security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *
  14  *      This program is free software; you can redistribute it and/or modify
  15  *      it under the terms of the GNU General Public License version 2,
  16  *      as published by the Free Software Foundation.
  17  */
  18
  19 #include <linux/config.h>
  20 #include <linux/module.h>
  21 #include <linux/init.h>
  22 #include <linux/kernel.h>
  23 #include <linux/ptrace.h>
  24 #include <linux/errno.h>
  25 #include <linux/sched.h>
  26 #include <linux/security.h>
  27 #include <linux/xattr.h>
  28 #include <linux/capability.h>
  29 #include <linux/unistd.h>
  30 #include <linux/mm.h>
  31 #include <linux/mman.h>
  32 #include <linux/slab.h>
  33 #include <linux/pagemap.h>
  34 #include <linux/swap.h>
  35 #include <linux/smp_lock.h>
  36 #include <linux/spinlock.h>
  37 #include <linux/syscalls.h>
  38 #include <linux/file.h>
  39 #include <linux/namei.h>
  40 #include <linux/mount.h>
  41 #include <linux/ext2_fs.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/kd.h>
  44 #include <linux/netfilter_ipv4.h>
  45 #include <linux/netfilter_ipv6.h>
  46 #include <linux/tty.h>
  47 #include <net/icmp.h>
  48 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  49 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  50 #include <asm/uaccess.h>
  51 #include <asm/semaphore.h>
  52 #include <asm/ioctls.h>
  53 #include <linux/bitops.h>
  54 #include <linux/interrupt.h>
  55 #include <linux/netdevice.h>    /* for network interface checks */
  56 #include <linux/netlink.h>
  57 #include <linux/tcp.h>
  58 #include <linux/udp.h>
  59 #include <linux/quota.h>
  60 #include <linux/un.h>           /* for Unix socket types */
  61 #include <net/af_unix.h>        /* for Unix socket types */
  62 #include <linux/parser.h>
  63 #include <linux/nfs_mount.h>
  64 #include <net/ipv6.h>
  65 #include <linux/hugetlb.h>
  66 #include <linux/personality.h>
  67
  68 #include "avc.h"
  69 #include "objsec.h"
  70 #include "netif.h"
  71
  72 #define XATTR_SELINUX_SUFFIX "selinux"
  73 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  74
  75 extern int policydb_loaded_version;
  76 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  77
  78 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  79 int selinux_enforcing = 0;
  80
  81 static int __init enforcing_setup(char *str)
  82 {
  83         selinux_enforcing = simple_strtol(str,NULL,0);
  84         return 1;
  85 }
  86 __setup("enforcing=", enforcing_setup);
  87 #endif
  88
  89 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  90 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  91
  92 static int __init selinux_enabled_setup(char *str)
  93 {
  94         selinux_enabled = simple_strtol(str, NULL, 0);
  95         return 1;
  96 }
  97 __setup("selinux=", selinux_enabled_setup);
  98 #endif
  99
 100 /* Original (dummy) security module. */
 101 static struct security_operations *original_ops = NULL;
 102
 103 /* Minimal support for a secondary security module,
 104    just to allow the use of the dummy or capability modules.
 105    The owlsm module can alternatively be used as a secondary
 106    module as long as CONFIG_OWLSM_FD is not enabled. */
 107 static struct security_operations *secondary_ops = NULL;
 108
 109 /* Lists of inode and superblock security structures initialized
 110    before the policy was loaded. */
 111 static LIST_HEAD(superblock_security_head);
 112 static spinlock_t sb_security_lock = SPIN_LOCK_UNLOCKED;
 113
 114 /* Allocate and free functions for each kind of security blob. */
 115
 116 static int task_alloc_security(struct task_struct *task)
 117 {
 118         struct task_security_struct *tsec;
 119
 120         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 121         if (!tsec)
 122                 return -ENOMEM;
 123
 124         memset(tsec, 0, sizeof(struct task_security_struct));
 125         tsec->magic = SELINUX_MAGIC;
 126         tsec->task = task;
 127         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 128         task->security = tsec;
 129
 130         return 0;
 131 }
 132
 133 static void task_free_security(struct task_struct *task)
 134 {
 135         struct task_security_struct *tsec = task->security;
 136
 137         if (!tsec || tsec->magic != SELINUX_MAGIC)
 138                 return;
 139
 140         task->security = NULL;
 141         kfree(tsec);
 142 }
 143
 144 static int inode_alloc_security(struct inode *inode)
 145 {
 146         struct task_security_struct *tsec = current->security;
 147         struct inode_security_struct *isec;
 148
 149         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 150         if (!isec)
 151                 return -ENOMEM;
 152
 153         memset(isec, 0, sizeof(struct inode_security_struct));
 154         init_MUTEX(&isec->sem);
 155         INIT_LIST_HEAD(&isec->list);
 156         isec->magic = SELINUX_MAGIC;
 157         isec->inode = inode;
 158         isec->sid = SECINITSID_UNLABELED;
 159         isec->sclass = SECCLASS_FILE;
 160         if (tsec && tsec->magic == SELINUX_MAGIC)
 161                 isec->task_sid = tsec->sid;
 162         else
 163                 isec->task_sid = SECINITSID_UNLABELED;
 164         inode->i_security = isec;
 165
 166         return 0;
 167 }
 168
 169 static void inode_free_security(struct inode *inode)
 170 {
 171         struct inode_security_struct *isec = inode->i_security;
 172         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 173
 174         if (!isec || isec->magic != SELINUX_MAGIC)
 175                 return;
 176
 177         spin_lock(&sbsec->isec_lock);
 178         if (!list_empty(&isec->list))
 179                 list_del_init(&isec->list);
 180         spin_unlock(&sbsec->isec_lock);
 181
 182         inode->i_security = NULL;
 183         kfree(isec);
 184 }
 185
 186 static int file_alloc_security(struct file *file)
 187 {
 188         struct task_security_struct *tsec = current->security;
 189         struct file_security_struct *fsec;
 190
 191         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 192         if (!fsec)
 193                 return -ENOMEM;
 194
 195         memset(fsec, 0, sizeof(struct file_security_struct));
 196         fsec->magic = SELINUX_MAGIC;
 197         fsec->file = file;
 198         if (tsec && tsec->magic == SELINUX_MAGIC) {
 199                 fsec->sid = tsec->sid;
 200                 fsec->fown_sid = tsec->sid;
 201         } else {
 202                 fsec->sid = SECINITSID_UNLABELED;
 203                 fsec->fown_sid = SECINITSID_UNLABELED;
 204         }
 205         file->f_security = fsec;
 206
 207         return 0;
 208 }
 209
 210 static void file_free_security(struct file *file)
 211 {
 212         struct file_security_struct *fsec = file->f_security;
 213
 214         if (!fsec || fsec->magic != SELINUX_MAGIC)
 215                 return;
 216
 217         file->f_security = NULL;
 218         kfree(fsec);
 219 }
 220
 221 static int superblock_alloc_security(struct super_block *sb)
 222 {
 223         struct superblock_security_struct *sbsec;
 224
 225         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 226         if (!sbsec)
 227                 return -ENOMEM;
 228
 229         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 230         init_MUTEX(&sbsec->sem);
 231         INIT_LIST_HEAD(&sbsec->list);
 232         INIT_LIST_HEAD(&sbsec->isec_head);
 233         spin_lock_init(&sbsec->isec_lock);
 234         sbsec->magic = SELINUX_MAGIC;
 235         sbsec->sb = sb;
 236         sbsec->sid = SECINITSID_UNLABELED;
 237         sbsec->def_sid = SECINITSID_FILE;
 238         sb->s_security = sbsec;
 239
 240         return 0;
 241 }
 242
 243 static void superblock_free_security(struct super_block *sb)
 244 {
 245         struct superblock_security_struct *sbsec = sb->s_security;
 246
 247         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 248                 return;
 249
 250         spin_lock(&sb_security_lock);
 251         if (!list_empty(&sbsec->list))
 252                 list_del_init(&sbsec->list);
 253         spin_unlock(&sb_security_lock);
 254
 255         sb->s_security = NULL;
 256         kfree(sbsec);
 257 }
 258
 259 #ifdef CONFIG_SECURITY_NETWORK
 260 static int sk_alloc_security(struct sock *sk, int family, int priority)
 261 {
 262         struct sk_security_struct *ssec;
 263
 264         if (family != PF_UNIX)
 265                 return 0;
 266
 267         ssec = kmalloc(sizeof(*ssec), priority);
 268         if (!ssec)
 269                 return -ENOMEM;
 270
 271         memset(ssec, 0, sizeof(*ssec));
 272         ssec->magic = SELINUX_MAGIC;
 273         ssec->sk = sk;
 274         ssec->peer_sid = SECINITSID_UNLABELED;
 275         sk->sk_security = ssec;
 276
 277         return 0;
 278 }
 279
 280 static void sk_free_security(struct sock *sk)
 281 {
 282         struct sk_security_struct *ssec = sk->sk_security;
 283
 284         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 285                 return;
 286
 287         sk->sk_security = NULL;
 288         kfree(ssec);
 289 }
 290 #endif  /* CONFIG_SECURITY_NETWORK */
 291
 292 /* The security server must be initialized before
 293    any labeling or access decisions can be provided. */
 294 extern int ss_initialized;
 295
 296 /* The file system's label must be initialized prior to use. */
 297
 298 static char *labeling_behaviors[6] = {
 299         "uses xattr",
 300         "uses transition SIDs",
 301         "uses task SIDs",
 302         "uses genfs_contexts",
 303         "not configured for labeling",
 304         "uses mountpoint labeling",
 305 };
 306
 307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 308
 309 static inline int inode_doinit(struct inode *inode)
 310 {
 311         return inode_doinit_with_dentry(inode, NULL);
 312 }
 313
 314 enum {
 315         Opt_context = 1,
 316         Opt_fscontext = 2,
 317         Opt_defcontext = 4,
 318 };
 319
 320 static match_table_t tokens = {
 321         {Opt_context, "context=%s"},
 322         {Opt_fscontext, "fscontext=%s"},
 323         {Opt_defcontext, "defcontext=%s"},
 324 };
 325
 326 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 327
 328 static int try_context_mount(struct super_block *sb, void *data)
 329 {
 330         char *context = NULL, *defcontext = NULL;
 331         const char *name;
 332         u32 sid;
 333         int alloc = 0, rc = 0, seen = 0;
 334         struct task_security_struct *tsec = current->security;
 335         struct superblock_security_struct *sbsec = sb->s_security;
 336
 337         if (!data)
 338                 goto out;
 339
 340         name = sb->s_type->name;
 341
 342         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 343
 344                 /* NFS we understand. */
 345                 if (!strcmp(name, "nfs")) {
 346                         struct nfs_mount_data *d = data;
 347
 348                         if (d->version <  NFS_MOUNT_VERSION)
 349                                 goto out;
 350
 351                         if (d->context[0]) {
 352                                 context = d->context;
 353                                 seen |= Opt_context;
 354                         }
 355                 } else
 356                         goto out;
 357
 358         } else {
 359                 /* Standard string-based options. */
 360                 char *p, *options = data;
 361
 362                 while ((p = strsep(&options, ",")) != NULL) {
 363                         int token;
 364                         substring_t args[MAX_OPT_ARGS];
 365
 366                         if (!*p)
 367                                 continue;
 368
 369                         token = match_token(p, tokens, args);
 370
 371                         switch (token) {
 372                         case Opt_context:
 373                                 if (seen) {
 374                                         rc = -EINVAL;
 375                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 376                                         goto out_free;
 377                                 }
 378                                 context = match_strdup(&args[0]);
 379                                 if (!context) {
 380                                         rc = -ENOMEM;
 381                                         goto out_free;
 382                                 }
 383                                 if (!alloc)
 384                                         alloc = 1;
 385                                 seen |= Opt_context;
 386                                 break;
 387
 388                         case Opt_fscontext:
 389                                 if (seen & (Opt_context|Opt_fscontext)) {
 390                                         rc = -EINVAL;
 391                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 392                                         goto out_free;
 393                                 }
 394                                 context = match_strdup(&args[0]);
 395                                 if (!context) {
 396                                         rc = -ENOMEM;
 397                                         goto out_free;
 398                                 }
 399                                 if (!alloc)
 400                                         alloc = 1;
 401                                 seen |= Opt_fscontext;
 402                                 break;
 403
 404                         case Opt_defcontext:
 405                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 406                                         rc = -EINVAL;
 407                                         printk(KERN_WARNING "SELinux:  "
 408                                                "defcontext option is invalid "
 409                                                "for this filesystem type\n");
 410                                         goto out_free;
 411                                 }
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 defcontext = match_strdup(&args[0]);
 418                                 if (!defcontext) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_defcontext;
 425                                 break;
 426
 427                         default:
 428                                 rc = -EINVAL;
 429                                 printk(KERN_WARNING "SELinux:  unknown mount "
 430                                        "option\n");
 431                                 goto out_free;
 432
 433                         }
 434                 }
 435         }
 436
 437         if (!seen)
 438                 goto out;
 439
 440         if (context) {
 441                 rc = security_context_to_sid(context, strlen(context), &sid);
 442                 if (rc) {
 443                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 444                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 445                                context, sb->s_id, name, rc);
 446                         goto out_free;
 447                 }
 448
 449                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 450                                   FILESYSTEM__RELABELFROM, NULL);
 451                 if (rc)
 452                         goto out_free;
 453
 454                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELTO, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 sbsec->sid = sid;
 460
 461                 if (seen & Opt_context)
 462                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 463         }
 464
 465         if (defcontext) {
 466                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 467                 if (rc) {
 468                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 469                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 470                                defcontext, sb->s_id, name, rc);
 471                         goto out_free;
 472                 }
 473
 474                 if (sid == sbsec->def_sid)
 475                         goto out_free;
 476
 477                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 478                                   FILESYSTEM__RELABELFROM, NULL);
 479                 if (rc)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__ASSOCIATE, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 sbsec->def_sid = sid;
 488         }
 489
 490 out_free:
 491         if (alloc) {
 492                 kfree(context);
 493                 kfree(defcontext);
 494         }
 495 out:
 496         return rc;
 497 }
 498
 499 static int superblock_doinit(struct super_block *sb, void *data)
 500 {
 501         struct superblock_security_struct *sbsec = sb->s_security;
 502         struct dentry *root = sb->s_root;
 503         struct inode *inode = root->d_inode;
 504         int rc = 0;
 505
 506         down(&sbsec->sem);
 507         if (sbsec->initialized)
 508                 goto out;
 509
 510         if (!ss_initialized) {
 511                 /* Defer initialization until selinux_complete_init,
 512                    after the initial policy is loaded and the security
 513                    server is ready to handle calls. */
 514                 spin_lock(&sb_security_lock);
 515                 if (list_empty(&sbsec->list))
 516                         list_add(&sbsec->list, &superblock_security_head);
 517                 spin_unlock(&sb_security_lock);
 518                 goto out;
 519         }
 520
 521         /* Determine the labeling behavior to use for this filesystem type. */
 522         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 523         if (rc) {
 524                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 525                        __FUNCTION__, sb->s_type->name, rc);
 526                 goto out;
 527         }
 528
 529         rc = try_context_mount(sb, data);
 530         if (rc)
 531                 goto out;
 532
 533         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 534                 /* Make sure that the xattr handler exists and that no
 535                    error other than -ENODATA is returned by getxattr on
 536                    the root directory.  -ENODATA is ok, as this may be
 537                    the first boot of the SELinux kernel before we have
 538                    assigned xattr values to the filesystem. */
 539                 if (!inode->i_op->getxattr) {
 540                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 541                                "xattr support\n", sb->s_id, sb->s_type->name);
 542                         rc = -EOPNOTSUPP;
 543                         goto out;
 544                 }
 545                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 546                 if (rc < 0 && rc != -ENODATA) {
 547                         if (rc == -EOPNOTSUPP)
 548                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 549                                        "%s) has no security xattr handler\n",
 550                                        sb->s_id, sb->s_type->name);
 551                         else
 552                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 553                                        "%s) getxattr errno %d\n", sb->s_id,
 554                                        sb->s_type->name, -rc);
 555                         goto out;
 556                 }
 557         }
 558
 559         if (strcmp(sb->s_type->name, "proc") == 0)
 560                 sbsec->proc = 1;
 561
 562         sbsec->initialized = 1;
 563
 564         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 565                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 566                        sb->s_id, sb->s_type->name);
 567         }
 568         else {
 569                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 570                        sb->s_id, sb->s_type->name,
 571                        labeling_behaviors[sbsec->behavior-1]);
 572         }
 573
 574         /* Initialize the root inode. */
 575         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 576
 577         /* Initialize any other inodes associated with the superblock, e.g.
