security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/init.h>
  23 #include <linux/kernel.h>
  24 #include <linux/tracehook.h>
  25 #include <linux/errno.h>
  26 #include <linux/sched.h>
  27 #include <linux/security.h>
  28 #include <linux/xattr.h>
  29 #include <linux/capability.h>
  30 #include <linux/unistd.h>
  31 #include <linux/mm.h>
  32 #include <linux/mman.h>
  33 #include <linux/slab.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/swap.h>
  36 #include <linux/smp_lock.h>
  37 #include <linux/spinlock.h>
  38 #include <linux/syscalls.h>
  39 #include <linux/file.h>
  40 #include <linux/namei.h>
  41 #include <linux/mount.h>
  42 #include <linux/ext2_fs.h>
  43 #include <linux/proc_fs.h>
  44 #include <linux/kd.h>
  45 #include <linux/netfilter_ipv4.h>
  46 #include <linux/netfilter_ipv6.h>
  47 #include <linux/tty.h>
  48 #include <net/icmp.h>
  49 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  50 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  51 #include <asm/uaccess.h>
  52 #include <asm/semaphore.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/quota.h>
  61 #include <linux/un.h>           /* for Unix socket types */
  62 #include <net/af_unix.h>        /* for Unix socket types */
  63 #include <linux/parser.h>
  64 #include <linux/nfs_mount.h>
  65 #include <net/ipv6.h>
  66 #include <linux/hugetlb.h>
  67 #include <linux/personality.h>
  68 #include <linux/sysctl.h>
  69 #include <linux/audit.h>
  70 #include <linux/string.h>
  71 #include <linux/selinux.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76 #include "xfrm.h"
  77
  78 #define XATTR_SELINUX_SUFFIX "selinux"
  79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  80
  81 extern unsigned int policydb_loaded_version;
  82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  83 extern int selinux_compat_net;
  84
  85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  86 int selinux_enforcing = 0;
  87
  88 static int __init enforcing_setup(char *str)
  89 {
  90         selinux_enforcing = simple_strtol(str,NULL,0);
  91         return 1;
  92 }
  93 __setup("enforcing=", enforcing_setup);
  94 #endif
  95
  96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  98
  99 static int __init selinux_enabled_setup(char *str)
 100 {
 101         selinux_enabled = simple_strtol(str, NULL, 0);
 102         return 1;
 103 }
 104 __setup("selinux=", selinux_enabled_setup);
 105 #else
 106 int selinux_enabled = 1;
 107 #endif
 108
 109 /* Original (dummy) security module. */
 110 static struct security_operations *original_ops = NULL;
 111
 112 /* Minimal support for a secondary security module,
 113    just to allow the use of the dummy or capability modules.
 114    The owlsm module can alternatively be used as a secondary
 115    module as long as CONFIG_OWLSM_FD is not enabled. */
 116 static struct security_operations *secondary_ops = NULL;
 117
 118 /* Lists of inode and superblock security structures initialized
 119    before the policy was loaded. */
 120 static LIST_HEAD(superblock_security_head);
 121 static DEFINE_SPINLOCK(sb_security_lock);
 122
 123 static kmem_cache_t *sel_inode_cache;
 124
 125 /* Return security context for a given sid or just the context
 126    length if the buffer is null or length is 0 */
 127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 128 {
 129         char *context;
 130         unsigned len;
 131         int rc;
 132
 133         rc = security_sid_to_context(sid, &context, &len);
 134         if (rc)
 135                 return rc;
 136
 137         if (!buffer || !size)
 138                 goto getsecurity_exit;
 139
 140         if (size < len) {
 141                 len = -ERANGE;
 142                 goto getsecurity_exit;
 143         }
 144         memcpy(buffer, context, len);
 145
 146 getsecurity_exit:
 147         kfree(context);
 148         return len;
 149 }
 150
 151 /* Allocate and free functions for each kind of security blob. */
 152
 153 static int task_alloc_security(struct task_struct *task)
 154 {
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 return -ENOMEM;
 160
 161         tsec->task = task;
 162         tsec->osid = tsec->sid = SECINITSID_UNLABELED;
 163         task->security = tsec;
 164
 165         return 0;
 166 }
 167
 168 static void task_free_security(struct task_struct *task)
 169 {
 170         struct task_security_struct *tsec = task->security;
 171         task->security = NULL;
 172         kfree(tsec);
 173 }
 174
 175 static int inode_alloc_security(struct inode *inode)
 176 {
 177         struct task_security_struct *tsec = current->security;
 178         struct inode_security_struct *isec;
 179
 180         isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
 181         if (!isec)
 182                 return -ENOMEM;
 183
 184         memset(isec, 0, sizeof(*isec));
 185         init_MUTEX(&isec->sem);
 186         INIT_LIST_HEAD(&isec->list);
 187         isec->inode = inode;
 188         isec->sid = SECINITSID_UNLABELED;
 189         isec->sclass = SECCLASS_FILE;
 190         isec->task_sid = tsec->sid;
 191         inode->i_security = isec;
 192
 193         return 0;
 194 }
 195
 196 static void inode_free_security(struct inode *inode)
 197 {
 198         struct inode_security_struct *isec = inode->i_security;
 199         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 200
 201         spin_lock(&sbsec->isec_lock);
 202         if (!list_empty(&isec->list))
 203                 list_del_init(&isec->list);
 204         spin_unlock(&sbsec->isec_lock);
 205
 206         inode->i_security = NULL;
 207         kmem_cache_free(sel_inode_cache, isec);
 208 }
 209
 210 static int file_alloc_security(struct file *file)
 211 {
 212         struct task_security_struct *tsec = current->security;
 213         struct file_security_struct *fsec;
 214
 215         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 216         if (!fsec)
 217                 return -ENOMEM;
 218
 219         fsec->file = file;
 220         fsec->sid = tsec->sid;
 221         fsec->fown_sid = tsec->sid;
 222         file->f_security = fsec;
 223
 224         return 0;
 225 }
 226
 227 static void file_free_security(struct file *file)
 228 {
 229         struct file_security_struct *fsec = file->f_security;
 230         file->f_security = NULL;
 231         kfree(fsec);
 232 }
 233
 234 static int superblock_alloc_security(struct super_block *sb)
 235 {
 236         struct superblock_security_struct *sbsec;
 237
 238         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 239         if (!sbsec)
 240                 return -ENOMEM;
 241
 242         init_MUTEX(&sbsec->sem);
 243         INIT_LIST_HEAD(&sbsec->list);
 244         INIT_LIST_HEAD(&sbsec->isec_head);
 245         spin_lock_init(&sbsec->isec_lock);
 246         sbsec->sb = sb;
 247         sbsec->sid = SECINITSID_UNLABELED;
 248         sbsec->def_sid = SECINITSID_FILE;
 249         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 250         sb->s_security = sbsec;
 251
 252         return 0;
 253 }
 254
 255 static void superblock_free_security(struct super_block *sb)
 256 {
 257         struct superblock_security_struct *sbsec = sb->s_security;
 258
 259         spin_lock(&sb_security_lock);
 260         if (!list_empty(&sbsec->list))
 261                 list_del_init(&sbsec->list);
 262         spin_unlock(&sb_security_lock);
 263
 264         sb->s_security = NULL;
 265         kfree(sbsec);
 266 }
 267
 268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 269 {
 270         struct sk_security_struct *ssec;
 271
 272         if (family != PF_UNIX)
 273                 return 0;
 274
 275         ssec = kzalloc(sizeof(*ssec), priority);
 276         if (!ssec)
 277                 return -ENOMEM;
 278
 279         ssec->sk = sk;
 280         ssec->peer_sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         return 0;
 284 }
 285
 286 static void sk_free_security(struct sock *sk)
 287 {
 288         struct sk_security_struct *ssec = sk->sk_security;
 289
 290         if (sk->sk_family != PF_UNIX)
 291                 return;
 292
 293         sk->sk_security = NULL;
 294         kfree(ssec);
 295 }
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323         Opt_rootcontext = 8,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331 };
 332
 333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 334
 335 static int may_context_mount_sb_relabel(u32 sid,
 336                         struct superblock_security_struct *sbsec,
 337                         struct task_security_struct *tsec)
 338 {
 339         int rc;
 340
 341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 342                           FILESYSTEM__RELABELFROM, NULL);
 343         if (rc)
 344                 return rc;
 345
 346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELTO, NULL);
 348         return rc;
 349 }
 350
 351 static int may_context_mount_inode_relabel(u32 sid,
 352                         struct superblock_security_struct *sbsec,
 353                         struct task_security_struct *tsec)
 354 {
 355         int rc;
 356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELFROM, NULL);
 358         if (rc)
 359                 return rc;
 360
 361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__ASSOCIATE, NULL);
 363         return rc;
 364 }
 365
 366 static int try_context_mount(struct super_block *sb, void *data)
 367 {
 368         char *context = NULL, *defcontext = NULL;
 369         char *fscontext = NULL, *rootcontext = NULL;
 370         const char *name;
 371         u32 sid;
 372         int alloc = 0, rc = 0, seen = 0;
 373         struct task_security_struct *tsec = current->security;
 374         struct superblock_security_struct *sbsec = sb->s_security;
 375
 376         if (!data)
 377                 goto out;
 378
 379         name = sb->s_type->name;
 380
 381         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 382
 383                 /* NFS we understand. */
 384                 if (!strcmp(name, "nfs")) {
 385                         struct nfs_mount_data *d = data;
 386
 387                         if (d->version <  NFS_MOUNT_VERSION)
 388                                 goto out;
 389
 390                         if (d->context[0]) {
 391                                 context = d->context;
 392                                 seen |= Opt_context;
 393                         }
 394                 } else
 395                         goto out;
 396
 397         } else {
 398                 /* Standard string-based options. */
 399                 char *p, *options = data;
 400
 401                 while ((p = strsep(&options, ",")) != NULL) {
 402                         int token;
 403                         substring_t args[MAX_OPT_ARGS];
 404
 405                         if (!*p)
 406                                 continue;
 407
 408                         token = match_token(p, tokens, args);
 409
 410                         switch (token) {
 411                         case Opt_context:
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 context = match_strdup(&args[0]);
 418                                 if (!context) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_context;
 425                                 break;
 426
 427                         case Opt_fscontext:
 428                                 if (seen & Opt_fscontext) {
 429                                         rc = -EINVAL;
 430                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 431                                         goto out_free;
 432                                 }
 433                                 fscontext = match_strdup(&args[0]);
 434                                 if (!fscontext) {
 435                                         rc = -ENOMEM;
 436                                         goto out_free;
 437                                 }
 438                                 if (!alloc)
 439                                         alloc = 1;
 440                                 seen |= Opt_fscontext;
 441                                 break;
 442
 443                         case Opt_rootcontext:
 444                                 if (seen & Opt_rootcontext) {
 445                                         rc = -EINVAL;
 446                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 447                                         goto out_free;
 448                                 }
 449                                 rootcontext = match_strdup(&args[0]);
 450                                 if (!rootcontext) {
 451                                         rc = -ENOMEM;
 452                                         goto out_free;
 453                                 }
 454                                 if (!alloc)
 455                                         alloc = 1;
 456                                 seen |= Opt_rootcontext;
 457                                 break;
 458
 459                         case Opt_defcontext:
 460                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 461                                         rc = -EINVAL;
 462                                         printk(KERN_WARNING "SELinux:  "
 463                                                "defcontext option is invalid "
 464                                                "for this filesystem type\n");
 465                                         goto out_free;
 466                                 }
 467                                 if (seen & (Opt_context|Opt_defcontext)) {
 468                                         rc = -EINVAL;
 469                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 470                                         goto out_free;
 471                                 }
 472                                 defcontext = match_strdup(&args[0]);
 473                                 if (!defcontext) {
 474                                         rc = -ENOMEM;
 475                                         goto out_free;
 476                                 }
 477                                 if (!alloc)
 478                                         alloc = 1;
 479                                 seen |= Opt_defcontext;
 480                                 break;
 481
 482                         default:
 483                                 rc = -EINVAL;
 484                                 printk(KERN_WARNING "SELinux:  unknown mount "
 485                                        "option\n");
 486                                 goto out_free;
 487
 488                         }
 489                 }
 490         }
 491
 492         if (!seen)
 493                 goto out;
 494
 495         /* sets the context of the superblock for the fs being mounted. */
 496         if (fscontext) {
 497                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 498                 if (rc) {
 499                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 500                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 501                                fscontext, sb->s_id, name, rc);
 502                         goto out_free;
 503                 }
 504
 505                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 506                 if (rc)
 507                         goto out_free;
 508
 509                 sbsec->sid = sid;
 510         }
 511
 512         /*
 513          * Switch to using mount point labeling behavior.
 514          * sets the label used on all file below the mountpoint, and will set
 515          * the superblock context if not already set.
 516          */
 517         if (context) {
 518                 rc = security_context_to_sid(context, strlen(context), &sid);
 519                 if (rc) {
 520                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 521                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 522                                context, sb->s_id, name, rc);
 523                         goto out_free;
 524                 }
 525
 526                 if (!fscontext) {
 527                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 528                         if (rc)
 529                                 goto out_free;
 530                         sbsec->sid = sid;
 531                 } else {
 532                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 533                         if (rc)
 534                                 goto out_free;
 535                 }
 536                 sbsec->mntpoint_sid = sid;
 537
 538                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 539         }
 540
 541         if (rootcontext) {
 542                 struct inode *inode = sb->s_root->d_inode;
 543                 struct inode_security_struct *isec = inode->i_security;
 544                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 545                 if (rc) {
 546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 548                                rootcontext, sb->s_id, name, rc);
 549                         goto out_free;
 550                 }
 551
 552                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 553                 if (rc)
 554                         goto out_free;
 555
 556                 isec->sid = sid;
 557                 isec->initialized = 1;
 558         }
 559
 560         if (defcontext) {
 561                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 562                 if (rc) {
 563                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 564                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 565                                defcontext, sb->s_id, name, rc);
 566                         goto out_free;
 567                 }
 568
 569                 if (sid == sbsec->def_sid)
 570                         goto out_free;
 571
 572                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 573                 if (rc)
 574                         goto out_free;
 575
 576                 sbsec->def_sid = sid;
 577         }
 578
 579 out_free:
 580         if (alloc) {
 581                 kfree(context);
 582                 kfree(defcontext);
 583                 kfree(fscontext);
 584                 kfree(rootcontext);
 585         }
 586 out:
 587         return rc;
 588 }
 589
 590 static int superblock_doinit(struct super_block *sb, void *data)
 591 {
 592         struct superblock_security_struct *sbsec = sb->s_security;
 593         struct dentry *root = sb->s_root;
 594         struct inode *inode = root->d_inode;
 595         int rc = 0;
 596
 597         down(&sbsec->sem);
 598         if (sbsec->initialized)
 599                 goto out;
 600
 601         if (!ss_initialized) {
 602                 /* Defer initialization until selinux_complete_init,
 603                    after the initial policy is loaded and the security
 604                    server is ready to handle calls. */
 605                 spin_lock(&sb_security_lock);
 606                 if (list_empty(&sbsec->list))
 607                         list_add(&sbsec->list, &superblock_security_head);
 608                 spin_unlock(&sb_security_lock);
 609                 goto out;
 610         }
 611
 612         /* Determine the labeling behavior to use for this filesystem type. */
 613         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 614         if (rc) {
 615                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 616                        __FUNCTION__, sb->s_type->name, rc);
 617                 goto out;
 618         }
 619
 620         rc = try_context_mount(sb, data);
 621         if (rc)
 622                 goto out;
 623
 624         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 625                 /* Make sure that the xattr handler exists and that no
 626                    error other than -ENODATA is returned by getxattr on
 627                    the root directory.  -ENODATA is ok, as this may be
 628                    the first boot of the SELinux kernel before we have
 629                    assigned xattr values to the filesystem. */
 630                 if (!inode->i_op->getxattr) {
 631                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 632                                "xattr support\n", sb->s_id, sb->s_type->name);
 633                         rc = -EOPNOTSUPP;
 634                         goto out;
 635                 }
 636                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 637                 if (rc < 0 && rc != -ENODATA) {
 638                         if (rc == -EOPNOTSUPP)
 639                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 640                                        "%s) has no security xattr handler\n",
 641                                        sb->s_id, sb->s_type->name);
 642                         else
 643                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 644                                        "%s) getxattr errno %d\n", sb->s_id,
 645                                        sb->s_type->name, -rc);
 646                         goto out;
 647                 }
 648         }
 649
 650         if (strcmp(sb->s_type->name, "proc") == 0)
 651                 sbsec->proc = 1;
 652
 653         sbsec->initialized = 1;
 654
 655         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 656                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 657                        sb->s_id, sb->s_type->name);
 658         }
 659         else {
 660                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 661                        sb->s_id, sb->s_type->name,
 662                        labeling_behaviors[sbsec->behavior-1]);
 663         }
 664
 665         /* Initialize the root inode. */
 666         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 667
 668         /* Initialize any other inodes associated with the superblock, e.g.
