security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/init.h>
  23 #include <linux/kernel.h>
  24 #include <linux/ptrace.h>
  25 #include <linux/errno.h>
  26 #include <linux/sched.h>
  27 #include <linux/security.h>
  28 #include <linux/xattr.h>
  29 #include <linux/capability.h>
  30 #include <linux/unistd.h>
  31 #include <linux/mm.h>
  32 #include <linux/mman.h>
  33 #include <linux/slab.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/swap.h>
  36 #include <linux/smp_lock.h>
  37 #include <linux/spinlock.h>
  38 #include <linux/syscalls.h>
  39 #include <linux/file.h>
  40 #include <linux/namei.h>
  41 #include <linux/mount.h>
  42 #include <linux/ext2_fs.h>
  43 #include <linux/proc_fs.h>
  44 #include <linux/kd.h>
  45 #include <linux/netfilter_ipv4.h>
  46 #include <linux/netfilter_ipv6.h>
  47 #include <linux/tty.h>
  48 #include <net/icmp.h>
  49 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  50 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  51 #include <asm/uaccess.h>
  52 #include <asm/semaphore.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/quota.h>
  61 #include <linux/un.h>           /* for Unix socket types */
  62 #include <net/af_unix.h>        /* for Unix socket types */
  63 #include <linux/parser.h>
  64 #include <linux/nfs_mount.h>
  65 #include <net/ipv6.h>
  66 #include <linux/hugetlb.h>
  67 #include <linux/personality.h>
  68 #include <linux/sysctl.h>
  69 #include <linux/audit.h>
  70 #include <linux/string.h>
  71 #include <linux/selinux.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76 #include "xfrm.h"
  77
  78 #define XATTR_SELINUX_SUFFIX "selinux"
  79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  80
  81 extern unsigned int policydb_loaded_version;
  82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  83 extern int selinux_compat_net;
  84
  85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  86 int selinux_enforcing = 0;
  87
  88 static int __init enforcing_setup(char *str)
  89 {
  90         selinux_enforcing = simple_strtol(str,NULL,0);
  91         return 1;
  92 }
  93 __setup("enforcing=", enforcing_setup);
  94 #endif
  95
  96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  98
  99 static int __init selinux_enabled_setup(char *str)
 100 {
 101         selinux_enabled = simple_strtol(str, NULL, 0);
 102         return 1;
 103 }
 104 __setup("selinux=", selinux_enabled_setup);
 105 #else
 106 int selinux_enabled = 1;
 107 #endif
 108
 109 /* Original (dummy) security module. */
 110 static struct security_operations *original_ops = NULL;
 111
 112 /* Minimal support for a secondary security module,
 113    just to allow the use of the dummy or capability modules.
 114    The owlsm module can alternatively be used as a secondary
 115    module as long as CONFIG_OWLSM_FD is not enabled. */
 116 static struct security_operations *secondary_ops = NULL;
 117
 118 /* Lists of inode and superblock security structures initialized
 119    before the policy was loaded. */
 120 static LIST_HEAD(superblock_security_head);
 121 static DEFINE_SPINLOCK(sb_security_lock);
 122
 123 static kmem_cache_t *sel_inode_cache;
 124
 125 /* Return security context for a given sid or just the context
 126    length if the buffer is null or length is 0 */
 127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 128 {
 129         char *context;
 130         unsigned len;
 131         int rc;
 132
 133         rc = security_sid_to_context(sid, &context, &len);
 134         if (rc)
 135                 return rc;
 136
 137         if (!buffer || !size)
 138                 goto getsecurity_exit;
 139
 140         if (size < len) {
 141                 len = -ERANGE;
 142                 goto getsecurity_exit;
 143         }
 144         memcpy(buffer, context, len);
 145
 146 getsecurity_exit:
 147         kfree(context);
 148         return len;
 149 }
 150
 151 /* Allocate and free functions for each kind of security blob. */
 152
 153 static int task_alloc_security(struct task_struct *task)
 154 {
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 return -ENOMEM;
 160
 161         tsec->task = task;
 162         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 163         task->security = tsec;
 164
 165         return 0;
 166 }
 167
 168 static void task_free_security(struct task_struct *task)
 169 {
 170         struct task_security_struct *tsec = task->security;
 171         task->security = NULL;
 172         kfree(tsec);
 173 }
 174
 175 static int inode_alloc_security(struct inode *inode)
 176 {
 177         struct task_security_struct *tsec = current->security;
 178         struct inode_security_struct *isec;
 179
 180         isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
 181         if (!isec)
 182                 return -ENOMEM;
 183
 184         memset(isec, 0, sizeof(*isec));
 185         init_MUTEX(&isec->sem);
 186         INIT_LIST_HEAD(&isec->list);
 187         isec->inode = inode;
 188         isec->sid = SECINITSID_UNLABELED;
 189         isec->sclass = SECCLASS_FILE;
 190         isec->task_sid = tsec->sid;
 191         inode->i_security = isec;
 192
 193         return 0;
 194 }
 195
 196 static void inode_free_security(struct inode *inode)
 197 {
 198         struct inode_security_struct *isec = inode->i_security;
 199         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 200
 201         spin_lock(&sbsec->isec_lock);
 202         if (!list_empty(&isec->list))
 203                 list_del_init(&isec->list);
 204         spin_unlock(&sbsec->isec_lock);
 205
 206         inode->i_security = NULL;
 207         kmem_cache_free(sel_inode_cache, isec);
 208 }
 209
 210 static int file_alloc_security(struct file *file)
 211 {
 212         struct task_security_struct *tsec = current->security;
 213         struct file_security_struct *fsec;
 214
 215         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 216         if (!fsec)
 217                 return -ENOMEM;
 218
 219         fsec->file = file;
 220         fsec->sid = tsec->sid;
 221         fsec->fown_sid = tsec->sid;
 222         file->f_security = fsec;
 223
 224         return 0;
 225 }
 226
 227 static void file_free_security(struct file *file)
 228 {
 229         struct file_security_struct *fsec = file->f_security;
 230         file->f_security = NULL;
 231         kfree(fsec);
 232 }
 233
 234 static int superblock_alloc_security(struct super_block *sb)
 235 {
 236         struct superblock_security_struct *sbsec;
 237
 238         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 239         if (!sbsec)
 240                 return -ENOMEM;
 241
 242         init_MUTEX(&sbsec->sem);
 243         INIT_LIST_HEAD(&sbsec->list);
 244         INIT_LIST_HEAD(&sbsec->isec_head);
 245         spin_lock_init(&sbsec->isec_lock);
 246         sbsec->sb = sb;
 247         sbsec->sid = SECINITSID_UNLABELED;
 248         sbsec->def_sid = SECINITSID_FILE;
 249         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 250         sb->s_security = sbsec;
 251
 252         return 0;
 253 }
 254
 255 static void superblock_free_security(struct super_block *sb)
 256 {
 257         struct superblock_security_struct *sbsec = sb->s_security;
 258
 259         spin_lock(&sb_security_lock);
 260         if (!list_empty(&sbsec->list))
 261                 list_del_init(&sbsec->list);
 262         spin_unlock(&sb_security_lock);
 263
 264         sb->s_security = NULL;
 265         kfree(sbsec);
 266 }
 267
 268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 269 {
 270         struct sk_security_struct *ssec;
 271
 272         if (family != PF_UNIX)
 273                 return 0;
 274
 275         ssec = kzalloc(sizeof(*ssec), priority);
 276         if (!ssec)
 277                 return -ENOMEM;
 278
 279         ssec->sk = sk;
 280         ssec->peer_sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         return 0;
 284 }
 285
 286 static void sk_free_security(struct sock *sk)
 287 {
 288         struct sk_security_struct *ssec = sk->sk_security;
 289
 290         if (sk->sk_family != PF_UNIX)
 291                 return;
 292
 293         sk->sk_security = NULL;
 294         kfree(ssec);
 295 }
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323         Opt_rootcontext = 8,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331 };
 332
 333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 334
 335 static int may_context_mount_sb_relabel(u32 sid,
 336                         struct superblock_security_struct *sbsec,
 337                         struct task_security_struct *tsec)
 338 {
 339         int rc;
 340
 341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 342                           FILESYSTEM__RELABELFROM, NULL);
 343         if (rc)
 344                 return rc;
 345
 346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELTO, NULL);
 348         return rc;
 349 }
 350
 351 static int may_context_mount_inode_relabel(u32 sid,
 352                         struct superblock_security_struct *sbsec,
 353                         struct task_security_struct *tsec)
 354 {
 355         int rc;
 356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELFROM, NULL);
 358         if (rc)
 359                 return rc;
 360
 361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__ASSOCIATE, NULL);
 363         return rc;
 364 }
 365
 366 static int try_context_mount(struct super_block *sb, void *data)
 367 {
 368         char *context = NULL, *defcontext = NULL;
 369         char *fscontext = NULL, *rootcontext = NULL;
 370         const char *name;
 371         u32 sid;
 372         int alloc = 0, rc = 0, seen = 0;
 373         struct task_security_struct *tsec = current->security;
 374         struct superblock_security_struct *sbsec = sb->s_security;
 375
 376         if (!data)
 377                 goto out;
 378
 379         name = sb->s_type->name;
 380
 381         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 382
 383                 /* NFS we understand. */
 384                 if (!strcmp(name, "nfs")) {
 385                         struct nfs_mount_data *d = data;
 386
 387                         if (d->version <  NFS_MOUNT_VERSION)
 388                                 goto out;
 389
 390                         if (d->context[0]) {
 391                                 context = d->context;
 392                                 seen |= Opt_context;
 393                         }
 394                 } else
 395                         goto out;
 396
 397         } else {
 398                 /* Standard string-based options. */
 399                 char *p, *options = data;
 400
 401                 while ((p = strsep(&options, ",")) != NULL) {
 402                         int token;
 403                         substring_t args[MAX_OPT_ARGS];
 404
 405                         if (!*p)
 406                                 continue;
 407
 408                         token = match_token(p, tokens, args);
 409
 410                         switch (token) {
 411                         case Opt_context:
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 context = match_strdup(&args[0]);
 418                                 if (!context) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_context;
 425                                 break;
 426
 427                         case Opt_fscontext:
 428                                 if (seen & Opt_fscontext) {
 429                                         rc = -EINVAL;
 430                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 431                                         goto out_free;
 432                                 }
 433                                 fscontext = match_strdup(&args[0]);
 434                                 if (!fscontext) {
 435                                         rc = -ENOMEM;
 436                                         goto out_free;
 437                                 }
 438                                 if (!alloc)
 439                                         alloc = 1;
 440                                 seen |= Opt_fscontext;
 441                                 break;
 442
 443                         case Opt_rootcontext:
 444                                 if (seen & Opt_rootcontext) {
 445                                         rc = -EINVAL;
 446                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 447                                         goto out_free;
 448                                 }
 449                                 rootcontext = match_strdup(&args[0]);
 450                                 if (!rootcontext) {
 451                                         rc = -ENOMEM;
 452                                         goto out_free;
 453                                 }
 454                                 if (!alloc)
 455                                         alloc = 1;
 456                                 seen |= Opt_rootcontext;
 457                                 break;
 458
 459                         case Opt_defcontext:
 460                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 461                                         rc = -EINVAL;
 462                                         printk(KERN_WARNING "SELinux:  "
 463                                                "defcontext option is invalid "
 464                                                "for this filesystem type\n");
 465                                         goto out_free;
 466                                 }
 467                                 if (seen & (Opt_context|Opt_defcontext)) {
 468                                         rc = -EINVAL;
 469                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 470                                         goto out_free;
 471                                 }
 472                                 defcontext = match_strdup(&args[0]);
 473                                 if (!defcontext) {
 474                                         rc = -ENOMEM;
 475                                         goto out_free;
 476                                 }
 477                                 if (!alloc)
 478                                         alloc = 1;
 479                                 seen |= Opt_defcontext;
 480                                 break;
 481
 482                         default:
 483                                 rc = -EINVAL;
 484                                 printk(KERN_WARNING "SELinux:  unknown mount "
 485                                        "option\n");
 486                                 goto out_free;
 487
 488                         }
 489                 }
 490         }
 491
 492         if (!seen)
 493                 goto out;
 494
 495         /* sets the context of the superblock for the fs being mounted. */
 496         if (fscontext) {
 497                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 498                 if (rc) {
 499                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 500                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 501                                fscontext, sb->s_id, name, rc);
 502                         goto out_free;
 503                 }
 504
 505                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 506                 if (rc)
 507                         goto out_free;
 508
 509                 sbsec->sid = sid;
 510         }
 511
 512         /*
 513          * Switch to using mount point labeling behavior.
 514          * sets the label used on all file below the mountpoint, and will set
 515          * the superblock context if not already set.
 516          */
 517         if (context) {
 518                 rc = security_context_to_sid(context, strlen(context), &sid);
 519                 if (rc) {
 520                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 521                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 522                                context, sb->s_id, name, rc);
 523                         goto out_free;
 524                 }
 525
 526                 if (!fscontext) {
 527                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 528                         if (rc)
 529                                 goto out_free;
 530                         sbsec->sid = sid;
 531                 } else {
 532                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 533                         if (rc)
 534                                 goto out_free;
 535                 }
 536                 sbsec->mntpoint_sid = sid;
 537
 538                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 539         }
 540
 541         if (rootcontext) {
 542                 struct inode *inode = sb->s_root->d_inode;
 543                 struct inode_security_struct *isec = inode->i_security;
 544                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 545                 if (rc) {
 546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 548                                rootcontext, sb->s_id, name, rc);
 549                         goto out_free;
 550                 }
 551
 552                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 553                 if (rc)
 554                         goto out_free;
 555
 556                 isec->sid = sid;
 557                 isec->initialized = 1;
 558         }
 559
 560         if (defcontext) {
 561                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 562                 if (rc) {
 563                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 564                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 565                                defcontext, sb->s_id, name, rc);
 566                         goto out_free;
 567                 }
 568
 569                 if (sid == sbsec->def_sid)
 570                         goto out_free;
 571
 572                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 573                 if (rc)
 574                         goto out_free;
 575
 576                 sbsec->def_sid = sid;
 577         }
 578
 579 out_free:
 580         if (alloc) {
 581                 kfree(context);
 582                 kfree(defcontext);
 583                 kfree(fscontext);
 584                 kfree(rootcontext);
 585         }
 586 out:
 587         return rc;
 588 }
 589
 590 static int superblock_doinit(struct super_block *sb, void *data)
 591 {
 592         struct superblock_security_struct *sbsec = sb->s_security;
 593         struct dentry *root = sb->s_root;
 594         struct inode *inode = root->d_inode;
 595         int rc = 0;
 596
 597         down(&sbsec->sem);
 598         if (sbsec->initialized)
 599                 goto out;
 600
 601         if (!ss_initialized) {
 602                 /* Defer initialization until selinux_complete_init,
 603                    after the initial policy is loaded and the security
 604                    server is ready to handle calls. */
 605                 spin_lock(&sb_security_lock);
 606                 if (list_empty(&sbsec->list))
 607                         list_add(&sbsec->list, &superblock_security_head);
 608                 spin_unlock(&sb_security_lock);
 609                 goto out;
 610         }
 611
 612         /* Determine the labeling behavior to use for this filesystem type. */
 613         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 614         if (rc) {
 615                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 616                        __FUNCTION__, sb->s_type->name, rc);
 617                 goto out;
 618         }
 619
 620         rc = try_context_mount(sb, data);
 621         if (rc)
 622                 goto out;
 623
 624         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 625                 /* Make sure that the xattr handler exists and that no
 626                    error other than -ENODATA is returned by getxattr on
 627                    the root directory.  -ENODATA is ok, as this may be
 628                    the first boot of the SELinux kernel before we have
 629                    assigned xattr values to the filesystem. */
 630                 if (!inode->i_op->getxattr) {
 631                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 632                                "xattr support\n", sb->s_id, sb->s_type->name);
 633                         rc = -EOPNOTSUPP;
 634                         goto out;
 635                 }
 636                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 637                 if (rc < 0 && rc != -ENODATA) {
 638                         if (rc == -EOPNOTSUPP)
 639                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 640                                        "%s) has no security xattr handler\n",
 641                                        sb->s_id, sb->s_type->name);
 642                         else
 643                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 644                                        "%s) getxattr errno %d\n", sb->s_id,
 645                                        sb->s_type->name, -rc);
 646                         goto out;
 647                 }
 648         }
 649
 650         if (strcmp(sb->s_type->name, "proc") == 0)
 651                 sbsec->proc = 1;
 652
 653         sbsec->initialized = 1;
 654
 655         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 656                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 657                        sb->s_id, sb->s_type->name);
 658         }
 659         else {
 660                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 661                        sb->s_id, sb->s_type->name,
 662                        labeling_behaviors[sbsec->behavior-1]);
 663         }
 664
 665         /* Initialize the root inode. */
 666         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 667
 668         /* Initialize any other inodes associated with the superblock, e.g.