 578            inodes created prior to initial policy load or inodes created
 579            during get_sb by a pseudo filesystem that directly
 580            populates itself. */
 581         spin_lock(&sbsec->isec_lock);
 582 next_inode:
 583         if (!list_empty(&sbsec->isec_head)) {
 584                 struct inode_security_struct *isec =
 585                                 list_entry(sbsec->isec_head.next,
 586                                            struct inode_security_struct, list);
 587                 struct inode *inode = isec->inode;
 588                 spin_unlock(&sbsec->isec_lock);
 589                 inode = igrab(inode);
 590                 if (inode) {
 591                         inode_doinit(inode);
 592                         iput(inode);
 593                 }
 594                 spin_lock(&sbsec->isec_lock);
 595                 list_del_init(&isec->list);
 596                 goto next_inode;
 597         }
 598         spin_unlock(&sbsec->isec_lock);
 599 out:
 600         up(&sbsec->sem);
 601         return rc;
 602 }
 603
 604 static inline u16 inode_mode_to_security_class(umode_t mode)
 605 {
 606         switch (mode & S_IFMT) {
 607         case S_IFSOCK:
 608                 return SECCLASS_SOCK_FILE;
 609         case S_IFLNK:
 610                 return SECCLASS_LNK_FILE;
 611         case S_IFREG:
 612                 return SECCLASS_FILE;
 613         case S_IFBLK:
 614                 return SECCLASS_BLK_FILE;
 615         case S_IFDIR:
 616                 return SECCLASS_DIR;
 617         case S_IFCHR:
 618                 return SECCLASS_CHR_FILE;
 619         case S_IFIFO:
 620                 return SECCLASS_FIFO_FILE;
 621
 622         }
 623
 624         return SECCLASS_FILE;
 625 }
 626
 627 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 628 {
 629         switch (family) {
 630         case PF_UNIX:
 631                 switch (type) {
 632                 case SOCK_STREAM:
 633                 case SOCK_SEQPACKET:
 634                         return SECCLASS_UNIX_STREAM_SOCKET;
 635                 case SOCK_DGRAM:
 636                         return SECCLASS_UNIX_DGRAM_SOCKET;
 637                 }
 638                 break;
 639         case PF_INET:
 640         case PF_INET6:
 641                 switch (type) {
 642                 case SOCK_STREAM:
 643                         return SECCLASS_TCP_SOCKET;
 644                 case SOCK_DGRAM:
 645                         return SECCLASS_UDP_SOCKET;
 646                 case SOCK_RAW:
 647                         return SECCLASS_RAWIP_SOCKET;
 648                 }
 649                 break;
 650         case PF_NETLINK:
 651                 switch (protocol) {
 652                 case NETLINK_ROUTE:
 653                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 654                 case NETLINK_FIREWALL:
 655                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 656                 case NETLINK_TCPDIAG:
 657                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 658                 case NETLINK_NFLOG:
 659                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 660                 case NETLINK_XFRM:
 661                         return SECCLASS_NETLINK_XFRM_SOCKET;
 662                 case NETLINK_SELINUX:
 663                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 664                 case NETLINK_AUDIT:
 665                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 666                 case NETLINK_IP6_FW:
 667                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 668                 case NETLINK_DNRTMSG:
 669                         return SECCLASS_NETLINK_DNRT_SOCKET;
 670                 default:
 671                         return SECCLASS_NETLINK_SOCKET;
 672                 }
 673         case PF_PACKET:
 674                 return SECCLASS_PACKET_SOCKET;
 675         case PF_KEY:
 676                 return SECCLASS_KEY_SOCKET;
 677         }
 678
 679         return SECCLASS_SOCKET;
 680 }
 681
 682 #ifdef CONFIG_PROC_FS
 683 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 684                                 u16 tclass,
 685                                 u32 *sid)
 686 {
 687         int buflen, rc;
 688         char *buffer, *path, *end;
 689
 690         buffer = (char*)__get_free_page(GFP_KERNEL);
 691         if (!buffer)
 692                 return -ENOMEM;
 693
 694         buflen = PAGE_SIZE;
 695         end = buffer+buflen;
 696         *--end = '\0';
 697         buflen--;
 698         path = end-1;
 699         *path = '/';
 700         while (de && de != de->parent) {
 701                 buflen -= de->namelen + 1;
 702                 if (buflen < 0)
 703                         break;
 704                 end -= de->namelen;
 705                 memcpy(end, de->name, de->namelen);
 706                 *--end = '/';
 707                 path = end;
 708                 de = de->parent;
 709         }
 710         rc = security_genfs_sid("proc", path, tclass, sid);
 711         free_page((unsigned long)buffer);
 712         return rc;
 713 }
 714 #else
 715 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 716                                 u16 tclass,
 717                                 u32 *sid)
 718 {
 719         return -EINVAL;
 720 }
 721 #endif
 722
 723 /* The inode's security attributes must be initialized before first use. */
 724 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 725 {
 726         struct superblock_security_struct *sbsec = NULL;
 727         struct inode_security_struct *isec = inode->i_security;
 728         u32 sid;
 729         struct dentry *dentry;
 730 #define INITCONTEXTLEN 255
 731         char *context = NULL;
 732         unsigned len = 0;
 733         int rc = 0;
 734         int hold_sem = 0;
 735
 736         if (isec->initialized)
 737                 goto out;
 738
 739         down(&isec->sem);
 740         hold_sem = 1;
 741         if (isec->initialized)
 742                 goto out;
 743
 744         sbsec = inode->i_sb->s_security;
 745         if (!sbsec->initialized) {
 746                 /* Defer initialization until selinux_complete_init,
 747                    after the initial policy is loaded and the security
 748                    server is ready to handle calls. */
 749                 spin_lock(&sbsec->isec_lock);
 750                 if (list_empty(&isec->list))
 751                         list_add(&isec->list, &sbsec->isec_head);
 752                 spin_unlock(&sbsec->isec_lock);
 753                 goto out;
 754         }
 755
 756         switch (sbsec->behavior) {
 757         case SECURITY_FS_USE_XATTR:
 758                 if (!inode->i_op->getxattr) {
 759                         isec->sid = sbsec->def_sid;
 760                         break;
 761                 }
 762
 763                 /* Need a dentry, since the xattr API requires one.
 764                    Life would be simpler if we could just pass the inode. */
 765                 if (opt_dentry) {
 766                         /* Called from d_instantiate or d_splice_alias. */
 767                         dentry = dget(opt_dentry);
 768                 } else {
 769                         /* Called from selinux_complete_init, try to find a dentry. */
 770                         dentry = d_find_alias(inode);
 771                 }
 772                 if (!dentry) {
 773                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 774                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 775                                inode->i_ino);
 776                         goto out;
 777                 }
 778
 779                 len = INITCONTEXTLEN;
 780                 context = kmalloc(len, GFP_KERNEL);
 781                 if (!context) {
 782                         rc = -ENOMEM;
 783                         dput(dentry);
 784                         goto out;
 785                 }
 786                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 787                                            context, len);
 788                 if (rc == -ERANGE) {
 789                         /* Need a larger buffer.  Query for the right size. */
 790                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 791                                                    NULL, 0);
 792                         if (rc < 0) {
 793                                 dput(dentry);
 794                                 goto out;
 795                         }
 796                         kfree(context);
 797                         len = rc;
 798                         context = kmalloc(len, GFP_KERNEL);
 799                         if (!context) {
 800                                 rc = -ENOMEM;
 801                                 dput(dentry);
 802                                 goto out;
 803                         }
 804                         rc = inode->i_op->getxattr(dentry,
 805                                                    XATTR_NAME_SELINUX,
 806                                                    context, len);
 807                 }
 808                 dput(dentry);
 809                 if (rc < 0) {
 810                         if (rc != -ENODATA) {
 811                                 printk(KERN_WARNING "%s:  getxattr returned "
 812                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 813                                        -rc, inode->i_sb->s_id, inode->i_ino);
 814                                 kfree(context);
 815                                 goto out;
 816                         }
 817                         /* Map ENODATA to the default file SID */
 818                         sid = sbsec->def_sid;
 819                         rc = 0;
 820                 } else {
 821                         rc = security_context_to_sid(context, rc, &sid);
 822                         if (rc) {
 823                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 824                                        "returned %d for dev=%s ino=%ld\n",
 825                                        __FUNCTION__, context, -rc,
 826                                        inode->i_sb->s_id, inode->i_ino);
 827                                 kfree(context);
 828                                 goto out;
 829                         }
 830                 }
 831                 kfree(context);
 832                 isec->sid = sid;
 833                 break;
 834         case SECURITY_FS_USE_TASK:
 835                 isec->sid = isec->task_sid;
 836                 break;
 837         case SECURITY_FS_USE_TRANS:
 838                 /* Default to the fs SID. */
 839                 isec->sid = sbsec->sid;
 840
 841                 /* Try to obtain a transition SID. */
 842                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 843                 rc = security_transition_sid(isec->task_sid,
 844                                              sbsec->sid,
 845                                              isec->sclass,
 846                                              &sid);
 847                 if (rc)
 848                         goto out;
 849                 isec->sid = sid;
 850                 break;
 851         default:
 852                 /* Default to the fs SID. */
 853                 isec->sid = sbsec->sid;
 854
 855                 if (sbsec->proc) {
 856                         struct proc_inode *proci = PROC_I(inode);
 857                         if (proci->pde) {
 858                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 859                                 rc = selinux_proc_get_sid(proci->pde,
 860                                                           isec->sclass,
 861                                                           &sid);
 862                                 if (rc)
 863                                         goto out;
 864                                 isec->sid = sid;
 865                         }
 866                 }
 867                 break;
 868         }
 869
 870         isec->initialized = 1;
 871
 872 out:
 873         if (inode->i_sock) {
 874                 struct socket *sock = SOCKET_I(inode);
 875                 if (sock->sk) {
 876                         isec->sclass = socket_type_to_security_class(sock->sk->sk_family,
 877                                                                      sock->sk->sk_type,
 878                                                                      sock->sk->sk_protocol);
 879                 } else {
 880                         isec->sclass = SECCLASS_SOCKET;
 881                 }
 882         } else {
 883                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 884         }
 885
 886         if (hold_sem)
 887                 up(&isec->sem);
 888         return rc;
 889 }
 890
 891 /* Convert a Linux signal to an access vector. */
 892 static inline u32 signal_to_av(int sig)
 893 {
 894         u32 perm = 0;
 895
 896         switch (sig) {
 897         case SIGCHLD:
 898                 /* Commonly granted from child to parent. */
 899                 perm = PROCESS__SIGCHLD;
 900                 break;
 901         case SIGKILL:
 902                 /* Cannot be caught or ignored */
 903                 perm = PROCESS__SIGKILL;
 904                 break;
 905         case SIGSTOP:
 906                 /* Cannot be caught or ignored */
 907                 perm = PROCESS__SIGSTOP;
 908                 break;
 909         default:
 910                 /* All other signals. */
 911                 perm = PROCESS__SIGNAL;
 912                 break;
 913         }
 914
 915         return perm;
 916 }
 917
 918 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 919    fork check, ptrace check, etc. */
 920 int task_has_perm(struct task_struct *tsk1,
 921                   struct task_struct *tsk2,
 922                   u32 perms)
 923 {
 924         struct task_security_struct *tsec1, *tsec2;
 925
 926         tsec1 = tsk1->security;
 927         tsec2 = tsk2->security;
 928         return avc_has_perm(tsec1->sid, tsec2->sid,
 929                             SECCLASS_PROCESS, perms, NULL);
 930 }
 931
 932 /* Check whether a task is allowed to use a capability. */
 933 int task_has_capability(struct task_struct *tsk,
 934                         int cap)
 935 {
 936         struct task_security_struct *tsec;
 937         struct avc_audit_data ad;
 938
 939         tsec = tsk->security;
 940
 941         AVC_AUDIT_DATA_INIT(&ad,CAP);
 942         ad.tsk = tsk;
 943         ad.u.cap = cap;
 944
 945         return avc_has_perm(tsec->sid, tsec->sid,
 946                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 947 }
 948
 949 /* Check whether a task is allowed to use a system operation. */
 950 int task_has_system(struct task_struct *tsk,
 951                     u32 perms)
 952 {
 953         struct task_security_struct *tsec;
 954
 955         tsec = tsk->security;
 956
 957         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 958                             SECCLASS_SYSTEM, perms, NULL);
 959 }
 960
 961 /* Check whether a task has a particular permission to an inode.
 962    The 'adp' parameter is optional and allows other audit
 963    data to be passed (e.g. the dentry). */
 964 int inode_has_perm(struct task_struct *tsk,
 965                    struct inode *inode,
 966                    u32 perms,
 967                    struct avc_audit_data *adp)
 968 {
 969         struct task_security_struct *tsec;
 970         struct inode_security_struct *isec;
 971         struct avc_audit_data ad;
 972
 973         tsec = tsk->security;
 974         isec = inode->i_security;
 975
 976         if (!adp) {
 977                 adp = &ad;
 978                 AVC_AUDIT_DATA_INIT(&ad, FS);
 979                 ad.u.fs.inode = inode;
 980         }
 981
 982         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 983 }
 984
 985 /* Same as inode_has_perm, but pass explicit audit data containing
 986    the dentry to help the auditing code to more easily generate the
 987    pathname if needed. */
 988 static inline int dentry_has_perm(struct task_struct *tsk,
 989                                   struct vfsmount *mnt,
 990                                   struct dentry *dentry,
 991                                   u32 av)
 992 {
 993         struct inode *inode = dentry->d_inode;
 994         struct avc_audit_data ad;
 995         AVC_AUDIT_DATA_INIT(&ad,FS);
 996         ad.u.fs.mnt = mnt;
 997         ad.u.fs.dentry = dentry;
 998         return inode_has_perm(tsk, inode, av, &ad);
 999 }
1000
1001 /* Check whether a task can use an open file descriptor to
1002    access an inode in a given way.  Check access to the
1003    descriptor itself, and then use dentry_has_perm to
1004    check a particular permission to the file.