 669            inodes created prior to initial policy load or inodes created
 670            during get_sb by a pseudo filesystem that directly
 671            populates itself. */
 672         spin_lock(&sbsec->isec_lock);
 673 next_inode:
 674         if (!list_empty(&sbsec->isec_head)) {
 675                 struct inode_security_struct *isec =
 676                                 list_entry(sbsec->isec_head.next,
 677                                            struct inode_security_struct, list);
 678                 struct inode *inode = isec->inode;
 679                 spin_unlock(&sbsec->isec_lock);
 680                 inode = igrab(inode);
 681                 if (inode) {
 682                         if (!IS_PRIVATE (inode))
 683                                 inode_doinit(inode);
 684                         iput(inode);
 685                 }
 686                 spin_lock(&sbsec->isec_lock);
 687                 list_del_init(&isec->list);
 688                 goto next_inode;
 689         }
 690         spin_unlock(&sbsec->isec_lock);
 691 out:
 692         up(&sbsec->sem);
 693         return rc;
 694 }
 695
 696 static inline u16 inode_mode_to_security_class(umode_t mode)
 697 {
 698         switch (mode & S_IFMT) {
 699         case S_IFSOCK:
 700                 return SECCLASS_SOCK_FILE;
 701         case S_IFLNK:
 702                 return SECCLASS_LNK_FILE;
 703         case S_IFREG:
 704                 return SECCLASS_FILE;
 705         case S_IFBLK:
 706                 return SECCLASS_BLK_FILE;
 707         case S_IFDIR:
 708                 return SECCLASS_DIR;
 709         case S_IFCHR:
 710                 return SECCLASS_CHR_FILE;
 711         case S_IFIFO:
 712                 return SECCLASS_FIFO_FILE;
 713
 714         }
 715
 716         return SECCLASS_FILE;
 717 }
 718
 719 static inline int default_protocol_stream(int protocol)
 720 {
 721         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 722 }
 723
 724 static inline int default_protocol_dgram(int protocol)
 725 {
 726         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 727 }
 728
 729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 730 {
 731         switch (family) {
 732         case PF_UNIX:
 733                 switch (type) {
 734                 case SOCK_STREAM:
 735                 case SOCK_SEQPACKET:
 736                         return SECCLASS_UNIX_STREAM_SOCKET;
 737                 case SOCK_DGRAM:
 738                         return SECCLASS_UNIX_DGRAM_SOCKET;
 739                 }
 740                 break;
 741         case PF_INET:
 742         case PF_INET6:
 743                 switch (type) {
 744                 case SOCK_STREAM:
 745                         if (default_protocol_stream(protocol))
 746                                 return SECCLASS_TCP_SOCKET;
 747                         else
 748                                 return SECCLASS_RAWIP_SOCKET;
 749                 case SOCK_DGRAM:
 750                         if (default_protocol_dgram(protocol))
 751                                 return SECCLASS_UDP_SOCKET;
 752                         else
 753                                 return SECCLASS_RAWIP_SOCKET;
 754                 default:
 755                         return SECCLASS_RAWIP_SOCKET;
 756                 }
 757                 break;
 758         case PF_NETLINK:
 759                 switch (protocol) {
 760                 case NETLINK_ROUTE:
 761                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 762                 case NETLINK_FIREWALL:
 763                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 764                 case NETLINK_INET_DIAG:
 765                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 766                 case NETLINK_NFLOG:
 767                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 768                 case NETLINK_XFRM:
 769                         return SECCLASS_NETLINK_XFRM_SOCKET;
 770                 case NETLINK_SELINUX:
 771                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 772                 case NETLINK_AUDIT:
 773                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 774                 case NETLINK_IP6_FW:
 775                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 776                 case NETLINK_DNRTMSG:
 777                         return SECCLASS_NETLINK_DNRT_SOCKET;
 778                 case NETLINK_KOBJECT_UEVENT:
 779                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 780                 default:
 781                         return SECCLASS_NETLINK_SOCKET;
 782                 }
 783         case PF_PACKET:
 784                 return SECCLASS_PACKET_SOCKET;
 785         case PF_KEY:
 786                 return SECCLASS_KEY_SOCKET;
 787         case PF_APPLETALK:
 788                 return SECCLASS_APPLETALK_SOCKET;
 789         }
 790
 791         return SECCLASS_SOCKET;
 792 }
 793
 794 #ifdef CONFIG_PROC_FS
 795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 796                                 u16 tclass,
 797                                 u32 *sid)
 798 {
 799         int buflen, rc;
 800         char *buffer, *path, *end;
 801
 802         buffer = (char*)__get_free_page(GFP_KERNEL);
 803         if (!buffer)
 804                 return -ENOMEM;
 805
 806         buflen = PAGE_SIZE;
 807         end = buffer+buflen;
 808         *--end = '\0';
 809         buflen--;
 810         path = end-1;
 811         *path = '/';
 812         while (de && de != de->parent) {
 813                 buflen -= de->namelen + 1;
 814                 if (buflen < 0)
 815                         break;
 816                 end -= de->namelen;
 817                 memcpy(end, de->name, de->namelen);
 818                 *--end = '/';
 819                 path = end;
 820                 de = de->parent;
 821         }
 822         rc = security_genfs_sid("proc", path, tclass, sid);
 823         free_page((unsigned long)buffer);
 824         return rc;
 825 }
 826 #else
 827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 828                                 u16 tclass,
 829                                 u32 *sid)
 830 {
 831         return -EINVAL;
 832 }
 833 #endif
 834
 835 /* The inode's security attributes must be initialized before first use. */
 836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 837 {
 838         struct superblock_security_struct *sbsec = NULL;
 839         struct inode_security_struct *isec = inode->i_security;
 840         u32 sid;
 841         struct dentry *dentry;
 842 #define INITCONTEXTLEN 255
 843         char *context = NULL;
 844         unsigned len = 0;
 845         int rc = 0;
 846         int hold_sem = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         down(&isec->sem);
 852         hold_sem = 1;
 853         if (isec->initialized)
 854                 goto out;
 855
 856         sbsec = inode->i_sb->s_security;
 857         if (!sbsec->initialized) {
 858                 /* Defer initialization until selinux_complete_init,
 859                    after the initial policy is loaded and the security
 860                    server is ready to handle calls. */
 861                 spin_lock(&sbsec->isec_lock);
 862                 if (list_empty(&isec->list))
 863                         list_add(&isec->list, &sbsec->isec_head);
 864                 spin_unlock(&sbsec->isec_lock);
 865                 goto out;
 866         }
 867
 868         switch (sbsec->behavior) {
 869         case SECURITY_FS_USE_XATTR:
 870                 if (!inode->i_op->getxattr) {
 871                         isec->sid = sbsec->def_sid;
 872                         break;
 873                 }
 874
 875                 /* Need a dentry, since the xattr API requires one.
 876                    Life would be simpler if we could just pass the inode. */
 877                 if (opt_dentry) {
 878                         /* Called from d_instantiate or d_splice_alias. */
 879                         dentry = dget(opt_dentry);
 880                 } else {
 881                         /* Called from selinux_complete_init, try to find a dentry. */
 882                         dentry = d_find_alias(inode);
 883                 }
 884                 if (!dentry) {
 885                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 886                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 887                                inode->i_ino);
 888                         goto out;
 889                 }
 890
 891                 len = INITCONTEXTLEN;
 892                 context = kmalloc(len, GFP_KERNEL);
 893                 if (!context) {
 894                         rc = -ENOMEM;
 895                         dput(dentry);
 896                         goto out;
 897                 }
 898                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 899                                            context, len);
 900                 if (rc == -ERANGE) {
 901                         /* Need a larger buffer.  Query for the right size. */
 902                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 903                                                    NULL, 0);
 904                         if (rc < 0) {
 905                                 dput(dentry);
 906                                 goto out;
 907                         }
 908                         kfree(context);
 909                         len = rc;
 910                         context = kmalloc(len, GFP_KERNEL);
 911                         if (!context) {
 912                                 rc = -ENOMEM;
 913                                 dput(dentry);
 914                                 goto out;
 915                         }
 916                         rc = inode->i_op->getxattr(dentry,
 917                                                    XATTR_NAME_SELINUX,
 918                                                    context, len);
 919                 }
 920                 dput(dentry);
 921                 if (rc < 0) {
 922                         if (rc != -ENODATA) {
 923                                 printk(KERN_WARNING "%s:  getxattr returned "
 924                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 925                                        -rc, inode->i_sb->s_id, inode->i_ino);
 926                                 kfree(context);
 927                                 goto out;
 928                         }
 929                         /* Map ENODATA to the default file SID */
 930                         sid = sbsec->def_sid;
 931                         rc = 0;
 932                 } else {
 933                         rc = security_context_to_sid_default(context, rc, &sid,
 934                                                              sbsec->def_sid);
 935                         if (rc) {
 936                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 937                                        "returned %d for dev=%s ino=%ld\n",
 938                                        __FUNCTION__, context, -rc,
 939                                        inode->i_sb->s_id, inode->i_ino);
 940                                 kfree(context);
 941                                 /* Leave with the unlabeled SID */
 942                                 rc = 0;
 943                                 break;
 944                         }
 945                 }
 946                 kfree(context);
 947                 isec->sid = sid;
 948                 break;
 949         case SECURITY_FS_USE_TASK:
 950                 isec->sid = isec->task_sid;
 951                 break;
 952         case SECURITY_FS_USE_TRANS:
 953                 /* Default to the fs SID. */
 954                 isec->sid = sbsec->sid;
 955
 956                 /* Try to obtain a transition SID. */
 957                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 958                 rc = security_transition_sid(isec->task_sid,
 959                                              sbsec->sid,
 960                                              isec->sclass,
 961                                              &sid);
 962                 if (rc)
 963                         goto out;
 964                 isec->sid = sid;
 965                 break;
 966         case SECURITY_FS_USE_MNTPOINT:
 967                 isec->sid = sbsec->mntpoint_sid;
 968                 break;
 969         default:
 970                 /* Default to the fs superblock SID. */
 971                 isec->sid = sbsec->sid;
 972
 973                 if (sbsec->proc) {
 974                         struct proc_inode *proci = PROC_I(inode);
 975                         if (proci->pde) {
 976                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 977                                 rc = selinux_proc_get_sid(proci->pde,
 978                                                           isec->sclass,
 979                                                           &sid);
 980                                 if (rc)
 981                                         goto out;
 982                                 isec->sid = sid;
 983                         }
 984                 }
 985                 break;
 986         }
 987
 988         isec->initialized = 1;
 989
 990 out:
 991         if (isec->sclass == SECCLASS_FILE)
 992                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 993
 994         if (hold_sem)
 995                 up(&isec->sem);
 996         return rc;
 997 }
 998
 999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1001 {
1002         u32 perm = 0;
1003
1004         switch (sig) {
1005         case SIGCHLD:
1006                 /* Commonly granted from child to parent. */
1007                 perm = PROCESS__SIGCHLD;
1008                 break;
1009         case SIGKILL:
1010                 /* Cannot be caught or ignored */
1011                 perm = PROCESS__SIGKILL;
1012                 break;
1013         case SIGSTOP:
1014                 /* Cannot be caught or ignored */
1015                 perm = PROCESS__SIGSTOP;
1016                 break;
1017         default:
1018                 /* All other signals. */
1019                 perm = PROCESS__SIGNAL;
1020                 break;
1021         }
1022
1023         return perm;
1024 }
1025
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027    fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029                          struct task_struct *tsk2,
1030                          u32 perms)
1031 {
1032         struct task_security_struct *tsec1, *tsec2;
1033
1034         tsec1 = tsk1->security;
1035         tsec2 = tsk2->security;
1036         return avc_has_perm(tsec1->sid, tsec2->sid,
1037                             SECCLASS_PROCESS, perms, NULL);
1038 }
1039
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1042                                int cap)
1043 {
1044         struct task_security_struct *tsec;
1045         struct avc_audit_data ad;
1046
1047         tsec = tsk->security;
1048
1049         AVC_AUDIT_DATA_INIT(&ad,CAP);
1050         ad.tsk = tsk;
1051         ad.u.cap = cap;
1052
1053         return avc_has_perm(tsec->sid, tsec->sid,
1054                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1055 }
1056
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1059                            u32 perms)
1060 {
1061         struct task_security_struct *tsec;
1062
1063         tsec = tsk->security;
1064
1065         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066                             SECCLASS_SYSTEM, perms, NULL);
1067 }
1068
1069 /* Check whether a task has a particular permission to an inode.
1070    The 'adp' parameter is optional and allows other audit
1071    data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073                           struct inode *inode,
1074                           u32 perms,
1075                           struct avc_audit_data *adp)
1076 {
1077         struct task_security_struct *tsec;
1078         struct inode_security_struct *isec;
1079         struct avc_audit_data ad;
1080
1081         tsec = tsk->security;
1082         isec = inode->i_security;
1083
1084         if (!adp) {
1085                 adp = &ad;
1086                 AVC_AUDIT_DATA_INIT(&ad, FS);
1087                 ad.u.fs.inode = inode;
1088         }
1089
1090         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1091 }
1092
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094    the dentry to help the auditing code to more easily generate the
1095    pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097                                   struct vfsmount *mnt,
1098                                   struct dentry *dentry,
1099                                   u32 av)
1100 {
1101         struct inode *inode = dentry->d_inode;
1102         struct avc_audit_data ad;
1103         AVC_AUDIT_DATA_INIT(&ad,FS);
1104         ad.u.fs.mnt = mnt;
1105         ad.u.fs.dentry = dentry;
1106         return inode_has_perm(tsk, inode, av, &ad);
1107 }
1108
1109 /* Check whether a task can use an open file descriptor to
1110    access an inode in a given way.  Check access to the
1111    descriptor itself, and then use dentry_has_perm to
1112    check a particular permission to the file.