 669            inodes created prior to initial policy load or inodes created
 670            during get_sb by a pseudo filesystem that directly
 671            populates itself. */
 672         spin_lock(&sbsec->isec_lock);
 673 next_inode:
 674         if (!list_empty(&sbsec->isec_head)) {
 675                 struct inode_security_struct *isec =
 676                                 list_entry(sbsec->isec_head.next,
 677                                            struct inode_security_struct, list);
 678                 struct inode *inode = isec->inode;
 679                 spin_unlock(&sbsec->isec_lock);
 680                 inode = igrab(inode);
 681                 if (inode) {
 682                         if (!IS_PRIVATE (inode))
 683                                 inode_doinit(inode);
 684                         iput(inode);
 685                 }
 686                 spin_lock(&sbsec->isec_lock);
 687                 list_del_init(&isec->list);
 688                 goto next_inode;
 689         }
 690         spin_unlock(&sbsec->isec_lock);
 691 out:
 692         up(&sbsec->sem);
 693         return rc;
 694 }
 695
 696 static inline u16 inode_mode_to_security_class(umode_t mode)
 697 {
 698         switch (mode & S_IFMT) {
 699         case S_IFSOCK:
 700                 return SECCLASS_SOCK_FILE;
 701         case S_IFLNK:
 702                 return SECCLASS_LNK_FILE;
 703         case S_IFREG:
 704                 return SECCLASS_FILE;
 705         case S_IFBLK:
 706                 return SECCLASS_BLK_FILE;
 707         case S_IFDIR:
 708                 return SECCLASS_DIR;
 709         case S_IFCHR:
 710                 return SECCLASS_CHR_FILE;
 711         case S_IFIFO:
 712                 return SECCLASS_FIFO_FILE;
 713
 714         }
 715
 716         return SECCLASS_FILE;
 717 }
 718
 719 static inline int default_protocol_stream(int protocol)
 720 {
 721         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 722 }
 723
 724 static inline int default_protocol_dgram(int protocol)
 725 {
 726         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 727 }
 728
 729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 730 {
 731         switch (family) {
 732         case PF_UNIX:
 733                 switch (type) {
 734                 case SOCK_STREAM:
 735                 case SOCK_SEQPACKET:
 736                         return SECCLASS_UNIX_STREAM_SOCKET;
 737                 case SOCK_DGRAM:
 738                         return SECCLASS_UNIX_DGRAM_SOCKET;
 739                 }
 740                 break;
 741         case PF_INET:
 742         case PF_INET6:
 743                 switch (type) {
 744                 case SOCK_STREAM:
 745                         if (default_protocol_stream(protocol))
 746                                 return SECCLASS_TCP_SOCKET;
 747                         else
 748                                 return SECCLASS_RAWIP_SOCKET;
 749                 case SOCK_DGRAM:
 750                         if (default_protocol_dgram(protocol))
 751                                 return SECCLASS_UDP_SOCKET;
 752                         else
 753                                 return SECCLASS_RAWIP_SOCKET;
 754                 default:
 755                         return SECCLASS_RAWIP_SOCKET;
 756                 }
 757                 break;
 758         case PF_NETLINK:
 759                 switch (protocol) {
 760                 case NETLINK_ROUTE:
 761                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 762                 case NETLINK_FIREWALL:
 763                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 764                 case NETLINK_INET_DIAG:
 765                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 766                 case NETLINK_NFLOG:
 767                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 768                 case NETLINK_XFRM:
 769                         return SECCLASS_NETLINK_XFRM_SOCKET;
 770                 case NETLINK_SELINUX:
 771                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 772                 case NETLINK_AUDIT:
 773                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 774                 case NETLINK_IP6_FW:
 775                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 776                 case NETLINK_DNRTMSG:
 777                         return SECCLASS_NETLINK_DNRT_SOCKET;
 778                 case NETLINK_KOBJECT_UEVENT:
 779                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 780                 default:
 781                         return SECCLASS_NETLINK_SOCKET;
 782                 }
 783         case PF_PACKET:
 784                 return SECCLASS_PACKET_SOCKET;
 785         case PF_KEY:
 786                 return SECCLASS_KEY_SOCKET;
 787         case PF_APPLETALK:
 788                 return SECCLASS_APPLETALK_SOCKET;
 789         }
 790
 791         return SECCLASS_SOCKET;
 792 }
 793
 794 #ifdef CONFIG_PROC_FS
 795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 796                                 u16 tclass,
 797                                 u32 *sid)
 798 {
 799         int buflen, rc;
 800         char *buffer, *path, *end;
 801
 802         buffer = (char*)__get_free_page(GFP_KERNEL);
 803         if (!buffer)
 804                 return -ENOMEM;
 805
 806         buflen = PAGE_SIZE;
 807         end = buffer+buflen;
 808         *--end = '\0';
 809         buflen--;
 810         path = end-1;
 811         *path = '/';
 812         while (de && de != de->parent) {
 813                 buflen -= de->namelen + 1;
 814                 if (buflen < 0)
 815                         break;
 816                 end -= de->namelen;
 817                 memcpy(end, de->name, de->namelen);
 818                 *--end = '/';
 819                 path = end;
 820                 de = de->parent;
 821         }
 822         rc = security_genfs_sid("proc", path, tclass, sid);
 823         free_page((unsigned long)buffer);
 824         return rc;
 825 }
 826 #else
 827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 828                                 u16 tclass,
 829                                 u32 *sid)
 830 {
 831         return -EINVAL;
 832 }
 833 #endif
 834
 835 /* The inode's security attributes must be initialized before first use. */
 836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 837 {
 838         struct superblock_security_struct *sbsec = NULL;
 839         struct inode_security_struct *isec = inode->i_security;
 840         u32 sid;
 841         struct dentry *dentry;
 842 #define INITCONTEXTLEN 255
 843         char *context = NULL;
 844         unsigned len = 0;
 845         int rc = 0;
 846         int hold_sem = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         down(&isec->sem);
 852         hold_sem = 1;
 853         if (isec->initialized)
 854                 goto out;
 855
 856         sbsec = inode->i_sb->s_security;
 857         if (!sbsec->initialized) {
 858                 /* Defer initialization until selinux_complete_init,
 859                    after the initial policy is loaded and the security
 860                    server is ready to handle calls. */
 861                 spin_lock(&sbsec->isec_lock);
 862                 if (list_empty(&isec->list))
 863                         list_add(&isec->list, &sbsec->isec_head);
 864                 spin_unlock(&sbsec->isec_lock);
 865                 goto out;
 866         }
 867
 868         switch (sbsec->behavior) {
 869         case SECURITY_FS_USE_XATTR:
 870                 if (!inode->i_op->getxattr) {
 871                         isec->sid = sbsec->def_sid;
 872                         break;
 873                 }
 874
 875                 /* Need a dentry, since the xattr API requires one.
 876                    Life would be simpler if we could just pass the inode. */
 877                 if (opt_dentry) {
 878                         /* Called from d_instantiate or d_splice_alias. */
 879                         dentry = dget(opt_dentry);
 880                 } else {
 881                         /* Called from selinux_complete_init, try to find a dentry. */
 882                         dentry = d_find_alias(inode);
 883                 }
 884                 if (!dentry) {
 885                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 886                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 887                                inode->i_ino);
 888                         goto out;
 889                 }
 890
 891                 len = INITCONTEXTLEN;
 892                 context = kmalloc(len, GFP_KERNEL);
 893                 if (!context) {
 894                         rc = -ENOMEM;
 895                         dput(dentry);
 896                         goto out;
 897                 }
 898                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 899                                            context, len);
 900                 if (rc == -ERANGE) {
 901                         /* Need a larger buffer.  Query for the right size. */
 902                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 903                                                    NULL, 0);
 904                         if (rc < 0) {
 905                                 dput(dentry);
 906                                 goto out;
 907                         }
 908                         kfree(context);
 909                         len = rc;
 910                         context = kmalloc(len, GFP_KERNEL);
 911                         if (!context) {
 912                                 rc = -ENOMEM;
 913                                 dput(dentry);
 914                                 goto out;
 915                         }
 916                         rc = inode->i_op->getxattr(dentry,
 917                                                    XATTR_NAME_SELINUX,
 918                                                    context, len);
 919                 }
 920                 dput(dentry);
 921                 if (rc < 0) {
 922                         if (rc != -ENODATA) {
 923                                 printk(KERN_WARNING "%s:  getxattr returned "
 924                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 925                                        -rc, inode->i_sb->s_id, inode->i_ino);
 926                                 kfree(context);
 927                                 goto out;
 928                         }
 929                         /* Map ENODATA to the default file SID */
 930                         sid = sbsec->def_sid;
 931                         rc = 0;
 932                 } else {
 933                         rc = security_context_to_sid_default(context, rc, &sid,
 934                                                              sbsec->def_sid);
 935                         if (rc) {
 936                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 937                                        "returned %d for dev=%s ino=%ld\n",
 938                                        __FUNCTION__, context, -rc,
 939                                        inode->i_sb->s_id, inode->i_ino);
 940                                 kfree(context);
 941                                 /* Leave with the unlabeled SID */
 942                                 rc = 0;
 943                                 break;
 944                         }
 945                 }
 946                 kfree(context);
 947                 isec->sid = sid;
 948                 break;
 949         case SECURITY_FS_USE_TASK:
 950                 isec->sid = isec->task_sid;
 951                 break;
 952         case SECURITY_FS_USE_TRANS:
 953                 /* Default to the fs SID. */
 954                 isec->sid = sbsec->sid;
 955
 956                 /* Try to obtain a transition SID. */
 957                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 958                 rc = security_transition_sid(isec->task_sid,
 959                                              sbsec->sid,
 960                                              isec->sclass,
 961                                              &sid);
 962                 if (rc)
 963                         goto out;
 964                 isec->sid = sid;
 965                 break;
 966         case SECURITY_FS_USE_MNTPOINT:
 967                 isec->sid = sbsec->mntpoint_sid;
 968                 break;
 969         default:
 970                 /* Default to the fs superblock SID. */
 971                 isec->sid = sbsec->sid;
 972
 973                 if (sbsec->proc) {
 974                         struct proc_inode *proci = PROC_I(inode);
 975                         if (proci->pde) {
 976                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 977                                 rc = selinux_proc_get_sid(proci->pde,
 978                                                           isec->sclass,
 979                                                           &sid);
 980                                 if (rc)
 981                                         goto out;
 982                                 isec->sid = sid;
 983                         }
 984                 }
 985                 break;
 986         }
 987
 988         isec->initialized = 1;
 989
 990 out:
 991         if (isec->sclass == SECCLASS_FILE)
 992                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 993
 994         if (hold_sem)
 995                 up(&isec->sem);
 996         return rc;
 997 }
 998
 999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1001 {
1002         u32 perm = 0;
1003
1004         switch (sig) {
1005         case SIGCHLD:
1006                 /* Commonly granted from child to parent. */
1007                 perm = PROCESS__SIGCHLD;
1008                 break;
1009         case SIGKILL:
1010                 /* Cannot be caught or ignored */
1011                 perm = PROCESS__SIGKILL;
1012                 break;
1013         case SIGSTOP:
1014                 /* Cannot be caught or ignored */
1015                 perm = PROCESS__SIGSTOP;
1016                 break;
1017         default:
1018                 /* All other signals. */
1019                 perm = PROCESS__SIGNAL;
1020                 break;
1021         }
1022
1023         return perm;
1024 }
1025
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027    fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029                          struct task_struct *tsk2,
1030                          u32 perms)
1031 {
1032         struct task_security_struct *tsec1, *tsec2;
1033
1034         tsec1 = tsk1->security;
1035         tsec2 = tsk2->security;
1036         return avc_has_perm(tsec1->sid, tsec2->sid,
1037                             SECCLASS_PROCESS, perms, NULL);
1038 }
1039
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1042                                int cap)
1043 {
1044         struct task_security_struct *tsec;
1045         struct avc_audit_data ad;
1046
1047         tsec = tsk->security;
1048
1049         AVC_AUDIT_DATA_INIT(&ad,CAP);
1050         ad.tsk = tsk;
1051         ad.u.cap = cap;
1052
1053         return avc_has_perm(tsec->sid, tsec->sid,
1054                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1055 }
1056
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1059                            u32 perms)
1060 {
1061         struct task_security_struct *tsec;
1062
1063         tsec = tsk->security;
1064
1065         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066                             SECCLASS_SYSTEM, perms, NULL);
1067 }
1068
1069 /* Check whether a task has a particular permission to an inode.
1070    The 'adp' parameter is optional and allows other audit
1071    data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073                           struct inode *inode,
1074                           u32 perms,
1075                           struct avc_audit_data *adp)
1076 {
1077         struct task_security_struct *tsec;
1078         struct inode_security_struct *isec;
1079         struct avc_audit_data ad;
1080
1081         tsec = tsk->security;
1082         isec = inode->i_security;
1083
1084         if (!adp) {
1085                 adp = &ad;
1086                 AVC_AUDIT_DATA_INIT(&ad, FS);
1087                 ad.u.fs.inode = inode;
1088         }
1089
1090         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1091 }
1092
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094    the dentry to help the auditing code to more easily generate the
1095    pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097                                   struct vfsmount *mnt,
1098                                   struct dentry *dentry,
1099                                   u32 av)
1100 {
1101         struct inode *inode = dentry->d_inode;
1102         struct avc_audit_data ad;
1103         AVC_AUDIT_DATA_INIT(&ad,FS);
1104         ad.u.fs.mnt = mnt;
1105         ad.u.fs.dentry = dentry;
1106         return inode_has_perm(tsk, inode, av, &ad);
1107 }
1108
1109 /* Check whether a task can use an open file descriptor to
1110    access an inode in a given way.  Check access to the
1111    descriptor itself, and then use dentry_has_perm to
1112    check a particular permission to the file.