1005    Access to the descriptor is implicitly granted if it
1006    has the same SID as the process.  If av is zero, then
1007    access to the file is not checked, e.g. for cases
1008    where only the descriptor is affected like seek. */
1009 static inline int file_has_perm(struct task_struct *tsk,
1010                                 struct file *file,
1011                                 u32 av)
1012 {
1013         struct task_security_struct *tsec = tsk->security;
1014         struct file_security_struct *fsec = file->f_security;
1015         struct vfsmount *mnt = file->f_vfsmnt;
1016         struct dentry *dentry = file->f_dentry;
1017         struct inode *inode = dentry->d_inode;
1018         struct avc_audit_data ad;
1019         int rc;
1020
1021         AVC_AUDIT_DATA_INIT(&ad, FS);
1022         ad.u.fs.mnt = mnt;
1023         ad.u.fs.dentry = dentry;
1024
1025         if (tsec->sid != fsec->sid) {
1026                 rc = avc_has_perm(tsec->sid, fsec->sid,
1027                                   SECCLASS_FD,
1028                                   FD__USE,
1029                                   &ad);
1030                 if (rc)
1031                         return rc;
1032         }
1033
1034         /* av is zero if only checking access to the descriptor. */
1035         if (av)
1036                 return inode_has_perm(tsk, inode, av, &ad);
1037
1038         return 0;
1039 }
1040
1041 /* Check whether a task can create a file. */
1042 static int may_create(struct inode *dir,
1043                       struct dentry *dentry,
1044                       u16 tclass)
1045 {
1046         struct task_security_struct *tsec;
1047         struct inode_security_struct *dsec;
1048         struct superblock_security_struct *sbsec;
1049         u32 newsid;
1050         struct avc_audit_data ad;
1051         int rc;
1052
1053         tsec = current->security;
1054         dsec = dir->i_security;
1055         sbsec = dir->i_sb->s_security;
1056
1057         AVC_AUDIT_DATA_INIT(&ad, FS);
1058         ad.u.fs.dentry = dentry;
1059
1060         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1061                           DIR__ADD_NAME | DIR__SEARCH,
1062                           &ad);
1063         if (rc)
1064                 return rc;
1065
1066         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1067                 newsid = tsec->create_sid;
1068         } else {
1069                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1070                                              &newsid);
1071                 if (rc)
1072                         return rc;
1073         }
1074
1075         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1076         if (rc)
1077                 return rc;
1078
1079         return avc_has_perm(newsid, sbsec->sid,
1080                             SECCLASS_FILESYSTEM,
1081                             FILESYSTEM__ASSOCIATE, &ad);
1082 }
1083
1084 #define MAY_LINK   0
1085 #define MAY_UNLINK 1
1086 #define MAY_RMDIR  2
1087
1088 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1089 static int may_link(struct inode *dir,
1090                     struct dentry *dentry,
1091                     int kind)
1092
1093 {
1094         struct task_security_struct *tsec;
1095         struct inode_security_struct *dsec, *isec;
1096         struct avc_audit_data ad;
1097         u32 av;
1098         int rc;
1099
1100         tsec = current->security;
1101         dsec = dir->i_security;
1102         isec = dentry->d_inode->i_security;
1103
1104         AVC_AUDIT_DATA_INIT(&ad, FS);
1105         ad.u.fs.dentry = dentry;
1106
1107         av = DIR__SEARCH;
1108         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1109         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1110         if (rc)
1111                 return rc;
1112
1113         switch (kind) {
1114         case MAY_LINK:
1115                 av = FILE__LINK;
1116                 break;
1117         case MAY_UNLINK:
1118                 av = FILE__UNLINK;
1119                 break;
1120         case MAY_RMDIR:
1121                 av = DIR__RMDIR;
1122                 break;
1123         default:
1124                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1125                 return 0;
1126         }
1127
1128         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1129         return rc;
1130 }
1131
1132 static inline int may_rename(struct inode *old_dir,
1133                              struct dentry *old_dentry,
1134                              struct inode *new_dir,
1135                              struct dentry *new_dentry)
1136 {
1137         struct task_security_struct *tsec;
1138         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1139         struct avc_audit_data ad;
1140         u32 av;
1141         int old_is_dir, new_is_dir;
1142         int rc;
1143
1144         tsec = current->security;
1145         old_dsec = old_dir->i_security;
1146         old_isec = old_dentry->d_inode->i_security;
1147         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1148         new_dsec = new_dir->i_security;
1149
1150         AVC_AUDIT_DATA_INIT(&ad, FS);
1151
1152         ad.u.fs.dentry = old_dentry;
1153         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1154                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1155         if (rc)
1156                 return rc;
1157         rc = avc_has_perm(tsec->sid, old_isec->sid,
1158                           old_isec->sclass, FILE__RENAME, &ad);
1159         if (rc)
1160                 return rc;
1161         if (old_is_dir && new_dir != old_dir) {
1162                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1163                                   old_isec->sclass, DIR__REPARENT, &ad);
1164                 if (rc)
1165                         return rc;
1166         }
1167
1168         ad.u.fs.dentry = new_dentry;
1169         av = DIR__ADD_NAME | DIR__SEARCH;
1170         if (new_dentry->d_inode)
1171                 av |= DIR__REMOVE_NAME;
1172         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1173         if (rc)
1174                 return rc;
1175         if (new_dentry->d_inode) {
1176                 new_isec = new_dentry->d_inode->i_security;
1177                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1178                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1179                                   new_isec->sclass,
1180                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1181                 if (rc)
1182                         return rc;
1183         }
1184
1185         return 0;
1186 }
1187
1188 /* Check whether a task can perform a filesystem operation. */
1189 int superblock_has_perm(struct task_struct *tsk,
1190                         struct super_block *sb,
1191                         u32 perms,
1192                         struct avc_audit_data *ad)
1193 {
1194         struct task_security_struct *tsec;
1195         struct superblock_security_struct *sbsec;
1196
1197         tsec = tsk->security;
1198         sbsec = sb->s_security;
1199         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1200                             perms, ad);
1201 }
1202
1203 /* Convert a Linux mode and permission mask to an access vector. */
1204 static inline u32 file_mask_to_av(int mode, int mask)
1205 {
1206         u32 av = 0;
1207
1208         if ((mode & S_IFMT) != S_IFDIR) {
1209                 if (mask & MAY_EXEC)
1210                         av |= FILE__EXECUTE;
1211                 if (mask & MAY_READ)
1212                         av |= FILE__READ;
1213
1214                 if (mask & MAY_APPEND)
1215                         av |= FILE__APPEND;
1216                 else if (mask & MAY_WRITE)
1217                         av |= FILE__WRITE;
1218
1219         } else {
1220                 if (mask & MAY_EXEC)
1221                         av |= DIR__SEARCH;
1222                 if (mask & MAY_WRITE)
1223                         av |= DIR__WRITE;
1224                 if (mask & MAY_READ)
1225                         av |= DIR__READ;
1226         }
1227
1228         return av;
1229 }
1230
1231 /* Convert a Linux file to an access vector. */
1232 static inline u32 file_to_av(struct file *file)
1233 {
1234         u32 av = 0;
1235
1236         if (file->f_mode & FMODE_READ)
1237                 av |= FILE__READ;
1238         if (file->f_mode & FMODE_WRITE) {
1239                 if (file->f_flags & O_APPEND)
1240                         av |= FILE__APPEND;
1241                 else
1242                         av |= FILE__WRITE;
1243         }
1244
1245         return av;
1246 }
1247
1248 /* Set an inode's SID to a specified value. */
1249 int inode_security_set_sid(struct inode *inode, u32 sid)
1250 {
1251         struct inode_security_struct *isec = inode->i_security;
1252         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1253
1254         if (!sbsec->initialized) {
1255                 /* Defer initialization to selinux_complete_init. */
1256                 return 0;
1257         }
1258
1259         down(&isec->sem);
1260         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1261         isec->sid = sid;
1262         isec->initialized = 1;
1263         up(&isec->sem);
1264         return 0;
1265 }
1266
1267 /* Set the security attributes on a newly created file. */
1268 static int post_create(struct inode *dir,
1269                        struct dentry *dentry)
1270 {
1271
1272         struct task_security_struct *tsec;
1273         struct inode *inode;
1274         struct inode_security_struct *dsec;
1275         struct superblock_security_struct *sbsec;
1276         u32 newsid;
1277         char *context;
1278         unsigned int len;
1279         int rc;
1280
1281         tsec = current->security;
1282         dsec = dir->i_security;
1283         sbsec = dir->i_sb->s_security;
1284
1285         inode = dentry->d_inode;
1286         if (!inode) {
1287                 /* Some file system types (e.g. NFS) may not instantiate
1288                    a dentry for all create operations (e.g. symlink),
1289                    so we have to check to see if the inode is non-NULL. */
1290                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1291                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1292                 return 0;
1293         }
1294
1295         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1296                 newsid = tsec->create_sid;
1297         } else {
1298                 rc = security_transition_sid(tsec->sid, dsec->sid,
1299                                              inode_mode_to_security_class(inode->i_mode),
1300                                              &newsid);
1301                 if (rc) {
1302                         printk(KERN_WARNING "post_create:  "
1303                                "security_transition_sid failed, rc=%d (dev=%s "
1304                                "ino=%ld)\n",
1305                                -rc, inode->i_sb->s_id, inode->i_ino);
1306                         return rc;
1307                 }
1308         }
1309
1310         rc = inode_security_set_sid(inode, newsid);
1311         if (rc) {
1312                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1313                        "failed, rc=%d (dev=%s ino=%ld)\n",
1314                        -rc, inode->i_sb->s_id, inode->i_ino);
1315                 return rc;
1316         }
1317
1318         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1319             inode->i_op->setxattr) {
1320                 /* Use extended attributes. */
1321                 rc = security_sid_to_context(newsid, &context, &len);
1322                 if (rc) {
1323                         printk(KERN_WARNING "post_create:  sid_to_context "
1324                                "failed, rc=%d (dev=%s ino=%ld)\n",
1325                                -rc, inode->i_sb->s_id, inode->i_ino);
1326                         return rc;
1327                 }
1328                 down(&inode->i_sem);
1329                 rc = inode->i_op->setxattr(dentry,
1330                                            XATTR_NAME_SELINUX,
1331                                            context, len, 0);
1332                 up(&inode->i_sem);
1333                 kfree(context);
1334                 if (rc < 0) {
1335                         printk(KERN_WARNING "post_create:  setxattr failed, "
1336                                "rc=%d (dev=%s ino=%ld)\n",
1337                                -rc, inode->i_sb->s_id, inode->i_ino);
1338                         return rc;
1339                 }
1340         }
1341
1342         return 0;
1343 }
1344
1345
1346 /* Hook functions begin here. */
1347
1348 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1349 {
1350         struct task_security_struct *psec = parent->security;
1351         struct task_security_struct *csec = child->security;
1352         int rc;
1353
1354         rc = secondary_ops->ptrace(parent,child);
1355         if (rc)
1356                 return rc;
1357
1358         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1359         /* Save the SID of the tracing process for later use in apply_creds. */
1360         if (!rc)
1361                 csec->ptrace_sid = psec->sid;
1362         return rc;
1363 }
1364
1365 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1366                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1367 {
1368         int error;
1369
1370         error = task_has_perm(current, target, PROCESS__GETCAP);
1371         if (error)
1372                 return error;
1373
1374         return secondary_ops->capget(target, effective, inheritable, permitted);
1375 }
1376
1377 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1378                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1379 {
1380         int error;
1381
1382         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1383         if (error)
1384                 return error;
1385
1386         return task_has_perm(current, target, PROCESS__SETCAP);
1387 }
1388
1389 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1390                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1391 {
1392         int error;
1393
1394         error = task_has_perm(current, target, PROCESS__SETCAP);
1395         if (error)
1396                 return;
1397
1398         secondary_ops->capset_set(target, effective, inheritable, permitted);
1399 }
1400
1401 static int selinux_capable(struct task_struct *tsk, int cap)
1402 {
1403         int rc;
1404
1405         rc = secondary_ops->capable(tsk, cap);
1406         if (rc)
1407                 return rc;
1408
1409         return task_has_capability(tsk,cap);
1410 }
1411
1412 static int selinux_sysctl(ctl_table *table, int op)
1413 {
1414         int error = 0;
1415         u32 av;
1416         struct task_security_struct *tsec;
1417         u32 tsid;
1418         int rc;
1419
1420         rc = secondary_ops->sysctl(table, op);
1421         if (rc)
1422                 return rc;
1423
1424         tsec = current->security;
1425
1426         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1427                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1428         if (rc) {
1429                 /* Default to the well-defined sysctl SID. */
1430                 tsid = SECINITSID_SYSCTL;
1431         }
1432
1433         /* The op values are "defined" in sysctl.c, thereby creating
1434          * a bad coupling between this module and sysctl.c */
1435         if(op == 001) {
1436                 error = avc_has_perm(tsec->sid, tsid,
1437                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1438         } else {
1439                 av = 0;
1440                 if (op & 004)
1441                         av |= FILE__READ;
1442                 if (op & 002)
1443                         av |= FILE__WRITE;
1444                 if (av)
1445                         error = avc_has_perm(tsec->sid, tsid,
1446                                              SECCLASS_FILE, av, NULL);
1447         }
1448
1449         return error;
1450 }
1451
1452 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1453 {
1454         int rc = 0;
1455
1456         if (!sb)
1457                 return 0;
1458
1459         switch (cmds) {
1460                 case Q_SYNC:
1461                 case Q_QUOTAON:
1462                 case Q_QUOTAOFF:
1463                 case Q_SETINFO:
1464                 case Q_SETQUOTA:
1465                         rc = superblock_has_perm(current,
1466                                                  sb,
1467                                                  FILESYSTEM__QUOTAMOD, NULL);
1468                         break;
1469                 case Q_GETFMT:
1470                 case Q_GETINFO:
1471                 case Q_GETQUOTA:
1472                         rc = superblock_has_perm(current,
1473                                                  sb,
1474                                                  FILESYSTEM__QUOTAGET, NULL);
1475                         break;
1476                 default:
1477                         rc = 0;  /* let the kernel handle invalid cmds */
1478                         break;
1479         }
1480         return rc;
1481 }
1482
1483 static int selinux_quota_on(struct file *f)
1484 {
1485         return file_has_perm(current, f, FILE__QUOTAON);
1486 }
1487
1488 static int selinux_syslog(int type)
1489 {
1490         int rc;
1491
1492         rc = secondary_ops->syslog(type);
1493         if (rc)
1494                 return rc;
1495
1496         switch (type) {
1497                 case 3:         /* Read last kernel messages */
1498                 case 10:        /* Return size of the log buffer */
1499                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1500                         break;
1501                 case 6:         /* Disable logging to console */
1502                 case 7:         /* Enable logging to console */
1503                 case 8:         /* Set level of messages printed to console */
1504                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1505                         break;
1506                 case 0:         /* Close log */
1507                 case 1:         /* Open log */
1508                 case 2:         /* Read from log */
1509                 case 4:         /* Read/clear last kernel messages */
1510                 case 5:         /* Clear ring buffer */
1511                 default:
1512                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1513                         break;
1514         }
1515         return rc;
1516 }
1517
1518 /*
1519  * Check that a process has enough memory to allocate a new virtual
1520  * mapping. 0 means there is enough memory for the allocation to
1521  * succeed and -ENOMEM implies there is not.
1522  *
1523  * We currently support three overcommit policies, which are set via the
1524  * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting
1525  *
1526  * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
1527  * Additional code 2002 Jul 20 by Robert Love.
1528  */
1529 static int selinux_vm_enough_memory(long pages)
1530 {
1531         unsigned long free, allowed;
1532         int rc;
1533         struct task_security_struct *tsec = current->security;
1534
1535         vm_acct_memory(pages);
1536
1537         /*
1538          * Sometimes we want to use more memory than we have
1539          */
1540         if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
1541                 return 0;
1542
1543         if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
1544                 free = get_page_cache_size();
1545                 free += nr_free_pages();
1546                 free += nr_swap_pages;
1547
1548                 /*
1549                  * Any slabs which are created with the
1550                  * SLAB_RECLAIM_ACCOUNT flag claim to have contents
1551                  * which are reclaimable, under pressure.  The dentry
1552                  * cache and most inode caches should fall into this
1553                  */
1554                 free += atomic_read(&slab_reclaim_pages);
1555
1556                 /*
1557                  * Leave the last 3% for privileged processes.
1558                  * Don't audit the check, as it is applied to all processes
1559                  * that allocate mappings.
