security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *
  14  *      This program is free software; you can redistribute it and/or modify
  15  *      it under the terms of the GNU General Public License version 2,
  16  *      as published by the Free Software Foundation.
  17  */
  18
  19 #include <linux/config.h>
  20 #include <linux/module.h>
  21 #include <linux/init.h>
  22 #include <linux/kernel.h>
  23 #include <linux/ptrace.h>
  24 #include <linux/errno.h>
  25 #include <linux/sched.h>
  26 #include <linux/security.h>
  27 #include <linux/xattr.h>
  28 #include <linux/capability.h>
  29 #include <linux/unistd.h>
  30 #include <linux/mm.h>
  31 #include <linux/mman.h>
  32 #include <linux/slab.h>
  33 #include <linux/pagemap.h>
  34 #include <linux/swap.h>
  35 #include <linux/smp_lock.h>
  36 #include <linux/spinlock.h>
  37 #include <linux/syscalls.h>
  38 #include <linux/file.h>
  39 #include <linux/namei.h>
  40 #include <linux/mount.h>
  41 #include <linux/ext2_fs.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/kd.h>
  44 #include <linux/netfilter_ipv4.h>
  45 #include <linux/netfilter_ipv6.h>
  46 #include <linux/tty.h>
  47 #include <net/icmp.h>
  48 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  49 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  50 #include <asm/uaccess.h>
  51 #include <asm/semaphore.h>
  52 #include <asm/ioctls.h>
  53 #include <linux/bitops.h>
  54 #include <linux/interrupt.h>
  55 #include <linux/netdevice.h>    /* for network interface checks */
  56 #include <linux/netlink.h>
  57 #include <linux/tcp.h>
  58 #include <linux/udp.h>
  59 #include <linux/quota.h>
  60 #include <linux/un.h>           /* for Unix socket types */
  61 #include <net/af_unix.h>        /* for Unix socket types */
  62 #include <linux/parser.h>
  63 #include <linux/nfs_mount.h>
  64 #include <net/ipv6.h>
  65 #include <linux/hugetlb.h>
  66 #include <linux/personality.h>
  67
  68 #include "avc.h"
  69 #include "objsec.h"
  70 #include "netif.h"
  71
  72 #define XATTR_SELINUX_SUFFIX "selinux"
  73 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  74
  75 extern int policydb_loaded_version;
  76 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  77
  78 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  79 int selinux_enforcing = 0;
  80
  81 static int __init enforcing_setup(char *str)
  82 {
  83         selinux_enforcing = simple_strtol(str,NULL,0);
  84         return 1;
  85 }
  86 __setup("enforcing=", enforcing_setup);
  87 #endif
  88
  89 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  90 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  91
  92 static int __init selinux_enabled_setup(char *str)
  93 {
  94         selinux_enabled = simple_strtol(str, NULL, 0);
  95         return 1;
  96 }
  97 __setup("selinux=", selinux_enabled_setup);
  98 #endif
  99
 100 /* Original (dummy) security module. */
 101 static struct security_operations *original_ops = NULL;
 102
 103 /* Minimal support for a secondary security module,
 104    just to allow the use of the dummy or capability modules.
 105    The owlsm module can alternatively be used as a secondary
 106    module as long as CONFIG_OWLSM_FD is not enabled. */
 107 static struct security_operations *secondary_ops = NULL;
 108
 109 /* Lists of inode and superblock security structures initialized
 110    before the policy was loaded. */
 111 static LIST_HEAD(superblock_security_head);
 112 static spinlock_t sb_security_lock = SPIN_LOCK_UNLOCKED;
 113
 114 /* Allocate and free functions for each kind of security blob. */
 115
 116 static int task_alloc_security(struct task_struct *task)
 117 {
 118         struct task_security_struct *tsec;
 119
 120         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 121         if (!tsec)
 122                 return -ENOMEM;
 123
 124         memset(tsec, 0, sizeof(struct task_security_struct));
 125         tsec->magic = SELINUX_MAGIC;
 126         tsec->task = task;
 127         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 128         task->security = tsec;
 129
 130         return 0;
 131 }
 132
 133 static void task_free_security(struct task_struct *task)
 134 {
 135         struct task_security_struct *tsec = task->security;
 136
 137         if (!tsec || tsec->magic != SELINUX_MAGIC)
 138                 return;
 139
 140         task->security = NULL;
 141         kfree(tsec);
 142 }
 143
 144 static int inode_alloc_security(struct inode *inode)
 145 {
 146         struct task_security_struct *tsec = current->security;
 147         struct inode_security_struct *isec;
 148
 149         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 150         if (!isec)
 151                 return -ENOMEM;
 152
 153         memset(isec, 0, sizeof(struct inode_security_struct));
 154         init_MUTEX(&isec->sem);
 155         INIT_LIST_HEAD(&isec->list);
 156         isec->magic = SELINUX_MAGIC;
 157         isec->inode = inode;
 158         isec->sid = SECINITSID_UNLABELED;
 159         isec->sclass = SECCLASS_FILE;
 160         if (tsec && tsec->magic == SELINUX_MAGIC)
 161                 isec->task_sid = tsec->sid;
 162         else
 163                 isec->task_sid = SECINITSID_UNLABELED;
 164         inode->i_security = isec;
 165
 166         return 0;
 167 }
 168
 169 static void inode_free_security(struct inode *inode)
 170 {
 171         struct inode_security_struct *isec = inode->i_security;
 172         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 173
 174         if (!isec || isec->magic != SELINUX_MAGIC)
 175                 return;
 176
 177         spin_lock(&sbsec->isec_lock);
 178         if (!list_empty(&isec->list))
 179                 list_del_init(&isec->list);
 180         spin_unlock(&sbsec->isec_lock);
 181
 182         inode->i_security = NULL;
 183         kfree(isec);
 184 }
 185
 186 static int file_alloc_security(struct file *file)
 187 {
 188         struct task_security_struct *tsec = current->security;
 189         struct file_security_struct *fsec;
 190
 191         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 192         if (!fsec)
 193                 return -ENOMEM;
 194
 195         memset(fsec, 0, sizeof(struct file_security_struct));
 196         fsec->magic = SELINUX_MAGIC;
 197         fsec->file = file;
 198         if (tsec && tsec->magic == SELINUX_MAGIC) {
 199                 fsec->sid = tsec->sid;
 200                 fsec->fown_sid = tsec->sid;
 201         } else {
 202                 fsec->sid = SECINITSID_UNLABELED;
 203                 fsec->fown_sid = SECINITSID_UNLABELED;
 204         }
 205         file->f_security = fsec;
 206
 207         return 0;
 208 }
 209
 210 static void file_free_security(struct file *file)
 211 {
 212         struct file_security_struct *fsec = file->f_security;
 213
 214         if (!fsec || fsec->magic != SELINUX_MAGIC)
 215                 return;
 216
 217         file->f_security = NULL;
 218         kfree(fsec);
 219 }
 220
 221 static int superblock_alloc_security(struct super_block *sb)
 222 {
 223         struct superblock_security_struct *sbsec;
 224
 225         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 226         if (!sbsec)
 227                 return -ENOMEM;
 228
 229         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 230         init_MUTEX(&sbsec->sem);
 231         INIT_LIST_HEAD(&sbsec->list);
 232         INIT_LIST_HEAD(&sbsec->isec_head);
 233         spin_lock_init(&sbsec->isec_lock);
 234         sbsec->magic = SELINUX_MAGIC;
 235         sbsec->sb = sb;
 236         sbsec->sid = SECINITSID_UNLABELED;
 237         sbsec->def_sid = SECINITSID_FILE;
 238         sb->s_security = sbsec;
 239
 240         return 0;
 241 }
 242
 243 static void superblock_free_security(struct super_block *sb)
 244 {
 245         struct superblock_security_struct *sbsec = sb->s_security;
 246
 247         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 248                 return;
 249
 250         spin_lock(&sb_security_lock);
 251         if (!list_empty(&sbsec->list))
 252                 list_del_init(&sbsec->list);
 253         spin_unlock(&sb_security_lock);
 254
 255         sb->s_security = NULL;
 256         kfree(sbsec);
 257 }
 258
 259 #ifdef CONFIG_SECURITY_NETWORK
 260 static int sk_alloc_security(struct sock *sk, int family, int priority)
 261 {
 262         struct sk_security_struct *ssec;
 263
 264         if (family != PF_UNIX)
 265                 return 0;
 266
 267         ssec = kmalloc(sizeof(*ssec), priority);
 268         if (!ssec)
 269                 return -ENOMEM;
 270
 271         memset(ssec, 0, sizeof(*ssec));
 272         ssec->magic = SELINUX_MAGIC;
 273         ssec->sk = sk;
 274         ssec->peer_sid = SECINITSID_UNLABELED;
 275         sk->sk_security = ssec;
 276
 277         return 0;
 278 }
 279
 280 static void sk_free_security(struct sock *sk)
 281 {
 282         struct sk_security_struct *ssec = sk->sk_security;
 283
 284         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 285                 return;
 286
 287         sk->sk_security = NULL;
 288         kfree(ssec);
 289 }
 290 #endif  /* CONFIG_SECURITY_NETWORK */
 291
 292 /* The security server must be initialized before
 293    any labeling or access decisions can be provided. */
 294 extern int ss_initialized;
 295
 296 /* The file system's label must be initialized prior to use. */
 297
 298 static char *labeling_behaviors[6] = {
 299         "uses xattr",
 300         "uses transition SIDs",
 301         "uses task SIDs",
 302         "uses genfs_contexts",
 303         "not configured for labeling",
 304         "uses mountpoint labeling",
 305 };
 306
 307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 308
 309 static inline int inode_doinit(struct inode *inode)
 310 {
 311         return inode_doinit_with_dentry(inode, NULL);
 312 }
 313
 314 enum {
 315         Opt_context = 1,
 316         Opt_fscontext = 2,
 317         Opt_defcontext = 4,
 318 };
 319
 320 static match_table_t tokens = {
 321         {Opt_context, "context=%s"},
 322         {Opt_fscontext, "fscontext=%s"},
 323         {Opt_defcontext, "defcontext=%s"},
 324 };
 325
 326 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 327
 328 static int try_context_mount(struct super_block *sb, void *data)
 329 {
 330         char *context = NULL, *defcontext = NULL;
 331         const char *name;
 332         u32 sid;
 333         int alloc = 0, rc = 0, seen = 0;
 334         struct task_security_struct *tsec = current->security;
 335         struct superblock_security_struct *sbsec = sb->s_security;
 336
 337         if (!data)
 338                 goto out;
 339
 340         name = sb->s_type->name;
 341
 342         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 343
 344                 /* NFS we understand. */
 345                 if (!strcmp(name, "nfs")) {
 346                         struct nfs_mount_data *d = data;
 347
 348                         if (d->version <  NFS_MOUNT_VERSION)
 349                                 goto out;
 350
 351                         if (d->context[0]) {
 352                                 context = d->context;
 353                                 seen |= Opt_context;
 354                         }
 355                 } else
 356                         goto out;
 357
 358         } else {
 359                 /* Standard string-based options. */
 360                 char *p, *options = data;
 361
 362                 while ((p = strsep(&options, ",")) != NULL) {
 363                         int token;
 364                         substring_t args[MAX_OPT_ARGS];
 365
 366                         if (!*p)
 367                                 continue;
 368
 369                         token = match_token(p, tokens, args);
 370
 371                         switch (token) {
 372                         case Opt_context:
 373                                 if (seen) {
 374                                         rc = -EINVAL;
 375                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 376                                         goto out_free;
 377                                 }
 378                                 context = match_strdup(&args[0]);
 379                                 if (!context) {
 380                                         rc = -ENOMEM;
 381                                         goto out_free;
 382                                 }
 383                                 if (!alloc)
 384                                         alloc = 1;
 385                                 seen |= Opt_context;
 386                                 break;
 387
 388                         case Opt_fscontext:
 389                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 390                                         rc = -EINVAL;
 391                                         printk(KERN_WARNING "SELinux:  "
 392                                                "fscontext option is invalid for"
 393                                                " this filesystem type\n");
 394                                         goto out_free;
 395                                 }
 396                                 if (seen & (Opt_context|Opt_fscontext)) {
 397                                         rc = -EINVAL;
 398                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 399                                         goto out_free;
 400                                 }
 401                                 context = match_strdup(&args[0]);
 402                                 if (!context) {
 403                                         rc = -ENOMEM;
 404                                         goto out_free;
 405                                 }
 406                                 if (!alloc)
 407                                         alloc = 1;
 408                                 seen |= Opt_fscontext;
 409                                 break;
 410
 411                         case Opt_defcontext:
 412                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING "SELinux:  "
 415                                                "defcontext option is invalid "
 416                                                "for this filesystem type\n");
 417                                         goto out_free;
 418                                 }
 419                                 if (seen & (Opt_context|Opt_defcontext)) {
 420                                         rc = -EINVAL;
 421                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 422                                         goto out_free;
 423                                 }
 424                                 defcontext = match_strdup(&args[0]);
 425                                 if (!defcontext) {
 426                                         rc = -ENOMEM;
 427                                         goto out_free;
 428                                 }
 429                                 if (!alloc)
 430                                         alloc = 1;
 431                                 seen |= Opt_defcontext;
 432                                 break;
 433
 434                         default:
 435                                 rc = -EINVAL;
 436                                 printk(KERN_WARNING "SELinux:  unknown mount "
 437                                        "option\n");
 438                                 goto out_free;
 439
 440                         }
 441                 }
 442         }
 443
 444         if (!seen)
 445                 goto out;
 446
 447         if (context) {
 448                 rc = security_context_to_sid(context, strlen(context), &sid);
 449                 if (rc) {
 450                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 451                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 452                                context, sb->s_id, name, rc);
 453                         goto out_free;
 454                 }
 455
 456                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                                   FILESYSTEM__RELABELFROM, NULL, NULL);
 458                 if (rc)
 459                         goto out_free;
 460
 461                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                                   FILESYSTEM__RELABELTO, NULL, NULL);
 463                 if (rc)
 464                         goto out_free;
 465
 466                 sbsec->sid = sid;
 467
 468                 if (seen & Opt_context)
 469                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 470         }
 471
 472         if (defcontext) {
 473                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 474                 if (rc) {
 475                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 476                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 477                                defcontext, sb->s_id, name, rc);
 478                         goto out_free;
 479                 }
 480
 481                 if (sid == sbsec->def_sid)
 482                         goto out_free;
 483
 484                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 485                                   FILESYSTEM__RELABELFROM, NULL, NULL);
 486                 if (rc)
 487                         goto out_free;
 488
 489                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 490                                   FILESYSTEM__ASSOCIATE, NULL, NULL);
 491                 if (rc)
 492                         goto out_free;
 493
 494                 sbsec->def_sid = sid;
 495         }
 496
 497 out_free:
 498         if (alloc) {
 499                 kfree(context);
 500                 kfree(defcontext);
 501         }
 502 out:
 503         return rc;
 504 }
 505
 506 static int superblock_doinit(struct super_block *sb, void *data)
 507 {
 508         struct superblock_security_struct *sbsec = sb->s_security;
 509         struct dentry *root = sb->s_root;
 510         struct inode *inode = root->d_inode;
 511         int rc = 0;
 512
 513         down(&sbsec->sem);
 514         if (sbsec->initialized)
 515                 goto out;
 516
 517         if (!ss_initialized) {
 518                 /* Defer initialization until selinux_complete_init,
 519                    after the initial policy is loaded and the security
 520                    server is ready to handle calls. */
 521                 spin_lock(&sb_security_lock);
 522                 if (list_empty(&sbsec->list))
 523                         list_add(&sbsec->list, &superblock_security_head);
 524                 spin_unlock(&sb_security_lock);
 525                 goto out;
 526         }
 527
 528         /* Determine the labeling behavior to use for this filesystem type. */
 529         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 530         if (rc) {
 531                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 532                        __FUNCTION__, sb->s_type->name, rc);
 533                 goto out;
 534         }
 535
 536         rc = try_context_mount(sb, data);
 537         if (rc)
 538                 goto out;
 539
 540         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 541                 /* Make sure that the xattr handler exists and that no
 542                    error other than -ENODATA is returned by getxattr on
 543                    the root directory.  -ENODATA is ok, as this may be
 544                    the first boot of the SELinux kernel before we have
 545                    assigned xattr values to the filesystem. */
 546                 if (!inode->i_op->getxattr) {
 547                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 548                                "xattr support\n", sb->s_id, sb->s_type->name);
 549                         rc = -EOPNOTSUPP;
 550                         goto out;
 551                 }
 552                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 553                 if (rc < 0 && rc != -ENODATA) {
 554                         if (rc == -EOPNOTSUPP)
 555                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 556                                        "%s) has no security xattr handler\n",
 557                                        sb->s_id, sb->s_type->name);
 558                         else
 559                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 560                                        "%s) getxattr errno %d\n", sb->s_id,
 561                                        sb->s_type->name, -rc);
 562                         goto out;
 563                 }
 564         }
 565
 566         if (strcmp(sb->s_type->name, "proc") == 0)
 567                 sbsec->proc = 1;
 568
 569         sbsec->initialized = 1;
 570
 571         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 572                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 573                        sb->s_id, sb->s_type->name);
 574         }
 575         else {
 576                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 577                        sb->s_id, sb->s_type->name,
 578                        labeling_behaviors[sbsec->behavior-1]);
 579         }
 580
 581         /* Initialize the root inode. */
 582         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 583
 584         /* Initialize any other inodes associated with the superblock, e.g.