1113    Access to the descriptor is implicitly granted if it
1114    has the same SID as the process.  If av is zero, then
1115    access to the file is not checked, e.g. for cases
1116    where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1118                                 struct file *file,
1119                                 u32 av)
1120 {
1121         struct task_security_struct *tsec = tsk->security;
1122         struct file_security_struct *fsec = file->f_security;
1123         struct vfsmount *mnt = file->f_vfsmnt;
1124         struct dentry *dentry = file->f_dentry;
1125         struct inode *inode = dentry->d_inode;
1126         struct avc_audit_data ad;
1127         int rc;
1128
1129         AVC_AUDIT_DATA_INIT(&ad, FS);
1130         ad.u.fs.mnt = mnt;
1131         ad.u.fs.dentry = dentry;
1132
1133         if (tsec->sid != fsec->sid) {
1134                 rc = avc_has_perm(tsec->sid, fsec->sid,
1135                                   SECCLASS_FD,
1136                                   FD__USE,
1137                                   &ad);
1138                 if (rc)
1139                         return rc;
1140         }
1141
1142         /* av is zero if only checking access to the descriptor. */
1143         if (av)
1144                 return inode_has_perm(tsk, inode, av, &ad);
1145
1146         return 0;
1147 }
1148
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151                       struct dentry *dentry,
1152                       u16 tclass)
1153 {
1154         struct task_security_struct *tsec;
1155         struct inode_security_struct *dsec;
1156         struct superblock_security_struct *sbsec;
1157         u32 newsid;
1158         struct avc_audit_data ad;
1159         int rc;
1160
1161         tsec = current->security;
1162         dsec = dir->i_security;
1163         sbsec = dir->i_sb->s_security;
1164
1165         AVC_AUDIT_DATA_INIT(&ad, FS);
1166         ad.u.fs.dentry = dentry;
1167
1168         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169                           DIR__ADD_NAME | DIR__SEARCH,
1170                           &ad);
1171         if (rc)
1172                 return rc;
1173
1174         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175                 newsid = tsec->create_sid;
1176         } else {
1177                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1178                                              &newsid);
1179                 if (rc)
1180                         return rc;
1181         }
1182
1183         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1184         if (rc)
1185                 return rc;
1186
1187         return avc_has_perm(newsid, sbsec->sid,
1188                             SECCLASS_FILESYSTEM,
1189                             FILESYSTEM__ASSOCIATE, &ad);
1190 }
1191
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194                           struct task_struct *ctx)
1195 {
1196         struct task_security_struct *tsec;
1197
1198         tsec = ctx->security;
1199
1200         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1201 }
1202
1203 #define MAY_LINK   0
1204 #define MAY_UNLINK 1
1205 #define MAY_RMDIR  2
1206
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209                     struct dentry *dentry,
1210                     int kind)
1211
1212 {
1213         struct task_security_struct *tsec;
1214         struct inode_security_struct *dsec, *isec;
1215         struct avc_audit_data ad;
1216         u32 av;
1217         int rc;
1218
1219         tsec = current->security;
1220         dsec = dir->i_security;
1221         isec = dentry->d_inode->i_security;
1222
1223         AVC_AUDIT_DATA_INIT(&ad, FS);
1224         ad.u.fs.dentry = dentry;
1225
1226         av = DIR__SEARCH;
1227         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1229         if (rc)
1230                 return rc;
1231
1232         switch (kind) {
1233         case MAY_LINK:
1234                 av = FILE__LINK;
1235                 break;
1236         case MAY_UNLINK:
1237                 av = FILE__UNLINK;
1238                 break;
1239         case MAY_RMDIR:
1240                 av = DIR__RMDIR;
1241                 break;
1242         default:
1243                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1244                 return 0;
1245         }
1246
1247         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1248         return rc;
1249 }
1250
1251 static inline int may_rename(struct inode *old_dir,
1252                              struct dentry *old_dentry,
1253                              struct inode *new_dir,
1254                              struct dentry *new_dentry)
1255 {
1256         struct task_security_struct *tsec;
1257         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258         struct avc_audit_data ad;
1259         u32 av;
1260         int old_is_dir, new_is_dir;
1261         int rc;
1262
1263         tsec = current->security;
1264         old_dsec = old_dir->i_security;
1265         old_isec = old_dentry->d_inode->i_security;
1266         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267         new_dsec = new_dir->i_security;
1268
1269         AVC_AUDIT_DATA_INIT(&ad, FS);
1270
1271         ad.u.fs.dentry = old_dentry;
1272         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1274         if (rc)
1275                 return rc;
1276         rc = avc_has_perm(tsec->sid, old_isec->sid,
1277                           old_isec->sclass, FILE__RENAME, &ad);
1278         if (rc)
1279                 return rc;
1280         if (old_is_dir && new_dir != old_dir) {
1281                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282                                   old_isec->sclass, DIR__REPARENT, &ad);
1283                 if (rc)
1284                         return rc;
1285         }
1286
1287         ad.u.fs.dentry = new_dentry;
1288         av = DIR__ADD_NAME | DIR__SEARCH;
1289         if (new_dentry->d_inode)
1290                 av |= DIR__REMOVE_NAME;
1291         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1292         if (rc)
1293                 return rc;
1294         if (new_dentry->d_inode) {
1295                 new_isec = new_dentry->d_inode->i_security;
1296                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1298                                   new_isec->sclass,
1299                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1300                 if (rc)
1301                         return rc;
1302         }
1303
1304         return 0;
1305 }
1306
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309                                struct super_block *sb,
1310                                u32 perms,
1311                                struct avc_audit_data *ad)
1312 {
1313         struct task_security_struct *tsec;
1314         struct superblock_security_struct *sbsec;
1315
1316         tsec = tsk->security;
1317         sbsec = sb->s_security;
1318         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1319                             perms, ad);
1320 }
1321
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1324 {
1325         u32 av = 0;
1326
1327         if ((mode & S_IFMT) != S_IFDIR) {
1328                 if (mask & MAY_EXEC)
1329                         av |= FILE__EXECUTE;
1330                 if (mask & MAY_READ)
1331                         av |= FILE__READ;
1332
1333                 if (mask & MAY_APPEND)
1334                         av |= FILE__APPEND;
1335                 else if (mask & MAY_WRITE)
1336                         av |= FILE__WRITE;
1337
1338         } else {
1339                 if (mask & MAY_EXEC)
1340                         av |= DIR__SEARCH;
1341                 if (mask & MAY_WRITE)
1342                         av |= DIR__WRITE;
1343                 if (mask & MAY_READ)
1344                         av |= DIR__READ;
1345         }
1346
1347         return av;
1348 }
1349
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1352 {
1353         u32 av = 0;
1354
1355         if (file->f_mode & FMODE_READ)
1356                 av |= FILE__READ;
1357         if (file->f_mode & FMODE_WRITE) {
1358                 if (file->f_flags & O_APPEND)
1359                         av |= FILE__APPEND;
1360                 else
1361                         av |= FILE__WRITE;
1362         }
1363
1364         return av;
1365 }
1366
1367 /* Set an inode's SID to a specified value. */
1368 static int inode_security_set_sid(struct inode *inode, u32 sid)
1369 {
1370         struct inode_security_struct *isec = inode->i_security;
1371         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1372
1373         if (!sbsec->initialized) {
1374                 /* Defer initialization to selinux_complete_init. */
1375                 return 0;
1376         }
1377
1378         down(&isec->sem);
1379         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1380         isec->sid = sid;
1381         isec->initialized = 1;
1382         up(&isec->sem);
1383         return 0;
1384 }
1385
1386 /* Hook functions begin here. */
1387
1388 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1389 {
1390         struct task_security_struct *psec = parent->security;
1391         struct task_security_struct *csec = child->security;
1392         int rc;
1393
1394         rc = secondary_ops->ptrace(parent,child);
1395         if (rc)
1396                 return rc;
1397
1398         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1399         /* Save the SID of the tracing process for later use in apply_creds. */
1400         if (!(child->ptrace & PT_PTRACED) && !rc)
1401                 csec->ptrace_sid = psec->sid;
1402         return rc;
1403 }
1404
1405 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1406                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1407 {
1408         int error;
1409
1410         error = task_has_perm(current, target, PROCESS__GETCAP);
1411         if (error)
1412                 return error;
1413
1414         return secondary_ops->capget(target, effective, inheritable, permitted);
1415 }
1416
1417 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1418                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1419 {
1420         int error;
1421
1422         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1423         if (error)
1424                 return error;
1425
1426         return task_has_perm(current, target, PROCESS__SETCAP);
1427 }
1428
1429 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1430                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1431 {
1432         secondary_ops->capset_set(target, effective, inheritable, permitted);
1433 }
1434
1435 static int selinux_capable(struct task_struct *tsk, int cap)
1436 {
1437         int rc;
1438
1439         rc = secondary_ops->capable(tsk, cap);
1440         if (rc)
1441                 return rc;
1442
1443         return task_has_capability(tsk,cap);
1444 }
1445
1446 static int selinux_sysctl(ctl_table *table, int op)
1447 {
1448         int error = 0;
1449         u32 av;
1450         struct task_security_struct *tsec;
1451         u32 tsid;
1452         int rc;
1453
1454         rc = secondary_ops->sysctl(table, op);
1455         if (rc)
1456                 return rc;
1457
1458         tsec = current->security;
1459
1460         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1461                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1462         if (rc) {
1463                 /* Default to the well-defined sysctl SID. */
1464                 tsid = SECINITSID_SYSCTL;
1465         }
1466
1467         /* The op values are "defined" in sysctl.c, thereby creating
1468          * a bad coupling between this module and sysctl.c */
1469         if(op == 001) {
1470                 error = avc_has_perm(tsec->sid, tsid,
1471                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1472         } else {
1473                 av = 0;
1474                 if (op & 004)
1475                         av |= FILE__READ;
1476                 if (op & 002)
1477                         av |= FILE__WRITE;
1478                 if (av)
1479                         error = avc_has_perm(tsec->sid, tsid,
1480                                              SECCLASS_FILE, av, NULL);
1481         }
1482
1483         return error;
1484 }
1485
1486 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1487 {
1488         int rc = 0;
1489
1490         if (!sb)
1491                 return 0;
1492
1493         switch (cmds) {
1494                 case Q_SYNC:
1495                 case Q_QUOTAON:
1496                 case Q_QUOTAOFF:
1497                 case Q_SETINFO:
1498                 case Q_SETQUOTA:
1499                         rc = superblock_has_perm(current,
1500                                                  sb,
1501                                                  FILESYSTEM__QUOTAMOD, NULL);
1502                         break;
1503                 case Q_GETFMT:
1504                 case Q_GETINFO:
1505                 case Q_GETQUOTA:
1506                         rc = superblock_has_perm(current,
1507                                                  sb,
1508                                                  FILESYSTEM__QUOTAGET, NULL);
1509                         break;
1510                 default:
1511                         rc = 0;  /* let the kernel handle invalid cmds */
1512                         break;
1513         }
1514         return rc;
1515 }
1516
1517 static int selinux_quota_on(struct dentry *dentry)
1518 {
1519         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1520 }
1521
1522 static int selinux_syslog(int type)
1523 {
1524         int rc;
1525
1526         rc = secondary_ops->syslog(type);
1527         if (rc)
1528                 return rc;
1529
1530         switch (type) {
1531                 case 3:         /* Read last kernel messages */
1532                 case 10:        /* Return size of the log buffer */
1533                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1534                         break;
1535                 case 6:         /* Disable logging to console */
1536                 case 7:         /* Enable logging to console */
1537                 case 8:         /* Set level of messages printed to console */
1538                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1539                         break;
1540                 case 0:         /* Close log */
1541                 case 1:         /* Open log */
1542                 case 2:         /* Read from log */
1543                 case 4:         /* Read/clear last kernel messages */
1544                 case 5:         /* Clear ring buffer */
1545                 default:
1546                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1547                         break;
1548         }
1549         return rc;
1550 }
1551
1552 /*
1553  * Check that a process has enough memory to allocate a new virtual
1554  * mapping. 0 means there is enough memory for the allocation to
1555  * succeed and -ENOMEM implies there is not.
1556  *
1557  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1558  * if the capability is granted, but __vm_enough_memory requires 1 if
1559  * the capability is granted.
1560  *
1561  * Do not audit the selinux permission check, as this is applied to all
1562  * processes that allocate mappings.
1563  */
1564 static int selinux_vm_enough_memory(long pages)
1565 {
1566         int rc, cap_sys_admin = 0;
1567         struct task_security_struct *tsec = current->security;
1568
1569         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1570         if (rc == 0)
1571                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1572                                         SECCLASS_CAPABILITY,
1573                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1574                                         NULL);
1575
1576         if (rc == 0)
1577                 cap_sys_admin = 1;
1578
1579         return __vm_enough_memory(pages, cap_sys_admin);
1580 }
1581
1582 /* binprm security operations */
1583
1584 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1585 {
1586         struct bprm_security_struct *bsec;
1587
1588         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1589         if (!bsec)
1590                 return -ENOMEM;
1591
1592         bsec->bprm = bprm;
1593         bsec->sid = SECINITSID_UNLABELED;
1594         bsec->set = 0;
1595
1596         bprm->security = bsec;
1597         return 0;
1598 }
1599
1600 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1601 {
1602         struct task_security_struct *tsec;
1603         struct inode *inode = bprm->file->f_dentry->d_inode;
1604         struct inode_security_struct *isec;
1605         struct bprm_security_struct *bsec;
1606         u32 newsid;
1607         struct avc_audit_data ad;
1608         int rc;
1609
1610         rc = secondary_ops->bprm_set_security(bprm);
1611         if (rc)
1612                 return rc;
1613
1614         bsec = bprm->security;
1615
1616         if (bsec->set)
1617                 return 0;
1618
1619         tsec = current->security;
1620         isec = inode->i_security;
1621
1622         /* Default to the current task SID. */
1623         bsec->sid = tsec->sid;
1624
1625         /* Reset fs, key, and sock SIDs on execve. */
1626         tsec->create_sid = 0;
1627         tsec->keycreate_sid = 0;
1628         tsec->sockcreate_sid = 0;
1629
1630         if (tsec->exec_sid) {
1631                 newsid = tsec->exec_sid;
1632                 /* Reset exec SID on execve. */
1633                 tsec->exec_sid = 0;
1634         } else {
1635                 /* Check for a default transition on this program. */
1636                 rc = security_transition_sid(tsec->sid, isec->sid,
1637                                              SECCLASS_PROCESS, &newsid);
1638                 if (rc)
1639                         return rc;
1640         }
1641
1642         AVC_AUDIT_DATA_INIT(&ad, FS);
1643         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1644         ad.u.fs.dentry = bprm->file->f_dentry;
1645
1646         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1647                 newsid = tsec->sid;
1648
1649         if (tsec->sid == newsid) {
1650                 rc = avc_has_perm(tsec->sid, isec->sid,
1651                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1652                 if (rc)
1653                         return rc;
1654         } else {
1655                 /* Check permissions for the transition. */
1656                 rc = avc_has_perm(tsec->sid, newsid,
1657                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1658                 if (rc)
1659                         return rc;
1660
1661                 rc = avc_has_perm(newsid, isec->sid,
1662                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1663                 if (rc)
1664                         return rc;
1665
1666                 /* Clear any possibly unsafe personality bits on exec: */
1667                 current->personality &= ~PER_CLEAR_ON_SETID;
1668
1669                 /* Set the security field to the new SID. */
1670                 bsec->sid = newsid;
1671         }
1672
1673         bsec->set = 1;
1674         return 0;
1675 }
1676
1677 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1678 {
1679         return secondary_ops->bprm_check_security(bprm);
1680 }
1681
1682
1683 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1684 {
1685         struct task_security_struct *tsec = current->security;
1686         int atsecure = 0;
1687
1688         if (tsec->osid != tsec->sid) {
1689                 /* Enable secure mode for SIDs transitions unless
1690                    the noatsecure permission is granted between
1691                    the two SIDs, i.e. ahp returns 0. */
1692                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1693                                          SECCLASS_PROCESS,
1694                                          PROCESS__NOATSECURE, NULL);
1695         }
1696
1697         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1698 }
1699
1700 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1701 {
1702         kfree(bprm->security);
1703         bprm->security = NULL;
1704 }
1705
1706 extern struct vfsmount *selinuxfs_mount;
1707 extern struct dentry *selinux_null;
1708
1709 /* Derived from fs/exec.c:flush_old_files. */
1710 static inline void flush_unauthorized_files(struct files_struct * files)
1711 {
1712         struct avc_audit_data ad;
1713         struct file *file, *devnull = NULL;
1714         struct tty_struct *tty;
1715         struct fdtable *fdt;
1716         long j = -1;
1717         int drop_tty = 0;
1718
1719         mutex_lock(&tty_mutex);
1720         tty = get_current_tty();
1721         if (tty) {
1722                 file_list_lock();
1723                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1724                 if (file) {
1725                         /* Revalidate access to controlling tty.
1726                            Use inode_has_perm on the tty inode directly rather
1727                            than using file_has_perm, as this particular open
1728                            file may belong to another process and we are only
1729                            interested in the inode-based check here. */
1730                         struct inode *inode = file->f_dentry->d_inode;
1731                         if (inode_has_perm(current, inode,
1732                                            FILE__READ | FILE__WRITE, NULL)) {
1733                                 drop_tty = 1;
1734                         }
1735                 }
1736                 file_list_unlock();
1737
1738                 /* Reset controlling tty. */
1739                 if (drop_tty)
1740                         proc_set_tty(current, NULL);
1741         }
1742         mutex_unlock(&tty_mutex);
1743
1744         /* Revalidate access to inherited open files. */
1745
1746         AVC_AUDIT_DATA_INIT(&ad,FS);
1747
1748         spin_lock(&files->file_lock);
1749         for (;;) {
1750                 unsigned long set, i;
1751                 int fd;
1752
1753                 j++;
1754                 i = j * __NFDBITS;
1755                 fdt = files_fdtable(files);
1756                 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1757                         break;
1758                 set = fdt->open_fds->fds_bits[j];
1759                 if (!set)
1760                         continue;
1761                 spin_unlock(&files->file_lock);
1762                 for ( ; set ; i++,set >>= 1) {
1763                         if (set & 1) {
1764                                 file = fget(i);
1765                                 if (!file)
1766                                         continue;
1767                                 if (file_has_perm(current,
1768                                                   file,
1769                                                   file_to_av(file))) {
1770                                         sys_close(i);
1771                                         fd = get_unused_fd();
1772                                         if (fd != i) {
1773                                                 if (fd >= 0)
1774                                                         put_unused_fd(fd);
1775                                                 fput(file);
1776                                                 continue;
1777                                         }
1778                                         if (devnull) {
1779                                                 get_file(devnull);
1780                                         } else {
1781                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1782                                                 if (!devnull) {
1783                                                         put_unused_fd(fd);
1784                                                         fput(file);
1785                                                         continue;
1786                                                 }
1787                                         }
1788                                         fd_install(fd, devnull);
1789                                 }
1790                                 fput(file);
1791                         }
1792                 }
1793                 spin_lock(&files->file_lock);
1794
1795         }
1796         spin_unlock(&files->file_lock);
1797 }
1798
1799 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1800 {
1801         struct task_security_struct *tsec;
1802         struct bprm_security_struct *bsec;
1803         u32 sid;
1804         int rc;
1805
1806         secondary_ops->bprm_apply_creds(bprm, unsafe);
1807
1808         tsec = current->security;
1809
1810         bsec = bprm->security;
1811         sid = bsec->sid;
1812
1813         tsec->osid = tsec->sid;
1814         bsec->unsafe = 0;
1815         if (tsec->sid != sid) {
1816                 /* Check for shared state.  If not ok, leave SID
1817                    unchanged and kill. */
1818                 if (unsafe & LSM_UNSAFE_SHARE) {
1819                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1820                                         PROCESS__SHARE, NULL);
1821                         if (rc) {
1822                                 bsec->unsafe = 1;
1823                                 return;
1824                         }
1825                 }
1826
1827                 /* Check for ptracing, and update the task SID if ok.
