security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <[email protected]>
   7  *            Chris Vance, <[email protected]>
   8  *            Wayne Salamon, <[email protected]>
   9  *            James Morris <[email protected]>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <[email protected]>
  13  *                                         Eric Paris <[email protected]>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <[email protected]>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <[email protected]>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <[email protected]>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 141  * policy capability is enabled, SECMARK is always considered enabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 147 }
 148
 149 /**
 150  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 151  *
 152  * Description:
 153  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 154  * (1) if any are enabled or false (0) if neither are enabled.  If the
 155  * always_check_network policy capability is enabled, peer labeling
 156  * is always considered enabled.
 157  *
 158  */
 159 static int selinux_peerlbl_enabled(void)
 160 {
 161         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 162 }
 163
 164 /*
 165  * initialise the security for the init task
 166  */
 167 static void cred_init_security(void)
 168 {
 169         struct cred *cred = (struct cred *) current->real_cred;
 170         struct task_security_struct *tsec;
 171
 172         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 173         if (!tsec)
 174                 panic("SELinux:  Failed to initialize initial task.\n");
 175
 176         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 177         cred->security = tsec;
 178 }
 179
 180 /*
 181  * get the security ID of a set of credentials
 182  */
 183 static inline u32 cred_sid(const struct cred *cred)
 184 {
 185         const struct task_security_struct *tsec;
 186
 187         tsec = cred->security;
 188         return tsec->sid;
 189 }
 190
 191 /*
 192  * get the objective security ID of a task
 193  */
 194 static inline u32 task_sid(const struct task_struct *task)
 195 {
 196         u32 sid;
 197
 198         rcu_read_lock();
 199         sid = cred_sid(__task_cred(task));
 200         rcu_read_unlock();
 201         return sid;
 202 }
 203
 204 /*
 205  * get the subjective security ID of the current task
 206  */
 207 static inline u32 current_sid(void)
 208 {
 209         const struct task_security_struct *tsec = current_security();
 210
 211         return tsec->sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         mutex_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         inode->i_security = isec;
 232
 233         return 0;
 234 }
 235
 236 static void inode_free_rcu(struct rcu_head *head)
 237 {
 238         struct inode_security_struct *isec;
 239
 240         isec = container_of(head, struct inode_security_struct, rcu);
 241         kmem_cache_free(sel_inode_cache, isec);
 242 }
 243
 244 static void inode_free_security(struct inode *inode)
 245 {
 246         struct inode_security_struct *isec = inode->i_security;
 247         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 248
 249         spin_lock(&sbsec->isec_lock);
 250         if (!list_empty(&isec->list))
 251                 list_del_init(&isec->list);
 252         spin_unlock(&sbsec->isec_lock);
 253
 254         /*
 255          * The inode may still be referenced in a path walk and
 256          * a call to selinux_inode_permission() can be made
 257          * after inode_free_security() is called. Ideally, the VFS
 258          * wouldn't do this, but fixing that is a much harder
 259          * job. For now, simply free the i_security via RCU, and
 260          * leave the current inode->i_security pointer intact.
 261          * The inode will be freed after the RCU grace period too.
 262          */
 263         call_rcu(&isec->rcu, inode_free_rcu);
 264 }
 265
 266 static int file_alloc_security(struct file *file)
 267 {
 268         struct file_security_struct *fsec;
 269         u32 sid = current_sid();
 270
 271         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 272         if (!fsec)
 273                 return -ENOMEM;
 274
 275         fsec->sid = sid;
 276         fsec->fown_sid = sid;
 277         file->f_security = fsec;
 278
 279         return 0;
 280 }
 281
 282 static void file_free_security(struct file *file)
 283 {
 284         struct file_security_struct *fsec = file->f_security;
 285         file->f_security = NULL;
 286         kfree(fsec);
 287 }
 288
 289 static int superblock_alloc_security(struct super_block *sb)
 290 {
 291         struct superblock_security_struct *sbsec;
 292
 293         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 294         if (!sbsec)
 295                 return -ENOMEM;
 296
 297         mutex_init(&sbsec->lock);
 298         INIT_LIST_HEAD(&sbsec->isec_head);
 299         spin_lock_init(&sbsec->isec_lock);
 300         sbsec->sb = sb;
 301         sbsec->sid = SECINITSID_UNLABELED;
 302         sbsec->def_sid = SECINITSID_FILE;
 303         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 304         sb->s_security = sbsec;
 305
 306         return 0;
 307 }
 308
 309 static void superblock_free_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec = sb->s_security;
 312         sb->s_security = NULL;
 313         kfree(sbsec);
 314 }
 315
 316 /* The file system's label must be initialized prior to use. */
 317
 318 static const char *labeling_behaviors[7] = {
 319         "uses xattr",
 320         "uses transition SIDs",
 321         "uses task SIDs",
 322         "uses genfs_contexts",
 323         "not configured for labeling",
 324         "uses mountpoint labeling",
 325         "uses native labeling",
 326 };
 327
 328 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 329
 330 static inline int inode_doinit(struct inode *inode)
 331 {
 332         return inode_doinit_with_dentry(inode, NULL);
 333 }
 334
 335 enum {
 336         Opt_error = -1,
 337         Opt_context = 1,
 338         Opt_fscontext = 2,
 339         Opt_defcontext = 3,
 340         Opt_rootcontext = 4,
 341         Opt_labelsupport = 5,
 342         Opt_nextmntopt = 6,
 343 };
 344
 345 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 346
 347 static const match_table_t tokens = {
 348         {Opt_context, CONTEXT_STR "%s"},
 349         {Opt_fscontext, FSCONTEXT_STR "%s"},
 350         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 351         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 352         {Opt_labelsupport, LABELSUPP_STR},
 353         {Opt_error, NULL},
 354 };
 355
 356 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 357
 358 static int may_context_mount_sb_relabel(u32 sid,
 359                         struct superblock_security_struct *sbsec,
 360                         const struct cred *cred)
 361 {
 362         const struct task_security_struct *tsec = cred->security;
 363         int rc;
 364
 365         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 366                           FILESYSTEM__RELABELFROM, NULL);
 367         if (rc)
 368                 return rc;
 369
 370         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 371                           FILESYSTEM__RELABELTO, NULL);
 372         return rc;
 373 }
 374
 375 static int may_context_mount_inode_relabel(u32 sid,
 376                         struct superblock_security_struct *sbsec,
 377                         const struct cred *cred)
 378 {
 379         const struct task_security_struct *tsec = cred->security;
 380         int rc;
 381         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 382                           FILESYSTEM__RELABELFROM, NULL);
 383         if (rc)
 384                 return rc;
 385
 386         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 387                           FILESYSTEM__ASSOCIATE, NULL);
 388         return rc;
 389 }
 390
 391 static int selinux_is_sblabel_mnt(struct super_block *sb)
 392 {
 393         struct superblock_security_struct *sbsec = sb->s_security;
 394
 395         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 396             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 397             sbsec->behavior == SECURITY_FS_USE_TASK)
 398                 return 1;
 399
 400         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 401         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 402                 return 1;
 403
 404         /*
 405          * Special handling for rootfs. Is genfs but supports
 406          * setting SELinux context on in-core inodes.
 407          */
 408         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 409                 return 1;
 410
 411         return 0;
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = root->d_inode;
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450         else
 451                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 452                        sb->s_id, sb->s_type->name,
 453                        labeling_behaviors[sbsec->behavior-1]);
 454
 455         sbsec->flags |= SE_SBINITIALIZED;
 456         if (selinux_is_sblabel_mnt(sb))
 457                 sbsec->flags |= SBLABEL_MNT;
 458
 459         /* Initialize the root inode. */
 460         rc = inode_doinit_with_dentry(root_inode, root);
 461
 462         /* Initialize any other inodes associated with the superblock, e.g.
 463            inodes created prior to initial policy load or inodes created
 464            during get_sb by a pseudo filesystem that directly
 465            populates itself. */
 466         spin_lock(&sbsec->isec_lock);
 467 next_inode:
 468         if (!list_empty(&sbsec->isec_head)) {
 469                 struct inode_security_struct *isec =
 470                                 list_entry(sbsec->isec_head.next,
 471                                            struct inode_security_struct, list);
 472                 struct inode *inode = isec->inode;
 473                 spin_unlock(&sbsec->isec_lock);
 474                 inode = igrab(inode);
 475                 if (inode) {
 476                         if (!IS_PRIVATE(inode))
 477                                 inode_doinit(inode);
 478                         iput(inode);
 479                 }
 480                 spin_lock(&sbsec->isec_lock);
 481                 list_del_init(&isec->list);
 482                 goto next_inode;
 483         }
 484         spin_unlock(&sbsec->isec_lock);
 485 out:
 486         return rc;
 487 }
 488
 489 /*
 490  * This function should allow an FS to ask what it's mount security
 491  * options were so it can use those later for submounts, displaying
 492  * mount options, or whatever.
 493  */
 494 static int selinux_get_mnt_opts(const struct super_block *sb,
 495                                 struct security_mnt_opts *opts)
 496 {
 497         int rc = 0, i;
 498         struct superblock_security_struct *sbsec = sb->s_security;
 499         char *context = NULL;
 500         u32 len;
 501         char tmp;
 502
 503         security_init_mnt_opts(opts);
 504
 505         if (!(sbsec->flags & SE_SBINITIALIZED))
 506                 return -EINVAL;
 507
 508         if (!ss_initialized)
 509                 return -EINVAL;
 510
 511         /* make sure we always check enough bits to cover the mask */
 512         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 513
 514         tmp = sbsec->flags & SE_MNTMASK;
 515         /* count the number of mount options for this sb */
 516         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 517                 if (tmp & 0x01)
 518                         opts->num_mnt_opts++;
 519                 tmp >>= 1;
 520         }
 521         /* Check if the Label support flag is set */
 522         if (sbsec->flags & SBLABEL_MNT)
 523                 opts->num_mnt_opts++;
 524
 525         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 526         if (!opts->mnt_opts) {
 527                 rc = -ENOMEM;
 528                 goto out_free;
 529         }
 530
 531         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 532         if (!opts->mnt_opts_flags) {
 533                 rc = -ENOMEM;
 534                 goto out_free;
 535         }
 536
 537         i = 0;
 538         if (sbsec->flags & FSCONTEXT_MNT) {
 539                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 540                 if (rc)
 541                         goto out_free;
 542                 opts->mnt_opts[i] = context;
 543                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 544         }
 545         if (sbsec->flags & CONTEXT_MNT) {
 546                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 551         }
 552         if (sbsec->flags & DEFCONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 558         }
 559         if (sbsec->flags & ROOTCONTEXT_MNT) {
 560                 struct inode *root = sbsec->sb->s_root->d_inode;
 561                 struct inode_security_struct *isec = root->i_security;
 562
 563                 rc = security_sid_to_context(isec->sid, &context, &len);
 564                 if (rc)
 565                         goto out_free;
 566                 opts->mnt_opts[i] = context;
 567                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 568         }
 569         if (sbsec->flags & SBLABEL_MNT) {
 570                 opts->mnt_opts[i] = NULL;
 571                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 572         }
 573
 574         BUG_ON(i != opts->num_mnt_opts);
 575
 576         return 0;
 577
 578 out_free:
 579         security_free_mnt_opts(opts);
 580         return rc;
 581 }
 582
 583 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 584                       u32 old_sid, u32 new_sid)
 585 {
 586         char mnt_flags = sbsec->flags & SE_MNTMASK;
 587
 588         /* check if the old mount command had the same options */
 589         if (sbsec->flags & SE_SBINITIALIZED)
 590                 if (!(sbsec->flags & flag) ||
 591                     (old_sid != new_sid))
 592                         return 1;
 593
 594         /* check if we were passed the same options twice,
 595          * aka someone passed context=a,context=b
 596          */
 597         if (!(sbsec->flags & SE_SBINITIALIZED))
 598                 if (mnt_flags & flag)
 599                         return 1;
 600         return 0;
 601 }
 602
 603 /*
 604  * Allow filesystems with binary mount data to explicitly set mount point
 605  * labeling information.
 606  */
 607 static int selinux_set_mnt_opts(struct super_block *sb,
 608                                 struct security_mnt_opts *opts,
 609                                 unsigned long kern_flags,
 610                                 unsigned long *set_kern_flags)
 611 {
 612         const struct cred *cred = current_cred();
 613         int rc = 0, i;
 614         struct superblock_security_struct *sbsec = sb->s_security;
 615         const char *name = sb->s_type->name;
 616         struct inode *inode = sbsec->sb->s_root->d_inode;
 617         struct inode_security_struct *root_isec = inode->i_security;
 618         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 619         u32 defcontext_sid = 0;
 620         char **mount_options = opts->mnt_opts;
 621         int *flags = opts->mnt_opts_flags;
 622         int num_opts = opts->num_mnt_opts;
 623
 624         mutex_lock(&sbsec->lock);
 625
 626         if (!ss_initialized) {
 627                 if (!num_opts) {
 628                         /* Defer initialization until selinux_complete_init,
 629                            after the initial policy is loaded and the security
 630                            server is ready to handle calls. */
 631                         goto out;
 632                 }
 633                 rc = -EINVAL;
 634                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 635                         "before the security server is initialized\n");
 636                 goto out;
 637         }
 638         if (kern_flags && !set_kern_flags) {
 639                 /* Specifying internal flags without providing a place to
 640                  * place the results is not allowed */
 641                 rc = -EINVAL;
 642                 goto out;
 643         }
 644
 645         /*
 646          * Binary mount data FS will come through this function twice.  Once
 647          * from an explicit call and once from the generic calls from the vfs.
 648          * Since the generic VFS calls will not contain any security mount data
 649          * we need to skip the double mount verification.
 650          *
 651          * This does open a hole in which we will not notice if the first
 652          * mount using this sb set explict options and a second mount using
 653          * this sb does not set any security options.  (The first options
 654          * will be used for both mounts)
 655          */
 656         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 657             && (num_opts == 0))
 658                 goto out;
 659
 660         /*
 661          * parse the mount options, check if they are valid sids.
 662          * also check if someone is trying to mount the same sb more
 663          * than once with different security options.
 664          */
 665         for (i = 0; i < num_opts; i++) {
 666                 u32 sid;
 667
 668                 if (flags[i] == SBLABEL_MNT)
 669                         continue;
 670                 rc = security_context_to_sid(mount_options[i],
 671                                              strlen(mount_options[i]), &sid);
 672                 if (rc) {
 673                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 674                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 675                                mount_options[i], sb->s_id, name, rc);
 676                         goto out;
 677                 }
 678                 switch (flags[i]) {
 679                 case FSCONTEXT_MNT:
 680                         fscontext_sid = sid;
 681
 682                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 683                                         fscontext_sid))
 684                                 goto out_double_mount;
 685
 686                         sbsec->flags |= FSCONTEXT_MNT;
 687                         break;
 688                 case CONTEXT_MNT:
 689                         context_sid = sid;
 690
 691                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 692                                         context_sid))
 693                                 goto out_double_mount;
 694
 695                         sbsec->flags |= CONTEXT_MNT;
 696                         break;
 697                 case ROOTCONTEXT_MNT:
 698                         rootcontext_sid = sid;
 699
 700                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 701                                         rootcontext_sid))
 702                                 goto out_double_mount;
 703
 704                         sbsec->flags |= ROOTCONTEXT_MNT;
 705
 706                         break;
 707                 case DEFCONTEXT_MNT:
 708                         defcontext_sid = sid;
 709
 710                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 711                                         defcontext_sid))
 712                                 goto out_double_mount;
 713
 714                         sbsec->flags |= DEFCONTEXT_MNT;
 715
 716                         break;
 717                 default:
 718                         rc = -EINVAL;
 719                         goto out;
 720                 }
 721         }
 722
 723         if (sbsec->flags & SE_SBINITIALIZED) {
 724                 /* previously mounted with options, but not on this attempt? */
 725                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 726                         goto out_double_mount;
 727                 rc = 0;
 728                 goto out;
 729         }
 730
 731         if (strcmp(sb->s_type->name, "proc") == 0)
 732                 sbsec->flags |= SE_SBPROC;
 733
 734         if (!sbsec->behavior) {
 735                 /*
 736                  * Determine the labeling behavior to use for this
 737                  * filesystem type.
 738                  */
 739                 rc = security_fs_use(sb);
 740                 if (rc) {
 741                         printk(KERN_WARNING
 742                                 "%s: security_fs_use(%s) returned %d\n",
 743                                         __func__, sb->s_type->name, rc);
 744                         goto out;
 745                 }
 746         }
 747         /* sets the context of the superblock for the fs being mounted. */
 748         if (fscontext_sid) {
 749                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 750                 if (rc)
 751                         goto out;
 752
 753                 sbsec->sid = fscontext_sid;
 754         }
 755
 756         /*
 757          * Switch to using mount point labeling behavior.
 758          * sets the label used on all file below the mountpoint, and will set
 759          * the superblock context if not already set.