1113    Access to the descriptor is implicitly granted if it
1114    has the same SID as the process.  If av is zero, then
1115    access to the file is not checked, e.g. for cases
1116    where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1118                                 struct file *file,
1119                                 u32 av)
1120 {
1121         struct task_security_struct *tsec = tsk->security;
1122         struct file_security_struct *fsec = file->f_security;
1123         struct vfsmount *mnt = file->f_vfsmnt;
1124         struct dentry *dentry = file->f_dentry;
1125         struct inode *inode = dentry->d_inode;
1126         struct avc_audit_data ad;
1127         int rc;
1128
1129         AVC_AUDIT_DATA_INIT(&ad, FS);
1130         ad.u.fs.mnt = mnt;
1131         ad.u.fs.dentry = dentry;
1132
1133         if (tsec->sid != fsec->sid) {
1134                 rc = avc_has_perm(tsec->sid, fsec->sid,
1135                                   SECCLASS_FD,
1136                                   FD__USE,
1137                                   &ad);
1138                 if (rc)
1139                         return rc;
1140         }
1141
1142         /* av is zero if only checking access to the descriptor. */
1143         if (av)
1144                 return inode_has_perm(tsk, inode, av, &ad);
1145
1146         return 0;
1147 }
1148
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151                       struct dentry *dentry,
1152                       u16 tclass)
1153 {
1154         struct task_security_struct *tsec;
1155         struct inode_security_struct *dsec;
1156         struct superblock_security_struct *sbsec;
1157         u32 newsid;
1158         struct avc_audit_data ad;
1159         int rc;
1160
1161         tsec = current->security;
1162         dsec = dir->i_security;
1163         sbsec = dir->i_sb->s_security;
1164
1165         AVC_AUDIT_DATA_INIT(&ad, FS);
1166         ad.u.fs.dentry = dentry;
1167
1168         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169                           DIR__ADD_NAME | DIR__SEARCH,
1170                           &ad);
1171         if (rc)
1172                 return rc;
1173
1174         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175                 newsid = tsec->create_sid;
1176         } else {
1177                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1178                                              &newsid);
1179                 if (rc)
1180                         return rc;
1181         }
1182
1183         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1184         if (rc)
1185                 return rc;
1186
1187         return avc_has_perm(newsid, sbsec->sid,
1188                             SECCLASS_FILESYSTEM,
1189                             FILESYSTEM__ASSOCIATE, &ad);
1190 }
1191
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194                           struct task_struct *ctx)
1195 {
1196         struct task_security_struct *tsec;
1197
1198         tsec = ctx->security;
1199
1200         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1201 }
1202
1203 #define MAY_LINK   0
1204 #define MAY_UNLINK 1
1205 #define MAY_RMDIR  2
1206
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209                     struct dentry *dentry,
1210                     int kind)
1211
1212 {
1213         struct task_security_struct *tsec;
1214         struct inode_security_struct *dsec, *isec;
1215         struct avc_audit_data ad;
1216         u32 av;
1217         int rc;
1218
1219         tsec = current->security;
1220         dsec = dir->i_security;
1221         isec = dentry->d_inode->i_security;
1222
1223         AVC_AUDIT_DATA_INIT(&ad, FS);
1224         ad.u.fs.dentry = dentry;
1225
1226         av = DIR__SEARCH;
1227         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1229         if (rc)
1230                 return rc;
1231
1232         switch (kind) {
1233         case MAY_LINK:
1234                 av = FILE__LINK;
1235                 break;
1236         case MAY_UNLINK:
1237                 av = FILE__UNLINK;
1238                 break;
1239         case MAY_RMDIR:
1240                 av = DIR__RMDIR;
1241                 break;
1242         default:
1243                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1244                 return 0;
1245         }
1246
1247         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1248         return rc;
1249 }
1250
1251 static inline int may_rename(struct inode *old_dir,
1252                              struct dentry *old_dentry,
1253                              struct inode *new_dir,
1254                              struct dentry *new_dentry)
1255 {
1256         struct task_security_struct *tsec;
1257         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258         struct avc_audit_data ad;
1259         u32 av;
1260         int old_is_dir, new_is_dir;
1261         int rc;
1262
1263         tsec = current->security;
1264         old_dsec = old_dir->i_security;
1265         old_isec = old_dentry->d_inode->i_security;
1266         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267         new_dsec = new_dir->i_security;
1268
1269         AVC_AUDIT_DATA_INIT(&ad, FS);
1270
1271         ad.u.fs.dentry = old_dentry;
1272         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1274         if (rc)
1275                 return rc;
1276         rc = avc_has_perm(tsec->sid, old_isec->sid,
1277                           old_isec->sclass, FILE__RENAME, &ad);
1278         if (rc)
1279                 return rc;
1280         if (old_is_dir && new_dir != old_dir) {
1281                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282                                   old_isec->sclass, DIR__REPARENT, &ad);
1283                 if (rc)
1284                         return rc;
1285         }
1286
1287         ad.u.fs.dentry = new_dentry;
1288         av = DIR__ADD_NAME | DIR__SEARCH;
1289         if (new_dentry->d_inode)
1290                 av |= DIR__REMOVE_NAME;
1291         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1292         if (rc)
1293                 return rc;
1294         if (new_dentry->d_inode) {
1295                 new_isec = new_dentry->d_inode->i_security;
1296                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1298                                   new_isec->sclass,
1299                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1300                 if (rc)
1301                         return rc;
1302         }
1303
1304         return 0;
1305 }
1306
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309                                struct super_block *sb,
1310                                u32 perms,
1311                                struct avc_audit_data *ad)
1312 {
1313         struct task_security_struct *tsec;
1314         struct superblock_security_struct *sbsec;
1315
1316         tsec = tsk->security;
1317         sbsec = sb->s_security;
1318         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1319                             perms, ad);
1320 }
1321
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1324 {
1325         u32 av = 0;
1326
1327         if ((mode & S_IFMT) != S_IFDIR) {
1328                 if (mask & MAY_EXEC)
1329                         av |= FILE__EXECUTE;
1330                 if (mask & MAY_READ)
1331                         av |= FILE__READ;
1332
1333                 if (mask & MAY_APPEND)
1334                         av |= FILE__APPEND;
1335                 else if (mask & MAY_WRITE)
1336                         av |= FILE__WRITE;
1337
1338         } else {
1339                 if (mask & MAY_EXEC)
1340                         av |= DIR__SEARCH;
1341                 if (mask & MAY_WRITE)
1342                         av |= DIR__WRITE;
1343                 if (mask & MAY_READ)
1344                         av |= DIR__READ;
1345         }
1346
1347         return av;
1348 }
1349
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1352 {
1353         u32 av = 0;
1354
1355         if (file->f_mode & FMODE_READ)
1356                 av |= FILE__READ;
1357         if (file->f_mode & FMODE_WRITE) {
1358                 if (file->f_flags & O_APPEND)
1359                         av |= FILE__APPEND;
1360                 else
1361                         av |= FILE__WRITE;
1362         }
1363
1364         return av;
1365 }
1366
1367 /* Set an inode's SID to a specified value. */
1368 static int inode_security_set_sid(struct inode *inode, u32 sid)
1369 {
1370         struct inode_security_struct *isec = inode->i_security;
1371         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1372
1373         if (!sbsec->initialized) {
1374                 /* Defer initialization to selinux_complete_init. */
1375                 return 0;
1376         }
1377
1378         down(&isec->sem);
1379         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1380         isec->sid = sid;
1381         isec->initialized = 1;
1382         up(&isec->sem);
1383         return 0;
1384 }
1385
1386 /* Hook functions begin here. */
1387
1388 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1389 {
1390         int rc;
1391
1392         rc = secondary_ops->ptrace(parent,child);
1393         if (rc)
1394                 return rc;
1395
1396         return task_has_perm(parent, child, PROCESS__PTRACE);
1397 }
1398
1399 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1400                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402         int error;
1403
1404         error = task_has_perm(current, target, PROCESS__GETCAP);
1405         if (error)
1406                 return error;
1407
1408         return secondary_ops->capget(target, effective, inheritable, permitted);
1409 }
1410
1411 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1412                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414         int error;
1415
1416         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1417         if (error)
1418                 return error;
1419
1420         return task_has_perm(current, target, PROCESS__SETCAP);
1421 }
1422
1423 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1424                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1425 {
1426         secondary_ops->capset_set(target, effective, inheritable, permitted);
1427 }
1428
1429 static int selinux_capable(struct task_struct *tsk, int cap)
1430 {
1431         int rc;
1432
1433         rc = secondary_ops->capable(tsk, cap);
1434         if (rc)
1435                 return rc;
1436
1437         return task_has_capability(tsk,cap);
1438 }
1439
1440 static int selinux_sysctl(ctl_table *table, int op)
1441 {
1442         int error = 0;
1443         u32 av;
1444         struct task_security_struct *tsec;
1445         u32 tsid;
1446         int rc;
1447
1448         rc = secondary_ops->sysctl(table, op);
1449         if (rc)
1450                 return rc;
1451
1452         tsec = current->security;
1453
1454         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1455                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1456         if (rc) {
1457                 /* Default to the well-defined sysctl SID. */
1458                 tsid = SECINITSID_SYSCTL;
1459         }
1460
1461         /* The op values are "defined" in sysctl.c, thereby creating
1462          * a bad coupling between this module and sysctl.c */
1463         if(op == 001) {
1464                 error = avc_has_perm(tsec->sid, tsid,
1465                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1466         } else {
1467                 av = 0;
1468                 if (op & 004)
1469                         av |= FILE__READ;
1470                 if (op & 002)
1471                         av |= FILE__WRITE;
1472                 if (av)
1473                         error = avc_has_perm(tsec->sid, tsid,
1474                                              SECCLASS_FILE, av, NULL);
1475         }
1476
1477         return error;
1478 }
1479
1480 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1481 {
1482         int rc = 0;
1483
1484         if (!sb)
1485                 return 0;
1486
1487         switch (cmds) {
1488                 case Q_SYNC:
1489                 case Q_QUOTAON:
1490                 case Q_QUOTAOFF:
1491                 case Q_SETINFO:
1492                 case Q_SETQUOTA:
1493                         rc = superblock_has_perm(current,
1494                                                  sb,
1495                                                  FILESYSTEM__QUOTAMOD, NULL);
1496                         break;
1497                 case Q_GETFMT:
1498                 case Q_GETINFO:
1499                 case Q_GETQUOTA:
1500                         rc = superblock_has_perm(current,
1501                                                  sb,
1502                                                  FILESYSTEM__QUOTAGET, NULL);
1503                         break;
1504                 default:
1505                         rc = 0;  /* let the kernel handle invalid cmds */
1506                         break;
1507         }
1508         return rc;
1509 }
1510
1511 static int selinux_quota_on(struct dentry *dentry)
1512 {
1513         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1514 }
1515
1516 static int selinux_syslog(int type)
1517 {
1518         int rc;
1519
1520         rc = secondary_ops->syslog(type);
1521         if (rc)
1522                 return rc;
1523
1524         switch (type) {
1525                 case 3:         /* Read last kernel messages */
1526                 case 10:        /* Return size of the log buffer */
1527                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1528                         break;
1529                 case 6:         /* Disable logging to console */
1530                 case 7:         /* Enable logging to console */
1531                 case 8:         /* Set level of messages printed to console */
1532                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1533                         break;
1534                 case 0:         /* Close log */
1535                 case 1:         /* Open log */
1536                 case 2:         /* Read from log */
1537                 case 4:         /* Read/clear last kernel messages */
1538                 case 5:         /* Clear ring buffer */
1539                 default:
1540                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1541                         break;
1542         }
1543         return rc;
1544 }
1545
1546 /*
1547  * Check that a process has enough memory to allocate a new virtual
1548  * mapping. 0 means there is enough memory for the allocation to
1549  * succeed and -ENOMEM implies there is not.
1550  *
1551  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1552  * if the capability is granted, but __vm_enough_memory requires 1 if
1553  * the capability is granted.
1554  *
1555  * Do not audit the selinux permission check, as this is applied to all
1556  * processes that allocate mappings.
1557  */
1558 static int selinux_vm_enough_memory(long pages)
1559 {
1560         int rc, cap_sys_admin = 0;
1561         struct task_security_struct *tsec = current->security;
1562
1563         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1564         if (rc == 0)
1565                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1566                                         SECCLASS_CAPABILITY,
1567                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1568                                         NULL);
1569
1570         if (rc == 0)
1571                 cap_sys_admin = 1;
1572
1573         return __vm_enough_memory(pages, cap_sys_admin);
1574 }
1575
1576 /* binprm security operations */
1577
1578 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1579 {
1580         struct bprm_security_struct *bsec;
1581
1582         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1583         if (!bsec)
1584                 return -ENOMEM;
1585
1586         bsec->bprm = bprm;
1587         bsec->sid = SECINITSID_UNLABELED;
1588         bsec->set = 0;
1589
1590         bprm->security = bsec;
1591         return 0;
1592 }
1593
1594 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1595 {
1596         struct task_security_struct *tsec;
1597         struct inode *inode = bprm->file->f_dentry->d_inode;
1598         struct inode_security_struct *isec;
1599         struct bprm_security_struct *bsec;
1600         u32 newsid;
1601         struct avc_audit_data ad;
1602         int rc;
1603
1604         rc = secondary_ops->bprm_set_security(bprm);
1605         if (rc)
1606                 return rc;
1607
1608         bsec = bprm->security;
1609
1610         if (bsec->set)
1611                 return 0;
1612
1613         tsec = current->security;
1614         isec = inode->i_security;
1615
1616         /* Default to the current task SID. */
1617         bsec->sid = tsec->sid;
1618
1619         /* Reset fs, key, and sock SIDs on execve. */
1620         tsec->create_sid = 0;
1621         tsec->keycreate_sid = 0;
1622         tsec->sockcreate_sid = 0;
1623
1624         if (tsec->exec_sid) {
1625                 newsid = tsec->exec_sid;
1626                 /* Reset exec SID on execve. */
1627                 tsec->exec_sid = 0;
1628         } else {
1629                 /* Check for a default transition on this program. */
1630                 rc = security_transition_sid(tsec->sid, isec->sid,
1631                                              SECCLASS_PROCESS, &newsid);
1632                 if (rc)
1633                         return rc;
1634         }
1635
1636         AVC_AUDIT_DATA_INIT(&ad, FS);
1637         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1638         ad.u.fs.dentry = bprm->file->f_dentry;
1639
1640         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1641                 newsid = tsec->sid;
1642
1643         if (tsec->sid == newsid) {
1644                 rc = avc_has_perm(tsec->sid, isec->sid,
1645                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1646                 if (rc)
1647                         return rc;
1648         } else {
1649                 /* Check permissions for the transition. */
1650                 rc = avc_has_perm(tsec->sid, newsid,
1651                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1652                 if (rc)
1653                         return rc;
1654
1655                 rc = avc_has_perm(newsid, isec->sid,
1656                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1657                 if (rc)
1658                         return rc;
1659
1660                 /* Clear any possibly unsafe personality bits on exec: */
1661                 current->personality &= ~PER_CLEAR_ON_SETID;
1662
1663                 /* Set the security field to the new SID. */
1664                 bsec->sid = newsid;
1665         }
1666
1667         bsec->set = 1;
1668         return 0;
1669 }
1670
1671 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1672 {
1673         return secondary_ops->bprm_check_security(bprm);
1674 }
1675
1676
1677 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1678 {
1679         struct task_security_struct *tsec = current->security;
1680         int atsecure = 0;
1681
1682         if (tsec->osid != tsec->sid) {
1683                 /* Enable secure mode for SIDs transitions unless
1684                    the noatsecure permission is granted between
1685                    the two SIDs, i.e. ahp returns 0. */
1686                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1687                                          SECCLASS_PROCESS,
1688                                          PROCESS__NOATSECURE, NULL);
1689         }
1690
1691         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1692 }
1693
1694 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1695 {
1696         kfree(bprm->security);
1697         bprm->security = NULL;
1698 }
1699
1700 extern struct vfsmount *selinuxfs_mount;
1701 extern struct dentry *selinux_null;
1702
1703 /* Derived from fs/exec.c:flush_old_files. */
1704 static inline void flush_unauthorized_files(struct files_struct * files)
1705 {
1706         struct avc_audit_data ad;
1707         struct file *file, *devnull = NULL;
1708         struct tty_struct *tty = current->signal->tty;
1709         struct fdtable *fdt;
1710         long j = -1;
1711
1712         if (tty) {
1713                 file_list_lock();
1714                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1715                 if (file) {
1716                         /* Revalidate access to controlling tty.
1717                            Use inode_has_perm on the tty inode directly rather
1718                            than using file_has_perm, as this particular open
1719                            file may belong to another process and we are only
1720                            interested in the inode-based check here. */
1721                         struct inode *inode = file->f_dentry->d_inode;
1722                         if (inode_has_perm(current, inode,
1723                                            FILE__READ | FILE__WRITE, NULL)) {
1724                                 /* Reset controlling tty. */
1725                                 current->signal->tty = NULL;
1726                                 current->signal->tty_old_pgrp = 0;
1727                         }
1728                 }
1729                 file_list_unlock();
1730         }
1731
1732         /* Revalidate access to inherited open files. */
1733
1734         AVC_AUDIT_DATA_INIT(&ad,FS);
1735
1736         spin_lock(&files->file_lock);
1737         for (;;) {
1738                 unsigned long set, i;
1739                 int fd;
1740
1741                 j++;
1742                 i = j * __NFDBITS;
1743                 fdt = files_fdtable(files);
1744                 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1745                         break;
1746                 set = fdt->open_fds->fds_bits[j];
1747                 if (!set)
1748                         continue;
1749                 spin_unlock(&files->file_lock);
1750                 for ( ; set ; i++,set >>= 1) {
1751                         if (set & 1) {
1752                                 file = fget(i);
1753                                 if (!file)
1754                                         continue;
1755                                 if (file_has_perm(current,
1756                                                   file,
1757                                                   file_to_av(file))) {
1758                                         sys_close(i);
1759                                         fd = get_unused_fd();
1760                                         if (fd != i) {
1761                                                 if (fd >= 0)
1762                                                         put_unused_fd(fd);
1763                                                 fput(file);
1764                                                 continue;
1765                                         }
1766                                         if (devnull) {
1767                                                 get_file(devnull);
1768                                         } else {
1769                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1770                                                 if (!devnull) {
1771                                                         put_unused_fd(fd);
1772                                                         fput(file);
1773                                                         continue;
1774                                                 }
1775                                         }
1776                                         fd_install(fd, devnull);
1777                                 }
1778                                 fput(file);
1779                         }
1780                 }
1781                 spin_lock(&files->file_lock);
1782
1783         }
1784         spin_unlock(&files->file_lock);
1785 }
1786
1787 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1788 {
1789         struct task_security_struct *tsec;
1790         struct bprm_security_struct *bsec;
1791         u32 sid;
1792         int rc;
1793
1794         secondary_ops->bprm_apply_creds(bprm, unsafe);
1795
1796         tsec = current->security;
1797
1798         bsec = bprm->security;
1799         sid = bsec->sid;
1800
1801         tsec->osid = tsec->sid;
1802         bsec->unsafe = 0;
1803         if (tsec->sid != sid) {
1804                 /* Check for shared state.  If not ok, leave SID
1805                    unchanged and kill. */
1806                 if (unsafe & LSM_UNSAFE_SHARE) {
1807                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1808                                         PROCESS__SHARE, NULL);
1809                         if (rc) {
1810                                 bsec->unsafe = 1;
1811                                 return;
1812                         }
1813                 }
1814
1815                 /* Check for ptracing, and update the task SID if ok.
