
4857         ad.u.ipc_id = sma->sem_perm.key;
4858
4859         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4860                           SEM__CREATE, &ad);
4861         if (rc) {
4862                 ipc_free_security(&sma->sem_perm);
4863                 return rc;
4864         }
4865         return 0;
4866 }
4867
4868 static void selinux_sem_free_security(struct sem_array *sma)
4869 {
4870         ipc_free_security(&sma->sem_perm);
4871 }
4872
4873 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4874 {
4875         struct task_security_struct *tsec;
4876         struct ipc_security_struct *isec;
4877         struct avc_audit_data ad;
4878
4879         tsec = current->security;
4880         isec = sma->sem_perm.security;
4881
4882         AVC_AUDIT_DATA_INIT(&ad, IPC);
4883         ad.u.ipc_id = sma->sem_perm.key;
4884
4885         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4886                             SEM__ASSOCIATE, &ad);
4887 }
4888
4889 /* Note, at this point, sma is locked down */
4890 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4891 {
4892         int err;
4893         u32 perms;
4894
4895         switch(cmd) {
4896         case IPC_INFO:
4897         case SEM_INFO:
4898                 /* No specific object, just general system-wide information. */
4899                 return task_has_system(current, SYSTEM__IPC_INFO);
4900         case GETPID:
4901         case GETNCNT:
4902         case GETZCNT:
4903                 perms = SEM__GETATTR;
4904                 break;
4905         case GETVAL:
4906         case GETALL:
4907                 perms = SEM__READ;
4908                 break;
4909         case SETVAL:
4910         case SETALL:
4911                 perms = SEM__WRITE;
4912                 break;
4913         case IPC_RMID:
4914                 perms = SEM__DESTROY;
4915                 break;
4916         case IPC_SET:
4917                 perms = SEM__SETATTR;
4918                 break;
4919         case IPC_STAT:
4920         case SEM_STAT:
4921                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4922                 break;
4923         default:
4924                 return 0;
4925         }
4926
4927         err = ipc_has_perm(&sma->sem_perm, perms);
4928         return err;
4929 }
4930
4931 static int selinux_sem_semop(struct sem_array *sma,
4932                              struct sembuf *sops, unsigned nsops, int alter)
4933 {
4934         u32 perms;
4935
4936         if (alter)
4937                 perms = SEM__READ | SEM__WRITE;
4938         else
4939                 perms = SEM__READ;
4940
4941         return ipc_has_perm(&sma->sem_perm, perms);
4942 }
4943
4944 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4945 {
4946         u32 av = 0;
4947
4948         av = 0;
4949         if (flag & S_IRUGO)
4950                 av |= IPC__UNIX_READ;
4951         if (flag & S_IWUGO)
4952                 av |= IPC__UNIX_WRITE;
4953
4954         if (av == 0)
4955                 return 0;
4956
4957         return ipc_has_perm(ipcp, av);
4958 }
4959
4960 /* module stacking operations */
4961 static int selinux_register_security (const char *name, struct security_operations *ops)
4962 {
4963         if (secondary_ops != original_ops) {
4964                 printk(KERN_ERR "%s:  There is already a secondary security "
4965                        "module registered.\n", __FUNCTION__);
4966                 return -EINVAL;
4967         }
4968
4969         secondary_ops = ops;
4970
4971         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4972                __FUNCTION__,
4973                name);
4974
4975         return 0;
4976 }
4977
4978 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4979 {
4980         if (inode)
4981                 inode_doinit_with_dentry(inode, dentry);
4982 }
4983
4984 static int selinux_getprocattr(struct task_struct *p,
4985                                char *name, char **value)
4986 {
4987         struct task_security_struct *tsec;
4988         u32 sid;
4989         int error;
4990         unsigned len;
4991
4992         if (current != p) {
4993                 error = task_has_perm(current, p, PROCESS__GETATTR);
4994                 if (error)
4995                         return error;
4996         }
4997
4998         tsec = p->security;
4999
5000         if (!strcmp(name, "current"))
5001                 sid = tsec->sid;
5002         else if (!strcmp(name, "prev"))
5003                 sid = tsec->osid;
5004         else if (!strcmp(name, "exec"))
5005                 sid = tsec->exec_sid;
5006         else if (!strcmp(name, "fscreate"))
5007                 sid = tsec->create_sid;
5008         else if (!strcmp(name, "keycreate"))
5009                 sid = tsec->keycreate_sid;
5010         else if (!strcmp(name, "sockcreate"))
5011                 sid = tsec->sockcreate_sid;
5012         else
5013                 return -EINVAL;
5014
5015         if (!sid)
5016                 return 0;
5017
5018         error = security_sid_to_context(sid, value, &len);
5019         if (error)
5020                 return error;
5021         return len;
5022 }
5023
5024 static int selinux_setprocattr(struct task_struct *p,
5025                                char *name, void *value, size_t size)
5026 {
5027         struct task_security_struct *tsec;
5028         u32 sid = 0;
5029         int error;
5030         char *str = value;
5031
5032         if (current != p) {
5033                 /* SELinux only allows a process to change its own
5034                    security attributes. */
5035                 return -EACCES;
5036         }
5037
5038         /*
5039          * Basic control over ability to set these attributes at all.