1560                  */
1561                 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1562                 if (!rc) {
1563                         rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1564                                                   SECCLASS_CAPABILITY,
1565                                                   CAP_TO_MASK(CAP_SYS_ADMIN), NULL);
1566                 }
1567                 if (rc)
1568                         free -= free / 32;
1569
1570                 if (free > pages)
1571                         return 0;
1572                 vm_unacct_memory(pages);
1573                 return -ENOMEM;
1574         }
1575
1576         allowed = (totalram_pages - hugetlb_total_pages())
1577                 * sysctl_overcommit_ratio / 100;
1578         allowed += total_swap_pages;
1579
1580         if (atomic_read(&vm_committed_space) < allowed)
1581                 return 0;
1582
1583         vm_unacct_memory(pages);
1584
1585         return -ENOMEM;
1586 }
1587
1588 /* binprm security operations */
1589
1590 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1591 {
1592         struct bprm_security_struct *bsec;
1593
1594         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1595         if (!bsec)
1596                 return -ENOMEM;
1597
1598         memset(bsec, 0, sizeof *bsec);
1599         bsec->magic = SELINUX_MAGIC;
1600         bsec->bprm = bprm;
1601         bsec->sid = SECINITSID_UNLABELED;
1602         bsec->set = 0;
1603
1604         bprm->security = bsec;
1605         return 0;
1606 }
1607
1608 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1609 {
1610         struct task_security_struct *tsec;
1611         struct inode *inode = bprm->file->f_dentry->d_inode;
1612         struct inode_security_struct *isec;
1613         struct bprm_security_struct *bsec;
1614         u32 newsid;
1615         struct avc_audit_data ad;
1616         int rc;
1617
1618         rc = secondary_ops->bprm_set_security(bprm);
1619         if (rc)
1620                 return rc;
1621
1622         bsec = bprm->security;
1623
1624         if (bsec->set)
1625                 return 0;
1626
1627         tsec = current->security;
1628         isec = inode->i_security;
1629
1630         /* Default to the current task SID. */
1631         bsec->sid = tsec->sid;
1632
1633         /* Reset create SID on execve. */
1634         tsec->create_sid = 0;
1635
1636         if (tsec->exec_sid) {
1637                 newsid = tsec->exec_sid;
1638                 /* Reset exec SID on execve. */
1639                 tsec->exec_sid = 0;
1640         } else {
1641                 /* Check for a default transition on this program. */
1642                 rc = security_transition_sid(tsec->sid, isec->sid,
1643                                              SECCLASS_PROCESS, &newsid);
1644                 if (rc)
1645                         return rc;
1646         }
1647
1648         AVC_AUDIT_DATA_INIT(&ad, FS);
1649         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1650         ad.u.fs.dentry = bprm->file->f_dentry;
1651
1652         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1653                 newsid = tsec->sid;
1654
1655         if (tsec->sid == newsid) {
1656                 rc = avc_has_perm(tsec->sid, isec->sid,
1657                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1658                 if (rc)
1659                         return rc;
1660         } else {
1661                 /* Check permissions for the transition. */
1662                 rc = avc_has_perm(tsec->sid, newsid,
1663                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1664                 if (rc)
1665                         return rc;
1666
1667                 rc = avc_has_perm(newsid, isec->sid,
1668                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1669                 if (rc)
1670                         return rc;
1671
1672                 /* Clear any possibly unsafe personality bits on exec: */
1673                 current->personality &= ~PER_CLEAR_ON_SETID;
1674
1675                 /* Set the security field to the new SID. */
1676                 bsec->sid = newsid;
1677         }
1678
1679         bsec->set = 1;
1680         return 0;
1681 }
1682
1683 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1684 {
1685         return secondary_ops->bprm_check_security(bprm);
1686 }
1687
1688
1689 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1690 {
1691         struct task_security_struct *tsec = current->security;
1692         int atsecure = 0;
1693
1694         if (tsec->osid != tsec->sid) {
1695                 /* Enable secure mode for SIDs transitions unless
1696                    the noatsecure permission is granted between
1697                    the two SIDs, i.e. ahp returns 0. */
1698                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1699                                          SECCLASS_PROCESS,
1700                                          PROCESS__NOATSECURE, NULL);
1701         }
1702
1703         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1704 }
1705
1706 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1707 {
1708         struct bprm_security_struct *bsec = bprm->security;
1709         bprm->security = NULL;
1710         kfree(bsec);
1711 }
1712
1713 extern struct vfsmount *selinuxfs_mount;
1714 extern struct dentry *selinux_null;
1715
1716 /* Derived from fs/exec.c:flush_old_files. */
1717 static inline void flush_unauthorized_files(struct files_struct * files)
1718 {
1719         struct avc_audit_data ad;
1720         struct file *file, *devnull = NULL;
1721         struct tty_struct *tty = current->signal->tty;
1722         long j = -1;
1723
1724         if (tty) {
1725                 file_list_lock();
1726                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1727                 if (file) {
1728                         /* Revalidate access to controlling tty.
1729                            Use inode_has_perm on the tty inode directly rather
1730                            than using file_has_perm, as this particular open
1731                            file may belong to another process and we are only
1732                            interested in the inode-based check here. */
1733                         struct inode *inode = file->f_dentry->d_inode;
1734                         if (inode_has_perm(current, inode,
1735                                            FILE__READ | FILE__WRITE, NULL)) {
1736                                 /* Reset controlling tty. */
1737                                 current->signal->tty = NULL;
1738                                 current->signal->tty_old_pgrp = 0;
1739                         }
1740                 }
1741                 file_list_unlock();
1742         }
1743
1744         /* Revalidate access to inherited open files. */
1745
1746         AVC_AUDIT_DATA_INIT(&ad,FS);
1747
1748         spin_lock(&files->file_lock);
1749         for (;;) {
1750                 unsigned long set, i;
1751                 int fd;
1752
1753                 j++;
1754                 i = j * __NFDBITS;
1755                 if (i >= files->max_fds || i >= files->max_fdset)
1756                         break;
1757                 set = files->open_fds->fds_bits[j];
1758                 if (!set)
1759                         continue;
1760                 spin_unlock(&files->file_lock);
1761                 for ( ; set ; i++,set >>= 1) {
1762                         if (set & 1) {
1763                                 file = fget(i);
1764                                 if (!file)
1765                                         continue;
1766                                 if (file_has_perm(current,
1767                                                   file,
1768                                                   file_to_av(file))) {
1769                                         sys_close(i);
1770                                         fd = get_unused_fd();
1771                                         if (fd != i) {
1772                                                 if (fd >= 0)
1773                                                         put_unused_fd(fd);
1774                                                 fput(file);
1775                                                 continue;
1776                                         }
1777                                         if (devnull) {
1778                                                 atomic_inc(&devnull->f_count);
1779                                         } else {
1780                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1781                                                 if (!devnull) {
1782                                                         put_unused_fd(fd);
1783                                                         fput(file);
1784                                                         continue;
1785                                                 }
1786                                         }
1787                                         fd_install(fd, devnull);
1788                                 }
1789                                 fput(file);
1790                         }
1791                 }
1792                 spin_lock(&files->file_lock);
1793
1794         }
1795         spin_unlock(&files->file_lock);
1796 }
1797
1798 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1799 {
1800         struct task_security_struct *tsec;
1801         struct bprm_security_struct *bsec;
1802         u32 sid;
1803         struct av_decision avd;
1804         struct itimerval itimer;
1805         struct rlimit *rlim, *initrlim;
1806         int rc, i;
1807
1808         secondary_ops->bprm_apply_creds(bprm, unsafe);
1809
1810         tsec = current->security;
1811
1812         bsec = bprm->security;
1813         sid = bsec->sid;
1814
1815         tsec->osid = tsec->sid;
1816         if (tsec->sid != sid) {
1817                 /* Check for shared state.  If not ok, leave SID
1818                    unchanged and kill. */
1819                 if (unsafe & LSM_UNSAFE_SHARE) {
1820                         rc = avc_has_perm_noaudit(tsec->sid, sid,
1821                                           SECCLASS_PROCESS, PROCESS__SHARE, &avd);
1822                         if (rc) {
1823                                 task_unlock(current);
1824                                 avc_audit(tsec->sid, sid, SECCLASS_PROCESS,
1825                                     PROCESS__SHARE, &avd, rc, NULL);
1826                                 force_sig_specific(SIGKILL, current);
1827                                 goto lock_out;
1828                         }
1829                 }
1830
1831                 /* Check for ptracing, and update the task SID if ok.
1832                    Otherwise, leave SID unchanged and kill. */
1833                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1834                         rc = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
1835                                           SECCLASS_PROCESS, PROCESS__PTRACE, &avd);
1836                         if (!rc)
1837                                 tsec->sid = sid;
1838                         task_unlock(current);
1839                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
1840                                   PROCESS__PTRACE, &avd, rc, NULL);
1841                         if (rc) {
1842                                 force_sig_specific(SIGKILL, current);
1843                                 goto lock_out;
1844                         }
1845                 } else {
1846                         tsec->sid = sid;
1847                         task_unlock(current);
1848                 }
1849
1850                 /* Close files for which the new task SID is not authorized. */
1851                 flush_unauthorized_files(current->files);
1852
1853                 /* Check whether the new SID can inherit signal state
1854                    from the old SID.  If not, clear itimers to avoid
1855                    subsequent signal generation and flush and unblock
1856                    signals. This must occur _after_ the task SID has
1857                   been updated so that any kill done after the flush
1858                   will be checked against the new SID. */
1859                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1860                                   PROCESS__SIGINH, NULL);
1861                 if (rc) {
1862                         memset(&itimer, 0, sizeof itimer);
1863                         for (i = 0; i < 3; i++)
1864                                 do_setitimer(i, &itimer, NULL);
1865                         flush_signals(current);
1866                         spin_lock_irq(&current->sighand->siglock);
1867                         flush_signal_handlers(current, 1);
1868                         sigemptyset(&current->blocked);
1869                         recalc_sigpending();
1870                         spin_unlock_irq(&current->sighand->siglock);
1871                 }
1872
1873                 /* Check whether the new SID can inherit resource limits
1874                    from the old SID.  If not, reset all soft limits to
1875                    the lower of the current task's hard limit and the init
1876                    task's soft limit.  Note that the setting of hard limits
1877                    (even to lower them) can be controlled by the setrlimit
1878                    check. The inclusion of the init task's soft limit into
1879                    the computation is to avoid resetting soft limits higher
1880                    than the default soft limit for cases where the default
1881                    is lower than the hard limit, e.g. RLIMIT_CORE or
1882                    RLIMIT_STACK.*/
1883                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1884                                   PROCESS__RLIMITINH, NULL);
1885                 if (rc) {
1886                         for (i = 0; i < RLIM_NLIMITS; i++) {
1887                                 rlim = current->rlim + i;
1888                                 initrlim = init_task.rlim+i;
1889                                 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1890                         }
1891                 }
1892
1893                 /* Wake up the parent if it is waiting so that it can
1894                    recheck wait permission to the new task SID. */
1895                 wake_up_interruptible(&current->parent->wait_chldexit);
1896
1897 lock_out:
1898                 task_lock(current);
1899                 return;
1900         }
1901 }
1902
1903 /* superblock security operations */
1904
1905 static int selinux_sb_alloc_security(struct super_block *sb)
1906 {
1907         return superblock_alloc_security(sb);
1908 }
1909
1910 static void selinux_sb_free_security(struct super_block *sb)
1911 {
1912         superblock_free_security(sb);
1913 }
1914
1915 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1916 {
1917         if (plen > olen)
1918                 return 0;
1919
1920         return !memcmp(prefix, option, plen);
1921 }
1922
1923 static inline int selinux_option(char *option, int len)
1924 {
1925         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1926                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1927                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1928 }
1929
1930 static inline void take_option(char **to, char *from, int *first, int len)
1931 {
1932         if (!*first) {
1933                 **to = ',';
1934                 *to += 1;
1935         }
1936         else
1937                 *first = 0;
1938         memcpy(*to, from, len);
1939         *to += len;
1940 }
1941
1942 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1943 {
1944         int fnosec, fsec, rc = 0;
1945         char *in_save, *in_curr, *in_end;
1946         char *sec_curr, *nosec_save, *nosec;
1947
1948         in_curr = orig;
1949         sec_curr = copy;
1950
1951         /* Binary mount data: just copy */
1952         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1953                 copy_page(sec_curr, in_curr);
1954                 goto out;
1955         }
1956
1957         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1958         if (!nosec) {
1959                 rc = -ENOMEM;
1960                 goto out;
1961         }
1962
1963         nosec_save = nosec;
1964         fnosec = fsec = 1;
1965         in_save = in_end = orig;
1966
1967         do {
1968                 if (*in_end == ',' || *in_end == '\0') {
1969                         int len = in_end - in_curr;
1970
1971                         if (selinux_option(in_curr, len))
1972                                 take_option(&sec_curr, in_curr, &fsec, len);
1973                         else
1974                                 take_option(&nosec, in_curr, &fnosec, len);
1975
1976                         in_curr = in_end + 1;
1977                 }
1978         } while (*in_end++);
1979
1980         copy_page(in_save, nosec_save);
1981 out:
1982         return rc;
1983 }
1984
1985 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1986 {
1987         struct avc_audit_data ad;
1988         int rc;
1989
1990         rc = superblock_doinit(sb, data);
1991         if (rc)
1992                 return rc;
1993
1994         AVC_AUDIT_DATA_INIT(&ad,FS);
1995         ad.u.fs.dentry = sb->s_root;
1996         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1997 }
1998
1999 static int selinux_sb_statfs(struct super_block *sb)
2000 {
2001         struct avc_audit_data ad;
2002
2003         AVC_AUDIT_DATA_INIT(&ad,FS);
2004         ad.u.fs.dentry = sb->s_root;
2005         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
2006 }
2007
2008 static int selinux_mount(char * dev_name,
2009                          struct nameidata *nd,
2010                          char * type,
2011                          unsigned long flags,
2012                          void * data)
2013 {
2014         int rc;
2015
2016         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2017         if (rc)
2018                 return rc;
2019
2020         if (flags & MS_REMOUNT)
2021                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2022                                            FILESYSTEM__REMOUNT, NULL);
2023         else
2024                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2025                                        FILE__MOUNTON);
2026 }
2027
2028 static int selinux_umount(struct vfsmount *mnt, int flags)
2029 {
2030         int rc;
2031
2032         rc = secondary_ops->sb_umount(mnt, flags);
2033         if (rc)
2034                 return rc;
2035
2036         return superblock_has_perm(current,mnt->mnt_sb,
2037                                    FILESYSTEM__UNMOUNT,NULL);
2038 }
2039
2040 /* inode security operations */
2041
2042 static int selinux_inode_alloc_security(struct inode *inode)
2043 {
2044         return inode_alloc_security(inode);
2045 }
2046
2047 static void selinux_inode_free_security(struct inode *inode)
2048 {
2049         inode_free_security(inode);
2050 }
2051
2052 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2053 {
2054         return may_create(dir, dentry, SECCLASS_FILE);
2055 }
2056
2057 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2058 {
2059         post_create(dir, dentry);
2060 }
2061
2062 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2063 {
2064         int rc;
2065
2066         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2067         if (rc)
2068                 return rc;
2069         return may_link(dir, old_dentry, MAY_LINK);
2070 }
2071
2072 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2073 {
2074         return;
2075 }
2076
2077 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2078 {
2079         int rc;
2080
2081         rc = secondary_ops->inode_unlink(dir, dentry);
2082         if (rc)
2083                 return rc;
2084         return may_link(dir, dentry, MAY_UNLINK);
2085 }
2086
2087 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2088 {
2089         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2090 }
2091
2092 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2093 {
2094         post_create(dir, dentry);
2095 }
2096
2097 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2098 {
2099         return may_create(dir, dentry, SECCLASS_DIR);
2100 }
2101
2102 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2103 {
2104         post_create(dir, dentry);
2105 }
2106
2107 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2108 {
2109         return may_link(dir, dentry, MAY_RMDIR);
2110 }
2111
2112 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2113 {
2114         int rc;
2115
2116         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2117         if (rc)
2118                 return rc;
2119
2120         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2121 }
2122
2123 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2124 {
2125         post_create(dir, dentry);
2126 }
2127
2128 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2129                                 struct inode *new_inode, struct dentry *new_dentry)
2130 {
2131         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2132 }
2133
2134 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2135                                       struct inode *new_inode, struct dentry *new_dentry)
2136 {
2137         return;
2138 }
2139
2140 static int selinux_inode_readlink(struct dentry *dentry)
2141 {
2142         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2143 }
2144
2145 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2146 {
2147         int rc;
2148
2149         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2150         if (rc)
2151                 return rc;
2152         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2153 }
2154
2155 static int selinux_inode_permission(struct inode *inode, int mask,
2156                                     struct nameidata *nd)
2157 {
2158         int rc;
2159
2160         rc = secondary_ops->inode_permission(inode, mask, nd);
2161         if (rc)
2162                 return rc;
2163
2164         if (!mask) {
2165                 /* No permission to check.  Existence test. */
2166                 return 0;
2167         }
2168
2169         return inode_has_perm(current, inode,
2170                                file_mask_to_av(inode->i_mode, mask), NULL);
2171 }
2172
2173 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2174 {
2175         int rc;
2176
2177         rc = secondary_ops->inode_setattr(dentry, iattr);
2178         if (rc)
2179                 return rc;
2180
2181         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2182                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2183                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2184
2185         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2186 }
2187
2188 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2189 {
2190         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2191 }
2192
2193 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2194 {
2195         struct task_security_struct *tsec = current->security;
2196         struct inode *inode = dentry->d_inode;
2197         struct inode_security_struct *isec = inode->i_security;
2198         struct superblock_security_struct *sbsec;
2199         struct avc_audit_data ad;
2200         u32 newsid;
2201         int rc = 0;
2202
2203         if (strcmp(name, XATTR_NAME_SELINUX)) {
2204                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2205                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2206                     !capable(CAP_SYS_ADMIN)) {
2207                         /* A different attribute in the security namespace.