 585            inodes created prior to initial policy load or inodes created
 586            during get_sb by a pseudo filesystem that directly
 587            populates itself. */
 588         spin_lock(&sbsec->isec_lock);
 589 next_inode:
 590         if (!list_empty(&sbsec->isec_head)) {
 591                 struct inode_security_struct *isec =
 592                                 list_entry(sbsec->isec_head.next,
 593                                            struct inode_security_struct, list);
 594                 struct inode *inode = isec->inode;
 595                 spin_unlock(&sbsec->isec_lock);
 596                 inode = igrab(inode);
 597                 if (inode) {
 598                         inode_doinit(inode);
 599                         iput(inode);
 600                 }
 601                 spin_lock(&sbsec->isec_lock);
 602                 list_del_init(&isec->list);
 603                 goto next_inode;
 604         }
 605         spin_unlock(&sbsec->isec_lock);
 606 out:
 607         up(&sbsec->sem);
 608         return rc;
 609 }
 610
 611 static inline u16 inode_mode_to_security_class(umode_t mode)
 612 {
 613         switch (mode & S_IFMT) {
 614         case S_IFSOCK:
 615                 return SECCLASS_SOCK_FILE;
 616         case S_IFLNK:
 617                 return SECCLASS_LNK_FILE;
 618         case S_IFREG:
 619                 return SECCLASS_FILE;
 620         case S_IFBLK:
 621                 return SECCLASS_BLK_FILE;
 622         case S_IFDIR:
 623                 return SECCLASS_DIR;
 624         case S_IFCHR:
 625                 return SECCLASS_CHR_FILE;
 626         case S_IFIFO:
 627                 return SECCLASS_FIFO_FILE;
 628
 629         }
 630
 631         return SECCLASS_FILE;
 632 }
 633
 634 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 635 {
 636         switch (family) {
 637         case PF_UNIX:
 638                 switch (type) {
 639                 case SOCK_STREAM:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644         case PF_INET:
 645         case PF_INET6:
 646                 switch (type) {
 647                 case SOCK_STREAM:
 648                         return SECCLASS_TCP_SOCKET;
 649                 case SOCK_DGRAM:
 650                         return SECCLASS_UDP_SOCKET;
 651                 case SOCK_RAW:
 652                         return SECCLASS_RAWIP_SOCKET;
 653                 }
 654         case PF_NETLINK:
 655                 switch (protocol) {
 656                 case NETLINK_ROUTE:
 657                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 658                 case NETLINK_FIREWALL:
 659                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 660                 case NETLINK_TCPDIAG:
 661                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 662                 case NETLINK_NFLOG:
 663                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 664                 case NETLINK_XFRM:
 665                         return SECCLASS_NETLINK_XFRM_SOCKET;
 666                 case NETLINK_SELINUX:
 667                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 668                 case NETLINK_AUDIT:
 669                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 670                 case NETLINK_IP6_FW:
 671                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 672                 case NETLINK_DNRTMSG:
 673                         return SECCLASS_NETLINK_DNRT_SOCKET;
 674                 default:
 675                         return SECCLASS_NETLINK_SOCKET;
 676                 }
 677         case PF_PACKET:
 678                 return SECCLASS_PACKET_SOCKET;
 679         case PF_KEY:
 680                 return SECCLASS_KEY_SOCKET;
 681         }
 682
 683         return SECCLASS_SOCKET;
 684 }
 685
 686 #ifdef CONFIG_PROC_FS
 687 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 688                                 u16 tclass,
 689                                 u32 *sid)
 690 {
 691         int buflen, rc;
 692         char *buffer, *path, *end;
 693
 694         buffer = (char*)__get_free_page(GFP_KERNEL);
 695         if (!buffer)
 696                 return -ENOMEM;
 697
 698         buflen = PAGE_SIZE;
 699         end = buffer+buflen;
 700         *--end = '\0';
 701         buflen--;
 702         path = end-1;
 703         *path = '/';
 704         while (de && de != de->parent) {
 705                 buflen -= de->namelen + 1;
 706                 if (buflen < 0)
 707                         break;
 708                 end -= de->namelen;
 709                 memcpy(end, de->name, de->namelen);
 710                 *--end = '/';
 711                 path = end;
 712                 de = de->parent;
 713         }
 714         rc = security_genfs_sid("proc", path, tclass, sid);
 715         free_page((unsigned long)buffer);
 716         return rc;
 717 }
 718 #else
 719 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 720                                 u16 tclass,
 721                                 u32 *sid)
 722 {
 723         return -EINVAL;
 724 }
 725 #endif
 726
 727 /* The inode's security attributes must be initialized before first use. */
 728 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 729 {
 730         struct superblock_security_struct *sbsec = NULL;
 731         struct inode_security_struct *isec = inode->i_security;
 732         u32 sid;
 733         struct dentry *dentry;
 734 #define INITCONTEXTLEN 255
 735         char *context = NULL;
 736         unsigned len = 0;
 737         int rc = 0;
 738         int hold_sem = 0;
 739
 740         if (isec->initialized)
 741                 goto out;
 742
 743         down(&isec->sem);
 744         hold_sem = 1;
 745         if (isec->initialized)
 746                 goto out;
 747
 748         sbsec = inode->i_sb->s_security;
 749         if (!sbsec->initialized) {
 750                 /* Defer initialization until selinux_complete_init,
 751                    after the initial policy is loaded and the security
 752                    server is ready to handle calls. */
 753                 spin_lock(&sbsec->isec_lock);
 754                 if (list_empty(&isec->list))
 755                         list_add(&isec->list, &sbsec->isec_head);
 756                 spin_unlock(&sbsec->isec_lock);
 757                 goto out;
 758         }
 759
 760         switch (sbsec->behavior) {
 761         case SECURITY_FS_USE_XATTR:
 762                 if (!inode->i_op->getxattr) {
 763                         isec->sid = sbsec->def_sid;
 764                         break;
 765                 }
 766
 767                 /* Need a dentry, since the xattr API requires one.
 768                    Life would be simpler if we could just pass the inode. */
 769                 if (opt_dentry) {
 770                         /* Called from d_instantiate or d_splice_alias. */
 771                         dentry = dget(opt_dentry);
 772                 } else {
 773                         /* Called from selinux_complete_init, try to find a dentry. */
 774                         dentry = d_find_alias(inode);
 775                 }
 776                 if (!dentry) {
 777                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 778                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 779                                inode->i_ino);
 780                         goto out;
 781                 }
 782
 783                 len = INITCONTEXTLEN;
 784                 context = kmalloc(len, GFP_KERNEL);
 785                 if (!context) {
 786                         rc = -ENOMEM;
 787                         dput(dentry);
 788                         goto out;
 789                 }
 790                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 791                                            context, len);
 792                 if (rc == -ERANGE) {
 793                         /* Need a larger buffer.  Query for the right size. */
 794                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                                    NULL, 0);
 796                         if (rc < 0) {
 797                                 dput(dentry);
 798                                 goto out;
 799                         }
 800                         kfree(context);
 801                         len = rc;
 802                         context = kmalloc(len, GFP_KERNEL);
 803                         if (!context) {
 804                                 rc = -ENOMEM;
 805                                 dput(dentry);
 806                                 goto out;
 807                         }
 808                         rc = inode->i_op->getxattr(dentry,
 809                                                    XATTR_NAME_SELINUX,
 810                                                    context, len);
 811                 }
 812                 dput(dentry);
 813                 if (rc < 0) {
 814                         if (rc != -ENODATA) {
 815                                 printk(KERN_WARNING "%s:  getxattr returned "
 816                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 817                                        -rc, inode->i_sb->s_id, inode->i_ino);
 818                                 kfree(context);
 819                                 goto out;
 820                         }
 821                         /* Map ENODATA to the default file SID */
 822                         sid = sbsec->def_sid;
 823                         rc = 0;
 824                 } else {
 825                         rc = security_context_to_sid(context, rc, &sid);
 826                         if (rc) {
 827                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 828                                        "returned %d for dev=%s ino=%ld\n",
 829                                        __FUNCTION__, context, -rc,
 830                                        inode->i_sb->s_id, inode->i_ino);
 831                                 kfree(context);
 832                                 goto out;
 833                         }
 834                 }
 835                 kfree(context);
 836                 isec->sid = sid;
 837                 break;
 838         case SECURITY_FS_USE_TASK:
 839                 isec->sid = isec->task_sid;
 840                 break;
 841         case SECURITY_FS_USE_TRANS:
 842                 /* Default to the fs SID. */
 843                 isec->sid = sbsec->sid;
 844
 845                 /* Try to obtain a transition SID. */
 846                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 847                 rc = security_transition_sid(isec->task_sid,
 848                                              sbsec->sid,
 849                                              isec->sclass,
 850                                              &sid);
 851                 if (rc)
 852                         goto out;
 853                 isec->sid = sid;
 854                 break;
 855         default:
 856                 /* Default to the fs SID. */
 857                 isec->sid = sbsec->sid;
 858
 859                 if (sbsec->proc) {
 860                         struct proc_inode *proci = PROC_I(inode);
 861                         if (proci->pde) {
 862                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 863                                 rc = selinux_proc_get_sid(proci->pde,
 864                                                           isec->sclass,
 865                                                           &sid);
 866                                 if (rc)
 867                                         goto out;
 868                                 isec->sid = sid;
 869                         }
 870                 }
 871                 break;
 872         }
 873
 874         isec->initialized = 1;
 875
 876 out:
 877         if (inode->i_sock) {
 878                 struct socket *sock = SOCKET_I(inode);
 879                 if (sock->sk) {
 880                         isec->sclass = socket_type_to_security_class(sock->sk->sk_family,
 881                                                                      sock->sk->sk_type,
 882                                                                      sock->sk->sk_protocol);
 883                 } else {
 884                         isec->sclass = SECCLASS_SOCKET;
 885                 }
 886         } else {
 887                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 888         }
 889
 890         if (hold_sem)
 891                 up(&isec->sem);
 892         return rc;
 893 }
 894
 895 /* Convert a Linux signal to an access vector. */
 896 static inline u32 signal_to_av(int sig)
 897 {
 898         u32 perm = 0;
 899
 900         switch (sig) {
 901         case SIGCHLD:
 902                 /* Commonly granted from child to parent. */
 903                 perm = PROCESS__SIGCHLD;
 904                 break;
 905         case SIGKILL:
 906                 /* Cannot be caught or ignored */
 907                 perm = PROCESS__SIGKILL;
 908                 break;
 909         case SIGSTOP:
 910                 /* Cannot be caught or ignored */
 911                 perm = PROCESS__SIGSTOP;
 912                 break;
 913         default:
 914                 /* All other signals. */
 915                 perm = PROCESS__SIGNAL;
 916                 break;
 917         }
 918
 919         return perm;
 920 }
 921
 922 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 923    fork check, ptrace check, etc. */
 924 int task_has_perm(struct task_struct *tsk1,
 925                   struct task_struct *tsk2,
 926                   u32 perms)
 927 {
 928         struct task_security_struct *tsec1, *tsec2;
 929
 930         tsec1 = tsk1->security;
 931         tsec2 = tsk2->security;
 932         return avc_has_perm(tsec1->sid, tsec2->sid,
 933                             SECCLASS_PROCESS, perms, &tsec2->avcr, NULL);
 934 }
 935
 936 /* Check whether a task is allowed to use a capability. */
 937 int task_has_capability(struct task_struct *tsk,
 938                         int cap)
 939 {
 940         struct task_security_struct *tsec;
 941         struct avc_audit_data ad;
 942
 943         tsec = tsk->security;
 944
 945         AVC_AUDIT_DATA_INIT(&ad,CAP);
 946         ad.tsk = tsk;
 947         ad.u.cap = cap;
 948
 949         return avc_has_perm(tsec->sid, tsec->sid,
 950                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), NULL, &ad);
 951 }
 952
 953 /* Check whether a task is allowed to use a system operation. */
 954 int task_has_system(struct task_struct *tsk,
 955                     u32 perms)
 956 {
 957         struct task_security_struct *tsec;
 958
 959         tsec = tsk->security;
 960
 961         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 962                             SECCLASS_SYSTEM, perms, NULL, NULL);
 963 }
 964
 965 /* Check whether a task has a particular permission to an inode.
 966    The 'aeref' parameter is optional and allows other AVC
 967    entry references to be passed (e.g. the one in the struct file).
 968    The 'adp' parameter is optional and allows other audit
 969    data to be passed (e.g. the dentry). */
 970 int inode_has_perm(struct task_struct *tsk,
 971                    struct inode *inode,
 972                    u32 perms,
 973                    struct avc_entry_ref *aeref,
 974                    struct avc_audit_data *adp)
 975 {
 976         struct task_security_struct *tsec;
 977         struct inode_security_struct *isec;
 978         struct avc_audit_data ad;
 979
 980         tsec = tsk->security;
 981         isec = inode->i_security;
 982
 983         if (!adp) {
 984                 adp = &ad;
 985                 AVC_AUDIT_DATA_INIT(&ad, FS);
 986                 ad.u.fs.inode = inode;
 987         }
 988
 989         return avc_has_perm(tsec->sid, isec->sid, isec->sclass,
 990                             perms, aeref ? aeref : &isec->avcr, adp);
 991 }
 992
 993 /* Same as inode_has_perm, but pass explicit audit data containing
 994    the dentry to help the auditing code to more easily generate the
 995    pathname if needed. */
 996 static inline int dentry_has_perm(struct task_struct *tsk,
 997                                   struct vfsmount *mnt,
 998                                   struct dentry *dentry,
 999                                   u32 av)
1000 {
1001         struct inode *inode = dentry->d_inode;
1002         struct avc_audit_data ad;
1003         AVC_AUDIT_DATA_INIT(&ad,FS);
1004         ad.u.fs.mnt = mnt;
1005         ad.u.fs.dentry = dentry;
1006         return inode_has_perm(tsk, inode, av, NULL, &ad);
1007 }
1008
1009 /* Check whether a task can use an open file descriptor to
1010    access an inode in a given way.  Check access to the
1011    descriptor itself, and then use dentry_has_perm to
1012    check a particular permission to the file.