 760          */
 761         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 762                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 763                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 764         }
 765
 766         if (context_sid) {
 767                 if (!fscontext_sid) {
 768                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 769                                                           cred);
 770                         if (rc)
 771                                 goto out;
 772                         sbsec->sid = context_sid;
 773                 } else {
 774                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 775                                                              cred);
 776                         if (rc)
 777                                 goto out;
 778                 }
 779                 if (!rootcontext_sid)
 780                         rootcontext_sid = context_sid;
 781
 782                 sbsec->mntpoint_sid = context_sid;
 783                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 784         }
 785
 786         if (rootcontext_sid) {
 787                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 788                                                      cred);
 789                 if (rc)
 790                         goto out;
 791
 792                 root_isec->sid = rootcontext_sid;
 793                 root_isec->initialized = 1;
 794         }
 795
 796         if (defcontext_sid) {
 797                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 798                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 799                         rc = -EINVAL;
 800                         printk(KERN_WARNING "SELinux: defcontext option is "
 801                                "invalid for this filesystem type\n");
 802                         goto out;
 803                 }
 804
 805                 if (defcontext_sid != sbsec->def_sid) {
 806                         rc = may_context_mount_inode_relabel(defcontext_sid,
 807                                                              sbsec, cred);
 808                         if (rc)
 809                                 goto out;
 810                 }
 811
 812                 sbsec->def_sid = defcontext_sid;
 813         }
 814
 815         rc = sb_finish_set_opts(sb);
 816 out:
 817         mutex_unlock(&sbsec->lock);
 818         return rc;
 819 out_double_mount:
 820         rc = -EINVAL;
 821         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 822                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 823         goto out;
 824 }
 825
 826 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 827                                     const struct super_block *newsb)
 828 {
 829         struct superblock_security_struct *old = oldsb->s_security;
 830         struct superblock_security_struct *new = newsb->s_security;
 831         char oldflags = old->flags & SE_MNTMASK;
 832         char newflags = new->flags & SE_MNTMASK;
 833
 834         if (oldflags != newflags)
 835                 goto mismatch;
 836         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 837                 goto mismatch;
 838         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 839                 goto mismatch;
 840         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 841                 goto mismatch;
 842         if (oldflags & ROOTCONTEXT_MNT) {
 843                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 844                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 845                 if (oldroot->sid != newroot->sid)
 846                         goto mismatch;
 847         }
 848         return 0;
 849 mismatch:
 850         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 851                             "different security settings for (dev %s, "
 852                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 853         return -EBUSY;
 854 }
 855
 856 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 857                                         struct super_block *newsb)
 858 {
 859         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 860         struct superblock_security_struct *newsbsec = newsb->s_security;
 861
 862         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 863         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 864         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 865
 866         /*
 867          * if the parent was able to be mounted it clearly had no special lsm
 868          * mount options.  thus we can safely deal with this superblock later
 869          */
 870         if (!ss_initialized)
 871                 return 0;
 872
 873         /* how can we clone if the old one wasn't set up?? */
 874         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 875
 876         /* if fs is reusing a sb, make sure that the contexts match */
 877         if (newsbsec->flags & SE_SBINITIALIZED)
 878                 return selinux_cmp_sb_context(oldsb, newsb);
 879
 880         mutex_lock(&newsbsec->lock);
 881
 882         newsbsec->flags = oldsbsec->flags;
 883
 884         newsbsec->sid = oldsbsec->sid;
 885         newsbsec->def_sid = oldsbsec->def_sid;
 886         newsbsec->behavior = oldsbsec->behavior;
 887
 888         if (set_context) {
 889                 u32 sid = oldsbsec->mntpoint_sid;
 890
 891                 if (!set_fscontext)
 892                         newsbsec->sid = sid;
 893                 if (!set_rootcontext) {
 894                         struct inode *newinode = newsb->s_root->d_inode;
 895                         struct inode_security_struct *newisec = newinode->i_security;
 896                         newisec->sid = sid;
 897                 }
 898                 newsbsec->mntpoint_sid = sid;
 899         }
 900         if (set_rootcontext) {
 901                 const struct inode *oldinode = oldsb->s_root->d_inode;
 902                 const struct inode_security_struct *oldisec = oldinode->i_security;
 903                 struct inode *newinode = newsb->s_root->d_inode;
 904                 struct inode_security_struct *newisec = newinode->i_security;
 905
 906                 newisec->sid = oldisec->sid;
 907         }
 908
 909         sb_finish_set_opts(newsb);
 910         mutex_unlock(&newsbsec->lock);
 911         return 0;
 912 }
 913
 914 static int selinux_parse_opts_str(char *options,
 915                                   struct security_mnt_opts *opts)
 916 {
 917         char *p;
 918         char *context = NULL, *defcontext = NULL;
 919         char *fscontext = NULL, *rootcontext = NULL;
 920         int rc, num_mnt_opts = 0;
 921
 922         opts->num_mnt_opts = 0;
 923
 924         /* Standard string-based options. */
 925         while ((p = strsep(&options, "|")) != NULL) {
 926                 int token;
 927                 substring_t args[MAX_OPT_ARGS];
 928
 929                 if (!*p)
 930                         continue;
 931
 932                 token = match_token(p, tokens, args);
 933
 934                 switch (token) {
 935                 case Opt_context:
 936                         if (context || defcontext) {
 937                                 rc = -EINVAL;
 938                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 939                                 goto out_err;
 940                         }
 941                         context = match_strdup(&args[0]);
 942                         if (!context) {
 943                                 rc = -ENOMEM;
 944                                 goto out_err;
 945                         }
 946                         break;
 947
 948                 case Opt_fscontext:
 949                         if (fscontext) {
 950                                 rc = -EINVAL;
 951                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 952                                 goto out_err;
 953                         }
 954                         fscontext = match_strdup(&args[0]);
 955                         if (!fscontext) {
 956                                 rc = -ENOMEM;
 957                                 goto out_err;
 958                         }
 959                         break;
 960
 961                 case Opt_rootcontext:
 962                         if (rootcontext) {
 963                                 rc = -EINVAL;
 964                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 965                                 goto out_err;
 966                         }
 967                         rootcontext = match_strdup(&args[0]);
 968                         if (!rootcontext) {
 969                                 rc = -ENOMEM;
 970                                 goto out_err;
 971                         }
 972                         break;
 973
 974                 case Opt_defcontext:
 975                         if (context || defcontext) {
 976                                 rc = -EINVAL;
 977                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 978                                 goto out_err;
 979                         }
 980                         defcontext = match_strdup(&args[0]);
 981                         if (!defcontext) {
 982                                 rc = -ENOMEM;
 983                                 goto out_err;
 984                         }
 985                         break;
 986                 case Opt_labelsupport:
 987                         break;
 988                 default:
 989                         rc = -EINVAL;
 990                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 991                         goto out_err;
 992
 993                 }
 994         }
 995
 996         rc = -ENOMEM;
 997         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 998         if (!opts->mnt_opts)
 999                 goto out_err;
1000
1001         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002         if (!opts->mnt_opts_flags) {
1003                 kfree(opts->mnt_opts);
1004                 goto out_err;
1005         }
1006
1007         if (fscontext) {
1008                 opts->mnt_opts[num_mnt_opts] = fscontext;
1009                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010         }
1011         if (context) {
1012                 opts->mnt_opts[num_mnt_opts] = context;
1013                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014         }
1015         if (rootcontext) {
1016                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018         }
1019         if (defcontext) {
1020                 opts->mnt_opts[num_mnt_opts] = defcontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022         }
1023
1024         opts->num_mnt_opts = num_mnt_opts;
1025         return 0;
1026
1027 out_err:
1028         kfree(context);
1029         kfree(defcontext);
1030         kfree(fscontext);
1031         kfree(rootcontext);
1032         return rc;
1033 }
1034 /*
1035  * string mount options parsing and call set the sbsec
1036  */
1037 static int superblock_doinit(struct super_block *sb, void *data)
1038 {
1039         int rc = 0;
1040         char *options = data;
1041         struct security_mnt_opts opts;
1042
1043         security_init_mnt_opts(&opts);
1044
1045         if (!data)
1046                 goto out;
1047
1048         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050         rc = selinux_parse_opts_str(options, &opts);
1051         if (rc)
1052                 goto out_err;
1053
1054 out:
1055         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057 out_err:
1058         security_free_mnt_opts(&opts);
1059         return rc;
1060 }
1061
1062 static void selinux_write_opts(struct seq_file *m,
1063                                struct security_mnt_opts *opts)
1064 {
1065         int i;
1066         char *prefix;
1067
1068         for (i = 0; i < opts->num_mnt_opts; i++) {
1069                 char *has_comma;
1070
1071                 if (opts->mnt_opts[i])
1072                         has_comma = strchr(opts->mnt_opts[i], ',');
1073                 else
1074                         has_comma = NULL;
1075
1076                 switch (opts->mnt_opts_flags[i]) {
1077                 case CONTEXT_MNT:
1078                         prefix = CONTEXT_STR;
1079                         break;
1080                 case FSCONTEXT_MNT:
1081                         prefix = FSCONTEXT_STR;
1082                         break;
1083                 case ROOTCONTEXT_MNT:
1084                         prefix = ROOTCONTEXT_STR;
1085                         break;
1086                 case DEFCONTEXT_MNT:
1087                         prefix = DEFCONTEXT_STR;
1088                         break;
1089                 case SBLABEL_MNT:
1090                         seq_putc(m, ',');
1091                         seq_puts(m, LABELSUPP_STR);
1092                         continue;
1093                 default:
1094                         BUG();
1095                         return;
1096                 };
1097                 /* we need a comma before each option */
1098                 seq_putc(m, ',');
1099                 seq_puts(m, prefix);
1100                 if (has_comma)
1101                         seq_putc(m, '\"');
1102                 seq_puts(m, opts->mnt_opts[i]);
1103                 if (has_comma)
1104                         seq_putc(m, '\"');
1105         }
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110         struct security_mnt_opts opts;
1111         int rc;
1112
1113         rc = selinux_get_mnt_opts(sb, &opts);
1114         if (rc) {
1115                 /* before policy load we may get EINVAL, don't show anything */
1116                 if (rc == -EINVAL)
1117                         rc = 0;
1118                 return rc;
1119         }
1120
1121         selinux_write_opts(m, &opts);
1122
1123         security_free_mnt_opts(&opts);
1124
1125         return rc;
1126 }
1127
1128 static inline u16 inode_mode_to_security_class(umode_t mode)
1129 {
1130         switch (mode & S_IFMT) {
1131         case S_IFSOCK:
1132                 return SECCLASS_SOCK_FILE;
1133         case S_IFLNK:
1134                 return SECCLASS_LNK_FILE;
1135         case S_IFREG:
1136                 return SECCLASS_FILE;
1137         case S_IFBLK:
1138                 return SECCLASS_BLK_FILE;
1139         case S_IFDIR:
1140                 return SECCLASS_DIR;
1141         case S_IFCHR:
1142                 return SECCLASS_CHR_FILE;
1143         case S_IFIFO:
1144                 return SECCLASS_FIFO_FILE;
1145
1146         }
1147
1148         return SECCLASS_FILE;
1149 }
1150
1151 static inline int default_protocol_stream(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154 }
1155
1156 static inline int default_protocol_dgram(int protocol)
1157 {
1158         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159 }
1160
1161 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162 {
1163         switch (family) {
1164         case PF_UNIX:
1165                 switch (type) {
1166                 case SOCK_STREAM:
1167                 case SOCK_SEQPACKET:
1168                         return SECCLASS_UNIX_STREAM_SOCKET;
1169                 case SOCK_DGRAM:
1170                         return SECCLASS_UNIX_DGRAM_SOCKET;
1171                 }
1172                 break;
1173         case PF_INET:
1174         case PF_INET6:
1175                 switch (type) {
1176                 case SOCK_STREAM:
1177                         if (default_protocol_stream(protocol))
1178                                 return SECCLASS_TCP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DGRAM:
1182                         if (default_protocol_dgram(protocol))
1183                                 return SECCLASS_UDP_SOCKET;
1184                         else
1185                                 return SECCLASS_RAWIP_SOCKET;
1186                 case SOCK_DCCP:
1187                         return SECCLASS_DCCP_SOCKET;
1188                 default:
1189                         return SECCLASS_RAWIP_SOCKET;
1190                 }
1191                 break;
1192         case PF_NETLINK:
1193                 switch (protocol) {
1194                 case NETLINK_ROUTE:
1195                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1196                 case NETLINK_FIREWALL:
1197                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198                 case NETLINK_SOCK_DIAG:
1199                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200                 case NETLINK_NFLOG:
1201                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1202                 case NETLINK_XFRM:
1203                         return SECCLASS_NETLINK_XFRM_SOCKET;
1204                 case NETLINK_SELINUX:
1205                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1206                 case NETLINK_AUDIT:
1207                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1208                 case NETLINK_IP6_FW:
1209                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1210                 case NETLINK_DNRTMSG:
1211                         return SECCLASS_NETLINK_DNRT_SOCKET;
1212                 case NETLINK_KOBJECT_UEVENT:
1213                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214                 default:
1215                         return SECCLASS_NETLINK_SOCKET;
1216                 }
1217         case PF_PACKET:
1218                 return SECCLASS_PACKET_SOCKET;
1219         case PF_KEY:
1220                 return SECCLASS_KEY_SOCKET;
1221         case PF_APPLETALK:
1222                 return SECCLASS_APPLETALK_SOCKET;
1223         }
1224
1225         return SECCLASS_SOCKET;
1226 }
1227
1228 #ifdef CONFIG_PROC_FS
1229 static int selinux_proc_get_sid(struct dentry *dentry,
1230                                 u16 tclass,
1231                                 u32 *sid)
1232 {
1233         int rc;
1234         char *buffer, *path;
1235
1236         buffer = (char *)__get_free_page(GFP_KERNEL);
1237         if (!buffer)
1238                 return -ENOMEM;
1239
1240         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241         if (IS_ERR(path))
1242                 rc = PTR_ERR(path);
1243         else {
1244                 /* each process gets a /proc/PID/ entry. Strip off the
1245                  * PID part to get a valid selinux labeling.
1246                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247                 while (path[1] >= '0' && path[1] <= '9') {
1248                         path[1] = '/';
1249                         path++;
1250                 }
1251                 rc = security_genfs_sid("proc", path, tclass, sid);
1252         }
1253         free_page((unsigned long)buffer);
1254         return rc;
1255 }
1256 #else
1257 static int selinux_proc_get_sid(struct dentry *dentry,
1258                                 u16 tclass,
1259                                 u32 *sid)
1260 {
1261         return -EINVAL;
1262 }
1263 #endif
1264
1265 /* The inode's security attributes must be initialized before first use. */
1266 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267 {
1268         struct superblock_security_struct *sbsec = NULL;
1269         struct inode_security_struct *isec = inode->i_security;
1270         u32 sid;
1271         struct dentry *dentry;
1272 #define INITCONTEXTLEN 255
1273         char *context = NULL;
1274         unsigned len = 0;
1275         int rc = 0;
1276
1277         if (isec->initialized)
1278                 goto out;
1279
1280         mutex_lock(&isec->lock);
1281         if (isec->initialized)
1282                 goto out_unlock;
1283
1284         sbsec = inode->i_sb->s_security;
1285         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286                 /* Defer initialization until selinux_complete_init,
1287                    after the initial policy is loaded and the security
1288                    server is ready to handle calls. */
1289                 spin_lock(&sbsec->isec_lock);
1290                 if (list_empty(&isec->list))
1291                         list_add(&isec->list, &sbsec->isec_head);
1292                 spin_unlock(&sbsec->isec_lock);
1293                 goto out_unlock;
1294         }
1295
1296         switch (sbsec->behavior) {
1297         case SECURITY_FS_USE_NATIVE:
1298                 break;
1299         case SECURITY_FS_USE_XATTR:
1300                 if (!inode->i_op->getxattr) {
1301                         isec->sid = sbsec->def_sid;
1302                         break;
1303                 }
1304
1305                 /* Need a dentry, since the xattr API requires one.
1306                    Life would be simpler if we could just pass the inode. */
1307                 if (opt_dentry) {
1308                         /* Called from d_instantiate or d_splice_alias. */
1309                         dentry = dget(opt_dentry);
1310                 } else {
1311                         /* Called from selinux_complete_init, try to find a dentry. */
1312                         dentry = d_find_alias(inode);
1313                 }
1314                 if (!dentry) {
1315                         /*
1316                          * this is can be hit on boot when a file is accessed
1317                          * before the policy is loaded.  When we load policy we
1318                          * may find inodes that have no dentry on the
1319                          * sbsec->isec_head list.  No reason to complain as these
1320                          * will get fixed up the next time we go through
1321                          * inode_doinit with a dentry, before these inodes could
1322                          * be used again by userspace.
1323                          */
1324                         goto out_unlock;
1325                 }
1326
1327                 len = INITCONTEXTLEN;
1328                 context = kmalloc(len+1, GFP_NOFS);
1329                 if (!context) {
1330                         rc = -ENOMEM;
1331                         dput(dentry);
1332                         goto out_unlock;
1333                 }
1334                 context[len] = '\0';
1335                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336                                            context, len);
1337                 if (rc == -ERANGE) {
1338                         kfree(context);
1339
1340                         /* Need a larger buffer.  Query for the right size. */
1341                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342                                                    NULL, 0);
1343                         if (rc < 0) {
1344                                 dput(dentry);
1345                                 goto out_unlock;
1346                         }
1347                         len = rc;
1348                         context = kmalloc(len+1, GFP_NOFS);
1349                         if (!context) {
1350                                 rc = -ENOMEM;
1351                                 dput(dentry);
1352                                 goto out_unlock;
1353                         }
1354                         context[len] = '\0';
1355                         rc = inode->i_op->getxattr(dentry,
1356                                                    XATTR_NAME_SELINUX,
1357                                                    context, len);
1358                 }
1359                 dput(dentry);
1360                 if (rc < 0) {
1361                         if (rc != -ENODATA) {
1362                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1363                                        "%d for dev=%s ino=%ld\n", __func__,
1364                                        -rc, inode->i_sb->s_id, inode->i_ino);
1365                                 kfree(context);
1366                                 goto out_unlock;
1367                         }
1368                         /* Map ENODATA to the default file SID */
1369                         sid = sbsec->def_sid;
1370                         rc = 0;
1371                 } else {
1372                         rc = security_context_to_sid_default(context, rc, &sid,
1373                                                              sbsec->def_sid,
1374                                                              GFP_NOFS);
1375                         if (rc) {
1376                                 char *dev = inode->i_sb->s_id;
1377                                 unsigned long ino = inode->i_ino;
1378
1379                                 if (rc == -EINVAL) {
1380                                         if (printk_ratelimit())
1381                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1383                                                         "filesystem in question.\n", ino, dev, context);
1384                                 } else {
1385                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1386                                                "returned %d for dev=%s ino=%ld\n",
1387                                                __func__, context, -rc, dev, ino);
1388                                 }
1389                                 kfree(context);
1390                                 /* Leave with the unlabeled SID */
1391                                 rc = 0;
1392                                 break;
1393                         }
1394                 }
1395                 kfree(context);
1396                 isec->sid = sid;
1397                 break;
1398         case SECURITY_FS_USE_TASK:
1399                 isec->sid = isec->task_sid;
1400                 break;
1401         case SECURITY_FS_USE_TRANS:
1402                 /* Default to the fs SID. */
1403                 isec->sid = sbsec->sid;
1404
1405                 /* Try to obtain a transition SID. */
1406                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408                                              isec->sclass, NULL, &sid);
1409                 if (rc)
1410                         goto out_unlock;
1411                 isec->sid = sid;
1412                 break;
1413         case SECURITY_FS_USE_MNTPOINT:
1414                 isec->sid = sbsec->mntpoint_sid;
1415                 break;
1416         default:
1417                 /* Default to the fs superblock SID. */
1418                 isec->sid = sbsec->sid;
1419
1420                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421                         /* We must have a dentry to determine the label on
1422                          * procfs inodes */
1423                         if (opt_dentry)
1424                                 /* Called from d_instantiate or
1425                                  * d_splice_alias. */
1426                                 dentry = dget(opt_dentry);
1427                         else
1428                                 /* Called from selinux_complete_init, try to
1429                                  * find a dentry. */
1430                                 dentry = d_find_alias(inode);
1431                         /*
1432                          * This can be hit on boot when a file is accessed
1433                          * before the policy is loaded.  When we load policy we
1434                          * may find inodes that have no dentry on the
1435                          * sbsec->isec_head list.  No reason to complain as
1436                          * these will get fixed up the next time we go through
1437                          * inode_doinit() with a dentry, before these inodes
1438                          * could be used again by userspace.
1439                          */
1440                         if (!dentry)
1441                                 goto out_unlock;
1442                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1443                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1444                         dput(dentry);
1445                         if (rc)
1446                                 goto out_unlock;
1447                         isec->sid = sid;
1448                 }
1449                 break;
1450         }
1451
1452         isec->initialized = 1;
1453
1454 out_unlock:
1455         mutex_unlock(&isec->lock);
1456 out:
1457         if (isec->sclass == SECCLASS_FILE)
1458                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1459         return rc;
1460 }
1461
1462 /* Convert a Linux signal to an access vector. */
1463 static inline u32 signal_to_av(int sig)
1464 {
1465         u32 perm = 0;
1466
1467         switch (sig) {
1468         case SIGCHLD:
1469                 /* Commonly granted from child to parent. */
1470                 perm = PROCESS__SIGCHLD;
1471                 break;
1472         case SIGKILL:
1473                 /* Cannot be caught or ignored */
1474                 perm = PROCESS__SIGKILL;
1475                 break;
1476         case SIGSTOP:
1477                 /* Cannot be caught or ignored */
1478                 perm = PROCESS__SIGSTOP;
1479                 break;
1480         default:
1481                 /* All other signals. */
1482                 perm = PROCESS__SIGNAL;
1483                 break;
1484         }
1485
1486         return perm;
1487 }
1488
1489 /*
1490  * Check permission between a pair of credentials
1491  * fork check, ptrace check, etc.
1492  */
1493 static int cred_has_perm(const struct cred *actor,
1494                          const struct cred *target,
1495                          u32 perms)
1496 {
1497         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1498
1499         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1500 }
1501
1502 /*
1503  * Check permission between a pair of tasks, e.g. signal checks,
1504  * fork check, ptrace check, etc.
1505  * tsk1 is the actor and tsk2 is the target
1506  * - this uses the default subjective creds of tsk1
1507  */
1508 static int task_has_perm(const struct task_struct *tsk1,
1509                          const struct task_struct *tsk2,
1510                          u32 perms)
1511 {
1512         const struct task_security_struct *__tsec1, *__tsec2;
1513         u32 sid1, sid2;
1514
1515         rcu_read_lock();
1516         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1517         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1518         rcu_read_unlock();
1519         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523  * Check permission between current and another task, e.g. signal checks,
1524  * fork check, ptrace check, etc.
1525  * current is the actor and tsk2 is the target
1526  * - this uses current's subjective creds
1527  */
1528 static int current_has_perm(const struct task_struct *tsk,
1529                             u32 perms)
1530 {
1531         u32 sid, tsid;
1532
1533         sid = current_sid();
1534         tsid = task_sid(tsk);
1535         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1536 }
1537
1538 #if CAP_LAST_CAP > 63
1539 #error Fix SELinux to handle capabilities > 63.
1540 #endif
1541
1542 /* Check whether a task is allowed to use a capability. */
1543 static int cred_has_capability(const struct cred *cred,
1544                                int cap, int audit)
1545 {
1546         struct common_audit_data ad;
1547         struct av_decision avd;
1548         u16 sclass;
1549         u32 sid = cred_sid(cred);
1550         u32 av = CAP_TO_MASK(cap);
1551         int rc;
1552
1553         ad.type = LSM_AUDIT_DATA_CAP;
1554         ad.u.cap = cap;
1555
1556         switch (CAP_TO_INDEX(cap)) {
1557         case 0:
1558                 sclass = SECCLASS_CAPABILITY;
1559                 break;
1560         case 1:
1561                 sclass = SECCLASS_CAPABILITY2;
1562                 break;
1563         default:
1564                 printk(KERN_ERR
1565                        "SELinux:  out of range capability %d\n", cap);
1566                 BUG();
1567                 return -EINVAL;
1568         }
1569
1570         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1571         if (audit == SECURITY_CAP_AUDIT) {
1572                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1573                 if (rc2)
1574                         return rc2;
1575         }
1576         return rc;
1577 }
1578
1579 /* Check whether a task is allowed to use a system operation. */
1580 static int task_has_system(struct task_struct *tsk,
1581                            u32 perms)
1582 {
1583         u32 sid = task_sid(tsk);
1584
1585         return avc_has_perm(sid, SECINITSID_KERNEL,
1586                             SECCLASS_SYSTEM, perms, NULL);
1587 }
1588
1589 /* Check whether a task has a particular permission to an inode.
1590    The 'adp' parameter is optional and allows other audit
1591    data to be passed (e.g. the dentry). */
1592 static int inode_has_perm(const struct cred *cred,
1593                           struct inode *inode,
1594                           u32 perms,
1595                           struct common_audit_data *adp)
1596 {
1597         struct inode_security_struct *isec;
1598         u32 sid;
1599
1600         validate_creds(cred);
1601
1602         if (unlikely(IS_PRIVATE(inode)))
1603                 return 0;
1604
1605         sid = cred_sid(cred);
1606         isec = inode->i_security;
1607
1608         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1609 }
1610
1611 /* Same as inode_has_perm, but pass explicit audit data containing
1612    the dentry to help the auditing code to more easily generate the
1613    pathname if needed. */
1614 static inline int dentry_has_perm(const struct cred *cred,
1615                                   struct dentry *dentry,
1616                                   u32 av)
1617 {
1618         struct inode *inode = dentry->d_inode;
1619         struct common_audit_data ad;
1620
1621         ad.type = LSM_AUDIT_DATA_DENTRY;
1622         ad.u.dentry = dentry;
1623         return inode_has_perm(cred, inode, av, &ad);
1624 }
1625
1626 /* Same as inode_has_perm, but pass explicit audit data containing
1627    the path to help the auditing code to more easily generate the
1628    pathname if needed. */
1629 static inline int path_has_perm(const struct cred *cred,
1630                                 struct path *path,
1631                                 u32 av)
1632 {
1633         struct inode *inode = path->dentry->d_inode;
1634         struct common_audit_data ad;
1635
1636         ad.type = LSM_AUDIT_DATA_PATH;
1637         ad.u.path = *path;
1638         return inode_has_perm(cred, inode, av, &ad);
1639 }
1640
1641 /* Same as path_has_perm, but uses the inode from the file struct. */
1642 static inline int file_path_has_perm(const struct cred *cred,
1643                                      struct file *file,
1644                                      u32 av)
1645 {
1646         struct common_audit_data ad;
1647
1648         ad.type = LSM_AUDIT_DATA_PATH;
1649         ad.u.path = file->f_path;
1650         return inode_has_perm(cred, file_inode(file), av, &ad);
1651 }
1652
1653 /* Check whether a task can use an open file descriptor to
1654    access an inode in a given way.  Check access to the
1655    descriptor itself, and then use dentry_has_perm to
1656    check a particular permission to the file.