5040          * current == p, but we'll pass them separately in case the
5041          * above restriction is ever removed.
5042          */
5043         if (!strcmp(name, "exec"))
5044                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5045         else if (!strcmp(name, "fscreate"))
5046                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5047         else if (!strcmp(name, "keycreate"))
5048                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5049         else if (!strcmp(name, "sockcreate"))
5050                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5051         else if (!strcmp(name, "current"))
5052                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5053         else
5054                 error = -EINVAL;
5055         if (error)
5056                 return error;
5057
5058         /* Obtain a SID for the context, if one was specified. */
5059         if (size && str[1] && str[1] != '\n') {
5060                 if (str[size-1] == '\n') {
5061                         str[size-1] = 0;
5062                         size--;
5063                 }
5064                 error = security_context_to_sid(value, size, &sid);
5065                 if (error)
5066                         return error;
5067         }
5068
5069         /* Permission checking based on the specified context is
5070            performed during the actual operation (execve,
5071            open/mkdir/...), when we know the full context of the
5072            operation.  See selinux_bprm_set_security for the execve
5073            checks and may_create for the file creation checks. The
5074            operation will then fail if the context is not permitted. */
5075         tsec = p->security;
5076         if (!strcmp(name, "exec"))
5077                 tsec->exec_sid = sid;
5078         else if (!strcmp(name, "fscreate"))
5079                 tsec->create_sid = sid;
5080         else if (!strcmp(name, "keycreate")) {
5081                 error = may_create_key(sid, p);
5082                 if (error)
5083                         return error;
5084                 tsec->keycreate_sid = sid;
5085         } else if (!strcmp(name, "sockcreate"))
5086                 tsec->sockcreate_sid = sid;
5087         else if (!strcmp(name, "current")) {
5088                 struct av_decision avd;
5089
5090                 if (sid == 0)
5091                         return -EINVAL;
5092
5093                 /* Only allow single threaded processes to change context */
5094                 if (atomic_read(&p->mm->mm_users) != 1) {
5095                         struct task_struct *g, *t;
5096                         struct mm_struct *mm = p->mm;
5097                         read_lock(&tasklist_lock);
5098                         do_each_thread(g, t)
5099                                 if (t->mm == mm && t != p) {
5100                                         read_unlock(&tasklist_lock);
5101                                         return -EPERM;
5102                                 }
5103                         while_each_thread(g, t);
5104                         read_unlock(&tasklist_lock);
5105                 }
5106
5107                 /* Check permissions for the transition. */
5108                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5109                                      PROCESS__DYNTRANSITION, NULL);
5110                 if (error)
5111                         return error;
5112
5113                 /* Check for ptracing, and update the task SID if ok.