1828                    Otherwise, leave SID unchanged and kill. */
1829                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1830                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1831                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1832                                           NULL);
1833                         if (rc) {
1834                                 bsec->unsafe = 1;
1835                                 return;
1836                         }
1837                 }
1838                 tsec->sid = sid;
1839         }
1840 }
1841
1842 /*
1843  * called after apply_creds without the task lock held
1844  */
1845 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1846 {
1847         struct task_security_struct *tsec;
1848         struct rlimit *rlim, *initrlim;
1849         struct itimerval itimer;
1850         struct bprm_security_struct *bsec;
1851         int rc, i;
1852
1853         tsec = current->security;
1854         bsec = bprm->security;
1855
1856         if (bsec->unsafe) {
1857                 force_sig_specific(SIGKILL, current);
1858                 return;
1859         }
1860         if (tsec->osid == tsec->sid)
1861                 return;
1862
1863         /* Close files for which the new task SID is not authorized. */
1864         flush_unauthorized_files(current->files);
1865
1866         /* Check whether the new SID can inherit signal state
1867            from the old SID.  If not, clear itimers to avoid
1868            subsequent signal generation and flush and unblock
1869            signals. This must occur _after_ the task SID has
1870           been updated so that any kill done after the flush
1871           will be checked against the new SID. */
1872         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1873                           PROCESS__SIGINH, NULL);
1874         if (rc) {
1875                 memset(&itimer, 0, sizeof itimer);
1876                 for (i = 0; i < 3; i++)
1877                         do_setitimer(i, &itimer, NULL);
1878                 flush_signals(current);
1879                 spin_lock_irq(&current->sighand->siglock);
1880                 flush_signal_handlers(current, 1);
1881                 sigemptyset(&current->blocked);
1882                 recalc_sigpending();
1883                 spin_unlock_irq(&current->sighand->siglock);
1884         }
1885
1886         /* Check whether the new SID can inherit resource limits
1887            from the old SID.  If not, reset all soft limits to
1888            the lower of the current task's hard limit and the init
1889            task's soft limit.  Note that the setting of hard limits
1890            (even to lower them) can be controlled by the setrlimit
1891            check. The inclusion of the init task's soft limit into
1892            the computation is to avoid resetting soft limits higher
1893            than the default soft limit for cases where the default
1894            is lower than the hard limit, e.g. RLIMIT_CORE or
1895            RLIMIT_STACK.*/
1896         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897                           PROCESS__RLIMITINH, NULL);
1898         if (rc) {
1899                 for (i = 0; i < RLIM_NLIMITS; i++) {
1900                         rlim = current->signal->rlim + i;
1901                         initrlim = init_task.signal->rlim+i;
1902                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1903                 }
1904                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1905                         /*
1906                          * This will cause RLIMIT_CPU calculations
1907                          * to be refigured.
1908                          */
1909                         current->it_prof_expires = jiffies_to_cputime(1);
1910                 }
1911         }
1912
1913         /* Wake up the parent if it is waiting so that it can
1914            recheck wait permission to the new task SID. */
1915         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1916 }
1917
1918 /* superblock security operations */
1919
1920 static int selinux_sb_alloc_security(struct super_block *sb)
1921 {
1922         return superblock_alloc_security(sb);
1923 }
1924
1925 static void selinux_sb_free_security(struct super_block *sb)
1926 {
1927         superblock_free_security(sb);
1928 }
1929
1930 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1931 {
1932         if (plen > olen)
1933                 return 0;
1934
1935         return !memcmp(prefix, option, plen);
1936 }
1937
1938 static inline int selinux_option(char *option, int len)
1939 {
1940         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1941                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1942                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1943                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1944 }
1945
1946 static inline void take_option(char **to, char *from, int *first, int len)
1947 {
1948         if (!*first) {
1949                 **to = ',';
1950                 *to += 1;
1951         }
1952         else
1953                 *first = 0;
1954         memcpy(*to, from, len);
1955         *to += len;
1956 }
1957
1958 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1959 {
1960         int fnosec, fsec, rc = 0;
1961         char *in_save, *in_curr, *in_end;
1962         char *sec_curr, *nosec_save, *nosec;
1963
1964         in_curr = orig;
1965         sec_curr = copy;
1966
1967         /* Binary mount data: just copy */
1968         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1969                 copy_page(sec_curr, in_curr);
1970                 goto out;
1971         }
1972
1973         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1974         if (!nosec) {
1975                 rc = -ENOMEM;
1976                 goto out;
1977         }
1978
1979         nosec_save = nosec;
1980         fnosec = fsec = 1;
1981         in_save = in_end = orig;
1982
1983         do {
1984                 if (*in_end == ',' || *in_end == '\0') {
1985                         int len = in_end - in_curr;
1986
1987                         if (selinux_option(in_curr, len))
1988                                 take_option(&sec_curr, in_curr, &fsec, len);
1989                         else
1990                                 take_option(&nosec, in_curr, &fnosec, len);
1991
1992                         in_curr = in_end + 1;
1993                 }
1994         } while (*in_end++);
1995
1996         strcpy(in_save, nosec_save);
1997         free_page((unsigned long)nosec_save);
1998 out:
1999         return rc;
2000 }
2001
2002 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2003 {
2004         struct avc_audit_data ad;
2005         int rc;
2006
2007         rc = superblock_doinit(sb, data);
2008         if (rc)
2009                 return rc;
2010
2011         AVC_AUDIT_DATA_INIT(&ad,FS);
2012         ad.u.fs.dentry = sb->s_root;
2013         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2014 }
2015
2016 static int selinux_sb_statfs(struct dentry *dentry)
2017 {
2018         struct avc_audit_data ad;
2019
2020         AVC_AUDIT_DATA_INIT(&ad,FS);
2021         ad.u.fs.dentry = dentry->d_sb->s_root;
2022         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2023 }
2024
2025 static int selinux_mount(char * dev_name,
2026                          struct nameidata *nd,
2027                          char * type,
2028                          unsigned long flags,
2029                          void * data)
2030 {
2031         int rc;
2032
2033         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2034         if (rc)
2035                 return rc;
2036
2037         if (flags & MS_REMOUNT)
2038                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2039                                            FILESYSTEM__REMOUNT, NULL);
2040         else
2041                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2042                                        FILE__MOUNTON);
2043 }
2044
2045 static int selinux_umount(struct vfsmount *mnt, int flags)
2046 {
2047         int rc;
2048
2049         rc = secondary_ops->sb_umount(mnt, flags);
2050         if (rc)
2051                 return rc;
2052
2053         return superblock_has_perm(current,mnt->mnt_sb,
2054                                    FILESYSTEM__UNMOUNT,NULL);
2055 }
2056
2057 /* inode security operations */
2058
2059 static int selinux_inode_alloc_security(struct inode *inode)
2060 {
2061         return inode_alloc_security(inode);
2062 }
2063
2064 static void selinux_inode_free_security(struct inode *inode)
2065 {
2066         inode_free_security(inode);
2067 }
2068
2069 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2070                                        char **name, void **value,
2071                                        size_t *len)
2072 {
2073         struct task_security_struct *tsec;
2074         struct inode_security_struct *dsec;
2075         struct superblock_security_struct *sbsec;
2076         u32 newsid, clen;
2077         int rc;
2078         char *namep = NULL, *context;
2079
2080         tsec = current->security;
2081         dsec = dir->i_security;
2082         sbsec = dir->i_sb->s_security;
2083
2084         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2085                 newsid = tsec->create_sid;
2086         } else {
2087                 rc = security_transition_sid(tsec->sid, dsec->sid,
2088                                              inode_mode_to_security_class(inode->i_mode),
2089                                              &newsid);
2090                 if (rc) {
2091                         printk(KERN_WARNING "%s:  "
2092                                "security_transition_sid failed, rc=%d (dev=%s "
2093                                "ino=%ld)\n",
2094                                __FUNCTION__,
2095                                -rc, inode->i_sb->s_id, inode->i_ino);
2096                         return rc;
2097                 }
2098         }
2099
2100         inode_security_set_sid(inode, newsid);
2101
2102         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2103                 return -EOPNOTSUPP;
2104
2105         if (name) {
2106                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2107                 if (!namep)
2108                         return -ENOMEM;
2109                 *name = namep;
2110         }
2111
2112         if (value && len) {
2113                 rc = security_sid_to_context(newsid, &context, &clen);
2114                 if (rc) {
2115                         kfree(namep);
2116                         return rc;
2117                 }
2118                 *value = context;
2119                 *len = clen;
2120         }
2121
2122         return 0;
2123 }
2124
2125 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2126 {
2127         return may_create(dir, dentry, SECCLASS_FILE);
2128 }
2129
2130 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2131 {
2132         int rc;
2133
2134         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2135         if (rc)
2136                 return rc;
2137         return may_link(dir, old_dentry, MAY_LINK);
2138 }
2139
2140 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2141 {
2142         int rc;
2143
2144         rc = secondary_ops->inode_unlink(dir, dentry);
2145         if (rc)
2146                 return rc;
2147         return may_link(dir, dentry, MAY_UNLINK);
2148 }
2149
2150 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2151 {
2152         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2153 }
2154
2155 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2156 {
2157         return may_create(dir, dentry, SECCLASS_DIR);
2158 }
2159
2160 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2161 {
2162         return may_link(dir, dentry, MAY_RMDIR);
2163 }
2164
2165 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2166 {
2167         int rc;
2168
2169         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2170         if (rc)
2171                 return rc;
2172
2173         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2174 }
2175
2176 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2177                                 struct inode *new_inode, struct dentry *new_dentry)
2178 {
2179         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2180 }
2181
2182 static int selinux_inode_readlink(struct dentry *dentry)
2183 {
2184         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2185 }
2186
2187 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2188 {
2189         int rc;
2190
2191         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2192         if (rc)
2193                 return rc;
2194         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2195 }
2196
2197 static int selinux_inode_permission(struct inode *inode, int mask,
2198                                     struct nameidata *nd)
2199 {
2200         int rc;
2201
2202         rc = secondary_ops->inode_permission(inode, mask, nd);
2203         if (rc)
2204                 return rc;
2205
2206         if (!mask) {
2207                 /* No permission to check.  Existence test. */
2208                 return 0;
2209         }
2210
2211         return inode_has_perm(current, inode,
2212                                file_mask_to_av(inode->i_mode, mask), NULL);
2213 }
2214
2215 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2216 {
2217         int rc;
2218
2219         rc = secondary_ops->inode_setattr(dentry, iattr);
2220         if (rc)
2221                 return rc;
2222
2223         if (iattr->ia_valid & ATTR_FORCE)
2224                 return 0;
2225
2226         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2227                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2228                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2229
2230         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2231 }
2232
2233 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2234 {
2235         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2236 }
2237
2238 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2239 {
2240         struct task_security_struct *tsec = current->security;
2241         struct inode *inode = dentry->d_inode;
2242         struct inode_security_struct *isec = inode->i_security;
2243         struct superblock_security_struct *sbsec;
2244         struct avc_audit_data ad;
2245         u32 newsid;
2246         int rc = 0;
2247
2248         if (strcmp(name, XATTR_NAME_SELINUX)) {
2249                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2250                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2251                     !capable(CAP_SYS_ADMIN)) {
2252                         /* A different attribute in the security namespace.
2253                            Restrict to administrator. */
2254                         return -EPERM;
2255                 }
2256
2257                 /* Not an attribute we recognize, so just check the
2258                    ordinary setattr permission. */
2259                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2260         }
2261
2262         sbsec = inode->i_sb->s_security;
2263         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2264                 return -EOPNOTSUPP;
2265
2266         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2267                 return -EPERM;
2268
2269         AVC_AUDIT_DATA_INIT(&ad,FS);
2270         ad.u.fs.dentry = dentry;
2271
2272         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2273                           FILE__RELABELFROM, &ad);
2274         if (rc)
2275                 return rc;
2276
2277         rc = security_context_to_sid(value, size, &newsid);
2278         if (rc)
2279                 return rc;
2280
2281         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2282                           FILE__RELABELTO, &ad);
2283         if (rc)
2284                 return rc;
2285
2286         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2287                                           isec->sclass);
2288         if (rc)
2289                 return rc;
2290
2291         return avc_has_perm(newsid,
2292                             sbsec->sid,
2293                             SECCLASS_FILESYSTEM,
2294                             FILESYSTEM__ASSOCIATE,
2295                             &ad);
2296 }
2297
2298 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2299                                         void *value, size_t size, int flags)
2300 {
2301         struct inode *inode = dentry->d_inode;
2302         struct inode_security_struct *isec = inode->i_security;
2303         u32 newsid;
2304         int rc;
2305
2306         if (strcmp(name, XATTR_NAME_SELINUX)) {
2307                 /* Not an attribute we recognize, so nothing to do. */
2308                 return;
2309         }
2310
2311         rc = security_context_to_sid(value, size, &newsid);
2312         if (rc) {
2313                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2314                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2315                 return;
2316         }
2317
2318         isec->sid = newsid;
2319         return;
2320 }
2321
2322 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2323 {
2324         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2325 }
2326
2327 static int selinux_inode_listxattr (struct dentry *dentry)
2328 {
2329         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2330 }
2331
2332 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2333 {
2334         if (strcmp(name, XATTR_NAME_SELINUX)) {
2335                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2336                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2337                     !capable(CAP_SYS_ADMIN)) {
2338                         /* A different attribute in the security namespace.
2339                            Restrict to administrator. */
2340                         return -EPERM;
2341                 }
2342
2343                 /* Not an attribute we recognize, so just check the
2344                    ordinary setattr permission. Might want a separate
2345                    permission for removexattr. */
2346                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2347         }
2348
2349         /* No one is allowed to remove a SELinux security label.
2350            You can change the label, but all data must be labeled. */
2351         return -EACCES;
2352 }
2353
2354 static const char *selinux_inode_xattr_getsuffix(void)
2355 {
2356       return XATTR_SELINUX_SUFFIX;
2357 }
2358
2359 /*
2360  * Copy the in-core inode security context value to the user.  If the
2361  * getxattr() prior to this succeeded, check to see if we need to
2362  * canonicalize the value to be finally returned to the user.
2363  *
2364  * Permission check is handled by selinux_inode_getxattr hook.
2365  */
2366 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2367 {
2368         struct inode_security_struct *isec = inode->i_security;
2369
2370         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2371                 return -EOPNOTSUPP;
2372
2373         return selinux_getsecurity(isec->sid, buffer, size);
2374 }
2375
2376 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2377                                      const void *value, size_t size, int flags)
2378 {
2379         struct inode_security_struct *isec = inode->i_security;
2380         u32 newsid;
2381         int rc;
2382
2383         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2384                 return -EOPNOTSUPP;
2385
2386         if (!value || !size)
2387                 return -EACCES;
2388
2389         rc = security_context_to_sid((void*)value, size, &newsid);
2390         if (rc)
2391                 return rc;
2392
2393         isec->sid = newsid;
2394         return 0;
2395 }
2396
2397 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2398 {
2399         const int len = sizeof(XATTR_NAME_SELINUX);
2400         if (buffer && len <= buffer_size)
2401                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2402         return len;
2403 }
2404
2405 /* file security operations */
2406
2407 static int selinux_file_permission(struct file *file, int mask)
2408 {
2409         struct inode *inode = file->f_dentry->d_inode;
2410
2411         if (!mask) {
2412                 /* No permission to check.  Existence test. */
2413                 return 0;
2414         }
2415
2416         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2417         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2418                 mask |= MAY_APPEND;
2419
2420         return file_has_perm(current, file,
2421                              file_mask_to_av(inode->i_mode, mask));
2422 }
2423
2424 static int selinux_file_alloc_security(struct file *file)
2425 {
2426         return file_alloc_security(file);
2427 }
2428
2429 static void selinux_file_free_security(struct file *file)
2430 {
2431         file_free_security(file);
2432 }
2433
2434 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2435                               unsigned long arg)
2436 {
2437         int error = 0;
2438
2439         switch (cmd) {
2440                 case FIONREAD:
2441                 /* fall through */
2442                 case FIBMAP:
2443                 /* fall through */
2444                 case FIGETBSZ:
2445                 /* fall through */
2446                 case EXT2_IOC_GETFLAGS:
2447                 /* fall through */
2448                 case EXT2_IOC_GETVERSION:
2449                         error = file_has_perm(current, file, FILE__GETATTR);
2450                         break;
2451
2452                 case EXT2_IOC_SETFLAGS:
2453                 /* fall through */
2454                 case EXT2_IOC_SETVERSION:
2455                         error = file_has_perm(current, file, FILE__SETATTR);
2456                         break;
2457
2458                 /* sys_ioctl() checks */
2459                 case FIONBIO:
2460                 /* fall through */
2461                 case FIOASYNC:
2462                         error = file_has_perm(current, file, 0);
2463                         break;
2464
2465                 case KDSKBENT:
2466                 case KDSKBSENT:
2467                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2468                         break;
2469
2470                 /* default case assumes that the command will go
2471                  * to the file's ioctl() function.
2472                  */
2473                 default:
2474                         error = file_has_perm(current, file, FILE__IOCTL);
2475
2476         }
2477         return error;
2478 }
2479
2480 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2481 {
2482         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2483                 /*
2484                  * We are making executable an anonymous mapping or a
2485                  * private file mapping that will also be writable.
2486                  * This has an additional check.
