security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/init.h>
  23 #include <linux/kernel.h>
  24 #include <linux/tracehook.h>
  25 #include <linux/errno.h>
  26 #include <linux/sched.h>
  27 #include <linux/security.h>
  28 #include <linux/xattr.h>
  29 #include <linux/capability.h>
  30 #include <linux/unistd.h>
  31 #include <linux/mm.h>
  32 #include <linux/mman.h>
  33 #include <linux/slab.h>
  34 #include <linux/pagemap.h>
  35 #include <linux/swap.h>
  36 #include <linux/smp_lock.h>
  37 #include <linux/spinlock.h>
  38 #include <linux/syscalls.h>
  39 #include <linux/file.h>
  40 #include <linux/namei.h>
  41 #include <linux/mount.h>
  42 #include <linux/ext2_fs.h>
  43 #include <linux/proc_fs.h>
  44 #include <linux/kd.h>
  45 #include <linux/netfilter_ipv4.h>
  46 #include <linux/netfilter_ipv6.h>
  47 #include <linux/tty.h>
  48 #include <net/icmp.h>
  49 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  50 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  51 #include <asm/uaccess.h>
  52 #include <asm/semaphore.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/quota.h>
  61 #include <linux/un.h>           /* for Unix socket types */
  62 #include <net/af_unix.h>        /* for Unix socket types */
  63 #include <linux/parser.h>
  64 #include <linux/nfs_mount.h>
  65 #include <net/ipv6.h>
  66 #include <linux/hugetlb.h>
  67 #include <linux/personality.h>
  68 #include <linux/sysctl.h>
  69 #include <linux/audit.h>
  70 #include <linux/string.h>
  71 #include <linux/selinux.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76 #include "xfrm.h"
  77
  78 #define XATTR_SELINUX_SUFFIX "selinux"
  79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  80
  81 extern unsigned int policydb_loaded_version;
  82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  83 extern int selinux_compat_net;
  84
  85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  86 int selinux_enforcing = 0;
  87
  88 static int __init enforcing_setup(char *str)
  89 {
  90         selinux_enforcing = simple_strtol(str,NULL,0);
  91         return 1;
  92 }
  93 __setup("enforcing=", enforcing_setup);
  94 #endif
  95
  96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  98
  99 static int __init selinux_enabled_setup(char *str)
 100 {
 101         selinux_enabled = simple_strtol(str, NULL, 0);
 102         return 1;
 103 }
 104 __setup("selinux=", selinux_enabled_setup);
 105 #else
 106 int selinux_enabled = 1;
 107 #endif
 108
 109 /* Original (dummy) security module. */
 110 static struct security_operations *original_ops = NULL;
 111
 112 /* Minimal support for a secondary security module,
 113    just to allow the use of the dummy or capability modules.
 114    The owlsm module can alternatively be used as a secondary
 115    module as long as CONFIG_OWLSM_FD is not enabled. */
 116 static struct security_operations *secondary_ops = NULL;
 117
 118 /* Lists of inode and superblock security structures initialized
 119    before the policy was loaded. */
 120 static LIST_HEAD(superblock_security_head);
 121 static DEFINE_SPINLOCK(sb_security_lock);
 122
 123 static kmem_cache_t *sel_inode_cache;
 124
 125 /* Return security context for a given sid or just the context
 126    length if the buffer is null or length is 0 */
 127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 128 {
 129         char *context;
 130         unsigned len;
 131         int rc;
 132
 133         rc = security_sid_to_context(sid, &context, &len);
 134         if (rc)
 135                 return rc;
 136
 137         if (!buffer || !size)
 138                 goto getsecurity_exit;
 139
 140         if (size < len) {
 141                 len = -ERANGE;
 142                 goto getsecurity_exit;
 143         }
 144         memcpy(buffer, context, len);
 145
 146 getsecurity_exit:
 147         kfree(context);
 148         return len;
 149 }
 150
 151 /* Allocate and free functions for each kind of security blob. */
 152
 153 static int task_alloc_security(struct task_struct *task)
 154 {
 155         struct task_security_struct *tsec;
 156
 157         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 158         if (!tsec)
 159                 return -ENOMEM;
 160
 161         tsec->task = task;
 162         tsec->osid = tsec->sid = SECINITSID_UNLABELED;
 163         task->security = tsec;
 164
 165         return 0;
 166 }
 167
 168 static void task_free_security(struct task_struct *task)
 169 {
 170         struct task_security_struct *tsec = task->security;
 171         task->security = NULL;
 172         kfree(tsec);
 173 }
 174
 175 static int inode_alloc_security(struct inode *inode)
 176 {
 177         struct task_security_struct *tsec = current->security;
 178         struct inode_security_struct *isec;
 179
 180         isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
 181         if (!isec)
 182                 return -ENOMEM;
 183
 184         memset(isec, 0, sizeof(*isec));
 185         init_MUTEX(&isec->sem);
 186         INIT_LIST_HEAD(&isec->list);
 187         isec->inode = inode;
 188         isec->sid = SECINITSID_UNLABELED;
 189         isec->sclass = SECCLASS_FILE;
 190         isec->task_sid = tsec->sid;
 191         inode->i_security = isec;
 192
 193         return 0;
 194 }
 195
 196 static void inode_free_security(struct inode *inode)
 197 {
 198         struct inode_security_struct *isec = inode->i_security;
 199         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 200
 201         spin_lock(&sbsec->isec_lock);
 202         if (!list_empty(&isec->list))
 203                 list_del_init(&isec->list);
 204         spin_unlock(&sbsec->isec_lock);
 205
 206         inode->i_security = NULL;
 207         kmem_cache_free(sel_inode_cache, isec);
 208 }
 209
 210 static int file_alloc_security(struct file *file)
 211 {
 212         struct task_security_struct *tsec = current->security;
 213         struct file_security_struct *fsec;
 214
 215         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 216         if (!fsec)
 217                 return -ENOMEM;
 218
 219         fsec->file = file;
 220         fsec->sid = tsec->sid;
 221         fsec->fown_sid = tsec->sid;
 222         file->f_security = fsec;
 223
 224         return 0;
 225 }
 226
 227 static void file_free_security(struct file *file)
 228 {
 229         struct file_security_struct *fsec = file->f_security;
 230         file->f_security = NULL;
 231         kfree(fsec);
 232 }
 233
 234 static int superblock_alloc_security(struct super_block *sb)
 235 {
 236         struct superblock_security_struct *sbsec;
 237
 238         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 239         if (!sbsec)
 240                 return -ENOMEM;
 241
 242         init_MUTEX(&sbsec->sem);
 243         INIT_LIST_HEAD(&sbsec->list);
 244         INIT_LIST_HEAD(&sbsec->isec_head);
 245         spin_lock_init(&sbsec->isec_lock);
 246         sbsec->sb = sb;
 247         sbsec->sid = SECINITSID_UNLABELED;
 248         sbsec->def_sid = SECINITSID_FILE;
 249         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 250         sb->s_security = sbsec;
 251
 252         return 0;
 253 }
 254
 255 static void superblock_free_security(struct super_block *sb)
 256 {
 257         struct superblock_security_struct *sbsec = sb->s_security;
 258
 259         spin_lock(&sb_security_lock);
 260         if (!list_empty(&sbsec->list))
 261                 list_del_init(&sbsec->list);
 262         spin_unlock(&sb_security_lock);
 263
 264         sb->s_security = NULL;
 265         kfree(sbsec);
 266 }
 267
 268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 269 {
 270         struct sk_security_struct *ssec;
 271
 272         if (family != PF_UNIX)
 273                 return 0;
 274
 275         ssec = kzalloc(sizeof(*ssec), priority);
 276         if (!ssec)
 277                 return -ENOMEM;
 278
 279         ssec->sk = sk;
 280         ssec->peer_sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         return 0;
 284 }
 285
 286 static void sk_free_security(struct sock *sk)
 287 {
 288         struct sk_security_struct *ssec = sk->sk_security;