1013    Access to the descriptor is implicitly granted if it
1014    has the same SID as the process.  If av is zero, then
1015    access to the file is not checked, e.g. for cases
1016    where only the descriptor is affected like seek. */
1017 static inline int file_has_perm(struct task_struct *tsk,
1018                                 struct file *file,
1019                                 u32 av)
1020 {
1021         struct task_security_struct *tsec = tsk->security;
1022         struct file_security_struct *fsec = file->f_security;
1023         struct vfsmount *mnt = file->f_vfsmnt;
1024         struct dentry *dentry = file->f_dentry;
1025         struct inode *inode = dentry->d_inode;
1026         struct avc_audit_data ad;
1027         int rc;
1028
1029         AVC_AUDIT_DATA_INIT(&ad, FS);
1030         ad.u.fs.mnt = mnt;
1031         ad.u.fs.dentry = dentry;
1032
1033         if (tsec->sid != fsec->sid) {
1034                 rc = avc_has_perm(tsec->sid, fsec->sid,
1035                                   SECCLASS_FD,
1036                                   FD__USE,
1037                                   &fsec->avcr, &ad);
1038                 if (rc)
1039                         return rc;
1040         }
1041
1042         /* av is zero if only checking access to the descriptor. */
1043         if (av)
1044                 return inode_has_perm(tsk, inode, av, &fsec->inode_avcr, &ad);
1045
1046         return 0;
1047 }
1048
1049 /* Check whether a task can create a file. */
1050 static int may_create(struct inode *dir,
1051                       struct dentry *dentry,
1052                       u16 tclass)
1053 {
1054         struct task_security_struct *tsec;
1055         struct inode_security_struct *dsec;
1056         struct superblock_security_struct *sbsec;
1057         u32 newsid;
1058         struct avc_audit_data ad;
1059         int rc;
1060
1061         tsec = current->security;
1062         dsec = dir->i_security;
1063         sbsec = dir->i_sb->s_security;
1064
1065         AVC_AUDIT_DATA_INIT(&ad, FS);
1066         ad.u.fs.dentry = dentry;
1067
1068         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1069                           DIR__ADD_NAME | DIR__SEARCH,
1070                           &dsec->avcr, &ad);
1071         if (rc)
1072                 return rc;
1073
1074         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1075                 newsid = tsec->create_sid;
1076         } else {
1077                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1078                                              &newsid);
1079                 if (rc)
1080                         return rc;
1081         }
1082
1083         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, NULL, &ad);
1084         if (rc)
1085                 return rc;
1086
1087         return avc_has_perm(newsid, sbsec->sid,
1088                             SECCLASS_FILESYSTEM,
1089                             FILESYSTEM__ASSOCIATE, NULL, &ad);
1090 }
1091
1092 #define MAY_LINK   0
1093 #define MAY_UNLINK 1
1094 #define MAY_RMDIR  2
1095
1096 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1097 static int may_link(struct inode *dir,
1098                     struct dentry *dentry,
1099                     int kind)
1100
1101 {
1102         struct task_security_struct *tsec;
1103         struct inode_security_struct *dsec, *isec;
1104         struct avc_audit_data ad;
1105         u32 av;
1106         int rc;
1107
1108         tsec = current->security;
1109         dsec = dir->i_security;
1110         isec = dentry->d_inode->i_security;
1111
1112         AVC_AUDIT_DATA_INIT(&ad, FS);
1113         ad.u.fs.dentry = dentry;
1114
1115         av = DIR__SEARCH;
1116         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1117         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1118                           av, &dsec->avcr, &ad);
1119         if (rc)
1120                 return rc;
1121
1122         switch (kind) {
1123         case MAY_LINK:
1124                 av = FILE__LINK;
1125                 break;
1126         case MAY_UNLINK:
1127                 av = FILE__UNLINK;
1128                 break;
1129         case MAY_RMDIR:
1130                 av = DIR__RMDIR;
1131                 break;
1132         default:
1133                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1134                 return 0;
1135         }
1136
1137         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
1138                           av, &isec->avcr, &ad);
1139         return rc;
1140 }
1141
1142 static inline int may_rename(struct inode *old_dir,
1143                              struct dentry *old_dentry,
1144                              struct inode *new_dir,
1145                              struct dentry *new_dentry)
1146 {
1147         struct task_security_struct *tsec;
1148         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1149         struct avc_audit_data ad;
1150         u32 av;
1151         int old_is_dir, new_is_dir;
1152         int rc;
1153
1154         tsec = current->security;
1155         old_dsec = old_dir->i_security;
1156         old_isec = old_dentry->d_inode->i_security;
1157         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1158         new_dsec = new_dir->i_security;
1159
1160         AVC_AUDIT_DATA_INIT(&ad, FS);
1161
1162         ad.u.fs.dentry = old_dentry;
1163         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1164                           DIR__REMOVE_NAME | DIR__SEARCH,
1165                           &old_dsec->avcr, &ad);
1166         if (rc)
1167                 return rc;
1168         rc = avc_has_perm(tsec->sid, old_isec->sid,
1169                           old_isec->sclass,
1170                           FILE__RENAME,
1171                           &old_isec->avcr, &ad);
1172         if (rc)
1173                 return rc;
1174         if (old_is_dir && new_dir != old_dir) {
1175                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1176                                   old_isec->sclass,
1177                                   DIR__REPARENT,
1178                                   &old_isec->avcr, &ad);
1179                 if (rc)
1180                         return rc;
1181         }
1182
1183         ad.u.fs.dentry = new_dentry;
1184         av = DIR__ADD_NAME | DIR__SEARCH;
1185         if (new_dentry->d_inode)
1186                 av |= DIR__REMOVE_NAME;
1187         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR,
1188                           av,&new_dsec->avcr, &ad);
1189         if (rc)
1190                 return rc;
1191         if (new_dentry->d_inode) {
1192                 new_isec = new_dentry->d_inode->i_security;
1193                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1194                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1195                                   new_isec->sclass,
1196                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK),
1197                                   &new_isec->avcr, &ad);
1198                 if (rc)
1199                         return rc;
1200         }
1201
1202         return 0;
1203 }
1204
1205 /* Check whether a task can perform a filesystem operation. */
1206 int superblock_has_perm(struct task_struct *tsk,
1207                         struct super_block *sb,
1208                         u32 perms,
1209                         struct avc_audit_data *ad)
1210 {
1211         struct task_security_struct *tsec;
1212         struct superblock_security_struct *sbsec;
1213
1214         tsec = tsk->security;
1215         sbsec = sb->s_security;
1216         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1217                             perms, NULL, ad);
1218 }
1219
1220 /* Convert a Linux mode and permission mask to an access vector. */
1221 static inline u32 file_mask_to_av(int mode, int mask)
1222 {
1223         u32 av = 0;
1224
1225         if ((mode & S_IFMT) != S_IFDIR) {
1226                 if (mask & MAY_EXEC)
1227                         av |= FILE__EXECUTE;
1228                 if (mask & MAY_READ)
1229                         av |= FILE__READ;
1230
1231                 if (mask & MAY_APPEND)
1232                         av |= FILE__APPEND;
1233                 else if (mask & MAY_WRITE)
1234                         av |= FILE__WRITE;
1235
1236         } else {
1237                 if (mask & MAY_EXEC)
1238                         av |= DIR__SEARCH;
1239                 if (mask & MAY_WRITE)
1240                         av |= DIR__WRITE;
1241                 if (mask & MAY_READ)
1242                         av |= DIR__READ;
1243         }
1244
1245         return av;
1246 }
1247
1248 /* Convert a Linux file to an access vector. */
1249 static inline u32 file_to_av(struct file *file)
1250 {
1251         u32 av = 0;
1252
1253         if (file->f_mode & FMODE_READ)
1254                 av |= FILE__READ;
1255         if (file->f_mode & FMODE_WRITE) {
1256                 if (file->f_flags & O_APPEND)
1257                         av |= FILE__APPEND;
1258                 else
1259                         av |= FILE__WRITE;
1260         }
1261
1262         return av;
1263 }
1264
1265 /* Set an inode's SID to a specified value. */
1266 int inode_security_set_sid(struct inode *inode, u32 sid)
1267 {
1268         struct inode_security_struct *isec = inode->i_security;
1269         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1270
1271         if (!sbsec->initialized) {
1272                 /* Defer initialization to selinux_complete_init. */
1273                 return 0;
1274         }
1275
1276         down(&isec->sem);
1277         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1278         isec->sid = sid;
1279         isec->initialized = 1;
1280         up(&isec->sem);
1281         return 0;
1282 }
1283
1284 /* Set the security attributes on a newly created file. */
1285 static int post_create(struct inode *dir,
1286                        struct dentry *dentry)
1287 {
1288
1289         struct task_security_struct *tsec;
1290         struct inode *inode;
1291         struct inode_security_struct *dsec;
1292         struct superblock_security_struct *sbsec;
1293         u32 newsid;
1294         char *context;
1295         unsigned int len;
1296         int rc;
1297
1298         tsec = current->security;
1299         dsec = dir->i_security;
1300         sbsec = dir->i_sb->s_security;
1301
1302         inode = dentry->d_inode;
1303         if (!inode) {
1304                 /* Some file system types (e.g. NFS) may not instantiate
1305                    a dentry for all create operations (e.g. symlink),
1306                    so we have to check to see if the inode is non-NULL. */
1307                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1308                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1309                 return 0;
1310         }
1311
1312         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1313                 newsid = tsec->create_sid;
1314         } else {
1315                 rc = security_transition_sid(tsec->sid, dsec->sid,
1316                                              inode_mode_to_security_class(inode->i_mode),
1317                                              &newsid);
1318                 if (rc) {
1319                         printk(KERN_WARNING "post_create:  "
1320                                "security_transition_sid failed, rc=%d (dev=%s "
1321                                "ino=%ld)\n",
1322                                -rc, inode->i_sb->s_id, inode->i_ino);
1323                         return rc;
1324                 }
1325         }
1326
1327         rc = inode_security_set_sid(inode, newsid);
1328         if (rc) {
1329                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1330                        "failed, rc=%d (dev=%s ino=%ld)\n",
1331                        -rc, inode->i_sb->s_id, inode->i_ino);
1332                 return rc;
1333         }
1334
1335         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1336             inode->i_op->setxattr) {
1337                 /* Use extended attributes. */
1338                 rc = security_sid_to_context(newsid, &context, &len);
1339                 if (rc) {
1340                         printk(KERN_WARNING "post_create:  sid_to_context "
1341                                "failed, rc=%d (dev=%s ino=%ld)\n",
1342                                -rc, inode->i_sb->s_id, inode->i_ino);
1343                         return rc;
1344                 }
1345                 down(&inode->i_sem);
1346                 rc = inode->i_op->setxattr(dentry,
1347                                            XATTR_NAME_SELINUX,
1348                                            context, len, 0);
1349                 up(&inode->i_sem);
1350                 kfree(context);
1351                 if (rc < 0) {
1352                         printk(KERN_WARNING "post_create:  setxattr failed, "
1353                                "rc=%d (dev=%s ino=%ld)\n",
1354                                -rc, inode->i_sb->s_id, inode->i_ino);
1355                         return rc;
1356                 }
1357         }
1358
1359         return 0;
1360 }
1361
1362
1363 /* Hook functions begin here. */
1364
1365 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1366 {
1367         struct task_security_struct *psec = parent->security;
1368         struct task_security_struct *csec = child->security;
1369         int rc;
1370
1371         rc = secondary_ops->ptrace(parent,child);
1372         if (rc)
1373                 return rc;
1374
1375         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1376         /* Save the SID of the tracing process for later use in apply_creds. */
1377         if (!rc)
1378                 csec->ptrace_sid = psec->sid;
1379         return rc;
1380 }
1381
1382 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1383                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1384 {
1385         int error;
1386
1387         error = task_has_perm(current, target, PROCESS__GETCAP);
1388         if (error)
1389                 return error;
1390
1391         return secondary_ops->capget(target, effective, inheritable, permitted);
1392 }
1393
1394 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1395                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1396 {
1397         int error;
1398
1399         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1400         if (error)
1401                 return error;
1402
1403         return task_has_perm(current, target, PROCESS__SETCAP);
1404 }
1405
1406 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1407                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1408 {
1409         int error;
1410
1411         error = task_has_perm(current, target, PROCESS__SETCAP);
1412         if (error)
1413                 return;
1414
1415         secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420         int rc;
1421
1422         rc = secondary_ops->capable(tsk, cap);
1423         if (rc)
1424                 return rc;
1425
1426         return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl(ctl_table *table, int op)
1430 {
1431         int error = 0;
1432         u32 av;
1433         struct task_security_struct *tsec;
1434         u32 tsid;
1435         int rc;
1436
1437         rc = secondary_ops->sysctl(table, op);
1438         if (rc)
1439                 return rc;
1440
1441         tsec = current->security;
1442
1443         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1444                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1445         if (rc) {
1446                 /* Default to the well-defined sysctl SID. */
1447                 tsid = SECINITSID_SYSCTL;
1448         }
1449
1450         /* The op values are "defined" in sysctl.c, thereby creating
1451          * a bad coupling between this module and sysctl.c */
1452         if(op == 001) {
1453                 error = avc_has_perm(tsec->sid, tsid,
1454                                      SECCLASS_DIR, DIR__SEARCH, NULL, NULL);
1455         } else {
1456                 av = 0;
1457                 if (op & 004)
1458                         av |= FILE__READ;
1459                 if (op & 002)
1460                         av |= FILE__WRITE;
1461                 if (av)
1462                         error = avc_has_perm(tsec->sid, tsid,
1463                                              SECCLASS_FILE, av, NULL, NULL);
1464         }
1465
1466         return error;
1467 }
1468
1469 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1470 {
1471         int rc = 0;
1472
1473         if (!sb)
1474                 return 0;
1475
1476         switch (cmds) {
1477                 case Q_SYNC:
1478                 case Q_QUOTAON:
1479                 case Q_QUOTAOFF:
1480                 case Q_SETINFO:
1481                 case Q_SETQUOTA:
1482                         rc = superblock_has_perm(current,
1483                                                  sb,
1484                                                  FILESYSTEM__QUOTAMOD, NULL);
1485                         break;
1486                 case Q_GETFMT:
1487                 case Q_GETINFO:
1488                 case Q_GETQUOTA:
1489                         rc = superblock_has_perm(current,
1490                                                  sb,
1491                                                  FILESYSTEM__QUOTAGET, NULL);
1492                         break;
1493                 default:
1494                         rc = 0;  /* let the kernel handle invalid cmds */
1495                         break;
1496         }
1497         return rc;
1498 }
1499
1500 static int selinux_quota_on(struct file *f)
1501 {
1502         return file_has_perm(current, f, FILE__QUOTAON);
1503 }
1504
1505 static int selinux_syslog(int type)
1506 {
1507         int rc;
1508
1509         rc = secondary_ops->syslog(type);
1510         if (rc)
1511                 return rc;
1512
1513         switch (type) {
1514                 case 3:         /* Read last kernel messages */
1515                 case 10:        /* Return size of the log buffer */
1516                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1517                         break;
1518                 case 6:         /* Disable logging to console */
1519                 case 7:         /* Enable logging to console */
1520                 case 8:         /* Set level of messages printed to console */
1521                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1522                         break;
1523                 case 0:         /* Close log */
1524                 case 1:         /* Open log */
1525                 case 2:         /* Read from log */
1526                 case 4:         /* Read/clear last kernel messages */
1527                 case 5:         /* Clear ring buffer */
1528                 default:
1529                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1530                         break;
1531         }
1532         return rc;
1533 }
1534
1535 /*
1536  * Check that a process has enough memory to allocate a new virtual
1537  * mapping. 0 means there is enough memory for the allocation to
1538  * succeed and -ENOMEM implies there is not.
1539  *
1540  * We currently support three overcommit policies, which are set via the
1541  * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting
1542  *
1543  * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
1544  * Additional code 2002 Jul 20 by Robert Love.
1545  */
1546 static int selinux_vm_enough_memory(long pages)
1547 {
1548         unsigned long free, allowed;
1549         int rc;
1550         struct task_security_struct *tsec = current->security;
1551
1552         vm_acct_memory(pages);
1553
1554         /*
1555          * Sometimes we want to use more memory than we have
1556          */
1557         if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
1558                 return 0;
1559
1560         if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
1561                 free = get_page_cache_size();
1562                 free += nr_free_pages();
1563                 free += nr_swap_pages;
1564
1565                 /*
1566                  * Any slabs which are created with the
1567                  * SLAB_RECLAIM_ACCOUNT flag claim to have contents
1568                  * which are reclaimable, under pressure.  The dentry
1569                  * cache and most inode caches should fall into this
1570                  */
1571                 free += atomic_read(&slab_reclaim_pages);
1572
1573                 /*
1574                  * Leave the last 3% for privileged processes.
1575                  * Don't audit the check, as it is applied to all processes
1576                  * that allocate mappings.