2487                  */
2488                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2489                 if (rc)
2490                         return rc;
2491         }
2492
2493         if (file) {
2494                 /* read access is always possible with a mapping */
2495                 u32 av = FILE__READ;
2496
2497                 /* write access only matters if the mapping is shared */
2498                 if (shared && (prot & PROT_WRITE))
2499                         av |= FILE__WRITE;
2500
2501                 if (prot & PROT_EXEC)
2502                         av |= FILE__EXECUTE;
2503
2504                 return file_has_perm(current, file, av);
2505         }
2506         return 0;
2507 }
2508
2509 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2510                              unsigned long prot, unsigned long flags)
2511 {
2512         int rc;
2513
2514         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2515         if (rc)
2516                 return rc;
2517
2518         if (selinux_checkreqprot)
2519                 prot = reqprot;
2520
2521         return file_map_prot_check(file, prot,
2522                                    (flags & MAP_TYPE) == MAP_SHARED);
2523 }
2524
2525 static int selinux_file_mprotect(struct vm_area_struct *vma,
2526                                  unsigned long reqprot,
2527                                  unsigned long prot)
2528 {
2529         int rc;
2530
2531         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2532         if (rc)
2533                 return rc;
2534
2535         if (selinux_checkreqprot)
2536                 prot = reqprot;
2537
2538         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2539                 rc = 0;
2540                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2541                     vma->vm_end <= vma->vm_mm->brk) {
2542                         rc = task_has_perm(current, current,
2543                                            PROCESS__EXECHEAP);
2544                 } else if (!vma->vm_file &&
2545                            vma->vm_start <= vma->vm_mm->start_stack &&
2546                            vma->vm_end >= vma->vm_mm->start_stack) {
2547                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2548                 } else if (vma->vm_file && vma->anon_vma) {
2549                         /*
2550                          * We are making executable a file mapping that has
2551                          * had some COW done. Since pages might have been
2552                          * written, check ability to execute the possibly
2553                          * modified content.  This typically should only
2554                          * occur for text relocations.
2555                          */
2556                         rc = file_has_perm(current, vma->vm_file,
2557                                            FILE__EXECMOD);
2558                 }
2559                 if (rc)
2560                         return rc;
2561         }
2562
2563         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2564 }
2565
2566 static int selinux_file_lock(struct file *file, unsigned int cmd)
2567 {
2568         return file_has_perm(current, file, FILE__LOCK);
2569 }
2570
2571 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2572                               unsigned long arg)
2573 {
2574         int err = 0;
2575
2576         switch (cmd) {
2577                 case F_SETFL:
2578                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2579                                 err = -EINVAL;
2580                                 break;
2581                         }
2582
2583                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2584                                 err = file_has_perm(current, file,FILE__WRITE);
2585                                 break;
2586                         }
2587                         /* fall through */
2588                 case F_SETOWN:
2589                 case F_SETSIG:
2590                 case F_GETFL:
2591                 case F_GETOWN:
2592                 case F_GETSIG:
2593                         /* Just check FD__USE permission */
2594                         err = file_has_perm(current, file, 0);
2595                         break;
2596                 case F_GETLK:
2597                 case F_SETLK:
2598                 case F_SETLKW:
2599 #if BITS_PER_LONG == 32
2600                 case F_GETLK64:
2601                 case F_SETLK64:
2602                 case F_SETLKW64:
2603 #endif
2604                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2605                                 err = -EINVAL;
2606                                 break;
2607                         }
2608                         err = file_has_perm(current, file, FILE__LOCK);
2609                         break;
2610         }
2611
2612         return err;
2613 }
2614
2615 static int selinux_file_set_fowner(struct file *file)
2616 {
2617         struct task_security_struct *tsec;
2618         struct file_security_struct *fsec;
2619
2620         tsec = current->security;
2621         fsec = file->f_security;
2622         fsec->fown_sid = tsec->sid;
2623
2624         return 0;
2625 }
2626
2627 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2628                                        struct fown_struct *fown, int signum)
2629 {
2630         struct file *file;
2631         u32 perm;
2632         struct task_security_struct *tsec;
2633         struct file_security_struct *fsec;
2634
2635         /* struct fown_struct is never outside the context of a struct file */
2636         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2637
2638         tsec = tsk->security;
2639         fsec = file->f_security;
2640
2641         if (!signum)
2642                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2643         else
2644                 perm = signal_to_av(signum);
2645
2646         return avc_has_perm(fsec->fown_sid, tsec->sid,
2647                             SECCLASS_PROCESS, perm, NULL);
2648 }
2649
2650 static int selinux_file_receive(struct file *file)
2651 {
2652         return file_has_perm(current, file, file_to_av(file));
2653 }
2654
2655 /* task security operations */
2656
2657 static int selinux_task_create(unsigned long clone_flags)
2658 {
2659         int rc;
2660
2661         rc = secondary_ops->task_create(clone_flags);
2662         if (rc)
2663                 return rc;
2664
2665         return task_has_perm(current, current, PROCESS__FORK);
2666 }
2667
2668 static int selinux_task_alloc_security(struct task_struct *tsk)
2669 {
2670         struct task_security_struct *tsec1, *tsec2;
2671         int rc;
2672
2673         tsec1 = current->security;
2674
2675         rc = task_alloc_security(tsk);
2676         if (rc)
2677                 return rc;
2678         tsec2 = tsk->security;
2679
2680         tsec2->osid = tsec1->osid;
2681         tsec2->sid = tsec1->sid;
2682
2683         /* Retain the exec, fs, key, and sock SIDs across fork */
2684         tsec2->exec_sid = tsec1->exec_sid;
2685         tsec2->create_sid = tsec1->create_sid;
2686         tsec2->keycreate_sid = tsec1->keycreate_sid;
2687         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2688
2689         /* Retain ptracer SID across fork, if any.
2690            This will be reset by the ptrace hook upon any
2691            subsequent ptrace_attach operations. */
2692         tsec2->ptrace_sid = tsec1->ptrace_sid;
2693
2694         return 0;
2695 }
2696
2697 static void selinux_task_free_security(struct task_struct *tsk)
2698 {
2699         task_free_security(tsk);
2700 }
2701
2702 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2703 {
2704         /* Since setuid only affects the current process, and
2705            since the SELinux controls are not based on the Linux
2706            identity attributes, SELinux does not need to control
2707            this operation.  However, SELinux does control the use
2708            of the CAP_SETUID and CAP_SETGID capabilities using the
2709            capable hook. */
2710         return 0;
2711 }
2712
2713 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2714 {
2715         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2716 }
2717
2718 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2719 {
2720         /* See the comment for setuid above. */
2721         return 0;
2722 }
2723
2724 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2725 {
2726         return task_has_perm(current, p, PROCESS__SETPGID);
2727 }
2728
2729 static int selinux_task_getpgid(struct task_struct *p)
2730 {
2731         return task_has_perm(current, p, PROCESS__GETPGID);
2732 }
2733
2734 static int selinux_task_getsid(struct task_struct *p)
2735 {
2736         return task_has_perm(current, p, PROCESS__GETSESSION);
2737 }
2738
2739 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2740 {
2741         selinux_get_task_sid(p, secid);
2742 }
2743
2744 static int selinux_task_setgroups(struct group_info *group_info)
2745 {
2746         /* See the comment for setuid above. */
2747         return 0;
2748 }
2749
2750 static int selinux_task_setnice(struct task_struct *p, int nice)
2751 {
2752         int rc;
2753
2754         rc = secondary_ops->task_setnice(p, nice);
2755         if (rc)
2756                 return rc;
2757
2758         return task_has_perm(current,p, PROCESS__SETSCHED);
2759 }
2760
2761 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2762 {
2763         return task_has_perm(current, p, PROCESS__SETSCHED);
2764 }
2765
2766 static int selinux_task_getioprio(struct task_struct *p)
2767 {
2768         return task_has_perm(current, p, PROCESS__GETSCHED);
2769 }
2770
2771 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2772 {
2773         struct rlimit *old_rlim = current->signal->rlim + resource;
2774         int rc;
2775
2776         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2777         if (rc)
2778                 return rc;
2779
2780         /* Control the ability to change the hard limit (whether
2781            lowering or raising it), so that the hard limit can
2782            later be used as a safe reset point for the soft limit
2783            upon context transitions. See selinux_bprm_apply_creds. */
2784         if (old_rlim->rlim_max != new_rlim->rlim_max)
2785                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2786
2787         return 0;
2788 }
2789
2790 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2791 {
2792         return task_has_perm(current, p, PROCESS__SETSCHED);
2793 }
2794
2795 static int selinux_task_getscheduler(struct task_struct *p)
2796 {
2797         return task_has_perm(current, p, PROCESS__GETSCHED);
2798 }
2799
2800 static int selinux_task_movememory(struct task_struct *p)
2801 {
2802         return task_has_perm(current, p, PROCESS__SETSCHED);
2803 }
2804
2805 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2806                                 int sig, u32 secid)
2807 {
2808         u32 perm;
2809         int rc;
2810         struct task_security_struct *tsec;
2811
2812         rc = secondary_ops->task_kill(p, info, sig, secid);
2813         if (rc)
2814                 return rc;
2815
2816         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2817                 return 0;
2818
2819         if (!sig)
2820                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2821         else
2822                 perm = signal_to_av(sig);
2823         tsec = p->security;
2824         if (secid)
2825                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2826         else
2827                 rc = task_has_perm(current, p, perm);
2828         return rc;
2829 }
2830
2831 static int selinux_task_prctl(int option,
2832                               unsigned long arg2,
2833                               unsigned long arg3,
2834                               unsigned long arg4,
2835                               unsigned long arg5)
2836 {
2837         /* The current prctl operations do not appear to require
2838            any SELinux controls since they merely observe or modify
2839            the state of the current process. */
2840         return 0;
2841 }
2842
2843 static int selinux_task_wait(struct task_struct *p)
2844 {
2845         u32 perm;
2846
2847         perm = signal_to_av(p->exit_signal);
2848
2849         return task_has_perm(p, current, perm);
2850 }
2851
2852 static void selinux_task_reparent_to_init(struct task_struct *p)
2853 {
2854         struct task_security_struct *tsec;
2855
2856         secondary_ops->task_reparent_to_init(p);
2857
2858         tsec = p->security;
2859         tsec->osid = tsec->sid;
2860         tsec->sid = SECINITSID_KERNEL;
2861         return;
2862 }
2863
2864 static void selinux_task_to_inode(struct task_struct *p,
2865                                   struct inode *inode)
2866 {
2867         struct task_security_struct *tsec = p->security;
2868         struct inode_security_struct *isec = inode->i_security;
2869
2870         isec->sid = tsec->sid;
2871         isec->initialized = 1;
2872         return;
2873 }
2874
2875 /* Returns error only if unable to parse addresses */
2876 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2877 {
2878         int offset, ihlen, ret = -EINVAL;
2879         struct iphdr _iph, *ih;
2880
2881         offset = skb->nh.raw - skb->data;
2882         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2883         if (ih == NULL)
2884                 goto out;
2885
2886         ihlen = ih->ihl * 4;
2887         if (ihlen < sizeof(_iph))
2888                 goto out;
2889
2890         ad->u.net.v4info.saddr = ih->saddr;
2891         ad->u.net.v4info.daddr = ih->daddr;
2892         ret = 0;
2893
2894         switch (ih->protocol) {
2895         case IPPROTO_TCP: {
2896                 struct tcphdr _tcph, *th;
2897
2898                 if (ntohs(ih->frag_off) & IP_OFFSET)
2899                         break;
2900
2901                 offset += ihlen;
2902                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2903                 if (th == NULL)
2904                         break;
2905
2906                 ad->u.net.sport = th->source;
2907                 ad->u.net.dport = th->dest;
2908                 break;
2909         }
2910
2911         case IPPROTO_UDP: {
2912                 struct udphdr _udph, *uh;
2913
2914                 if (ntohs(ih->frag_off) & IP_OFFSET)
2915                         break;
2916
2917                 offset += ihlen;
2918                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2919                 if (uh == NULL)
2920                         break;
2921
2922                 ad->u.net.sport = uh->source;
2923                 ad->u.net.dport = uh->dest;
2924                 break;
2925         }
2926
2927         default:
2928                 break;
2929         }
2930 out:
2931         return ret;
2932 }
2933
2934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2935
2936 /* Returns error only if unable to parse addresses */
2937 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2938 {
2939         u8 nexthdr;
2940         int ret = -EINVAL, offset;
2941         struct ipv6hdr _ipv6h, *ip6;
2942
2943         offset = skb->nh.raw - skb->data;
2944         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2945         if (ip6 == NULL)
2946                 goto out;
2947
2948         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2949         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2950         ret = 0;
2951
2952         nexthdr = ip6->nexthdr;
2953         offset += sizeof(_ipv6h);
2954         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2955         if (offset < 0)
2956                 goto out;
2957
2958         switch (nexthdr) {
2959         case IPPROTO_TCP: {
2960                 struct tcphdr _tcph, *th;
2961
2962                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2963                 if (th == NULL)
2964                         break;
2965
2966                 ad->u.net.sport = th->source;
2967                 ad->u.net.dport = th->dest;
2968                 break;
2969         }
2970
2971         case IPPROTO_UDP: {
2972                 struct udphdr _udph, *uh;
2973
2974                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2975                 if (uh == NULL)
2976                         break;
2977
2978                 ad->u.net.sport = uh->source;
2979                 ad->u.net.dport = uh->dest;
2980                 break;
2981         }
2982
2983         /* includes fragments */
2984         default:
2985                 break;
2986         }
2987 out:
2988         return ret;
2989 }
2990
2991 #endif /* IPV6 */
2992
2993 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2994                              char **addrp, int *len, int src)
2995 {
2996         int ret = 0;
2997
2998         switch (ad->u.net.family) {
2999         case PF_INET:
3000                 ret = selinux_parse_skb_ipv4(skb, ad);
3001                 if (ret || !addrp)
3002                         break;
3003                 *len = 4;
3004                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3005                                         &ad->u.net.v4info.daddr);
3006                 break;
3007
3008 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3009         case PF_INET6:
3010                 ret = selinux_parse_skb_ipv6(skb, ad);
3011                 if (ret || !addrp)
3012                         break;
3013                 *len = 16;
3014                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3015                                         &ad->u.net.v6info.daddr);
3016                 break;
3017 #endif  /* IPV6 */
3018         default:
3019                 break;
3020         }
3021
3022         return ret;
3023 }
3024
3025 /* socket security operations */
3026 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3027                            u32 perms)
3028 {
3029         struct inode_security_struct *isec;
3030         struct task_security_struct *tsec;
3031         struct avc_audit_data ad;
3032         int err = 0;
3033
3034         tsec = task->security;
3035         isec = SOCK_INODE(sock)->i_security;
3036
3037         if (isec->sid == SECINITSID_KERNEL)
3038                 goto out;
3039
3040         AVC_AUDIT_DATA_INIT(&ad,NET);
3041         ad.u.net.sk = sock->sk;
3042         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3043
3044 out:
3045         return err;
3046 }
3047
3048 static int selinux_socket_create(int family, int type,
3049                                  int protocol, int kern)
3050 {
3051         int err = 0;
3052         struct task_security_struct *tsec;
3053         u32 newsid;
3054
3055         if (kern)
3056                 goto out;
3057
3058         tsec = current->security;
3059         newsid = tsec->sockcreate_sid ? : tsec->sid;
3060         err = avc_has_perm(tsec->sid, newsid,
3061                            socket_type_to_security_class(family, type,
3062                            protocol), SOCKET__CREATE, NULL);
3063
3064 out:
3065         return err;
3066 }
3067
3068 static void selinux_socket_post_create(struct socket *sock, int family,
3069                                        int type, int protocol, int kern)
3070 {
3071         struct inode_security_struct *isec;
3072         struct task_security_struct *tsec;
3073         u32 newsid;
3074
3075         isec = SOCK_INODE(sock)->i_security;
3076
3077         tsec = current->security;
3078         newsid = tsec->sockcreate_sid ? : tsec->sid;
3079         isec->sclass = socket_type_to_security_class(family, type, protocol);
3080         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3081         isec->initialized = 1;
3082
3083         return;
3084 }
3085
3086 /* Range of port numbers used to automatically bind.
3087    Need to determine whether we should perform a name_bind
3088    permission check between the socket and the port number. */
3089 #define ip_local_port_range_0 sysctl_local_port_range[0]
3090 #define ip_local_port_range_1 sysctl_local_port_range[1]
3091
3092 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3093 {
3094         u16 family;
3095         int err;
3096
3097         err = socket_has_perm(current, sock, SOCKET__BIND);
3098         if (err)
3099                 goto out;
3100
3101         /*
3102          * If PF_INET or PF_INET6, check name_bind permission for the port.
3103          * Multiple address binding for SCTP is not supported yet: we just
3104          * check the first address now.