1657    Access to the descriptor is implicitly granted if it
1658    has the same SID as the process.  If av is zero, then
1659    access to the file is not checked, e.g. for cases
1660    where only the descriptor is affected like seek. */
1661 static int file_has_perm(const struct cred *cred,
1662                          struct file *file,
1663                          u32 av)
1664 {
1665         struct file_security_struct *fsec = file->f_security;
1666         struct inode *inode = file_inode(file);
1667         struct common_audit_data ad;
1668         u32 sid = cred_sid(cred);
1669         int rc;
1670
1671         ad.type = LSM_AUDIT_DATA_PATH;
1672         ad.u.path = file->f_path;
1673
1674         if (sid != fsec->sid) {
1675                 rc = avc_has_perm(sid, fsec->sid,
1676                                   SECCLASS_FD,
1677                                   FD__USE,
1678                                   &ad);
1679                 if (rc)
1680                         goto out;
1681         }
1682
1683         /* av is zero if only checking access to the descriptor. */
1684         rc = 0;
1685         if (av)
1686                 rc = inode_has_perm(cred, inode, av, &ad);
1687
1688 out:
1689         return rc;
1690 }
1691
1692 /* Check whether a task can create a file. */
1693 static int may_create(struct inode *dir,
1694                       struct dentry *dentry,
1695                       u16 tclass)
1696 {
1697         const struct task_security_struct *tsec = current_security();
1698         struct inode_security_struct *dsec;
1699         struct superblock_security_struct *sbsec;
1700         u32 sid, newsid;
1701         struct common_audit_data ad;
1702         int rc;
1703
1704         dsec = dir->i_security;
1705         sbsec = dir->i_sb->s_security;
1706
1707         sid = tsec->sid;
1708         newsid = tsec->create_sid;
1709
1710         ad.type = LSM_AUDIT_DATA_DENTRY;
1711         ad.u.dentry = dentry;
1712
1713         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1714                           DIR__ADD_NAME | DIR__SEARCH,
1715                           &ad);
1716         if (rc)
1717                 return rc;
1718
1719         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1720                 rc = security_transition_sid(sid, dsec->sid, tclass,
1721                                              &dentry->d_name, &newsid);
1722                 if (rc)
1723                         return rc;
1724         }
1725
1726         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1727         if (rc)
1728                 return rc;
1729
1730         return avc_has_perm(newsid, sbsec->sid,
1731                             SECCLASS_FILESYSTEM,
1732                             FILESYSTEM__ASSOCIATE, &ad);
1733 }
1734
1735 /* Check whether a task can create a key. */
1736 static int may_create_key(u32 ksid,
1737                           struct task_struct *ctx)
1738 {
1739         u32 sid = task_sid(ctx);
1740
1741         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1742 }
1743
1744 #define MAY_LINK        0
1745 #define MAY_UNLINK      1
1746 #define MAY_RMDIR       2
1747
1748 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1749 static int may_link(struct inode *dir,
1750                     struct dentry *dentry,
1751                     int kind)
1752
1753 {
1754         struct inode_security_struct *dsec, *isec;
1755         struct common_audit_data ad;
1756         u32 sid = current_sid();
1757         u32 av;
1758         int rc;
1759
1760         dsec = dir->i_security;
1761         isec = dentry->d_inode->i_security;
1762
1763         ad.type = LSM_AUDIT_DATA_DENTRY;
1764         ad.u.dentry = dentry;
1765
1766         av = DIR__SEARCH;
1767         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1768         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1769         if (rc)
1770                 return rc;
1771
1772         switch (kind) {
1773         case MAY_LINK:
1774                 av = FILE__LINK;
1775                 break;
1776         case MAY_UNLINK:
1777                 av = FILE__UNLINK;
1778                 break;
1779         case MAY_RMDIR:
1780                 av = DIR__RMDIR;
1781                 break;
1782         default:
1783                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1784                         __func__, kind);
1785                 return 0;
1786         }
1787
1788         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1789         return rc;
1790 }
1791
1792 static inline int may_rename(struct inode *old_dir,
1793                              struct dentry *old_dentry,
1794                              struct inode *new_dir,
1795                              struct dentry *new_dentry)
1796 {
1797         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1798         struct common_audit_data ad;
1799         u32 sid = current_sid();
1800         u32 av;
1801         int old_is_dir, new_is_dir;
1802         int rc;
1803
1804         old_dsec = old_dir->i_security;
1805         old_isec = old_dentry->d_inode->i_security;
1806         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1807         new_dsec = new_dir->i_security;
1808
1809         ad.type = LSM_AUDIT_DATA_DENTRY;
1810
1811         ad.u.dentry = old_dentry;
1812         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1813                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1814         if (rc)
1815                 return rc;
1816         rc = avc_has_perm(sid, old_isec->sid,
1817                           old_isec->sclass, FILE__RENAME, &ad);
1818         if (rc)
1819                 return rc;
1820         if (old_is_dir && new_dir != old_dir) {
1821                 rc = avc_has_perm(sid, old_isec->sid,
1822                                   old_isec->sclass, DIR__REPARENT, &ad);
1823                 if (rc)
1824                         return rc;
1825         }
1826
1827         ad.u.dentry = new_dentry;
1828         av = DIR__ADD_NAME | DIR__SEARCH;
1829         if (new_dentry->d_inode)
1830                 av |= DIR__REMOVE_NAME;
1831         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1832         if (rc)
1833                 return rc;
1834         if (new_dentry->d_inode) {
1835                 new_isec = new_dentry->d_inode->i_security;
1836                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1837                 rc = avc_has_perm(sid, new_isec->sid,
1838                                   new_isec->sclass,
1839                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1840                 if (rc)
1841                         return rc;
1842         }
1843
1844         return 0;
1845 }
1846
1847 /* Check whether a task can perform a filesystem operation. */
1848 static int superblock_has_perm(const struct cred *cred,
1849                                struct super_block *sb,
1850                                u32 perms,
1851                                struct common_audit_data *ad)
1852 {
1853         struct superblock_security_struct *sbsec;
1854         u32 sid = cred_sid(cred);
1855
1856         sbsec = sb->s_security;
1857         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1858 }
1859
1860 /* Convert a Linux mode and permission mask to an access vector. */
1861 static inline u32 file_mask_to_av(int mode, int mask)
1862 {
1863         u32 av = 0;
1864
1865         if (!S_ISDIR(mode)) {
1866                 if (mask & MAY_EXEC)
1867                         av |= FILE__EXECUTE;
1868                 if (mask & MAY_READ)
1869                         av |= FILE__READ;
1870
1871                 if (mask & MAY_APPEND)
1872                         av |= FILE__APPEND;
1873                 else if (mask & MAY_WRITE)
1874                         av |= FILE__WRITE;
1875
1876         } else {
1877                 if (mask & MAY_EXEC)
1878                         av |= DIR__SEARCH;
1879                 if (mask & MAY_WRITE)
1880                         av |= DIR__WRITE;
1881                 if (mask & MAY_READ)
1882                         av |= DIR__READ;
1883         }
1884
1885         return av;
1886 }
1887
1888 /* Convert a Linux file to an access vector. */
1889 static inline u32 file_to_av(struct file *file)
1890 {
1891         u32 av = 0;
1892
1893         if (file->f_mode & FMODE_READ)
1894                 av |= FILE__READ;
1895         if (file->f_mode & FMODE_WRITE) {
1896                 if (file->f_flags & O_APPEND)
1897                         av |= FILE__APPEND;
1898                 else
1899                         av |= FILE__WRITE;
1900         }
1901         if (!av) {
1902                 /*
1903                  * Special file opened with flags 3 for ioctl-only use.
1904                  */
1905                 av = FILE__IOCTL;
1906         }
1907
1908         return av;
1909 }
1910
1911 /*
1912  * Convert a file to an access vector and include the correct open
1913  * open permission.
1914  */
1915 static inline u32 open_file_to_av(struct file *file)
1916 {
1917         u32 av = file_to_av(file);
1918
1919         if (selinux_policycap_openperm)
1920                 av |= FILE__OPEN;
1921
1922         return av;
1923 }
1924
1925 /* Hook functions begin here. */
1926
1927 static int selinux_ptrace_access_check(struct task_struct *child,
1928                                      unsigned int mode)
1929 {
1930         int rc;
1931
1932         rc = cap_ptrace_access_check(child, mode);
1933         if (rc)
1934                 return rc;
1935
1936         if (mode & PTRACE_MODE_READ) {
1937                 u32 sid = current_sid();
1938                 u32 csid = task_sid(child);
1939                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1940         }
1941
1942         return current_has_perm(child, PROCESS__PTRACE);
1943 }
1944
1945 static int selinux_ptrace_traceme(struct task_struct *parent)
1946 {
1947         int rc;
1948
1949         rc = cap_ptrace_traceme(parent);
1950         if (rc)
1951                 return rc;
1952
1953         return task_has_perm(parent, current, PROCESS__PTRACE);
1954 }
1955
1956 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1957                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1958 {
1959         int error;
1960
1961         error = current_has_perm(target, PROCESS__GETCAP);
1962         if (error)
1963                 return error;
1964
1965         return cap_capget(target, effective, inheritable, permitted);
1966 }
1967
1968 static int selinux_capset(struct cred *new, const struct cred *old,
1969                           const kernel_cap_t *effective,
1970                           const kernel_cap_t *inheritable,
1971                           const kernel_cap_t *permitted)
1972 {
1973         int error;
1974
1975         error = cap_capset(new, old,
1976                                       effective, inheritable, permitted);
1977         if (error)
1978                 return error;
1979
1980         return cred_has_perm(old, new, PROCESS__SETCAP);
1981 }
1982
1983 /*
1984  * (This comment used to live with the selinux_task_setuid hook,
1985  * which was removed).
1986  *
1987  * Since setuid only affects the current process, and since the SELinux
1988  * controls are not based on the Linux identity attributes, SELinux does not
1989  * need to control this operation.  However, SELinux does control the use of
1990  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1991  */
1992
1993 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1994                            int cap, int audit)
1995 {
1996         int rc;
1997
1998         rc = cap_capable(cred, ns, cap, audit);
1999         if (rc)
2000                 return rc;
2001
2002         return cred_has_capability(cred, cap, audit);
2003 }
2004
2005 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2006 {
2007         const struct cred *cred = current_cred();
2008         int rc = 0;
2009
2010         if (!sb)
2011                 return 0;
2012
2013         switch (cmds) {
2014         case Q_SYNC:
2015         case Q_QUOTAON:
2016         case Q_QUOTAOFF:
2017         case Q_SETINFO:
2018         case Q_SETQUOTA:
2019                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2020                 break;
2021         case Q_GETFMT:
2022         case Q_GETINFO:
2023         case Q_GETQUOTA:
2024                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2025                 break;
2026         default:
2027                 rc = 0;  /* let the kernel handle invalid cmds */
2028                 break;
2029         }
2030         return rc;
2031 }
2032
2033 static int selinux_quota_on(struct dentry *dentry)
2034 {
2035         const struct cred *cred = current_cred();
2036
2037         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2038 }
2039
2040 static int selinux_syslog(int type)
2041 {
2042         int rc;
2043
2044         switch (type) {
2045         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2046         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2047                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2048                 break;
2049         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2050         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2051         /* Set level of messages printed to console */
2052         case SYSLOG_ACTION_CONSOLE_LEVEL:
2053                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2054                 break;
2055         case SYSLOG_ACTION_CLOSE:       /* Close log */
2056         case SYSLOG_ACTION_OPEN:        /* Open log */
2057         case SYSLOG_ACTION_READ:        /* Read from log */
2058         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2059         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2060         default:
2061                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2062                 break;
2063         }
2064         return rc;
2065 }
2066
2067 /*
2068  * Check that a process has enough memory to allocate a new virtual
2069  * mapping. 0 means there is enough memory for the allocation to
2070  * succeed and -ENOMEM implies there is not.
2071  *
2072  * Do not audit the selinux permission check, as this is applied to all
2073  * processes that allocate mappings.
2074  */
2075 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2076 {
2077         int rc, cap_sys_admin = 0;
2078
2079         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2080                              SECURITY_CAP_NOAUDIT);
2081         if (rc == 0)
2082                 cap_sys_admin = 1;
2083
2084         return __vm_enough_memory(mm, pages, cap_sys_admin);
2085 }
2086
2087 /* binprm security operations */
2088
2089 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2090 {
2091         const struct task_security_struct *old_tsec;
2092         struct task_security_struct *new_tsec;
2093         struct inode_security_struct *isec;
2094         struct common_audit_data ad;
2095         struct inode *inode = file_inode(bprm->file);
2096         int rc;
2097
2098         rc = cap_bprm_set_creds(bprm);
2099         if (rc)
2100                 return rc;
2101
2102         /* SELinux context only depends on initial program or script and not
2103          * the script interpreter */
2104         if (bprm->cred_prepared)
2105                 return 0;
2106
2107         old_tsec = current_security();
2108         new_tsec = bprm->cred->security;
2109         isec = inode->i_security;
2110
2111         /* Default to the current task SID. */
2112         new_tsec->sid = old_tsec->sid;
2113         new_tsec->osid = old_tsec->sid;
2114
2115         /* Reset fs, key, and sock SIDs on execve. */
2116         new_tsec->create_sid = 0;
2117         new_tsec->keycreate_sid = 0;
2118         new_tsec->sockcreate_sid = 0;
2119
2120         if (old_tsec->exec_sid) {
2121                 new_tsec->sid = old_tsec->exec_sid;
2122                 /* Reset exec SID on execve. */
2123                 new_tsec->exec_sid = 0;
2124
2125                 /*
2126                  * Minimize confusion: if no_new_privs and a transition is
2127                  * explicitly requested, then fail the exec.
2128                  */
2129                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2130                         return -EPERM;
2131         } else {
2132                 /* Check for a default transition on this program. */
2133                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2134                                              SECCLASS_PROCESS, NULL,
2135                                              &new_tsec->sid);
2136                 if (rc)
2137                         return rc;
2138         }
2139
2140         ad.type = LSM_AUDIT_DATA_PATH;
2141         ad.u.path = bprm->file->f_path;
2142
2143         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2144             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2145                 new_tsec->sid = old_tsec->sid;
2146
2147         if (new_tsec->sid == old_tsec->sid) {
2148                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2149                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2150                 if (rc)
2151                         return rc;
2152         } else {
2153                 /* Check permissions for the transition. */
2154                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2156                 if (rc)
2157                         return rc;
2158
2159                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2160                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2161                 if (rc)
2162                         return rc;
2163
2164                 /* Check for shared state */
2165                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2166                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2167                                           SECCLASS_PROCESS, PROCESS__SHARE,
2168                                           NULL);
2169                         if (rc)
2170                                 return -EPERM;
2171                 }
2172
2173                 /* Make sure that anyone attempting to ptrace over a task that
2174                  * changes its SID has the appropriate permit */
2175                 if (bprm->unsafe &
2176                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2177                         struct task_struct *tracer;
2178                         struct task_security_struct *sec;
2179                         u32 ptsid = 0;
2180
2181                         rcu_read_lock();
2182                         tracer = ptrace_parent(current);
2183                         if (likely(tracer != NULL)) {
2184                                 sec = __task_cred(tracer)->security;
2185                                 ptsid = sec->sid;
2186                         }
2187                         rcu_read_unlock();
2188
2189                         if (ptsid != 0) {
2190                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2191                                                   SECCLASS_PROCESS,
2192                                                   PROCESS__PTRACE, NULL);
2193                                 if (rc)
2194                                         return -EPERM;
2195                         }
2196                 }
2197
2198                 /* Clear any possibly unsafe personality bits on exec: */
2199                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2200         }
2201
2202         return 0;
2203 }
2204
2205 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2206 {
2207         const struct task_security_struct *tsec = current_security();
2208         u32 sid, osid;
2209         int atsecure = 0;
2210
2211         sid = tsec->sid;
2212         osid = tsec->osid;
2213
2214         if (osid != sid) {
2215                 /* Enable secure mode for SIDs transitions unless
2216                    the noatsecure permission is granted between
2217                    the two SIDs, i.e. ahp returns 0. */
2218                 atsecure = avc_has_perm(osid, sid,
2219                                         SECCLASS_PROCESS,
2220                                         PROCESS__NOATSECURE, NULL);
2221         }
2222
2223         return (atsecure || cap_bprm_secureexec(bprm));
2224 }
2225
2226 static int match_file(const void *p, struct file *file, unsigned fd)
2227 {
2228         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2229 }
2230
2231 /* Derived from fs/exec.c:flush_old_files. */
2232 static inline void flush_unauthorized_files(const struct cred *cred,
2233                                             struct files_struct *files)
2234 {
2235         struct file *file, *devnull = NULL;
2236         struct tty_struct *tty;
2237         int drop_tty = 0;
2238         unsigned n;
2239
2240         tty = get_current_tty();
2241         if (tty) {
2242                 spin_lock(&tty_files_lock);
2243                 if (!list_empty(&tty->tty_files)) {
2244                         struct tty_file_private *file_priv;
2245
2246                         /* Revalidate access to controlling tty.
2247                            Use file_path_has_perm on the tty path directly
2248                            rather than using file_has_perm, as this particular
2249                            open file may belong to another process and we are
2250                            only interested in the inode-based check here. */
2251                         file_priv = list_first_entry(&tty->tty_files,
2252                                                 struct tty_file_private, list);
2253                         file = file_priv->file;
2254                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2255                                 drop_tty = 1;
2256                 }
2257                 spin_unlock(&tty_files_lock);
2258                 tty_kref_put(tty);
2259         }
2260         /* Reset controlling tty. */
2261         if (drop_tty)
2262                 no_tty();
2263
2264         /* Revalidate access to inherited open files. */
2265         n = iterate_fd(files, 0, match_file, cred);
2266         if (!n) /* none found? */
2267                 return;
2268
2269         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2270         if (IS_ERR(devnull))
2271                 devnull = NULL;
2272         /* replace all the matching ones with this */
2273         do {
2274                 replace_fd(n - 1, devnull, 0);
2275         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2276         if (devnull)
2277                 fput(devnull);
2278 }
2279
2280 /*
2281  * Prepare a process for imminent new credential changes due to exec
2282  */
2283 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2284 {
2285         struct task_security_struct *new_tsec;
2286         struct rlimit *rlim, *initrlim;
2287         int rc, i;
2288
2289         new_tsec = bprm->cred->security;
2290         if (new_tsec->sid == new_tsec->osid)
2291                 return;
2292
2293         /* Close files for which the new task SID is not authorized. */
2294         flush_unauthorized_files(bprm->cred, current->files);
2295
2296         /* Always clear parent death signal on SID transitions. */
2297         current->pdeath_signal = 0;
2298
2299         /* Check whether the new SID can inherit resource limits from the old
2300          * SID.  If not, reset all soft limits to the lower of the current
2301          * task's hard limit and the init task's soft limit.
2302          *
2303          * Note that the setting of hard limits (even to lower them) can be
2304          * controlled by the setrlimit check.  The inclusion of the init task's
2305          * soft limit into the computation is to avoid resetting soft limits
2306          * higher than the default soft limit for cases where the default is
2307          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2308          */
2309         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2310                           PROCESS__RLIMITINH, NULL);
2311         if (rc) {
2312                 /* protect against do_prlimit() */
2313                 task_lock(current);
2314                 for (i = 0; i < RLIM_NLIMITS; i++) {
2315                         rlim = current->signal->rlim + i;
2316                         initrlim = init_task.signal->rlim + i;
2317                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2318                 }
2319                 task_unlock(current);
2320                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2321         }
2322 }
2323
2324 /*
2325  * Clean up the process immediately after the installation of new credentials
2326  * due to exec
2327  */
2328 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2329 {
2330         const struct task_security_struct *tsec = current_security();
2331         struct itimerval itimer;
2332         u32 osid, sid;
2333         int rc, i;
2334
2335         osid = tsec->osid;
2336         sid = tsec->sid;
2337
2338         if (sid == osid)
2339                 return;
2340
2341         /* Check whether the new SID can inherit signal state from the old SID.
2342          * If not, clear itimers to avoid subsequent signal generation and
2343          * flush and unblock signals.
2344          *
2345          * This must occur _after_ the task SID has been updated so that any
2346          * kill done after the flush will be checked against the new SID.