1816                    Otherwise, leave SID unchanged and kill. */
1817                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1818                         struct task_struct *t;
1819
1820                         rcu_read_lock();
1821                         t = tracehook_tracer_task(current);
1822                         if (unlikely(t == NULL))
1823                                 rcu_read_unlock();
1824                         else {
1825                                 struct task_security_struct *sec = t->security;
1826                                 u32 ptsid = sec->sid;
1827                                 rcu_read_unlock();
1828
1829                                 rc = avc_has_perm(ptsid, sid,
1830                                                   SECCLASS_PROCESS,
1831                                                   PROCESS__PTRACE, NULL);
1832                                 if (rc) {
1833                                         bsec->unsafe = 1;
1834                                         return;
1835                                 }
1836                         }
1837                 }
1838                 tsec->sid = sid;
1839         }
1840 }
1841
1842 /*
1843  * called after apply_creds without the task lock held
1844  */
1845 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1846 {
1847         struct task_security_struct *tsec;
1848         struct rlimit *rlim, *initrlim;
1849         struct itimerval itimer;
1850         struct bprm_security_struct *bsec;
1851         int rc, i;
1852
1853         tsec = current->security;
1854         bsec = bprm->security;
1855
1856         if (bsec->unsafe) {
1857                 force_sig_specific(SIGKILL, current);
1858                 return;
1859         }
1860         if (tsec->osid == tsec->sid)
1861                 return;
1862
1863         /* Close files for which the new task SID is not authorized. */
1864         flush_unauthorized_files(current->files);
1865
1866         /* Check whether the new SID can inherit signal state
1867            from the old SID.  If not, clear itimers to avoid
1868            subsequent signal generation and flush and unblock
1869            signals. This must occur _after_ the task SID has
1870           been updated so that any kill done after the flush
1871           will be checked against the new SID. */
1872         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1873                           PROCESS__SIGINH, NULL);
1874         if (rc) {
1875                 memset(&itimer, 0, sizeof itimer);
1876                 for (i = 0; i < 3; i++)
1877                         do_setitimer(i, &itimer, NULL);
1878                 flush_signals(current);
1879                 spin_lock_irq(&current->sighand->siglock);
1880                 flush_signal_handlers(current, 1);
1881                 sigemptyset(&current->blocked);
1882                 recalc_sigpending();
1883                 spin_unlock_irq(&current->sighand->siglock);
1884         }
1885
1886         /* Check whether the new SID can inherit resource limits
1887            from the old SID.  If not, reset all soft limits to
1888            the lower of the current task's hard limit and the init
1889            task's soft limit.  Note that the setting of hard limits
1890            (even to lower them) can be controlled by the setrlimit
1891            check. The inclusion of the init task's soft limit into
1892            the computation is to avoid resetting soft limits higher
1893            than the default soft limit for cases where the default
1894            is lower than the hard limit, e.g. RLIMIT_CORE or
1895            RLIMIT_STACK.*/
1896         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897                           PROCESS__RLIMITINH, NULL);
1898         if (rc) {
1899                 for (i = 0; i < RLIM_NLIMITS; i++) {
1900                         rlim = current->signal->rlim + i;
1901                         initrlim = init_task.signal->rlim+i;
1902                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1903                 }
1904                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1905                         /*
1906                          * This will cause RLIMIT_CPU calculations
1907                          * to be refigured.
1908                          */
1909                         current->it_prof_expires = jiffies_to_cputime(1);
1910                 }
1911         }
1912
1913         /* Wake up the parent if it is waiting so that it can
1914            recheck wait permission to the new task SID. */
1915         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1916 }
1917
1918 /* superblock security operations */
1919
1920 static int selinux_sb_alloc_security(struct super_block *sb)
1921 {
1922         return superblock_alloc_security(sb);
1923 }
1924
1925 static void selinux_sb_free_security(struct super_block *sb)
1926 {
1927         superblock_free_security(sb);
1928 }
1929
1930 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1931 {
1932         if (plen > olen)
1933                 return 0;
1934
1935         return !memcmp(prefix, option, plen);
1936 }
1937
1938 static inline int selinux_option(char *option, int len)
1939 {
1940         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1941                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1942                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1943                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1944 }
1945
1946 static inline void take_option(char **to, char *from, int *first, int len)
1947 {
1948         if (!*first) {
1949                 **to = ',';
1950                 *to += 1;
1951         }
1952         else
1953                 *first = 0;
1954         memcpy(*to, from, len);
1955         *to += len;
1956 }
1957
1958 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1959 {
1960         int fnosec, fsec, rc = 0;
1961         char *in_save, *in_curr, *in_end;
1962         char *sec_curr, *nosec_save, *nosec;
1963
1964         in_curr = orig;
1965         sec_curr = copy;
1966
1967         /* Binary mount data: just copy */
1968         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1969                 copy_page(sec_curr, in_curr);
1970                 goto out;
1971         }
1972
1973         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1974         if (!nosec) {
1975                 rc = -ENOMEM;
1976                 goto out;
1977         }
1978
1979         nosec_save = nosec;
1980         fnosec = fsec = 1;
1981         in_save = in_end = orig;
1982
1983         do {
1984                 if (*in_end == ',' || *in_end == '\0') {
1985                         int len = in_end - in_curr;
1986
1987                         if (selinux_option(in_curr, len))
1988                                 take_option(&sec_curr, in_curr, &fsec, len);
1989                         else
1990                                 take_option(&nosec, in_curr, &fnosec, len);
1991
1992                         in_curr = in_end + 1;
1993                 }
1994         } while (*in_end++);
1995
1996         strcpy(in_save, nosec_save);
1997         free_page((unsigned long)nosec_save);
1998 out:
1999         return rc;
2000 }
2001
2002 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2003 {
2004         struct avc_audit_data ad;
2005         int rc;
2006
2007         rc = superblock_doinit(sb, data);
2008         if (rc)
2009                 return rc;
2010
2011         AVC_AUDIT_DATA_INIT(&ad,FS);
2012         ad.u.fs.dentry = sb->s_root;
2013         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2014 }
2015
2016 static int selinux_sb_statfs(struct dentry *dentry)
2017 {
2018         struct avc_audit_data ad;
2019
2020         AVC_AUDIT_DATA_INIT(&ad,FS);
2021         ad.u.fs.dentry = dentry->d_sb->s_root;
2022         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2023 }
2024
2025 static int selinux_mount(char * dev_name,
2026                          struct nameidata *nd,
2027                          char * type,
2028                          unsigned long flags,
2029                          void * data)
2030 {
2031         int rc;
2032
2033         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2034         if (rc)
2035                 return rc;
2036
2037         if (flags & MS_REMOUNT)
2038                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2039                                            FILESYSTEM__REMOUNT, NULL);
2040         else
2041                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2042                                        FILE__MOUNTON);
2043 }
2044
2045 static int selinux_umount(struct vfsmount *mnt, int flags)
2046 {
2047         int rc;
2048
2049         rc = secondary_ops->sb_umount(mnt, flags);
2050         if (rc)
2051                 return rc;
2052
2053         return superblock_has_perm(current,mnt->mnt_sb,
2054                                    FILESYSTEM__UNMOUNT,NULL);
2055 }
2056
2057 /* inode security operations */
2058
2059 static int selinux_inode_alloc_security(struct inode *inode)
2060 {
2061         return inode_alloc_security(inode);
2062 }
2063
2064 static void selinux_inode_free_security(struct inode *inode)
2065 {
2066         inode_free_security(inode);
2067 }
2068
2069 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2070                                        char **name, void **value,
2071                                        size_t *len)
2072 {
2073         struct task_security_struct *tsec;
2074         struct inode_security_struct *dsec;
2075         struct superblock_security_struct *sbsec;
2076         u32 newsid, clen;
2077         int rc;
2078         char *namep = NULL, *context;
2079
2080         tsec = current->security;
2081         dsec = dir->i_security;
2082         sbsec = dir->i_sb->s_security;
2083
2084         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2085                 newsid = tsec->create_sid;
2086         } else {
2087                 rc = security_transition_sid(tsec->sid, dsec->sid,
2088                                              inode_mode_to_security_class(inode->i_mode),
2089                                              &newsid);
2090                 if (rc) {
2091                         printk(KERN_WARNING "%s:  "
2092                                "security_transition_sid failed, rc=%d (dev=%s "
2093                                "ino=%ld)\n",
2094                                __FUNCTION__,
2095                                -rc, inode->i_sb->s_id, inode->i_ino);
2096                         return rc;
2097                 }
2098         }
2099
2100         inode_security_set_sid(inode, newsid);
2101
2102         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2103                 return -EOPNOTSUPP;
2104
2105         if (name) {
2106                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2107                 if (!namep)
2108                         return -ENOMEM;
2109                 *name = namep;
2110         }
2111
2112         if (value && len) {
2113                 rc = security_sid_to_context(newsid, &context, &clen);
2114                 if (rc) {
2115                         kfree(namep);
2116                         return rc;
2117                 }
2118                 *value = context;
2119                 *len = clen;
2120         }
2121
2122         return 0;
2123 }
2124
2125 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2126 {
2127         return may_create(dir, dentry, SECCLASS_FILE);
2128 }
2129
2130 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2131 {
2132         int rc;
2133
2134         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2135         if (rc)
2136                 return rc;
2137         return may_link(dir, old_dentry, MAY_LINK);
2138 }
2139
2140 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2141 {
2142         int rc;
2143
2144         rc = secondary_ops->inode_unlink(dir, dentry);
2145         if (rc)
2146                 return rc;
2147         return may_link(dir, dentry, MAY_UNLINK);
2148 }
2149
2150 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2151 {
2152         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2153 }
2154
2155 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2156 {
2157         return may_create(dir, dentry, SECCLASS_DIR);
2158 }
2159
2160 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2161 {
2162         return may_link(dir, dentry, MAY_RMDIR);
2163 }
2164
2165 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2166 {
2167         int rc;
2168
2169         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2170         if (rc)
2171                 return rc;
2172
2173         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2174 }
2175
2176 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2177                                 struct inode *new_inode, struct dentry *new_dentry)
2178 {
2179         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2180 }
2181
2182 static int selinux_inode_readlink(struct dentry *dentry)
2183 {
2184         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2185 }
2186
2187 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2188 {
2189         int rc;
2190
2191         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2192         if (rc)
2193                 return rc;
2194         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2195 }
2196
2197 static int selinux_inode_permission(struct inode *inode, int mask,
2198                                     struct nameidata *nd)
2199 {
2200         int rc;
2201
2202         rc = secondary_ops->inode_permission(inode, mask, nd);
2203         if (rc)
2204                 return rc;
2205
2206         if (!mask) {
2207                 /* No permission to check.  Existence test. */
2208                 return 0;
2209         }
2210
2211         return inode_has_perm(current, inode,
2212                                file_mask_to_av(inode->i_mode, mask), NULL);
2213 }
2214
2215 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2216 {
2217         int rc;
2218
2219         rc = secondary_ops->inode_setattr(dentry, iattr);
2220         if (rc)
2221                 return rc;
2222
2223         if (iattr->ia_valid & ATTR_FORCE)
2224                 return 0;
2225
2226         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2227                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2228                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2229
2230         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2231 }
2232
2233 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2234 {
2235         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2236 }
2237
2238 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2239 {
2240         struct task_security_struct *tsec = current->security;
2241         struct inode *inode = dentry->d_inode;
2242         struct inode_security_struct *isec = inode->i_security;
2243         struct superblock_security_struct *sbsec;
2244         struct avc_audit_data ad;
2245         u32 newsid;
2246         int rc = 0;
2247
2248         if (strcmp(name, XATTR_NAME_SELINUX)) {
2249                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2250                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2251                     !capable(CAP_SYS_ADMIN)) {
2252                         /* A different attribute in the security namespace.
2253                            Restrict to administrator. */
2254                         return -EPERM;
2255                 }
2256
2257                 /* Not an attribute we recognize, so just check the
2258                    ordinary setattr permission. */
2259                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2260         }
2261
2262         sbsec = inode->i_sb->s_security;
2263         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2264                 return -EOPNOTSUPP;
2265
2266         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2267                 return -EPERM;
2268
2269         AVC_AUDIT_DATA_INIT(&ad,FS);
2270         ad.u.fs.dentry = dentry;
2271
2272         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2273                           FILE__RELABELFROM, &ad);
2274         if (rc)
2275                 return rc;
2276
2277         rc = security_context_to_sid(value, size, &newsid);
2278         if (rc)
2279                 return rc;
2280
2281         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2282                           FILE__RELABELTO, &ad);
2283         if (rc)
2284                 return rc;
2285
2286         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2287                                           isec->sclass);
2288         if (rc)
2289                 return rc;
2290
2291         return avc_has_perm(newsid,
2292                             sbsec->sid,
2293                             SECCLASS_FILESYSTEM,
2294                             FILESYSTEM__ASSOCIATE,
2295                             &ad);
2296 }
2297
2298 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2299                                         void *value, size_t size, int flags)
2300 {
2301         struct inode *inode = dentry->d_inode;
2302         struct inode_security_struct *isec = inode->i_security;
2303         u32 newsid;
2304         int rc;
2305
2306         if (strcmp(name, XATTR_NAME_SELINUX)) {
2307                 /* Not an attribute we recognize, so nothing to do. */
2308                 return;
2309         }
2310
2311         rc = security_context_to_sid(value, size, &newsid);
2312         if (rc) {
2313                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2314                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2315                 return;
2316         }
2317
2318         isec->sid = newsid;
2319         return;
2320 }
2321
2322 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2323 {
2324         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2325 }
2326
2327 static int selinux_inode_listxattr (struct dentry *dentry)
2328 {
2329         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2330 }
2331
2332 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2333 {
2334         if (strcmp(name, XATTR_NAME_SELINUX)) {
2335                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2336                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2337                     !capable(CAP_SYS_ADMIN)) {
2338                         /* A different attribute in the security namespace.
2339                            Restrict to administrator. */
2340                         return -EPERM;
2341                 }
2342
2343                 /* Not an attribute we recognize, so just check the
2344                    ordinary setattr permission. Might want a separate
2345                    permission for removexattr. */
2346                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2347         }
2348
2349         /* No one is allowed to remove a SELinux security label.
2350            You can change the label, but all data must be labeled. */
2351         return -EACCES;
2352 }
2353
2354 static const char *selinux_inode_xattr_getsuffix(void)
2355 {
2356       return XATTR_SELINUX_SUFFIX;
2357 }
2358
2359 /*
2360  * Copy the in-core inode security context value to the user.  If the
2361  * getxattr() prior to this succeeded, check to see if we need to
2362  * canonicalize the value to be finally returned to the user.
2363  *
2364  * Permission check is handled by selinux_inode_getxattr hook.
2365  */
2366 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2367 {
2368         struct inode_security_struct *isec = inode->i_security;
2369
2370         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2371                 return -EOPNOTSUPP;
2372
2373         return selinux_getsecurity(isec->sid, buffer, size);
2374 }
2375
2376 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2377                                      const void *value, size_t size, int flags)
2378 {
2379         struct inode_security_struct *isec = inode->i_security;
2380         u32 newsid;
2381         int rc;
2382
2383         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2384                 return -EOPNOTSUPP;
2385
2386         if (!value || !size)
2387                 return -EACCES;
2388
2389         rc = security_context_to_sid((void*)value, size, &newsid);
2390         if (rc)
2391                 return rc;
2392
2393         isec->sid = newsid;
2394         return 0;
2395 }
2396
2397 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2398 {
2399         const int len = sizeof(XATTR_NAME_SELINUX);
2400         if (buffer && len <= buffer_size)
2401                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2402         return len;
2403 }
2404
2405 /* file security operations */
2406
2407 static int selinux_file_permission(struct file *file, int mask)
2408 {
2409         struct inode *inode = file->f_dentry->d_inode;
2410
2411         if (!mask) {
2412                 /* No permission to check.  Existence test. */
2413                 return 0;
2414         }
2415
2416         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2417         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2418                 mask |= MAY_APPEND;
2419
2420         return file_has_perm(current, file,
2421                              file_mask_to_av(inode->i_mode, mask));
2422 }
2423
2424 static int selinux_file_alloc_security(struct file *file)
2425 {
2426         return file_alloc_security(file);
2427 }
2428
2429 static void selinux_file_free_security(struct file *file)
2430 {
2431         file_free_security(file);
2432 }
2433
2434 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2435                               unsigned long arg)
2436 {
2437         int error = 0;
2438
2439         switch (cmd) {
2440                 case FIONREAD:
2441                 /* fall through */
2442                 case FIBMAP:
2443                 /* fall through */
2444                 case FIGETBSZ:
2445                 /* fall through */
2446                 case EXT2_IOC_GETFLAGS:
2447                 /* fall through */
2448                 case EXT2_IOC_GETVERSION:
2449                         error = file_has_perm(current, file, FILE__GETATTR);
2450                         break;
2451
2452                 case EXT2_IOC_SETFLAGS:
2453                 /* fall through */
2454                 case EXT2_IOC_SETVERSION:
2455                         error = file_has_perm(current, file, FILE__SETATTR);
2456                         break;
2457
2458                 /* sys_ioctl() checks */
2459                 case FIONBIO:
2460                 /* fall through */
2461                 case FIOASYNC:
2462                         error = file_has_perm(current, file, 0);
2463                         break;
2464
2465                 case KDSKBENT:
2466                 case KDSKBSENT:
2467                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2468                         break;
2469
2470                 /* default case assumes that the command will go
2471                  * to the file's ioctl() function.
2472                  */
2473                 default:
2474                         error = file_has_perm(current, file, FILE__IOCTL);
2475
2476         }
2477         return error;
2478 }
2479
2480 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2481 {
2482         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2483                 /*
2484                  * We are making executable an anonymous mapping or a
2485                  * private file mapping that will also be writable.
2486                  * This has an additional check.