5114                    Otherwise, leave SID unchanged and fail. */
5115                 task_lock(p);
5116                 if (p->ptrace & PT_PTRACED) {
5117                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5118                                                      SECCLASS_PROCESS,
5119                                                      PROCESS__PTRACE, 0, &avd);
5120                         if (!error)
5121                                 tsec->sid = sid;
5122                         task_unlock(p);
5123                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5124                                   PROCESS__PTRACE, &avd, error, NULL);
5125                         if (error)
5126                                 return error;
5127                 } else {
5128                         tsec->sid = sid;
5129                         task_unlock(p);
5130                 }
5131         }
5132         else
5133                 return -EINVAL;
5134
5135         return size;
5136 }
5137
5138 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5139 {
5140         return security_sid_to_context(secid, secdata, seclen);
5141 }
5142
5143 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5144 {
5145         return security_context_to_sid(secdata, seclen, secid);
5146 }
5147
5148 static void selinux_release_secctx(char *secdata, u32 seclen)
5149 {
5150         kfree(secdata);
5151 }
5152
5153 #ifdef CONFIG_KEYS
5154
5155 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5156                              unsigned long flags)
5157 {
5158         struct task_security_struct *tsec = tsk->security;
5159         struct key_security_struct *ksec;
5160
5161         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5162         if (!ksec)
5163                 return -ENOMEM;
5164
5165         ksec->obj = k;
5166         if (tsec->keycreate_sid)
5167                 ksec->sid = tsec->keycreate_sid;
5168         else
5169                 ksec->sid = tsec->sid;
5170         k->security = ksec;
5171
5172         return 0;
5173 }
5174
5175 static void selinux_key_free(struct key *k)
5176 {
5177         struct key_security_struct *ksec = k->security;
5178
5179         k->security = NULL;
5180         kfree(ksec);
5181 }
5182
5183 static int selinux_key_permission(key_ref_t key_ref,
5184                             struct task_struct *ctx,
5185                             key_perm_t perm)
5186 {
5187         struct key *key;
5188         struct task_security_struct *tsec;
5189         struct key_security_struct *ksec;
5190
5191         key = key_ref_to_ptr(key_ref);
5192
5193         tsec = ctx->security;
5194         ksec = key->security;
5195
5196         /* if no specific permissions are requested, we skip the
5197            permission check. No serious, additional covert channels
5198            appear to be created. */
5199         if (perm == 0)
5200                 return 0;
5201
5202         return avc_has_perm(tsec->sid, ksec->sid,
5203                             SECCLASS_KEY, perm, NULL);
5204 }
5205
5206 #endif
5207
5208 static struct security_operations selinux_ops = {
5209         .ptrace =                       selinux_ptrace,
5210         .capget =                       selinux_capget,
5211         .capset_check =                 selinux_capset_check,
5212         .capset_set =                   selinux_capset_set,
5213         .sysctl =                       selinux_sysctl,
5214         .capable =                      selinux_capable,
5215         .quotactl =                     selinux_quotactl,
5216         .quota_on =                     selinux_quota_on,
5217         .syslog =                       selinux_syslog,
5218         .vm_enough_memory =             selinux_vm_enough_memory,
5219
5220         .netlink_send =                 selinux_netlink_send,
5221         .netlink_recv =                 selinux_netlink_recv,
5222
5223         .bprm_alloc_security =          selinux_bprm_alloc_security,
5224         .bprm_free_security =           selinux_bprm_free_security,
5225         .bprm_apply_creds =             selinux_bprm_apply_creds,
5226         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5227         .bprm_set_security =            selinux_bprm_set_security,
5228         .bprm_check_security =          selinux_bprm_check_security,
5229         .bprm_secureexec =              selinux_bprm_secureexec,
5230
5231         .sb_alloc_security =            selinux_sb_alloc_security,
5232         .sb_free_security =             selinux_sb_free_security,
5233         .sb_copy_data =                 selinux_sb_copy_data,
5234         .sb_kern_mount =                selinux_sb_kern_mount,
5235         .sb_statfs =                    selinux_sb_statfs,
5236         .sb_mount =                     selinux_mount,
5237         .sb_umount =                    selinux_umount,
5238         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5239         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5240         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5241
5242         .inode_alloc_security =         selinux_inode_alloc_security,
5243         .inode_free_security =          selinux_inode_free_security,
5244         .inode_init_security =          selinux_inode_init_security,
5245         .inode_create =                 selinux_inode_create,