2347          */
2348         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2349         if (rc) {
2350                 memset(&itimer, 0, sizeof itimer);
2351                 for (i = 0; i < 3; i++)
2352                         do_setitimer(i, &itimer, NULL);
2353                 spin_lock_irq(&current->sighand->siglock);
2354                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2355                         __flush_signals(current);
2356                         flush_signal_handlers(current, 1);
2357                         sigemptyset(&current->blocked);
2358                 }
2359                 spin_unlock_irq(&current->sighand->siglock);
2360         }
2361
2362         /* Wake up the parent if it is waiting so that it can recheck
2363          * wait permission to the new task SID. */
2364         read_lock(&tasklist_lock);
2365         __wake_up_parent(current, current->real_parent);
2366         read_unlock(&tasklist_lock);
2367 }
2368
2369 /* superblock security operations */
2370
2371 static int selinux_sb_alloc_security(struct super_block *sb)
2372 {
2373         return superblock_alloc_security(sb);
2374 }
2375
2376 static void selinux_sb_free_security(struct super_block *sb)
2377 {
2378         superblock_free_security(sb);
2379 }
2380
2381 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2382 {
2383         if (plen > olen)
2384                 return 0;
2385
2386         return !memcmp(prefix, option, plen);
2387 }
2388
2389 static inline int selinux_option(char *option, int len)
2390 {
2391         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2392                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2393                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2394                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2395                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2396 }
2397
2398 static inline void take_option(char **to, char *from, int *first, int len)
2399 {
2400         if (!*first) {
2401                 **to = ',';
2402                 *to += 1;
2403         } else
2404                 *first = 0;
2405         memcpy(*to, from, len);
2406         *to += len;
2407 }
2408
2409 static inline void take_selinux_option(char **to, char *from, int *first,
2410                                        int len)
2411 {
2412         int current_size = 0;
2413
2414         if (!*first) {
2415                 **to = '|';
2416                 *to += 1;
2417         } else
2418                 *first = 0;
2419
2420         while (current_size < len) {
2421                 if (*from != '"') {
2422                         **to = *from;
2423                         *to += 1;
2424                 }
2425                 from += 1;
2426                 current_size += 1;
2427         }
2428 }
2429
2430 static int selinux_sb_copy_data(char *orig, char *copy)
2431 {
2432         int fnosec, fsec, rc = 0;
2433         char *in_save, *in_curr, *in_end;
2434         char *sec_curr, *nosec_save, *nosec;
2435         int open_quote = 0;
2436
2437         in_curr = orig;
2438         sec_curr = copy;
2439
2440         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2441         if (!nosec) {
2442                 rc = -ENOMEM;
2443                 goto out;
2444         }
2445
2446         nosec_save = nosec;
2447         fnosec = fsec = 1;
2448         in_save = in_end = orig;
2449
2450         do {
2451                 if (*in_end == '"')
2452                         open_quote = !open_quote;
2453                 if ((*in_end == ',' && open_quote == 0) ||
2454                                 *in_end == '\0') {
2455                         int len = in_end - in_curr;
2456
2457                         if (selinux_option(in_curr, len))
2458                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2459                         else
2460                                 take_option(&nosec, in_curr, &fnosec, len);
2461
2462                         in_curr = in_end + 1;
2463                 }
2464         } while (*in_end++);
2465
2466         strcpy(in_save, nosec_save);
2467         free_page((unsigned long)nosec_save);
2468 out:
2469         return rc;
2470 }
2471
2472 static int selinux_sb_remount(struct super_block *sb, void *data)
2473 {
2474         int rc, i, *flags;
2475         struct security_mnt_opts opts;
2476         char *secdata, **mount_options;
2477         struct superblock_security_struct *sbsec = sb->s_security;
2478
2479         if (!(sbsec->flags & SE_SBINITIALIZED))
2480                 return 0;
2481
2482         if (!data)
2483                 return 0;
2484
2485         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2486                 return 0;
2487
2488         security_init_mnt_opts(&opts);
2489         secdata = alloc_secdata();
2490         if (!secdata)
2491                 return -ENOMEM;
2492         rc = selinux_sb_copy_data(data, secdata);
2493         if (rc)
2494                 goto out_free_secdata;
2495
2496         rc = selinux_parse_opts_str(secdata, &opts);
2497         if (rc)
2498                 goto out_free_secdata;
2499
2500         mount_options = opts.mnt_opts;
2501         flags = opts.mnt_opts_flags;
2502
2503         for (i = 0; i < opts.num_mnt_opts; i++) {
2504                 u32 sid;
2505                 size_t len;
2506
2507                 if (flags[i] == SBLABEL_MNT)
2508                         continue;
2509                 len = strlen(mount_options[i]);
2510                 rc = security_context_to_sid(mount_options[i], len, &sid);
2511                 if (rc) {
2512                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2513                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2514                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2515                         goto out_free_opts;
2516                 }
2517                 rc = -EINVAL;
2518                 switch (flags[i]) {
2519                 case FSCONTEXT_MNT:
2520                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2521                                 goto out_bad_option;
2522                         break;
2523                 case CONTEXT_MNT:
2524                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2525                                 goto out_bad_option;
2526                         break;
2527                 case ROOTCONTEXT_MNT: {
2528                         struct inode_security_struct *root_isec;
2529                         root_isec = sb->s_root->d_inode->i_security;
2530
2531                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2532                                 goto out_bad_option;
2533                         break;
2534                 }
2535                 case DEFCONTEXT_MNT:
2536                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2537                                 goto out_bad_option;
2538                         break;
2539                 default:
2540                         goto out_free_opts;
2541                 }
2542         }
2543
2544         rc = 0;
2545 out_free_opts:
2546         security_free_mnt_opts(&opts);
2547 out_free_secdata:
2548         free_secdata(secdata);
2549         return rc;
2550 out_bad_option:
2551         printk(KERN_WARNING "SELinux: unable to change security options "
2552                "during remount (dev %s, type=%s)\n", sb->s_id,
2553                sb->s_type->name);
2554         goto out_free_opts;
2555 }
2556
2557 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2558 {
2559         const struct cred *cred = current_cred();
2560         struct common_audit_data ad;
2561         int rc;
2562
2563         rc = superblock_doinit(sb, data);
2564         if (rc)
2565                 return rc;
2566
2567         /* Allow all mounts performed by the kernel */
2568         if (flags & MS_KERNMOUNT)
2569                 return 0;
2570
2571         ad.type = LSM_AUDIT_DATA_DENTRY;
2572         ad.u.dentry = sb->s_root;
2573         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2574 }
2575
2576 static int selinux_sb_statfs(struct dentry *dentry)
2577 {
2578         const struct cred *cred = current_cred();
2579         struct common_audit_data ad;
2580
2581         ad.type = LSM_AUDIT_DATA_DENTRY;
2582         ad.u.dentry = dentry->d_sb->s_root;
2583         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2584 }
2585
2586 static int selinux_mount(const char *dev_name,
2587                          struct path *path,
2588                          const char *type,
2589                          unsigned long flags,
2590                          void *data)
2591 {
2592         const struct cred *cred = current_cred();
2593
2594         if (flags & MS_REMOUNT)
2595                 return superblock_has_perm(cred, path->dentry->d_sb,
2596                                            FILESYSTEM__REMOUNT, NULL);
2597         else
2598                 return path_has_perm(cred, path, FILE__MOUNTON);
2599 }
2600
2601 static int selinux_umount(struct vfsmount *mnt, int flags)
2602 {
2603         const struct cred *cred = current_cred();
2604
2605         return superblock_has_perm(cred, mnt->mnt_sb,
2606                                    FILESYSTEM__UNMOUNT, NULL);
2607 }
2608
2609 /* inode security operations */
2610
2611 static int selinux_inode_alloc_security(struct inode *inode)
2612 {
2613         return inode_alloc_security(inode);
2614 }
2615
2616 static void selinux_inode_free_security(struct inode *inode)
2617 {
2618         inode_free_security(inode);
2619 }
2620
2621 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2622                                         struct qstr *name, void **ctx,
2623                                         u32 *ctxlen)
2624 {
2625         const struct cred *cred = current_cred();
2626         struct task_security_struct *tsec;
2627         struct inode_security_struct *dsec;
2628         struct superblock_security_struct *sbsec;
2629         struct inode *dir = dentry->d_parent->d_inode;
2630         u32 newsid;
2631         int rc;
2632
2633         tsec = cred->security;
2634         dsec = dir->i_security;
2635         sbsec = dir->i_sb->s_security;
2636
2637         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2638                 newsid = tsec->create_sid;
2639         } else {
2640                 rc = security_transition_sid(tsec->sid, dsec->sid,
2641                                              inode_mode_to_security_class(mode),
2642                                              name,
2643                                              &newsid);
2644                 if (rc) {
2645                         printk(KERN_WARNING
2646                                 "%s: security_transition_sid failed, rc=%d\n",
2647                                __func__, -rc);
2648                         return rc;
2649                 }
2650         }
2651
2652         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2653 }
2654
2655 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2656                                        const struct qstr *qstr,
2657                                        const char **name,
2658                                        void **value, size_t *len)
2659 {
2660         const struct task_security_struct *tsec = current_security();
2661         struct inode_security_struct *dsec;
2662         struct superblock_security_struct *sbsec;
2663         u32 sid, newsid, clen;
2664         int rc;
2665         char *context;
2666
2667         dsec = dir->i_security;
2668         sbsec = dir->i_sb->s_security;
2669
2670         sid = tsec->sid;
2671         newsid = tsec->create_sid;
2672
2673         if ((sbsec->flags & SE_SBINITIALIZED) &&
2674             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2675                 newsid = sbsec->mntpoint_sid;
2676         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2677                 rc = security_transition_sid(sid, dsec->sid,
2678                                              inode_mode_to_security_class(inode->i_mode),
2679                                              qstr, &newsid);
2680                 if (rc) {
2681                         printk(KERN_WARNING "%s:  "
2682                                "security_transition_sid failed, rc=%d (dev=%s "
2683                                "ino=%ld)\n",
2684                                __func__,
2685                                -rc, inode->i_sb->s_id, inode->i_ino);
2686                         return rc;
2687                 }
2688         }
2689
2690         /* Possibly defer initialization to selinux_complete_init. */
2691         if (sbsec->flags & SE_SBINITIALIZED) {
2692                 struct inode_security_struct *isec = inode->i_security;
2693                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2694                 isec->sid = newsid;
2695                 isec->initialized = 1;
2696         }
2697
2698         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2699                 return -EOPNOTSUPP;
2700
2701         if (name)
2702                 *name = XATTR_SELINUX_SUFFIX;
2703
2704         if (value && len) {
2705                 rc = security_sid_to_context_force(newsid, &context, &clen);
2706                 if (rc)
2707                         return rc;
2708                 *value = context;
2709                 *len = clen;
2710         }
2711
2712         return 0;
2713 }
2714
2715 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2716 {
2717         return may_create(dir, dentry, SECCLASS_FILE);
2718 }
2719
2720 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2721 {
2722         return may_link(dir, old_dentry, MAY_LINK);
2723 }
2724
2725 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2726 {
2727         return may_link(dir, dentry, MAY_UNLINK);
2728 }
2729
2730 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2731 {
2732         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2733 }
2734
2735 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2736 {
2737         return may_create(dir, dentry, SECCLASS_DIR);
2738 }
2739
2740 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2741 {
2742         return may_link(dir, dentry, MAY_RMDIR);
2743 }
2744
2745 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2746 {
2747         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2748 }
2749
2750 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2751                                 struct inode *new_inode, struct dentry *new_dentry)
2752 {
2753         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2754 }
2755
2756 static int selinux_inode_readlink(struct dentry *dentry)
2757 {
2758         const struct cred *cred = current_cred();
2759
2760         return dentry_has_perm(cred, dentry, FILE__READ);
2761 }
2762
2763 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2764 {
2765         const struct cred *cred = current_cred();
2766
2767         return dentry_has_perm(cred, dentry, FILE__READ);
2768 }
2769
2770 static noinline int audit_inode_permission(struct inode *inode,
2771                                            u32 perms, u32 audited, u32 denied,
2772                                            unsigned flags)
2773 {
2774         struct common_audit_data ad;
2775         struct inode_security_struct *isec = inode->i_security;
2776         int rc;
2777
2778         ad.type = LSM_AUDIT_DATA_INODE;
2779         ad.u.inode = inode;
2780
2781         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2782                             audited, denied, &ad, flags);
2783         if (rc)
2784                 return rc;
2785         return 0;
2786 }
2787
2788 static int selinux_inode_permission(struct inode *inode, int mask)
2789 {
2790         const struct cred *cred = current_cred();
2791         u32 perms;
2792         bool from_access;
2793         unsigned flags = mask & MAY_NOT_BLOCK;
2794         struct inode_security_struct *isec;
2795         u32 sid;
2796         struct av_decision avd;
2797         int rc, rc2;
2798         u32 audited, denied;
2799
2800         from_access = mask & MAY_ACCESS;
2801         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2802
2803         /* No permission to check.  Existence test. */
2804         if (!mask)
2805                 return 0;
2806
2807         validate_creds(cred);
2808
2809         if (unlikely(IS_PRIVATE(inode)))
2810                 return 0;
2811
2812         perms = file_mask_to_av(inode->i_mode, mask);
2813
2814         sid = cred_sid(cred);
2815         isec = inode->i_security;
2816
2817         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2818         audited = avc_audit_required(perms, &avd, rc,
2819                                      from_access ? FILE__AUDIT_ACCESS : 0,
2820                                      &denied);
2821         if (likely(!audited))
2822                 return rc;
2823
2824         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2825         if (rc2)
2826                 return rc2;
2827         return rc;
2828 }
2829
2830 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2831 {
2832         const struct cred *cred = current_cred();
2833         unsigned int ia_valid = iattr->ia_valid;
2834         __u32 av = FILE__WRITE;
2835
2836         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2837         if (ia_valid & ATTR_FORCE) {
2838                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2839                               ATTR_FORCE);
2840                 if (!ia_valid)
2841                         return 0;
2842         }
2843
2844         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2845                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2846                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2847
2848         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2849                 av |= FILE__OPEN;
2850
2851         return dentry_has_perm(cred, dentry, av);
2852 }
2853
2854 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2855 {
2856         const struct cred *cred = current_cred();
2857         struct path path;
2858
2859         path.dentry = dentry;
2860         path.mnt = mnt;
2861
2862         return path_has_perm(cred, &path, FILE__GETATTR);
2863 }
2864
2865 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2866 {
2867         const struct cred *cred = current_cred();
2868
2869         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2870                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2871                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2872                         if (!capable(CAP_SETFCAP))
2873                                 return -EPERM;
2874                 } else if (!capable(CAP_SYS_ADMIN)) {
2875                         /* A different attribute in the security namespace.
2876                            Restrict to administrator. */
2877                         return -EPERM;
2878                 }
2879         }
2880
2881         /* Not an attribute we recognize, so just check the
2882            ordinary setattr permission. */
2883         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2884 }
2885
2886 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2887                                   const void *value, size_t size, int flags)
2888 {
2889         struct inode *inode = dentry->d_inode;
2890         struct inode_security_struct *isec = inode->i_security;
2891         struct superblock_security_struct *sbsec;
2892         struct common_audit_data ad;
2893         u32 newsid, sid = current_sid();
2894         int rc = 0;
2895
2896         if (strcmp(name, XATTR_NAME_SELINUX))
2897                 return selinux_inode_setotherxattr(dentry, name);
2898
2899         sbsec = inode->i_sb->s_security;
2900         if (!(sbsec->flags & SBLABEL_MNT))
2901                 return -EOPNOTSUPP;
2902
2903         if (!inode_owner_or_capable(inode))
2904                 return -EPERM;
2905
2906         ad.type = LSM_AUDIT_DATA_DENTRY;
2907         ad.u.dentry = dentry;
2908
2909         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2910                           FILE__RELABELFROM, &ad);
2911         if (rc)
2912                 return rc;
2913
2914         rc = security_context_to_sid(value, size, &newsid);
2915         if (rc == -EINVAL) {
2916                 if (!capable(CAP_MAC_ADMIN)) {
2917                         struct audit_buffer *ab;
2918                         size_t audit_size;
2919                         const char *str;
2920
2921                         /* We strip a nul only if it is at the end, otherwise the
2922                          * context contains a nul and we should audit that */
2923                         if (value) {
2924                                 str = value;
2925                                 if (str[size - 1] == '\0')
2926                                         audit_size = size - 1;
2927                                 else
2928                                         audit_size = size;
2929                         } else {
2930                                 str = "";
2931                                 audit_size = 0;
2932                         }
2933                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2934                         audit_log_format(ab, "op=setxattr invalid_context=");
2935                         audit_log_n_untrustedstring(ab, value, audit_size);
2936                         audit_log_end(ab);
2937
2938                         return rc;
2939                 }
2940                 rc = security_context_to_sid_force(value, size, &newsid);
2941         }
2942         if (rc)
2943                 return rc;
2944
2945         rc = avc_has_perm(sid, newsid, isec->sclass,
2946                           FILE__RELABELTO, &ad);
2947         if (rc)
2948                 return rc;
2949
2950         rc = security_validate_transition(isec->sid, newsid, sid,
2951                                           isec->sclass);
2952         if (rc)
2953                 return rc;
2954
2955         return avc_has_perm(newsid,
2956                             sbsec->sid,
2957                             SECCLASS_FILESYSTEM,
2958                             FILESYSTEM__ASSOCIATE,
2959                             &ad);
2960 }
2961
2962 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2963                                         const void *value, size_t size,
2964                                         int flags)
2965 {
2966         struct inode *inode = dentry->d_inode;
2967         struct inode_security_struct *isec = inode->i_security;
2968         u32 newsid;
2969         int rc;
2970
2971         if (strcmp(name, XATTR_NAME_SELINUX)) {
2972                 /* Not an attribute we recognize, so nothing to do. */
2973                 return;
2974         }
2975
2976         rc = security_context_to_sid_force(value, size, &newsid);
2977         if (rc) {
2978                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2979                        "for (%s, %lu), rc=%d\n",
2980                        inode->i_sb->s_id, inode->i_ino, -rc);
2981                 return;
2982         }
2983
2984         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2985         isec->sid = newsid;
2986         isec->initialized = 1;
2987
2988         return;
2989 }
2990
2991 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2992 {
2993         const struct cred *cred = current_cred();
2994
2995         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2996 }
2997
2998 static int selinux_inode_listxattr(struct dentry *dentry)
2999 {
3000         const struct cred *cred = current_cred();
3001
3002         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3003 }
3004
3005 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3006 {
3007         if (strcmp(name, XATTR_NAME_SELINUX))
3008                 return selinux_inode_setotherxattr(dentry, name);
3009
3010         /* No one is allowed to remove a SELinux security label.
3011            You can change the label, but all data must be labeled. */
3012         return -EACCES;
3013 }
3014
3015 /*
3016  * Copy the inode security context value to the user.
3017  *
3018  * Permission check is handled by selinux_inode_getxattr hook.
3019  */
3020 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3021 {
3022         u32 size;
3023         int error;
3024         char *context = NULL;
3025         struct inode_security_struct *isec = inode->i_security;
3026
3027         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3028                 return -EOPNOTSUPP;
3029
3030         /*
3031          * If the caller has CAP_MAC_ADMIN, then get the raw context
3032          * value even if it is not defined by current policy; otherwise,
3033          * use the in-core value under current policy.
3034          * Use the non-auditing forms of the permission checks since
3035          * getxattr may be called by unprivileged processes commonly
3036          * and lack of permission just means that we fall back to the
3037          * in-core context value, not a denial.
3038          */
3039         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3040                                 SECURITY_CAP_NOAUDIT);
3041         if (!error)
3042                 error = security_sid_to_context_force(isec->sid, &context,
3043                                                       &size);
3044         else
3045                 error = security_sid_to_context(isec->sid, &context, &size);
3046         if (error)
3047                 return error;
3048         error = size;
3049         if (alloc) {
3050                 *buffer = context;
3051                 goto out_nofree;
3052         }
3053         kfree(context);
3054 out_nofree:
3055         return error;
3056 }
3057
3058 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3059                                      const void *value, size_t size, int flags)
3060 {
3061         struct inode_security_struct *isec = inode->i_security;
3062         u32 newsid;
3063         int rc;
3064
3065         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3066                 return -EOPNOTSUPP;
3067
3068         if (!value || !size)
3069                 return -EACCES;
3070
3071         rc = security_context_to_sid((void *)value, size, &newsid);
3072         if (rc)
3073                 return rc;
3074
3075         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3076         isec->sid = newsid;
3077         isec->initialized = 1;
3078         return 0;
3079 }
3080
3081 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3082 {
3083         const int len = sizeof(XATTR_NAME_SELINUX);
3084         if (buffer && len <= buffer_size)
3085                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3086         return len;
3087 }
3088
3089 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3090 {
3091         struct inode_security_struct *isec = inode->i_security;
3092         *secid = isec->sid;
3093 }
3094
3095 /* file security operations */
3096
3097 static int selinux_revalidate_file_permission(struct file *file, int mask)
3098 {
3099         const struct cred *cred = current_cred();
3100         struct inode *inode = file_inode(file);
3101
3102         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3103         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3104                 mask |= MAY_APPEND;
3105
3106         return file_has_perm(cred, file,
3107                              file_mask_to_av(inode->i_mode, mask));
3108 }
3109
3110 static int selinux_file_permission(struct file *file, int mask)
3111 {
3112         struct inode *inode = file_inode(file);
3113         struct file_security_struct *fsec = file->f_security;
3114         struct inode_security_struct *isec = inode->i_security;
3115         u32 sid = current_sid();
3116
3117         if (!mask)
3118                 /* No permission to check.  Existence test. */
3119                 return 0;
3120
3121         if (sid == fsec->sid && fsec->isid == isec->sid &&
3122             fsec->pseqno == avc_policy_seqno())
3123                 /* No change since file_open check. */
3124                 return 0;
3125
3126         return selinux_revalidate_file_permission(file, mask);
3127 }
3128
3129 static int selinux_file_alloc_security(struct file *file)
3130 {
3131         return file_alloc_security(file);
3132 }
3133
3134 static void selinux_file_free_security(struct file *file)
3135 {
3136         file_free_security(file);
3137 }
3138
3139 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3140                               unsigned long arg)
3141 {
3142         const struct cred *cred = current_cred();
3143         int error = 0;
3144
3145         switch (cmd) {
3146         case FIONREAD:
3147         /* fall through */
3148         case FIBMAP:
3149         /* fall through */
3150         case FIGETBSZ:
3151         /* fall through */
3152         case FS_IOC_GETFLAGS:
3153         /* fall through */
3154         case FS_IOC_GETVERSION:
3155                 error = file_has_perm(cred, file, FILE__GETATTR);
3156                 break;
3157
3158         case FS_IOC_SETFLAGS:
3159         /* fall through */
3160         case FS_IOC_SETVERSION:
3161                 error = file_has_perm(cred, file, FILE__SETATTR);
3162                 break;
3163
3164         /* sys_ioctl() checks */
3165         case FIONBIO:
3166         /* fall through */
3167         case FIOASYNC:
3168                 error = file_has_perm(cred, file, 0);
3169                 break;
3170
3171         case KDSKBENT:
3172         case KDSKBSENT:
3173                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3174                                             SECURITY_CAP_AUDIT);
3175                 break;
3176
3177         /* default case assumes that the command will go
3178          * to the file's ioctl() function.