2487                  */
2488                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2489                 if (rc)
2490                         return rc;
2491         }
2492
2493         if (file) {
2494                 /* read access is always possible with a mapping */
2495                 u32 av = FILE__READ;
2496
2497                 /* write access only matters if the mapping is shared */
2498                 if (shared && (prot & PROT_WRITE))
2499                         av |= FILE__WRITE;
2500
2501                 if (prot & PROT_EXEC)
2502                         av |= FILE__EXECUTE;
2503
2504                 return file_has_perm(current, file, av);
2505         }
2506         return 0;
2507 }
2508
2509 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2510                              unsigned long prot, unsigned long flags)
2511 {
2512         int rc;
2513
2514         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2515         if (rc)
2516                 return rc;
2517
2518         if (selinux_checkreqprot)
2519                 prot = reqprot;
2520
2521         return file_map_prot_check(file, prot,
2522                                    (flags & MAP_TYPE) == MAP_SHARED);
2523 }
2524
2525 static int selinux_file_mprotect(struct vm_area_struct *vma,
2526                                  unsigned long reqprot,
2527                                  unsigned long prot)
2528 {
2529         int rc;
2530
2531         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2532         if (rc)
2533                 return rc;
2534
2535         if (selinux_checkreqprot)
2536                 prot = reqprot;
2537
2538         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2539                 rc = 0;
2540                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2541                     vma->vm_end <= vma->vm_mm->brk) {
2542                         rc = task_has_perm(current, current,
2543                                            PROCESS__EXECHEAP);
2544                 } else if (!vma->vm_file &&
2545                            vma->vm_start <= vma->vm_mm->start_stack &&
2546                            vma->vm_end >= vma->vm_mm->start_stack) {
2547                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2548                 } else if (vma->vm_file && vma->anon_vma) {
2549                         /*
2550                          * We are making executable a file mapping that has
2551                          * had some COW done. Since pages might have been
2552                          * written, check ability to execute the possibly
2553                          * modified content.  This typically should only
2554                          * occur for text relocations.
2555                          */
2556                         rc = file_has_perm(current, vma->vm_file,
2557                                            FILE__EXECMOD);
2558                 }
2559                 if (rc)
2560                         return rc;
2561         }
2562
2563         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2564 }
2565
2566 static int selinux_file_lock(struct file *file, unsigned int cmd)
2567 {
2568         return file_has_perm(current, file, FILE__LOCK);
2569 }
2570
2571 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2572                               unsigned long arg)
2573 {
2574         int err = 0;
2575
2576         switch (cmd) {
2577                 case F_SETFL:
2578                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2579                                 err = -EINVAL;
2580                                 break;
2581                         }
2582
2583                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2584                                 err = file_has_perm(current, file,FILE__WRITE);
2585                                 break;
2586                         }
2587                         /* fall through */
2588                 case F_SETOWN:
2589                 case F_SETSIG:
2590                 case F_GETFL:
2591                 case F_GETOWN:
2592                 case F_GETSIG:
2593                         /* Just check FD__USE permission */
2594                         err = file_has_perm(current, file, 0);
2595                         break;
2596                 case F_GETLK:
2597                 case F_SETLK:
2598                 case F_SETLKW:
2599 #if BITS_PER_LONG == 32
2600                 case F_GETLK64:
2601                 case F_SETLK64:
2602                 case F_SETLKW64:
2603 #endif
2604                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2605                                 err = -EINVAL;
2606                                 break;
2607                         }
2608                         err = file_has_perm(current, file, FILE__LOCK);
2609                         break;
2610         }
2611
2612         return err;
2613 }
2614
2615 static int selinux_file_set_fowner(struct file *file)
2616 {
2617         struct task_security_struct *tsec;
2618         struct file_security_struct *fsec;
2619
2620         tsec = current->security;
2621         fsec = file->f_security;
2622         fsec->fown_sid = tsec->sid;
2623
2624         return 0;
2625 }
2626
2627 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2628                                        struct fown_struct *fown, int signum)
2629 {
2630         struct file *file;
2631         u32 perm;
2632         struct task_security_struct *tsec;
2633         struct file_security_struct *fsec;
2634
2635         /* struct fown_struct is never outside the context of a struct file */
2636         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2637
2638         tsec = tsk->security;
2639         fsec = file->f_security;
2640
2641         if (!signum)
2642                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2643         else
2644                 perm = signal_to_av(signum);
2645
2646         return avc_has_perm(fsec->fown_sid, tsec->sid,
2647                             SECCLASS_PROCESS, perm, NULL);
2648 }
2649
2650 static int selinux_file_receive(struct file *file)
2651 {
2652         return file_has_perm(current, file, file_to_av(file));
2653 }
2654
2655 /* task security operations */
2656
2657 static int selinux_task_create(unsigned long clone_flags)
2658 {
2659         int rc;
2660
2661         rc = secondary_ops->task_create(clone_flags);
2662         if (rc)
2663                 return rc;
2664
2665         return task_has_perm(current, current, PROCESS__FORK);
2666 }
2667
2668 static int selinux_task_alloc_security(struct task_struct *tsk)
2669 {
2670         struct task_security_struct *tsec1, *tsec2;
2671         int rc;
2672
2673         tsec1 = current->security;
2674
2675         rc = task_alloc_security(tsk);
2676         if (rc)
2677                 return rc;
2678         tsec2 = tsk->security;
2679
2680         tsec2->osid = tsec1->osid;
2681         tsec2->sid = tsec1->sid;
2682
2683         /* Retain the exec, fs, key, and sock SIDs across fork */
2684         tsec2->exec_sid = tsec1->exec_sid;
2685         tsec2->create_sid = tsec1->create_sid;
2686         tsec2->keycreate_sid = tsec1->keycreate_sid;
2687         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2688
2689         return 0;
2690 }
2691
2692 static void selinux_task_free_security(struct task_struct *tsk)
2693 {
2694         task_free_security(tsk);
2695 }
2696
2697 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2698 {
2699         /* Since setuid only affects the current process, and
2700            since the SELinux controls are not based on the Linux
2701            identity attributes, SELinux does not need to control
2702            this operation.  However, SELinux does control the use
2703            of the CAP_SETUID and CAP_SETGID capabilities using the
2704            capable hook. */
2705         return 0;
2706 }
2707
2708 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2709 {
2710         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2711 }
2712
2713 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2714 {
2715         /* See the comment for setuid above. */
2716         return 0;
2717 }
2718
2719 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2720 {
2721         return task_has_perm(current, p, PROCESS__SETPGID);
2722 }
2723
2724 static int selinux_task_getpgid(struct task_struct *p)
2725 {
2726         return task_has_perm(current, p, PROCESS__GETPGID);
2727 }
2728
2729 static int selinux_task_getsid(struct task_struct *p)
2730 {
2731         return task_has_perm(current, p, PROCESS__GETSESSION);
2732 }
2733
2734 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2735 {
2736         selinux_get_task_sid(p, secid);
2737 }
2738
2739 static int selinux_task_setgroups(struct group_info *group_info)
2740 {
2741         /* See the comment for setuid above. */
2742         return 0;
2743 }
2744
2745 static int selinux_task_setnice(struct task_struct *p, int nice)
2746 {
2747         int rc;
2748
2749         rc = secondary_ops->task_setnice(p, nice);
2750         if (rc)
2751                 return rc;
2752
2753         return task_has_perm(current,p, PROCESS__SETSCHED);
2754 }
2755
2756 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2757 {
2758         return task_has_perm(current, p, PROCESS__SETSCHED);
2759 }
2760
2761 static int selinux_task_getioprio(struct task_struct *p)
2762 {
2763         return task_has_perm(current, p, PROCESS__GETSCHED);
2764 }
2765
2766 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2767 {
2768         struct rlimit *old_rlim = current->signal->rlim + resource;
2769         int rc;
2770
2771         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2772         if (rc)
2773                 return rc;
2774
2775         /* Control the ability to change the hard limit (whether
2776            lowering or raising it), so that the hard limit can
2777            later be used as a safe reset point for the soft limit
2778            upon context transitions. See selinux_bprm_apply_creds. */
2779         if (old_rlim->rlim_max != new_rlim->rlim_max)
2780                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2781
2782         return 0;
2783 }
2784
2785 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2786 {
2787         return task_has_perm(current, p, PROCESS__SETSCHED);
2788 }
2789
2790 static int selinux_task_getscheduler(struct task_struct *p)
2791 {
2792         return task_has_perm(current, p, PROCESS__GETSCHED);
2793 }
2794
2795 static int selinux_task_movememory(struct task_struct *p)
2796 {
2797         return task_has_perm(current, p, PROCESS__SETSCHED);
2798 }
2799
2800 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2801                                 int sig, u32 secid)
2802 {
2803         u32 perm;
2804         int rc;
2805         struct task_security_struct *tsec;
2806
2807         rc = secondary_ops->task_kill(p, info, sig, secid);
2808         if (rc)
2809                 return rc;
2810
2811         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2812                 return 0;
2813
2814         if (!sig)
2815                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2816         else
2817                 perm = signal_to_av(sig);
2818         tsec = p->security;
2819         if (secid)
2820                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2821         else
2822                 rc = task_has_perm(current, p, perm);
2823         return rc;
2824 }
2825
2826 static int selinux_task_prctl(int option,
2827                               unsigned long arg2,
2828                               unsigned long arg3,
2829                               unsigned long arg4,
2830                               unsigned long arg5)
2831 {
2832         /* The current prctl operations do not appear to require
2833            any SELinux controls since they merely observe or modify
2834            the state of the current process. */
2835         return 0;
2836 }
2837
2838 static int selinux_task_wait(struct task_struct *p)
2839 {
2840         u32 perm;
2841
2842         perm = signal_to_av(p->exit_signal);
2843
2844         return task_has_perm(p, current, perm);
2845 }
2846
2847 static void selinux_task_reparent_to_init(struct task_struct *p)
2848 {
2849         struct task_security_struct *tsec;
2850
2851         secondary_ops->task_reparent_to_init(p);
2852
2853         tsec = p->security;
2854         tsec->osid = tsec->sid;
2855         tsec->sid = SECINITSID_KERNEL;
2856         return;
2857 }
2858
2859 static void selinux_task_to_inode(struct task_struct *p,
2860                                   struct inode *inode)
2861 {
2862         struct task_security_struct *tsec = p->security;
2863         struct inode_security_struct *isec = inode->i_security;
2864
2865         isec->sid = tsec->sid;
2866         isec->initialized = 1;
2867         return;
2868 }
2869
2870 /* Returns error only if unable to parse addresses */
2871 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2872 {
2873         int offset, ihlen, ret = -EINVAL;
2874         struct iphdr _iph, *ih;
2875
2876         offset = skb->nh.raw - skb->data;
2877         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2878         if (ih == NULL)
2879                 goto out;
2880
2881         ihlen = ih->ihl * 4;
2882         if (ihlen < sizeof(_iph))
2883                 goto out;
2884
2885         ad->u.net.v4info.saddr = ih->saddr;
2886         ad->u.net.v4info.daddr = ih->daddr;
2887         ret = 0;
2888
2889         switch (ih->protocol) {
2890         case IPPROTO_TCP: {
2891                 struct tcphdr _tcph, *th;
2892
2893                 if (ntohs(ih->frag_off) & IP_OFFSET)
2894                         break;
2895
2896                 offset += ihlen;
2897                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2898                 if (th == NULL)
2899                         break;
2900
2901                 ad->u.net.sport = th->source;
2902                 ad->u.net.dport = th->dest;
2903                 break;
2904         }
2905
2906         case IPPROTO_UDP: {
2907                 struct udphdr _udph, *uh;
2908
2909                 if (ntohs(ih->frag_off) & IP_OFFSET)
2910                         break;
2911
2912                 offset += ihlen;
2913                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2914                 if (uh == NULL)
2915                         break;
2916
2917                 ad->u.net.sport = uh->source;
2918                 ad->u.net.dport = uh->dest;
2919                 break;
2920         }
2921
2922         default:
2923                 break;
2924         }
2925 out:
2926         return ret;
2927 }
2928
2929 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2930
2931 /* Returns error only if unable to parse addresses */
2932 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2933 {
2934         u8 nexthdr;
2935         int ret = -EINVAL, offset;
2936         struct ipv6hdr _ipv6h, *ip6;
2937
2938         offset = skb->nh.raw - skb->data;
2939         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2940         if (ip6 == NULL)
2941                 goto out;
2942
2943         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2944         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2945         ret = 0;
2946
2947         nexthdr = ip6->nexthdr;
2948         offset += sizeof(_ipv6h);
2949         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2950         if (offset < 0)
2951                 goto out;
2952
2953         switch (nexthdr) {
2954         case IPPROTO_TCP: {
2955                 struct tcphdr _tcph, *th;
2956
2957                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2958                 if (th == NULL)
2959                         break;
2960
2961                 ad->u.net.sport = th->source;
2962                 ad->u.net.dport = th->dest;
2963                 break;
2964         }
2965
2966         case IPPROTO_UDP: {
2967                 struct udphdr _udph, *uh;
2968
2969                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2970                 if (uh == NULL)
2971                         break;
2972
2973                 ad->u.net.sport = uh->source;
2974                 ad->u.net.dport = uh->dest;
2975                 break;
2976         }
2977
2978         /* includes fragments */
2979         default:
2980                 break;
2981         }
2982 out:
2983         return ret;
2984 }
2985
2986 #endif /* IPV6 */
2987
2988 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2989                              char **addrp, int *len, int src)
2990 {
2991         int ret = 0;
2992
2993         switch (ad->u.net.family) {
2994         case PF_INET:
2995                 ret = selinux_parse_skb_ipv4(skb, ad);
2996                 if (ret || !addrp)
2997                         break;
2998                 *len = 4;
2999                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3000                                         &ad->u.net.v4info.daddr);
3001                 break;
3002
3003 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3004         case PF_INET6:
3005                 ret = selinux_parse_skb_ipv6(skb, ad);
3006                 if (ret || !addrp)
3007                         break;
3008                 *len = 16;
3009                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3010                                         &ad->u.net.v6info.daddr);
3011                 break;
3012 #endif  /* IPV6 */
3013         default:
3014                 break;
3015         }
3016
3017         return ret;
3018 }
3019
3020 /* socket security operations */
3021 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3022                            u32 perms)
3023 {
3024         struct inode_security_struct *isec;
3025         struct task_security_struct *tsec;
3026         struct avc_audit_data ad;
3027         int err = 0;
3028
3029         tsec = task->security;
3030         isec = SOCK_INODE(sock)->i_security;
3031
3032         if (isec->sid == SECINITSID_KERNEL)
3033                 goto out;
3034
3035         AVC_AUDIT_DATA_INIT(&ad,NET);
3036         ad.u.net.sk = sock->sk;
3037         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3038
3039 out:
3040         return err;
3041 }
3042
3043 static int selinux_socket_create(int family, int type,
3044                                  int protocol, int kern)
3045 {
3046         int err = 0;
3047         struct task_security_struct *tsec;
3048         u32 newsid;
3049
3050         if (kern)
3051                 goto out;
3052
3053         tsec = current->security;
3054         newsid = tsec->sockcreate_sid ? : tsec->sid;
3055         err = avc_has_perm(tsec->sid, newsid,
3056                            socket_type_to_security_class(family, type,
3057                            protocol), SOCKET__CREATE, NULL);
3058
3059 out:
3060         return err;
3061 }
3062
3063 static void selinux_socket_post_create(struct socket *sock, int family,
3064                                        int type, int protocol, int kern)
3065 {
3066         struct inode_security_struct *isec;
3067         struct task_security_struct *tsec;
3068         u32 newsid;
3069
3070         isec = SOCK_INODE(sock)->i_security;
3071
3072         tsec = current->security;
3073         newsid = tsec->sockcreate_sid ? : tsec->sid;
3074         isec->sclass = socket_type_to_security_class(family, type, protocol);
3075         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3076         isec->initialized = 1;
3077
3078         return;
3079 }
3080
3081 /* Range of port numbers used to automatically bind.
3082    Need to determine whether we should perform a name_bind
3083    permission check between the socket and the port number. */
3084 #define ip_local_port_range_0 sysctl_local_port_range[0]
3085 #define ip_local_port_range_1 sysctl_local_port_range[1]
3086
3087 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3088 {
3089         u16 family;
3090         int err;
3091
3092         err = socket_has_perm(current, sock, SOCKET__BIND);
3093         if (err)
3094                 goto out;
3095
3096         /*
3097          * If PF_INET or PF_INET6, check name_bind permission for the port.
3098          * Multiple address binding for SCTP is not supported yet: we just
3099          * check the first address now.