3105          */
3106         family = sock->sk->sk_family;
3107         if (family == PF_INET || family == PF_INET6) {
3108                 char *addrp;
3109                 struct inode_security_struct *isec;
3110                 struct task_security_struct *tsec;
3111                 struct avc_audit_data ad;
3112                 struct sockaddr_in *addr4 = NULL;
3113                 struct sockaddr_in6 *addr6 = NULL;
3114                 unsigned short snum;
3115                 struct sock *sk = sock->sk;
3116                 u32 sid, node_perm, addrlen;
3117
3118                 tsec = current->security;
3119                 isec = SOCK_INODE(sock)->i_security;
3120
3121                 if (family == PF_INET) {
3122                         addr4 = (struct sockaddr_in *)address;
3123                         snum = ntohs(addr4->sin_port);
3124                         addrlen = sizeof(addr4->sin_addr.s_addr);
3125                         addrp = (char *)&addr4->sin_addr.s_addr;
3126                 } else {
3127                         addr6 = (struct sockaddr_in6 *)address;
3128                         snum = ntohs(addr6->sin6_port);
3129                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3130                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3131                 }
3132
3133                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3134                            snum > ip_local_port_range_1)) {
3135                         err = security_port_sid(sk->sk_family, sk->sk_type,
3136                                                 sk->sk_protocol, snum, &sid);
3137                         if (err)
3138                                 goto out;
3139                         AVC_AUDIT_DATA_INIT(&ad,NET);
3140                         ad.u.net.sport = htons(snum);
3141                         ad.u.net.family = family;
3142                         err = avc_has_perm(isec->sid, sid,
3143                                            isec->sclass,
3144                                            SOCKET__NAME_BIND, &ad);
3145                         if (err)
3146                                 goto out;
3147                 }
3148
3149                 switch(isec->sclass) {
3150                 case SECCLASS_TCP_SOCKET:
3151                         node_perm = TCP_SOCKET__NODE_BIND;
3152                         break;
3153
3154                 case SECCLASS_UDP_SOCKET:
3155                         node_perm = UDP_SOCKET__NODE_BIND;
3156                         break;
3157
3158                 default:
3159                         node_perm = RAWIP_SOCKET__NODE_BIND;
3160                         break;
3161                 }
3162
3163                 err = security_node_sid(family, addrp, addrlen, &sid);
3164                 if (err)
3165                         goto out;
3166
3167                 AVC_AUDIT_DATA_INIT(&ad,NET);
3168                 ad.u.net.sport = htons(snum);
3169                 ad.u.net.family = family;
3170
3171                 if (family == PF_INET)
3172                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3173                 else
3174                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3175
3176                 err = avc_has_perm(isec->sid, sid,
3177                                    isec->sclass, node_perm, &ad);
3178                 if (err)
3179                         goto out;
3180         }
3181 out:
3182         return err;
3183 }
3184
3185 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3186 {
3187         struct inode_security_struct *isec;
3188         int err;
3189
3190         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3191         if (err)
3192                 return err;
3193
3194         /*
3195          * If a TCP socket, check name_connect permission for the port.
3196          */
3197         isec = SOCK_INODE(sock)->i_security;
3198         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3199                 struct sock *sk = sock->sk;
3200                 struct avc_audit_data ad;
3201                 struct sockaddr_in *addr4 = NULL;
3202                 struct sockaddr_in6 *addr6 = NULL;
3203                 unsigned short snum;
3204                 u32 sid;
3205
3206                 if (sk->sk_family == PF_INET) {
3207                         addr4 = (struct sockaddr_in *)address;
3208                         if (addrlen < sizeof(struct sockaddr_in))
3209                                 return -EINVAL;
3210                         snum = ntohs(addr4->sin_port);
3211                 } else {
3212                         addr6 = (struct sockaddr_in6 *)address;
3213                         if (addrlen < SIN6_LEN_RFC2133)
3214                                 return -EINVAL;
3215                         snum = ntohs(addr6->sin6_port);
3216                 }
3217
3218                 err = security_port_sid(sk->sk_family, sk->sk_type,
3219                                         sk->sk_protocol, snum, &sid);
3220                 if (err)
3221                         goto out;
3222
3223                 AVC_AUDIT_DATA_INIT(&ad,NET);
3224                 ad.u.net.dport = htons(snum);
3225                 ad.u.net.family = sk->sk_family;
3226                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3227                                    TCP_SOCKET__NAME_CONNECT, &ad);
3228                 if (err)
3229                         goto out;
3230         }
3231
3232 out:
3233         return err;
3234 }
3235
3236 static int selinux_socket_listen(struct socket *sock, int backlog)
3237 {
3238         return socket_has_perm(current, sock, SOCKET__LISTEN);
3239 }
3240
3241 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3242 {
3243         int err;
3244         struct inode_security_struct *isec;
3245         struct inode_security_struct *newisec;
3246
3247         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3248         if (err)
3249                 return err;
3250
3251         newisec = SOCK_INODE(newsock)->i_security;
3252
3253         isec = SOCK_INODE(sock)->i_security;
3254         newisec->sclass = isec->sclass;
3255         newisec->sid = isec->sid;
3256         newisec->initialized = 1;
3257
3258         return 0;
3259 }
3260
3261 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3262                                   int size)
3263 {
3264         return socket_has_perm(current, sock, SOCKET__WRITE);
3265 }
3266
3267 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3268                                   int size, int flags)
3269 {
3270         return socket_has_perm(current, sock, SOCKET__READ);
3271 }
3272
3273 static int selinux_socket_getsockname(struct socket *sock)
3274 {
3275         return socket_has_perm(current, sock, SOCKET__GETATTR);
3276 }
3277
3278 static int selinux_socket_getpeername(struct socket *sock)
3279 {
3280         return socket_has_perm(current, sock, SOCKET__GETATTR);
3281 }
3282
3283 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3284 {
3285         return socket_has_perm(current, sock, SOCKET__SETOPT);
3286 }
3287
3288 static int selinux_socket_getsockopt(struct socket *sock, int level,
3289                                      int optname)
3290 {
3291         return socket_has_perm(current, sock, SOCKET__GETOPT);
3292 }
3293
3294 static int selinux_socket_shutdown(struct socket *sock, int how)
3295 {
3296         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3297 }
3298
3299 static int selinux_socket_unix_stream_connect(struct socket *sock,
3300                                               struct socket *other,
3301                                               struct sock *newsk)
3302 {
3303         struct sk_security_struct *ssec;
3304         struct inode_security_struct *isec;
3305         struct inode_security_struct *other_isec;
3306         struct avc_audit_data ad;
3307         int err;
3308
3309         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3310         if (err)
3311                 return err;
3312
3313         isec = SOCK_INODE(sock)->i_security;
3314         other_isec = SOCK_INODE(other)->i_security;
3315
3316         AVC_AUDIT_DATA_INIT(&ad,NET);
3317         ad.u.net.sk = other->sk;
3318
3319         err = avc_has_perm(isec->sid, other_isec->sid,
3320                            isec->sclass,
3321                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3322         if (err)
3323                 return err;
3324
3325         /* connecting socket */
3326         ssec = sock->sk->sk_security;
3327         ssec->peer_sid = other_isec->sid;
3328
3329         /* server child socket */
3330         ssec = newsk->sk_security;
3331         ssec->peer_sid = isec->sid;
3332
3333         return 0;
3334 }
3335
3336 static int selinux_socket_unix_may_send(struct socket *sock,
3337                                         struct socket *other)
3338 {
3339         struct inode_security_struct *isec;
3340         struct inode_security_struct *other_isec;
3341         struct avc_audit_data ad;
3342         int err;
3343
3344         isec = SOCK_INODE(sock)->i_security;
3345         other_isec = SOCK_INODE(other)->i_security;
3346
3347         AVC_AUDIT_DATA_INIT(&ad,NET);
3348         ad.u.net.sk = other->sk;
3349
3350         err = avc_has_perm(isec->sid, other_isec->sid,
3351                            isec->sclass, SOCKET__SENDTO, &ad);
3352         if (err)
3353                 return err;
3354
3355         return 0;
3356 }
3357
3358 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3359                 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3360                 u16 family, char *addrp, int len)
3361 {
3362         int err = 0;
3363         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3364
3365         if (!skb->dev)
3366                 goto out;
3367
3368         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3369         if (err)
3370                 goto out;
3371
3372         switch (sock_class) {
3373         case SECCLASS_UDP_SOCKET:
3374                 netif_perm = NETIF__UDP_RECV;
3375                 node_perm = NODE__UDP_RECV;
3376                 recv_perm = UDP_SOCKET__RECV_MSG;
3377                 break;
3378
3379         case SECCLASS_TCP_SOCKET:
3380                 netif_perm = NETIF__TCP_RECV;
3381                 node_perm = NODE__TCP_RECV;
3382                 recv_perm = TCP_SOCKET__RECV_MSG;
3383                 break;
3384
3385         default:
3386                 netif_perm = NETIF__RAWIP_RECV;
3387                 node_perm = NODE__RAWIP_RECV;
3388                 break;
3389         }
3390
3391         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3392         if (err)
3393                 goto out;
3394
3395         err = security_node_sid(family, addrp, len, &node_sid);
3396         if (err)
3397                 goto out;
3398
3399         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3400         if (err)
3401                 goto out;
3402
3403         if (recv_perm) {
3404                 u32 port_sid;
3405
3406                 err = security_port_sid(sk->sk_family, sk->sk_type,
3407                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3408                                         &port_sid);
3409                 if (err)
3410                         goto out;
3411
3412                 err = avc_has_perm(sock_sid, port_sid,
3413                                    sock_class, recv_perm, ad);
3414         }
3415
3416 out:
3417         return err;
3418 }
3419
3420 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3421 {
3422         u16 family;
3423         u16 sock_class = 0;
3424         char *addrp;
3425         int len, err = 0;
3426         u32 sock_sid = 0;
3427         struct socket *sock;
3428         struct avc_audit_data ad;
3429
3430         family = sk->sk_family;
3431         if (family != PF_INET && family != PF_INET6)
3432                 goto out;
3433
3434         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3435         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3436                 family = PF_INET;
3437
3438         read_lock_bh(&sk->sk_callback_lock);
3439         sock = sk->sk_socket;
3440         if (sock) {
3441                 struct inode *inode;
3442                 inode = SOCK_INODE(sock);
3443                 if (inode) {
3444                         struct inode_security_struct *isec;
3445                         isec = inode->i_security;
3446                         sock_sid = isec->sid;
3447                         sock_class = isec->sclass;
3448                 }
3449         }
3450         read_unlock_bh(&sk->sk_callback_lock);
3451         if (!sock_sid)
3452                 goto out;
3453
3454         AVC_AUDIT_DATA_INIT(&ad, NET);
3455         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3456         ad.u.net.family = family;
3457
3458         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3459         if (err)
3460                 goto out;
3461
3462         if (selinux_compat_net)
3463                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3464                                                   sock_class, family,
3465                                                   addrp, len);
3466         else
3467                 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3468                                    PACKET__RECV, &ad);
3469         if (err)
3470                 goto out;
3471
3472         err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3473 out:
3474         return err;
3475 }
3476
3477 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3478                                             int __user *optlen, unsigned len)
3479 {
3480         int err = 0;
3481         char *scontext;
3482         u32 scontext_len;
3483         struct sk_security_struct *ssec;
3484         struct inode_security_struct *isec;
3485         u32 peer_sid = 0;
3486
3487         isec = SOCK_INODE(sock)->i_security;
3488
3489         /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3490         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3491                 ssec = sock->sk->sk_security;
3492                 peer_sid = ssec->peer_sid;
3493         }
3494         else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3495                 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3496
3497                 if (peer_sid == SECSID_NULL) {
3498                         err = -ENOPROTOOPT;
3499                         goto out;
3500                 }
3501         }
3502         else {
3503                 err = -ENOPROTOOPT;
3504                 goto out;
3505         }
3506
3507         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3508
3509         if (err)
3510                 goto out;
3511
3512         if (scontext_len > len) {
3513                 err = -ERANGE;
3514                 goto out_len;
3515         }
3516
3517         if (copy_to_user(optval, scontext, scontext_len))
3518                 err = -EFAULT;
3519
3520 out_len:
3521         if (put_user(scontext_len, optlen))
3522                 err = -EFAULT;
3523
3524         kfree(scontext);
3525 out:
3526         return err;
3527 }
3528
3529 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3530 {
3531         u32 peer_secid = SECSID_NULL;
3532         int err = 0;
3533
3534         if (sock && (sock->sk->sk_family == PF_UNIX))
3535                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3536         else if (skb)
3537                 peer_secid = selinux_socket_getpeer_dgram(skb);
3538
3539         if (peer_secid == SECSID_NULL)
3540                 err = -EINVAL;
3541         *secid = peer_secid;
3542
3543         return err;
3544 }
3545
3546 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3547 {
3548         return sk_alloc_security(sk, family, priority);
3549 }
3550
3551 static void selinux_sk_free_security(struct sock *sk)
3552 {
3553         sk_free_security(sk);
3554 }
3555
3556 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3557 {
3558         struct inode_security_struct *isec;
3559         u32 sock_sid = SECINITSID_ANY_SOCKET;
3560
3561         if (!sk)
3562                 return selinux_no_sk_sid(fl);
3563
3564         read_lock_bh(&sk->sk_callback_lock);
3565         isec = get_sock_isec(sk);
3566
3567         if (isec)
3568                 sock_sid = isec->sid;
3569
3570         read_unlock_bh(&sk->sk_callback_lock);
3571         return sock_sid;
3572 }
3573
3574 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3575 {
3576         int err = 0;
3577         u32 perm;
3578         struct nlmsghdr *nlh;
3579         struct socket *sock = sk->sk_socket;
3580         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3581
3582         if (skb->len < NLMSG_SPACE(0)) {
3583                 err = -EINVAL;
3584                 goto out;
3585         }
3586         nlh = (struct nlmsghdr *)skb->data;
3587
3588         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3589         if (err) {
3590                 if (err == -EINVAL) {
3591                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3592                                   "SELinux:  unrecognized netlink message"
3593                                   " type=%hu for sclass=%hu\n",
3594                                   nlh->nlmsg_type, isec->sclass);
3595                         if (!selinux_enforcing)
3596                                 err = 0;
3597                 }
3598
3599                 /* Ignore */
3600                 if (err == -ENOENT)
3601                         err = 0;
3602                 goto out;
3603         }
3604
3605         err = socket_has_perm(current, sock, perm);
3606 out:
3607         return err;
3608 }
3609
3610 #ifdef CONFIG_NETFILTER
3611
3612 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3613                                             struct inode_security_struct *isec,
3614                                             struct avc_audit_data *ad,
3615                                             u16 family, char *addrp, int len)
3616 {
3617         int err;
3618         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3619
3620         err = sel_netif_sids(dev, &if_sid, NULL);
3621         if (err)
3622                 goto out;
3623
3624         switch (isec->sclass) {
3625         case SECCLASS_UDP_SOCKET:
3626                 netif_perm = NETIF__UDP_SEND;
3627                 node_perm = NODE__UDP_SEND;
3628                 send_perm = UDP_SOCKET__SEND_MSG;
3629                 break;
3630
3631         case SECCLASS_TCP_SOCKET:
3632                 netif_perm = NETIF__TCP_SEND;
3633                 node_perm = NODE__TCP_SEND;
3634                 send_perm = TCP_SOCKET__SEND_MSG;
3635                 break;
3636
3637         default:
3638                 netif_perm = NETIF__RAWIP_SEND;
3639                 node_perm = NODE__RAWIP_SEND;
3640                 break;
3641         }
3642
3643         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3644         if (err)
3645                 goto out;
3646
3647         err = security_node_sid(family, addrp, len, &node_sid);
3648         if (err)
3649                 goto out;
3650
3651         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3652         if (err)
3653                 goto out;
3654
3655         if (send_perm) {
3656                 u32 port_sid;
3657
3658                 err = security_port_sid(sk->sk_family,
3659                                         sk->sk_type,
3660                                         sk->sk_protocol,
3661                                         ntohs(ad->u.net.dport),
3662                                         &port_sid);
3663                 if (err)
3664                         goto out;
3665
3666                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3667                                    send_perm, ad);
3668         }
3669 out:
3670         return err;
3671 }
3672
3673 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3674                                               struct sk_buff **pskb,
3675                                               const struct net_device *in,
3676                                               const struct net_device *out,
3677                                               int (*okfn)(struct sk_buff *),
3678                                               u16 family)