 289
 290         if (sk->sk_family != PF_UNIX)
 291                 return;
 292
 293         sk->sk_security = NULL;
 294         kfree(ssec);
 295 }
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323         Opt_rootcontext = 8,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331 };
 332
 333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 334
 335 static int may_context_mount_sb_relabel(u32 sid,
 336                         struct superblock_security_struct *sbsec,
 337                         struct task_security_struct *tsec)
 338 {
 339         int rc;
 340
 341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 342                           FILESYSTEM__RELABELFROM, NULL);
 343         if (rc)
 344                 return rc;
 345
 346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 347                           FILESYSTEM__RELABELTO, NULL);
 348         return rc;
 349 }
 350
 351 static int may_context_mount_inode_relabel(u32 sid,
 352                         struct superblock_security_struct *sbsec,
 353                         struct task_security_struct *tsec)
 354 {
 355         int rc;
 356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 357                           FILESYSTEM__RELABELFROM, NULL);
 358         if (rc)
 359                 return rc;
 360
 361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 362                           FILESYSTEM__ASSOCIATE, NULL);
 363         return rc;
 364 }
 365
 366 static int try_context_mount(struct super_block *sb, void *data)
 367 {
 368         char *context = NULL, *defcontext = NULL;
 369         char *fscontext = NULL, *rootcontext = NULL;
 370         const char *name;
 371         u32 sid;
 372         int alloc = 0, rc = 0, seen = 0;
 373         struct task_security_struct *tsec = current->security;
 374         struct superblock_security_struct *sbsec = sb->s_security;
 375
 376         if (!data)
 377                 goto out;
 378
 379         name = sb->s_type->name;
 380
 381         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 382
 383                 /* NFS we understand. */
 384                 if (!strcmp(name, "nfs")) {
 385                         struct nfs_mount_data *d = data;
 386
 387                         if (d->version <  NFS_MOUNT_VERSION)
 388                                 goto out;
 389
 390                         if (d->context[0]) {
 391                                 context = d->context;
 392                                 seen |= Opt_context;
 393                         }
 394                 } else
 395                         goto out;
 396
 397         } else {
 398                 /* Standard string-based options. */
 399                 char *p, *options = data;
 400
 401                 while ((p = strsep(&options, ",")) != NULL) {
 402                         int token;
 403                         substring_t args[MAX_OPT_ARGS];
 404
 405                         if (!*p)
 406                                 continue;
 407
 408                         token = match_token(p, tokens, args);
 409
 410                         switch (token) {
 411                         case Opt_context:
 412                                 if (seen & (Opt_context|Opt_defcontext)) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 415                                         goto out_free;
 416                                 }
 417                                 context = match_strdup(&args[0]);
 418                                 if (!context) {
 419                                         rc = -ENOMEM;
 420                                         goto out_free;
 421                                 }
 422                                 if (!alloc)
 423                                         alloc = 1;
 424                                 seen |= Opt_context;
 425                                 break;
 426
 427                         case Opt_fscontext:
 428                                 if (seen & Opt_fscontext) {
 429                                         rc = -EINVAL;
 430                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 431                                         goto out_free;
 432                                 }
 433                                 fscontext = match_strdup(&args[0]);
 434                                 if (!fscontext) {
 435                                         rc = -ENOMEM;
 436                                         goto out_free;
 437                                 }
 438                                 if (!alloc)
 439                                         alloc = 1;
 440                                 seen |= Opt_fscontext;
 441                                 break;
 442
 443                         case Opt_rootcontext:
 444                                 if (seen & Opt_rootcontext) {
 445                                         rc = -EINVAL;
 446                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 447                                         goto out_free;
 448                                 }
 449                                 rootcontext = match_strdup(&args[0]);
 450                                 if (!rootcontext) {
 451                                         rc = -ENOMEM;
 452                                         goto out_free;
 453                                 }
 454                                 if (!alloc)
 455                                         alloc = 1;
 456                                 seen |= Opt_rootcontext;
 457                                 break;
 458
 459                         case Opt_defcontext:
 460                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 461                                         rc = -EINVAL;
 462                                         printk(KERN_WARNING "SELinux:  "
 463                                                "defcontext option is invalid "
 464                                                "for this filesystem type\n");
 465                                         goto out_free;
 466                                 }
 467                                 if (seen & (Opt_context|Opt_defcontext)) {
 468                                         rc = -EINVAL;
 469                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 470                                         goto out_free;
 471                                 }
 472                                 defcontext = match_strdup(&args[0]);
 473                                 if (!defcontext) {
 474                                         rc = -ENOMEM;
 475                                         goto out_free;
 476                                 }
 477                                 if (!alloc)
 478                                         alloc = 1;
 479                                 seen |= Opt_defcontext;
 480                                 break;
 481
 482                         default:
 483                                 rc = -EINVAL;
 484                                 printk(KERN_WARNING "SELinux:  unknown mount "
 485                                        "option\n");
 486                                 goto out_free;
 487
 488                         }
 489                 }
 490         }
 491
 492         if (!seen)
 493                 goto out;
 494
 495         /* sets the context of the superblock for the fs being mounted. */
 496         if (fscontext) {
 497                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 498                 if (rc) {
 499                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 500                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 501                                fscontext, sb->s_id, name, rc);
 502                         goto out_free;
 503                 }
 504
 505                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 506                 if (rc)
 507                         goto out_free;
 508
 509                 sbsec->sid = sid;
 510         }
 511
 512         /*
 513          * Switch to using mount point labeling behavior.