1577                  */
1578                 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1579                 if (!rc) {
1580                         rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1581                                                   SECCLASS_CAPABILITY,
1582                                                   CAP_TO_MASK(CAP_SYS_ADMIN),
1583                                                   NULL, NULL);
1584                 }
1585                 if (rc)
1586                         free -= free / 32;
1587
1588                 if (free > pages)
1589                         return 0;
1590                 vm_unacct_memory(pages);
1591                 return -ENOMEM;
1592         }
1593
1594         allowed = (totalram_pages - hugetlb_total_pages())
1595                 * sysctl_overcommit_ratio / 100;
1596         allowed += total_swap_pages;
1597
1598         if (atomic_read(&vm_committed_space) < allowed)
1599                 return 0;
1600
1601         vm_unacct_memory(pages);
1602
1603         return -ENOMEM;
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610         struct bprm_security_struct *bsec;
1611
1612         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613         if (!bsec)
1614                 return -ENOMEM;
1615
1616         memset(bsec, 0, sizeof *bsec);
1617         bsec->magic = SELINUX_MAGIC;
1618         bsec->bprm = bprm;
1619         bsec->sid = SECINITSID_UNLABELED;
1620         bsec->set = 0;
1621
1622         bprm->security = bsec;
1623         return 0;
1624 }
1625
1626 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1627 {
1628         struct task_security_struct *tsec;
1629         struct inode *inode = bprm->file->f_dentry->d_inode;
1630         struct inode_security_struct *isec;
1631         struct bprm_security_struct *bsec;
1632         u32 newsid;
1633         struct avc_audit_data ad;
1634         int rc;
1635
1636         rc = secondary_ops->bprm_set_security(bprm);
1637         if (rc)
1638                 return rc;
1639
1640         bsec = bprm->security;
1641
1642         if (bsec->set)
1643                 return 0;
1644
1645         tsec = current->security;
1646         isec = inode->i_security;
1647
1648         /* Default to the current task SID. */
1649         bsec->sid = tsec->sid;
1650
1651         /* Reset create SID on execve. */
1652         tsec->create_sid = 0;
1653
1654         if (tsec->exec_sid) {
1655                 newsid = tsec->exec_sid;
1656                 /* Reset exec SID on execve. */
1657                 tsec->exec_sid = 0;
1658         } else {
1659                 /* Check for a default transition on this program. */
1660                 rc = security_transition_sid(tsec->sid, isec->sid,
1661                                              SECCLASS_PROCESS, &newsid);
1662                 if (rc)
1663                         return rc;
1664         }
1665
1666         AVC_AUDIT_DATA_INIT(&ad, FS);
1667         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1668         ad.u.fs.dentry = bprm->file->f_dentry;
1669
1670         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1671                 newsid = tsec->sid;
1672
1673         if (tsec->sid == newsid) {
1674                 rc = avc_has_perm(tsec->sid, isec->sid,
1675                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS,
1676                                   &isec->avcr, &ad);
1677                 if (rc)
1678                         return rc;
1679         } else {
1680                 /* Check permissions for the transition. */
1681                 rc = avc_has_perm(tsec->sid, newsid,
1682                                   SECCLASS_PROCESS, PROCESS__TRANSITION,
1683                                   NULL,
1684                                   &ad);
1685                 if (rc)
1686                         return rc;
1687
1688                 rc = avc_has_perm(newsid, isec->sid,
1689                                   SECCLASS_FILE, FILE__ENTRYPOINT,
1690                                   &isec->avcr, &ad);
1691                 if (rc)
1692                         return rc;
1693
1694                 /* Clear any possibly unsafe personality bits on exec: */
1695                 current->personality &= ~PER_CLEAR_ON_SETID;
1696
1697                 /* Set the security field to the new SID. */
1698                 bsec->sid = newsid;
1699         }
1700
1701         bsec->set = 1;
1702         return 0;
1703 }
1704
1705 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1706 {
1707         return secondary_ops->bprm_check_security(bprm);
1708 }
1709
1710
1711 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1712 {
1713         struct task_security_struct *tsec = current->security;
1714         int atsecure = 0;
1715
1716         if (tsec->osid != tsec->sid) {
1717                 /* Enable secure mode for SIDs transitions unless
1718                    the noatsecure permission is granted between
1719                    the two SIDs, i.e. ahp returns 0. */
1720                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1721                                          SECCLASS_PROCESS,
1722                                          PROCESS__NOATSECURE, NULL, NULL);
1723         }
1724
1725         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1726 }
1727
1728 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1729 {
1730         struct bprm_security_struct *bsec = bprm->security;
1731         bprm->security = NULL;
1732         kfree(bsec);
1733 }
1734
1735 extern struct vfsmount *selinuxfs_mount;
1736 extern struct dentry *selinux_null;
1737
1738 /* Derived from fs/exec.c:flush_old_files. */
1739 static inline void flush_unauthorized_files(struct files_struct * files)
1740 {
1741         struct avc_audit_data ad;
1742         struct file *file, *devnull = NULL;
1743         struct tty_struct *tty = current->signal->tty;
1744         long j = -1;
1745
1746         if (tty) {
1747                 file_list_lock();
1748                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1749                 if (file) {
1750                         /* Revalidate access to controlling tty.
1751                            Use inode_has_perm on the tty inode directly rather
1752                            than using file_has_perm, as this particular open
1753                            file may belong to another process and we are only
1754                            interested in the inode-based check here. */
1755                         struct inode *inode = file->f_dentry->d_inode;
1756                         if (inode_has_perm(current, inode,
1757                                            FILE__READ | FILE__WRITE,
1758                                            NULL, NULL)) {
1759                                 /* Reset controlling tty. */
1760                                 current->signal->tty = NULL;
1761                                 current->signal->tty_old_pgrp = 0;
1762                         }
1763                 }
1764                 file_list_unlock();
1765         }
1766
1767         /* Revalidate access to inherited open files. */
1768
1769         AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771         spin_lock(&files->file_lock);
1772         for (;;) {
1773                 unsigned long set, i;
1774                 int fd;
1775
1776                 j++;
1777                 i = j * __NFDBITS;
1778                 if (i >= files->max_fds || i >= files->max_fdset)
1779                         break;
1780                 set = files->open_fds->fds_bits[j];
1781                 if (!set)
1782                         continue;
1783                 spin_unlock(&files->file_lock);
1784                 for ( ; set ; i++,set >>= 1) {
1785                         if (set & 1) {
1786                                 file = fget(i);
1787                                 if (!file)
1788                                         continue;
1789                                 if (file_has_perm(current,
1790                                                   file,
1791                                                   file_to_av(file))) {
1792                                         sys_close(i);
1793                                         fd = get_unused_fd();
1794                                         if (fd != i) {
1795                                                 if (fd >= 0)
1796                                                         put_unused_fd(fd);
1797                                                 fput(file);
1798                                                 continue;
1799                                         }
1800                                         if (devnull) {
1801                                                 atomic_inc(&devnull->f_count);
1802                                         } else {
1803                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1804                                                 if (!devnull) {
1805                                                         put_unused_fd(fd);
1806                                                         fput(file);
1807                                                         continue;
1808                                                 }
1809                                         }
1810                                         fd_install(fd, devnull);
1811                                 }
1812                                 fput(file);
1813                         }
1814                 }
1815                 spin_lock(&files->file_lock);
1816
1817         }
1818         spin_unlock(&files->file_lock);
1819 }
1820
1821 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1822 {
1823         struct task_security_struct *tsec;
1824         struct bprm_security_struct *bsec;
1825         u32 sid;
1826         struct av_decision avd;
1827         struct itimerval itimer;
1828         struct rlimit *rlim, *initrlim;
1829         int rc, i;
1830
1831         secondary_ops->bprm_apply_creds(bprm, unsafe);
1832
1833         tsec = current->security;
1834
1835         bsec = bprm->security;
1836         sid = bsec->sid;
1837
1838         tsec->osid = tsec->sid;
1839         if (tsec->sid != sid) {
1840                 /* Check for shared state.  If not ok, leave SID
1841                    unchanged and kill. */
1842                 if (unsafe & LSM_UNSAFE_SHARE) {
1843                         rc = avc_has_perm_noaudit(tsec->sid, sid,
1844                                           SECCLASS_PROCESS, PROCESS__SHARE,
1845                                           NULL, &avd);
1846                         if (rc) {
1847                                 task_unlock(current);
1848                                 avc_audit(tsec->sid, sid, SECCLASS_PROCESS,
1849                                     PROCESS__SHARE, &avd, rc, NULL);
1850                                 force_sig_specific(SIGKILL, current);
1851                                 goto lock_out;
1852                         }
1853                 }
1854
1855                 /* Check for ptracing, and update the task SID if ok.
1856                    Otherwise, leave SID unchanged and kill. */
1857                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1858                         rc = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
1859                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1860                                           NULL, &avd);
1861                         if (!rc)
1862                                 tsec->sid = sid;
1863                         task_unlock(current);
1864                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
1865                                   PROCESS__PTRACE, &avd, rc, NULL);
1866                         if (rc) {
1867                                 force_sig_specific(SIGKILL, current);
1868                                 goto lock_out;
1869                         }
1870                 } else {
1871                         tsec->sid = sid;
1872                         task_unlock(current);
1873                 }
1874
1875                 /* Close files for which the new task SID is not authorized. */
1876                 flush_unauthorized_files(current->files);
1877
1878                 /* Check whether the new SID can inherit signal state
1879                    from the old SID.  If not, clear itimers to avoid
1880                    subsequent signal generation and flush and unblock
1881                    signals. This must occur _after_ the task SID has
1882                   been updated so that any kill done after the flush
1883                   will be checked against the new SID. */
1884                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1885                                   PROCESS__SIGINH, NULL, NULL);
1886                 if (rc) {
1887                         memset(&itimer, 0, sizeof itimer);
1888                         for (i = 0; i < 3; i++)
1889                                 do_setitimer(i, &itimer, NULL);
1890                         flush_signals(current);
1891                         spin_lock_irq(&current->sighand->siglock);
1892                         flush_signal_handlers(current, 1);
1893                         sigemptyset(&current->blocked);
1894                         recalc_sigpending();
1895                         spin_unlock_irq(&current->sighand->siglock);
1896                 }
1897
1898                 /* Check whether the new SID can inherit resource limits
1899                    from the old SID.  If not, reset all soft limits to
1900                    the lower of the current task's hard limit and the init
1901                    task's soft limit.  Note that the setting of hard limits
1902                    (even to lower them) can be controlled by the setrlimit
1903                    check. The inclusion of the init task's soft limit into
1904                    the computation is to avoid resetting soft limits higher
1905                    than the default soft limit for cases where the default
1906                    is lower than the hard limit, e.g. RLIMIT_CORE or
1907                    RLIMIT_STACK.*/
1908                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1909                                   PROCESS__RLIMITINH, NULL, NULL);
1910                 if (rc) {
1911                         for (i = 0; i < RLIM_NLIMITS; i++) {
1912                                 rlim = current->rlim + i;
1913                                 initrlim = init_task.rlim+i;
1914                                 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1915                         }
1916                 }
1917
1918                 /* Wake up the parent if it is waiting so that it can
1919                    recheck wait permission to the new task SID. */
1920                 wake_up_interruptible(&current->parent->wait_chldexit);
1921
1922 lock_out:
1923                 task_lock(current);
1924                 return;
1925         }
1926 }
1927
1928 /* superblock security operations */
1929
1930 static int selinux_sb_alloc_security(struct super_block *sb)
1931 {
1932         return superblock_alloc_security(sb);
1933 }
1934
1935 static void selinux_sb_free_security(struct super_block *sb)
1936 {
1937         superblock_free_security(sb);
1938 }
1939
1940 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1941 {
1942         if (plen > olen)
1943                 return 0;
1944
1945         return !memcmp(prefix, option, plen);
1946 }
1947
1948 static inline int selinux_option(char *option, int len)
1949 {
1950         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1951                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1952                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1953 }
1954
1955 static inline void take_option(char **to, char *from, int *first, int len)
1956 {
1957         if (!*first) {
1958                 **to = ',';
1959                 *to += 1;
1960         }
1961         else
1962                 *first = 0;
1963         memcpy(*to, from, len);
1964         *to += len;
1965 }
1966
1967 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1968 {
1969         int fnosec, fsec, rc = 0;
1970         char *in_save, *in_curr, *in_end;
1971         char *sec_curr, *nosec_save, *nosec;
1972
1973         in_curr = orig;
1974         sec_curr = copy;
1975
1976         /* Binary mount data: just copy */
1977         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1978                 copy_page(sec_curr, in_curr);
1979                 goto out;
1980         }
1981
1982         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1983         if (!nosec) {
1984                 rc = -ENOMEM;
1985                 goto out;
1986         }
1987
1988         nosec_save = nosec;
1989         fnosec = fsec = 1;
1990         in_save = in_end = orig;
1991
1992         do {
1993                 if (*in_end == ',' || *in_end == '\0') {
1994                         int len = in_end - in_curr;
1995
1996                         if (selinux_option(in_curr, len))
1997                                 take_option(&sec_curr, in_curr, &fsec, len);
1998                         else
1999                                 take_option(&nosec, in_curr, &fnosec, len);
2000
2001                         in_curr = in_end + 1;
2002                 }
2003         } while (*in_end++);
2004
2005         copy_page(in_save, nosec_save);
2006 out:
2007         return rc;
2008 }
2009
2010 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2011 {
2012         struct avc_audit_data ad;
2013         int rc;
2014
2015         rc = superblock_doinit(sb, data);
2016         if (rc)
2017                 return rc;
2018
2019         AVC_AUDIT_DATA_INIT(&ad,FS);
2020         ad.u.fs.dentry = sb->s_root;
2021         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2022 }
2023
2024 static int selinux_sb_statfs(struct super_block *sb)
2025 {
2026         struct avc_audit_data ad;
2027
2028         AVC_AUDIT_DATA_INIT(&ad,FS);
2029         ad.u.fs.dentry = sb->s_root;
2030         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
2031 }
2032
2033 static int selinux_mount(char * dev_name,
2034                          struct nameidata *nd,
2035                          char * type,
2036                          unsigned long flags,
2037                          void * data)
2038 {
2039         int rc;
2040
2041         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2042         if (rc)
2043                 return rc;
2044
2045         if (flags & MS_REMOUNT)
2046                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2047                                            FILESYSTEM__REMOUNT, NULL);
2048         else
2049                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2050                                        FILE__MOUNTON);
2051 }
2052
2053 static int selinux_umount(struct vfsmount *mnt, int flags)
2054 {
2055         int rc;
2056
2057         rc = secondary_ops->sb_umount(mnt, flags);
2058         if (rc)
2059                 return rc;
2060
2061         return superblock_has_perm(current,mnt->mnt_sb,
2062                                    FILESYSTEM__UNMOUNT,NULL);
2063 }
2064
2065 /* inode security operations */
2066
2067 static int selinux_inode_alloc_security(struct inode *inode)
2068 {
2069         return inode_alloc_security(inode);
2070 }
2071
2072 static void selinux_inode_free_security(struct inode *inode)
2073 {
2074         inode_free_security(inode);
2075 }
2076
2077 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2078 {
2079         return may_create(dir, dentry, SECCLASS_FILE);
2080 }
2081
2082 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2083 {
2084         post_create(dir, dentry);
2085 }
2086
2087 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2088 {
2089         int rc;
2090
2091         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2092         if (rc)
2093                 return rc;
2094         return may_link(dir, old_dentry, MAY_LINK);
2095 }
2096
2097 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2098 {
2099         return;
2100 }
2101
2102 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2103 {
2104         int rc;
2105
2106         rc = secondary_ops->inode_unlink(dir, dentry);
2107         if (rc)
2108                 return rc;
2109         return may_link(dir, dentry, MAY_UNLINK);
2110 }
2111
2112 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2113 {
2114         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2115 }
2116
2117 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2118 {
2119         post_create(dir, dentry);
2120 }
2121
2122 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2123 {
2124         return may_create(dir, dentry, SECCLASS_DIR);
2125 }
2126
2127 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2128 {
2129         post_create(dir, dentry);
2130 }
2131
2132 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2133 {
2134         return may_link(dir, dentry, MAY_RMDIR);
2135 }
2136
2137 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2138 {
2139         int rc;
2140
2141         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2142         if (rc)
2143                 return rc;
2144
2145         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2146 }
2147
2148 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2149 {
2150         post_create(dir, dentry);
2151 }
2152
2153 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2154                                 struct inode *new_inode, struct dentry *new_dentry)
2155 {
2156         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2157 }
2158
2159 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2160                                       struct inode *new_inode, struct dentry *new_dentry)
2161 {
2162         return;
2163 }
2164
2165 static int selinux_inode_readlink(struct dentry *dentry)
2166 {
2167         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2168 }
2169
2170 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2171 {
2172         int rc;
2173
2174         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2175         if (rc)
2176                 return rc;
2177         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2178 }
2179
2180 static int selinux_inode_permission(struct inode *inode, int mask,
2181                                     struct nameidata *nd)
2182 {
2183         int rc;
2184
2185         rc = secondary_ops->inode_permission(inode, mask, nd);
2186         if (rc)
2187                 return rc;
2188
2189         if (!mask) {
2190                 /* No permission to check.  Existence test. */
2191                 return 0;
2192         }
2193
2194         return inode_has_perm(current, inode,
2195                                file_mask_to_av(inode->i_mode, mask), NULL, NULL);
2196 }
2197
2198 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2199 {
2200         int rc;
2201
2202         rc = secondary_ops->inode_setattr(dentry, iattr);
2203         if (rc)
2204                 return rc;
2205
2206         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2207                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2208                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2209
2210         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2211 }
2212
2213 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2214 {
2215         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2216 }
2217
2218 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2219 {
2220         struct task_security_struct *tsec = current->security;
2221         struct inode *inode = dentry->d_inode;
2222         struct inode_security_struct *isec = inode->i_security;
2223         struct superblock_security_struct *sbsec;
2224         struct avc_audit_data ad;
2225         u32 newsid;
2226         int rc = 0;
2227
2228         if (strcmp(name, XATTR_NAME_SELINUX)) {
2229                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2230                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2231                     !capable(CAP_SYS_ADMIN)) {
2232                         /* A different attribute in the security namespace.