3679 {
3680         char *addrp;
3681         int len, err = 0;
3682         struct sock *sk;
3683         struct socket *sock;
3684         struct inode *inode;
3685         struct sk_buff *skb = *pskb;
3686         struct inode_security_struct *isec;
3687         struct avc_audit_data ad;
3688         struct net_device *dev = (struct net_device *)out;
3689
3690         sk = skb->sk;
3691         if (!sk)
3692                 goto out;
3693
3694         sock = sk->sk_socket;
3695         if (!sock)
3696                 goto out;
3697
3698         inode = SOCK_INODE(sock);
3699         if (!inode)
3700                 goto out;
3701
3702         isec = inode->i_security;
3703
3704         AVC_AUDIT_DATA_INIT(&ad, NET);
3705         ad.u.net.netif = dev->name;
3706         ad.u.net.family = family;
3707
3708         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3709         if (err)
3710                 goto out;
3711
3712         if (selinux_compat_net)
3713                 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3714                                                        family, addrp, len);
3715         else
3716                 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3717                                    PACKET__SEND, &ad);
3718
3719         if (err)
3720                 goto out;
3721
3722         err = selinux_xfrm_postroute_last(isec->sid, skb);
3723 out:
3724         return err ? NF_DROP : NF_ACCEPT;
3725 }
3726
3727 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3728                                                 struct sk_buff **pskb,
3729                                                 const struct net_device *in,
3730                                                 const struct net_device *out,
3731                                                 int (*okfn)(struct sk_buff *))
3732 {
3733         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3734 }
3735
3736 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3737
3738 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3739                                                 struct sk_buff **pskb,
3740                                                 const struct net_device *in,
3741                                                 const struct net_device *out,
3742                                                 int (*okfn)(struct sk_buff *))
3743 {
3744         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3745 }
3746
3747 #endif  /* IPV6 */
3748
3749 #endif  /* CONFIG_NETFILTER */
3750
3751 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3752 {
3753         int err;
3754
3755         err = secondary_ops->netlink_send(sk, skb);
3756         if (err)
3757                 return err;
3758
3759         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3760                 err = selinux_nlmsg_perm(sk, skb);
3761
3762         return err;
3763 }
3764
3765 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3766 {
3767         int err;
3768         struct avc_audit_data ad;
3769
3770         err = secondary_ops->netlink_recv(skb, capability);
3771         if (err)
3772                 return err;
3773
3774         AVC_AUDIT_DATA_INIT(&ad, CAP);
3775         ad.u.cap = capability;
3776
3777         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3778                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3779 }
3780
3781 static int ipc_alloc_security(struct task_struct *task,
3782                               struct kern_ipc_perm *perm,
3783                               u16 sclass)
3784 {
3785         struct task_security_struct *tsec = task->security;
3786         struct ipc_security_struct *isec;
3787
3788         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3789         if (!isec)
3790                 return -ENOMEM;
3791
3792         isec->sclass = sclass;
3793         isec->ipc_perm = perm;
3794         isec->sid = tsec->sid;
3795         perm->security = isec;
3796
3797         return 0;
3798 }
3799
3800 static void ipc_free_security(struct kern_ipc_perm *perm)
3801 {
3802         struct ipc_security_struct *isec = perm->security;
3803         perm->security = NULL;
3804         kfree(isec);
3805 }
3806
3807 static int msg_msg_alloc_security(struct msg_msg *msg)
3808 {
3809         struct msg_security_struct *msec;
3810
3811         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3812         if (!msec)
3813                 return -ENOMEM;
3814
3815         msec->msg = msg;
3816         msec->sid = SECINITSID_UNLABELED;
3817         msg->security = msec;
3818
3819         return 0;
3820 }
3821
3822 static void msg_msg_free_security(struct msg_msg *msg)
3823 {
3824         struct msg_security_struct *msec = msg->security;
3825
3826         msg->security = NULL;
3827         kfree(msec);
3828 }
3829
3830 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3831                         u32 perms)
3832 {
3833         struct task_security_struct *tsec;
3834         struct ipc_security_struct *isec;
3835         struct avc_audit_data ad;
3836
3837         tsec = current->security;
3838         isec = ipc_perms->security;
3839
3840         AVC_AUDIT_DATA_INIT(&ad, IPC);
3841         ad.u.ipc_id = ipc_perms->key;
3842
3843         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3844 }
3845
3846 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3847 {
3848         return msg_msg_alloc_security(msg);
3849 }
3850
3851 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3852 {
3853         msg_msg_free_security(msg);
3854 }
3855
3856 /* message queue security operations */
3857 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3858 {
3859         struct task_security_struct *tsec;
3860         struct ipc_security_struct *isec;
3861         struct avc_audit_data ad;
3862         int rc;
3863
3864         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3865         if (rc)
3866                 return rc;
3867
3868         tsec = current->security;
3869         isec = msq->q_perm.security;
3870
3871         AVC_AUDIT_DATA_INIT(&ad, IPC);
3872         ad.u.ipc_id = msq->q_perm.key;
3873
3874         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3875                           MSGQ__CREATE, &ad);
3876         if (rc) {
3877                 ipc_free_security(&msq->q_perm);
3878                 return rc;
3879         }
3880         return 0;
3881 }
3882
3883 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3884 {
3885         ipc_free_security(&msq->q_perm);
3886 }
3887
3888 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3889 {
3890         struct task_security_struct *tsec;
3891         struct ipc_security_struct *isec;
3892         struct avc_audit_data ad;
3893
3894         tsec = current->security;
3895         isec = msq->q_perm.security;
3896
3897         AVC_AUDIT_DATA_INIT(&ad, IPC);
3898         ad.u.ipc_id = msq->q_perm.key;
3899
3900         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3901                             MSGQ__ASSOCIATE, &ad);
3902 }
3903
3904 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3905 {
3906         int err;
3907         int perms;
3908
3909         switch(cmd) {
3910         case IPC_INFO:
3911         case MSG_INFO:
3912                 /* No specific object, just general system-wide information. */
3913                 return task_has_system(current, SYSTEM__IPC_INFO);
3914         case IPC_STAT:
3915         case MSG_STAT:
3916                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3917                 break;
3918         case IPC_SET:
3919                 perms = MSGQ__SETATTR;
3920                 break;
3921         case IPC_RMID:
3922                 perms = MSGQ__DESTROY;
3923                 break;
3924         default:
3925                 return 0;
3926         }
3927
3928         err = ipc_has_perm(&msq->q_perm, perms);
3929         return err;
3930 }
3931
3932 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3933 {
3934         struct task_security_struct *tsec;
3935         struct ipc_security_struct *isec;
3936         struct msg_security_struct *msec;
3937         struct avc_audit_data ad;
3938         int rc;
3939
3940         tsec = current->security;
3941         isec = msq->q_perm.security;
3942         msec = msg->security;
3943
3944         /*
3945          * First time through, need to assign label to the message
3946          */
3947         if (msec->sid == SECINITSID_UNLABELED) {
3948                 /*
3949                  * Compute new sid based on current process and
3950                  * message queue this message will be stored in
3951                  */
3952                 rc = security_transition_sid(tsec->sid,
3953                                              isec->sid,
3954                                              SECCLASS_MSG,
3955                                              &msec->sid);
3956                 if (rc)
3957                         return rc;
3958         }
3959
3960         AVC_AUDIT_DATA_INIT(&ad, IPC);
3961         ad.u.ipc_id = msq->q_perm.key;
3962
3963         /* Can this process write to the queue? */
3964         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3965                           MSGQ__WRITE, &ad);
3966         if (!rc)
3967                 /* Can this process send the message */
3968                 rc = avc_has_perm(tsec->sid, msec->sid,
3969                                   SECCLASS_MSG, MSG__SEND, &ad);
3970         if (!rc)
3971                 /* Can the message be put in the queue? */
3972                 rc = avc_has_perm(msec->sid, isec->sid,
3973                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3974
3975         return rc;
3976 }
3977
3978 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3979                                     struct task_struct *target,
3980                                     long type, int mode)
3981 {
3982         struct task_security_struct *tsec;
3983         struct ipc_security_struct *isec;
3984         struct msg_security_struct *msec;
3985         struct avc_audit_data ad;
3986         int rc;
3987
3988         tsec = target->security;
3989         isec = msq->q_perm.security;
3990         msec = msg->security;
3991
3992         AVC_AUDIT_DATA_INIT(&ad, IPC);
3993         ad.u.ipc_id = msq->q_perm.key;
3994
3995         rc = avc_has_perm(tsec->sid, isec->sid,
3996                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3997         if (!rc)
3998                 rc = avc_has_perm(tsec->sid, msec->sid,
3999                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4000         return rc;
4001 }
4002
4003 /* Shared Memory security operations */
4004 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4005 {
4006         struct task_security_struct *tsec;
4007         struct ipc_security_struct *isec;
4008         struct avc_audit_data ad;
4009         int rc;
4010
4011         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4012         if (rc)
4013                 return rc;
4014
4015         tsec = current->security;
4016         isec = shp->shm_perm.security;
4017
4018         AVC_AUDIT_DATA_INIT(&ad, IPC);
4019         ad.u.ipc_id = shp->shm_perm.key;
4020
4021         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4022                           SHM__CREATE, &ad);
4023         if (rc) {
4024                 ipc_free_security(&shp->shm_perm);
4025                 return rc;
4026         }
4027         return 0;
4028 }
4029
4030 static void selinux_shm_free_security(struct shmid_kernel *shp)
4031 {
4032         ipc_free_security(&shp->shm_perm);
4033 }
4034
4035 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4036 {
4037         struct task_security_struct *tsec;
4038         struct ipc_security_struct *isec;
4039         struct avc_audit_data ad;
4040
4041         tsec = current->security;
4042         isec = shp->shm_perm.security;
4043
4044         AVC_AUDIT_DATA_INIT(&ad, IPC);
4045         ad.u.ipc_id = shp->shm_perm.key;
4046
4047         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4048                             SHM__ASSOCIATE, &ad);
4049 }
4050
4051 /* Note, at this point, shp is locked down */
4052 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4053 {
4054         int perms;
4055         int err;
4056
4057         switch(cmd) {
4058         case IPC_INFO:
4059         case SHM_INFO:
4060                 /* No specific object, just general system-wide information. */
4061                 return task_has_system(current, SYSTEM__IPC_INFO);
4062         case IPC_STAT:
4063         case SHM_STAT:
4064                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4065                 break;
4066         case IPC_SET:
4067                 perms = SHM__SETATTR;
4068                 break;
4069         case SHM_LOCK:
4070         case SHM_UNLOCK:
4071                 perms = SHM__LOCK;
4072                 break;
4073         case IPC_RMID:
4074                 perms = SHM__DESTROY;
4075                 break;
4076         default:
4077                 return 0;
4078         }
4079
4080         err = ipc_has_perm(&shp->shm_perm, perms);
4081         return err;
4082 }
4083
4084 static int selinux_shm_shmat(struct shmid_kernel *shp,
4085                              char __user *shmaddr, int shmflg)
4086 {
4087         u32 perms;
4088         int rc;
4089
4090         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4091         if (rc)
4092                 return rc;
4093
4094         if (shmflg & SHM_RDONLY)
4095                 perms = SHM__READ;
4096         else
4097                 perms = SHM__READ | SHM__WRITE;
4098
4099         return ipc_has_perm(&shp->shm_perm, perms);
4100 }
4101
4102 /* Semaphore security operations */
4103 static int selinux_sem_alloc_security(struct sem_array *sma)
4104 {
4105         struct task_security_struct *tsec;
4106         struct ipc_security_struct *isec;
4107         struct avc_audit_data ad;
4108         int rc;
4109
4110         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4111         if (rc)
4112                 return rc;
4113
4114         tsec = current->security;
4115         isec = sma->sem_perm.security;
4116
4117         AVC_AUDIT_DATA_INIT(&ad, IPC);
4118         ad.u.ipc_id = sma->sem_perm.key;
4119
4120         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4121                           SEM__CREATE, &ad);
4122         if (rc) {
4123                 ipc_free_security(&sma->sem_perm);
4124                 return rc;
4125         }
4126         return 0;
4127 }
4128
4129 static void selinux_sem_free_security(struct sem_array *sma)
4130 {
4131         ipc_free_security(&sma->sem_perm);
4132 }
4133
4134 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4135 {
4136         struct task_security_struct *tsec;
4137         struct ipc_security_struct *isec;
4138         struct avc_audit_data ad;
4139
4140         tsec = current->security;
4141         isec = sma->sem_perm.security;
4142
4143         AVC_AUDIT_DATA_INIT(&ad, IPC);
4144         ad.u.ipc_id = sma->sem_perm.key;
4145
4146         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4147                             SEM__ASSOCIATE, &ad);
4148 }
4149
4150 /* Note, at this point, sma is locked down */
4151 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4152 {
4153         int err;
4154         u32 perms;
4155
4156         switch(cmd) {
4157         case IPC_INFO:
4158         case SEM_INFO:
4159                 /* No specific object, just general system-wide information. */
4160                 return task_has_system(current, SYSTEM__IPC_INFO);
4161         case GETPID:
4162         case GETNCNT:
4163         case GETZCNT:
4164                 perms = SEM__GETATTR;
4165                 break;
4166         case GETVAL:
4167         case GETALL:
4168                 perms = SEM__READ;
4169                 break;
4170         case SETVAL:
4171         case SETALL:
4172                 perms = SEM__WRITE;
4173                 break;
4174         case IPC_RMID:
4175                 perms = SEM__DESTROY;
4176                 break;
4177         case IPC_SET:
4178                 perms = SEM__SETATTR;
4179                 break;
4180         case IPC_STAT:
4181         case SEM_STAT:
4182                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4183                 break;
4184         default:
4185                 return 0;
4186         }
4187
4188         err = ipc_has_perm(&sma->sem_perm, perms);
4189         return err;
4190 }
4191
4192 static int selinux_sem_semop(struct sem_array *sma,
4193                              struct sembuf *sops, unsigned nsops, int alter)
4194 {
4195         u32 perms;
4196
4197         if (alter)
4198                 perms = SEM__READ | SEM__WRITE;
4199         else
4200                 perms = SEM__READ;
4201
4202         return ipc_has_perm(&sma->sem_perm, perms);
4203 }
4204
4205 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4206 {
4207         u32 av = 0;
4208
4209         av = 0;
4210         if (flag & S_IRUGO)
4211                 av |= IPC__UNIX_READ;
4212         if (flag & S_IWUGO)
4213                 av |= IPC__UNIX_WRITE;
4214
4215         if (av == 0)
4216                 return 0;
4217
4218         return ipc_has_perm(ipcp, av);
4219 }
4220
4221 /* module stacking operations */
4222 static int selinux_register_security (const char *name, struct security_operations *ops)
4223 {
4224         if (secondary_ops != original_ops) {
4225                 printk(KERN_INFO "%s:  There is already a secondary security "
4226                        "module registered.\n", __FUNCTION__);
4227                 return -EINVAL;
4228         }
4229
4230         secondary_ops = ops;
4231
4232         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4233                __FUNCTION__,
4234                name);
4235
4236         return 0;
4237 }
4238
4239 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4240 {
4241         if (ops != secondary_ops) {
4242                 printk (KERN_INFO "%s:  trying to unregister a security module "
4243                         "that is not registered.\n", __FUNCTION__);
4244                 return -EINVAL;
4245         }
4246
4247         secondary_ops = original_ops;
4248
4249         return 0;
4250 }
4251
4252 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4253 {
4254         if (inode)
4255                 inode_doinit_with_dentry(inode, dentry);
4256 }
4257
4258 static int selinux_getprocattr(struct task_struct *p,
4259                                char *name, void *value, size_t size)
4260 {
4261         struct task_security_struct *tsec;
4262         u32 sid;
4263         int error;
4264
4265         if (current != p) {
4266                 error = task_has_perm(current, p, PROCESS__GETATTR);
4267                 if (error)
4268                         return error;
4269         }
4270
4271         tsec = p->security;
4272
4273         if (!strcmp(name, "current"))
4274                 sid = tsec->sid;
4275         else if (!strcmp(name, "prev"))
4276                 sid = tsec->osid;
4277         else if (!strcmp(name, "exec"))
4278                 sid = tsec->exec_sid;
4279         else if (!strcmp(name, "fscreate"))
4280                 sid = tsec->create_sid;
4281         else if (!strcmp(name, "keycreate"))
4282                 sid = tsec->keycreate_sid;
4283         else if (!strcmp(name, "sockcreate"))
4284                 sid = tsec->sockcreate_sid;
4285         else
4286                 return -EINVAL;
4287
4288         if (!sid)
4289                 return 0;
4290
4291         return selinux_getsecurity(sid, value, size);
4292 }
4293
4294 static int selinux_setprocattr(struct task_struct *p,
4295                                char *name, void *value, size_t size)
4296 {
4297         struct task_security_struct *tsec;
4298         u32 sid = 0;
4299         int error;
4300         char *str = value;
4301
4302         if (current != p) {
4303                 /* SELinux only allows a process to change its own
4304                    security attributes. */
4305                 return -EACCES;
4306         }
4307
4308         /*
4309          * Basic control over ability to set these attributes at all.
4310          * current == p, but we'll pass them separately in case the
4311          * above restriction is ever removed.