 514          * sets the label used on all file below the mountpoint, and will set
 515          * the superblock context if not already set.
 516          */
 517         if (context) {
 518                 rc = security_context_to_sid(context, strlen(context), &sid);
 519                 if (rc) {
 520                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 521                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 522                                context, sb->s_id, name, rc);
 523                         goto out_free;
 524                 }
 525
 526                 if (!fscontext) {
 527                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 528                         if (rc)
 529                                 goto out_free;
 530                         sbsec->sid = sid;
 531                 } else {
 532                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 533                         if (rc)
 534                                 goto out_free;
 535                 }
 536                 sbsec->mntpoint_sid = sid;
 537
 538                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 539         }
 540
 541         if (rootcontext) {
 542                 struct inode *inode = sb->s_root->d_inode;
 543                 struct inode_security_struct *isec = inode->i_security;
 544                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 545                 if (rc) {
 546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 548                                rootcontext, sb->s_id, name, rc);
 549                         goto out_free;
 550                 }
 551
 552                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 553                 if (rc)
 554                         goto out_free;
 555
 556                 isec->sid = sid;
 557                 isec->initialized = 1;
 558         }
 559
 560         if (defcontext) {
 561                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 562                 if (rc) {
 563                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 564                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 565                                defcontext, sb->s_id, name, rc);
 566                         goto out_free;
 567                 }
 568
 569                 if (sid == sbsec->def_sid)
 570                         goto out_free;
 571
 572                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 573                 if (rc)
 574                         goto out_free;
 575
 576                 sbsec->def_sid = sid;
 577         }
 578
 579 out_free:
 580         if (alloc) {
 581                 kfree(context);
 582                 kfree(defcontext);
 583                 kfree(fscontext);
 584                 kfree(rootcontext);
 585         }
 586 out:
 587         return rc;
 588 }
 589
 590 static int superblock_doinit(struct super_block *sb, void *data)
 591 {
 592         struct superblock_security_struct *sbsec = sb->s_security;
 593         struct dentry *root = sb->s_root;
 594         struct inode *inode = root->d_inode;
 595         int rc = 0;
 596
 597         down(&sbsec->sem);
 598         if (sbsec->initialized)
 599                 goto out;
 600
 601         if (!ss_initialized) {
 602                 /* Defer initialization until selinux_complete_init,
 603                    after the initial policy is loaded and the security
 604                    server is ready to handle calls. */
 605                 spin_lock(&sb_security_lock);
 606                 if (list_empty(&sbsec->list))
 607                         list_add(&sbsec->list, &superblock_security_head);
 608                 spin_unlock(&sb_security_lock);
 609                 goto out;
 610         }
 611
 612         /* Determine the labeling behavior to use for this filesystem type. */
 613         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 614         if (rc) {
 615                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 616                        __FUNCTION__, sb->s_type->name, rc);
 617                 goto out;
 618         }
 619
 620         rc = try_context_mount(sb, data);
 621         if (rc)
 622                 goto out;
 623
 624         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 625                 /* Make sure that the xattr handler exists and that no
 626                    error other than -ENODATA is returned by getxattr on
 627                    the root directory.  -ENODATA is ok, as this may be
 628                    the first boot of the SELinux kernel before we have
 629                    assigned xattr values to the filesystem. */
 630                 if (!inode->i_op->getxattr) {
 631                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 632                                "xattr support\n", sb->s_id, sb->s_type->name);
 633                         rc = -EOPNOTSUPP;
 634                         goto out;
 635                 }
 636                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 637                 if (rc < 0 && rc != -ENODATA) {
 638                         if (rc == -EOPNOTSUPP)
 639                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 640                                        "%s) has no security xattr handler\n",
 641                                        sb->s_id, sb->s_type->name);
 642                         else
 643                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 644                                        "%s) getxattr errno %d\n", sb->s_id,
 645                                        sb->s_type->name, -rc);
 646                         goto out;
 647                 }
 648         }
 649
 650         if (strcmp(sb->s_type->name, "proc") == 0)
 651                 sbsec->proc = 1;
 652
 653         sbsec->initialized = 1;
 654
 655         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 656                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 657                        sb->s_id, sb->s_type->name);
 658         }
 659         else {
 660                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 661                        sb->s_id, sb->s_type->name,
 662                        labeling_behaviors[sbsec->behavior-1]);
 663         }
 664
 665         /* Initialize the root inode. */
 666         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 667
 668         /* Initialize any other inodes associated with the superblock, e.g.
 669            inodes created prior to initial policy load or inodes created
 670            during get_sb by a pseudo filesystem that directly
 671            populates itself. */
 672         spin_lock(&sbsec->isec_lock);
 673 next_inode:
 674         if (!list_empty(&sbsec->isec_head)) {
 675                 struct inode_security_struct *isec =
 676                                 list_entry(sbsec->isec_head.next,
 677                                            struct inode_security_struct, list);
 678                 struct inode *inode = isec->inode;
 679                 spin_unlock(&sbsec->isec_lock);
 680                 inode = igrab(inode);
 681                 if (inode) {
 682                         if (!IS_PRIVATE (inode))
 683                                 inode_doinit(inode);
 684                         iput(inode);
 685                 }
 686                 spin_lock(&sbsec->isec_lock);
 687                 list_del_init(&isec->list);
 688                 goto next_inode;
 689         }
 690         spin_unlock(&sbsec->isec_lock);
 691 out:
 692         up(&sbsec->sem);
 693         return rc;
 694 }
 695
 696 static inline u16 inode_mode_to_security_class(umode_t mode)
 697 {
 698         switch (mode & S_IFMT) {
 699         case S_IFSOCK:
 700                 return SECCLASS_SOCK_FILE;
 701         case S_IFLNK:
 702                 return SECCLASS_LNK_FILE;
 703         case S_IFREG:
 704                 return SECCLASS_FILE;
 705         case S_IFBLK:
 706                 return SECCLASS_BLK_FILE;
 707         case S_IFDIR:
 708                 return SECCLASS_DIR;
 709         case S_IFCHR:
 710                 return SECCLASS_CHR_FILE;
 711         case S_IFIFO:
 712                 return SECCLASS_FIFO_FILE;
 713
 714         }
 715
 716         return SECCLASS_FILE;
 717 }
 718
 719 static inline int default_protocol_stream(int protocol)
 720 {
 721         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 722 }
 723
 724 static inline int default_protocol_dgram(int protocol)
 725 {
 726         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 727 }
 728
 729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 730 {
 731         switch (family) {
 732         case PF_UNIX:
 733                 switch (type) {
 734                 case SOCK_STREAM:
 735                 case SOCK_SEQPACKET:
 736                         return SECCLASS_UNIX_STREAM_SOCKET;
 737                 case SOCK_DGRAM:
 738                         return SECCLASS_UNIX_DGRAM_SOCKET;
 739                 }
 740                 break;
 741         case PF_INET:
 742         case PF_INET6:
 743                 switch (type) {
 744                 case SOCK_STREAM:
 745                         if (default_protocol_stream(protocol))
 746                                 return SECCLASS_TCP_SOCKET;
 747                         else
 748                                 return SECCLASS_RAWIP_SOCKET;
 749                 case SOCK_DGRAM:
 750                         if (default_protocol_dgram(protocol))
 751                                 return SECCLASS_UDP_SOCKET;
 752                         else
 753                                 return SECCLASS_RAWIP_SOCKET;
 754                 default:
 755                         return SECCLASS_RAWIP_SOCKET;
 756                 }
 757                 break;
 758         case PF_NETLINK:
 759                 switch (protocol) {
 760                 case NETLINK_ROUTE:
 761                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 762                 case NETLINK_FIREWALL:
 763                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 764                 case NETLINK_INET_DIAG:
 765                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 766                 case NETLINK_NFLOG:
 767                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 768                 case NETLINK_XFRM:
 769                         return SECCLASS_NETLINK_XFRM_SOCKET;
 770                 case NETLINK_SELINUX:
 771                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 772                 case NETLINK_AUDIT:
 773                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 774                 case NETLINK_IP6_FW:
 775                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 776                 case NETLINK_DNRTMSG:
 777                         return SECCLASS_NETLINK_DNRT_SOCKET;
 778                 case NETLINK_KOBJECT_UEVENT:
 779                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 780                 default:
 781                         return SECCLASS_NETLINK_SOCKET;
 782                 }
 783         case PF_PACKET:
 784                 return SECCLASS_PACKET_SOCKET;
 785         case PF_KEY:
 786                 return SECCLASS_KEY_SOCKET;
 787         case PF_APPLETALK:
 788                 return SECCLASS_APPLETALK_SOCKET;
 789         }
 790
 791         return SECCLASS_SOCKET;
 792 }
 793
 794 #ifdef CONFIG_PROC_FS
 795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 796                                 u16 tclass,
 797                                 u32 *sid)
 798 {
 799         int buflen, rc;
 800         char *buffer, *path, *end;
 801
 802         buffer = (char*)__get_free_page(GFP_KERNEL);
 803         if (!buffer)
 804                 return -ENOMEM;
 805
 806         buflen = PAGE_SIZE;
 807         end = buffer+buflen;
 808         *--end = '\0';
 809         buflen--;
 810         path = end-1;
 811         *path = '/';
 812         while (de && de != de->parent) {
 813                 buflen -= de->namelen + 1;
 814                 if (buflen < 0)
 815                         break;
 816                 end -= de->namelen;
 817                 memcpy(end, de->name, de->namelen);
 818                 *--end = '/';
 819                 path = end;
 820                 de = de->parent;
 821         }
 822         rc = security_genfs_sid("proc", path, tclass, sid);
 823         free_page((unsigned long)buffer);
 824         return rc;
 825 }
 826 #else
 827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 828                                 u16 tclass,
 829                                 u32 *sid)
 830 {
 831         return -EINVAL;
 832 }
 833 #endif
 834
 835 /* The inode's security attributes must be initialized before first use. */
 836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 837 {
 838         struct superblock_security_struct *sbsec = NULL;
 839         struct inode_security_struct *isec = inode->i_security;
 840         u32 sid;
 841         struct dentry *dentry;
 842 #define INITCONTEXTLEN 255
 843         char *context = NULL;
 844         unsigned len = 0;
 845         int rc = 0;
 846         int hold_sem = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         down(&isec->sem);
 852         hold_sem = 1;
 853         if (isec->initialized)
 854                 goto out;
 855
 856         sbsec = inode->i_sb->s_security;
 857         if (!sbsec->initialized) {
 858                 /* Defer initialization until selinux_complete_init,
 859                    after the initial policy is loaded and the security
 860                    server is ready to handle calls. */
 861                 spin_lock(&sbsec->isec_lock);
 862                 if (list_empty(&isec->list))
 863                         list_add(&isec->list, &sbsec->isec_head);
 864                 spin_unlock(&sbsec->isec_lock);
 865                 goto out;
 866         }
 867
 868         switch (sbsec->behavior) {
 869         case SECURITY_FS_USE_XATTR:
 870                 if (!inode->i_op->getxattr) {
 871                         isec->sid = sbsec->def_sid;
 872                         break;
 873                 }
 874
 875                 /* Need a dentry, since the xattr API requires one.
 876                    Life would be simpler if we could just pass the inode. */
 877                 if (opt_dentry) {
 878                         /* Called from d_instantiate or d_splice_alias. */
 879                         dentry = dget(opt_dentry);
 880                 } else {
 881                         /* Called from selinux_complete_init, try to find a dentry. */
 882                         dentry = d_find_alias(inode);
 883                 }
 884                 if (!dentry) {
 885                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 886                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 887                                inode->i_ino);
 888                         goto out;
 889                 }
 890
 891                 len = INITCONTEXTLEN;
 892                 context = kmalloc(len, GFP_KERNEL);
 893                 if (!context) {
 894                         rc = -ENOMEM;
 895                         dput(dentry);
 896                         goto out;
 897                 }
 898                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 899                                            context, len);
 900                 if (rc == -ERANGE) {
 901                         /* Need a larger buffer.  Query for the right size. */
 902                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 903                                                    NULL, 0);
 904                         if (rc < 0) {
 905                                 dput(dentry);
 906                                 goto out;