2233                            Restrict to administrator. */
2234                         return -EPERM;
2235                 }
2236
2237                 /* Not an attribute we recognize, so just check the
2238                    ordinary setattr permission. */
2239                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2240         }
2241
2242         sbsec = inode->i_sb->s_security;
2243         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2244                 return -EOPNOTSUPP;
2245
2246         AVC_AUDIT_DATA_INIT(&ad,FS);
2247         ad.u.fs.dentry = dentry;
2248
2249         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2250                           FILE__RELABELFROM,
2251                           &isec->avcr, &ad);
2252         if (rc)
2253                 return rc;
2254
2255         rc = security_context_to_sid(value, size, &newsid);
2256         if (rc)
2257                 return rc;
2258
2259         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2260                           FILE__RELABELTO, NULL, &ad);
2261         if (rc)
2262                 return rc;
2263
2264         return avc_has_perm(newsid,
2265                             sbsec->sid,
2266                             SECCLASS_FILESYSTEM,
2267                             FILESYSTEM__ASSOCIATE,
2268                             NULL,
2269                             &ad);
2270 }
2271
2272 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2273                                         void *value, size_t size, int flags)
2274 {
2275         struct inode *inode = dentry->d_inode;
2276         struct inode_security_struct *isec = inode->i_security;
2277         u32 newsid;
2278         int rc;
2279
2280         if (strcmp(name, XATTR_NAME_SELINUX)) {
2281                 /* Not an attribute we recognize, so nothing to do. */
2282                 return;
2283         }
2284
2285         rc = security_context_to_sid(value, size, &newsid);
2286         if (rc) {
2287                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2288                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2289                 return;
2290         }
2291
2292         isec->sid = newsid;
2293         return;
2294 }
2295
2296 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2297 {
2298         struct inode *inode = dentry->d_inode;
2299         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2300
2301         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2302                 return -EOPNOTSUPP;
2303
2304         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2305 }
2306
2307 static int selinux_inode_listxattr (struct dentry *dentry)
2308 {
2309         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2310 }
2311
2312 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2313 {
2314         if (strcmp(name, XATTR_NAME_SELINUX)) {
2315                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2316                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2317                     !capable(CAP_SYS_ADMIN)) {
2318                         /* A different attribute in the security namespace.
2319                            Restrict to administrator. */
2320                         return -EPERM;
2321                 }
2322
2323                 /* Not an attribute we recognize, so just check the
2324                    ordinary setattr permission. Might want a separate
2325                    permission for removexattr. */
2326                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2327         }
2328
2329         /* No one is allowed to remove a SELinux security label.
2330            You can change the label, but all data must be labeled. */
2331         return -EACCES;
2332 }
2333
2334 static int selinux_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size)
2335 {
2336         struct inode *inode = dentry->d_inode;
2337         struct inode_security_struct *isec = inode->i_security;
2338         char *context;
2339         unsigned len;
2340         int rc;
2341
2342         /* Permission check handled by selinux_inode_getxattr hook.*/
2343
2344         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2345                 return -EOPNOTSUPP;
2346
2347         rc = security_sid_to_context(isec->sid, &context, &len);
2348         if (rc)
2349                 return rc;
2350
2351         if (!buffer || !size) {
2352                 kfree(context);
2353                 return len;
2354         }
2355         if (size < len) {
2356                 kfree(context);
2357                 return -ERANGE;
2358         }
2359         memcpy(buffer, context, len);
2360         kfree(context);
2361         return len;
2362 }
2363
2364 static int selinux_inode_setsecurity(struct dentry *dentry, const char *name,
2365                                      const void *value, size_t size, int flags)
2366 {
2367         struct inode *inode = dentry->d_inode;
2368         struct inode_security_struct *isec = inode->i_security;
2369         u32 newsid;
2370         int rc;
2371
2372         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2373                 return -EOPNOTSUPP;
2374
2375         if (!value || !size)
2376                 return -EACCES;
2377
2378         rc = security_context_to_sid((void*)value, size, &newsid);
2379         if (rc)
2380                 return rc;
2381
2382         isec->sid = newsid;
2383         return 0;
2384 }
2385
2386 static int selinux_inode_listsecurity(struct dentry *dentry, char *buffer)
2387 {
2388         const int len = sizeof(XATTR_NAME_SELINUX);
2389         if (buffer)
2390                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2391         return len;
2392 }
2393
2394 /* file security operations */
2395
2396 static int selinux_file_permission(struct file *file, int mask)
2397 {
2398         struct inode *inode = file->f_dentry->d_inode;
2399
2400         if (!mask) {
2401                 /* No permission to check.  Existence test. */
2402                 return 0;
2403         }
2404
2405         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2406         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2407                 mask |= MAY_APPEND;
2408
2409         return file_has_perm(current, file,
2410                              file_mask_to_av(inode->i_mode, mask));
2411 }
2412
2413 static int selinux_file_alloc_security(struct file *file)
2414 {
2415         return file_alloc_security(file);
2416 }
2417
2418 static void selinux_file_free_security(struct file *file)
2419 {
2420         file_free_security(file);
2421 }
2422
2423 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2424                               unsigned long arg)
2425 {
2426         int error = 0;
2427
2428         switch (cmd) {
2429                 case FIONREAD:
2430                 /* fall through */
2431                 case FIBMAP:
2432                 /* fall through */
2433                 case FIGETBSZ:
2434                 /* fall through */
2435                 case EXT2_IOC_GETFLAGS:
2436                 /* fall through */
2437                 case EXT2_IOC_GETVERSION:
2438                         error = file_has_perm(current, file, FILE__GETATTR);
2439                         break;
2440
2441                 case EXT2_IOC_SETFLAGS:
2442                 /* fall through */
2443                 case EXT2_IOC_SETVERSION:
2444                         error = file_has_perm(current, file, FILE__SETATTR);
2445                         break;
2446
2447                 /* sys_ioctl() checks */
2448                 case FIONBIO:
2449                 /* fall through */
2450                 case FIOASYNC:
2451                         error = file_has_perm(current, file, 0);
2452                         break;
2453
2454                 case KDSKBENT:
2455                 case KDSKBSENT:
2456                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2457                         break;
2458
2459                 /* default case assumes that the command will go
2460                  * to the file's ioctl() function.
2461                  */
2462                 default:
2463                         error = file_has_perm(current, file, FILE__IOCTL);
2464
2465         }
2466         return error;
2467 }
2468
2469 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2470 {
2471         if (file) {
2472                 /* read access is always possible with a mapping */
2473                 u32 av = FILE__READ;
2474
2475                 /* write access only matters if the mapping is shared */
2476                 if (shared && (prot & PROT_WRITE))
2477                         av |= FILE__WRITE;
2478
2479                 if (prot & PROT_EXEC)
2480                         av |= FILE__EXECUTE;
2481
2482                 return file_has_perm(current, file, av);
2483         }
2484         return 0;
2485 }
2486
2487 static int selinux_file_mmap(struct file *file, unsigned long prot, unsigned long flags)
2488 {
2489         int rc;
2490
2491         rc = secondary_ops->file_mmap(file, prot, flags);
2492         if (rc)
2493                 return rc;
2494
2495         return file_map_prot_check(file, prot,
2496                                    (flags & MAP_TYPE) == MAP_SHARED);
2497 }
2498
2499 static int selinux_file_mprotect(struct vm_area_struct *vma,
2500                                  unsigned long prot)
2501 {
2502         int rc;
2503
2504         rc = secondary_ops->file_mprotect(vma, prot);
2505         if (rc)
2506                 return rc;
2507
2508         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2509 }
2510
2511 static int selinux_file_lock(struct file *file, unsigned int cmd)
2512 {
2513         return file_has_perm(current, file, FILE__LOCK);
2514 }
2515
2516 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2517                               unsigned long arg)
2518 {
2519         int err = 0;
2520
2521         switch (cmd) {
2522                 case F_SETFL:
2523                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2524                                 err = -EINVAL;
2525                                 break;
2526                         }
2527
2528                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2529                                 err = file_has_perm(current, file,FILE__WRITE);
2530                                 break;
2531                         }
2532                         /* fall through */
2533                 case F_SETOWN:
2534                 case F_SETSIG:
2535                 case F_GETFL:
2536                 case F_GETOWN:
2537                 case F_GETSIG:
2538                         /* Just check FD__USE permission */
2539                         err = file_has_perm(current, file, 0);
2540                         break;
2541                 case F_GETLK:
2542                 case F_SETLK:
2543                 case F_SETLKW:
2544 #if BITS_PER_LONG == 32
2545                 case F_GETLK64:
2546                 case F_SETLK64:
2547                 case F_SETLKW64:
2548 #endif
2549                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2550                                 err = -EINVAL;
2551                                 break;
2552                         }
2553                         err = file_has_perm(current, file, FILE__LOCK);
2554                         break;
2555         }
2556
2557         return err;
2558 }
2559
2560 static int selinux_file_set_fowner(struct file *file)
2561 {
2562         struct task_security_struct *tsec;
2563         struct file_security_struct *fsec;
2564
2565         tsec = current->security;
2566         fsec = file->f_security;
2567         fsec->fown_sid = tsec->sid;
2568
2569         return 0;
2570 }
2571
2572 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2573                                        struct fown_struct *fown,
2574                                        int fd, int reason)
2575 {
2576         struct file *file;
2577         u32 perm;
2578         struct task_security_struct *tsec;
2579         struct file_security_struct *fsec;
2580
2581         /* struct fown_struct is never outside the context of a struct file */
2582         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2583
2584         tsec = tsk->security;
2585         fsec = file->f_security;
2586
2587         if (!fown->signum)
2588                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2589         else
2590                 perm = signal_to_av(fown->signum);
2591
2592         return avc_has_perm(fsec->fown_sid, tsec->sid,
2593                             SECCLASS_PROCESS, perm, NULL, NULL);
2594 }
2595
2596 static int selinux_file_receive(struct file *file)
2597 {
2598         return file_has_perm(current, file, file_to_av(file));
2599 }
2600
2601 /* task security operations */
2602
2603 static int selinux_task_create(unsigned long clone_flags)
2604 {
2605         int rc;
2606
2607         rc = secondary_ops->task_create(clone_flags);
2608         if (rc)
2609                 return rc;
2610
2611         return task_has_perm(current, current, PROCESS__FORK);
2612 }
2613
2614 static int selinux_task_alloc_security(struct task_struct *tsk)
2615 {
2616         struct task_security_struct *tsec1, *tsec2;
2617         int rc;
2618
2619         tsec1 = current->security;
2620
2621         rc = task_alloc_security(tsk);
2622         if (rc)
2623                 return rc;
2624         tsec2 = tsk->security;
2625
2626         tsec2->osid = tsec1->osid;
2627         tsec2->sid = tsec1->sid;
2628
2629         /* Retain the exec and create SIDs across fork */
2630         tsec2->exec_sid = tsec1->exec_sid;
2631         tsec2->create_sid = tsec1->create_sid;
2632
2633         /* Retain ptracer SID across fork, if any.
2634            This will be reset by the ptrace hook upon any
2635            subsequent ptrace_attach operations. */
2636         tsec2->ptrace_sid = tsec1->ptrace_sid;
2637
2638         return 0;
2639 }
2640
2641 static void selinux_task_free_security(struct task_struct *tsk)
2642 {
2643         task_free_security(tsk);
2644 }
2645
2646 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2647 {
2648         /* Since setuid only affects the current process, and
2649            since the SELinux controls are not based on the Linux
2650            identity attributes, SELinux does not need to control
2651            this operation.  However, SELinux does control the use
2652            of the CAP_SETUID and CAP_SETGID capabilities using the
2653            capable hook. */
2654         return 0;
2655 }
2656
2657 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2658 {
2659         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2660 }
2661
2662 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2663 {
2664         /* See the comment for setuid above. */
2665         return 0;
2666 }
2667
2668 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2669 {
2670         return task_has_perm(current, p, PROCESS__SETPGID);
2671 }
2672
2673 static int selinux_task_getpgid(struct task_struct *p)
2674 {
2675         return task_has_perm(current, p, PROCESS__GETPGID);
2676 }
2677
2678 static int selinux_task_getsid(struct task_struct *p)
2679 {
2680         return task_has_perm(current, p, PROCESS__GETSESSION);
2681 }
2682
2683 static int selinux_task_setgroups(struct group_info *group_info)
2684 {
2685         /* See the comment for setuid above. */
2686         return 0;
2687 }
2688
2689 static int selinux_task_setnice(struct task_struct *p, int nice)
2690 {
2691         int rc;
2692
2693         rc = secondary_ops->task_setnice(p, nice);
2694         if (rc)
2695                 return rc;
2696
2697         return task_has_perm(current,p, PROCESS__SETSCHED);
2698 }
2699
2700 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2701 {
2702         struct rlimit *old_rlim = current->rlim + resource;
2703         int rc;
2704
2705         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2706         if (rc)
2707                 return rc;
2708
2709         /* Control the ability to change the hard limit (whether
2710            lowering or raising it), so that the hard limit can
2711            later be used as a safe reset point for the soft limit
2712            upon context transitions. See selinux_bprm_apply_creds. */
2713         if (old_rlim->rlim_max != new_rlim->rlim_max)
2714                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2715
2716         return 0;
2717 }
2718
2719 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2720 {
2721         struct task_security_struct *tsec1, *tsec2;
2722
2723         tsec1 = current->security;
2724         tsec2 = p->security;
2725
2726         /* No auditing from the setscheduler hook, since the runqueue lock
2727            is held and the system will deadlock if we try to log an audit
2728            message. */
2729         return avc_has_perm_noaudit(tsec1->sid, tsec2->sid,
2730                                     SECCLASS_PROCESS, PROCESS__SETSCHED,
2731                                     &tsec2->avcr, NULL);
2732 }
2733
2734 static int selinux_task_getscheduler(struct task_struct *p)
2735 {
2736         return task_has_perm(current, p, PROCESS__GETSCHED);
2737 }
2738
2739 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2740 {
2741         u32 perm;
2742         int rc;
2743
2744         rc = secondary_ops->task_kill(p, info, sig);
2745         if (rc)
2746                 return rc;
2747
2748         if (info && ((unsigned long)info == 1 ||
2749                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2750                 return 0;
2751
2752         if (!sig)
2753                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2754         else
2755                 perm = signal_to_av(sig);
2756
2757         return task_has_perm(current, p, perm);
2758 }
2759
2760 static int selinux_task_prctl(int option,
2761                               unsigned long arg2,
2762                               unsigned long arg3,
2763                               unsigned long arg4,
2764                               unsigned long arg5)
2765 {
2766         /* The current prctl operations do not appear to require
2767            any SELinux controls since they merely observe or modify
2768            the state of the current process. */
2769         return 0;
2770 }
2771
2772 static int selinux_task_wait(struct task_struct *p)
2773 {
2774         u32 perm;
2775
2776         perm = signal_to_av(p->exit_signal);
2777
2778         return task_has_perm(p, current, perm);
2779 }
2780
2781 static void selinux_task_reparent_to_init(struct task_struct *p)
2782 {
2783         struct task_security_struct *tsec;
2784
2785         secondary_ops->task_reparent_to_init(p);
2786
2787         tsec = p->security;
2788         tsec->osid = tsec->sid;
2789         tsec->sid = SECINITSID_KERNEL;
2790         return;
2791 }
2792
2793 static void selinux_task_to_inode(struct task_struct *p,
2794                                   struct inode *inode)
2795 {
2796         struct task_security_struct *tsec = p->security;
2797         struct inode_security_struct *isec = inode->i_security;
2798
2799         isec->sid = tsec->sid;
2800         isec->initialized = 1;
2801         return;
2802 }
2803
2804 #ifdef CONFIG_SECURITY_NETWORK
2805
2806 /* Returns error only if unable to parse addresses */
2807 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2808 {
2809         int offset, ihlen, ret = -EINVAL;
2810         struct iphdr _iph, *ih;
2811
2812         offset = skb->nh.raw - skb->data;
2813         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2814         if (ih == NULL)
2815                 goto out;
2816
2817         ihlen = ih->ihl * 4;
2818         if (ihlen < sizeof(_iph))
2819                 goto out;
2820
2821         ad->u.net.v4info.saddr = ih->saddr;
2822         ad->u.net.v4info.daddr = ih->daddr;
2823         ret = 0;
2824
2825         switch (ih->protocol) {
2826         case IPPROTO_TCP: {
2827                 struct tcphdr _tcph, *th;
2828
2829                 if (ntohs(ih->frag_off) & IP_OFFSET)
2830                         break;
2831
2832                 offset += ihlen;
2833                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2834                 if (th == NULL)
2835                         break;
2836
2837                 ad->u.net.sport = th->source;
2838                 ad->u.net.dport = th->dest;
2839                 break;
2840         }
2841
2842         case IPPROTO_UDP: {
2843                 struct udphdr _udph, *uh;
2844
2845                 if (ntohs(ih->frag_off) & IP_OFFSET)
2846                         break;
2847
2848                 offset += ihlen;
2849                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2850                 if (uh == NULL)
2851                         break;
2852
2853                 ad->u.net.sport = uh->source;
2854                 ad->u.net.dport = uh->dest;
2855                 break;
2856         }
2857
2858         default:
2859                 break;
2860         }
2861 out:
2862         return ret;
2863 }
2864
2865 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2866
2867 /* Returns error only if unable to parse addresses */
2868 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2869 {
2870         u8 nexthdr;
2871         int ret = -EINVAL, offset;
2872         struct ipv6hdr _ipv6h, *ip6;
2873
2874         offset = skb->nh.raw - skb->data;
2875         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2876         if (ip6 == NULL)
2877                 goto out;
2878
2879         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2880         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2881         ret = 0;
2882
2883         nexthdr = ip6->nexthdr;
2884         offset += sizeof(_ipv6h);
2885         offset = ipv6_skip_exthdr(skb, offset, &nexthdr,
2886                                   skb->tail - skb->head - offset);
2887         if (offset < 0)
2888                 goto out;
2889
2890         switch (nexthdr) {
2891         case IPPROTO_TCP: {
2892                 struct tcphdr _tcph, *th;
2893
2894                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2895                 if (th == NULL)
2896                         break;
2897
2898                 ad->u.net.sport = th->source;
2899                 ad->u.net.dport = th->dest;
2900                 break;
2901         }
2902
2903         case IPPROTO_UDP: {
2904                 struct udphdr _udph, *uh;
2905
2906                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2907                 if (uh == NULL)
2908                         break;
2909
2910                 ad->u.net.sport = uh->source;
2911                 ad->u.net.dport = uh->dest;
2912                 break;
2913         }
2914
2915         /* includes fragments */
2916         default:
2917                 break;
2918         }
2919 out:
2920         return ret;
2921 }
2922
2923 #endif /* IPV6 */
2924
2925 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2926                              char **addrp, int *len, int src)
2927 {
2928         int ret = 0;
2929
2930         switch (ad->u.net.family) {
2931         case PF_INET:
2932                 ret = selinux_parse_skb_ipv4(skb, ad);
2933                 if (ret || !addrp)
2934                         break;
2935                 *len = 4;
2936                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2937                                         &ad->u.net.v4info.daddr);
2938                 break;
2939
2940 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2941         case PF_INET6:
2942                 ret = selinux_parse_skb_ipv6(skb, ad);
2943                 if (ret || !addrp)
2944                         break;
2945                 *len = 16;
2946                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2947                                         &ad->u.net.v6info.daddr);
2948                 break;
2949 #endif  /* IPV6 */
2950         default:
2951                 break;
2952         }
2953
2954         return ret;
2955 }
2956
2957 /* socket security operations */
2958 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2959                            u32 perms)
2960 {
2961         struct inode_security_struct *isec;
2962         struct task_security_struct *tsec;
2963         struct avc_audit_data ad;
2964         int err = 0;
2965
2966         tsec = task->security;
2967         isec = SOCK_INODE(sock)->i_security;
2968
2969         if (isec->sid == SECINITSID_KERNEL)
2970                 goto out;
2971
2972         AVC_AUDIT_DATA_INIT(&ad,NET);
2973         ad.u.net.sk = sock->sk;
2974         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2975                            perms, &isec->avcr, &ad);
2976
2977 out:
2978         return err;
2979 }
2980
2981 static int selinux_socket_create(int family, int type,
2982                                  int protocol, int kern)
2983 {
2984         int err = 0;
2985         struct task_security_struct *tsec;
2986
2987         if (kern)
2988                 goto out;
2989
2990         tsec = current->security;
2991         err = avc_has_perm(tsec->sid, tsec->sid,
2992                            socket_type_to_security_class(family, type,
2993                            protocol), SOCKET__CREATE, NULL, NULL);
2994
2995 out:
2996         return err;
2997 }
2998
2999 static void selinux_socket_post_create(struct socket *sock, int family,
3000                                        int type, int protocol, int kern)
3001 {
3002         int err;
3003         struct inode_security_struct *isec;
3004         struct task_security_struct *tsec;
3005
3006         err = inode_doinit(SOCK_INODE(sock));
3007         if (err < 0)
3008                 return;
3009         isec = SOCK_INODE(sock)->i_security;
3010
3011         tsec = current->security;
3012         isec->sclass = socket_type_to_security_class(family, type, protocol);
3013         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3014
3015         return;
3016 }
3017
3018 /* Range of port numbers used to automatically bind.