4312          */
4313         if (!strcmp(name, "exec"))
4314                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4315         else if (!strcmp(name, "fscreate"))
4316                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4317         else if (!strcmp(name, "keycreate"))
4318                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4319         else if (!strcmp(name, "sockcreate"))
4320                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4321         else if (!strcmp(name, "current"))
4322                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4323         else
4324                 error = -EINVAL;
4325         if (error)
4326                 return error;
4327
4328         /* Obtain a SID for the context, if one was specified. */
4329         if (size && str[1] && str[1] != '\n') {
4330                 if (str[size-1] == '\n') {
4331                         str[size-1] = 0;
4332                         size--;
4333                 }
4334                 error = security_context_to_sid(value, size, &sid);
4335                 if (error)
4336                         return error;
4337         }
4338
4339         /* Permission checking based on the specified context is
4340            performed during the actual operation (execve,
4341            open/mkdir/...), when we know the full context of the
4342            operation.  See selinux_bprm_set_security for the execve
4343            checks and may_create for the file creation checks. The
4344            operation will then fail if the context is not permitted. */
4345         tsec = p->security;
4346         if (!strcmp(name, "exec"))
4347                 tsec->exec_sid = sid;
4348         else if (!strcmp(name, "fscreate"))
4349                 tsec->create_sid = sid;
4350         else if (!strcmp(name, "keycreate")) {
4351                 error = may_create_key(sid, p);
4352                 if (error)
4353                         return error;
4354                 tsec->keycreate_sid = sid;
4355         } else if (!strcmp(name, "sockcreate"))
4356                 tsec->sockcreate_sid = sid;
4357         else if (!strcmp(name, "current")) {
4358                 struct av_decision avd;
4359
4360                 if (sid == 0)
4361                         return -EINVAL;
4362
4363                 /* Only allow single threaded processes to change context */
4364                 if (atomic_read(&p->mm->mm_users) != 1) {
4365                         struct task_struct *g, *t;
4366                         struct mm_struct *mm = p->mm;
4367                         read_lock(&tasklist_lock);
4368                         do_each_thread(g, t)
4369                                 if (t->mm == mm && t != p) {
4370                                         read_unlock(&tasklist_lock);
4371                                         return -EPERM;
4372                                 }
4373                         while_each_thread(g, t);
4374                         read_unlock(&tasklist_lock);
4375                 }
4376
4377                 /* Check permissions for the transition. */
4378                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4379                                      PROCESS__DYNTRANSITION, NULL);
4380                 if (error)
4381                         return error;
4382
4383                 /* Check for ptracing, and update the task SID if ok.
4384                    Otherwise, leave SID unchanged and fail. */
4385                 task_lock(p);
4386                 if (p->ptrace & PT_PTRACED) {
4387                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4388                                                      SECCLASS_PROCESS,
4389                                                      PROCESS__PTRACE, &avd);
4390                         if (!error)
4391                                 tsec->sid = sid;
4392                         task_unlock(p);
4393                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4394                                   PROCESS__PTRACE, &avd, error, NULL);
4395                         if (error)
4396                                 return error;
4397                 } else {
4398                         tsec->sid = sid;
4399                         task_unlock(p);
4400                 }
4401         }
4402         else
4403                 return -EINVAL;
4404
4405         return size;
4406 }
4407
4408 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4409 {
4410         return security_sid_to_context(secid, secdata, seclen);
4411 }
4412
4413 static void selinux_release_secctx(char *secdata, u32 seclen)
4414 {
4415         if (secdata)
4416                 kfree(secdata);
4417 }
4418
4419 #ifdef CONFIG_KEYS
4420
4421 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4422                              unsigned long flags)
4423 {
4424         struct task_security_struct *tsec = tsk->security;
4425         struct key_security_struct *ksec;
4426
4427         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4428         if (!ksec)
4429                 return -ENOMEM;
4430
4431         ksec->obj = k;
4432         if (tsec->keycreate_sid)
4433                 ksec->sid = tsec->keycreate_sid;
4434         else
4435                 ksec->sid = tsec->sid;
4436         k->security = ksec;
4437
4438         return 0;
4439 }
4440
4441 static void selinux_key_free(struct key *k)
4442 {
4443         struct key_security_struct *ksec = k->security;
4444
4445         k->security = NULL;
4446         kfree(ksec);
4447 }
4448
4449 static int selinux_key_permission(key_ref_t key_ref,
4450                             struct task_struct *ctx,
4451                             key_perm_t perm)
4452 {
4453         struct key *key;
4454         struct task_security_struct *tsec;
4455         struct key_security_struct *ksec;
4456
4457         key = key_ref_to_ptr(key_ref);
4458
4459         tsec = ctx->security;
4460         ksec = key->security;
4461
4462         /* if no specific permissions are requested, we skip the
4463            permission check. No serious, additional covert channels
4464            appear to be created. */
4465         if (perm == 0)
4466                 return 0;
4467
4468         return avc_has_perm(tsec->sid, ksec->sid,
4469                             SECCLASS_KEY, perm, NULL);
4470 }
4471
4472 #endif
4473
4474 static struct security_operations selinux_ops = {
4475         .ptrace =                       selinux_ptrace,
4476         .capget =                       selinux_capget,
4477         .capset_check =                 selinux_capset_check,
4478         .capset_set =                   selinux_capset_set,
4479         .sysctl =                       selinux_sysctl,
4480         .capable =                      selinux_capable,
4481         .quotactl =                     selinux_quotactl,
4482         .quota_on =                     selinux_quota_on,
4483         .syslog =                       selinux_syslog,
4484         .vm_enough_memory =             selinux_vm_enough_memory,
4485
4486         .netlink_send =                 selinux_netlink_send,
4487         .netlink_recv =                 selinux_netlink_recv,
4488
4489         .bprm_alloc_security =          selinux_bprm_alloc_security,
4490         .bprm_free_security =           selinux_bprm_free_security,
4491         .bprm_apply_creds =             selinux_bprm_apply_creds,
4492         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4493         .bprm_set_security =            selinux_bprm_set_security,
4494         .bprm_check_security =          selinux_bprm_check_security,
4495         .bprm_secureexec =              selinux_bprm_secureexec,
4496
4497         .sb_alloc_security =            selinux_sb_alloc_security,
4498         .sb_free_security =             selinux_sb_free_security,
4499         .sb_copy_data =                 selinux_sb_copy_data,
4500         .sb_kern_mount =                selinux_sb_kern_mount,
4501         .sb_statfs =                    selinux_sb_statfs,
4502         .sb_mount =                     selinux_mount,
4503         .sb_umount =                    selinux_umount,
4504
4505         .inode_alloc_security =         selinux_inode_alloc_security,
4506         .inode_free_security =          selinux_inode_free_security,
4507         .inode_init_security =          selinux_inode_init_security,
4508         .inode_create =                 selinux_inode_create,
4509         .inode_link =                   selinux_inode_link,
4510         .inode_unlink =                 selinux_inode_unlink,
4511         .inode_symlink =                selinux_inode_symlink,
4512         .inode_mkdir =                  selinux_inode_mkdir,
4513         .inode_rmdir =                  selinux_inode_rmdir,
4514         .inode_mknod =                  selinux_inode_mknod,
4515         .inode_rename =                 selinux_inode_rename,
4516         .inode_readlink =               selinux_inode_readlink,
4517         .inode_follow_link =            selinux_inode_follow_link,
4518         .inode_permission =             selinux_inode_permission,
4519         .inode_setattr =                selinux_inode_setattr,
4520         .inode_getattr =                selinux_inode_getattr,
4521         .inode_setxattr =               selinux_inode_setxattr,
4522         .inode_post_setxattr =          selinux_inode_post_setxattr,
4523         .inode_getxattr =               selinux_inode_getxattr,
4524         .inode_listxattr =              selinux_inode_listxattr,
4525         .inode_removexattr =            selinux_inode_removexattr,
4526         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4527         .inode_getsecurity =            selinux_inode_getsecurity,
4528         .inode_setsecurity =            selinux_inode_setsecurity,
4529         .inode_listsecurity =           selinux_inode_listsecurity,
4530
4531         .file_permission =              selinux_file_permission,
4532         .file_alloc_security =          selinux_file_alloc_security,
4533         .file_free_security =           selinux_file_free_security,
4534         .file_ioctl =                   selinux_file_ioctl,
4535         .file_mmap =                    selinux_file_mmap,
4536         .file_mprotect =                selinux_file_mprotect,
4537         .file_lock =                    selinux_file_lock,
4538         .file_fcntl =                   selinux_file_fcntl,
4539         .file_set_fowner =              selinux_file_set_fowner,
4540         .file_send_sigiotask =          selinux_file_send_sigiotask,
4541         .file_receive =                 selinux_file_receive,
4542
4543         .task_create =                  selinux_task_create,
4544         .task_alloc_security =          selinux_task_alloc_security,
4545         .task_free_security =           selinux_task_free_security,
4546         .task_setuid =                  selinux_task_setuid,
4547         .task_post_setuid =             selinux_task_post_setuid,
4548         .task_setgid =                  selinux_task_setgid,
4549         .task_setpgid =                 selinux_task_setpgid,
4550         .task_getpgid =                 selinux_task_getpgid,
4551         .task_getsid =                  selinux_task_getsid,
4552         .task_getsecid =                selinux_task_getsecid,
4553         .task_setgroups =               selinux_task_setgroups,
4554         .task_setnice =                 selinux_task_setnice,
4555         .task_setioprio =               selinux_task_setioprio,
4556         .task_getioprio =               selinux_task_getioprio,
4557         .task_setrlimit =               selinux_task_setrlimit,
4558         .task_setscheduler =            selinux_task_setscheduler,
4559         .task_getscheduler =            selinux_task_getscheduler,
4560         .task_movememory =              selinux_task_movememory,
4561         .task_kill =                    selinux_task_kill,
4562         .task_wait =                    selinux_task_wait,
4563         .task_prctl =                   selinux_task_prctl,
4564         .task_reparent_to_init =        selinux_task_reparent_to_init,
4565         .task_to_inode =                selinux_task_to_inode,
4566
4567         .ipc_permission =               selinux_ipc_permission,
4568
4569         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4570         .msg_msg_free_security =        selinux_msg_msg_free_security,
4571
4572         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4573         .msg_queue_free_security =      selinux_msg_queue_free_security,
4574         .msg_queue_associate =          selinux_msg_queue_associate,
4575         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4576         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4577         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4578
4579         .shm_alloc_security =           selinux_shm_alloc_security,
4580         .shm_free_security =            selinux_shm_free_security,
4581         .shm_associate =                selinux_shm_associate,
4582         .shm_shmctl =                   selinux_shm_shmctl,
4583         .shm_shmat =                    selinux_shm_shmat,
4584
4585         .sem_alloc_security =           selinux_sem_alloc_security,
4586         .sem_free_security =            selinux_sem_free_security,
4587         .sem_associate =                selinux_sem_associate,
4588         .sem_semctl =                   selinux_sem_semctl,
4589         .sem_semop =                    selinux_sem_semop,
4590
4591         .register_security =            selinux_register_security,
4592         .unregister_security =          selinux_unregister_security,
4593
4594         .d_instantiate =                selinux_d_instantiate,
4595
4596         .getprocattr =                  selinux_getprocattr,
4597         .setprocattr =                  selinux_setprocattr,
4598
4599         .secid_to_secctx =              selinux_secid_to_secctx,
4600         .release_secctx =               selinux_release_secctx,
4601
4602         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4603         .unix_may_send =                selinux_socket_unix_may_send,
4604
4605         .socket_create =                selinux_socket_create,
4606         .socket_post_create =           selinux_socket_post_create,
4607         .socket_bind =                  selinux_socket_bind,
4608         .socket_connect =               selinux_socket_connect,
4609         .socket_listen =                selinux_socket_listen,
4610         .socket_accept =                selinux_socket_accept,
4611         .socket_sendmsg =               selinux_socket_sendmsg,
4612         .socket_recvmsg =               selinux_socket_recvmsg,
4613         .socket_getsockname =           selinux_socket_getsockname,
4614         .socket_getpeername =           selinux_socket_getpeername,
4615         .socket_getsockopt =            selinux_socket_getsockopt,
4616         .socket_setsockopt =            selinux_socket_setsockopt,
4617         .socket_shutdown =              selinux_socket_shutdown,
4618         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4619         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4620         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4621         .sk_alloc_security =            selinux_sk_alloc_security,
4622         .sk_free_security =             selinux_sk_free_security,
4623         .sk_getsid =                    selinux_sk_getsid_security,
4624
4625 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4626         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4627         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4628         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4629         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4630         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4631         .xfrm_state_free_security =     selinux_xfrm_state_free,
4632         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4633         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4634 #endif
4635
4636 #ifdef CONFIG_KEYS
4637         .key_alloc =                    selinux_key_alloc,
4638         .key_free =                     selinux_key_free,
4639         .key_permission =               selinux_key_permission,
4640 #endif
4641 };
4642
4643 static __init int selinux_init(void)
4644 {
4645         struct task_security_struct *tsec;
4646
4647         if (!selinux_enabled) {
4648                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4649                 return 0;
4650         }
4651
4652         printk(KERN_INFO "SELinux:  Initializing.\n");
4653
4654         /* Set the security state for the initial task. */
4655         if (task_alloc_security(current))
4656                 panic("SELinux:  Failed to initialize initial task.\n");
4657         tsec = current->security;
4658         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4659
4660         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4661                                             sizeof(struct inode_security_struct),
4662                                             0, SLAB_PANIC, NULL, NULL);
4663         avc_init();
4664
4665         original_ops = secondary_ops = security_ops;
4666         if (!secondary_ops)
4667                 panic ("SELinux: No initial security operations\n");
4668         if (register_security (&selinux_ops))
4669                 panic("SELinux: Unable to register with kernel.\n");
4670
4671         if (selinux_enforcing) {
4672                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4673         } else {
4674                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4675         }
4676
4677 #ifdef CONFIG_KEYS
4678         /* Add security information to initial keyrings */
4679         selinux_key_alloc(&root_user_keyring, current,
4680                           KEY_ALLOC_NOT_IN_QUOTA);
4681         selinux_key_alloc(&root_session_keyring, current,
4682                           KEY_ALLOC_NOT_IN_QUOTA);
4683 #endif
4684
4685         return 0;
4686 }
4687
4688 void selinux_complete_init(void)
4689 {
4690         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4691
4692         /* Set up any superblocks initialized prior to the policy load. */
4693         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4694         spin_lock(&sb_lock);
4695         spin_lock(&sb_security_lock);
4696 next_sb:
4697         if (!list_empty(&superblock_security_head)) {
4698                 struct superblock_security_struct *sbsec =
4699                                 list_entry(superblock_security_head.next,
4700                                            struct superblock_security_struct,
4701                                            list);
4702                 struct super_block *sb = sbsec->sb;
4703                 sb->s_count++;
4704                 spin_unlock(&sb_security_lock);
4705                 spin_unlock(&sb_lock);
4706                 down_read(&sb->s_umount);
4707                 if (sb->s_root)
4708                         superblock_doinit(sb, NULL);
4709                 drop_super(sb);
4710                 spin_lock(&sb_lock);
4711                 spin_lock(&sb_security_lock);
4712                 list_del_init(&sbsec->list);
4713                 goto next_sb;
4714         }
4715         spin_unlock(&sb_security_lock);
4716         spin_unlock(&sb_lock);
4717 }
4718
4719 /* SELinux requires early initialization in order to label
4720    all processes and objects when they are created. */
4721 security_initcall(selinux_init);
4722
4723 #if defined(CONFIG_NETFILTER)
4724
4725 static struct nf_hook_ops selinux_ipv4_op = {
4726         .hook =         selinux_ipv4_postroute_last,
4727         .owner =        THIS_MODULE,
4728         .pf =           PF_INET,
4729         .hooknum =      NF_IP_POST_ROUTING,
4730         .priority =     NF_IP_PRI_SELINUX_LAST,
4731 };
4732
4733 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4734
4735 static struct nf_hook_ops selinux_ipv6_op = {
4736         .hook =         selinux_ipv6_postroute_last,
4737         .owner =        THIS_MODULE,
4738         .pf =           PF_INET6,
4739         .hooknum =      NF_IP6_POST_ROUTING,
4740         .priority =     NF_IP6_PRI_SELINUX_LAST,
4741 };
4742
4743 #endif  /* IPV6 */
4744
4745 static int __init selinux_nf_ip_init(void)
4746 {
4747         int err = 0;
4748
4749         if (!selinux_enabled)
4750                 goto out;
4751
4752         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4753
4754         err = nf_register_hook(&selinux_ipv4_op);
4755         if (err)
4756                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4757
4758 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4759
4760         err = nf_register_hook(&selinux_ipv6_op);
4761         if (err)
4762                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4763
4764 #endif  /* IPV6 */
4765
4766 out:
4767         return err;
4768 }
4769
4770 __initcall(selinux_nf_ip_init);
4771
4772 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4773 static void selinux_nf_ip_exit(void)
4774 {
4775         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4776
4777         nf_unregister_hook(&selinux_ipv4_op);
4778 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4779         nf_unregister_hook(&selinux_ipv6_op);
4780 #endif  /* IPV6 */
4781 }
4782 #endif
4783
4784 #else /* CONFIG_NETFILTER */
4785
4786 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4787 #define selinux_nf_ip_exit()
4788 #endif
4789
4790 #endif /* CONFIG_NETFILTER */
4791
4792 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4793 int selinux_disable(void)
4794 {
4795         extern void exit_sel_fs(void);
4796         static int selinux_disabled = 0;
4797
4798         if (ss_initialized) {
4799                 /* Not permitted after initial policy load. */
4800                 return -EINVAL;
4801         }
4802
4803         if (selinux_disabled) {
4804                 /* Only do this once. */
4805                 return -EINVAL;
4806         }
4807
4808         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4809
4810         selinux_disabled = 1;
4811         selinux_enabled = 0;
4812
4813         /* Reset security_ops to the secondary module, dummy or capability. */
4814         security_ops = secondary_ops;
4815
4816         /* Unregister netfilter hooks. */
4817         selinux_nf_ip_exit();
4818
4819         /* Unregister selinuxfs. */
4820         exit_sel_fs();
4821
4822         return 0;
4823 }
4824 #endif
4825
4826