 907                         }
 908                         kfree(context);
 909                         len = rc;
 910                         context = kmalloc(len, GFP_KERNEL);
 911                         if (!context) {
 912                                 rc = -ENOMEM;
 913                                 dput(dentry);
 914                                 goto out;
 915                         }
 916                         rc = inode->i_op->getxattr(dentry,
 917                                                    XATTR_NAME_SELINUX,
 918                                                    context, len);
 919                 }
 920                 dput(dentry);
 921                 if (rc < 0) {
 922                         if (rc != -ENODATA) {
 923                                 printk(KERN_WARNING "%s:  getxattr returned "
 924                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 925                                        -rc, inode->i_sb->s_id, inode->i_ino);
 926                                 kfree(context);
 927                                 goto out;
 928                         }
 929                         /* Map ENODATA to the default file SID */
 930                         sid = sbsec->def_sid;
 931                         rc = 0;
 932                 } else {
 933                         rc = security_context_to_sid_default(context, rc, &sid,
 934                                                              sbsec->def_sid);
 935                         if (rc) {
 936                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 937                                        "returned %d for dev=%s ino=%ld\n",
 938                                        __FUNCTION__, context, -rc,
 939                                        inode->i_sb->s_id, inode->i_ino);
 940                                 kfree(context);
 941                                 /* Leave with the unlabeled SID */
 942                                 rc = 0;
 943                                 break;
 944                         }
 945                 }
 946                 kfree(context);
 947                 isec->sid = sid;
 948                 break;
 949         case SECURITY_FS_USE_TASK:
 950                 isec->sid = isec->task_sid;
 951                 break;
 952         case SECURITY_FS_USE_TRANS:
 953                 /* Default to the fs SID. */
 954                 isec->sid = sbsec->sid;
 955
 956                 /* Try to obtain a transition SID. */
 957                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 958                 rc = security_transition_sid(isec->task_sid,
 959                                              sbsec->sid,
 960                                              isec->sclass,
 961                                              &sid);
 962                 if (rc)
 963                         goto out;
 964                 isec->sid = sid;
 965                 break;
 966         case SECURITY_FS_USE_MNTPOINT:
 967                 isec->sid = sbsec->mntpoint_sid;
 968                 break;
 969         default:
 970                 /* Default to the fs superblock SID. */
 971                 isec->sid = sbsec->sid;
 972
 973                 if (sbsec->proc) {
 974                         struct proc_inode *proci = PROC_I(inode);
 975                         if (proci->pde) {
 976                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 977                                 rc = selinux_proc_get_sid(proci->pde,
 978                                                           isec->sclass,
 979                                                           &sid);
 980                                 if (rc)
 981                                         goto out;
 982                                 isec->sid = sid;
 983                         }
 984                 }
 985                 break;
 986         }
 987
 988         isec->initialized = 1;
 989
 990 out:
 991         if (isec->sclass == SECCLASS_FILE)
 992                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 993
 994         if (hold_sem)
 995                 up(&isec->sem);
 996         return rc;
 997 }
 998
 999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1001 {
1002         u32 perm = 0;
1003
1004         switch (sig) {
1005         case SIGCHLD:
1006                 /* Commonly granted from child to parent. */
1007                 perm = PROCESS__SIGCHLD;
1008                 break;
1009         case SIGKILL:
1010                 /* Cannot be caught or ignored */
1011                 perm = PROCESS__SIGKILL;
1012                 break;
1013         case SIGSTOP:
1014                 /* Cannot be caught or ignored */
1015                 perm = PROCESS__SIGSTOP;
1016                 break;
1017         default:
1018                 /* All other signals. */
1019                 perm = PROCESS__SIGNAL;
1020                 break;
1021         }
1022
1023         return perm;
1024 }
1025
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027    fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029                          struct task_struct *tsk2,
1030                          u32 perms)
1031 {
1032         struct task_security_struct *tsec1, *tsec2;
1033
1034         tsec1 = tsk1->security;
1035         tsec2 = tsk2->security;
1036         return avc_has_perm(tsec1->sid, tsec2->sid,
1037                             SECCLASS_PROCESS, perms, NULL);
1038 }
1039
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1042                                int cap)
1043 {
1044         struct task_security_struct *tsec;
1045         struct avc_audit_data ad;
1046
1047         tsec = tsk->security;
1048
1049         AVC_AUDIT_DATA_INIT(&ad,CAP);
1050         ad.tsk = tsk;
1051         ad.u.cap = cap;
1052
1053         return avc_has_perm(tsec->sid, tsec->sid,
1054                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1055 }
1056
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1059                            u32 perms)
1060 {
1061         struct task_security_struct *tsec;
1062
1063         tsec = tsk->security;
1064
1065         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066                             SECCLASS_SYSTEM, perms, NULL);
1067 }
1068
1069 /* Check whether a task has a particular permission to an inode.
1070    The 'adp' parameter is optional and allows other audit
1071    data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073                           struct inode *inode,
1074                           u32 perms,
1075                           struct avc_audit_data *adp)
1076 {
1077         struct task_security_struct *tsec;
1078         struct inode_security_struct *isec;
1079         struct avc_audit_data ad;
1080
1081         tsec = tsk->security;
1082         isec = inode->i_security;
1083
1084         if (!adp) {
1085                 adp = &ad;
1086                 AVC_AUDIT_DATA_INIT(&ad, FS);
1087                 ad.u.fs.inode = inode;
1088         }
1089
1090         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1091 }
1092
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094    the dentry to help the auditing code to more easily generate the
1095    pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097                                   struct vfsmount *mnt,
1098                                   struct dentry *dentry,
1099                                   u32 av)
1100 {
1101         struct inode *inode = dentry->d_inode;
1102         struct avc_audit_data ad;
1103         AVC_AUDIT_DATA_INIT(&ad,FS);
1104         ad.u.fs.mnt = mnt;
1105         ad.u.fs.dentry = dentry;
1106         return inode_has_perm(tsk, inode, av, &ad);
1107 }
1108
1109 /* Check whether a task can use an open file descriptor to
1110    access an inode in a given way.  Check access to the
1111    descriptor itself, and then use dentry_has_perm to
1112    check a particular permission to the file.