2208                            Restrict to administrator. */
2209                         return -EPERM;
2210                 }
2211
2212                 /* Not an attribute we recognize, so just check the
2213                    ordinary setattr permission. */
2214                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2215         }
2216
2217         sbsec = inode->i_sb->s_security;
2218         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2219                 return -EOPNOTSUPP;
2220
2221         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2222                 return -EPERM;
2223
2224         AVC_AUDIT_DATA_INIT(&ad,FS);
2225         ad.u.fs.dentry = dentry;
2226
2227         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2228                           FILE__RELABELFROM, &ad);
2229         if (rc)
2230                 return rc;
2231
2232         rc = security_context_to_sid(value, size, &newsid);
2233         if (rc)
2234                 return rc;
2235
2236         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2237                           FILE__RELABELTO, &ad);
2238         if (rc)
2239                 return rc;
2240
2241         return avc_has_perm(newsid,
2242                             sbsec->sid,
2243                             SECCLASS_FILESYSTEM,
2244                             FILESYSTEM__ASSOCIATE,
2245                             &ad);
2246 }
2247
2248 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2249                                         void *value, size_t size, int flags)
2250 {
2251         struct inode *inode = dentry->d_inode;
2252         struct inode_security_struct *isec = inode->i_security;
2253         u32 newsid;
2254         int rc;
2255
2256         if (strcmp(name, XATTR_NAME_SELINUX)) {
2257                 /* Not an attribute we recognize, so nothing to do. */
2258                 return;
2259         }
2260
2261         rc = security_context_to_sid(value, size, &newsid);
2262         if (rc) {
2263                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2264                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2265                 return;
2266         }
2267
2268         isec->sid = newsid;
2269         return;
2270 }
2271
2272 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2273 {
2274         struct inode *inode = dentry->d_inode;
2275         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2276
2277         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2278                 return -EOPNOTSUPP;
2279
2280         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2281 }
2282
2283 static int selinux_inode_listxattr (struct dentry *dentry)
2284 {
2285         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2286 }
2287
2288 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2289 {
2290         if (strcmp(name, XATTR_NAME_SELINUX)) {
2291                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2292                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2293                     !capable(CAP_SYS_ADMIN)) {
2294                         /* A different attribute in the security namespace.
2295                            Restrict to administrator. */
2296                         return -EPERM;
2297                 }
2298
2299                 /* Not an attribute we recognize, so just check the
2300                    ordinary setattr permission. Might want a separate
2301                    permission for removexattr. */
2302                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2303         }
2304
2305         /* No one is allowed to remove a SELinux security label.
2306            You can change the label, but all data must be labeled. */
2307         return -EACCES;
2308 }
2309
2310 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2311 {
2312         struct inode_security_struct *isec = inode->i_security;
2313         char *context;
2314         unsigned len;
2315         int rc;
2316
2317         /* Permission check handled by selinux_inode_getxattr hook.*/
2318
2319         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2320                 return -EOPNOTSUPP;
2321
2322         rc = security_sid_to_context(isec->sid, &context, &len);
2323         if (rc)
2324                 return rc;
2325
2326         if (!buffer || !size) {
2327                 kfree(context);
2328                 return len;
2329         }
2330         if (size < len) {
2331                 kfree(context);
2332                 return -ERANGE;
2333         }
2334         memcpy(buffer, context, len);
2335         kfree(context);
2336         return len;
2337 }
2338
2339 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2340                                      const void *value, size_t size, int flags)
2341 {
2342         struct inode_security_struct *isec = inode->i_security;
2343         u32 newsid;
2344         int rc;
2345
2346         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2347                 return -EOPNOTSUPP;
2348
2349         if (!value || !size)
2350                 return -EACCES;
2351
2352         rc = security_context_to_sid((void*)value, size, &newsid);
2353         if (rc)
2354                 return rc;
2355
2356         isec->sid = newsid;
2357         return 0;
2358 }
2359
2360 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2361 {
2362         const int len = sizeof(XATTR_NAME_SELINUX);
2363         if (buffer && len <= buffer_size)
2364                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2365         return len;
2366 }
2367
2368 /* file security operations */
2369
2370 static int selinux_file_permission(struct file *file, int mask)
2371 {
2372         struct inode *inode = file->f_dentry->d_inode;
2373
2374         if (!mask) {
2375                 /* No permission to check.  Existence test. */
2376                 return 0;
2377         }
2378
2379         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2380         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2381                 mask |= MAY_APPEND;
2382
2383         return file_has_perm(current, file,
2384                              file_mask_to_av(inode->i_mode, mask));
2385 }
2386
2387 static int selinux_file_alloc_security(struct file *file)
2388 {
2389         return file_alloc_security(file);
2390 }
2391
2392 static void selinux_file_free_security(struct file *file)
2393 {
2394         file_free_security(file);
2395 }
2396
2397 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2398                               unsigned long arg)
2399 {
2400         int error = 0;
2401
2402         switch (cmd) {
2403                 case FIONREAD:
2404                 /* fall through */
2405                 case FIBMAP:
2406                 /* fall through */
2407                 case FIGETBSZ:
2408                 /* fall through */
2409                 case EXT2_IOC_GETFLAGS:
2410                 /* fall through */
2411                 case EXT2_IOC_GETVERSION:
2412                         error = file_has_perm(current, file, FILE__GETATTR);
2413                         break;
2414
2415                 case EXT2_IOC_SETFLAGS:
2416                 /* fall through */
2417                 case EXT2_IOC_SETVERSION:
2418                         error = file_has_perm(current, file, FILE__SETATTR);
2419                         break;
2420
2421                 /* sys_ioctl() checks */
2422                 case FIONBIO:
2423                 /* fall through */
2424                 case FIOASYNC:
2425                         error = file_has_perm(current, file, 0);
2426                         break;
2427
2428                 case KDSKBENT:
2429                 case KDSKBSENT:
2430                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2431                         break;
2432
2433                 /* default case assumes that the command will go
2434                  * to the file's ioctl() function.
2435                  */
2436                 default:
2437                         error = file_has_perm(current, file, FILE__IOCTL);
2438
2439         }
2440         return error;
2441 }
2442
2443 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2444 {
2445         if (file) {
2446                 /* read access is always possible with a mapping */
2447                 u32 av = FILE__READ;
2448
2449                 /* write access only matters if the mapping is shared */
2450                 if (shared && (prot & PROT_WRITE))
2451                         av |= FILE__WRITE;
2452
2453                 if (prot & PROT_EXEC)
2454                         av |= FILE__EXECUTE;
2455
2456                 return file_has_perm(current, file, av);
2457         }
2458         return 0;
2459 }
2460
2461 static int selinux_file_mmap(struct file *file, unsigned long prot, unsigned long flags)
2462 {
2463         int rc;
2464
2465         rc = secondary_ops->file_mmap(file, prot, flags);
2466         if (rc)
2467                 return rc;
2468
2469         return file_map_prot_check(file, prot,
2470                                    (flags & MAP_TYPE) == MAP_SHARED);
2471 }
2472
2473 static int selinux_file_mprotect(struct vm_area_struct *vma,
2474                                  unsigned long prot)
2475 {
2476         int rc;
2477
2478         rc = secondary_ops->file_mprotect(vma, prot);
2479         if (rc)
2480                 return rc;
2481
2482         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2483 }
2484
2485 static int selinux_file_lock(struct file *file, unsigned int cmd)
2486 {
2487         return file_has_perm(current, file, FILE__LOCK);
2488 }
2489
2490 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2491                               unsigned long arg)
2492 {
2493         int err = 0;
2494
2495         switch (cmd) {
2496                 case F_SETFL:
2497                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2498                                 err = -EINVAL;
2499                                 break;
2500                         }
2501
2502                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2503                                 err = file_has_perm(current, file,FILE__WRITE);
2504                                 break;
2505                         }
2506                         /* fall through */
2507                 case F_SETOWN:
2508                 case F_SETSIG:
2509                 case F_GETFL:
2510                 case F_GETOWN:
2511                 case F_GETSIG:
2512                         /* Just check FD__USE permission */
2513                         err = file_has_perm(current, file, 0);
2514                         break;
2515                 case F_GETLK:
2516                 case F_SETLK:
2517                 case F_SETLKW:
2518 #if BITS_PER_LONG == 32
2519                 case F_GETLK64:
2520                 case F_SETLK64:
2521                 case F_SETLKW64:
2522 #endif
2523                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2524                                 err = -EINVAL;
2525                                 break;
2526                         }
2527                         err = file_has_perm(current, file, FILE__LOCK);
2528                         break;
2529         }
2530
2531         return err;
2532 }
2533
2534 static int selinux_file_set_fowner(struct file *file)
2535 {
2536         struct task_security_struct *tsec;
2537         struct file_security_struct *fsec;
2538
2539         tsec = current->security;
2540         fsec = file->f_security;
2541         fsec->fown_sid = tsec->sid;
2542
2543         return 0;
2544 }
2545
2546 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2547                                        struct fown_struct *fown,
2548                                        int signum)
2549 {
2550         struct file *file;
2551         u32 perm;
2552         struct task_security_struct *tsec;
2553         struct file_security_struct *fsec;
2554
2555         /* struct fown_struct is never outside the context of a struct file */
2556         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2557
2558         tsec = tsk->security;
2559         fsec = file->f_security;
2560
2561         if (!signum)
2562                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2563         else
2564                 perm = signal_to_av(signum);
2565
2566         return avc_has_perm(fsec->fown_sid, tsec->sid,
2567                             SECCLASS_PROCESS, perm, NULL);
2568 }
2569
2570 static int selinux_file_receive(struct file *file)
2571 {
2572         return file_has_perm(current, file, file_to_av(file));
2573 }
2574
2575 /* task security operations */
2576
2577 static int selinux_task_create(unsigned long clone_flags)
2578 {
2579         int rc;
2580
2581         rc = secondary_ops->task_create(clone_flags);
2582         if (rc)
2583                 return rc;
2584
2585         return task_has_perm(current, current, PROCESS__FORK);
2586 }
2587
2588 static int selinux_task_alloc_security(struct task_struct *tsk)
2589 {
2590         struct task_security_struct *tsec1, *tsec2;
2591         int rc;
2592
2593         tsec1 = current->security;
2594
2595         rc = task_alloc_security(tsk);
2596         if (rc)
2597                 return rc;
2598         tsec2 = tsk->security;
2599
2600         tsec2->osid = tsec1->osid;
2601         tsec2->sid = tsec1->sid;
2602
2603         /* Retain the exec and create SIDs across fork */
2604         tsec2->exec_sid = tsec1->exec_sid;
2605         tsec2->create_sid = tsec1->create_sid;
2606
2607         /* Retain ptracer SID across fork, if any.
2608            This will be reset by the ptrace hook upon any
2609            subsequent ptrace_attach operations. */
2610         tsec2->ptrace_sid = tsec1->ptrace_sid;
2611
2612         return 0;
2613 }
2614
2615 static void selinux_task_free_security(struct task_struct *tsk)
2616 {
2617         task_free_security(tsk);
2618 }
2619
2620 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2621 {
2622         /* Since setuid only affects the current process, and
2623            since the SELinux controls are not based on the Linux
2624            identity attributes, SELinux does not need to control
2625            this operation.  However, SELinux does control the use
2626            of the CAP_SETUID and CAP_SETGID capabilities using the
2627            capable hook. */
2628         return 0;
2629 }
2630
2631 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2632 {
2633         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2634 }
2635
2636 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2637 {
2638         /* See the comment for setuid above. */
2639         return 0;
2640 }
2641
2642 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2643 {
2644         return task_has_perm(current, p, PROCESS__SETPGID);
2645 }
2646
2647 static int selinux_task_getpgid(struct task_struct *p)
2648 {
2649         return task_has_perm(current, p, PROCESS__GETPGID);
2650 }
2651
2652 static int selinux_task_getsid(struct task_struct *p)
2653 {
2654         return task_has_perm(current, p, PROCESS__GETSESSION);
2655 }
2656
2657 static int selinux_task_setgroups(struct group_info *group_info)
2658 {
2659         /* See the comment for setuid above. */
2660         return 0;
2661 }
2662
2663 static int selinux_task_setnice(struct task_struct *p, int nice)
2664 {
2665         int rc;
2666
2667         rc = secondary_ops->task_setnice(p, nice);
2668         if (rc)
2669                 return rc;
2670
2671         return task_has_perm(current,p, PROCESS__SETSCHED);
2672 }
2673
2674 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2675 {
2676         struct rlimit *old_rlim = current->rlim + resource;
2677         int rc;
2678
2679         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2680         if (rc)
2681                 return rc;
2682
2683         /* Control the ability to change the hard limit (whether
2684            lowering or raising it), so that the hard limit can
2685            later be used as a safe reset point for the soft limit
2686            upon context transitions. See selinux_bprm_apply_creds. */
2687         if (old_rlim->rlim_max != new_rlim->rlim_max)
2688                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2689
2690         return 0;
2691 }
2692
2693 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2694 {
2695         struct task_security_struct *tsec1, *tsec2;
2696
2697         tsec1 = current->security;
2698         tsec2 = p->security;
2699
2700         /* No auditing from the setscheduler hook, since the runqueue lock
2701            is held and the system will deadlock if we try to log an audit
2702            message. */
2703         return avc_has_perm_noaudit(tsec1->sid, tsec2->sid,
2704                                     SECCLASS_PROCESS, PROCESS__SETSCHED, NULL);
2705 }
2706
2707 static int selinux_task_getscheduler(struct task_struct *p)
2708 {
2709         return task_has_perm(current, p, PROCESS__GETSCHED);
2710 }
2711
2712 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2713 {
2714         u32 perm;
2715         int rc;
2716
2717         rc = secondary_ops->task_kill(p, info, sig);
2718         if (rc)
2719                 return rc;
2720
2721         if (info && ((unsigned long)info == 1 ||
2722                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2723                 return 0;
2724
2725         if (!sig)
2726                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2727         else
2728                 perm = signal_to_av(sig);
2729
2730         return task_has_perm(current, p, perm);
2731 }
2732
2733 static int selinux_task_prctl(int option,
2734                               unsigned long arg2,
2735                               unsigned long arg3,
2736                               unsigned long arg4,
2737                               unsigned long arg5)
2738 {
2739         /* The current prctl operations do not appear to require
2740            any SELinux controls since they merely observe or modify
2741            the state of the current process. */
2742         return 0;
2743 }
2744
2745 static int selinux_task_wait(struct task_struct *p)
2746 {
2747         u32 perm;
2748
2749         perm = signal_to_av(p->exit_signal);
2750
2751         return task_has_perm(p, current, perm);
2752 }
2753
2754 static void selinux_task_reparent_to_init(struct task_struct *p)
2755 {
2756         struct task_security_struct *tsec;
2757
2758         secondary_ops->task_reparent_to_init(p);
2759
2760         tsec = p->security;
2761         tsec->osid = tsec->sid;
2762         tsec->sid = SECINITSID_KERNEL;
2763         return;
2764 }
2765
2766 static void selinux_task_to_inode(struct task_struct *p,
2767                                   struct inode *inode)
2768 {
2769         struct task_security_struct *tsec = p->security;
2770         struct inode_security_struct *isec = inode->i_security;
2771
2772         isec->sid = tsec->sid;
2773         isec->initialized = 1;
2774         return;
2775 }
2776
2777 #ifdef CONFIG_SECURITY_NETWORK
2778
2779 /* Returns error only if unable to parse addresses */
2780 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2781 {
2782         int offset, ihlen, ret = -EINVAL;
2783         struct iphdr _iph, *ih;
2784
2785         offset = skb->nh.raw - skb->data;
2786         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2787         if (ih == NULL)
2788                 goto out;
2789
2790         ihlen = ih->ihl * 4;
2791         if (ihlen < sizeof(_iph))
2792                 goto out;
2793
2794         ad->u.net.v4info.saddr = ih->saddr;
2795         ad->u.net.v4info.daddr = ih->daddr;
2796         ret = 0;
2797
2798         switch (ih->protocol) {
2799         case IPPROTO_TCP: {
2800                 struct tcphdr _tcph, *th;
2801
2802                 if (ntohs(ih->frag_off) & IP_OFFSET)
2803                         break;
2804
2805                 offset += ihlen;
2806                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2807                 if (th == NULL)
2808                         break;
2809
2810                 ad->u.net.sport = th->source;
2811                 ad->u.net.dport = th->dest;
2812                 break;
2813         }
2814
2815         case IPPROTO_UDP: {
2816                 struct udphdr _udph, *uh;
2817
2818                 if (ntohs(ih->frag_off) & IP_OFFSET)
2819                         break;
2820
2821                 offset += ihlen;
2822                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2823                 if (uh == NULL)
2824                         break;
2825
2826                 ad->u.net.sport = uh->source;
2827                 ad->u.net.dport = uh->dest;
2828                 break;
2829         }
2830
2831         default:
2832                 break;
2833         }
2834 out:
2835         return ret;
2836 }
2837
2838 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2839
2840 /* Returns error only if unable to parse addresses */
2841 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2842 {
2843         u8 nexthdr;
2844         int ret = -EINVAL, offset;
2845         struct ipv6hdr _ipv6h, *ip6;
2846
2847         offset = skb->nh.raw - skb->data;
2848         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2849         if (ip6 == NULL)
2850                 goto out;
2851
2852         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2853         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2854         ret = 0;
2855
2856         nexthdr = ip6->nexthdr;
2857         offset += sizeof(_ipv6h);
2858         offset = ipv6_skip_exthdr(skb, offset, &nexthdr,
2859                                   skb->tail - skb->head - offset);
2860         if (offset < 0)
2861                 goto out;
2862
2863         switch (nexthdr) {
2864         case IPPROTO_TCP: {
2865                 struct tcphdr _tcph, *th;
2866
2867                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2868                 if (th == NULL)
2869                         break;
2870
2871                 ad->u.net.sport = th->source;
2872                 ad->u.net.dport = th->dest;
2873                 break;
2874         }
2875
2876         case IPPROTO_UDP: {
2877                 struct udphdr _udph, *uh;
2878
2879                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2880                 if (uh == NULL)
2881                         break;
2882
2883                 ad->u.net.sport = uh->source;
2884                 ad->u.net.dport = uh->dest;
2885                 break;
2886         }
2887
2888         /* includes fragments */
2889         default:
2890                 break;
2891         }
2892 out:
2893         return ret;
2894 }
2895
2896 #endif /* IPV6 */
2897
2898 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2899                              char **addrp, int *len, int src)
2900 {
2901         int ret = 0;
2902
2903         switch (ad->u.net.family) {
2904         case PF_INET:
2905                 ret = selinux_parse_skb_ipv4(skb, ad);
2906                 if (ret || !addrp)
2907                         break;
2908                 *len = 4;
2909                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2910                                         &ad->u.net.v4info.daddr);
2911                 break;
2912
2913 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2914         case PF_INET6:
2915                 ret = selinux_parse_skb_ipv6(skb, ad);
2916                 if (ret || !addrp)
2917                         break;
2918                 *len = 16;
2919                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2920                                         &ad->u.net.v6info.daddr);
2921                 break;
2922 #endif  /* IPV6 */
2923         default:
2924                 break;
2925         }
2926
2927         return ret;
2928 }
2929
2930 /* socket security operations */
2931 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2932                            u32 perms)
2933 {
2934         struct inode_security_struct *isec;
2935         struct task_security_struct *tsec;
2936         struct avc_audit_data ad;
2937         int err = 0;
2938
2939         tsec = task->security;
2940         isec = SOCK_INODE(sock)->i_security;
2941
2942         if (isec->sid == SECINITSID_KERNEL)
2943                 goto out;
2944
2945         AVC_AUDIT_DATA_INIT(&ad,NET);
2946         ad.u.net.sk = sock->sk;
2947         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2948
2949 out:
2950         return err;
2951 }
2952
2953 static int selinux_socket_create(int family, int type,
2954                                  int protocol, int kern)
2955 {
2956         int err = 0;
2957         struct task_security_struct *tsec;
2958
2959         if (kern)
2960                 goto out;
2961
2962         tsec = current->security;
2963         err = avc_has_perm(tsec->sid, tsec->sid,
2964                            socket_type_to_security_class(family, type,
2965                            protocol), SOCKET__CREATE, NULL);
2966
2967 out:
2968         return err;
2969 }
2970
2971 static void selinux_socket_post_create(struct socket *sock, int family,
2972                                        int type, int protocol, int kern)
2973 {
2974         int err;
2975         struct inode_security_struct *isec;
2976         struct task_security_struct *tsec;
2977
2978         err = inode_doinit(SOCK_INODE(sock));
2979         if (err < 0)
2980                 return;
2981         isec = SOCK_INODE(sock)->i_security;
2982
2983         tsec = current->security;
2984         isec->sclass = socket_type_to_security_class(family, type, protocol);
2985         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2986
2987         return;
2988 }
2989
2990 /* Range of port numbers used to automatically bind.