3019    Need to determine whether we should perform a name_bind
3020    permission check between the socket and the port number. */
3021 #define ip_local_port_range_0 sysctl_local_port_range[0]
3022 #define ip_local_port_range_1 sysctl_local_port_range[1]
3023
3024 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3025 {
3026         u16 family;
3027         int err;
3028
3029         err = socket_has_perm(current, sock, SOCKET__BIND);
3030         if (err)
3031                 goto out;
3032
3033         /*
3034          * If PF_INET or PF_INET6, check name_bind permission for the port.
3035          */
3036         family = sock->sk->sk_family;
3037         if (family == PF_INET || family == PF_INET6) {
3038                 char *addrp;
3039                 struct inode_security_struct *isec;
3040                 struct task_security_struct *tsec;
3041                 struct avc_audit_data ad;
3042                 struct sockaddr_in *addr4 = NULL;
3043                 struct sockaddr_in6 *addr6 = NULL;
3044                 unsigned short snum;
3045                 struct sock *sk = sock->sk;
3046                 u32 sid, node_perm, addrlen;
3047
3048                 tsec = current->security;
3049                 isec = SOCK_INODE(sock)->i_security;
3050
3051                 if (family == PF_INET) {
3052                         addr4 = (struct sockaddr_in *)address;
3053                         snum = ntohs(addr4->sin_port);
3054                         addrlen = sizeof(addr4->sin_addr.s_addr);
3055                         addrp = (char *)&addr4->sin_addr.s_addr;
3056                 } else {
3057                         addr6 = (struct sockaddr_in6 *)address;
3058                         snum = ntohs(addr6->sin6_port);
3059                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3060                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3061                 }
3062
3063                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3064                            snum > ip_local_port_range_1)) {
3065                         err = security_port_sid(sk->sk_family, sk->sk_type,
3066                                                 sk->sk_protocol, snum, &sid);
3067                         if (err)
3068                                 goto out;
3069                         AVC_AUDIT_DATA_INIT(&ad,NET);
3070                         ad.u.net.sport = htons(snum);
3071                         ad.u.net.family = family;
3072                         err = avc_has_perm(isec->sid, sid,
3073                                            isec->sclass,
3074                                            SOCKET__NAME_BIND, NULL, &ad);
3075                         if (err)
3076                                 goto out;
3077                 }
3078
3079                 switch(sk->sk_protocol) {
3080                 case IPPROTO_TCP:
3081                         node_perm = TCP_SOCKET__NODE_BIND;
3082                         break;
3083
3084                 case IPPROTO_UDP:
3085                         node_perm = UDP_SOCKET__NODE_BIND;
3086                         break;
3087
3088                 default:
3089                         node_perm = RAWIP_SOCKET__NODE_BIND;
3090                         break;
3091                 }
3092
3093                 err = security_node_sid(family, addrp, addrlen, &sid);
3094                 if (err)
3095                         goto out;
3096
3097                 AVC_AUDIT_DATA_INIT(&ad,NET);
3098                 ad.u.net.sport = htons(snum);
3099                 ad.u.net.family = family;
3100
3101                 if (family == PF_INET)
3102                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3103                 else
3104                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3105
3106                 err = avc_has_perm(isec->sid, sid,
3107                                    isec->sclass, node_perm, NULL, &ad);
3108                 if (err)
3109                         goto out;
3110         }
3111 out:
3112         return err;
3113 }
3114
3115 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3116 {
3117         return socket_has_perm(current, sock, SOCKET__CONNECT);
3118 }
3119
3120 static int selinux_socket_listen(struct socket *sock, int backlog)
3121 {
3122         return socket_has_perm(current, sock, SOCKET__LISTEN);
3123 }
3124
3125 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3126 {
3127         int err;
3128         struct inode_security_struct *isec;
3129         struct inode_security_struct *newisec;
3130
3131         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3132         if (err)
3133                 return err;
3134
3135         err = inode_doinit(SOCK_INODE(newsock));
3136         if (err < 0)
3137                 return err;
3138         newisec = SOCK_INODE(newsock)->i_security;
3139
3140         isec = SOCK_INODE(sock)->i_security;
3141         newisec->sclass = isec->sclass;
3142         newisec->sid = isec->sid;
3143
3144         return 0;
3145 }
3146
3147 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3148                                   int size)
3149 {
3150         return socket_has_perm(current, sock, SOCKET__WRITE);
3151 }
3152
3153 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3154                                   int size, int flags)
3155 {
3156         return socket_has_perm(current, sock, SOCKET__READ);
3157 }
3158
3159 static int selinux_socket_getsockname(struct socket *sock)
3160 {
3161         return socket_has_perm(current, sock, SOCKET__GETATTR);
3162 }
3163
3164 static int selinux_socket_getpeername(struct socket *sock)
3165 {
3166         return socket_has_perm(current, sock, SOCKET__GETATTR);
3167 }
3168
3169 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3170 {
3171         return socket_has_perm(current, sock, SOCKET__SETOPT);
3172 }
3173
3174 static int selinux_socket_getsockopt(struct socket *sock, int level,
3175                                      int optname)
3176 {
3177         return socket_has_perm(current, sock, SOCKET__GETOPT);
3178 }
3179
3180 static int selinux_socket_shutdown(struct socket *sock, int how)
3181 {
3182         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3183 }
3184
3185 static int selinux_socket_unix_stream_connect(struct socket *sock,
3186                                               struct socket *other,
3187                                               struct sock *newsk)
3188 {
3189         struct sk_security_struct *ssec;
3190         struct inode_security_struct *isec;
3191         struct inode_security_struct *other_isec;
3192         struct avc_audit_data ad;
3193         int err;
3194
3195         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3196         if (err)
3197                 return err;
3198
3199         isec = SOCK_INODE(sock)->i_security;
3200         other_isec = SOCK_INODE(other)->i_security;
3201
3202         AVC_AUDIT_DATA_INIT(&ad,NET);
3203         ad.u.net.sk = other->sk;
3204
3205         err = avc_has_perm(isec->sid, other_isec->sid,
3206                            isec->sclass,
3207                            UNIX_STREAM_SOCKET__CONNECTTO,
3208                            &other_isec->avcr, &ad);
3209         if (err)
3210                 return err;
3211
3212         /* connecting socket */
3213         ssec = sock->sk->sk_security;
3214         ssec->peer_sid = other_isec->sid;
3215
3216         /* server child socket */
3217         ssec = newsk->sk_security;
3218         ssec->peer_sid = isec->sid;
3219
3220         return 0;
3221 }
3222
3223 static int selinux_socket_unix_may_send(struct socket *sock,
3224                                         struct socket *other)
3225 {
3226         struct inode_security_struct *isec;
3227         struct inode_security_struct *other_isec;
3228         struct avc_audit_data ad;
3229         int err;
3230
3231         isec = SOCK_INODE(sock)->i_security;
3232         other_isec = SOCK_INODE(other)->i_security;
3233
3234         AVC_AUDIT_DATA_INIT(&ad,NET);
3235         ad.u.net.sk = other->sk;
3236
3237         err = avc_has_perm(isec->sid, other_isec->sid,
3238                            isec->sclass,
3239                            SOCKET__SENDTO,
3240                            &other_isec->avcr, &ad);
3241         if (err)
3242                 return err;
3243
3244         return 0;
3245 }
3246
3247 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3248 {
3249         u16 family;
3250         char *addrp;
3251         int len, err = 0;
3252         u32 netif_perm, node_perm, node_sid, recv_perm = 0;
3253         u32 sock_sid = 0;
3254         u16 sock_class = 0;
3255         struct socket *sock;
3256         struct net_device *dev;
3257         struct sel_netif *netif;
3258         struct netif_security_struct *nsec;
3259         struct avc_audit_data ad;
3260
3261         family = sk->sk_family;
3262         if (family != PF_INET && family != PF_INET6)
3263                 goto out;
3264
3265         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3266         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3267                 family = PF_INET;
3268
3269         read_lock_bh(&sk->sk_callback_lock);
3270         sock = sk->sk_socket;
3271         if (sock) {
3272                 struct inode *inode;
3273                 inode = SOCK_INODE(sock);
3274                 if (inode) {
3275                         struct inode_security_struct *isec;
3276                         isec = inode->i_security;
3277                         sock_sid = isec->sid;
3278                         sock_class = isec->sclass;
3279                 }
3280         }
3281         read_unlock_bh(&sk->sk_callback_lock);
3282         if (!sock_sid)
3283                 goto out;
3284
3285         dev = skb->dev;
3286         if (!dev)
3287                 goto out;
3288
3289         netif = sel_netif_lookup(dev);
3290         if (IS_ERR(netif)) {
3291                 err = PTR_ERR(netif);
3292                 goto out;
3293         }
3294
3295         nsec = &netif->nsec;
3296
3297         switch (sock_class) {
3298         case SECCLASS_UDP_SOCKET:
3299                 netif_perm = NETIF__UDP_RECV;
3300                 node_perm = NODE__UDP_RECV;
3301                 recv_perm = UDP_SOCKET__RECV_MSG;
3302                 break;
3303
3304         case SECCLASS_TCP_SOCKET:
3305                 netif_perm = NETIF__TCP_RECV;
3306                 node_perm = NODE__TCP_RECV;
3307                 recv_perm = TCP_SOCKET__RECV_MSG;
3308                 break;
3309
3310         default:
3311                 netif_perm = NETIF__RAWIP_RECV;
3312                 node_perm = NODE__RAWIP_RECV;
3313                 break;
3314         }
3315
3316         AVC_AUDIT_DATA_INIT(&ad, NET);
3317         ad.u.net.netif = dev->name;
3318         ad.u.net.family = family;
3319
3320         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3321         if (err) {
3322                 sel_netif_put(netif);
3323                 goto out;
3324         }
3325
3326         err = avc_has_perm(sock_sid, nsec->if_sid, SECCLASS_NETIF,
3327                            netif_perm, &nsec->avcr, &ad);
3328         sel_netif_put(netif);
3329         if (err)
3330                 goto out;
3331
3332         /* Fixme: this lookup is inefficient */
3333         err = security_node_sid(family, addrp, len, &node_sid);
3334         if (err)
3335                 goto out;
3336
3337         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);
3338         if (err)
3339                 goto out;
3340
3341         if (recv_perm) {
3342                 u32 port_sid;
3343
3344                 /* Fixme: make this more efficient */
3345                 err = security_port_sid(sk->sk_family, sk->sk_type,
3346                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3347                                         &port_sid);
3348                 if (err)
3349                         goto out;
3350
3351                 err = avc_has_perm(sock_sid, port_sid, sock_class,
3352                                    recv_perm, NULL, &ad);
3353         }
3354 out:
3355         return err;
3356 }
3357
3358 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3359                                      int __user *optlen, unsigned len)
3360 {
3361         int err = 0;
3362         char *scontext;
3363         u32 scontext_len;
3364         struct sk_security_struct *ssec;
3365         struct inode_security_struct *isec;
3366
3367         isec = SOCK_INODE(sock)->i_security;
3368         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3369                 err = -ENOPROTOOPT;
3370                 goto out;
3371         }
3372
3373         ssec = sock->sk->sk_security;
3374
3375         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3376         if (err)
3377                 goto out;
3378
3379         if (scontext_len > len) {
3380                 err = -ERANGE;
3381                 goto out_len;
3382         }
3383
3384         if (copy_to_user(optval, scontext, scontext_len))
3385                 err = -EFAULT;
3386
3387 out_len:
3388         if (put_user(scontext_len, optlen))
3389                 err = -EFAULT;
3390
3391         kfree(scontext);
3392 out:
3393         return err;
3394 }
3395
3396 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3397 {
3398         return sk_alloc_security(sk, family, priority);
3399 }
3400
3401 static void selinux_sk_free_security(struct sock *sk)
3402 {
3403         sk_free_security(sk);
3404 }
3405
3406 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3407 {
3408         int err = 0;
3409         u32 perm;
3410         struct nlmsghdr *nlh;
3411         struct socket *sock = sk->sk_socket;
3412         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3413
3414         if (skb->len < NLMSG_SPACE(0)) {
3415                 err = -EINVAL;
3416                 goto out;
3417         }
3418         nlh = (struct nlmsghdr *)skb->data;
3419
3420         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3421         if (err) {
3422                 /* Ignore */
3423                 if (err == -ENOENT)
3424                         err = 0;
3425                 goto out;
3426         }
3427
3428         err = socket_has_perm(current, sock, perm);
3429 out:
3430         return err;
3431 }
3432
3433 #ifdef CONFIG_NETFILTER
3434
3435 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3436                                               struct sk_buff **pskb,
3437                                               const struct net_device *in,
3438                                               const struct net_device *out,
3439                                               int (*okfn)(struct sk_buff *),
3440                                               u16 family)
3441 {
3442         char *addrp;
3443         int len, err = NF_ACCEPT;
3444         u32 netif_perm, node_perm, node_sid, send_perm = 0;
3445         struct sock *sk;
3446         struct socket *sock;
3447         struct inode *inode;
3448         struct sel_netif *netif;
3449         struct sk_buff *skb = *pskb;
3450         struct netif_security_struct *nsec;
3451         struct inode_security_struct *isec;
3452         struct avc_audit_data ad;
3453         struct net_device *dev = (struct net_device *)out;
3454
3455         sk = skb->sk;
3456         if (!sk)
3457                 goto out;
3458
3459         sock = sk->sk_socket;
3460         if (!sock)
3461                 goto out;
3462
3463         inode = SOCK_INODE(sock);
3464         if (!inode)
3465                 goto out;
3466
3467         netif = sel_netif_lookup(dev);
3468         if (IS_ERR(netif)) {
3469                 err = NF_DROP;
3470                 goto out;
3471         }
3472
3473         nsec = &netif->nsec;
3474         isec = inode->i_security;
3475
3476         switch (isec->sclass) {
3477         case SECCLASS_UDP_SOCKET:
3478                 netif_perm = NETIF__UDP_SEND;
3479                 node_perm = NODE__UDP_SEND;
3480                 send_perm = UDP_SOCKET__SEND_MSG;
3481                 break;
3482
3483         case SECCLASS_TCP_SOCKET:
3484                 netif_perm = NETIF__TCP_SEND;
3485                 node_perm = NODE__TCP_SEND;
3486                 send_perm = TCP_SOCKET__SEND_MSG;
3487                 break;
3488
3489         default:
3490                 netif_perm = NETIF__RAWIP_SEND;
3491                 node_perm = NODE__RAWIP_SEND;
3492                 break;
3493         }
3494
3495
3496         AVC_AUDIT_DATA_INIT(&ad, NET);
3497         ad.u.net.netif = dev->name;
3498         ad.u.net.family = family;
3499
3500         err = selinux_parse_skb(skb, &ad, &addrp,
3501                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3502         if (err != NF_ACCEPT) {
3503                 sel_netif_put(netif);
3504                 goto out;
3505         }
3506
3507         err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
3508                            netif_perm, &nsec->avcr, &ad) ? NF_DROP : NF_ACCEPT;
3509         sel_netif_put(netif);
3510         if (err != NF_ACCEPT)
3511                 goto out;
3512
3513         /* Fixme: this lookup is inefficient */
3514         err = security_node_sid(family, addrp, len,
3515                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3516         if (err != NF_ACCEPT)
3517                 goto out;
3518
3519         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3520                            node_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3521         if (err != NF_ACCEPT)
3522                 goto out;
3523
3524         if (send_perm) {
3525                 u32 port_sid;
3526
3527                 /* Fixme: make this more efficient */
3528                 err = security_port_sid(sk->sk_family,
3529                                         sk->sk_type,
3530                                         sk->sk_protocol,
3531                                         ntohs(ad.u.net.dport),
3532                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3533                 if (err != NF_ACCEPT)
3534                         goto out;
3535
3536                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3537                                    send_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3538         }
3539
3540 out:
3541         return err;
3542 }
3543
3544 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3545                                                 struct sk_buff **pskb,
3546                                                 const struct net_device *in,
3547                                                 const struct net_device *out,
3548                                                 int (*okfn)(struct sk_buff *))
3549 {
3550         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3551 }
3552
3553 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3554
3555 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3556                                                 struct sk_buff **pskb,
3557                                                 const struct net_device *in,
3558                                                 const struct net_device *out,
3559                                                 int (*okfn)(struct sk_buff *))