5246         .inode_link =                   selinux_inode_link,
5247         .inode_unlink =                 selinux_inode_unlink,
5248         .inode_symlink =                selinux_inode_symlink,
5249         .inode_mkdir =                  selinux_inode_mkdir,
5250         .inode_rmdir =                  selinux_inode_rmdir,
5251         .inode_mknod =                  selinux_inode_mknod,
5252         .inode_rename =                 selinux_inode_rename,
5253         .inode_readlink =               selinux_inode_readlink,
5254         .inode_follow_link =            selinux_inode_follow_link,
5255         .inode_permission =             selinux_inode_permission,
5256         .inode_setattr =                selinux_inode_setattr,
5257         .inode_getattr =                selinux_inode_getattr,
5258         .inode_setxattr =               selinux_inode_setxattr,
5259         .inode_post_setxattr =          selinux_inode_post_setxattr,
5260         .inode_getxattr =               selinux_inode_getxattr,
5261         .inode_listxattr =              selinux_inode_listxattr,
5262         .inode_removexattr =            selinux_inode_removexattr,
5263         .inode_getsecurity =            selinux_inode_getsecurity,
5264         .inode_setsecurity =            selinux_inode_setsecurity,
5265         .inode_listsecurity =           selinux_inode_listsecurity,
5266         .inode_need_killpriv =          selinux_inode_need_killpriv,
5267         .inode_killpriv =               selinux_inode_killpriv,
5268
5269         .file_permission =              selinux_file_permission,
5270         .file_alloc_security =          selinux_file_alloc_security,
5271         .file_free_security =           selinux_file_free_security,
5272         .file_ioctl =                   selinux_file_ioctl,
5273         .file_mmap =                    selinux_file_mmap,
5274         .file_mprotect =                selinux_file_mprotect,
5275         .file_lock =                    selinux_file_lock,
5276         .file_fcntl =                   selinux_file_fcntl,
5277         .file_set_fowner =              selinux_file_set_fowner,
5278         .file_send_sigiotask =          selinux_file_send_sigiotask,
5279         .file_receive =                 selinux_file_receive,
5280
5281         .dentry_open =                  selinux_dentry_open,
5282
5283         .task_create =                  selinux_task_create,
5284         .task_alloc_security =          selinux_task_alloc_security,
5285         .task_free_security =           selinux_task_free_security,
5286         .task_setuid =                  selinux_task_setuid,
5287         .task_post_setuid =             selinux_task_post_setuid,
5288         .task_setgid =                  selinux_task_setgid,
5289         .task_setpgid =                 selinux_task_setpgid,
5290         .task_getpgid =                 selinux_task_getpgid,
5291         .task_getsid =                  selinux_task_getsid,
5292         .task_getsecid =                selinux_task_getsecid,
5293         .task_setgroups =               selinux_task_setgroups,
5294         .task_setnice =                 selinux_task_setnice,
5295         .task_setioprio =               selinux_task_setioprio,
5296         .task_getioprio =               selinux_task_getioprio,
5297         .task_setrlimit =               selinux_task_setrlimit,
5298         .task_setscheduler =            selinux_task_setscheduler,
5299         .task_getscheduler =            selinux_task_getscheduler,
5300         .task_movememory =              selinux_task_movememory,
5301         .task_kill =                    selinux_task_kill,
5302         .task_wait =                    selinux_task_wait,
5303         .task_prctl =                   selinux_task_prctl,
5304         .task_reparent_to_init =        selinux_task_reparent_to_init,
5305         .task_to_inode =                selinux_task_to_inode,
5306
5307         .ipc_permission =               selinux_ipc_permission,
5308
5309         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5310         .msg_msg_free_security =        selinux_msg_msg_free_security,
5311
5312         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5313         .msg_queue_free_security =      selinux_msg_queue_free_security,
5314         .msg_queue_associate =          selinux_msg_queue_associate,
5315         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5316         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5317         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5318
5319         .shm_alloc_security =           selinux_shm_alloc_security,
5320         .shm_free_security =            selinux_shm_free_security,
5321         .shm_associate =                selinux_shm_associate,
5322         .shm_shmctl =                   selinux_shm_shmctl,
5323         .shm_shmat =                    selinux_shm_shmat,
5324
5325         .sem_alloc_security =           selinux_sem_alloc_security,
5326         .sem_free_security =            selinux_sem_free_security,
5327         .sem_associate =                selinux_sem_associate,
5328         .sem_semctl =                   selinux_sem_semctl,
5329         .sem_semop =                    selinux_sem_semop,
5330
5331         .register_security =            selinux_register_security,
5332
5333         .d_instantiate =                selinux_d_instantiate,
5334