2991    Need to determine whether we should perform a name_bind
2992    permission check between the socket and the port number. */
2993 #define ip_local_port_range_0 sysctl_local_port_range[0]
2994 #define ip_local_port_range_1 sysctl_local_port_range[1]
2995
2996 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2997 {
2998         u16 family;
2999         int err;
3000
3001         err = socket_has_perm(current, sock, SOCKET__BIND);
3002         if (err)
3003                 goto out;
3004
3005         /*
3006          * If PF_INET or PF_INET6, check name_bind permission for the port.
3007          */
3008         family = sock->sk->sk_family;
3009         if (family == PF_INET || family == PF_INET6) {
3010                 char *addrp;
3011                 struct inode_security_struct *isec;
3012                 struct task_security_struct *tsec;
3013                 struct avc_audit_data ad;
3014                 struct sockaddr_in *addr4 = NULL;
3015                 struct sockaddr_in6 *addr6 = NULL;
3016                 unsigned short snum;
3017                 struct sock *sk = sock->sk;
3018                 u32 sid, node_perm, addrlen;
3019
3020                 tsec = current->security;
3021                 isec = SOCK_INODE(sock)->i_security;
3022
3023                 if (family == PF_INET) {
3024                         addr4 = (struct sockaddr_in *)address;
3025                         snum = ntohs(addr4->sin_port);
3026                         addrlen = sizeof(addr4->sin_addr.s_addr);
3027                         addrp = (char *)&addr4->sin_addr.s_addr;
3028                 } else {
3029                         addr6 = (struct sockaddr_in6 *)address;
3030                         snum = ntohs(addr6->sin6_port);
3031                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3032                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3033                 }
3034
3035                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3036                            snum > ip_local_port_range_1)) {
3037                         err = security_port_sid(sk->sk_family, sk->sk_type,
3038                                                 sk->sk_protocol, snum, &sid);
3039                         if (err)
3040                                 goto out;
3041                         AVC_AUDIT_DATA_INIT(&ad,NET);
3042                         ad.u.net.sport = htons(snum);
3043                         ad.u.net.family = family;
3044                         err = avc_has_perm(isec->sid, sid,
3045                                            isec->sclass,
3046                                            SOCKET__NAME_BIND, &ad);
3047                         if (err)
3048                                 goto out;
3049                 }
3050
3051                 switch(sk->sk_protocol) {
3052                 case IPPROTO_TCP:
3053                         node_perm = TCP_SOCKET__NODE_BIND;
3054                         break;
3055
3056                 case IPPROTO_UDP:
3057                         node_perm = UDP_SOCKET__NODE_BIND;
3058                         break;
3059
3060                 default:
3061                         node_perm = RAWIP_SOCKET__NODE_BIND;
3062                         break;
3063                 }
3064
3065                 err = security_node_sid(family, addrp, addrlen, &sid);
3066                 if (err)
3067                         goto out;
3068
3069                 AVC_AUDIT_DATA_INIT(&ad,NET);
3070                 ad.u.net.sport = htons(snum);
3071                 ad.u.net.family = family;
3072
3073                 if (family == PF_INET)
3074                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3075                 else
3076                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3077
3078                 err = avc_has_perm(isec->sid, sid,
3079                                    isec->sclass, node_perm, &ad);
3080                 if (err)
3081                         goto out;
3082         }
3083 out:
3084         return err;
3085 }
3086
3087 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3088 {
3089         return socket_has_perm(current, sock, SOCKET__CONNECT);
3090 }
3091
3092 static int selinux_socket_listen(struct socket *sock, int backlog)
3093 {
3094         return socket_has_perm(current, sock, SOCKET__LISTEN);
3095 }
3096
3097 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3098 {
3099         int err;
3100         struct inode_security_struct *isec;
3101         struct inode_security_struct *newisec;
3102
3103         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3104         if (err)
3105                 return err;
3106
3107         err = inode_doinit(SOCK_INODE(newsock));
3108         if (err < 0)
3109                 return err;
3110         newisec = SOCK_INODE(newsock)->i_security;
3111
3112         isec = SOCK_INODE(sock)->i_security;
3113         newisec->sclass = isec->sclass;
3114         newisec->sid = isec->sid;
3115
3116         return 0;
3117 }
3118
3119 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3120                                   int size)
3121 {
3122         return socket_has_perm(current, sock, SOCKET__WRITE);
3123 }
3124
3125 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3126                                   int size, int flags)
3127 {
3128         return socket_has_perm(current, sock, SOCKET__READ);
3129 }
3130
3131 static int selinux_socket_getsockname(struct socket *sock)
3132 {
3133         return socket_has_perm(current, sock, SOCKET__GETATTR);
3134 }
3135
3136 static int selinux_socket_getpeername(struct socket *sock)
3137 {
3138         return socket_has_perm(current, sock, SOCKET__GETATTR);
3139 }
3140
3141 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3142 {
3143         return socket_has_perm(current, sock, SOCKET__SETOPT);
3144 }
3145
3146 static int selinux_socket_getsockopt(struct socket *sock, int level,
3147                                      int optname)
3148 {
3149         return socket_has_perm(current, sock, SOCKET__GETOPT);
3150 }
3151
3152 static int selinux_socket_shutdown(struct socket *sock, int how)
3153 {
3154         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3155 }
3156
3157 static int selinux_socket_unix_stream_connect(struct socket *sock,
3158                                               struct socket *other,
3159                                               struct sock *newsk)
3160 {
3161         struct sk_security_struct *ssec;
3162         struct inode_security_struct *isec;
3163         struct inode_security_struct *other_isec;
3164         struct avc_audit_data ad;
3165         int err;
3166
3167         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3168         if (err)
3169                 return err;
3170
3171         isec = SOCK_INODE(sock)->i_security;
3172         other_isec = SOCK_INODE(other)->i_security;
3173
3174         AVC_AUDIT_DATA_INIT(&ad,NET);
3175         ad.u.net.sk = other->sk;
3176
3177         err = avc_has_perm(isec->sid, other_isec->sid,
3178                            isec->sclass,
3179                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3180         if (err)
3181                 return err;
3182
3183         /* connecting socket */
3184         ssec = sock->sk->sk_security;
3185         ssec->peer_sid = other_isec->sid;
3186
3187         /* server child socket */
3188         ssec = newsk->sk_security;
3189         ssec->peer_sid = isec->sid;
3190
3191         return 0;
3192 }
3193
3194 static int selinux_socket_unix_may_send(struct socket *sock,
3195                                         struct socket *other)
3196 {
3197         struct inode_security_struct *isec;
3198         struct inode_security_struct *other_isec;
3199         struct avc_audit_data ad;
3200         int err;
3201
3202         isec = SOCK_INODE(sock)->i_security;
3203         other_isec = SOCK_INODE(other)->i_security;
3204
3205         AVC_AUDIT_DATA_INIT(&ad,NET);
3206         ad.u.net.sk = other->sk;
3207
3208         err = avc_has_perm(isec->sid, other_isec->sid,
3209                            isec->sclass, SOCKET__SENDTO, &ad);
3210         if (err)
3211                 return err;
3212
3213         return 0;
3214 }
3215
3216 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3217 {
3218         u16 family;
3219         char *addrp;
3220         int len, err = 0;
3221         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3222         u32 sock_sid = 0;
3223         u16 sock_class = 0;
3224         struct socket *sock;
3225         struct net_device *dev;
3226         struct avc_audit_data ad;
3227
3228         family = sk->sk_family;
3229         if (family != PF_INET && family != PF_INET6)
3230                 goto out;
3231
3232         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3233         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3234                 family = PF_INET;
3235
3236         read_lock_bh(&sk->sk_callback_lock);
3237         sock = sk->sk_socket;
3238         if (sock) {
3239                 struct inode *inode;
3240                 inode = SOCK_INODE(sock);
3241                 if (inode) {
3242                         struct inode_security_struct *isec;
3243                         isec = inode->i_security;
3244                         sock_sid = isec->sid;
3245                         sock_class = isec->sclass;
3246                 }
3247         }
3248         read_unlock_bh(&sk->sk_callback_lock);
3249         if (!sock_sid)
3250                 goto out;
3251
3252         dev = skb->dev;
3253         if (!dev)
3254                 goto out;
3255
3256         err = sel_netif_sids(dev, &if_sid, NULL);
3257         if (err)
3258                 goto out;
3259
3260         switch (sock_class) {
3261         case SECCLASS_UDP_SOCKET:
3262                 netif_perm = NETIF__UDP_RECV;
3263                 node_perm = NODE__UDP_RECV;
3264                 recv_perm = UDP_SOCKET__RECV_MSG;
3265                 break;
3266
3267         case SECCLASS_TCP_SOCKET:
3268                 netif_perm = NETIF__TCP_RECV;
3269                 node_perm = NODE__TCP_RECV;
3270                 recv_perm = TCP_SOCKET__RECV_MSG;
3271                 break;
3272
3273         default:
3274                 netif_perm = NETIF__RAWIP_RECV;
3275                 node_perm = NODE__RAWIP_RECV;
3276                 break;
3277         }
3278
3279         AVC_AUDIT_DATA_INIT(&ad, NET);
3280         ad.u.net.netif = dev->name;
3281         ad.u.net.family = family;
3282
3283         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3284         if (err)
3285                 goto out;
3286
3287         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3288         if (err)
3289                 goto out;
3290
3291         /* Fixme: this lookup is inefficient */
3292         err = security_node_sid(family, addrp, len, &node_sid);
3293         if (err)
3294                 goto out;
3295
3296         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3297         if (err)
3298                 goto out;
3299
3300         if (recv_perm) {
3301                 u32 port_sid;
3302
3303                 /* Fixme: make this more efficient */
3304                 err = security_port_sid(sk->sk_family, sk->sk_type,
3305                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3306                                         &port_sid);
3307                 if (err)
3308                         goto out;
3309
3310                 err = avc_has_perm(sock_sid, port_sid,
3311                                    sock_class, recv_perm, &ad);
3312         }
3313 out:
3314         return err;
3315 }
3316
3317 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3318                                      int __user *optlen, unsigned len)
3319 {
3320         int err = 0;
3321         char *scontext;
3322         u32 scontext_len;
3323         struct sk_security_struct *ssec;
3324         struct inode_security_struct *isec;
3325
3326         isec = SOCK_INODE(sock)->i_security;
3327         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3328                 err = -ENOPROTOOPT;
3329                 goto out;
3330         }
3331
3332         ssec = sock->sk->sk_security;
3333
3334         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3335         if (err)
3336                 goto out;
3337
3338         if (scontext_len > len) {
3339                 err = -ERANGE;
3340                 goto out_len;
3341         }
3342
3343         if (copy_to_user(optval, scontext, scontext_len))
3344                 err = -EFAULT;
3345
3346 out_len:
3347         if (put_user(scontext_len, optlen))
3348                 err = -EFAULT;
3349
3350         kfree(scontext);
3351 out:
3352         return err;
3353 }
3354
3355 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3356 {
3357         return sk_alloc_security(sk, family, priority);
3358 }
3359
3360 static void selinux_sk_free_security(struct sock *sk)
3361 {
3362         sk_free_security(sk);
3363 }
3364
3365 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3366 {
3367         int err = 0;
3368         u32 perm;
3369         struct nlmsghdr *nlh;
3370         struct socket *sock = sk->sk_socket;
3371         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3372
3373         if (skb->len < NLMSG_SPACE(0)) {
3374                 err = -EINVAL;
3375                 goto out;
3376         }
3377         nlh = (struct nlmsghdr *)skb->data;
3378
3379         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3380         if (err) {
3381                 /* Ignore */
3382                 if (err == -ENOENT)
3383                         err = 0;
3384                 goto out;
3385         }
3386
3387         err = socket_has_perm(current, sock, perm);
3388 out:
3389         return err;
3390 }
3391
3392 #ifdef CONFIG_NETFILTER
3393
3394 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3395                                               struct sk_buff **pskb,
3396                                               const struct net_device *in,
3397                                               const struct net_device *out,
3398                                               int (*okfn)(struct sk_buff *),
3399                                               u16 family)
3400 {
3401         char *addrp;
3402         int len, err = NF_ACCEPT;
3403         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3404         struct sock *sk;
3405         struct socket *sock;
3406         struct inode *inode;
3407         struct sk_buff *skb = *pskb;
3408         struct inode_security_struct *isec;
3409         struct avc_audit_data ad;
3410         struct net_device *dev = (struct net_device *)out;
3411
3412         sk = skb->sk;
3413         if (!sk)
3414                 goto out;
3415
3416         sock = sk->sk_socket;
3417         if (!sock)
3418                 goto out;
3419
3420         inode = SOCK_INODE(sock);
3421         if (!inode)
3422                 goto out;
3423
3424         err = sel_netif_sids(dev, &if_sid, NULL);
3425         if (err)
3426                 goto out;
3427
3428         isec = inode->i_security;
3429
3430         switch (isec->sclass) {
3431         case SECCLASS_UDP_SOCKET:
3432                 netif_perm = NETIF__UDP_SEND;
3433                 node_perm = NODE__UDP_SEND;
3434                 send_perm = UDP_SOCKET__SEND_MSG;
3435                 break;
3436
3437         case SECCLASS_TCP_SOCKET:
3438                 netif_perm = NETIF__TCP_SEND;
3439                 node_perm = NODE__TCP_SEND;
3440                 send_perm = TCP_SOCKET__SEND_MSG;
3441                 break;
3442
3443         default:
3444                 netif_perm = NETIF__RAWIP_SEND;
3445                 node_perm = NODE__RAWIP_SEND;
3446                 break;
3447         }
3448
3449
3450         AVC_AUDIT_DATA_INIT(&ad, NET);
3451         ad.u.net.netif = dev->name;
3452         ad.u.net.family = family;
3453
3454         err = selinux_parse_skb(skb, &ad, &addrp,
3455                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3456         if (err != NF_ACCEPT)
3457                 goto out;
3458
3459         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3460                            netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3461         if (err != NF_ACCEPT)
3462                 goto out;
3463
3464         /* Fixme: this lookup is inefficient */
3465         err = security_node_sid(family, addrp, len,
3466                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3467         if (err != NF_ACCEPT)
3468                 goto out;
3469
3470         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3471                            node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3472         if (err != NF_ACCEPT)
3473                 goto out;
3474
3475         if (send_perm) {
3476                 u32 port_sid;
3477
3478                 /* Fixme: make this more efficient */
3479                 err = security_port_sid(sk->sk_family,
3480                                         sk->sk_type,
3481                                         sk->sk_protocol,
3482                                         ntohs(ad.u.net.dport),
3483                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3484                 if (err != NF_ACCEPT)
3485                         goto out;
3486
3487                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3488                                    send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3489         }
3490
3491 out:
3492         return err;
3493 }
3494
3495 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3496                                                 struct sk_buff **pskb,
3497                                                 const struct net_device *in,
3498                                                 const struct net_device *out,
3499                                                 int (*okfn)(struct sk_buff *))
3500 {
3501         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3502 }
3503
3504 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3505
3506 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3507                                                 struct sk_buff **pskb,
3508                                                 const struct net_device *in,
3509                                                 const struct net_device *out,
3510                                                 int (*okfn)(struct sk_buff *))
3511 {
3512         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3513 }
3514
3515 #endif  /* IPV6 */
3516
3517 #endif  /* CONFIG_NETFILTER */
3518
3519 #else
3520