3560 {
3561         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3562 }
3563
3564 #endif  /* IPV6 */
3565
3566 #endif  /* CONFIG_NETFILTER */
3567
3568 #else
3569
3570 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3571 {
3572         return 0;
3573 }
3574
3575 #endif  /* CONFIG_SECURITY_NETWORK */
3576
3577 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3578 {
3579         int err = 0;
3580
3581         if (capable(CAP_NET_ADMIN))
3582                 cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
3583         else
3584                 NETLINK_CB(skb).eff_cap = 0;
3585
3586         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3587                 err = selinux_nlmsg_perm(sk, skb);
3588
3589         return err;
3590 }
3591
3592 static int selinux_netlink_recv(struct sk_buff *skb)
3593 {
3594         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3595                 return -EPERM;
3596         return 0;
3597 }
3598
3599 static int ipc_alloc_security(struct task_struct *task,
3600                               struct kern_ipc_perm *perm,
3601                               u16 sclass)
3602 {
3603         struct task_security_struct *tsec = task->security;
3604         struct ipc_security_struct *isec;
3605
3606         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3607         if (!isec)
3608                 return -ENOMEM;
3609
3610         memset(isec, 0, sizeof(struct ipc_security_struct));
3611         isec->magic = SELINUX_MAGIC;
3612         isec->sclass = sclass;
3613         isec->ipc_perm = perm;
3614         if (tsec) {
3615                 isec->sid = tsec->sid;
3616         } else {
3617                 isec->sid = SECINITSID_UNLABELED;
3618         }
3619         perm->security = isec;
3620
3621         return 0;
3622 }
3623
3624 static void ipc_free_security(struct kern_ipc_perm *perm)
3625 {
3626         struct ipc_security_struct *isec = perm->security;
3627         if (!isec || isec->magic != SELINUX_MAGIC)
3628                 return;
3629
3630         perm->security = NULL;
3631         kfree(isec);
3632 }
3633
3634 static int msg_msg_alloc_security(struct msg_msg *msg)
3635 {
3636         struct msg_security_struct *msec;
3637
3638         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3639         if (!msec)
3640                 return -ENOMEM;
3641
3642         memset(msec, 0, sizeof(struct msg_security_struct));
3643         msec->magic = SELINUX_MAGIC;
3644         msec->msg = msg;
3645         msec->sid = SECINITSID_UNLABELED;
3646         msg->security = msec;
3647
3648         return 0;
3649 }
3650
3651 static void msg_msg_free_security(struct msg_msg *msg)
3652 {
3653         struct msg_security_struct *msec = msg->security;
3654         if (!msec || msec->magic != SELINUX_MAGIC)
3655                 return;
3656
3657         msg->security = NULL;
3658         kfree(msec);
3659 }
3660
3661 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3662                         u16 sclass, u32 perms)
3663 {
3664         struct task_security_struct *tsec;
3665         struct ipc_security_struct *isec;
3666         struct avc_audit_data ad;
3667
3668         tsec = current->security;
3669         isec = ipc_perms->security;
3670
3671         AVC_AUDIT_DATA_INIT(&ad, IPC);
3672         ad.u.ipc_id = ipc_perms->key;
3673
3674         return avc_has_perm(tsec->sid, isec->sid, sclass,
3675                             perms, &isec->avcr, &ad);
3676 }
3677
3678 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3679 {
3680         return msg_msg_alloc_security(msg);
3681 }
3682
3683 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3684 {
3685         msg_msg_free_security(msg);
3686 }
3687
3688 /* message queue security operations */
3689 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3690 {
3691         struct task_security_struct *tsec;
3692         struct ipc_security_struct *isec;
3693         struct avc_audit_data ad;
3694         int rc;
3695
3696         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3697         if (rc)
3698                 return rc;
3699
3700         tsec = current->security;
3701         isec = msq->q_perm.security;
3702
3703         AVC_AUDIT_DATA_INIT(&ad, IPC);
3704         ad.u.ipc_id = msq->q_perm.key;
3705
3706         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3707                           MSGQ__CREATE, &isec->avcr, &ad);
3708         if (rc) {
3709                 ipc_free_security(&msq->q_perm);
3710                 return rc;
3711         }
3712         return 0;
3713 }
3714
3715 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3716 {
3717         ipc_free_security(&msq->q_perm);
3718 }
3719
3720 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3721 {
3722         struct task_security_struct *tsec;
3723         struct ipc_security_struct *isec;
3724         struct avc_audit_data ad;
3725
3726         tsec = current->security;
3727         isec = msq->q_perm.security;
3728
3729         AVC_AUDIT_DATA_INIT(&ad, IPC);
3730         ad.u.ipc_id = msq->q_perm.key;
3731
3732         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3733                             MSGQ__ASSOCIATE, &isec->avcr, &ad);
3734 }
3735
3736 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3737 {
3738         int err;
3739         int perms;
3740
3741         switch(cmd) {
3742         case IPC_INFO:
3743         case MSG_INFO:
3744                 /* No specific object, just general system-wide information. */
3745                 return task_has_system(current, SYSTEM__IPC_INFO);
3746         case IPC_STAT:
3747         case MSG_STAT:
3748                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3749                 break;
3750         case IPC_SET:
3751                 perms = MSGQ__SETATTR;
3752                 break;
3753         case IPC_RMID:
3754                 perms = MSGQ__DESTROY;
3755                 break;
3756         default:
3757                 return 0;
3758         }
3759
3760         err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
3761         return err;
3762 }
3763
3764 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3765 {
3766         struct task_security_struct *tsec;
3767         struct ipc_security_struct *isec;
3768         struct msg_security_struct *msec;
3769         struct avc_audit_data ad;
3770         int rc;
3771
3772         tsec = current->security;
3773         isec = msq->q_perm.security;
3774         msec = msg->security;
3775
3776         /*
3777          * First time through, need to assign label to the message
3778          */
3779         if (msec->sid == SECINITSID_UNLABELED) {
3780                 /*
3781                  * Compute new sid based on current process and
3782                  * message queue this message will be stored in
3783                  */
3784                 rc = security_transition_sid(tsec->sid,
3785                                              isec->sid,
3786                                              SECCLASS_MSG,
3787                                              &msec->sid);
3788                 if (rc)
3789                         return rc;
3790         }
3791
3792         AVC_AUDIT_DATA_INIT(&ad, IPC);
3793         ad.u.ipc_id = msq->q_perm.key;
3794
3795         /* Can this process write to the queue? */
3796         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3797                           MSGQ__WRITE, &isec->avcr, &ad);
3798         if (!rc)
3799                 /* Can this process send the message */
3800                 rc = avc_has_perm(tsec->sid, msec->sid,
3801                                   SECCLASS_MSG, MSG__SEND,
3802                                   &msec->avcr, &ad);
3803         if (!rc)
3804                 /* Can the message be put in the queue? */
3805                 rc = avc_has_perm(msec->sid, isec->sid,
3806                                   SECCLASS_MSGQ, MSGQ__ENQUEUE,
3807                                   &isec->avcr, &ad);
3808
3809         return rc;
3810 }
3811
3812 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3813                                     struct task_struct *target,
3814                                     long type, int mode)
3815 {
3816         struct task_security_struct *tsec;
3817         struct ipc_security_struct *isec;
3818         struct msg_security_struct *msec;
3819         struct avc_audit_data ad;
3820         int rc;
3821
3822         tsec = target->security;
3823         isec = msq->q_perm.security;
3824         msec = msg->security;
3825
3826         AVC_AUDIT_DATA_INIT(&ad, IPC);
3827         ad.u.ipc_id = msq->q_perm.key;
3828
3829         rc = avc_has_perm(tsec->sid, isec->sid,
3830                           SECCLASS_MSGQ, MSGQ__READ,
3831                           &isec->avcr, &ad);
3832         if (!rc)
3833                 rc = avc_has_perm(tsec->sid, msec->sid,
3834                                   SECCLASS_MSG, MSG__RECEIVE,
3835                                   &msec->avcr, &ad);
3836         return rc;
3837 }
3838
3839 /* Shared Memory security operations */
3840 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3841 {
3842         struct task_security_struct *tsec;
3843         struct ipc_security_struct *isec;
3844         struct avc_audit_data ad;
3845         int rc;
3846
3847         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3848         if (rc)
3849                 return rc;
3850
3851         tsec = current->security;
3852         isec = shp->shm_perm.security;
3853
3854         AVC_AUDIT_DATA_INIT(&ad, IPC);
3855         ad.u.ipc_id = shp->shm_perm.key;
3856
3857         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3858                           SHM__CREATE, &isec->avcr, &ad);
3859         if (rc) {
3860                 ipc_free_security(&shp->shm_perm);
3861                 return rc;
3862         }
3863         return 0;
3864 }
3865
3866 static void selinux_shm_free_security(struct shmid_kernel *shp)
3867 {
3868         ipc_free_security(&shp->shm_perm);
3869 }
3870
3871 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3872 {
3873         struct task_security_struct *tsec;
3874         struct ipc_security_struct *isec;
3875         struct avc_audit_data ad;
3876
3877         tsec = current->security;
3878         isec = shp->shm_perm.security;
3879
3880         AVC_AUDIT_DATA_INIT(&ad, IPC);
3881         ad.u.ipc_id = shp->shm_perm.key;
3882
3883         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3884                             SHM__ASSOCIATE, &isec->avcr, &ad);
3885 }
3886
3887 /* Note, at this point, shp is locked down */
3888 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3889 {
3890         int perms;
3891         int err;
3892
3893         switch(cmd) {
3894         case IPC_INFO:
3895         case SHM_INFO:
3896                 /* No specific object, just general system-wide information. */
3897                 return task_has_system(current, SYSTEM__IPC_INFO);
3898         case IPC_STAT:
3899         case SHM_STAT:
3900                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3901                 break;
3902         case IPC_SET:
3903                 perms = SHM__SETATTR;
3904                 break;
3905         case SHM_LOCK:
3906         case SHM_UNLOCK:
3907                 perms = SHM__LOCK;
3908                 break;
3909         case IPC_RMID:
3910                 perms = SHM__DESTROY;
3911                 break;
3912         default:
3913                 return 0;
3914         }
3915
3916         err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3917         return err;
3918 }
3919
3920 static int selinux_shm_shmat(struct shmid_kernel *shp,
3921                              char __user *shmaddr, int shmflg)
3922 {
3923         u32 perms;
3924         int rc;
3925
3926         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3927         if (rc)
3928                 return rc;
3929
3930         if (shmflg & SHM_RDONLY)
3931                 perms = SHM__READ;
3932         else
3933                 perms = SHM__READ | SHM__WRITE;
3934
3935         return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3936 }
3937
3938 /* Semaphore security operations */
3939 static int selinux_sem_alloc_security(struct sem_array *sma)
3940 {
3941         struct task_security_struct *tsec;
3942         struct ipc_security_struct *isec;
3943         struct avc_audit_data ad;
3944         int rc;
3945
3946         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3947         if (rc)
3948                 return rc;
3949
3950         tsec = current->security;
3951         isec = sma->sem_perm.security;
3952
3953         AVC_AUDIT_DATA_INIT(&ad, IPC);
3954         ad.u.ipc_id = sma->sem_perm.key;
3955
3956         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3957                           SEM__CREATE, &isec->avcr, &ad);
3958         if (rc) {
3959                 ipc_free_security(&sma->sem_perm);
3960                 return rc;
3961         }
3962         return 0;
3963 }
3964
3965 static void selinux_sem_free_security(struct sem_array *sma)
3966 {
3967         ipc_free_security(&sma->sem_perm);
3968 }
3969
3970 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3971 {
3972         struct task_security_struct *tsec;
3973         struct ipc_security_struct *isec;
3974         struct avc_audit_data ad;
3975
3976         tsec = current->security;
3977         isec = sma->sem_perm.security;
3978
3979         AVC_AUDIT_DATA_INIT(&ad, IPC);
3980         ad.u.ipc_id = sma->sem_perm.key;
3981
3982         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3983                             SEM__ASSOCIATE, &isec->avcr, &ad);
3984 }
3985
3986 /* Note, at this point, sma is locked down */
3987 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3988 {
3989         int err;
3990         u32 perms;
3991
3992         switch(cmd) {
3993         case IPC_INFO:
3994         case SEM_INFO:
3995                 /* No specific object, just general system-wide information. */
3996                 return task_has_system(current, SYSTEM__IPC_INFO);
3997         case GETPID:
3998         case GETNCNT:
3999         case GETZCNT:
4000                 perms = SEM__GETATTR;
4001                 break;
4002         case GETVAL:
4003         case GETALL:
4004                 perms = SEM__READ;
4005                 break;
4006         case SETVAL:
4007         case SETALL:
4008                 perms = SEM__WRITE;
4009                 break;
4010         case IPC_RMID:
4011                 perms = SEM__DESTROY;
4012                 break;
4013         case IPC_SET:
4014                 perms = SEM__SETATTR;
4015                 break;
4016         case IPC_STAT:
4017         case SEM_STAT:
4018                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4019                 break;
4020         default:
4021                 return 0;
4022         }
4023
4024         err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4025         return err;
4026 }
4027
4028 static int selinux_sem_semop(struct sem_array *sma,
4029                              struct sembuf *sops, unsigned nsops, int alter)
4030 {
4031         u32 perms;
4032
4033         if (alter)
4034                 perms = SEM__READ | SEM__WRITE;
4035         else
4036                 perms = SEM__READ;
4037
4038         return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4039 }
4040
4041 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4042 {
4043         struct ipc_security_struct *isec = ipcp->security;
4044         u16 sclass = SECCLASS_IPC;
4045         u32 av = 0;
4046
4047         if (isec && isec->magic == SELINUX_MAGIC)
4048                 sclass = isec->sclass;
4049
4050         av = 0;
4051         if (flag & S_IRUGO)
4052                 av |= IPC__UNIX_READ;
4053         if (flag & S_IWUGO)
4054                 av |= IPC__UNIX_WRITE;
4055
4056         if (av == 0)
4057                 return 0;
4058
4059         return ipc_has_perm(ipcp, sclass, av);
4060 }
4061
4062 /* module stacking operations */
4063 int selinux_register_security (const char *name, struct security_operations *ops)
4064 {
4065         if (secondary_ops != original_ops) {
4066                 printk(KERN_INFO "%s:  There is already a secondary security "
4067                        "module registered.\n", __FUNCTION__);
4068                 return -EINVAL;
4069         }
4070
4071         secondary_ops = ops;
4072
4073         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4074                __FUNCTION__,
4075                name);
4076
4077         return 0;
4078 }
4079
4080 int selinux_unregister_security (const char *name, struct security_operations *ops)
4081 {
4082         if (ops != secondary_ops) {
4083                 printk (KERN_INFO "%s:  trying to unregister a security module "
4084                         "that is not registered.\n", __FUNCTION__);
4085                 return -EINVAL;
4086         }
4087
4088         secondary_ops = original_ops;
4089
4090         return 0;
4091 }
4092
4093 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4094 {
4095         if (inode)
4096                 inode_doinit_with_dentry(inode, dentry);
4097 }
4098
4099 static int selinux_getprocattr(struct task_struct *p,
4100                                char *name, void *value, size_t size)
4101 {
4102         struct task_security_struct *tsec;
4103         u32 sid, len;
4104         char *context;
4105         int error;
4106
4107         if (current != p) {
4108                 error = task_has_perm(current, p, PROCESS__GETATTR);
4109                 if (error)
4110                         return error;
4111         }
4112
4113         if (!size)
4114                 return -ERANGE;
4115
4116         tsec = p->security;
4117
4118         if (!strcmp(name, "current"))
4119                 sid = tsec->sid;
4120         else if (!strcmp(name, "prev"))
4121                 sid = tsec->osid;
4122         else if (!strcmp(name, "exec"))
4123                 sid = tsec->exec_sid;
4124         else if (!strcmp(name, "fscreate"))
4125                 sid = tsec->create_sid;
4126         else
4127                 return -EINVAL;
4128
4129         if (!sid)
4130                 return 0;
4131
4132         error = security_sid_to_context(sid, &context, &len);
4133         if (error)
4134                 return error;
4135         if (len > size) {
4136                 kfree(context);
4137                 return -ERANGE;
4138         }
4139         memcpy(value, context, len);
4140         kfree(context);
4141         return len;
4142 }
4143
4144 static int selinux_setprocattr(struct task_struct *p,
4145                                char *name, void *value, size_t size)
4146 {
4147         struct task_security_struct *tsec;
4148         u32 sid = 0;
4149         int error;
4150
4151         if (current != p || !strcmp(name, "current")) {
4152                 /* SELinux only allows a process to change its own
4153                    security attributes, and it only allows the process
4154                    current SID to change via exec. */
4155                 return -EACCES;
4156         }
4157
4158         /*
4159          * Basic control over ability to set these attributes at all.