1113    Access to the descriptor is implicitly granted if it
1114    has the same SID as the process.  If av is zero, then
1115    access to the file is not checked, e.g. for cases
1116    where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1118                                 struct file *file,
1119                                 u32 av)
1120 {
1121         struct task_security_struct *tsec = tsk->security;
1122         struct file_security_struct *fsec = file->f_security;
1123         struct vfsmount *mnt = file->f_vfsmnt;
1124         struct dentry *dentry = file->f_dentry;
1125         struct inode *inode = dentry->d_inode;
1126         struct avc_audit_data ad;
1127         int rc;
1128
1129         AVC_AUDIT_DATA_INIT(&ad, FS);
1130         ad.u.fs.mnt = mnt;
1131         ad.u.fs.dentry = dentry;
1132
1133         if (tsec->sid != fsec->sid) {
1134                 rc = avc_has_perm(tsec->sid, fsec->sid,
1135                                   SECCLASS_FD,
1136                                   FD__USE,
1137                                   &ad);
1138                 if (rc)
1139                         return rc;
1140         }
1141
1142         /* av is zero if only checking access to the descriptor. */
1143         if (av)
1144                 return inode_has_perm(tsk, inode, av, &ad);
1145
1146         return 0;
1147 }
1148
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151                       struct dentry *dentry,
1152                       u16 tclass)
1153 {
1154         struct task_security_struct *tsec;
1155         struct inode_security_struct *dsec;
1156         struct superblock_security_struct *sbsec;
1157         u32 newsid;
1158         struct avc_audit_data ad;
1159         int rc;
1160
1161         tsec = current->security;
1162         dsec = dir->i_security;
1163         sbsec = dir->i_sb->s_security;
1164
1165         AVC_AUDIT_DATA_INIT(&ad, FS);
1166         ad.u.fs.dentry = dentry;
1167
1168         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169                           DIR__ADD_NAME | DIR__SEARCH,
1170                           &ad);
1171         if (rc)
1172                 return rc;
1173
1174         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175                 newsid = tsec->create_sid;
1176         } else {
1177                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1178                                              &newsid);
1179                 if (rc)
1180                         return rc;
1181         }
1182
1183         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1184         if (rc)
1185                 return rc;
1186
1187         return avc_has_perm(newsid, sbsec->sid,
1188                             SECCLASS_FILESYSTEM,
1189                             FILESYSTEM__ASSOCIATE, &ad);
1190 }
1191
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194                           struct task_struct *ctx)
1195 {
1196         struct task_security_struct *tsec;
1197
1198         tsec = ctx->security;
1199
1200         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1201 }
1202
1203 #define MAY_LINK   0
1204 #define MAY_UNLINK 1
1205 #define MAY_RMDIR  2
1206
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209                     struct dentry *dentry,
1210                     int kind)
1211
1212 {
1213         struct task_security_struct *tsec;
1214         struct inode_security_struct *dsec, *isec;
1215         struct avc_audit_data ad;
1216         u32 av;
1217         int rc;
1218
1219         tsec = current->security;
1220         dsec = dir->i_security;
1221         isec = dentry->d_inode->i_security;
1222
1223         AVC_AUDIT_DATA_INIT(&ad, FS);
1224         ad.u.fs.dentry = dentry;
1225
1226         av = DIR__SEARCH;
1227         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1229         if (rc)
1230                 return rc;
1231
1232         switch (kind) {
1233         case MAY_LINK:
1234                 av = FILE__LINK;
1235                 break;
1236         case MAY_UNLINK:
1237                 av = FILE__UNLINK;
1238                 break;
1239         case MAY_RMDIR:
1240                 av = DIR__RMDIR;
1241                 break;
1242         default:
1243                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1244                 return 0;
1245         }
1246
1247         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1248         return rc;
1249 }
1250
1251 static inline int may_rename(struct inode *old_dir,
1252                              struct dentry *old_dentry,
1253                              struct inode *new_dir,
1254                              struct dentry *new_dentry)
1255 {
1256         struct task_security_struct *tsec;
1257         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258         struct avc_audit_data ad;
1259         u32 av;
1260         int old_is_dir, new_is_dir;
1261         int rc;
1262
1263         tsec = current->security;
1264         old_dsec = old_dir->i_security;
1265         old_isec = old_dentry->d_inode->i_security;
1266         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267         new_dsec = new_dir->i_security;
1268
1269         AVC_AUDIT_DATA_INIT(&ad, FS);
1270
1271         ad.u.fs.dentry = old_dentry;
1272         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1274         if (rc)
1275                 return rc;
1276         rc = avc_has_perm(tsec->sid, old_isec->sid,
1277                           old_isec->sclass, FILE__RENAME, &ad);
1278         if (rc)
1279                 return rc;
1280         if (old_is_dir && new_dir != old_dir) {
1281                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282                                   old_isec->sclass, DIR__REPARENT, &ad);
1283                 if (rc)
1284                         return rc;
1285         }
1286
1287         ad.u.fs.dentry = new_dentry;
1288         av = DIR__ADD_NAME | DIR__SEARCH;
1289         if (new_dentry->d_inode)
1290                 av |= DIR__REMOVE_NAME;
1291         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1292         if (rc)
1293                 return rc;
1294         if (new_dentry->d_inode) {
1295                 new_isec = new_dentry->d_inode->i_security;
1296                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1298                                   new_isec->sclass,
1299                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1300                 if (rc)
1301                         return rc;
1302         }
1303
1304         return 0;
1305 }
1306
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309                                struct super_block *sb,
1310                                u32 perms,
1311                                struct avc_audit_data *ad)
1312 {
1313         struct task_security_struct *tsec;
1314         struct superblock_security_struct *sbsec;
1315
1316         tsec = tsk->security;
1317         sbsec = sb->s_security;
1318         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1319                             perms, ad);
1320 }
1321
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1324 {
1325         u32 av = 0;
1326
1327         if ((mode & S_IFMT) != S_IFDIR) {
1328                 if (mask & MAY_EXEC)
1329                         av |= FILE__EXECUTE;
1330                 if (mask & MAY_READ)
1331                         av |= FILE__READ;
1332
1333                 if (mask & MAY_APPEND)
1334                         av |= FILE__APPEND;
1335                 else if (mask & MAY_WRITE)
1336                         av |= FILE__WRITE;
1337
1338         } else {
1339                 if (mask & MAY_EXEC)
1340                         av |= DIR__SEARCH;
1341                 if (mask & MAY_WRITE)
1342                         av |= DIR__WRITE;
1343                 if (mask & MAY_READ)
1344                         av |= DIR__READ;
1345         }
1346
1347         return av;
1348 }
1349
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1352 {
1353         u32 av = 0;
1354
1355         if (file->f_mode & FMODE_READ)
1356                 av |= FILE__READ;
1357         if (file->f_mode & FMODE_WRITE) {
1358                 if (file->f_flags & O_APPEND)
1359                         av |= FILE__APPEND;
1360                 else
1361                         av |= FILE__WRITE;
1362         }
1363
1364         return av;
1365 }
1366
1367 /* Set an inode's SID to a specified value. */
1368 static int inode_security_set_sid(struct inode *inode, u32 sid)
1369 {
1370         struct inode_security_struct *isec = inode->i_security;
1371         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1372
1373         if (!sbsec->initialized) {
1374                 /* Defer initialization to selinux_complete_init. */
1375                 return 0;
1376         }
1377
1378         down(&isec->sem);
1379         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1380         isec->sid = sid;
1381         isec->initialized = 1;
1382         up(&isec->sem);
1383         return 0;
1384 }
1385
1386 /* Hook functions begin here. */
1387
1388 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1389 {
1390         int rc;
1391
1392         rc = secondary_ops->ptrace(parent,child);
1393         if (rc)
1394                 return rc;
1395
1396         return task_has_perm(parent, child, PROCESS__PTRACE);
1397 }
1398
1399 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1400                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402         int error;
1403
1404         error = task_has_perm(current, target, PROCESS__GETCAP);
1405         if (error)
1406                 return error;
1407
1408         return secondary_ops->capget(target, effective, inheritable, permitted);
1409 }
1410
1411 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1412                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414         int error;
1415
1416         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1417         if (error)
1418                 return error;
1419
1420         return task_has_perm(current, target, PROCESS__SETCAP);
1421 }
1422
1423 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1424                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1425 {
1426         secondary_ops->capset_set(target, effective, inheritable, permitted);
1427 }
1428