3100          */
3101         family = sock->sk->sk_family;
3102         if (family == PF_INET || family == PF_INET6) {
3103                 char *addrp;
3104                 struct inode_security_struct *isec;
3105                 struct task_security_struct *tsec;
3106                 struct avc_audit_data ad;
3107                 struct sockaddr_in *addr4 = NULL;
3108                 struct sockaddr_in6 *addr6 = NULL;
3109                 unsigned short snum;
3110                 struct sock *sk = sock->sk;
3111                 u32 sid, node_perm, addrlen;
3112
3113                 tsec = current->security;
3114                 isec = SOCK_INODE(sock)->i_security;
3115
3116                 if (family == PF_INET) {
3117                         addr4 = (struct sockaddr_in *)address;
3118                         snum = ntohs(addr4->sin_port);
3119                         addrlen = sizeof(addr4->sin_addr.s_addr);
3120                         addrp = (char *)&addr4->sin_addr.s_addr;
3121                 } else {
3122                         addr6 = (struct sockaddr_in6 *)address;
3123                         snum = ntohs(addr6->sin6_port);
3124                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3125                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3126                 }
3127
3128                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3129                            snum > ip_local_port_range_1)) {
3130                         err = security_port_sid(sk->sk_family, sk->sk_type,
3131                                                 sk->sk_protocol, snum, &sid);
3132                         if (err)
3133                                 goto out;
3134                         AVC_AUDIT_DATA_INIT(&ad,NET);
3135                         ad.u.net.sport = htons(snum);
3136                         ad.u.net.family = family;
3137                         err = avc_has_perm(isec->sid, sid,
3138                                            isec->sclass,
3139                                            SOCKET__NAME_BIND, &ad);
3140                         if (err)
3141                                 goto out;
3142                 }
3143
3144                 switch(isec->sclass) {
3145                 case SECCLASS_TCP_SOCKET:
3146                         node_perm = TCP_SOCKET__NODE_BIND;
3147                         break;
3148
3149                 case SECCLASS_UDP_SOCKET:
3150                         node_perm = UDP_SOCKET__NODE_BIND;
3151                         break;
3152
3153                 default:
3154                         node_perm = RAWIP_SOCKET__NODE_BIND;
3155                         break;
3156                 }
3157
3158                 err = security_node_sid(family, addrp, addrlen, &sid);
3159                 if (err)
3160                         goto out;
3161
3162                 AVC_AUDIT_DATA_INIT(&ad,NET);
3163                 ad.u.net.sport = htons(snum);
3164                 ad.u.net.family = family;
3165
3166                 if (family == PF_INET)
3167                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3168                 else
3169                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3170
3171                 err = avc_has_perm(isec->sid, sid,
3172                                    isec->sclass, node_perm, &ad);
3173                 if (err)
3174                         goto out;
3175         }
3176 out:
3177         return err;
3178 }
3179
3180 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3181 {
3182         struct inode_security_struct *isec;
3183         int err;
3184
3185         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3186         if (err)
3187                 return err;
3188
3189         /*
3190          * If a TCP socket, check name_connect permission for the port.
3191          */
3192         isec = SOCK_INODE(sock)->i_security;
3193         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3194                 struct sock *sk = sock->sk;
3195                 struct avc_audit_data ad;
3196                 struct sockaddr_in *addr4 = NULL;
3197                 struct sockaddr_in6 *addr6 = NULL;
3198                 unsigned short snum;
3199                 u32 sid;
3200
3201                 if (sk->sk_family == PF_INET) {
3202                         addr4 = (struct sockaddr_in *)address;
3203                         if (addrlen < sizeof(struct sockaddr_in))
3204                                 return -EINVAL;
3205                         snum = ntohs(addr4->sin_port);
3206                 } else {
3207                         addr6 = (struct sockaddr_in6 *)address;
3208                         if (addrlen < SIN6_LEN_RFC2133)
3209                                 return -EINVAL;
3210                         snum = ntohs(addr6->sin6_port);
3211                 }
3212
3213                 err = security_port_sid(sk->sk_family, sk->sk_type,
3214                                         sk->sk_protocol, snum, &sid);
3215                 if (err)
3216                         goto out;
3217
3218                 AVC_AUDIT_DATA_INIT(&ad,NET);
3219                 ad.u.net.dport = htons(snum);
3220                 ad.u.net.family = sk->sk_family;
3221                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3222                                    TCP_SOCKET__NAME_CONNECT, &ad);
3223                 if (err)
3224                         goto out;
3225         }
3226
3227 out:
3228         return err;
3229 }
3230
3231 static int selinux_socket_listen(struct socket *sock, int backlog)
3232 {
3233         return socket_has_perm(current, sock, SOCKET__LISTEN);
3234 }
3235
3236 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3237 {
3238         int err;
3239         struct inode_security_struct *isec;
3240         struct inode_security_struct *newisec;
3241
3242         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3243         if (err)
3244                 return err;
3245
3246         newisec = SOCK_INODE(newsock)->i_security;
3247
3248         isec = SOCK_INODE(sock)->i_security;
3249         newisec->sclass = isec->sclass;
3250         newisec->sid = isec->sid;
3251         newisec->initialized = 1;
3252
3253         return 0;
3254 }
3255
3256 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3257                                   int size)
3258 {
3259         return socket_has_perm(current, sock, SOCKET__WRITE);
3260 }
3261
3262 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3263                                   int size, int flags)
3264 {
3265         return socket_has_perm(current, sock, SOCKET__READ);
3266 }
3267
3268 static int selinux_socket_getsockname(struct socket *sock)
3269 {
3270         return socket_has_perm(current, sock, SOCKET__GETATTR);
3271 }
3272
3273 static int selinux_socket_getpeername(struct socket *sock)
3274 {
3275         return socket_has_perm(current, sock, SOCKET__GETATTR);
3276 }
3277
3278 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3279 {
3280         return socket_has_perm(current, sock, SOCKET__SETOPT);
3281 }
3282
3283 static int selinux_socket_getsockopt(struct socket *sock, int level,
3284                                      int optname)
3285 {
3286         return socket_has_perm(current, sock, SOCKET__GETOPT);
3287 }
3288
3289 static int selinux_socket_shutdown(struct socket *sock, int how)
3290 {
3291         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3292 }
3293
3294 static int selinux_socket_unix_stream_connect(struct socket *sock,
3295                                               struct socket *other,
3296                                               struct sock *newsk)
3297 {
3298         struct sk_security_struct *ssec;
3299         struct inode_security_struct *isec;
3300         struct inode_security_struct *other_isec;
3301         struct avc_audit_data ad;
3302         int err;
3303
3304         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3305         if (err)
3306                 return err;
3307
3308         isec = SOCK_INODE(sock)->i_security;
3309         other_isec = SOCK_INODE(other)->i_security;
3310
3311         AVC_AUDIT_DATA_INIT(&ad,NET);
3312         ad.u.net.sk = other->sk;
3313
3314         err = avc_has_perm(isec->sid, other_isec->sid,
3315                            isec->sclass,
3316                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3317         if (err)
3318                 return err;
3319
3320         /* connecting socket */
3321         ssec = sock->sk->sk_security;
3322         ssec->peer_sid = other_isec->sid;
3323
3324         /* server child socket */
3325         ssec = newsk->sk_security;
3326         ssec->peer_sid = isec->sid;
3327
3328         return 0;
3329 }
3330
3331 static int selinux_socket_unix_may_send(struct socket *sock,
3332                                         struct socket *other)
3333 {
3334         struct inode_security_struct *isec;
3335         struct inode_security_struct *other_isec;
3336         struct avc_audit_data ad;
3337         int err;
3338
3339         isec = SOCK_INODE(sock)->i_security;
3340         other_isec = SOCK_INODE(other)->i_security;
3341
3342         AVC_AUDIT_DATA_INIT(&ad,NET);
3343         ad.u.net.sk = other->sk;
3344
3345         err = avc_has_perm(isec->sid, other_isec->sid,
3346                            isec->sclass, SOCKET__SENDTO, &ad);
3347         if (err)
3348                 return err;
3349
3350         return 0;
3351 }
3352
3353 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3354                 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3355                 u16 family, char *addrp, int len)
3356 {
3357         int err = 0;
3358         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3359
3360         if (!skb->dev)
3361                 goto out;
3362
3363         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3364         if (err)
3365                 goto out;
3366
3367         switch (sock_class) {
3368         case SECCLASS_UDP_SOCKET:
3369                 netif_perm = NETIF__UDP_RECV;
3370                 node_perm = NODE__UDP_RECV;
3371                 recv_perm = UDP_SOCKET__RECV_MSG;
3372                 break;
3373
3374         case SECCLASS_TCP_SOCKET:
3375                 netif_perm = NETIF__TCP_RECV;
3376                 node_perm = NODE__TCP_RECV;
3377                 recv_perm = TCP_SOCKET__RECV_MSG;
3378                 break;
3379
3380         default:
3381                 netif_perm = NETIF__RAWIP_RECV;
3382                 node_perm = NODE__RAWIP_RECV;
3383                 break;
3384         }
3385
3386         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3387         if (err)
3388                 goto out;
3389
3390         err = security_node_sid(family, addrp, len, &node_sid);
3391         if (err)
3392                 goto out;
3393
3394         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3395         if (err)
3396                 goto out;
3397
3398         if (recv_perm) {
3399                 u32 port_sid;
3400
3401                 err = security_port_sid(sk->sk_family, sk->sk_type,
3402                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3403                                         &port_sid);
3404                 if (err)
3405                         goto out;
3406
3407                 err = avc_has_perm(sock_sid, port_sid,
3408                                    sock_class, recv_perm, ad);
3409         }
3410
3411 out:
3412         return err;
3413 }
3414
3415 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3416 {
3417         u16 family;
3418         u16 sock_class = 0;
3419         char *addrp;
3420         int len, err = 0;
3421         u32 sock_sid = 0;
3422         struct socket *sock;
3423         struct avc_audit_data ad;
3424
3425         family = sk->sk_family;
3426         if (family != PF_INET && family != PF_INET6)
3427                 goto out;
3428
3429         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3430         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3431                 family = PF_INET;
3432
3433         read_lock_bh(&sk->sk_callback_lock);
3434         sock = sk->sk_socket;
3435         if (sock) {
3436                 struct inode *inode;
3437                 inode = SOCK_INODE(sock);
3438                 if (inode) {
3439                         struct inode_security_struct *isec;
3440                         isec = inode->i_security;
3441                         sock_sid = isec->sid;
3442                         sock_class = isec->sclass;
3443                 }
3444         }
3445         read_unlock_bh(&sk->sk_callback_lock);
3446         if (!sock_sid)
3447                 goto out;
3448
3449         AVC_AUDIT_DATA_INIT(&ad, NET);
3450         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3451         ad.u.net.family = family;
3452
3453         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3454         if (err)
3455                 goto out;
3456
3457         if (selinux_compat_net)
3458                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3459                                                   sock_class, family,
3460                                                   addrp, len);
3461         else
3462                 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3463                                    PACKET__RECV, &ad);
3464         if (err)
3465                 goto out;
3466
3467         err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3468 out:
3469         return err;
3470 }
3471
3472 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3473                                             int __user *optlen, unsigned len)
3474 {
3475         int err = 0;
3476         char *scontext;
3477         u32 scontext_len;
3478         struct sk_security_struct *ssec;
3479         struct inode_security_struct *isec;
3480         u32 peer_sid = 0;
3481
3482         isec = SOCK_INODE(sock)->i_security;
3483
3484         /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3485         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3486                 ssec = sock->sk->sk_security;
3487                 peer_sid = ssec->peer_sid;
3488         }
3489         else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3490                 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3491
3492                 if (peer_sid == SECSID_NULL) {
3493                         err = -ENOPROTOOPT;
3494                         goto out;
3495                 }
3496         }
3497         else {
3498                 err = -ENOPROTOOPT;
3499                 goto out;
3500         }
3501
3502         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3503
3504         if (err)
3505                 goto out;
3506
3507         if (scontext_len > len) {
3508                 err = -ERANGE;
3509                 goto out_len;
3510         }
3511
3512         if (copy_to_user(optval, scontext, scontext_len))
3513                 err = -EFAULT;
3514
3515 out_len:
3516         if (put_user(scontext_len, optlen))
3517                 err = -EFAULT;
3518
3519         kfree(scontext);
3520 out:
3521         return err;
3522 }
3523
3524 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3525 {
3526         u32 peer_secid = SECSID_NULL;
3527         int err = 0;
3528
3529         if (sock && (sock->sk->sk_family == PF_UNIX))
3530                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3531         else if (skb)
3532                 peer_secid = selinux_socket_getpeer_dgram(skb);
3533
3534         if (peer_secid == SECSID_NULL)
3535                 err = -EINVAL;
3536         *secid = peer_secid;
3537
3538         return err;
3539 }
3540
3541 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3542 {
3543         return sk_alloc_security(sk, family, priority);
3544 }
3545
3546 static void selinux_sk_free_security(struct sock *sk)
3547 {
3548         sk_free_security(sk);
3549 }
3550
3551 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3552 {
3553         struct inode_security_struct *isec;
3554         u32 sock_sid = SECINITSID_ANY_SOCKET;
3555
3556         if (!sk)
3557                 return selinux_no_sk_sid(fl);
3558
3559         read_lock_bh(&sk->sk_callback_lock);
3560         isec = get_sock_isec(sk);
3561
3562         if (isec)
3563                 sock_sid = isec->sid;
3564
3565         read_unlock_bh(&sk->sk_callback_lock);
3566         return sock_sid;
3567 }
3568
3569 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3570 {
3571         int err = 0;
3572         u32 perm;
3573         struct nlmsghdr *nlh;
3574         struct socket *sock = sk->sk_socket;
3575         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3576
3577         if (skb->len < NLMSG_SPACE(0)) {
3578                 err = -EINVAL;
3579                 goto out;
3580         }
3581         nlh = (struct nlmsghdr *)skb->data;
3582
3583         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3584         if (err) {
3585                 if (err == -EINVAL) {
3586                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3587                                   "SELinux:  unrecognized netlink message"
3588                                   " type=%hu for sclass=%hu\n",
3589                                   nlh->nlmsg_type, isec->sclass);
3590                         if (!selinux_enforcing)
3591                                 err = 0;
3592                 }
3593
3594                 /* Ignore */
3595                 if (err == -ENOENT)
3596                         err = 0;
3597                 goto out;
3598         }
3599
3600         err = socket_has_perm(current, sock, perm);
3601 out:
3602         return err;
3603 }
3604
3605 #ifdef CONFIG_NETFILTER
3606
3607 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3608                                             struct inode_security_struct *isec,
3609                                             struct avc_audit_data *ad,
3610                                             u16 family, char *addrp, int len)
3611 {
3612         int err;
3613         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3614
3615         err = sel_netif_sids(dev, &if_sid, NULL);
3616         if (err)
3617                 goto out;
3618
3619         switch (isec->sclass) {
3620         case SECCLASS_UDP_SOCKET:
3621                 netif_perm = NETIF__UDP_SEND;
3622                 node_perm = NODE__UDP_SEND;
3623                 send_perm = UDP_SOCKET__SEND_MSG;
3624                 break;
3625
3626         case SECCLASS_TCP_SOCKET:
3627                 netif_perm = NETIF__TCP_SEND;
3628                 node_perm = NODE__TCP_SEND;
3629                 send_perm = TCP_SOCKET__SEND_MSG;
3630                 break;
3631
3632         default:
3633                 netif_perm = NETIF__RAWIP_SEND;
3634                 node_perm = NODE__RAWIP_SEND;
3635                 break;
3636         }
3637
3638         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3639         if (err)
3640                 goto out;
3641
3642         err = security_node_sid(family, addrp, len, &node_sid);
3643         if (err)
3644                 goto out;
3645
3646         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3647         if (err)
3648                 goto out;
3649
3650         if (send_perm) {
3651                 u32 port_sid;
3652
3653                 err = security_port_sid(sk->sk_family,
3654                                         sk->sk_type,
3655                                         sk->sk_protocol,
3656                                         ntohs(ad->u.net.dport),
3657                                         &port_sid);
3658                 if (err)
3659                         goto out;
3660
3661                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3662                                    send_perm, ad);
3663         }
3664 out:
3665         return err;
3666 }
3667
3668 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3669                                               struct sk_buff **pskb,
3670                                               const struct net_device *in,
3671                                               const struct net_device *out,
3672                                               int (*okfn)(struct sk_buff *),
3673                                               u16 family)
3674 {
3675         char *addrp;
3676         int len, err = 0;
3677         struct sock *sk;
3678         struct socket *sock;
3679         struct inode *inode;
3680         struct sk_buff *skb = *pskb;
3681         struct inode_security_struct *isec;
3682         struct avc_audit_data ad;
3683         struct net_device *dev = (struct net_device *)out;
3684
3685         sk = skb->sk;
3686         if (!sk)
3687                 goto out;
3688
3689         sock = sk->sk_socket;
3690         if (!sock)
3691                 goto out;
3692
3693         inode = SOCK_INODE(sock);
3694         if (!inode)
3695                 goto out;
3696
3697         isec = inode->i_security;
3698
3699         AVC_AUDIT_DATA_INIT(&ad, NET);
3700         ad.u.net.netif = dev->name;
3701         ad.u.net.family = family;
3702
3703         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3704         if (err)
3705                 goto out;
3706
3707         if (selinux_compat_net)
3708                 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3709                                                        family, addrp, len);
3710         else
3711                 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3712                                    PACKET__SEND, &ad);
3713
3714         if (err)
3715                 goto out;
3716
3717         err = selinux_xfrm_postroute_last(isec->sid, skb);
3718 out:
3719         return err ? NF_DROP : NF_ACCEPT;
3720 }
3721
3722 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3723                                                 struct sk_buff **pskb,
3724                                                 const struct net_device *in,