4160          * current == p, but we'll pass them separately in case the
4161          * above restriction is ever removed.
4162          */
4163         if (!strcmp(name, "exec"))
4164                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4165         else if (!strcmp(name, "fscreate"))
4166                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4167         else
4168                 error = -EINVAL;
4169         if (error)
4170                 return error;
4171
4172         /* Obtain a SID for the context, if one was specified. */
4173         if (size) {
4174                 int error;
4175                 error = security_context_to_sid(value, size, &sid);
4176                 if (error)
4177                         return error;
4178         }
4179
4180         /* Permission checking based on the specified context is
4181            performed during the actual operation (execve,
4182            open/mkdir/...), when we know the full context of the
4183            operation.  See selinux_bprm_set_security for the execve
4184            checks and may_create for the file creation checks. The
4185            operation will then fail if the context is not permitted. */
4186         tsec = p->security;
4187         if (!strcmp(name, "exec"))
4188                 tsec->exec_sid = sid;
4189         else if (!strcmp(name, "fscreate"))
4190                 tsec->create_sid = sid;
4191         else
4192                 return -EINVAL;
4193
4194         return size;
4195 }
4196
4197 struct security_operations selinux_ops = {
4198         .ptrace =                       selinux_ptrace,
4199         .capget =                       selinux_capget,
4200         .capset_check =                 selinux_capset_check,
4201         .capset_set =                   selinux_capset_set,
4202         .sysctl =                       selinux_sysctl,
4203         .capable =                      selinux_capable,
4204         .quotactl =                     selinux_quotactl,
4205         .quota_on =                     selinux_quota_on,
4206         .syslog =                       selinux_syslog,
4207         .vm_enough_memory =             selinux_vm_enough_memory,
4208
4209         .netlink_send =                 selinux_netlink_send,
4210         .netlink_recv =                 selinux_netlink_recv,
4211
4212         .bprm_alloc_security =          selinux_bprm_alloc_security,
4213         .bprm_free_security =           selinux_bprm_free_security,
4214         .bprm_apply_creds =             selinux_bprm_apply_creds,
4215         .bprm_set_security =            selinux_bprm_set_security,
4216         .bprm_check_security =          selinux_bprm_check_security,
4217         .bprm_secureexec =              selinux_bprm_secureexec,
4218
4219         .sb_alloc_security =            selinux_sb_alloc_security,
4220         .sb_free_security =             selinux_sb_free_security,
4221         .sb_copy_data =                 selinux_sb_copy_data,
4222         .sb_kern_mount =                selinux_sb_kern_mount,
4223         .sb_statfs =                    selinux_sb_statfs,
4224         .sb_mount =                     selinux_mount,
4225         .sb_umount =                    selinux_umount,
4226
4227         .inode_alloc_security =         selinux_inode_alloc_security,
4228         .inode_free_security =          selinux_inode_free_security,
4229         .inode_create =                 selinux_inode_create,
4230         .inode_post_create =            selinux_inode_post_create,
4231         .inode_link =                   selinux_inode_link,
4232         .inode_post_link =              selinux_inode_post_link,
4233         .inode_unlink =                 selinux_inode_unlink,
4234         .inode_symlink =                selinux_inode_symlink,
4235         .inode_post_symlink =           selinux_inode_post_symlink,
4236         .inode_mkdir =                  selinux_inode_mkdir,
4237         .inode_post_mkdir =             selinux_inode_post_mkdir,
4238         .inode_rmdir =                  selinux_inode_rmdir,
4239         .inode_mknod =                  selinux_inode_mknod,
4240         .inode_post_mknod =             selinux_inode_post_mknod,
4241         .inode_rename =                 selinux_inode_rename,
4242         .inode_post_rename =            selinux_inode_post_rename,
4243         .inode_readlink =               selinux_inode_readlink,
4244         .inode_follow_link =            selinux_inode_follow_link,
4245         .inode_permission =             selinux_inode_permission,
4246         .inode_setattr =                selinux_inode_setattr,
4247         .inode_getattr =                selinux_inode_getattr,
4248         .inode_setxattr =               selinux_inode_setxattr,
4249         .inode_post_setxattr =          selinux_inode_post_setxattr,
4250         .inode_getxattr =               selinux_inode_getxattr,
4251         .inode_listxattr =              selinux_inode_listxattr,
4252         .inode_removexattr =            selinux_inode_removexattr,
4253         .inode_getsecurity =            selinux_inode_getsecurity,
4254         .inode_setsecurity =            selinux_inode_setsecurity,
4255         .inode_listsecurity =           selinux_inode_listsecurity,
4256
4257         .file_permission =              selinux_file_permission,
4258         .file_alloc_security =          selinux_file_alloc_security,
4259         .file_free_security =           selinux_file_free_security,
4260         .file_ioctl =                   selinux_file_ioctl,
4261         .file_mmap =                    selinux_file_mmap,
4262         .file_mprotect =                selinux_file_mprotect,
4263         .file_lock =                    selinux_file_lock,
4264         .file_fcntl =                   selinux_file_fcntl,
4265         .file_set_fowner =              selinux_file_set_fowner,
4266         .file_send_sigiotask =          selinux_file_send_sigiotask,
4267         .file_receive =                 selinux_file_receive,
4268
4269         .task_create =                  selinux_task_create,
4270         .task_alloc_security =          selinux_task_alloc_security,
4271         .task_free_security =           selinux_task_free_security,
4272         .task_setuid =                  selinux_task_setuid,
4273         .task_post_setuid =             selinux_task_post_setuid,
4274         .task_setgid =                  selinux_task_setgid,
4275         .task_setpgid =                 selinux_task_setpgid,
4276         .task_getpgid =                 selinux_task_getpgid,
4277         .task_getsid =                  selinux_task_getsid,
4278         .task_setgroups =               selinux_task_setgroups,
4279         .task_setnice =                 selinux_task_setnice,
4280         .task_setrlimit =               selinux_task_setrlimit,
4281         .task_setscheduler =            selinux_task_setscheduler,
4282         .task_getscheduler =            selinux_task_getscheduler,
4283         .task_kill =                    selinux_task_kill,
4284         .task_wait =                    selinux_task_wait,
4285         .task_prctl =                   selinux_task_prctl,
4286         .task_reparent_to_init =        selinux_task_reparent_to_init,
4287         .task_to_inode =                selinux_task_to_inode,
4288
4289         .ipc_permission =               selinux_ipc_permission,
4290
4291         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4292         .msg_msg_free_security =        selinux_msg_msg_free_security,
4293
4294         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4295         .msg_queue_free_security =      selinux_msg_queue_free_security,
4296         .msg_queue_associate =          selinux_msg_queue_associate,
4297         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4298         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4299         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4300
4301         .shm_alloc_security =           selinux_shm_alloc_security,
4302         .shm_free_security =            selinux_shm_free_security,
4303         .shm_associate =                selinux_shm_associate,
4304         .shm_shmctl =                   selinux_shm_shmctl,
4305         .shm_shmat =                    selinux_shm_shmat,
4306
4307         .sem_alloc_security =           selinux_sem_alloc_security,
4308         .sem_free_security =            selinux_sem_free_security,
4309         .sem_associate =                selinux_sem_associate,
4310         .sem_semctl =                   selinux_sem_semctl,
4311         .sem_semop =                    selinux_sem_semop,
4312
4313         .register_security =            selinux_register_security,
4314         .unregister_security =          selinux_unregister_security,
4315
4316         .d_instantiate =                selinux_d_instantiate,
4317
4318         .getprocattr =                  selinux_getprocattr,
4319         .setprocattr =                  selinux_setprocattr,
4320
4321 #ifdef CONFIG_SECURITY_NETWORK
4322         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4323         .unix_may_send =                selinux_socket_unix_may_send,
4324
4325         .socket_create =                selinux_socket_create,
4326         .socket_post_create =           selinux_socket_post_create,
4327         .socket_bind =                  selinux_socket_bind,
4328         .socket_connect =               selinux_socket_connect,
4329         .socket_listen =                selinux_socket_listen,
4330         .socket_accept =                selinux_socket_accept,
4331         .socket_sendmsg =               selinux_socket_sendmsg,
4332         .socket_recvmsg =               selinux_socket_recvmsg,
4333         .socket_getsockname =           selinux_socket_getsockname,
4334         .socket_getpeername =           selinux_socket_getpeername,
4335         .socket_getsockopt =            selinux_socket_getsockopt,
4336         .socket_setsockopt =            selinux_socket_setsockopt,
4337         .socket_shutdown =              selinux_socket_shutdown,
4338         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4339         .socket_getpeersec =            selinux_socket_getpeersec,
4340         .sk_alloc_security =            selinux_sk_alloc_security,
4341         .sk_free_security =             selinux_sk_free_security,
4342 #endif
4343 };
4344
4345 __init int selinux_init(void)
4346 {
4347         struct task_security_struct *tsec;
4348
4349         if (!selinux_enabled) {
4350                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4351                 return 0;
4352         }
4353
4354         printk(KERN_INFO "SELinux:  Initializing.\n");
4355
4356         /* Set the security state for the initial task. */
4357         if (task_alloc_security(current))
4358                 panic("SELinux:  Failed to initialize initial task.\n");
4359         tsec = current->security;
4360         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4361
4362         avc_init();
4363
4364         original_ops = secondary_ops = security_ops;
4365         if (!secondary_ops)
4366                 panic ("SELinux: No initial security operations\n");
4367         if (register_security (&selinux_ops))
4368                 panic("SELinux: Unable to register with kernel.\n");
4369
4370         if (selinux_enforcing) {
4371                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4372         } else {
4373                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4374         }
4375         return 0;
4376 }
4377
4378 void selinux_complete_init(void)
4379 {
4380         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4381
4382         /* Set up any superblocks initialized prior to the policy load. */
4383         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4384         spin_lock(&sb_security_lock);
4385 next_sb:
4386         if (!list_empty(&superblock_security_head)) {
4387                 struct superblock_security_struct *sbsec =
4388                                 list_entry(superblock_security_head.next,
4389                                            struct superblock_security_struct,
4390                                            list);
4391                 struct super_block *sb = sbsec->sb;
4392                 spin_lock(&sb_lock);
4393                 sb->s_count++;
4394                 spin_unlock(&sb_lock);
4395                 spin_unlock(&sb_security_lock);
4396                 down_read(&sb->s_umount);
4397                 if (sb->s_root)
4398                         superblock_doinit(sb, NULL);
4399                 drop_super(sb);
4400                 spin_lock(&sb_security_lock);
4401                 list_del_init(&sbsec->list);
4402                 goto next_sb;
4403         }
4404         spin_unlock(&sb_security_lock);
4405 }
4406
4407 /* SELinux requires early initialization in order to label
4408    all processes and objects when they are created. */
4409 security_initcall(selinux_init);
4410
4411 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4412
4413 static struct nf_hook_ops selinux_ipv4_op = {
4414         .hook =         selinux_ipv4_postroute_last,
4415         .owner =        THIS_MODULE,
4416         .pf =           PF_INET,
4417         .hooknum =      NF_IP_POST_ROUTING,
4418         .priority =     NF_IP_PRI_SELINUX_LAST,
4419 };
4420
4421 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4422
4423 static struct nf_hook_ops selinux_ipv6_op = {
4424         .hook =         selinux_ipv6_postroute_last,
4425         .owner =        THIS_MODULE,
4426         .pf =           PF_INET6,
4427         .hooknum =      NF_IP6_POST_ROUTING,
4428         .priority =     NF_IP6_PRI_SELINUX_LAST,
4429 };
4430
4431 #endif  /* IPV6 */
4432
4433 static int __init selinux_nf_ip_init(void)
4434 {
4435         int err = 0;
4436
4437         if (!selinux_enabled)
4438                 goto out;
4439
4440         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4441
4442         err = nf_register_hook(&selinux_ipv4_op);
4443         if (err)
4444                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4445
4446 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4447
4448         err = nf_register_hook(&selinux_ipv6_op);
4449         if (err)
4450                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4451
4452 #endif  /* IPV6 */
4453 out:
4454         return err;
4455 }
4456
4457 __initcall(selinux_nf_ip_init);
4458
4459 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4460 static void selinux_nf_ip_exit(void)
4461 {
4462         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4463
4464         nf_unregister_hook(&selinux_ipv4_op);
4465 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4466         nf_unregister_hook(&selinux_ipv6_op);
4467 #endif  /* IPV6 */
4468 }
4469 #endif
4470
4471 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4472
4473 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4474 #define selinux_nf_ip_exit()
4475 #endif
4476
4477 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4478
4479 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4480 int selinux_disable(void)
4481 {
4482         extern void exit_sel_fs(void);
4483         static int selinux_disabled = 0;
4484
4485         if (ss_initialized) {
4486                 /* Not permitted after initial policy load. */
4487                 return -EINVAL;
4488         }
4489
4490         if (selinux_disabled) {
4491                 /* Only do this once. */
4492                 return -EINVAL;
4493         }
4494
4495         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4496
4497         selinux_disabled = 1;
4498
4499         /* Reset security_ops to the secondary module, dummy or capability. */
4500         security_ops = secondary_ops;
4501
4502         /* Unregister netfilter hooks. */
4503         selinux_nf_ip_exit();
4504
4505         /* Unregister selinuxfs. */
4506         exit_sel_fs();
4507
4508         return 0;
4509 }
4510 #endif
4511
4512