1429 static int selinux_capable(struct task_struct *tsk, int cap)
1430 {
1431         int rc;
1432
1433         rc = secondary_ops->capable(tsk, cap);
1434         if (rc)
1435                 return rc;
1436
1437         return task_has_capability(tsk,cap);
1438 }
1439
1440 static int selinux_sysctl(ctl_table *table, int op)
1441 {
1442         int error = 0;
1443         u32 av;
1444         struct task_security_struct *tsec;
1445         u32 tsid;
1446         int rc;
1447
1448         rc = secondary_ops->sysctl(table, op);
1449         if (rc)
1450                 return rc;
1451
1452         tsec = current->security;
1453
1454         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1455                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1456         if (rc) {
1457                 /* Default to the well-defined sysctl SID. */
1458                 tsid = SECINITSID_SYSCTL;
1459         }
1460
1461         /* The op values are "defined" in sysctl.c, thereby creating
1462          * a bad coupling between this module and sysctl.c */
1463         if(op == 001) {
1464                 error = avc_has_perm(tsec->sid, tsid,
1465                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1466         } else {
1467                 av = 0;
1468                 if (op & 004)
1469                         av |= FILE__READ;
1470                 if (op & 002)
1471                         av |= FILE__WRITE;
1472                 if (av)
1473                         error = avc_has_perm(tsec->sid, tsid,
1474                                              SECCLASS_FILE, av, NULL);
1475         }
1476
1477         return error;
1478 }
1479
1480 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1481 {
1482         int rc = 0;
1483
1484         if (!sb)
1485                 return 0;
1486
1487         switch (cmds) {
1488                 case Q_SYNC:
1489                 case Q_QUOTAON:
1490                 case Q_QUOTAOFF:
1491                 case Q_SETINFO:
1492                 case Q_SETQUOTA:
1493                         rc = superblock_has_perm(current,
1494                                                  sb,
1495                                                  FILESYSTEM__QUOTAMOD, NULL);
1496                         break;
1497                 case Q_GETFMT:
1498                 case Q_GETINFO:
1499                 case Q_GETQUOTA:
1500                         rc = superblock_has_perm(current,
1501                                                  sb,
1502                                                  FILESYSTEM__QUOTAGET, NULL);
1503                         break;
1504                 default:
1505                         rc = 0;  /* let the kernel handle invalid cmds */
1506                         break;
1507         }
1508         return rc;
1509 }
1510
1511 static int selinux_quota_on(struct dentry *dentry)
1512 {
1513         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1514 }
1515
1516 static int selinux_syslog(int type)
1517 {
1518         int rc;
1519
1520         rc = secondary_ops->syslog(type);
1521         if (rc)
1522                 return rc;
1523
1524         switch (type) {
1525                 case 3:         /* Read last kernel messages */
1526                 case 10:        /* Return size of the log buffer */
1527                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1528                         break;
1529                 case 6:         /* Disable logging to console */
1530                 case 7:         /* Enable logging to console */
1531                 case 8:         /* Set level of messages printed to console */
1532                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1533                         break;
1534                 case 0:         /* Close log */
1535                 case 1:         /* Open log */
1536                 case 2:         /* Read from log */
1537                 case 4:         /* Read/clear last kernel messages */
1538                 case 5:         /* Clear ring buffer */
1539                 default:
1540                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1541                         break;
1542         }
1543         return rc;
1544 }
1545
1546 /*
1547  * Check that a process has enough memory to allocate a new virtual
1548  * mapping. 0 means there is enough memory for the allocation to
1549  * succeed and -ENOMEM implies there is not.
1550  *
1551  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1552  * if the capability is granted, but __vm_enough_memory requires 1 if
1553  * the capability is granted.
1554  *
1555  * Do not audit the selinux permission check, as this is applied to all
1556  * processes that allocate mappings.
1557  */
1558 static int selinux_vm_enough_memory(long pages)
1559 {
1560         int rc, cap_sys_admin = 0;
1561         struct task_security_struct *tsec = current->security;
1562
1563         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1564         if (rc == 0)
1565                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1566                                         SECCLASS_CAPABILITY,
1567                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1568                                         NULL);
1569
1570         if (rc == 0)
1571                 cap_sys_admin = 1;
1572
1573         return __vm_enough_memory(pages, cap_sys_admin);
1574 }
1575
1576 /* binprm security operations */
1577
1578 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1579 {
1580         struct bprm_security_struct *bsec;
1581
1582         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1583         if (!bsec)
1584                 return -ENOMEM;
1585
1586         bsec->bprm = bprm;
1587         bsec->sid = SECINITSID_UNLABELED;
1588         bsec->set = 0;
1589
1590         bprm->security = bsec;
1591         return 0;
1592 }
1593
1594 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1595 {
1596         struct task_security_struct *tsec;
1597         struct inode *inode = bprm->file->f_dentry->d_inode;
1598         struct inode_security_struct *isec;
1599         struct bprm_security_struct *bsec;
1600         u32 newsid;
1601         struct avc_audit_data ad;
1602         int rc;
1603
1604         rc = secondary_ops->bprm_set_security(bprm);
1605         if (rc)
1606                 return rc;
1607
1608         bsec = bprm->security;
1609
1610         if (bsec->set)
1611                 return 0;
1612
1613         tsec = current->security;
1614         isec = inode->i_security;
1615
1616         /* Default to the current task SID. */
1617         bsec->sid = tsec->sid;
1618
1619         /* Reset fs, key, and sock SIDs on execve. */
1620         tsec->create_sid = 0;
1621         tsec->keycreate_sid = 0;
1622         tsec->sockcreate_sid = 0;
1623
1624         if (tsec->exec_sid) {
1625                 newsid = tsec->exec_sid;
1626                 /* Reset exec SID on execve. */
1627                 tsec->exec_sid = 0;
1628         } else {
1629                 /* Check for a default transition on this program. */
1630                 rc = security_transition_sid(tsec->sid, isec->sid,
1631                                              SECCLASS_PROCESS, &newsid);
1632                 if (rc)
1633                         return rc;
1634         }
1635
1636         AVC_AUDIT_DATA_INIT(&ad, FS);
1637         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1638         ad.u.fs.dentry = bprm->file->f_dentry;
1639
1640         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1641                 newsid = tsec->sid;
1642
1643         if (tsec->sid == newsid) {
1644                 rc = avc_has_perm(tsec->sid, isec->sid,
1645                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1646                 if (rc)
1647                         return rc;
1648         } else {
1649                 /* Check permissions for the transition. */
1650                 rc = avc_has_perm(tsec->sid, newsid,
1651                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1652                 if (rc)
1653                         return rc;
1654
1655                 rc = avc_has_perm(newsid, isec->sid,
1656                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1657                 if (rc)
1658                         return rc;
1659
1660                 /* Clear any possibly unsafe personality bits on exec: */
1661                 current->personality &= ~PER_CLEAR_ON_SETID;
1662
1663                 /* Set the security field to the new SID. */
1664                 bsec->sid = newsid;
1665         }
1666
1667         bsec->set = 1;
1668         return 0;
1669 }
1670
1671 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1672 {
1673         return secondary_ops->bprm_check_security(bprm);
1674 }
1675
1676
1677 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1678 {
1679         struct task_security_struct *tsec = current->security;
1680         int atsecure = 0;
1681
1682         if (tsec->osid != tsec->sid) {
1683                 /* Enable secure mode for SIDs transitions unless
1684                    the noatsecure permission is granted between
1685                    the two SIDs, i.e. ahp returns 0. */
1686                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1687                                          SECCLASS_PROCESS,
1688                                          PROCESS__NOATSECURE, NULL);
1689         }
1690
1691         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1692 }
1693
1694 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1695 {
1696         kfree(bprm->security);
1697         bprm->security = NULL;
1698 }
1699
1700 extern struct vfsmount *selinuxfs_mount;
1701 extern struct dentry *selinux_null;
1702
1703 /* Derived from fs/exec.c:flush_old_files. */
1704 static inline void flush_unauthorized_files(struct files_struct * files)
1705 {
1706         struct avc_audit_data ad;
1707         struct file *file, *devnull = NULL;
1708         struct tty_struct *tty;
1709         struct fdtable *fdt;
1710         long j = -1;
1711         int drop_tty = 0;
1712
1713         mutex_lock(&tty_mutex);
1714         tty = get_current_tty();
1715         if (tty) {
1716                 file_list_lock();
1717                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1718                 if (file) {
1719                         /* Revalidate access to controlling tty.