3725                                                 const struct net_device *out,
3726                                                 int (*okfn)(struct sk_buff *))
3727 {
3728         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3729 }
3730
3731 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3732
3733 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3734                                                 struct sk_buff **pskb,
3735                                                 const struct net_device *in,
3736                                                 const struct net_device *out,
3737                                                 int (*okfn)(struct sk_buff *))
3738 {
3739         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3740 }
3741
3742 #endif  /* IPV6 */
3743
3744 #endif  /* CONFIG_NETFILTER */
3745
3746 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3747 {
3748         int err;
3749
3750         err = secondary_ops->netlink_send(sk, skb);
3751         if (err)
3752                 return err;
3753
3754         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3755                 err = selinux_nlmsg_perm(sk, skb);
3756
3757         return err;
3758 }
3759
3760 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3761 {
3762         int err;
3763         struct avc_audit_data ad;
3764
3765         err = secondary_ops->netlink_recv(skb, capability);
3766         if (err)
3767                 return err;
3768
3769         AVC_AUDIT_DATA_INIT(&ad, CAP);
3770         ad.u.cap = capability;
3771
3772         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3773                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3774 }
3775
3776 static int ipc_alloc_security(struct task_struct *task,
3777                               struct kern_ipc_perm *perm,
3778                               u16 sclass)
3779 {
3780         struct task_security_struct *tsec = task->security;
3781         struct ipc_security_struct *isec;
3782
3783         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3784         if (!isec)
3785                 return -ENOMEM;
3786
3787         isec->sclass = sclass;
3788         isec->ipc_perm = perm;
3789         isec->sid = tsec->sid;
3790         perm->security = isec;
3791
3792         return 0;
3793 }
3794
3795 static void ipc_free_security(struct kern_ipc_perm *perm)
3796 {
3797         struct ipc_security_struct *isec = perm->security;
3798         perm->security = NULL;
3799         kfree(isec);
3800 }
3801
3802 static int msg_msg_alloc_security(struct msg_msg *msg)
3803 {
3804         struct msg_security_struct *msec;
3805
3806         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3807         if (!msec)
3808                 return -ENOMEM;
3809
3810         msec->msg = msg;
3811         msec->sid = SECINITSID_UNLABELED;
3812         msg->security = msec;
3813
3814         return 0;
3815 }
3816
3817 static void msg_msg_free_security(struct msg_msg *msg)
3818 {
3819         struct msg_security_struct *msec = msg->security;
3820
3821         msg->security = NULL;
3822         kfree(msec);
3823 }
3824
3825 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3826                         u32 perms)
3827 {
3828         struct task_security_struct *tsec;
3829         struct ipc_security_struct *isec;
3830         struct avc_audit_data ad;
3831
3832         tsec = current->security;
3833         isec = ipc_perms->security;
3834
3835         AVC_AUDIT_DATA_INIT(&ad, IPC);
3836         ad.u.ipc_id = ipc_perms->key;
3837
3838         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3839 }
3840
3841 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3842 {
3843         return msg_msg_alloc_security(msg);
3844 }
3845
3846 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3847 {
3848         msg_msg_free_security(msg);
3849 }
3850
3851 /* message queue security operations */
3852 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3853 {
3854         struct task_security_struct *tsec;
3855         struct ipc_security_struct *isec;
3856         struct avc_audit_data ad;
3857         int rc;
3858
3859         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3860         if (rc)
3861                 return rc;
3862
3863         tsec = current->security;
3864         isec = msq->q_perm.security;
3865
3866         AVC_AUDIT_DATA_INIT(&ad, IPC);
3867         ad.u.ipc_id = msq->q_perm.key;
3868
3869         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3870                           MSGQ__CREATE, &ad);
3871         if (rc) {
3872                 ipc_free_security(&msq->q_perm);
3873                 return rc;
3874         }
3875         return 0;
3876 }
3877
3878 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3879 {
3880         ipc_free_security(&msq->q_perm);
3881 }
3882
3883 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3884 {
3885         struct task_security_struct *tsec;
3886         struct ipc_security_struct *isec;
3887         struct avc_audit_data ad;
3888
3889         tsec = current->security;
3890         isec = msq->q_perm.security;
3891
3892         AVC_AUDIT_DATA_INIT(&ad, IPC);
3893         ad.u.ipc_id = msq->q_perm.key;
3894
3895         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3896                             MSGQ__ASSOCIATE, &ad);
3897 }
3898
3899 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3900 {
3901         int err;
3902         int perms;
3903
3904         switch(cmd) {
3905         case IPC_INFO:
3906         case MSG_INFO:
3907                 /* No specific object, just general system-wide information. */
3908                 return task_has_system(current, SYSTEM__IPC_INFO);
3909         case IPC_STAT:
3910         case MSG_STAT:
3911                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3912                 break;
3913         case IPC_SET:
3914                 perms = MSGQ__SETATTR;
3915                 break;
3916         case IPC_RMID:
3917                 perms = MSGQ__DESTROY;
3918                 break;
3919         default:
3920                 return 0;
3921         }
3922
3923         err = ipc_has_perm(&msq->q_perm, perms);
3924         return err;
3925 }
3926
3927 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3928 {
3929         struct task_security_struct *tsec;
3930         struct ipc_security_struct *isec;
3931         struct msg_security_struct *msec;
3932         struct avc_audit_data ad;
3933         int rc;
3934
3935         tsec = current->security;
3936         isec = msq->q_perm.security;
3937         msec = msg->security;
3938
3939         /*
3940          * First time through, need to assign label to the message
3941          */
3942         if (msec->sid == SECINITSID_UNLABELED) {
3943                 /*
3944                  * Compute new sid based on current process and
3945                  * message queue this message will be stored in
3946                  */
3947                 rc = security_transition_sid(tsec->sid,
3948                                              isec->sid,
3949                                              SECCLASS_MSG,
3950                                              &msec->sid);
3951                 if (rc)
3952                         return rc;
3953         }
3954
3955         AVC_AUDIT_DATA_INIT(&ad, IPC);
3956         ad.u.ipc_id = msq->q_perm.key;
3957
3958         /* Can this process write to the queue? */
3959         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3960                           MSGQ__WRITE, &ad);
3961         if (!rc)
3962                 /* Can this process send the message */
3963                 rc = avc_has_perm(tsec->sid, msec->sid,
3964                                   SECCLASS_MSG, MSG__SEND, &ad);
3965         if (!rc)
3966                 /* Can the message be put in the queue? */
3967                 rc = avc_has_perm(msec->sid, isec->sid,
3968                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3969
3970         return rc;
3971 }
3972
3973 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3974                                     struct task_struct *target,
3975                                     long type, int mode)
3976 {
3977         struct task_security_struct *tsec;
3978         struct ipc_security_struct *isec;
3979         struct msg_security_struct *msec;
3980         struct avc_audit_data ad;
3981         int rc;
3982
3983         tsec = target->security;
3984         isec = msq->q_perm.security;
3985         msec = msg->security;
3986
3987         AVC_AUDIT_DATA_INIT(&ad, IPC);
3988         ad.u.ipc_id = msq->q_perm.key;
3989
3990         rc = avc_has_perm(tsec->sid, isec->sid,
3991                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3992         if (!rc)
3993                 rc = avc_has_perm(tsec->sid, msec->sid,
3994                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3995         return rc;
3996 }
3997
3998 /* Shared Memory security operations */
3999 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4000 {
4001         struct task_security_struct *tsec;
4002         struct ipc_security_struct *isec;
4003         struct avc_audit_data ad;
4004         int rc;
4005
4006         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4007         if (rc)
4008                 return rc;
4009
4010         tsec = current->security;
4011         isec = shp->shm_perm.security;
4012
4013         AVC_AUDIT_DATA_INIT(&ad, IPC);
4014         ad.u.ipc_id = shp->shm_perm.key;
4015
4016         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4017                           SHM__CREATE, &ad);
4018         if (rc) {
4019                 ipc_free_security(&shp->shm_perm);
4020                 return rc;
4021         }
4022         return 0;
4023 }
4024
4025 static void selinux_shm_free_security(struct shmid_kernel *shp)
4026 {
4027         ipc_free_security(&shp->shm_perm);
4028 }
4029
4030 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4031 {
4032         struct task_security_struct *tsec;
4033         struct ipc_security_struct *isec;
4034         struct avc_audit_data ad;
4035
4036         tsec = current->security;
4037         isec = shp->shm_perm.security;
4038
4039         AVC_AUDIT_DATA_INIT(&ad, IPC);
4040         ad.u.ipc_id = shp->shm_perm.key;
4041
4042         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4043                             SHM__ASSOCIATE, &ad);
4044 }
4045
4046 /* Note, at this point, shp is locked down */
4047 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4048 {
4049         int perms;
4050         int err;
4051
4052         switch(cmd) {
4053         case IPC_INFO:
4054         case SHM_INFO:
4055                 /* No specific object, just general system-wide information. */
4056                 return task_has_system(current, SYSTEM__IPC_INFO);
4057         case IPC_STAT:
4058         case SHM_STAT:
4059                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4060                 break;
4061         case IPC_SET:
4062                 perms = SHM__SETATTR;
4063                 break;
4064         case SHM_LOCK:
4065         case SHM_UNLOCK:
4066                 perms = SHM__LOCK;
4067                 break;
4068         case IPC_RMID:
4069                 perms = SHM__DESTROY;
4070                 break;
4071         default:
4072                 return 0;
4073         }
4074
4075         err = ipc_has_perm(&shp->shm_perm, perms);
4076         return err;
4077 }
4078
4079 static int selinux_shm_shmat(struct shmid_kernel *shp,
4080                              char __user *shmaddr, int shmflg)
4081 {
4082         u32 perms;
4083         int rc;
4084
4085         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4086         if (rc)
4087                 return rc;
4088
4089         if (shmflg & SHM_RDONLY)
4090                 perms = SHM__READ;
4091         else
4092                 perms = SHM__READ | SHM__WRITE;
4093
4094         return ipc_has_perm(&shp->shm_perm, perms);
4095 }
4096
4097 /* Semaphore security operations */
4098 static int selinux_sem_alloc_security(struct sem_array *sma)
4099 {
4100         struct task_security_struct *tsec;
4101         struct ipc_security_struct *isec;
4102         struct avc_audit_data ad;
4103         int rc;
4104
4105         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4106         if (rc)
4107                 return rc;
4108
4109         tsec = current->security;
4110         isec = sma->sem_perm.security;
4111
4112         AVC_AUDIT_DATA_INIT(&ad, IPC);
4113         ad.u.ipc_id = sma->sem_perm.key;
4114
4115         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4116                           SEM__CREATE, &ad);
4117         if (rc) {
4118                 ipc_free_security(&sma->sem_perm);
4119                 return rc;
4120         }
4121         return 0;
4122 }
4123
4124 static void selinux_sem_free_security(struct sem_array *sma)
4125 {
4126         ipc_free_security(&sma->sem_perm);
4127 }
4128
4129 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4130 {
4131         struct task_security_struct *tsec;
4132         struct ipc_security_struct *isec;
4133         struct avc_audit_data ad;
4134
4135         tsec = current->security;
4136         isec = sma->sem_perm.security;
4137
4138         AVC_AUDIT_DATA_INIT(&ad, IPC);
4139         ad.u.ipc_id = sma->sem_perm.key;
4140
4141         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4142                             SEM__ASSOCIATE, &ad);
4143 }
4144
4145 /* Note, at this point, sma is locked down */
4146 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4147 {
4148         int err;
4149         u32 perms;
4150
4151         switch(cmd) {
4152         case IPC_INFO:
4153         case SEM_INFO:
4154                 /* No specific object, just general system-wide information. */
4155                 return task_has_system(current, SYSTEM__IPC_INFO);
4156         case GETPID:
4157         case GETNCNT:
4158         case GETZCNT:
4159                 perms = SEM__GETATTR;
4160                 break;
4161         case GETVAL:
4162         case GETALL:
4163                 perms = SEM__READ;
4164                 break;
4165         case SETVAL:
4166         case SETALL:
4167                 perms = SEM__WRITE;
4168                 break;
4169         case IPC_RMID:
4170                 perms = SEM__DESTROY;
4171                 break;
4172         case IPC_SET:
4173                 perms = SEM__SETATTR;
4174                 break;
4175         case IPC_STAT:
4176         case SEM_STAT:
4177                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4178                 break;
4179         default:
4180                 return 0;
4181         }
4182
4183         err = ipc_has_perm(&sma->sem_perm, perms);
4184         return err;
4185 }
4186
4187 static int selinux_sem_semop(struct sem_array *sma,
4188                              struct sembuf *sops, unsigned nsops, int alter)
4189 {
4190         u32 perms;
4191
4192         if (alter)
4193                 perms = SEM__READ | SEM__WRITE;
4194         else
4195                 perms = SEM__READ;
4196
4197         return ipc_has_perm(&sma->sem_perm, perms);
4198 }
4199
4200 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4201 {
4202         u32 av = 0;
4203
4204         av = 0;
4205         if (flag & S_IRUGO)
4206                 av |= IPC__UNIX_READ;
4207         if (flag & S_IWUGO)
4208                 av |= IPC__UNIX_WRITE;
4209
4210         if (av == 0)
4211                 return 0;
4212
4213         return ipc_has_perm(ipcp, av);
4214 }
4215
4216 /* module stacking operations */
4217 static int selinux_register_security (const char *name, struct security_operations *ops)
4218 {
4219         if (secondary_ops != original_ops) {
4220                 printk(KERN_INFO "%s:  There is already a secondary security "
4221                        "module registered.\n", __FUNCTION__);
4222                 return -EINVAL;
4223         }
4224
4225         secondary_ops = ops;
4226
4227         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4228                __FUNCTION__,
4229                name);
4230
4231         return 0;
4232 }
4233
4234 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4235 {
4236         if (ops != secondary_ops) {
4237                 printk (KERN_INFO "%s:  trying to unregister a security module "
4238                         "that is not registered.\n", __FUNCTION__);
4239                 return -EINVAL;
4240         }
4241
4242         secondary_ops = original_ops;
4243
4244         return 0;
4245 }
4246
4247 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4248 {
4249         if (inode)
4250                 inode_doinit_with_dentry(inode, dentry);
4251 }
4252
4253 static int selinux_getprocattr(struct task_struct *p,
4254                                char *name, void *value, size_t size)
4255 {
4256         struct task_security_struct *tsec;
4257         u32 sid;
4258         int error;
4259
4260         if (current != p) {
4261                 error = task_has_perm(current, p, PROCESS__GETATTR);
4262                 if (error)
4263                         return error;
4264         }
4265
4266         tsec = p->security;
4267
4268         if (!strcmp(name, "current"))
4269                 sid = tsec->sid;
4270         else if (!strcmp(name, "prev"))
4271                 sid = tsec->osid;
4272         else if (!strcmp(name, "exec"))
4273                 sid = tsec->exec_sid;
4274         else if (!strcmp(name, "fscreate"))
4275                 sid = tsec->create_sid;
4276         else if (!strcmp(name, "keycreate"))
4277                 sid = tsec->keycreate_sid;
4278         else if (!strcmp(name, "sockcreate"))
4279                 sid = tsec->sockcreate_sid;
4280         else
4281                 return -EINVAL;
4282
4283         if (!sid)
4284                 return 0;
4285
4286         return selinux_getsecurity(sid, value, size);
4287 }
4288
4289 static int selinux_setprocattr(struct task_struct *p,
4290                                char *name, void *value, size_t size)
4291 {
4292         struct task_security_struct *tsec;
4293         struct task_struct *tracer;
4294         u32 sid = 0;
4295         int error;
4296         char *str = value;
4297
4298         if (current != p) {
4299                 /* SELinux only allows a process to change its own
4300                    security attributes. */
4301                 return -EACCES;
4302         }
4303
4304         /*
4305          * Basic control over ability to set these attributes at all.
4306          * current == p, but we'll pass them separately in case the
4307          * above restriction is ever removed.
4308          */
4309         if (!strcmp(name, "exec"))
4310                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4311         else if (!strcmp(name, "fscreate"))
4312                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4313         else if (!strcmp(name, "keycreate"))
4314                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4315         else if (!strcmp(name, "sockcreate"))
4316                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4317         else if (!strcmp(name, "current"))
4318                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4319         else
4320                 error = -EINVAL;
4321         if (error)
4322                 return error;
4323
4324         /* Obtain a SID for the context, if one was specified. */
4325         if (size && str[1] && str[1] != '\n') {
4326                 if (str[size-1] == '\n') {
4327                         str[size-1] = 0;
4328                         size--;
4329                 }
4330                 error = security_context_to_sid(value, size, &sid);
4331                 if (error)
4332                         return error;
4333         }
4334
4335         /* Permission checking based on the specified context is
4336            performed during the actual operation (execve,
4337            open/mkdir/...), when we know the full context of the
4338            operation.  See selinux_bprm_set_security for the execve
4339            checks and may_create for the file creation checks. The
4340            operation will then fail if the context is not permitted. */
4341         tsec = p->security;
4342         if (!strcmp(name, "exec"))
4343                 tsec->exec_sid = sid;
4344         else if (!strcmp(name, "fscreate"))
4345                 tsec->create_sid = sid;
4346         else if (!strcmp(name, "keycreate")) {
4347                 error = may_create_key(sid, p);
4348                 if (error)
4349                         return error;
4350                 tsec->keycreate_sid = sid;
4351         } else if (!strcmp(name, "sockcreate"))
4352                 tsec->sockcreate_sid = sid;
4353         else if (!strcmp(name, "current")) {
4354                 struct av_decision avd;
4355
4356                 if (sid == 0)
4357                         return -EINVAL;
4358
4359                 /* Only allow single threaded processes to change context */
4360                 if (atomic_read(&p->mm->mm_users) != 1) {
4361                         struct task_struct *g, *t;
4362                         struct mm_struct *mm = p->mm;
4363                         read_lock(&tasklist_lock);
4364                         do_each_thread(g, t)
4365                                 if (t->mm == mm && t != p) {
4366                                         read_unlock(&tasklist_lock);
4367                                         return -EPERM;
4368                                 }
4369                         while_each_thread(g, t);
4370                         read_unlock(&tasklist_lock);
4371                 }
4372
4373                 /* Check permissions for the transition. */
4374                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4375                                      PROCESS__DYNTRANSITION, NULL);
4376                 if (error)
4377                         return error;
4378
4379                 /* Check for ptracing, and update the task SID if ok.