5335         .getprocattr =                  selinux_getprocattr,
5336         .setprocattr =                  selinux_setprocattr,
5337
5338         .secid_to_secctx =              selinux_secid_to_secctx,
5339         .secctx_to_secid =              selinux_secctx_to_secid,
5340         .release_secctx =               selinux_release_secctx,
5341
5342         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5343         .unix_may_send =                selinux_socket_unix_may_send,
5344
5345         .socket_create =                selinux_socket_create,
5346         .socket_post_create =           selinux_socket_post_create,
5347         .socket_bind =                  selinux_socket_bind,
5348         .socket_connect =               selinux_socket_connect,
5349         .socket_listen =                selinux_socket_listen,
5350         .socket_accept =                selinux_socket_accept,
5351         .socket_sendmsg =               selinux_socket_sendmsg,
5352         .socket_recvmsg =               selinux_socket_recvmsg,
5353         .socket_getsockname =           selinux_socket_getsockname,
5354         .socket_getpeername =           selinux_socket_getpeername,
5355         .socket_getsockopt =            selinux_socket_getsockopt,
5356         .socket_setsockopt =            selinux_socket_setsockopt,
5357         .socket_shutdown =              selinux_socket_shutdown,
5358         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5359         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5360         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5361         .sk_alloc_security =            selinux_sk_alloc_security,
5362         .sk_free_security =             selinux_sk_free_security,
5363         .sk_clone_security =            selinux_sk_clone_security,
5364         .sk_getsecid =                  selinux_sk_getsecid,
5365         .sock_graft =                   selinux_sock_graft,
5366         .inet_conn_request =            selinux_inet_conn_request,
5367         .inet_csk_clone =               selinux_inet_csk_clone,
5368         .inet_conn_established =        selinux_inet_conn_established,
5369         .req_classify_flow =            selinux_req_classify_flow,
5370
5371 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5372         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5373         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5374         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5375         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5376         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5377         .xfrm_state_free_security =     selinux_xfrm_state_free,
5378         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5379         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5380         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5381         .xfrm_decode_session =          selinux_xfrm_decode_session,
5382 #endif
5383
5384 #ifdef CONFIG_KEYS
5385         .key_alloc =                    selinux_key_alloc,
5386         .key_free =                     selinux_key_free,
5387         .key_permission =               selinux_key_permission,
5388 #endif
5389 };
5390
5391 static __init int selinux_init(void)
5392 {
5393         struct task_security_struct *tsec;
5394
5395         if (!selinux_enabled) {
5396                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5397                 return 0;
5398         }
5399
5400         printk(KERN_INFO "SELinux:  Initializing.\n");
5401
5402         /* Set the security state for the initial task. */
5403         if (task_alloc_security(current))
5404                 panic("SELinux:  Failed to initialize initial task.\n");
5405         tsec = current->security;
5406         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5407
5408         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5409                                             sizeof(struct inode_security_struct),
5410                                             0, SLAB_PANIC, NULL);
5411         avc_init();
5412
5413         original_ops = secondary_ops = security_ops;
5414         if (!secondary_ops)
5415                 panic ("SELinux: No initial security operations\n");
5416         if (register_security (&selinux_ops))
5417                 panic("SELinux: Unable to register with kernel.\n");
5418
5419         if (selinux_enforcing) {
5420                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5421         } else {
5422                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5423         }
5424
5425 #ifdef CONFIG_KEYS
5426         /* Add security information to initial keyrings */
5427         selinux_key_alloc(&root_user_keyring, current,
5428                           KEY_ALLOC_NOT_IN_QUOTA);
5429         selinux_key_alloc(&root_session_keyring, current,
5430                           KEY_ALLOC_NOT_IN_QUOTA);
5431 #endif
5432
5433         return 0;
5434 }
5435
5436 void selinux_complete_init(void)
5437 {
5438         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5439
5440         /* Set up any superblocks initialized prior to the policy load. */
5441         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5442         spin_lock(&sb_lock);
5443         spin_lock(&sb_security_lock);
5444 next_sb:
5445         if (!list_empty(&superblock_security_head)) {