3179          */
3180         default:
3181                 error = file_has_perm(cred, file, FILE__IOCTL);
3182         }
3183         return error;
3184 }
3185
3186 static int default_noexec;
3187
3188 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3189 {
3190         const struct cred *cred = current_cred();
3191         int rc = 0;
3192
3193         if (default_noexec &&
3194             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3195                 /*
3196                  * We are making executable an anonymous mapping or a
3197                  * private file mapping that will also be writable.
3198                  * This has an additional check.
3199                  */
3200                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3201                 if (rc)
3202                         goto error;
3203         }
3204
3205         if (file) {
3206                 /* read access is always possible with a mapping */
3207                 u32 av = FILE__READ;
3208
3209                 /* write access only matters if the mapping is shared */
3210                 if (shared && (prot & PROT_WRITE))
3211                         av |= FILE__WRITE;
3212
3213                 if (prot & PROT_EXEC)
3214                         av |= FILE__EXECUTE;
3215
3216                 return file_has_perm(cred, file, av);
3217         }
3218
3219 error:
3220         return rc;
3221 }
3222
3223 static int selinux_mmap_addr(unsigned long addr)
3224 {
3225         int rc;
3226
3227         /* do DAC check on address space usage */
3228         rc = cap_mmap_addr(addr);
3229         if (rc)
3230                 return rc;
3231
3232         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3233                 u32 sid = current_sid();
3234                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3235                                   MEMPROTECT__MMAP_ZERO, NULL);
3236         }
3237
3238         return rc;
3239 }
3240
3241 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3242                              unsigned long prot, unsigned long flags)
3243 {
3244         if (selinux_checkreqprot)
3245                 prot = reqprot;
3246
3247         return file_map_prot_check(file, prot,
3248                                    (flags & MAP_TYPE) == MAP_SHARED);
3249 }
3250
3251 static int selinux_file_mprotect(struct vm_area_struct *vma,
3252                                  unsigned long reqprot,
3253                                  unsigned long prot)
3254 {
3255         const struct cred *cred = current_cred();
3256
3257         if (selinux_checkreqprot)
3258                 prot = reqprot;
3259
3260         if (default_noexec &&
3261             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3262                 int rc = 0;
3263                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3264                     vma->vm_end <= vma->vm_mm->brk) {
3265                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3266                 } else if (!vma->vm_file &&
3267                            vma->vm_start <= vma->vm_mm->start_stack &&
3268                            vma->vm_end >= vma->vm_mm->start_stack) {
3269                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3270                 } else if (vma->vm_file && vma->anon_vma) {
3271                         /*
3272                          * We are making executable a file mapping that has
3273                          * had some COW done. Since pages might have been
3274                          * written, check ability to execute the possibly
3275                          * modified content.  This typically should only
3276                          * occur for text relocations.
3277                          */
3278                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3279                 }
3280                 if (rc)
3281                         return rc;
3282         }
3283
3284         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3285 }
3286
3287 static int selinux_file_lock(struct file *file, unsigned int cmd)
3288 {
3289         const struct cred *cred = current_cred();
3290
3291         return file_has_perm(cred, file, FILE__LOCK);
3292 }
3293
3294 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3295                               unsigned long arg)
3296 {
3297         const struct cred *cred = current_cred();
3298         int err = 0;
3299
3300         switch (cmd) {
3301         case F_SETFL:
3302                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3303                         err = file_has_perm(cred, file, FILE__WRITE);
3304                         break;
3305                 }
3306                 /* fall through */
3307         case F_SETOWN:
3308         case F_SETSIG:
3309         case F_GETFL:
3310         case F_GETOWN:
3311         case F_GETSIG:
3312         case F_GETOWNER_UIDS:
3313                 /* Just check FD__USE permission */
3314                 err = file_has_perm(cred, file, 0);
3315                 break;
3316         case F_GETLK:
3317         case F_SETLK:
3318         case F_SETLKW:
3319 #if BITS_PER_LONG == 32
3320         case F_GETLK64:
3321         case F_SETLK64:
3322         case F_SETLKW64:
3323 #endif
3324                 err = file_has_perm(cred, file, FILE__LOCK);
3325                 break;
3326         }
3327
3328         return err;
3329 }
3330
3331 static int selinux_file_set_fowner(struct file *file)
3332 {
3333         struct file_security_struct *fsec;
3334
3335         fsec = file->f_security;
3336         fsec->fown_sid = current_sid();
3337
3338         return 0;
3339 }
3340
3341 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3342                                        struct fown_struct *fown, int signum)
3343 {
3344         struct file *file;
3345         u32 sid = task_sid(tsk);
3346         u32 perm;
3347         struct file_security_struct *fsec;
3348
3349         /* struct fown_struct is never outside the context of a struct file */
3350         file = container_of(fown, struct file, f_owner);
3351
3352         fsec = file->f_security;
3353
3354         if (!signum)
3355                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3356         else
3357                 perm = signal_to_av(signum);
3358
3359         return avc_has_perm(fsec->fown_sid, sid,
3360                             SECCLASS_PROCESS, perm, NULL);
3361 }
3362
3363 static int selinux_file_receive(struct file *file)
3364 {
3365         const struct cred *cred = current_cred();
3366
3367         return file_has_perm(cred, file, file_to_av(file));
3368 }
3369
3370 static int selinux_file_open(struct file *file, const struct cred *cred)
3371 {
3372         struct file_security_struct *fsec;
3373         struct inode_security_struct *isec;
3374
3375         fsec = file->f_security;
3376         isec = file_inode(file)->i_security;
3377         /*
3378          * Save inode label and policy sequence number
3379          * at open-time so that selinux_file_permission
3380          * can determine whether revalidation is necessary.
3381          * Task label is already saved in the file security
3382          * struct as its SID.
3383          */
3384         fsec->isid = isec->sid;
3385         fsec->pseqno = avc_policy_seqno();
3386         /*
3387          * Since the inode label or policy seqno may have changed
3388          * between the selinux_inode_permission check and the saving
3389          * of state above, recheck that access is still permitted.
3390          * Otherwise, access might never be revalidated against the
3391          * new inode label or new policy.
3392          * This check is not redundant - do not remove.
3393          */
3394         return file_path_has_perm(cred, file, open_file_to_av(file));
3395 }
3396
3397 /* task security operations */
3398
3399 static int selinux_task_create(unsigned long clone_flags)
3400 {
3401         return current_has_perm(current, PROCESS__FORK);
3402 }
3403
3404 /*
3405  * allocate the SELinux part of blank credentials
3406  */
3407 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3408 {
3409         struct task_security_struct *tsec;
3410
3411         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3412         if (!tsec)
3413                 return -ENOMEM;
3414
3415         cred->security = tsec;
3416         return 0;
3417 }
3418
3419 /*
3420  * detach and free the LSM part of a set of credentials
3421  */
3422 static void selinux_cred_free(struct cred *cred)
3423 {
3424         struct task_security_struct *tsec = cred->security;
3425
3426         /*
3427          * cred->security == NULL if security_cred_alloc_blank() or
3428          * security_prepare_creds() returned an error.
3429          */
3430         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3431         cred->security = (void *) 0x7UL;
3432         kfree(tsec);
3433 }
3434
3435 /*
3436  * prepare a new set of credentials for modification
3437  */
3438 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3439                                 gfp_t gfp)
3440 {
3441         const struct task_security_struct *old_tsec;
3442         struct task_security_struct *tsec;
3443
3444         old_tsec = old->security;
3445
3446         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3447         if (!tsec)
3448                 return -ENOMEM;
3449
3450         new->security = tsec;
3451         return 0;
3452 }
3453
3454 /*
3455  * transfer the SELinux data to a blank set of creds
3456  */
3457 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3458 {
3459         const struct task_security_struct *old_tsec = old->security;
3460         struct task_security_struct *tsec = new->security;
3461
3462         *tsec = *old_tsec;
3463 }
3464
3465 /*
3466  * set the security data for a kernel service
3467  * - all the creation contexts are set to unlabelled
3468  */
3469 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3470 {
3471         struct task_security_struct *tsec = new->security;
3472         u32 sid = current_sid();
3473         int ret;
3474
3475         ret = avc_has_perm(sid, secid,
3476                            SECCLASS_KERNEL_SERVICE,
3477                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3478                            NULL);
3479         if (ret == 0) {
3480                 tsec->sid = secid;
3481                 tsec->create_sid = 0;
3482                 tsec->keycreate_sid = 0;
3483                 tsec->sockcreate_sid = 0;
3484         }
3485         return ret;
3486 }
3487
3488 /*
3489  * set the file creation context in a security record to the same as the
3490  * objective context of the specified inode
3491  */
3492 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3493 {
3494         struct inode_security_struct *isec = inode->i_security;
3495         struct task_security_struct *tsec = new->security;
3496         u32 sid = current_sid();
3497         int ret;
3498
3499         ret = avc_has_perm(sid, isec->sid,
3500                            SECCLASS_KERNEL_SERVICE,
3501                            KERNEL_SERVICE__CREATE_FILES_AS,
3502                            NULL);
3503
3504         if (ret == 0)
3505                 tsec->create_sid = isec->sid;
3506         return ret;
3507 }
3508
3509 static int selinux_kernel_module_request(char *kmod_name)
3510 {
3511         u32 sid;
3512         struct common_audit_data ad;
3513
3514         sid = task_sid(current);
3515
3516         ad.type = LSM_AUDIT_DATA_KMOD;
3517         ad.u.kmod_name = kmod_name;
3518
3519         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3520                             SYSTEM__MODULE_REQUEST, &ad);
3521 }
3522
3523 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3524 {
3525         return current_has_perm(p, PROCESS__SETPGID);
3526 }
3527
3528 static int selinux_task_getpgid(struct task_struct *p)
3529 {
3530         return current_has_perm(p, PROCESS__GETPGID);
3531 }
3532
3533 static int selinux_task_getsid(struct task_struct *p)
3534 {
3535         return current_has_perm(p, PROCESS__GETSESSION);
3536 }
3537
3538 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3539 {
3540         *secid = task_sid(p);
3541 }
3542
3543 static int selinux_task_setnice(struct task_struct *p, int nice)
3544 {
3545         int rc;
3546
3547         rc = cap_task_setnice(p, nice);
3548         if (rc)
3549                 return rc;
3550
3551         return current_has_perm(p, PROCESS__SETSCHED);
3552 }
3553
3554 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3555 {
3556         int rc;
3557
3558         rc = cap_task_setioprio(p, ioprio);
3559         if (rc)
3560                 return rc;
3561
3562         return current_has_perm(p, PROCESS__SETSCHED);
3563 }
3564
3565 static int selinux_task_getioprio(struct task_struct *p)
3566 {
3567         return current_has_perm(p, PROCESS__GETSCHED);
3568 }
3569
3570 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3571                 struct rlimit *new_rlim)
3572 {
3573         struct rlimit *old_rlim = p->signal->rlim + resource;
3574
3575         /* Control the ability to change the hard limit (whether
3576            lowering or raising it), so that the hard limit can
3577            later be used as a safe reset point for the soft limit
3578            upon context transitions.  See selinux_bprm_committing_creds. */
3579         if (old_rlim->rlim_max != new_rlim->rlim_max)
3580                 return current_has_perm(p, PROCESS__SETRLIMIT);
3581
3582         return 0;
3583 }
3584
3585 static int selinux_task_setscheduler(struct task_struct *p)
3586 {
3587         int rc;
3588
3589         rc = cap_task_setscheduler(p);
3590         if (rc)
3591                 return rc;
3592
3593         return current_has_perm(p, PROCESS__SETSCHED);
3594 }
3595
3596 static int selinux_task_getscheduler(struct task_struct *p)
3597 {
3598         return current_has_perm(p, PROCESS__GETSCHED);
3599 }
3600
3601 static int selinux_task_movememory(struct task_struct *p)
3602 {
3603         return current_has_perm(p, PROCESS__SETSCHED);
3604 }
3605
3606 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3607                                 int sig, u32 secid)
3608 {
3609         u32 perm;
3610         int rc;
3611
3612         if (!sig)
3613                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3614         else
3615                 perm = signal_to_av(sig);
3616         if (secid)
3617                 rc = avc_has_perm(secid, task_sid(p),
3618                                   SECCLASS_PROCESS, perm, NULL);
3619         else
3620                 rc = current_has_perm(p, perm);
3621         return rc;
3622 }
3623
3624 static int selinux_task_wait(struct task_struct *p)
3625 {
3626         return task_has_perm(p, current, PROCESS__SIGCHLD);
3627 }
3628
3629 static void selinux_task_to_inode(struct task_struct *p,
3630                                   struct inode *inode)
3631 {
3632         struct inode_security_struct *isec = inode->i_security;
3633         u32 sid = task_sid(p);
3634
3635         isec->sid = sid;
3636         isec->initialized = 1;
3637 }
3638
3639 /* Returns error only if unable to parse addresses */
3640 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3641                         struct common_audit_data *ad, u8 *proto)
3642 {
3643         int offset, ihlen, ret = -EINVAL;
3644         struct iphdr _iph, *ih;
3645
3646         offset = skb_network_offset(skb);
3647         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3648         if (ih == NULL)
3649                 goto out;
3650
3651         ihlen = ih->ihl * 4;
3652         if (ihlen < sizeof(_iph))
3653                 goto out;
3654
3655         ad->u.net->v4info.saddr = ih->saddr;
3656         ad->u.net->v4info.daddr = ih->daddr;
3657         ret = 0;
3658
3659         if (proto)
3660                 *proto = ih->protocol;
3661
3662         switch (ih->protocol) {
3663         case IPPROTO_TCP: {
3664                 struct tcphdr _tcph, *th;
3665
3666                 if (ntohs(ih->frag_off) & IP_OFFSET)
3667                         break;
3668
3669                 offset += ihlen;
3670                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3671                 if (th == NULL)
3672                         break;
3673
3674                 ad->u.net->sport = th->source;
3675                 ad->u.net->dport = th->dest;
3676                 break;
3677         }
3678
3679         case IPPROTO_UDP: {
3680                 struct udphdr _udph, *uh;
3681
3682                 if (ntohs(ih->frag_off) & IP_OFFSET)
3683                         break;
3684
3685                 offset += ihlen;
3686                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3687                 if (uh == NULL)
3688                         break;
3689
3690                 ad->u.net->sport = uh->source;
3691                 ad->u.net->dport = uh->dest;
3692                 break;
3693         }
3694
3695         case IPPROTO_DCCP: {
3696                 struct dccp_hdr _dccph, *dh;
3697
3698                 if (ntohs(ih->frag_off) & IP_OFFSET)
3699                         break;
3700
3701                 offset += ihlen;
3702                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3703                 if (dh == NULL)
3704                         break;
3705
3706                 ad->u.net->sport = dh->dccph_sport;
3707                 ad->u.net->dport = dh->dccph_dport;
3708                 break;
3709         }
3710
3711         default:
3712                 break;
3713         }
3714 out:
3715         return ret;
3716 }
3717
3718 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3719
3720 /* Returns error only if unable to parse addresses */
3721 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3722                         struct common_audit_data *ad, u8 *proto)
3723 {
3724         u8 nexthdr;
3725         int ret = -EINVAL, offset;
3726         struct ipv6hdr _ipv6h, *ip6;
3727         __be16 frag_off;
3728
3729         offset = skb_network_offset(skb);
3730         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3731         if (ip6 == NULL)
3732                 goto out;
3733
3734         ad->u.net->v6info.saddr = ip6->saddr;
3735         ad->u.net->v6info.daddr = ip6->daddr;
3736         ret = 0;
3737
3738         nexthdr = ip6->nexthdr;
3739         offset += sizeof(_ipv6h);
3740         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3741         if (offset < 0)
3742                 goto out;
3743
3744         if (proto)
3745                 *proto = nexthdr;
3746
3747         switch (nexthdr) {
3748         case IPPROTO_TCP: {
3749                 struct tcphdr _tcph, *th;
3750
3751                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3752                 if (th == NULL)
3753                         break;
3754
3755                 ad->u.net->sport = th->source;
3756                 ad->u.net->dport = th->dest;
3757                 break;
3758         }
3759
3760         case IPPROTO_UDP: {
3761                 struct udphdr _udph, *uh;
3762
3763                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3764                 if (uh == NULL)
3765                         break;
3766
3767                 ad->u.net->sport = uh->source;
3768                 ad->u.net->dport = uh->dest;
3769                 break;
3770         }
3771
3772         case IPPROTO_DCCP: {
3773                 struct dccp_hdr _dccph, *dh;
3774
3775                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3776                 if (dh == NULL)
3777                         break;
3778
3779                 ad->u.net->sport = dh->dccph_sport;
3780                 ad->u.net->dport = dh->dccph_dport;
3781                 break;
3782         }
3783
3784         /* includes fragments */
3785         default:
3786                 break;
3787         }
3788 out:
3789         return ret;
3790 }
3791
3792 #endif /* IPV6 */
3793
3794 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3795                              char **_addrp, int src, u8 *proto)
3796 {
3797         char *addrp;
3798         int ret;
3799
3800         switch (ad->u.net->family) {
3801         case PF_INET:
3802                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3803                 if (ret)
3804                         goto parse_error;
3805                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3806                                        &ad->u.net->v4info.daddr);
3807                 goto okay;
3808
3809 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3810         case PF_INET6:
3811                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3812                 if (ret)
3813                         goto parse_error;
3814                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3815                                        &ad->u.net->v6info.daddr);
3816                 goto okay;
3817 #endif  /* IPV6 */
3818         default:
3819                 addrp = NULL;
3820                 goto okay;
3821         }
3822
3823 parse_error:
3824         printk(KERN_WARNING
3825                "SELinux: failure in selinux_parse_skb(),"
3826                " unable to parse packet\n");
3827         return ret;
3828
3829 okay:
3830         if (_addrp)
3831                 *_addrp = addrp;
3832         return 0;
3833 }
3834
3835 /**
3836  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3837  * @skb: the packet
3838  * @family: protocol family
3839  * @sid: the packet's peer label SID
3840  *
3841  * Description:
3842  * Check the various different forms of network peer labeling and determine
3843  * the peer label/SID for the packet; most of the magic actually occurs in
3844  * the security server function security_net_peersid_cmp().  The function
3845  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3846  * or -EACCES if @sid is invalid due to inconsistencies with the different
3847  * peer labels.
3848  *
3849  */
3850 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3851 {
3852         int err;
3853         u32 xfrm_sid;
3854         u32 nlbl_sid;
3855         u32 nlbl_type;
3856
3857         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3858         if (unlikely(err))
3859                 return -EACCES;
3860         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3861         if (unlikely(err))
3862                 return -EACCES;
3863
3864         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3865         if (unlikely(err)) {
3866                 printk(KERN_WARNING
3867                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3868                        " unable to determine packet's peer label\n");
3869                 return -EACCES;
3870         }
3871
3872         return 0;
3873 }
3874
3875 /**
3876  * selinux_conn_sid - Determine the child socket label for a connection
3877  * @sk_sid: the parent socket's SID
3878  * @skb_sid: the packet's SID
3879  * @conn_sid: the resulting connection SID
3880  *
3881  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3882  * combined with the MLS information from @skb_sid in order to create
3883  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3884  * of @sk_sid.  Returns zero on success, negative values on failure.
3885  *
3886  */
3887 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3888 {
3889         int err = 0;
3890
3891         if (skb_sid != SECSID_NULL)
3892                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3893         else
3894                 *conn_sid = sk_sid;
3895
3896         return err;
3897 }
3898
3899 /* socket security operations */
3900
3901 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3902                                  u16 secclass, u32 *socksid)
3903 {
3904         if (tsec->sockcreate_sid > SECSID_NULL) {
3905                 *socksid = tsec->sockcreate_sid;
3906                 return 0;
3907         }
3908
3909         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3910                                        socksid);
3911 }
3912
3913 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3914 {
3915         struct sk_security_struct *sksec = sk->sk_security;
3916         struct common_audit_data ad;
3917         struct lsm_network_audit net = {0,};
3918         u32 tsid = task_sid(task);
3919
3920         if (sksec->sid == SECINITSID_KERNEL)
3921                 return 0;
3922
3923         ad.type = LSM_AUDIT_DATA_NET;
3924         ad.u.net = &net;
3925         ad.u.net->sk = sk;
3926
3927         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3928 }
3929
3930 static int selinux_socket_create(int family, int type,
3931                                  int protocol, int kern)
3932 {
3933         const struct task_security_struct *tsec = current_security();
3934         u32 newsid;
3935         u16 secclass;
3936         int rc;
3937
3938         if (kern)
3939                 return 0;
3940
3941         secclass = socket_type_to_security_class(family, type, protocol);
3942         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3943         if (rc)
3944                 return rc;
3945
3946         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3947 }
3948
3949 static int selinux_socket_post_create(struct socket *sock, int family,
3950                                       int type, int protocol, int kern)
3951 {
3952         const struct task_security_struct *tsec = current_security();
3953         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3954         struct sk_security_struct *sksec;
3955         int err = 0;
3956
3957         isec->sclass = socket_type_to_security_class(family, type, protocol);
3958
3959         if (kern)
3960                 isec->sid = SECINITSID_KERNEL;
3961         else {
3962                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3963                 if (err)
3964                         return err;
3965         }
3966
3967         isec->initialized = 1;
3968
3969         if (sock->sk) {
3970                 sksec = sock->sk->sk_security;
3971                 sksec->sid = isec->sid;
3972                 sksec->sclass = isec->sclass;
3973                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3974         }
3975
3976         return err;
3977 }
3978
3979 /* Range of port numbers used to automatically bind.