3521 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3522 {
3523         return 0;
3524 }
3525
3526 #endif  /* CONFIG_SECURITY_NETWORK */
3527
3528 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3529 {
3530         int err = 0;
3531
3532         if (capable(CAP_NET_ADMIN))
3533                 cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
3534         else
3535                 NETLINK_CB(skb).eff_cap = 0;
3536
3537         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3538                 err = selinux_nlmsg_perm(sk, skb);
3539
3540         return err;
3541 }
3542
3543 static int selinux_netlink_recv(struct sk_buff *skb)
3544 {
3545         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3546                 return -EPERM;
3547         return 0;
3548 }
3549
3550 static int ipc_alloc_security(struct task_struct *task,
3551                               struct kern_ipc_perm *perm,
3552                               u16 sclass)
3553 {
3554         struct task_security_struct *tsec = task->security;
3555         struct ipc_security_struct *isec;
3556
3557         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3558         if (!isec)
3559                 return -ENOMEM;
3560
3561         memset(isec, 0, sizeof(struct ipc_security_struct));
3562         isec->magic = SELINUX_MAGIC;
3563         isec->sclass = sclass;
3564         isec->ipc_perm = perm;
3565         if (tsec) {
3566                 isec->sid = tsec->sid;
3567         } else {
3568                 isec->sid = SECINITSID_UNLABELED;
3569         }
3570         perm->security = isec;
3571
3572         return 0;
3573 }
3574
3575 static void ipc_free_security(struct kern_ipc_perm *perm)
3576 {
3577         struct ipc_security_struct *isec = perm->security;
3578         if (!isec || isec->magic != SELINUX_MAGIC)
3579                 return;
3580
3581         perm->security = NULL;
3582         kfree(isec);
3583 }
3584
3585 static int msg_msg_alloc_security(struct msg_msg *msg)
3586 {
3587         struct msg_security_struct *msec;
3588
3589         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3590         if (!msec)
3591                 return -ENOMEM;
3592
3593         memset(msec, 0, sizeof(struct msg_security_struct));
3594         msec->magic = SELINUX_MAGIC;
3595         msec->msg = msg;
3596         msec->sid = SECINITSID_UNLABELED;
3597         msg->security = msec;
3598
3599         return 0;
3600 }
3601
3602 static void msg_msg_free_security(struct msg_msg *msg)
3603 {
3604         struct msg_security_struct *msec = msg->security;
3605         if (!msec || msec->magic != SELINUX_MAGIC)
3606                 return;
3607
3608         msg->security = NULL;
3609         kfree(msec);
3610 }
3611
3612 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3613                         u16 sclass, u32 perms)
3614 {
3615         struct task_security_struct *tsec;
3616         struct ipc_security_struct *isec;
3617         struct avc_audit_data ad;
3618
3619         tsec = current->security;
3620         isec = ipc_perms->security;
3621
3622         AVC_AUDIT_DATA_INIT(&ad, IPC);
3623         ad.u.ipc_id = ipc_perms->key;
3624
3625         return avc_has_perm(tsec->sid, isec->sid, sclass, perms, &ad);
3626 }
3627
3628 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3629 {
3630         return msg_msg_alloc_security(msg);
3631 }
3632
3633 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3634 {
3635         msg_msg_free_security(msg);
3636 }
3637
3638 /* message queue security operations */
3639 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3640 {
3641         struct task_security_struct *tsec;
3642         struct ipc_security_struct *isec;
3643         struct avc_audit_data ad;
3644         int rc;
3645
3646         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3647         if (rc)
3648                 return rc;
3649
3650         tsec = current->security;
3651         isec = msq->q_perm.security;
3652
3653         AVC_AUDIT_DATA_INIT(&ad, IPC);
3654         ad.u.ipc_id = msq->q_perm.key;
3655
3656         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3657                           MSGQ__CREATE, &ad);
3658         if (rc) {
3659                 ipc_free_security(&msq->q_perm);
3660                 return rc;
3661         }
3662         return 0;
3663 }
3664
3665 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3666 {
3667         ipc_free_security(&msq->q_perm);
3668 }
3669
3670 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3671 {
3672         struct task_security_struct *tsec;
3673         struct ipc_security_struct *isec;
3674         struct avc_audit_data ad;
3675
3676         tsec = current->security;
3677         isec = msq->q_perm.security;
3678
3679         AVC_AUDIT_DATA_INIT(&ad, IPC);
3680         ad.u.ipc_id = msq->q_perm.key;
3681
3682         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3683                             MSGQ__ASSOCIATE, &ad);
3684 }
3685
3686 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3687 {
3688         int err;
3689         int perms;
3690
3691         switch(cmd) {
3692         case IPC_INFO:
3693         case MSG_INFO:
3694                 /* No specific object, just general system-wide information. */
3695                 return task_has_system(current, SYSTEM__IPC_INFO);
3696         case IPC_STAT:
3697         case MSG_STAT:
3698                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3699                 break;
3700         case IPC_SET:
3701                 perms = MSGQ__SETATTR;
3702                 break;
3703         case IPC_RMID:
3704                 perms = MSGQ__DESTROY;
3705                 break;
3706         default:
3707                 return 0;
3708         }
3709
3710         err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
3711         return err;
3712 }
3713
3714 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3715 {
3716         struct task_security_struct *tsec;
3717         struct ipc_security_struct *isec;
3718         struct msg_security_struct *msec;
3719         struct avc_audit_data ad;
3720         int rc;
3721
3722         tsec = current->security;
3723         isec = msq->q_perm.security;
3724         msec = msg->security;
3725
3726         /*
3727          * First time through, need to assign label to the message
3728          */
3729         if (msec->sid == SECINITSID_UNLABELED) {
3730                 /*
3731                  * Compute new sid based on current process and
3732                  * message queue this message will be stored in
3733                  */
3734                 rc = security_transition_sid(tsec->sid,
3735                                              isec->sid,
3736                                              SECCLASS_MSG,
3737                                              &msec->sid);
3738                 if (rc)
3739                         return rc;
3740         }
3741
3742         AVC_AUDIT_DATA_INIT(&ad, IPC);
3743         ad.u.ipc_id = msq->q_perm.key;
3744
3745         /* Can this process write to the queue? */
3746         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3747                           MSGQ__WRITE, &ad);
3748         if (!rc)
3749                 /* Can this process send the message */
3750                 rc = avc_has_perm(tsec->sid, msec->sid,
3751                                   SECCLASS_MSG, MSG__SEND, &ad);
3752         if (!rc)
3753                 /* Can the message be put in the queue? */
3754                 rc = avc_has_perm(msec->sid, isec->sid,
3755                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3756
3757         return rc;
3758 }
3759
3760 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3761                                     struct task_struct *target,
3762                                     long type, int mode)
3763 {
3764         struct task_security_struct *tsec;
3765         struct ipc_security_struct *isec;
3766         struct msg_security_struct *msec;
3767         struct avc_audit_data ad;
3768         int rc;
3769
3770         tsec = target->security;
3771         isec = msq->q_perm.security;
3772         msec = msg->security;
3773
3774         AVC_AUDIT_DATA_INIT(&ad, IPC);
3775         ad.u.ipc_id = msq->q_perm.key;
3776
3777         rc = avc_has_perm(tsec->sid, isec->sid,
3778                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3779         if (!rc)
3780                 rc = avc_has_perm(tsec->sid, msec->sid,
3781                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3782         return rc;
3783 }
3784
3785 /* Shared Memory security operations */
3786 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3787 {
3788         struct task_security_struct *tsec;
3789         struct ipc_security_struct *isec;
3790         struct avc_audit_data ad;
3791         int rc;
3792
3793         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3794         if (rc)
3795                 return rc;
3796
3797         tsec = current->security;
3798         isec = shp->shm_perm.security;
3799
3800         AVC_AUDIT_DATA_INIT(&ad, IPC);
3801         ad.u.ipc_id = shp->shm_perm.key;
3802
3803         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3804                           SHM__CREATE, &ad);
3805         if (rc) {
3806                 ipc_free_security(&shp->shm_perm);
3807                 return rc;
3808         }
3809         return 0;
3810 }
3811
3812 static void selinux_shm_free_security(struct shmid_kernel *shp)
3813 {
3814         ipc_free_security(&shp->shm_perm);
3815 }
3816
3817 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3818 {
3819         struct task_security_struct *tsec;
3820         struct ipc_security_struct *isec;
3821         struct avc_audit_data ad;
3822
3823         tsec = current->security;
3824         isec = shp->shm_perm.security;
3825
3826         AVC_AUDIT_DATA_INIT(&ad, IPC);
3827         ad.u.ipc_id = shp->shm_perm.key;
3828
3829         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3830                             SHM__ASSOCIATE, &ad);
3831 }
3832
3833 /* Note, at this point, shp is locked down */
3834 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3835 {
3836         int perms;
3837         int err;
3838
3839         switch(cmd) {
3840         case IPC_INFO:
3841         case SHM_INFO:
3842                 /* No specific object, just general system-wide information. */
3843                 return task_has_system(current, SYSTEM__IPC_INFO);
3844         case IPC_STAT:
3845         case SHM_STAT:
3846                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3847                 break;
3848         case IPC_SET:
3849                 perms = SHM__SETATTR;
3850                 break;
3851         case SHM_LOCK:
3852         case SHM_UNLOCK:
3853                 perms = SHM__LOCK;
3854                 break;
3855         case IPC_RMID:
3856                 perms = SHM__DESTROY;
3857                 break;
3858         default:
3859                 return 0;
3860         }
3861
3862         err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3863         return err;
3864 }
3865
3866 static int selinux_shm_shmat(struct shmid_kernel *shp,
3867                              char __user *shmaddr, int shmflg)
3868 {
3869         u32 perms;
3870         int rc;
3871
3872         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3873         if (rc)
3874                 return rc;
3875
3876         if (shmflg & SHM_RDONLY)
3877                 perms = SHM__READ;
3878         else
3879                 perms = SHM__READ | SHM__WRITE;
3880
3881         return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3882 }
3883
3884 /* Semaphore security operations */
3885 static int selinux_sem_alloc_security(struct sem_array *sma)
3886 {
3887         struct task_security_struct *tsec;
3888         struct ipc_security_struct *isec;
3889         struct avc_audit_data ad;
3890         int rc;
3891
3892         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3893         if (rc)
3894                 return rc;
3895
3896         tsec = current->security;
3897         isec = sma->sem_perm.security;
3898
3899         AVC_AUDIT_DATA_INIT(&ad, IPC);
3900         ad.u.ipc_id = sma->sem_perm.key;
3901
3902         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3903                           SEM__CREATE, &ad);
3904         if (rc) {
3905                 ipc_free_security(&sma->sem_perm);
3906                 return rc;
3907         }
3908         return 0;
3909 }
3910
3911 static void selinux_sem_free_security(struct sem_array *sma)
3912 {
3913         ipc_free_security(&sma->sem_perm);
3914 }
3915
3916 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3917 {
3918         struct task_security_struct *tsec;
3919         struct ipc_security_struct *isec;
3920         struct avc_audit_data ad;
3921
3922         tsec = current->security;
3923         isec = sma->sem_perm.security;
3924
3925         AVC_AUDIT_DATA_INIT(&ad, IPC);
3926         ad.u.ipc_id = sma->sem_perm.key;
3927
3928         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3929                             SEM__ASSOCIATE, &ad);
3930 }
3931
3932 /* Note, at this point, sma is locked down */
3933 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3934 {
3935         int err;
3936         u32 perms;
3937
3938         switch(cmd) {
3939         case IPC_INFO:
3940         case SEM_INFO:
3941                 /* No specific object, just general system-wide information. */
3942                 return task_has_system(current, SYSTEM__IPC_INFO);
3943         case GETPID:
3944         case GETNCNT:
3945         case GETZCNT:
3946                 perms = SEM__GETATTR;
3947                 break;
3948         case GETVAL:
3949         case GETALL:
3950                 perms = SEM__READ;
3951                 break;
3952         case SETVAL:
3953         case SETALL:
3954                 perms = SEM__WRITE;
3955                 break;
3956         case IPC_RMID:
3957                 perms = SEM__DESTROY;
3958                 break;
3959         case IPC_SET:
3960                 perms = SEM__SETATTR;
3961                 break;
3962         case IPC_STAT:
3963         case SEM_STAT:
3964                 perms = SEM__GETATTR | SEM__ASSOCIATE;
3965                 break;
3966         default:
3967                 return 0;
3968         }
3969
3970         err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
3971         return err;
3972 }
3973
3974 static int selinux_sem_semop(struct sem_array *sma,
3975                              struct sembuf *sops, unsigned nsops, int alter)
3976 {
3977         u32 perms;
3978
3979         if (alter)
3980                 perms = SEM__READ | SEM__WRITE;
3981         else
3982                 perms = SEM__READ;
3983
3984         return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
3985 }
3986
3987 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
3988 {
3989         struct ipc_security_struct *isec = ipcp->security;
3990         u16 sclass = SECCLASS_IPC;
3991         u32 av = 0;
3992
3993         if (isec && isec->magic == SELINUX_MAGIC)
3994                 sclass = isec->sclass;
3995
3996         av = 0;
3997         if (flag & S_IRUGO)
3998                 av |= IPC__UNIX_READ;
3999         if (flag & S_IWUGO)
4000                 av |= IPC__UNIX_WRITE;
4001
4002         if (av == 0)
4003                 return 0;
4004
4005         return ipc_has_perm(ipcp, sclass, av);
4006 }
4007
4008 /* module stacking operations */
4009 int selinux_register_security (const char *name, struct security_operations *ops)
4010 {
4011         if (secondary_ops != original_ops) {
4012                 printk(KERN_INFO "%s:  There is already a secondary security "
4013                        "module registered.\n", __FUNCTION__);
4014                 return -EINVAL;
4015         }
4016
4017         secondary_ops = ops;
4018
4019         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4020                __FUNCTION__,
4021                name);
4022
4023         return 0;
4024 }
4025
4026 int selinux_unregister_security (const char *name, struct security_operations *ops)
4027 {
4028         if (ops != secondary_ops) {
4029                 printk (KERN_INFO "%s:  trying to unregister a security module "
4030                         "that is not registered.\n", __FUNCTION__);
4031                 return -EINVAL;
4032         }
4033
4034         secondary_ops = original_ops;
4035
4036         return 0;
4037 }
4038
4039 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4040 {
4041         if (inode)
4042                 inode_doinit_with_dentry(inode, dentry);
4043 }
4044
4045 static int selinux_getprocattr(struct task_struct *p,
4046                                char *name, void *value, size_t size)
4047 {
4048         struct task_security_struct *tsec;
4049         u32 sid, len;
4050         char *context;
4051         int error;
4052
4053         if (current != p) {
4054                 error = task_has_perm(current, p, PROCESS__GETATTR);
4055                 if (error)
4056                         return error;
4057         }
4058
4059         if (!size)
4060                 return -ERANGE;
4061
4062         tsec = p->security;
4063
4064         if (!strcmp(name, "current"))
4065                 sid = tsec->sid;
4066         else if (!strcmp(name, "prev"))
4067                 sid = tsec->osid;
4068         else if (!strcmp(name, "exec"))
4069                 sid = tsec->exec_sid;
4070         else if (!strcmp(name, "fscreate"))
4071                 sid = tsec->create_sid;
4072         else
4073                 return -EINVAL;
4074
4075         if (!sid)
4076                 return 0;
4077
4078         error = security_sid_to_context(sid, &context, &len);
4079         if (error)
4080                 return error;
4081         if (len > size) {
4082                 kfree(context);
4083                 return -ERANGE;
4084         }
4085         memcpy(value, context, len);
4086         kfree(context);
4087         return len;
4088 }
4089
4090 static int selinux_setprocattr(struct task_struct *p,
4091                                char *name, void *value, size_t size)
4092 {
4093         struct task_security_struct *tsec;
4094         u32 sid = 0;
4095         int error;
4096
4097         if (current != p || !strcmp(name, "current")) {
4098                 /* SELinux only allows a process to change its own
4099                    security attributes, and it only allows the process
4100                    current SID to change via exec. */
4101                 return -EACCES;
4102         }
4103
4104         /*
4105          * Basic control over ability to set these attributes at all.