5446                 struct superblock_security_struct *sbsec =
5447                                 list_entry(superblock_security_head.next,
5448                                            struct superblock_security_struct,
5449                                            list);
5450                 struct super_block *sb = sbsec->sb;
5451                 sb->s_count++;
5452                 spin_unlock(&sb_security_lock);
5453                 spin_unlock(&sb_lock);
5454                 down_read(&sb->s_umount);
5455                 if (sb->s_root)
5456                         superblock_doinit(sb, NULL);
5457                 drop_super(sb);
5458                 spin_lock(&sb_lock);
5459                 spin_lock(&sb_security_lock);
5460                 list_del_init(&sbsec->list);
5461                 goto next_sb;
5462         }
5463         spin_unlock(&sb_security_lock);
5464         spin_unlock(&sb_lock);
5465 }
5466
5467 /* SELinux requires early initialization in order to label
5468    all processes and objects when they are created. */
5469 security_initcall(selinux_init);
5470
5471 #if defined(CONFIG_NETFILTER)
5472
5473 static struct nf_hook_ops selinux_ipv4_ops[] = {
5474         {
5475                 .hook =         selinux_ipv4_postroute,
5476                 .owner =        THIS_MODULE,
5477                 .pf =           PF_INET,
5478                 .hooknum =      NF_INET_POST_ROUTING,
5479                 .priority =     NF_IP_PRI_SELINUX_LAST,
5480         },
5481         {
5482                 .hook =         selinux_ipv4_forward,
5483                 .owner =        THIS_MODULE,
5484                 .pf =           PF_INET,
5485                 .hooknum =      NF_INET_FORWARD,
5486                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5487         }
5488 };
5489
5490 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5491
5492 static struct nf_hook_ops selinux_ipv6_ops[] = {
5493         {
5494                 .hook =         selinux_ipv6_postroute,
5495                 .owner =        THIS_MODULE,
5496                 .pf =           PF_INET6,
5497                 .hooknum =      NF_INET_POST_ROUTING,
5498                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5499         },
5500         {
5501                 .hook =         selinux_ipv6_forward,
5502                 .owner =        THIS_MODULE,
5503                 .pf =           PF_INET6,
5504                 .hooknum =      NF_INET_FORWARD,
5505                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5506         }
5507 };
5508
5509 #endif  /* IPV6 */
5510
5511 static int __init selinux_nf_ip_init(void)
5512 {
5513         int err = 0;
5514         u32 iter;
5515
5516         if (!selinux_enabled)
5517                 goto out;
5518
5519         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5520
5521         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5522                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5523                 if (err)
5524                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5525                               err);
5526         }
5527
5528 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5529         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5530                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5531                 if (err)
5532                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5533                               err);
5534         }
5535 #endif  /* IPV6 */
5536
5537 out:
5538         return err;
5539 }
5540
5541 __initcall(selinux_nf_ip_init);
5542
5543 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5544 static void selinux_nf_ip_exit(void)
5545 {
5546         u32 iter;
5547
5548         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5549
5550         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5551                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5552 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5553         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5554                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5555 #endif  /* IPV6 */
5556 }
5557 #endif
5558
5559 #else /* CONFIG_NETFILTER */
5560
5561 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5562 #define selinux_nf_ip_exit()
5563 #endif
5564
5565 #endif /* CONFIG_NETFILTER */
5566
5567 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5568 int selinux_disable(void)
5569 {
5570         extern void exit_sel_fs(void);
5571         static int selinux_disabled = 0;
5572
5573         if (ss_initialized) {
5574                 /* Not permitted after initial policy load. */
5575                 return -EINVAL;
5576         }
5577
5578         if (selinux_disabled) {
5579                 /* Only do this once. */
5580                 return -EINVAL;
5581         }
5582
5583         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5584
5585         selinux_disabled = 1;
5586         selinux_enabled = 0;
5587
5588         /* Reset security_ops to the secondary module, dummy or capability. */
5589         security_ops = secondary_ops;
5590
5591         /* Unregister netfilter hooks. */
5592         selinux_nf_ip_exit();
5593
5594         /* Unregister selinuxfs. */
5595         exit_sel_fs();
5596
5597         return 0;
5598 }
5599 #endif
5600
5601