3980    Need to determine whether we should perform a name_bind
3981    permission check between the socket and the port number. */
3982
3983 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3984 {
3985         struct sock *sk = sock->sk;
3986         u16 family;
3987         int err;
3988
3989         err = sock_has_perm(current, sk, SOCKET__BIND);
3990         if (err)
3991                 goto out;
3992
3993         /*
3994          * If PF_INET or PF_INET6, check name_bind permission for the port.
3995          * Multiple address binding for SCTP is not supported yet: we just
3996          * check the first address now.
3997          */
3998         family = sk->sk_family;
3999         if (family == PF_INET || family == PF_INET6) {
4000                 char *addrp;
4001                 struct sk_security_struct *sksec = sk->sk_security;
4002                 struct common_audit_data ad;
4003                 struct lsm_network_audit net = {0,};
4004                 struct sockaddr_in *addr4 = NULL;
4005                 struct sockaddr_in6 *addr6 = NULL;
4006                 unsigned short snum;
4007                 u32 sid, node_perm;
4008
4009                 if (family == PF_INET) {
4010                         addr4 = (struct sockaddr_in *)address;
4011                         snum = ntohs(addr4->sin_port);
4012                         addrp = (char *)&addr4->sin_addr.s_addr;
4013                 } else {
4014                         addr6 = (struct sockaddr_in6 *)address;
4015                         snum = ntohs(addr6->sin6_port);
4016                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4017                 }
4018
4019                 if (snum) {
4020                         int low, high;
4021
4022                         inet_get_local_port_range(sock_net(sk), &low, &high);
4023
4024                         if (snum < max(PROT_SOCK, low) || snum > high) {
4025                                 err = sel_netport_sid(sk->sk_protocol,
4026                                                       snum, &sid);
4027                                 if (err)
4028                                         goto out;
4029                                 ad.type = LSM_AUDIT_DATA_NET;
4030                                 ad.u.net = &net;
4031                                 ad.u.net->sport = htons(snum);
4032                                 ad.u.net->family = family;
4033                                 err = avc_has_perm(sksec->sid, sid,
4034                                                    sksec->sclass,
4035                                                    SOCKET__NAME_BIND, &ad);
4036                                 if (err)
4037                                         goto out;
4038                         }
4039                 }
4040
4041                 switch (sksec->sclass) {
4042                 case SECCLASS_TCP_SOCKET:
4043                         node_perm = TCP_SOCKET__NODE_BIND;
4044                         break;
4045
4046                 case SECCLASS_UDP_SOCKET:
4047                         node_perm = UDP_SOCKET__NODE_BIND;
4048                         break;
4049
4050                 case SECCLASS_DCCP_SOCKET:
4051                         node_perm = DCCP_SOCKET__NODE_BIND;
4052                         break;
4053
4054                 default:
4055                         node_perm = RAWIP_SOCKET__NODE_BIND;
4056                         break;
4057                 }
4058
4059                 err = sel_netnode_sid(addrp, family, &sid);
4060                 if (err)
4061                         goto out;
4062
4063                 ad.type = LSM_AUDIT_DATA_NET;
4064                 ad.u.net = &net;
4065                 ad.u.net->sport = htons(snum);
4066                 ad.u.net->family = family;
4067
4068                 if (family == PF_INET)
4069                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4070                 else
4071                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4072
4073                 err = avc_has_perm(sksec->sid, sid,
4074                                    sksec->sclass, node_perm, &ad);
4075                 if (err)
4076                         goto out;
4077         }
4078 out:
4079         return err;
4080 }
4081
4082 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4083 {
4084         struct sock *sk = sock->sk;
4085         struct sk_security_struct *sksec = sk->sk_security;
4086         int err;
4087
4088         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4089         if (err)
4090                 return err;
4091
4092         /*
4093          * If a TCP or DCCP socket, check name_connect permission for the port.
4094          */
4095         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4096             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4097                 struct common_audit_data ad;
4098                 struct lsm_network_audit net = {0,};
4099                 struct sockaddr_in *addr4 = NULL;
4100                 struct sockaddr_in6 *addr6 = NULL;
4101                 unsigned short snum;
4102                 u32 sid, perm;
4103
4104                 if (sk->sk_family == PF_INET) {
4105                         addr4 = (struct sockaddr_in *)address;
4106                         if (addrlen < sizeof(struct sockaddr_in))
4107                                 return -EINVAL;
4108                         snum = ntohs(addr4->sin_port);
4109                 } else {
4110                         addr6 = (struct sockaddr_in6 *)address;
4111                         if (addrlen < SIN6_LEN_RFC2133)
4112                                 return -EINVAL;
4113                         snum = ntohs(addr6->sin6_port);
4114                 }
4115
4116                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4117                 if (err)
4118                         goto out;
4119
4120                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4121                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4122
4123                 ad.type = LSM_AUDIT_DATA_NET;
4124                 ad.u.net = &net;
4125                 ad.u.net->dport = htons(snum);
4126                 ad.u.net->family = sk->sk_family;
4127                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4128                 if (err)
4129                         goto out;
4130         }
4131
4132         err = selinux_netlbl_socket_connect(sk, address);
4133
4134 out:
4135         return err;
4136 }
4137
4138 static int selinux_socket_listen(struct socket *sock, int backlog)
4139 {
4140         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4141 }
4142
4143 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4144 {
4145         int err;
4146         struct inode_security_struct *isec;
4147         struct inode_security_struct *newisec;
4148
4149         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4150         if (err)
4151                 return err;
4152
4153         newisec = SOCK_INODE(newsock)->i_security;
4154
4155         isec = SOCK_INODE(sock)->i_security;
4156         newisec->sclass = isec->sclass;
4157         newisec->sid = isec->sid;
4158         newisec->initialized = 1;
4159
4160         return 0;
4161 }
4162
4163 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4164                                   int size)
4165 {
4166         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4167 }
4168
4169 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4170                                   int size, int flags)
4171 {
4172         return sock_has_perm(current, sock->sk, SOCKET__READ);
4173 }
4174
4175 static int selinux_socket_getsockname(struct socket *sock)
4176 {
4177         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4178 }
4179
4180 static int selinux_socket_getpeername(struct socket *sock)
4181 {
4182         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4183 }
4184
4185 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4186 {
4187         int err;
4188
4189         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4190         if (err)
4191                 return err;
4192
4193         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4194 }
4195
4196 static int selinux_socket_getsockopt(struct socket *sock, int level,
4197                                      int optname)
4198 {
4199         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4200 }
4201
4202 static int selinux_socket_shutdown(struct socket *sock, int how)
4203 {
4204         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4205 }
4206
4207 static int selinux_socket_unix_stream_connect(struct sock *sock,
4208                                               struct sock *other,
4209                                               struct sock *newsk)
4210 {
4211         struct sk_security_struct *sksec_sock = sock->sk_security;
4212         struct sk_security_struct *sksec_other = other->sk_security;
4213         struct sk_security_struct *sksec_new = newsk->sk_security;
4214         struct common_audit_data ad;
4215         struct lsm_network_audit net = {0,};
4216         int err;
4217
4218         ad.type = LSM_AUDIT_DATA_NET;
4219         ad.u.net = &net;
4220         ad.u.net->sk = other;
4221
4222         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4223                            sksec_other->sclass,
4224                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4225         if (err)
4226                 return err;
4227
4228         /* server child socket */
4229         sksec_new->peer_sid = sksec_sock->sid;
4230         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4231                                     &sksec_new->sid);
4232         if (err)
4233                 return err;
4234
4235         /* connecting socket */
4236         sksec_sock->peer_sid = sksec_new->sid;
4237
4238         return 0;
4239 }
4240
4241 static int selinux_socket_unix_may_send(struct socket *sock,
4242                                         struct socket *other)
4243 {
4244         struct sk_security_struct *ssec = sock->sk->sk_security;
4245         struct sk_security_struct *osec = other->sk->sk_security;
4246         struct common_audit_data ad;
4247         struct lsm_network_audit net = {0,};
4248
4249         ad.type = LSM_AUDIT_DATA_NET;
4250         ad.u.net = &net;
4251         ad.u.net->sk = other->sk;
4252
4253         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4254                             &ad);
4255 }
4256
4257 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4258                                     u32 peer_sid,
4259                                     struct common_audit_data *ad)
4260 {
4261         int err;
4262         u32 if_sid;
4263         u32 node_sid;
4264
4265         err = sel_netif_sid(ifindex, &if_sid);
4266         if (err)
4267                 return err;
4268         err = avc_has_perm(peer_sid, if_sid,
4269                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4270         if (err)
4271                 return err;
4272
4273         err = sel_netnode_sid(addrp, family, &node_sid);
4274         if (err)
4275                 return err;
4276         return avc_has_perm(peer_sid, node_sid,
4277                             SECCLASS_NODE, NODE__RECVFROM, ad);
4278 }
4279
4280 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4281                                        u16 family)
4282 {
4283         int err = 0;
4284         struct sk_security_struct *sksec = sk->sk_security;
4285         u32 sk_sid = sksec->sid;
4286         struct common_audit_data ad;
4287         struct lsm_network_audit net = {0,};
4288         char *addrp;
4289
4290         ad.type = LSM_AUDIT_DATA_NET;
4291         ad.u.net = &net;
4292         ad.u.net->netif = skb->skb_iif;
4293         ad.u.net->family = family;
4294         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4295         if (err)
4296                 return err;
4297
4298         if (selinux_secmark_enabled()) {
4299                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4300                                    PACKET__RECV, &ad);
4301                 if (err)
4302                         return err;
4303         }
4304
4305         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4306         if (err)
4307                 return err;
4308         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4309
4310         return err;
4311 }
4312
4313 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4314 {
4315         int err;
4316         struct sk_security_struct *sksec = sk->sk_security;
4317         u16 family = sk->sk_family;
4318         u32 sk_sid = sksec->sid;
4319         struct common_audit_data ad;
4320         struct lsm_network_audit net = {0,};
4321         char *addrp;
4322         u8 secmark_active;
4323         u8 peerlbl_active;
4324
4325         if (family != PF_INET && family != PF_INET6)
4326                 return 0;
4327
4328         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4329         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4330                 family = PF_INET;
4331
4332         /* If any sort of compatibility mode is enabled then handoff processing
4333          * to the selinux_sock_rcv_skb_compat() function to deal with the
4334          * special handling.  We do this in an attempt to keep this function
4335          * as fast and as clean as possible. */
4336         if (!selinux_policycap_netpeer)
4337                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4338
4339         secmark_active = selinux_secmark_enabled();
4340         peerlbl_active = selinux_peerlbl_enabled();
4341         if (!secmark_active && !peerlbl_active)
4342                 return 0;
4343
4344         ad.type = LSM_AUDIT_DATA_NET;
4345         ad.u.net = &net;
4346         ad.u.net->netif = skb->skb_iif;
4347         ad.u.net->family = family;
4348         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4349         if (err)
4350                 return err;
4351
4352         if (peerlbl_active) {
4353                 u32 peer_sid;
4354
4355                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4356                 if (err)
4357                         return err;
4358                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4359                                                peer_sid, &ad);
4360                 if (err) {
4361                         selinux_netlbl_err(skb, err, 0);
4362                         return err;
4363                 }
4364                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4365                                    PEER__RECV, &ad);
4366                 if (err) {
4367                         selinux_netlbl_err(skb, err, 0);
4368                         return err;
4369                 }
4370         }
4371
4372         if (secmark_active) {
4373                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4374                                    PACKET__RECV, &ad);
4375                 if (err)
4376                         return err;
4377         }
4378
4379         return err;
4380 }
4381
4382 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4383                                             int __user *optlen, unsigned len)
4384 {
4385         int err = 0;
4386         char *scontext;
4387         u32 scontext_len;
4388         struct sk_security_struct *sksec = sock->sk->sk_security;
4389         u32 peer_sid = SECSID_NULL;
4390
4391         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4392             sksec->sclass == SECCLASS_TCP_SOCKET)
4393                 peer_sid = sksec->peer_sid;
4394         if (peer_sid == SECSID_NULL)
4395                 return -ENOPROTOOPT;
4396
4397         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4398         if (err)
4399                 return err;
4400
4401         if (scontext_len > len) {
4402                 err = -ERANGE;
4403                 goto out_len;
4404         }
4405
4406         if (copy_to_user(optval, scontext, scontext_len))
4407                 err = -EFAULT;
4408
4409 out_len:
4410         if (put_user(scontext_len, optlen))
4411                 err = -EFAULT;
4412         kfree(scontext);
4413         return err;
4414 }
4415
4416 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4417 {
4418         u32 peer_secid = SECSID_NULL;
4419         u16 family;
4420
4421         if (skb && skb->protocol == htons(ETH_P_IP))
4422                 family = PF_INET;
4423         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4424                 family = PF_INET6;
4425         else if (sock)
4426                 family = sock->sk->sk_family;
4427         else
4428                 goto out;
4429
4430         if (sock && family == PF_UNIX)
4431                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4432         else if (skb)
4433                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4434
4435 out:
4436         *secid = peer_secid;
4437         if (peer_secid == SECSID_NULL)
4438                 return -EINVAL;
4439         return 0;
4440 }
4441
4442 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4443 {
4444         struct sk_security_struct *sksec;
4445
4446         sksec = kzalloc(sizeof(*sksec), priority);
4447         if (!sksec)
4448                 return -ENOMEM;
4449
4450         sksec->peer_sid = SECINITSID_UNLABELED;
4451         sksec->sid = SECINITSID_UNLABELED;
4452         selinux_netlbl_sk_security_reset(sksec);
4453         sk->sk_security = sksec;
4454
4455         return 0;
4456 }
4457
4458 static void selinux_sk_free_security(struct sock *sk)
4459 {
4460         struct sk_security_struct *sksec = sk->sk_security;
4461
4462         sk->sk_security = NULL;
4463         selinux_netlbl_sk_security_free(sksec);
4464         kfree(sksec);
4465 }
4466
4467 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4468 {
4469         struct sk_security_struct *sksec = sk->sk_security;
4470         struct sk_security_struct *newsksec = newsk->sk_security;
4471
4472         newsksec->sid = sksec->sid;
4473         newsksec->peer_sid = sksec->peer_sid;
4474         newsksec->sclass = sksec->sclass;
4475
4476         selinux_netlbl_sk_security_reset(newsksec);
4477 }
4478
4479 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4480 {
4481         if (!sk)
4482                 *secid = SECINITSID_ANY_SOCKET;
4483         else {
4484                 struct sk_security_struct *sksec = sk->sk_security;
4485
4486                 *secid = sksec->sid;
4487         }
4488 }
4489
4490 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4491 {
4492         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4493         struct sk_security_struct *sksec = sk->sk_security;
4494
4495         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4496             sk->sk_family == PF_UNIX)
4497                 isec->sid = sksec->sid;
4498         sksec->sclass = isec->sclass;
4499 }
4500
4501 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4502                                      struct request_sock *req)
4503 {
4504         struct sk_security_struct *sksec = sk->sk_security;
4505         int err;
4506         u16 family = req->rsk_ops->family;
4507         u32 connsid;
4508         u32 peersid;
4509
4510         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4511         if (err)
4512                 return err;
4513         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4514         if (err)
4515                 return err;
4516         req->secid = connsid;
4517         req->peer_secid = peersid;
4518
4519         return selinux_netlbl_inet_conn_request(req, family);
4520 }
4521
4522 static void selinux_inet_csk_clone(struct sock *newsk,
4523                                    const struct request_sock *req)
4524 {
4525         struct sk_security_struct *newsksec = newsk->sk_security;
4526
4527         newsksec->sid = req->secid;
4528         newsksec->peer_sid = req->peer_secid;
4529         /* NOTE: Ideally, we should also get the isec->sid for the
4530            new socket in sync, but we don't have the isec available yet.
4531            So we will wait until sock_graft to do it, by which
4532            time it will have been created and available. */
4533
4534         /* We don't need to take any sort of lock here as we are the only
4535          * thread with access to newsksec */
4536         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4537 }
4538
4539 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4540 {
4541         u16 family = sk->sk_family;
4542         struct sk_security_struct *sksec = sk->sk_security;
4543
4544         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4545         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4546                 family = PF_INET;
4547
4548         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4549 }
4550
4551 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4552 {
4553         skb_set_owner_w(skb, sk);
4554 }
4555
4556 static int selinux_secmark_relabel_packet(u32 sid)
4557 {
4558         const struct task_security_struct *__tsec;
4559         u32 tsid;
4560
4561         __tsec = current_security();
4562         tsid = __tsec->sid;
4563
4564         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4565 }
4566
4567 static void selinux_secmark_refcount_inc(void)
4568 {
4569         atomic_inc(&selinux_secmark_refcount);
4570 }
4571
4572 static void selinux_secmark_refcount_dec(void)
4573 {
4574         atomic_dec(&selinux_secmark_refcount);
4575 }
4576
4577 static void selinux_req_classify_flow(const struct request_sock *req,
4578                                       struct flowi *fl)
4579 {
4580         fl->flowi_secid = req->secid;
4581 }
4582
4583 static int selinux_tun_dev_alloc_security(void **security)
4584 {
4585         struct tun_security_struct *tunsec;
4586
4587         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4588         if (!tunsec)
4589                 return -ENOMEM;
4590         tunsec->sid = current_sid();
4591
4592         *security = tunsec;
4593         return 0;
4594 }
4595
4596 static void selinux_tun_dev_free_security(void *security)
4597 {
4598         kfree(security);
4599 }
4600
4601 static int selinux_tun_dev_create(void)
4602 {
4603         u32 sid = current_sid();
4604
4605         /* we aren't taking into account the "sockcreate" SID since the socket
4606          * that is being created here is not a socket in the traditional sense,
4607          * instead it is a private sock, accessible only to the kernel, and
4608          * representing a wide range of network traffic spanning multiple
4609          * connections unlike traditional sockets - check the TUN driver to
4610          * get a better understanding of why this socket is special */
4611
4612         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4613                             NULL);
4614 }
4615
4616 static int selinux_tun_dev_attach_queue(void *security)
4617 {
4618         struct tun_security_struct *tunsec = security;
4619
4620         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4621                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4622 }
4623
4624 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4625 {
4626         struct tun_security_struct *tunsec = security;
4627         struct sk_security_struct *sksec = sk->sk_security;
4628
4629         /* we don't currently perform any NetLabel based labeling here and it
4630          * isn't clear that we would want to do so anyway; while we could apply
4631          * labeling without the support of the TUN user the resulting labeled
4632          * traffic from the other end of the connection would almost certainly
4633          * cause confusion to the TUN user that had no idea network labeling
4634          * protocols were being used */
4635
4636         sksec->sid = tunsec->sid;
4637         sksec->sclass = SECCLASS_TUN_SOCKET;
4638
4639         return 0;
4640 }
4641
4642 static int selinux_tun_dev_open(void *security)
4643 {
4644         struct tun_security_struct *tunsec = security;
4645         u32 sid = current_sid();
4646         int err;
4647
4648         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4649                            TUN_SOCKET__RELABELFROM, NULL);
4650         if (err)
4651                 return err;
4652         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4653                            TUN_SOCKET__RELABELTO, NULL);
4654         if (err)
4655                 return err;
4656         tunsec->sid = sid;
4657
4658         return 0;
4659 }
4660
4661 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4662 {
4663         int err = 0;
4664         u32 perm;
4665         struct nlmsghdr *nlh;
4666         struct sk_security_struct *sksec = sk->sk_security;
4667
4668         if (skb->len < NLMSG_HDRLEN) {
4669                 err = -EINVAL;
4670                 goto out;
4671         }
4672         nlh = nlmsg_hdr(skb);
4673
4674         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4675         if (err) {
4676                 if (err == -EINVAL) {
4677                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4678                                   "SELinux:  unrecognized netlink message"
4679                                   " type=%hu for sclass=%hu\n",
4680                                   nlh->nlmsg_type, sksec->sclass);
4681                         if (!selinux_enforcing || security_get_allow_unknown())
4682                                 err = 0;
4683                 }
4684
4685                 /* Ignore */
4686                 if (err == -ENOENT)
4687                         err = 0;
4688                 goto out;
4689         }
4690
4691         err = sock_has_perm(current, sk, perm);
4692 out:
4693         return err;
4694 }
4695
4696 #ifdef CONFIG_NETFILTER
4697
4698 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4699                                        u16 family)
4700 {
4701         int err;
4702         char *addrp;
4703         u32 peer_sid;
4704         struct common_audit_data ad;
4705         struct lsm_network_audit net = {0,};
4706         u8 secmark_active;
4707         u8 netlbl_active;
4708         u8 peerlbl_active;
4709
4710         if (!selinux_policycap_netpeer)
4711                 return NF_ACCEPT;
4712
4713         secmark_active = selinux_secmark_enabled();
4714         netlbl_active = netlbl_enabled();
4715         peerlbl_active = selinux_peerlbl_enabled();
4716         if (!secmark_active && !peerlbl_active)
4717                 return NF_ACCEPT;
4718
4719         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4720                 return NF_DROP;
4721
4722         ad.type = LSM_AUDIT_DATA_NET;
4723         ad.u.net = &net;
4724         ad.u.net->netif = ifindex;
4725         ad.u.net->family = family;
4726         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4727                 return NF_DROP;
4728
4729         if (peerlbl_active) {
4730                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4731                                                peer_sid, &ad);
4732                 if (err) {
4733                         selinux_netlbl_err(skb, err, 1);
4734                         return NF_DROP;
4735                 }
4736         }
4737
4738         if (secmark_active)
4739                 if (avc_has_perm(peer_sid, skb->secmark,
4740                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4741                         return NF_DROP;
4742
4743         if (netlbl_active)
4744                 /* we do this in the FORWARD path and not the POST_ROUTING
4745                  * path because we want to make sure we apply the necessary
4746                  * labeling before IPsec is applied so we can leverage AH
4747                  * protection */
4748                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4749                         return NF_DROP;
4750
4751         return NF_ACCEPT;
4752 }
4753
4754 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4755                                          struct sk_buff *skb,
4756                                          const struct net_device *in,
4757                                          const struct net_device *out,
4758                                          int (*okfn)(struct sk_buff *))
4759 {
4760         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4761 }
4762
4763 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4764 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4765                                          struct sk_buff *skb,
4766                                          const struct net_device *in,
4767                                          const struct net_device *out,
4768                                          int (*okfn)(struct sk_buff *))
4769 {
4770         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4771 }
4772 #endif  /* IPV6 */
4773
4774 static unsigned int selinux_ip_output(struct sk_buff *skb,
4775                                       u16 family)
4776 {
4777         struct sock *sk;
4778         u32 sid;
4779
4780         if (!netlbl_enabled())
4781                 return NF_ACCEPT;
4782
4783         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4784          * because we want to make sure we apply the necessary labeling
4785          * before IPsec is applied so we can leverage AH protection */
4786         sk = skb->sk;
4787         if (sk) {
4788                 struct sk_security_struct *sksec;
4789
4790                 if (sk->sk_state == TCP_LISTEN)
4791                         /* if the socket is the listening state then this
4792                          * packet is a SYN-ACK packet which means it needs to
4793                          * be labeled based on the connection/request_sock and
4794                          * not the parent socket.  unfortunately, we can't
4795                          * lookup the request_sock yet as it isn't queued on
4796                          * the parent socket until after the SYN-ACK is sent.