4380                    Otherwise, leave SID unchanged and fail. */
4381                 task_lock(p);
4382                 rcu_read_lock();
4383                 tracer = tracehook_tracer_task(p);
4384                 if (tracer != NULL) {
4385                         struct task_security_struct *ptsec = tracer->security;
4386                         u32 ptsid = ptsec->sid;
4387                         rcu_read_unlock();
4388                         error = avc_has_perm_noaudit(ptsid, sid,
4389                                                      SECCLASS_PROCESS,
4390                                                      PROCESS__PTRACE, &avd);
4391                         if (!error)
4392                                 tsec->sid = sid;
4393                         task_unlock(p);
4394                         avc_audit(ptsid, sid, SECCLASS_PROCESS,
4395                                   PROCESS__PTRACE, &avd, error, NULL);
4396                         if (error)
4397                                 return error;
4398                 } else {
4399                         rcu_read_unlock();
4400                         tsec->sid = sid;
4401                         task_unlock(p);
4402                 }
4403         }
4404         else
4405                 return -EINVAL;
4406
4407         return size;
4408 }
4409
4410 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4411 {
4412         return security_sid_to_context(secid, secdata, seclen);
4413 }
4414
4415 static void selinux_release_secctx(char *secdata, u32 seclen)
4416 {
4417         if (secdata)
4418                 kfree(secdata);
4419 }
4420
4421 #ifdef CONFIG_KEYS
4422
4423 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4424                              unsigned long flags)
4425 {
4426         struct task_security_struct *tsec = tsk->security;
4427         struct key_security_struct *ksec;
4428
4429         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4430         if (!ksec)
4431                 return -ENOMEM;
4432
4433         ksec->obj = k;
4434         if (tsec->keycreate_sid)
4435                 ksec->sid = tsec->keycreate_sid;
4436         else
4437                 ksec->sid = tsec->sid;
4438         k->security = ksec;
4439
4440         return 0;
4441 }
4442
4443 static void selinux_key_free(struct key *k)
4444 {
4445         struct key_security_struct *ksec = k->security;
4446
4447         k->security = NULL;
4448         kfree(ksec);
4449 }
4450
4451 static int selinux_key_permission(key_ref_t key_ref,
4452                             struct task_struct *ctx,
4453                             key_perm_t perm)
4454 {
4455         struct key *key;
4456         struct task_security_struct *tsec;
4457         struct key_security_struct *ksec;
4458
4459         key = key_ref_to_ptr(key_ref);
4460
4461         tsec = ctx->security;
4462         ksec = key->security;
4463
4464         /* if no specific permissions are requested, we skip the
4465            permission check. No serious, additional covert channels
4466            appear to be created. */
4467         if (perm == 0)
4468                 return 0;
4469
4470         return avc_has_perm(tsec->sid, ksec->sid,
4471                             SECCLASS_KEY, perm, NULL);
4472 }
4473
4474 #endif
4475
4476 static struct security_operations selinux_ops = {
4477         .ptrace =                       selinux_ptrace,
4478         .capget =                       selinux_capget,
4479         .capset_check =                 selinux_capset_check,
4480         .capset_set =                   selinux_capset_set,
4481         .sysctl =                       selinux_sysctl,
4482         .capable =                      selinux_capable,
4483         .quotactl =                     selinux_quotactl,
4484         .quota_on =                     selinux_quota_on,
4485         .syslog =                       selinux_syslog,
4486         .vm_enough_memory =             selinux_vm_enough_memory,
4487
4488         .netlink_send =                 selinux_netlink_send,
4489         .netlink_recv =                 selinux_netlink_recv,
4490
4491         .bprm_alloc_security =          selinux_bprm_alloc_security,
4492         .bprm_free_security =           selinux_bprm_free_security,
4493         .bprm_apply_creds =             selinux_bprm_apply_creds,
4494         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4495         .bprm_set_security =            selinux_bprm_set_security,
4496         .bprm_check_security =          selinux_bprm_check_security,
4497         .bprm_secureexec =              selinux_bprm_secureexec,
4498
4499         .sb_alloc_security =            selinux_sb_alloc_security,
4500         .sb_free_security =             selinux_sb_free_security,
4501         .sb_copy_data =                 selinux_sb_copy_data,
4502         .sb_kern_mount =                selinux_sb_kern_mount,
4503         .sb_statfs =                    selinux_sb_statfs,
4504         .sb_mount =                     selinux_mount,
4505         .sb_umount =                    selinux_umount,
4506
4507         .inode_alloc_security =         selinux_inode_alloc_security,
4508         .inode_free_security =          selinux_inode_free_security,
4509         .inode_init_security =          selinux_inode_init_security,
4510         .inode_create =                 selinux_inode_create,
4511         .inode_link =                   selinux_inode_link,
4512         .inode_unlink =                 selinux_inode_unlink,
4513         .inode_symlink =                selinux_inode_symlink,
4514         .inode_mkdir =                  selinux_inode_mkdir,
4515         .inode_rmdir =                  selinux_inode_rmdir,
4516         .inode_mknod =                  selinux_inode_mknod,
4517         .inode_rename =                 selinux_inode_rename,
4518         .inode_readlink =               selinux_inode_readlink,
4519         .inode_follow_link =            selinux_inode_follow_link,
4520         .inode_permission =             selinux_inode_permission,
4521         .inode_setattr =                selinux_inode_setattr,
4522         .inode_getattr =                selinux_inode_getattr,
4523         .inode_setxattr =               selinux_inode_setxattr,
4524         .inode_post_setxattr =          selinux_inode_post_setxattr,
4525         .inode_getxattr =               selinux_inode_getxattr,
4526         .inode_listxattr =              selinux_inode_listxattr,
4527         .inode_removexattr =            selinux_inode_removexattr,
4528         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4529         .inode_getsecurity =            selinux_inode_getsecurity,
4530         .inode_setsecurity =            selinux_inode_setsecurity,
4531         .inode_listsecurity =           selinux_inode_listsecurity,
4532
4533         .file_permission =              selinux_file_permission,
4534         .file_alloc_security =          selinux_file_alloc_security,
4535         .file_free_security =           selinux_file_free_security,
4536         .file_ioctl =                   selinux_file_ioctl,
4537         .file_mmap =                    selinux_file_mmap,
4538         .file_mprotect =                selinux_file_mprotect,
4539         .file_lock =                    selinux_file_lock,
4540         .file_fcntl =                   selinux_file_fcntl,
4541         .file_set_fowner =              selinux_file_set_fowner,
4542         .file_send_sigiotask =          selinux_file_send_sigiotask,
4543         .file_receive =                 selinux_file_receive,
4544
4545         .task_create =                  selinux_task_create,
4546         .task_alloc_security =          selinux_task_alloc_security,
4547         .task_free_security =           selinux_task_free_security,
4548         .task_setuid =                  selinux_task_setuid,
4549         .task_post_setuid =             selinux_task_post_setuid,
4550         .task_setgid =                  selinux_task_setgid,
4551         .task_setpgid =                 selinux_task_setpgid,
4552         .task_getpgid =                 selinux_task_getpgid,
4553         .task_getsid =                  selinux_task_getsid,
4554         .task_getsecid =                selinux_task_getsecid,
4555         .task_setgroups =               selinux_task_setgroups,
4556         .task_setnice =                 selinux_task_setnice,
4557         .task_setioprio =               selinux_task_setioprio,
4558         .task_getioprio =               selinux_task_getioprio,
4559         .task_setrlimit =               selinux_task_setrlimit,
4560         .task_setscheduler =            selinux_task_setscheduler,
4561         .task_getscheduler =            selinux_task_getscheduler,
4562         .task_movememory =              selinux_task_movememory,
4563         .task_kill =                    selinux_task_kill,
4564         .task_wait =                    selinux_task_wait,
4565         .task_prctl =                   selinux_task_prctl,
4566         .task_reparent_to_init =        selinux_task_reparent_to_init,
4567         .task_to_inode =                selinux_task_to_inode,
4568
4569         .ipc_permission =               selinux_ipc_permission,
4570
4571         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4572         .msg_msg_free_security =        selinux_msg_msg_free_security,
4573
4574         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4575         .msg_queue_free_security =      selinux_msg_queue_free_security,
4576         .msg_queue_associate =          selinux_msg_queue_associate,
4577         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4578         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4579         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4580
4581         .shm_alloc_security =           selinux_shm_alloc_security,
4582         .shm_free_security =            selinux_shm_free_security,
4583         .shm_associate =                selinux_shm_associate,
4584         .shm_shmctl =                   selinux_shm_shmctl,
4585         .shm_shmat =                    selinux_shm_shmat,
4586
4587         .sem_alloc_security =           selinux_sem_alloc_security,
4588         .sem_free_security =            selinux_sem_free_security,
4589         .sem_associate =                selinux_sem_associate,
4590         .sem_semctl =                   selinux_sem_semctl,
4591         .sem_semop =                    selinux_sem_semop,
4592
4593         .register_security =            selinux_register_security,
4594         .unregister_security =          selinux_unregister_security,
4595
4596         .d_instantiate =                selinux_d_instantiate,
4597
4598         .getprocattr =                  selinux_getprocattr,
4599         .setprocattr =                  selinux_setprocattr,
4600
4601         .secid_to_secctx =              selinux_secid_to_secctx,
4602         .release_secctx =               selinux_release_secctx,
4603
4604         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4605         .unix_may_send =                selinux_socket_unix_may_send,
4606
4607         .socket_create =                selinux_socket_create,
4608         .socket_post_create =           selinux_socket_post_create,
4609         .socket_bind =                  selinux_socket_bind,
4610         .socket_connect =               selinux_socket_connect,
4611         .socket_listen =                selinux_socket_listen,
4612         .socket_accept =                selinux_socket_accept,
4613         .socket_sendmsg =               selinux_socket_sendmsg,
4614         .socket_recvmsg =               selinux_socket_recvmsg,
4615         .socket_getsockname =           selinux_socket_getsockname,
4616         .socket_getpeername =           selinux_socket_getpeername,
4617         .socket_getsockopt =            selinux_socket_getsockopt,
4618         .socket_setsockopt =            selinux_socket_setsockopt,
4619         .socket_shutdown =              selinux_socket_shutdown,
4620         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4621         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4622         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4623         .sk_alloc_security =            selinux_sk_alloc_security,
4624         .sk_free_security =             selinux_sk_free_security,
4625         .sk_getsid =                    selinux_sk_getsid_security,
4626
4627 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4628         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4629         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4630         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4631         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4632         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4633         .xfrm_state_free_security =     selinux_xfrm_state_free,
4634         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4635         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4636 #endif
4637
4638 #ifdef CONFIG_KEYS
4639         .key_alloc =                    selinux_key_alloc,
4640         .key_free =                     selinux_key_free,
4641         .key_permission =               selinux_key_permission,
4642 #endif
4643 };
4644
4645 static __init int selinux_init(void)
4646 {
4647         struct task_security_struct *tsec;
4648
4649         if (!selinux_enabled) {
4650                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4651                 return 0;
4652         }
4653
4654         printk(KERN_INFO "SELinux:  Initializing.\n");
4655
4656         /* Set the security state for the initial task. */
4657         if (task_alloc_security(current))
4658                 panic("SELinux:  Failed to initialize initial task.\n");
4659         tsec = current->security;
4660         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4661
4662         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4663                                             sizeof(struct inode_security_struct),
4664                                             0, SLAB_PANIC, NULL, NULL);
4665         avc_init();
4666
4667         original_ops = secondary_ops = security_ops;
4668         if (!secondary_ops)
4669                 panic ("SELinux: No initial security operations\n");
4670         if (register_security (&selinux_ops))
4671                 panic("SELinux: Unable to register with kernel.\n");
4672
4673         if (selinux_enforcing) {
4674                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4675         } else {
4676                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4677         }
4678
4679 #ifdef CONFIG_KEYS
4680         /* Add security information to initial keyrings */
4681         selinux_key_alloc(&root_user_keyring, current,
4682                           KEY_ALLOC_NOT_IN_QUOTA);
4683         selinux_key_alloc(&root_session_keyring, current,
4684                           KEY_ALLOC_NOT_IN_QUOTA);
4685 #endif
4686
4687         return 0;
4688 }
4689
4690 void selinux_complete_init(void)
4691 {
4692         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4693
4694         /* Set up any superblocks initialized prior to the policy load. */
4695         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4696         spin_lock(&sb_lock);
4697         spin_lock(&sb_security_lock);
4698 next_sb:
4699         if (!list_empty(&superblock_security_head)) {
4700                 struct superblock_security_struct *sbsec =
4701                                 list_entry(superblock_security_head.next,
4702                                            struct superblock_security_struct,
4703                                            list);
4704                 struct super_block *sb = sbsec->sb;
4705                 sb->s_count++;
4706                 spin_unlock(&sb_security_lock);
4707                 spin_unlock(&sb_lock);
4708                 down_read(&sb->s_umount);
4709                 if (sb->s_root)
4710                         superblock_doinit(sb, NULL);
4711                 drop_super(sb);
4712                 spin_lock(&sb_lock);
4713                 spin_lock(&sb_security_lock);
4714                 list_del_init(&sbsec->list);
4715                 goto next_sb;
4716         }
4717         spin_unlock(&sb_security_lock);
4718         spin_unlock(&sb_lock);
4719 }
4720
4721 /* SELinux requires early initialization in order to label
4722    all processes and objects when they are created. */
4723 security_initcall(selinux_init);
4724
4725 #if defined(CONFIG_NETFILTER)
4726
4727 static struct nf_hook_ops selinux_ipv4_op = {
4728         .hook =         selinux_ipv4_postroute_last,
4729         .owner =        THIS_MODULE,
4730         .pf =           PF_INET,
4731         .hooknum =      NF_IP_POST_ROUTING,
4732         .priority =     NF_IP_PRI_SELINUX_LAST,
4733 };
4734
4735 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4736
4737 static struct nf_hook_ops selinux_ipv6_op = {
4738         .hook =         selinux_ipv6_postroute_last,
4739         .owner =        THIS_MODULE,
4740         .pf =           PF_INET6,
4741         .hooknum =      NF_IP6_POST_ROUTING,
4742         .priority =     NF_IP6_PRI_SELINUX_LAST,
4743 };
4744
4745 #endif  /* IPV6 */
4746
4747 static int __init selinux_nf_ip_init(void)
4748 {
4749         int err = 0;
4750
4751         if (!selinux_enabled)
4752                 goto out;
4753
4754         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4755
4756         err = nf_register_hook(&selinux_ipv4_op);
4757         if (err)
4758                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4759
4760 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4761
4762         err = nf_register_hook(&selinux_ipv6_op);
4763         if (err)
4764                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4765
4766 #endif  /* IPV6 */
4767
4768 out:
4769         return err;
4770 }
4771
4772 __initcall(selinux_nf_ip_init);
4773
4774 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4775 static void selinux_nf_ip_exit(void)
4776 {
4777         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4778
4779         nf_unregister_hook(&selinux_ipv4_op);
4780 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4781         nf_unregister_hook(&selinux_ipv6_op);
4782 #endif  /* IPV6 */
4783 }
4784 #endif
4785
4786 #else /* CONFIG_NETFILTER */
4787
4788 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4789 #define selinux_nf_ip_exit()
4790 #endif
4791
4792 #endif /* CONFIG_NETFILTER */
4793
4794 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4795 int selinux_disable(void)
4796 {
4797         extern void exit_sel_fs(void);
4798         static int selinux_disabled = 0;
4799
4800         if (ss_initialized) {
4801                 /* Not permitted after initial policy load. */
4802                 return -EINVAL;
4803         }
4804
4805         if (selinux_disabled) {
4806                 /* Only do this once. */
4807                 return -EINVAL;
4808         }
4809
4810         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4811
4812         selinux_disabled = 1;
4813         selinux_enabled = 0;
4814
4815         /* Reset security_ops to the secondary module, dummy or capability. */
4816         security_ops = secondary_ops;
4817
4818         /* Unregister netfilter hooks. */
4819         selinux_nf_ip_exit();
4820
4821         /* Unregister selinuxfs. */
4822         exit_sel_fs();
4823
4824         return 0;
4825 }
4826 #endif
4827
4828