4106          * current == p, but we'll pass them separately in case the
4107          * above restriction is ever removed.
4108          */
4109         if (!strcmp(name, "exec"))
4110                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4111         else if (!strcmp(name, "fscreate"))
4112                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4113         else
4114                 error = -EINVAL;
4115         if (error)
4116                 return error;
4117
4118         /* Obtain a SID for the context, if one was specified. */
4119         if (size) {
4120                 int error;
4121                 error = security_context_to_sid(value, size, &sid);
4122                 if (error)
4123                         return error;
4124         }
4125
4126         /* Permission checking based on the specified context is
4127            performed during the actual operation (execve,
4128            open/mkdir/...), when we know the full context of the
4129            operation.  See selinux_bprm_set_security for the execve
4130            checks and may_create for the file creation checks. The
4131            operation will then fail if the context is not permitted. */
4132         tsec = p->security;
4133         if (!strcmp(name, "exec"))
4134                 tsec->exec_sid = sid;
4135         else if (!strcmp(name, "fscreate"))
4136                 tsec->create_sid = sid;
4137         else
4138                 return -EINVAL;
4139
4140         return size;
4141 }
4142
4143 struct security_operations selinux_ops = {
4144         .ptrace =                       selinux_ptrace,
4145         .capget =                       selinux_capget,
4146         .capset_check =                 selinux_capset_check,
4147         .capset_set =                   selinux_capset_set,
4148         .sysctl =                       selinux_sysctl,
4149         .capable =                      selinux_capable,
4150         .quotactl =                     selinux_quotactl,
4151         .quota_on =                     selinux_quota_on,
4152         .syslog =                       selinux_syslog,
4153         .vm_enough_memory =             selinux_vm_enough_memory,
4154
4155         .netlink_send =                 selinux_netlink_send,
4156         .netlink_recv =                 selinux_netlink_recv,
4157
4158         .bprm_alloc_security =          selinux_bprm_alloc_security,
4159         .bprm_free_security =           selinux_bprm_free_security,
4160         .bprm_apply_creds =             selinux_bprm_apply_creds,
4161         .bprm_set_security =            selinux_bprm_set_security,
4162         .bprm_check_security =          selinux_bprm_check_security,
4163         .bprm_secureexec =              selinux_bprm_secureexec,
4164
4165         .sb_alloc_security =            selinux_sb_alloc_security,
4166         .sb_free_security =             selinux_sb_free_security,
4167         .sb_copy_data =                 selinux_sb_copy_data,
4168         .sb_kern_mount =                selinux_sb_kern_mount,
4169         .sb_statfs =                    selinux_sb_statfs,
4170         .sb_mount =                     selinux_mount,
4171         .sb_umount =                    selinux_umount,
4172
4173         .inode_alloc_security =         selinux_inode_alloc_security,
4174         .inode_free_security =          selinux_inode_free_security,
4175         .inode_create =                 selinux_inode_create,
4176         .inode_post_create =            selinux_inode_post_create,
4177         .inode_link =                   selinux_inode_link,
4178         .inode_post_link =              selinux_inode_post_link,
4179         .inode_unlink =                 selinux_inode_unlink,
4180         .inode_symlink =                selinux_inode_symlink,
4181         .inode_post_symlink =           selinux_inode_post_symlink,
4182         .inode_mkdir =                  selinux_inode_mkdir,
4183         .inode_post_mkdir =             selinux_inode_post_mkdir,
4184         .inode_rmdir =                  selinux_inode_rmdir,
4185         .inode_mknod =                  selinux_inode_mknod,
4186         .inode_post_mknod =             selinux_inode_post_mknod,
4187         .inode_rename =                 selinux_inode_rename,
4188         .inode_post_rename =            selinux_inode_post_rename,
4189         .inode_readlink =               selinux_inode_readlink,
4190         .inode_follow_link =            selinux_inode_follow_link,
4191         .inode_permission =             selinux_inode_permission,
4192         .inode_setattr =                selinux_inode_setattr,
4193         .inode_getattr =                selinux_inode_getattr,
4194         .inode_setxattr =               selinux_inode_setxattr,
4195         .inode_post_setxattr =          selinux_inode_post_setxattr,
4196         .inode_getxattr =               selinux_inode_getxattr,
4197         .inode_listxattr =              selinux_inode_listxattr,
4198         .inode_removexattr =            selinux_inode_removexattr,
4199         .inode_getsecurity =            selinux_inode_getsecurity,
4200         .inode_setsecurity =            selinux_inode_setsecurity,
4201         .inode_listsecurity =           selinux_inode_listsecurity,
4202
4203         .file_permission =              selinux_file_permission,
4204         .file_alloc_security =          selinux_file_alloc_security,
4205         .file_free_security =           selinux_file_free_security,
4206         .file_ioctl =                   selinux_file_ioctl,
4207         .file_mmap =                    selinux_file_mmap,
4208         .file_mprotect =                selinux_file_mprotect,
4209         .file_lock =                    selinux_file_lock,
4210         .file_fcntl =                   selinux_file_fcntl,
4211         .file_set_fowner =              selinux_file_set_fowner,
4212         .file_send_sigiotask =          selinux_file_send_sigiotask,
4213         .file_receive =                 selinux_file_receive,
4214
4215         .task_create =                  selinux_task_create,
4216         .task_alloc_security =          selinux_task_alloc_security,
4217         .task_free_security =           selinux_task_free_security,
4218         .task_setuid =                  selinux_task_setuid,
4219         .task_post_setuid =             selinux_task_post_setuid,
4220         .task_setgid =                  selinux_task_setgid,
4221         .task_setpgid =                 selinux_task_setpgid,
4222         .task_getpgid =                 selinux_task_getpgid,
4223         .task_getsid =                  selinux_task_getsid,
4224         .task_setgroups =               selinux_task_setgroups,
4225         .task_setnice =                 selinux_task_setnice,
4226         .task_setrlimit =               selinux_task_setrlimit,
4227         .task_setscheduler =            selinux_task_setscheduler,
4228         .task_getscheduler =            selinux_task_getscheduler,
4229         .task_kill =                    selinux_task_kill,
4230         .task_wait =                    selinux_task_wait,
4231         .task_prctl =                   selinux_task_prctl,
4232         .task_reparent_to_init =        selinux_task_reparent_to_init,
4233         .task_to_inode =                selinux_task_to_inode,
4234
4235         .ipc_permission =               selinux_ipc_permission,
4236
4237         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4238         .msg_msg_free_security =        selinux_msg_msg_free_security,
4239
4240         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4241         .msg_queue_free_security =      selinux_msg_queue_free_security,
4242         .msg_queue_associate =          selinux_msg_queue_associate,
4243         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4244         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4245         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4246
4247         .shm_alloc_security =           selinux_shm_alloc_security,
4248         .shm_free_security =            selinux_shm_free_security,
4249         .shm_associate =                selinux_shm_associate,
4250         .shm_shmctl =                   selinux_shm_shmctl,
4251         .shm_shmat =                    selinux_shm_shmat,
4252
4253         .sem_alloc_security =           selinux_sem_alloc_security,
4254         .sem_free_security =            selinux_sem_free_security,
4255         .sem_associate =                selinux_sem_associate,
4256         .sem_semctl =                   selinux_sem_semctl,
4257         .sem_semop =                    selinux_sem_semop,
4258
4259         .register_security =            selinux_register_security,
4260         .unregister_security =          selinux_unregister_security,
4261
4262         .d_instantiate =                selinux_d_instantiate,
4263
4264         .getprocattr =                  selinux_getprocattr,
4265         .setprocattr =                  selinux_setprocattr,
4266
4267 #ifdef CONFIG_SECURITY_NETWORK
4268         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4269         .unix_may_send =                selinux_socket_unix_may_send,
4270
4271         .socket_create =                selinux_socket_create,
4272         .socket_post_create =           selinux_socket_post_create,
4273         .socket_bind =                  selinux_socket_bind,
4274         .socket_connect =               selinux_socket_connect,
4275         .socket_listen =                selinux_socket_listen,
4276         .socket_accept =                selinux_socket_accept,
4277         .socket_sendmsg =               selinux_socket_sendmsg,
4278         .socket_recvmsg =               selinux_socket_recvmsg,
4279         .socket_getsockname =           selinux_socket_getsockname,
4280         .socket_getpeername =           selinux_socket_getpeername,
4281         .socket_getsockopt =            selinux_socket_getsockopt,
4282         .socket_setsockopt =            selinux_socket_setsockopt,
4283         .socket_shutdown =              selinux_socket_shutdown,
4284         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4285         .socket_getpeersec =            selinux_socket_getpeersec,
4286         .sk_alloc_security =            selinux_sk_alloc_security,
4287         .sk_free_security =             selinux_sk_free_security,
4288 #endif
4289 };
4290
4291 __init int selinux_init(void)
4292 {
4293         struct task_security_struct *tsec;
4294
4295         if (!selinux_enabled) {
4296                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4297                 return 0;
4298         }
4299
4300         printk(KERN_INFO "SELinux:  Initializing.\n");
4301
4302         /* Set the security state for the initial task. */
4303         if (task_alloc_security(current))
4304                 panic("SELinux:  Failed to initialize initial task.\n");
4305         tsec = current->security;
4306         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4307
4308         avc_init();
4309
4310         original_ops = secondary_ops = security_ops;
4311         if (!secondary_ops)
4312                 panic ("SELinux: No initial security operations\n");
4313         if (register_security (&selinux_ops))
4314                 panic("SELinux: Unable to register with kernel.\n");
4315
4316         if (selinux_enforcing) {
4317                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4318         } else {
4319                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4320         }
4321         return 0;
4322 }
4323
4324 void selinux_complete_init(void)
4325 {
4326         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4327
4328         /* Set up any superblocks initialized prior to the policy load. */
4329         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4330         spin_lock(&sb_security_lock);
4331 next_sb:
4332         if (!list_empty(&superblock_security_head)) {
4333                 struct superblock_security_struct *sbsec =
4334                                 list_entry(superblock_security_head.next,
4335                                            struct superblock_security_struct,
4336                                            list);
4337                 struct super_block *sb = sbsec->sb;
4338                 spin_lock(&sb_lock);
4339                 sb->s_count++;
4340                 spin_unlock(&sb_lock);
4341                 spin_unlock(&sb_security_lock);
4342                 down_read(&sb->s_umount);
4343                 if (sb->s_root)
4344                         superblock_doinit(sb, NULL);
4345                 drop_super(sb);
4346                 spin_lock(&sb_security_lock);
4347                 list_del_init(&sbsec->list);
4348                 goto next_sb;
4349         }
4350         spin_unlock(&sb_security_lock);
4351 }
4352
4353 /* SELinux requires early initialization in order to label
4354    all processes and objects when they are created. */
4355 security_initcall(selinux_init);
4356
4357 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4358
4359 static struct nf_hook_ops selinux_ipv4_op = {
4360         .hook =         selinux_ipv4_postroute_last,
4361         .owner =        THIS_MODULE,
4362         .pf =           PF_INET,
4363         .hooknum =      NF_IP_POST_ROUTING,
4364         .priority =     NF_IP_PRI_SELINUX_LAST,
4365 };
4366
4367 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4368
4369 static struct nf_hook_ops selinux_ipv6_op = {
4370         .hook =         selinux_ipv6_postroute_last,
4371         .owner =        THIS_MODULE,
4372         .pf =           PF_INET6,
4373         .hooknum =      NF_IP6_POST_ROUTING,
4374         .priority =     NF_IP6_PRI_SELINUX_LAST,
4375 };
4376
4377 #endif  /* IPV6 */
4378
4379 static int __init selinux_nf_ip_init(void)
4380 {
4381         int err = 0;
4382
4383         if (!selinux_enabled)
4384                 goto out;
4385
4386         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4387
4388         err = nf_register_hook(&selinux_ipv4_op);
4389         if (err)
4390                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4391
4392 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4393
4394         err = nf_register_hook(&selinux_ipv6_op);
4395         if (err)
4396                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4397
4398 #endif  /* IPV6 */
4399 out:
4400         return err;
4401 }
4402
4403 __initcall(selinux_nf_ip_init);
4404
4405 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4406 static void selinux_nf_ip_exit(void)
4407 {
4408         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4409
4410         nf_unregister_hook(&selinux_ipv4_op);
4411 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4412         nf_unregister_hook(&selinux_ipv6_op);
4413 #endif  /* IPV6 */
4414 }
4415 #endif
4416
4417 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4418
4419 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4420 #define selinux_nf_ip_exit()
4421 #endif
4422
4423 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4424
4425 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4426 int selinux_disable(void)
4427 {
4428         extern void exit_sel_fs(void);
4429         static int selinux_disabled = 0;
4430
4431         if (ss_initialized) {
4432                 /* Not permitted after initial policy load. */
4433                 return -EINVAL;
4434         }
4435
4436         if (selinux_disabled) {
4437                 /* Only do this once. */
4438                 return -EINVAL;
4439         }
4440
4441         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4442
4443         selinux_disabled = 1;
4444
4445         /* Reset security_ops to the secondary module, dummy or capability. */
4446         security_ops = secondary_ops;
4447
4448         /* Unregister netfilter hooks. */
4449         selinux_nf_ip_exit();
4450
4451         /* Unregister selinuxfs. */
4452         exit_sel_fs();
4453
4454         return 0;
4455 }
4456 #endif
4457
4458