4797                          * the "solution" is to simply pass the packet as-is
4798                          * as any IP option based labeling should be copied
4799                          * from the initial connection request (in the IP
4800                          * layer).  it is far from ideal, but until we get a
4801                          * security label in the packet itself this is the
4802                          * best we can do. */
4803                         return NF_ACCEPT;
4804
4805                 /* standard practice, label using the parent socket */
4806                 sksec = sk->sk_security;
4807                 sid = sksec->sid;
4808         } else
4809                 sid = SECINITSID_KERNEL;
4810         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4811                 return NF_DROP;
4812
4813         return NF_ACCEPT;
4814 }
4815
4816 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4817                                         struct sk_buff *skb,
4818                                         const struct net_device *in,
4819                                         const struct net_device *out,
4820                                         int (*okfn)(struct sk_buff *))
4821 {
4822         return selinux_ip_output(skb, PF_INET);
4823 }
4824
4825 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4826                                                 int ifindex,
4827                                                 u16 family)
4828 {
4829         struct sock *sk = skb->sk;
4830         struct sk_security_struct *sksec;
4831         struct common_audit_data ad;
4832         struct lsm_network_audit net = {0,};
4833         char *addrp;
4834         u8 proto;
4835
4836         if (sk == NULL)
4837                 return NF_ACCEPT;
4838         sksec = sk->sk_security;
4839
4840         ad.type = LSM_AUDIT_DATA_NET;
4841         ad.u.net = &net;
4842         ad.u.net->netif = ifindex;
4843         ad.u.net->family = family;
4844         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4845                 return NF_DROP;
4846
4847         if (selinux_secmark_enabled())
4848                 if (avc_has_perm(sksec->sid, skb->secmark,
4849                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4850                         return NF_DROP_ERR(-ECONNREFUSED);
4851
4852         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4853                 return NF_DROP_ERR(-ECONNREFUSED);
4854
4855         return NF_ACCEPT;
4856 }
4857
4858 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4859                                          u16 family)
4860 {
4861         u32 secmark_perm;
4862         u32 peer_sid;
4863         struct sock *sk;
4864         struct common_audit_data ad;
4865         struct lsm_network_audit net = {0,};
4866         char *addrp;
4867         u8 secmark_active;
4868         u8 peerlbl_active;
4869
4870         /* If any sort of compatibility mode is enabled then handoff processing
4871          * to the selinux_ip_postroute_compat() function to deal with the
4872          * special handling.  We do this in an attempt to keep this function
4873          * as fast and as clean as possible. */
4874         if (!selinux_policycap_netpeer)
4875                 return selinux_ip_postroute_compat(skb, ifindex, family);
4876
4877         secmark_active = selinux_secmark_enabled();
4878         peerlbl_active = selinux_peerlbl_enabled();
4879         if (!secmark_active && !peerlbl_active)
4880                 return NF_ACCEPT;
4881
4882         sk = skb->sk;
4883
4884 #ifdef CONFIG_XFRM
4885         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4886          * packet transformation so allow the packet to pass without any checks
4887          * since we'll have another chance to perform access control checks
4888          * when the packet is on it's final way out.
4889          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4890          *       is NULL, in this case go ahead and apply access control.
4891          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4892          *       TCP listening state we cannot wait until the XFRM processing
4893          *       is done as we will miss out on the SA label if we do;
4894          *       unfortunately, this means more work, but it is only once per
4895          *       connection. */
4896         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4897             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4898                 return NF_ACCEPT;
4899 #endif
4900
4901         if (sk == NULL) {
4902                 /* Without an associated socket the packet is either coming
4903                  * from the kernel or it is being forwarded; check the packet
4904                  * to determine which and if the packet is being forwarded
4905                  * query the packet directly to determine the security label. */
4906                 if (skb->skb_iif) {
4907                         secmark_perm = PACKET__FORWARD_OUT;
4908                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4909                                 return NF_DROP;
4910                 } else {
4911                         secmark_perm = PACKET__SEND;
4912                         peer_sid = SECINITSID_KERNEL;
4913                 }
4914         } else if (sk->sk_state == TCP_LISTEN) {
4915                 /* Locally generated packet but the associated socket is in the
4916                  * listening state which means this is a SYN-ACK packet.  In
4917                  * this particular case the correct security label is assigned
4918                  * to the connection/request_sock but unfortunately we can't
4919                  * query the request_sock as it isn't queued on the parent
4920                  * socket until after the SYN-ACK packet is sent; the only
4921                  * viable choice is to regenerate the label like we do in
4922                  * selinux_inet_conn_request().  See also selinux_ip_output()
4923                  * for similar problems. */
4924                 u32 skb_sid;
4925                 struct sk_security_struct *sksec = sk->sk_security;
4926                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4927                         return NF_DROP;
4928                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4929                  * and the packet has been through at least one XFRM
4930                  * transformation then we must be dealing with the "final"
4931                  * form of labeled IPsec packet; since we've already applied
4932                  * all of our access controls on this packet we can safely
4933                  * pass the packet. */
4934                 if (skb_sid == SECSID_NULL) {
4935                         switch (family) {
4936                         case PF_INET:
4937                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4938                                         return NF_ACCEPT;
4939                                 break;
4940                         case PF_INET6:
4941                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4942                                         return NF_ACCEPT;
4943                         default:
4944                                 return NF_DROP_ERR(-ECONNREFUSED);
4945                         }
4946                 }
4947                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4948                         return NF_DROP;
4949                 secmark_perm = PACKET__SEND;
4950         } else {
4951                 /* Locally generated packet, fetch the security label from the
4952                  * associated socket. */
4953                 struct sk_security_struct *sksec = sk->sk_security;
4954                 peer_sid = sksec->sid;
4955                 secmark_perm = PACKET__SEND;
4956         }
4957
4958         ad.type = LSM_AUDIT_DATA_NET;
4959         ad.u.net = &net;
4960         ad.u.net->netif = ifindex;
4961         ad.u.net->family = family;
4962         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4963                 return NF_DROP;
4964
4965         if (secmark_active)
4966                 if (avc_has_perm(peer_sid, skb->secmark,
4967                                  SECCLASS_PACKET, secmark_perm, &ad))
4968                         return NF_DROP_ERR(-ECONNREFUSED);
4969
4970         if (peerlbl_active) {
4971                 u32 if_sid;
4972                 u32 node_sid;
4973
4974                 if (sel_netif_sid(ifindex, &if_sid))
4975                         return NF_DROP;
4976                 if (avc_has_perm(peer_sid, if_sid,
4977                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4978                         return NF_DROP_ERR(-ECONNREFUSED);
4979
4980                 if (sel_netnode_sid(addrp, family, &node_sid))
4981                         return NF_DROP;
4982                 if (avc_has_perm(peer_sid, node_sid,
4983                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4984                         return NF_DROP_ERR(-ECONNREFUSED);
4985         }
4986
4987         return NF_ACCEPT;
4988 }
4989
4990 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4991                                            struct sk_buff *skb,
4992                                            const struct net_device *in,
4993                                            const struct net_device *out,
4994                                            int (*okfn)(struct sk_buff *))
4995 {
4996         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4997 }
4998
4999 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5000 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5001                                            struct sk_buff *skb,
5002                                            const struct net_device *in,
5003                                            const struct net_device *out,
5004                                            int (*okfn)(struct sk_buff *))
5005 {
5006         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
5007 }
5008 #endif  /* IPV6 */
5009
5010 #endif  /* CONFIG_NETFILTER */
5011
5012 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5013 {
5014         int err;
5015
5016         err = cap_netlink_send(sk, skb);
5017         if (err)
5018                 return err;
5019
5020         return selinux_nlmsg_perm(sk, skb);
5021 }
5022
5023 static int ipc_alloc_security(struct task_struct *task,
5024                               struct kern_ipc_perm *perm,
5025                               u16 sclass)
5026 {
5027         struct ipc_security_struct *isec;
5028         u32 sid;
5029
5030         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5031         if (!isec)
5032                 return -ENOMEM;
5033
5034         sid = task_sid(task);
5035         isec->sclass = sclass;
5036         isec->sid = sid;
5037         perm->security = isec;
5038
5039         return 0;
5040 }
5041
5042 static void ipc_free_security(struct kern_ipc_perm *perm)
5043 {
5044         struct ipc_security_struct *isec = perm->security;
5045         perm->security = NULL;
5046         kfree(isec);
5047 }
5048
5049 static int msg_msg_alloc_security(struct msg_msg *msg)
5050 {
5051         struct msg_security_struct *msec;
5052
5053         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5054         if (!msec)
5055                 return -ENOMEM;
5056
5057         msec->sid = SECINITSID_UNLABELED;
5058         msg->security = msec;
5059
5060         return 0;
5061 }
5062
5063 static void msg_msg_free_security(struct msg_msg *msg)
5064 {
5065         struct msg_security_struct *msec = msg->security;
5066
5067         msg->security = NULL;
5068         kfree(msec);
5069 }
5070
5071 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5072                         u32 perms)
5073 {
5074         struct ipc_security_struct *isec;
5075         struct common_audit_data ad;
5076         u32 sid = current_sid();
5077
5078         isec = ipc_perms->security;
5079
5080         ad.type = LSM_AUDIT_DATA_IPC;
5081         ad.u.ipc_id = ipc_perms->key;
5082
5083         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5084 }
5085
5086 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5087 {
5088         return msg_msg_alloc_security(msg);
5089 }
5090
5091 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5092 {
5093         msg_msg_free_security(msg);
5094 }
5095
5096 /* message queue security operations */
5097 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5098 {
5099         struct ipc_security_struct *isec;
5100         struct common_audit_data ad;
5101         u32 sid = current_sid();
5102         int rc;
5103
5104         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5105         if (rc)
5106                 return rc;
5107
5108         isec = msq->q_perm.security;
5109
5110         ad.type = LSM_AUDIT_DATA_IPC;
5111         ad.u.ipc_id = msq->q_perm.key;
5112
5113         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5114                           MSGQ__CREATE, &ad);
5115         if (rc) {
5116                 ipc_free_security(&msq->q_perm);
5117                 return rc;
5118         }
5119         return 0;
5120 }
5121
5122 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5123 {
5124         ipc_free_security(&msq->q_perm);
5125 }
5126
5127 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5128 {
5129         struct ipc_security_struct *isec;
5130         struct common_audit_data ad;
5131         u32 sid = current_sid();
5132
5133         isec = msq->q_perm.security;
5134
5135         ad.type = LSM_AUDIT_DATA_IPC;
5136         ad.u.ipc_id = msq->q_perm.key;
5137
5138         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5139                             MSGQ__ASSOCIATE, &ad);
5140 }
5141
5142 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5143 {
5144         int err;
5145         int perms;
5146
5147         switch (cmd) {
5148         case IPC_INFO:
5149         case MSG_INFO:
5150                 /* No specific object, just general system-wide information. */
5151                 return task_has_system(current, SYSTEM__IPC_INFO);
5152         case IPC_STAT:
5153         case MSG_STAT:
5154                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5155                 break;
5156         case IPC_SET:
5157                 perms = MSGQ__SETATTR;
5158                 break;
5159         case IPC_RMID:
5160                 perms = MSGQ__DESTROY;
5161                 break;
5162         default:
5163                 return 0;
5164         }
5165
5166         err = ipc_has_perm(&msq->q_perm, perms);
5167         return err;
5168 }
5169
5170 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5171 {
5172         struct ipc_security_struct *isec;
5173         struct msg_security_struct *msec;
5174         struct common_audit_data ad;
5175         u32 sid = current_sid();
5176         int rc;
5177
5178         isec = msq->q_perm.security;
5179         msec = msg->security;
5180
5181         /*
5182          * First time through, need to assign label to the message
5183          */
5184         if (msec->sid == SECINITSID_UNLABELED) {
5185                 /*
5186                  * Compute new sid based on current process and
5187                  * message queue this message will be stored in
5188                  */
5189                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5190                                              NULL, &msec->sid);
5191                 if (rc)
5192                         return rc;
5193         }
5194
5195         ad.type = LSM_AUDIT_DATA_IPC;
5196         ad.u.ipc_id = msq->q_perm.key;
5197
5198         /* Can this process write to the queue? */
5199         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5200                           MSGQ__WRITE, &ad);
5201         if (!rc)
5202                 /* Can this process send the message */
5203                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5204                                   MSG__SEND, &ad);
5205         if (!rc)
5206                 /* Can the message be put in the queue? */
5207                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5208                                   MSGQ__ENQUEUE, &ad);
5209
5210         return rc;
5211 }
5212
5213 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5214                                     struct task_struct *target,
5215                                     long type, int mode)
5216 {
5217         struct ipc_security_struct *isec;
5218         struct msg_security_struct *msec;
5219         struct common_audit_data ad;
5220         u32 sid = task_sid(target);
5221         int rc;
5222
5223         isec = msq->q_perm.security;
5224         msec = msg->security;
5225
5226         ad.type = LSM_AUDIT_DATA_IPC;
5227         ad.u.ipc_id = msq->q_perm.key;
5228
5229         rc = avc_has_perm(sid, isec->sid,
5230                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5231         if (!rc)
5232                 rc = avc_has_perm(sid, msec->sid,
5233                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5234         return rc;
5235 }
5236
5237 /* Shared Memory security operations */
5238 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5239 {
5240         struct ipc_security_struct *isec;
5241         struct common_audit_data ad;
5242         u32 sid = current_sid();
5243         int rc;
5244
5245         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5246         if (rc)
5247                 return rc;
5248
5249         isec = shp->shm_perm.security;
5250
5251         ad.type = LSM_AUDIT_DATA_IPC;
5252         ad.u.ipc_id = shp->shm_perm.key;
5253
5254         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5255                           SHM__CREATE, &ad);
5256         if (rc) {
5257                 ipc_free_security(&shp->shm_perm);
5258                 return rc;
5259         }
5260         return 0;
5261 }
5262
5263 static void selinux_shm_free_security(struct shmid_kernel *shp)
5264 {
5265         ipc_free_security(&shp->shm_perm);
5266 }
5267
5268 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5269 {
5270         struct ipc_security_struct *isec;
5271         struct common_audit_data ad;
5272         u32 sid = current_sid();
5273
5274         isec = shp->shm_perm.security;
5275
5276         ad.type = LSM_AUDIT_DATA_IPC;
5277         ad.u.ipc_id = shp->shm_perm.key;
5278
5279         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5280                             SHM__ASSOCIATE, &ad);
5281 }
5282
5283 /* Note, at this point, shp is locked down */
5284 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5285 {
5286         int perms;
5287         int err;
5288
5289         switch (cmd) {
5290         case IPC_INFO:
5291         case SHM_INFO:
5292                 /* No specific object, just general system-wide information. */
5293                 return task_has_system(current, SYSTEM__IPC_INFO);
5294         case IPC_STAT:
5295         case SHM_STAT:
5296                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5297                 break;
5298         case IPC_SET:
5299                 perms = SHM__SETATTR;
5300                 break;
5301         case SHM_LOCK:
5302         case SHM_UNLOCK:
5303                 perms = SHM__LOCK;
5304                 break;
5305         case IPC_RMID:
5306                 perms = SHM__DESTROY;
5307                 break;
5308         default:
5309                 return 0;
5310         }
5311
5312         err = ipc_has_perm(&shp->shm_perm, perms);
5313         return err;
5314 }
5315
5316 static int selinux_shm_shmat(struct shmid_kernel *shp,
5317                              char __user *shmaddr, int shmflg)
5318 {
5319         u32 perms;
5320
5321         if (shmflg & SHM_RDONLY)
5322                 perms = SHM__READ;
5323         else
5324                 perms = SHM__READ | SHM__WRITE;
5325
5326         return ipc_has_perm(&shp->shm_perm, perms);
5327 }
5328
5329 /* Semaphore security operations */
5330 static int selinux_sem_alloc_security(struct sem_array *sma)
5331 {
5332         struct ipc_security_struct *isec;
5333         struct common_audit_data ad;
5334         u32 sid = current_sid();
5335         int rc;
5336
5337         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5338         if (rc)
5339                 return rc;
5340
5341         isec = sma->sem_perm.security;
5342
5343         ad.type = LSM_AUDIT_DATA_IPC;
5344         ad.u.ipc_id = sma->sem_perm.key;
5345
5346         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5347                           SEM__CREATE, &ad);
5348         if (rc) {
5349                 ipc_free_security(&sma->sem_perm);
5350                 return rc;
5351         }
5352         return 0;
5353 }
5354
5355 static void selinux_sem_free_security(struct sem_array *sma)
5356 {
5357         ipc_free_security(&sma->sem_perm);
5358 }
5359
5360 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5361 {
5362         struct ipc_security_struct *isec;
5363         struct common_audit_data ad;
5364         u32 sid = current_sid();
5365
5366         isec = sma->sem_perm.security;
5367
5368         ad.type = LSM_AUDIT_DATA_IPC;
5369         ad.u.ipc_id = sma->sem_perm.key;
5370
5371         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5372                             SEM__ASSOCIATE, &ad);
5373 }
5374
5375 /* Note, at this point, sma is locked down */
5376 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5377 {
5378         int err;
5379         u32 perms;
5380
5381         switch (cmd) {
5382         case IPC_INFO:
5383         case SEM_INFO:
5384                 /* No specific object, just general system-wide information. */
5385                 return task_has_system(current, SYSTEM__IPC_INFO);
5386         case GETPID:
5387         case GETNCNT:
5388         case GETZCNT:
5389                 perms = SEM__GETATTR;
5390                 break;
5391         case GETVAL:
5392         case GETALL:
5393                 perms = SEM__READ;
5394                 break;
5395         case SETVAL:
5396         case SETALL:
5397                 perms = SEM__WRITE;
5398                 break;
5399         case IPC_RMID:
5400                 perms = SEM__DESTROY;
5401                 break;
5402         case IPC_SET:
5403                 perms = SEM__SETATTR;
5404                 break;
5405         case IPC_STAT:
5406         case SEM_STAT:
5407                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5408                 break;
5409         default:
5410                 return 0;
5411         }
5412
5413         err = ipc_has_perm(&sma->sem_perm, perms);
5414         return err;
5415 }
5416
5417 static int selinux_sem_semop(struct sem_array *sma,
5418                              struct sembuf *sops, unsigned nsops, int alter)
5419 {
5420         u32 perms;
5421
5422         if (alter)
5423                 perms = SEM__READ | SEM__WRITE;
5424         else
5425                 perms = SEM__READ;
5426
5427         return ipc_has_perm(&sma->sem_perm, perms);
5428 }
5429
5430 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5431 {
5432         u32 av = 0;
5433
5434         av = 0;
5435         if (flag & S_IRUGO)
5436                 av |= IPC__UNIX_READ;
5437         if (flag & S_IWUGO)
5438                 av |= IPC__UNIX_WRITE;
5439
5440         if (av == 0)
5441                 return 0;
5442
5443         return ipc_has_perm(ipcp, av);
5444 }
5445
5446 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5447 {
5448         struct ipc_security_struct *isec = ipcp->security;
5449         *secid = isec->sid;
5450 }
5451
5452 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5453 {
5454         if (inode)
5455                 inode_doinit_with_dentry(inode, dentry);
5456 }
5457
5458 static int selinux_getprocattr(struct task_struct *p,
5459                                char *name, char **value)
5460 {
5461         const struct task_security_struct *__tsec;
5462         u32 sid;
5463         int error;
5464         unsigned len;
5465
5466         if (current != p) {
5467                 error = current_has_perm(p, PROCESS__GETATTR);
5468                 if (error)
5469                         return error;
5470         }
5471
5472         rcu_read_lock();
5473         __tsec = __task_cred(p)->security;
5474
5475         if (!strcmp(name, "current"))
5476                 sid = __tsec->sid;
5477         else if (!strcmp(name, "prev"))
5478                 sid = __tsec->osid;
5479         else if (!strcmp(name, "exec"))
5480                 sid = __tsec->exec_sid;
5481         else if (!strcmp(name, "fscreate"))
5482                 sid = __tsec->create_sid;
5483         else if (!strcmp(name, "keycreate"))
5484                 sid = __tsec->keycreate_sid;
5485         else if (!strcmp(name, "sockcreate"))
5486                 sid = __tsec->sockcreate_sid;
5487         else
5488                 goto invalid;
5489         rcu_read_unlock();
5490
5491         if (!sid)
5492                 return 0;
5493
5494         error = security_sid_to_context(sid, value, &len);
5495         if (error)
5496                 return error;
5497         return len;
5498
5499 invalid:
5500         rcu_read_unlock();
5501         return -EINVAL;
5502 }
5503
5504 static int selinux_setprocattr(struct task_struct *p,
5505                                char *name, void *value, size_t size)
5506 {
5507         struct task_security_struct *tsec;
5508         struct task_struct *tracer;
5509         struct cred *new;
5510         u32 sid = 0, ptsid;
5511         int error;
5512         char *str = value;
5513
5514         if (current != p) {
5515                 /* SELinux only allows a process to change its own
5516                    security attributes. */
5517                 return -EACCES;
5518         }
5519
5520         /*
5521          * Basic control over ability to set these attributes at all.
5522          * current == p, but we'll pass them separately in case the
5523          * above restriction is ever removed.
5524          */
5525         if (!strcmp(name, "exec"))
5526                 error = current_has_perm(p, PROCESS__SETEXEC);
5527         else if (!strcmp(name, "fscreate"))
5528                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5529         else if (!strcmp(name, "keycreate"))
5530                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5531         else if (!strcmp(name, "sockcreate"))
5532                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5533         else if (!strcmp(name, "current"))
5534                 error = current_has_perm(p, PROCESS__SETCURRENT);
5535         else
5536                 error = -EINVAL;
5537         if (error)
5538                 return error;
5539
5540         /* Obtain a SID for the context, if one was specified. */
5541         if (size && str[1] && str[1] != '\n') {
5542                 if (str[size-1] == '\n') {
5543                         str[size-1] = 0;
5544                         size--;
5545                 }
5546                 error = security_context_to_sid(value, size, &sid);
5547                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5548                         if (!capable(CAP_MAC_ADMIN)) {
5549                                 struct audit_buffer *ab;
5550                                 size_t audit_size;
5551
5552                                 /* We strip a nul only if it is at the end, otherwise the
5553                                  * context contains a nul and we should audit that */
5554                                 if (str[size - 1] == '\0')
5555                                         audit_size = size - 1;
5556                                 else
5557                                         audit_size = size;
5558                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5559                                 audit_log_format(ab, "op=fscreate invalid_context=");
5560                                 audit_log_n_untrustedstring(ab, value, audit_size);
5561                                 audit_log_end(ab);
5562
5563                                 return error;
5564                         }
5565                         error = security_context_to_sid_force(value, size,
5566                                                               &sid);
5567                 }
5568                 if (error)
5569                         return error;
5570         }
5571
5572         new = prepare_creds();
5573         if (!new)
5574                 return -ENOMEM;
5575
5576         /* Permission checking based on the specified context is
5577            performed during the actual operation (execve,
5578            open/mkdir/...), when we know the full context of the
5579            operation.  See selinux_bprm_set_creds for the execve
5580            checks and may_create for the file creation checks. The
5581            operation will then fail if the context is not permitted. */
5582         tsec = new->security;
5583         if (!strcmp(name, "exec")) {
5584                 tsec->exec_sid = sid;
5585         } else if (!strcmp(name, "fscreate")) {
5586                 tsec->create_sid = sid;
5587         } else if (!strcmp(name, "keycreate")) {
5588                 error = may_create_key(sid, p);
5589                 if (error)
5590                         goto abort_change;
5591                 tsec->keycreate_sid = sid;
5592         } else if (!strcmp(name, "sockcreate")) {
5593                 tsec->sockcreate_sid = sid;
5594         } else if (!strcmp(name, "current")) {
5595                 error = -EINVAL;
5596                 if (sid == 0)
5597                         goto abort_change;
5598
5599                 /* Only allow single threaded processes to change context */
5600                 error = -EPERM;
5601                 if (!current_is_single_threaded()) {
5602                         error = security_bounded_transition(tsec->sid, sid);
5603                         if (error)
5604                                 goto abort_change;
5605                 }
5606
5607                 /* Check permissions for the transition. */
5608                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5609                                      PROCESS__DYNTRANSITION, NULL);
5610                 if (error)
5611                         goto abort_change;
5612
5613                 /* Check for ptracing, and update the task SID if ok.
5614                    Otherwise, leave SID unchanged and fail. */
5615                 ptsid = 0;
5616                 rcu_read_lock();
5617                 tracer = ptrace_parent(p);
5618                 if (tracer)
5619                         ptsid = task_sid(tracer);
5620                 rcu_read_unlock();
5621
5622                 if (tracer) {
5623                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5624                                              PROCESS__PTRACE, NULL);
5625                         if (error)
5626                                 goto abort_change;
5627                 }
5628
5629                 tsec->sid = sid;
5630         } else {
5631                 error = -EINVAL;
5632                 goto abort_change;
5633         }
5634
5635         commit_creds(new);
5636         return size;
5637
5638 abort_change:
5639         abort_creds(new);
5640         return error;
5641 }
5642
5643 static int selinux_ismaclabel(const char *name)
5644 {
5645         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5646 }
5647
5648 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5649 {
5650         return security_sid_to_context(secid, secdata, seclen);
5651 }
5652
5653 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5654 {
5655         return security_context_to_sid(secdata, seclen, secid);
5656 }
5657
5658 static void selinux_release_secctx(char *secdata, u32 seclen)
5659 {
5660         kfree(secdata);
5661 }
5662
5663 /*
5664  *      called with inode->i_mutex locked
5665  */
5666 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5667 {
5668         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5669 }
5670
5671 /*
5672  *      called with inode->i_mutex locked
5673  */
5674 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5675 {
5676         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5677 }
5678
5679 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5680 {
5681         int len = 0;
5682         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5683                                                 ctx, true);
5684         if (len < 0)
5685                 return len;
5686         *ctxlen = len;
5687         return 0;
5688 }
5689 #ifdef CONFIG_KEYS
5690
5691 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5692                              unsigned long flags)
5693 {
5694         const struct task_security_struct *tsec;
5695         struct key_security_struct *ksec;
5696
5697         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5698         if (!ksec)
5699                 return -ENOMEM;
5700
5701         tsec = cred->security;
5702         if (tsec->keycreate_sid)
5703                 ksec->sid = tsec->keycreate_sid;
5704         else
5705                 ksec->sid = tsec->sid;
5706
5707         k->security = ksec;
5708         return 0;
5709 }
5710
5711 static void selinux_key_free(struct key *k)
5712 {
5713         struct key_security_struct *ksec = k->security;
5714
5715         k->security = NULL;
5716         kfree(ksec);
5717 }
5718
5719 static int selinux_key_permission(key_ref_t key_ref,
5720                                   const struct cred *cred,
5721                                   key_perm_t perm)
5722 {
5723         struct key *key;
5724         struct key_security_struct *ksec;
5725         u32 sid;
5726
5727         /* if no specific permissions are requested, we skip the
5728            permission check. No serious, additional covert channels
5729            appear to be created. */
5730         if (perm == 0)
5731                 return 0;
5732
5733         sid = cred_sid(cred);
5734
5735         key = key_ref_to_ptr(key_ref);
5736         ksec = key->security;
5737
5738         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5739 }
5740
5741 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5742 {
5743         struct key_security_struct *ksec = key->security;
5744         char *context = NULL;
5745         unsigned len;
5746         int rc;
5747
5748         rc = security_sid_to_context(ksec->sid, &context, &len);
5749         if (!rc)
5750                 rc = len;
5751         *_buffer = context;
5752         return rc;
5753 }
5754
5755 #endif
5756
5757 static struct security_operations selinux_ops = {
5758         .name =                         "selinux",
5759
5760         .ptrace_access_check =          selinux_ptrace_access_check,
5761         .ptrace_traceme =               selinux_ptrace_traceme,
5762         .capget =                       selinux_capget,
5763         .capset =                       selinux_capset,
5764         .capable =                      selinux_capable,
5765         .quotactl =                     selinux_quotactl,
5766         .quota_on =                     selinux_quota_on,
5767         .syslog =                       selinux_syslog,
5768         .vm_enough_memory =             selinux_vm_enough_memory,
5769
5770         .netlink_send =                 selinux_netlink_send,
5771
5772         .bprm_set_creds =               selinux_bprm_set_creds,
5773         .bprm_committing_creds =        selinux_bprm_committing_creds,
5774         .bprm_committed_creds =         selinux_bprm_committed_creds,
5775         .bprm_secureexec =              selinux_bprm_secureexec,
5776
5777         .sb_alloc_security =            selinux_sb_alloc_security,
5778         .sb_free_security =             selinux_sb_free_security,
5779         .sb_copy_data =                 selinux_sb_copy_data,
5780         .sb_remount =                   selinux_sb_remount,
5781         .sb_kern_mount =                selinux_sb_kern_mount,
5782         .sb_show_options =              selinux_sb_show_options,
5783         .sb_statfs =                    selinux_sb_statfs,
5784         .sb_mount =                     selinux_mount,
5785         .sb_umount =                    selinux_umount,
5786         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5787         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5788         .sb_parse_opts_str =            selinux_parse_opts_str,
5789
5790         .dentry_init_security =         selinux_dentry_init_security,
5791
5792         .inode_alloc_security =         selinux_inode_alloc_security,
5793         .inode_free_security =          selinux_inode_free_security,
5794         .inode_init_security =          selinux_inode_init_security,
5795         .inode_create =                 selinux_inode_create,
5796         .inode_link =                   selinux_inode_link,
5797         .inode_unlink =                 selinux_inode_unlink,
5798         .inode_symlink =                selinux_inode_symlink,
5799         .inode_mkdir =                  selinux_inode_mkdir,
5800         .inode_rmdir =                  selinux_inode_rmdir,
5801         .inode_mknod =                  selinux_inode_mknod,
5802         .inode_rename =                 selinux_inode_rename,
5803         .inode_readlink =               selinux_inode_readlink,
5804         .inode_follow_link =            selinux_inode_follow_link,
5805         .inode_permission =             selinux_inode_permission,
5806         .inode_setattr =                selinux_inode_setattr,
5807         .inode_getattr =                selinux_inode_getattr,
5808         .inode_setxattr =               selinux_inode_setxattr,
5809         .inode_post_setxattr =          selinux_inode_post_setxattr,
5810         .inode_getxattr =               selinux_inode_getxattr,
5811         .inode_listxattr =              selinux_inode_listxattr,
5812         .inode_removexattr =            selinux_inode_removexattr,
5813         .inode_getsecurity =            selinux_inode_getsecurity,
5814         .inode_setsecurity =            selinux_inode_setsecurity,
5815         .inode_listsecurity =           selinux_inode_listsecurity,
5816         .inode_getsecid =               selinux_inode_getsecid,
5817
5818         .file_permission =              selinux_file_permission,
5819         .file_alloc_security =          selinux_file_alloc_security,
5820         .file_free_security =           selinux_file_free_security,
5821         .file_ioctl =                   selinux_file_ioctl,
5822         .mmap_file =                    selinux_mmap_file,
5823         .mmap_addr =                    selinux_mmap_addr,
5824         .file_mprotect =                selinux_file_mprotect,
5825         .file_lock =                    selinux_file_lock,
5826         .file_fcntl =                   selinux_file_fcntl,
5827         .file_set_fowner =              selinux_file_set_fowner,
5828         .file_send_sigiotask =          selinux_file_send_sigiotask,
5829         .file_receive =                 selinux_file_receive,
5830
5831         .file_open =                    selinux_file_open,
5832
5833         .task_create =                  selinux_task_create,
5834         .cred_alloc_blank =             selinux_cred_alloc_blank,
5835         .cred_free =                    selinux_cred_free,
5836         .cred_prepare =                 selinux_cred_prepare,
5837         .cred_transfer =                selinux_cred_transfer,
5838         .kernel_act_as =                selinux_kernel_act_as,
5839         .kernel_create_files_as =       selinux_kernel_create_files_as,
5840         .kernel_module_request =        selinux_kernel_module_request,
5841         .task_setpgid =                 selinux_task_setpgid,
5842         .task_getpgid =                 selinux_task_getpgid,
5843         .task_getsid =                  selinux_task_getsid,
5844         .task_getsecid =                selinux_task_getsecid,
5845         .task_setnice =                 selinux_task_setnice,
5846         .task_setioprio =               selinux_task_setioprio,
5847         .task_getioprio =               selinux_task_getioprio,
5848         .task_setrlimit =               selinux_task_setrlimit,
5849         .task_setscheduler =            selinux_task_setscheduler,
5850         .task_getscheduler =            selinux_task_getscheduler,
5851         .task_movememory =              selinux_task_movememory,
5852         .task_kill =                    selinux_task_kill,
5853         .task_wait =                    selinux_task_wait,
5854         .task_to_inode =                selinux_task_to_inode,
5855
5856         .ipc_permission =               selinux_ipc_permission,
5857         .ipc_getsecid =                 selinux_ipc_getsecid,
5858
5859         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5860         .msg_msg_free_security =        selinux_msg_msg_free_security,
5861
5862         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5863         .msg_queue_free_security =      selinux_msg_queue_free_security,
5864         .msg_queue_associate =          selinux_msg_queue_associate,
5865         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5866         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5867         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5868
5869         .shm_alloc_security =           selinux_shm_alloc_security,
5870         .shm_free_security =            selinux_shm_free_security,
5871         .shm_associate =                selinux_shm_associate,
5872         .shm_shmctl =                   selinux_shm_shmctl,
5873         .shm_shmat =                    selinux_shm_shmat,
5874
5875         .sem_alloc_security =           selinux_sem_alloc_security,
5876         .sem_free_security =            selinux_sem_free_security,
5877         .sem_associate =                selinux_sem_associate,
5878         .sem_semctl =                   selinux_sem_semctl,
5879         .sem_semop =                    selinux_sem_semop,
5880
5881         .d_instantiate =                selinux_d_instantiate,
5882
5883         .getprocattr =                  selinux_getprocattr,
5884         .setprocattr =                  selinux_setprocattr,
5885
5886         .ismaclabel =                   selinux_ismaclabel,
5887         .secid_to_secctx =              selinux_secid_to_secctx,
5888         .secctx_to_secid =              selinux_secctx_to_secid,
5889         .release_secctx =               selinux_release_secctx,
5890         .inode_notifysecctx =           selinux_inode_notifysecctx,
5891         .inode_setsecctx =              selinux_inode_setsecctx,
5892         .inode_getsecctx =              selinux_inode_getsecctx,
5893
5894         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5895         .unix_may_send =                selinux_socket_unix_may_send,
5896
5897         .socket_create =                selinux_socket_create,
5898         .socket_post_create =           selinux_socket_post_create,
5899         .socket_bind =                  selinux_socket_bind,
5900         .socket_connect =               selinux_socket_connect,
5901         .socket_listen =                selinux_socket_listen,
5902         .socket_accept =                selinux_socket_accept,
5903         .socket_sendmsg =               selinux_socket_sendmsg,
5904         .socket_recvmsg =               selinux_socket_recvmsg,
5905         .socket_getsockname =           selinux_socket_getsockname,
5906         .socket_getpeername =           selinux_socket_getpeername,
5907         .socket_getsockopt =            selinux_socket_getsockopt,
5908         .socket_setsockopt =            selinux_socket_setsockopt,
5909         .socket_shutdown =              selinux_socket_shutdown,
5910         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5911         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5912         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5913         .sk_alloc_security =            selinux_sk_alloc_security,
5914         .sk_free_security =             selinux_sk_free_security,
5915         .sk_clone_security =            selinux_sk_clone_security,
5916         .sk_getsecid =                  selinux_sk_getsecid,
5917         .sock_graft =                   selinux_sock_graft,
5918         .inet_conn_request =            selinux_inet_conn_request,
5919         .inet_csk_clone =               selinux_inet_csk_clone,
5920         .inet_conn_established =        selinux_inet_conn_established,
5921         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5922         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5923         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5924         .req_classify_flow =            selinux_req_classify_flow,
5925         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5926         .tun_dev_free_security =        selinux_tun_dev_free_security,
5927         .tun_dev_create =               selinux_tun_dev_create,
5928         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5929         .tun_dev_attach =               selinux_tun_dev_attach,
5930         .tun_dev_open =                 selinux_tun_dev_open,
5931         .skb_owned_by =                 selinux_skb_owned_by,
5932
5933 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5934         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5935         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5936         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5937         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5938         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5939         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5940         .xfrm_state_free_security =     selinux_xfrm_state_free,
5941         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5942         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5943         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5944         .xfrm_decode_session =          selinux_xfrm_decode_session,
5945 #endif
5946
5947 #ifdef CONFIG_KEYS
5948         .key_alloc =                    selinux_key_alloc,
5949         .key_free =                     selinux_key_free,
5950         .key_permission =               selinux_key_permission,
5951         .key_getsecurity =              selinux_key_getsecurity,
5952 #endif
5953
5954 #ifdef CONFIG_AUDIT
5955         .audit_rule_init =              selinux_audit_rule_init,
5956         .audit_rule_known =             selinux_audit_rule_known,
5957         .audit_rule_match =             selinux_audit_rule_match,
5958         .audit_rule_free =              selinux_audit_rule_free,
5959 #endif
5960 };
5961
5962 static __init int selinux_init(void)
5963 {
5964         if (!security_module_enable(&selinux_ops)) {
5965                 selinux_enabled = 0;
5966                 return 0;
5967         }
5968
5969         if (!selinux_enabled) {
5970                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5971                 return 0;
5972         }
5973
5974         printk(KERN_INFO "SELinux:  Initializing.\n");
5975
5976         /* Set the security state for the initial task. */
5977         cred_init_security();
5978
5979         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5980
5981         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5982                                             sizeof(struct inode_security_struct),
5983                                             0, SLAB_PANIC, NULL);
5984         avc_init();
5985
5986         if (register_security(&selinux_ops))
5987                 panic("SELinux: Unable to register with kernel.\n");
5988
5989         if (selinux_enforcing)
5990                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5991         else
5992                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5993
5994         return 0;
5995 }
5996
5997 static void delayed_superblock_init(struct super_block *sb, void *unused)
5998 {
5999         superblock_doinit(sb, NULL);
6000 }
6001
6002 void selinux_complete_init(void)
6003 {
6004         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6005
6006         /* Set up any superblocks initialized prior to the policy load. */
6007         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6008         iterate_supers(delayed_superblock_init, NULL);
6009 }
6010
6011 /* SELinux requires early initialization in order to label
6012    all processes and objects when they are created. */
6013 security_initcall(selinux_init);
6014
6015 #if defined(CONFIG_NETFILTER)
6016
6017 static struct nf_hook_ops selinux_ipv4_ops[] = {
6018         {
6019                 .hook =         selinux_ipv4_postroute,
6020                 .owner =        THIS_MODULE,
6021                 .pf =           NFPROTO_IPV4,
6022                 .hooknum =      NF_INET_POST_ROUTING,
6023                 .priority =     NF_IP_PRI_SELINUX_LAST,
6024         },
6025         {
6026                 .hook =         selinux_ipv4_forward,
6027                 .owner =        THIS_MODULE,
6028                 .pf =           NFPROTO_IPV4,
6029                 .hooknum =      NF_INET_FORWARD,
6030                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6031         },
6032         {
6033                 .hook =         selinux_ipv4_output,
6034                 .owner =        THIS_MODULE,
6035                 .pf =           NFPROTO_IPV4,
6036                 .hooknum =      NF_INET_LOCAL_OUT,
6037                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6038         }
6039 };
6040
6041 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6042
6043 static struct nf_hook_ops selinux_ipv6_ops[] = {
6044         {
6045                 .hook =         selinux_ipv6_postroute,
6046                 .owner =        THIS_MODULE,
6047                 .pf =           NFPROTO_IPV6,
6048                 .hooknum =      NF_INET_POST_ROUTING,
6049                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6050         },
6051         {
6052                 .hook =         selinux_ipv6_forward,
6053                 .owner =        THIS_MODULE,
6054                 .pf =           NFPROTO_IPV6,
6055                 .hooknum =      NF_INET_FORWARD,
6056                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6057         }
6058 };
6059
6060 #endif  /* IPV6 */
6061
6062 static int __init selinux_nf_ip_init(void)
6063 {
6064         int err = 0;
6065
6066         if (!selinux_enabled)
6067                 goto out;
6068
6069         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6070
6071         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6072         if (err)
6073                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6074
6075 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6076         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6077         if (err)
6078                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6079 #endif  /* IPV6 */
6080
6081 out:
6082         return err;
6083 }
6084
6085 __initcall(selinux_nf_ip_init);
6086
6087 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6088 static void selinux_nf_ip_exit(void)
6089 {
6090         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6091
6092         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6093 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6094         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6095 #endif  /* IPV6 */
6096 }
6097 #endif
6098
6099 #else /* CONFIG_NETFILTER */
6100
6101 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6102 #define selinux_nf_ip_exit()
6103 #endif
6104
6105 #endif /* CONFIG_NETFILTER */
6106
6107 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6108 static int selinux_disabled;
6109
6110 int selinux_disable(void)
6111 {
6112         if (ss_initialized) {
6113                 /* Not permitted after initial policy load. */
6114                 return -EINVAL;
6115         }
6116
6117         if (selinux_disabled) {
6118                 /* Only do this once. */
6119                 return -EINVAL;
6120         }
6121
6122         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6123
6124         selinux_disabled = 1;
6125         selinux_enabled = 0;
6126
6127         reset_security_ops();
6128
6129         /* Try to destroy the avc node cache */
6130         avc_disable();
6131
6132         /* Unregister netfilter hooks. */
6133         selinux_nf_ip_exit();
6134
6135         /* Unregister selinuxfs. */
6136         exit_sel_fs();
6137
6138         return 0;
6139 }
6140 #endif