1720                            Use inode_has_perm on the tty inode directly rather
1721                            than using file_has_perm, as this particular open
1722                            file may belong to another process and we are only
1723                            interested in the inode-based check here. */
1724                         struct inode *inode = file->f_dentry->d_inode;
1725                         if (inode_has_perm(current, inode,
1726                                            FILE__READ | FILE__WRITE, NULL)) {
1727                                 drop_tty = 1;
1728                         }
1729                 }
1730                 file_list_unlock();
1731
1732                 /* Reset controlling tty. */
1733                 if (drop_tty)
1734                         proc_set_tty(current, NULL);
1735         }
1736         mutex_unlock(&tty_mutex);
1737
1738         /* Revalidate access to inherited open files. */
1739
1740         AVC_AUDIT_DATA_INIT(&ad,FS);
1741
1742         spin_lock(&files->file_lock);
1743         for (;;) {
1744                 unsigned long set, i;
1745                 int fd;
1746
1747                 j++;
1748                 i = j * __NFDBITS;
1749                 fdt = files_fdtable(files);
1750                 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1751                         break;
1752                 set = fdt->open_fds->fds_bits[j];
1753                 if (!set)
1754                         continue;
1755                 spin_unlock(&files->file_lock);
1756                 for ( ; set ; i++,set >>= 1) {
1757                         if (set & 1) {
1758                                 file = fget(i);
1759                                 if (!file)
1760                                         continue;
1761                                 if (file_has_perm(current,
1762                                                   file,
1763                                                   file_to_av(file))) {
1764                                         sys_close(i);
1765                                         fd = get_unused_fd();
1766                                         if (fd != i) {
1767                                                 if (fd >= 0)
1768                                                         put_unused_fd(fd);
1769                                                 fput(file);
1770                                                 continue;
1771                                         }
1772                                         if (devnull) {
1773                                                 get_file(devnull);
1774                                         } else {
1775                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1776                                                 if (!devnull) {
1777                                                         put_unused_fd(fd);
1778                                                         fput(file);
1779                                                         continue;
1780                                                 }
1781                                         }
1782                                         fd_install(fd, devnull);
1783                                 }
1784                                 fput(file);
1785                         }
1786                 }
1787                 spin_lock(&files->file_lock);
1788
1789         }
1790         spin_unlock(&files->file_lock);
1791 }
1792
1793 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1794 {
1795         struct task_security_struct *tsec;
1796         struct bprm_security_struct *bsec;
1797         u32 sid;
1798         int rc;
1799
1800         secondary_ops->bprm_apply_creds(bprm, unsafe);
1801
1802         tsec = current->security;
1803
1804         bsec = bprm->security;
1805         sid = bsec->sid;
1806
1807         tsec->osid = tsec->sid;
1808         bsec->unsafe = 0;
1809         if (tsec->sid != sid) {
1810                 /* Check for shared state.  If not ok, leave SID
1811                    unchanged and kill. */
1812                 if (unsafe & LSM_UNSAFE_SHARE) {
1813                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1814                                         PROCESS__SHARE, NULL);
1815                         if (rc) {
1816                                 bsec->unsafe = 1;
1817                                 return;
1818                         }
1819                 }
1820
1821                 /* Check for ptracing, and update the task SID if ok.
1822                    Otherwise, leave SID unchanged and kill. */
1823                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1824                         struct task_struct *t;
1825
1826                         rcu_read_lock();
1827                         t = tracehook_tracer_task(current);
1828                         if (unlikely(t == NULL))
1829                                 rcu_read_unlock();
1830                         else {
1831                                 struct task_security_struct *sec = t->security;
1832                                 u32 ptsid = sec->sid;
1833                                 rcu_read_unlock();
1834
1835                                 rc = avc_has_perm(ptsid, sid,
1836                                                   SECCLASS_PROCESS,
1837                                                   PROCESS__PTRACE, NULL);
1838                                 if (rc) {
1839                                         bsec->unsafe = 1;
1840                                         return;
1841                                 }
1842                         }
1843                 }
1844                 tsec->sid = sid;
1845         }
1846 }
1847
1848 /*
1849  * called after apply_creds without the task lock held
1850  */
1851 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1852 {
1853         struct task_security_struct *tsec;
1854         struct rlimit *rlim, *initrlim;
1855         struct itimerval itimer;
1856         struct bprm_security_struct *bsec;
1857         int rc, i;
1858
1859         tsec = current->security;
1860         bsec = bprm->security;
1861
1862         if (bsec->unsafe) {
1863                 force_sig_specific(SIGKILL, current);
1864                 return;
1865         }
1866         if (tsec->osid == tsec->sid)
1867                 return;
1868
1869         /* Close files for which the new task SID is not authorized. */
1870         flush_unauthorized_files(current->files);
1871
1872         /* Check whether the new SID can inherit signal state
1873            from the old SID.  If not, clear itimers to avoid
1874            subsequent signal generation and flush and unblock
1875            signals. This must occur _after_ the task SID has
1876           been updated so that any kill done after the flush
1877           will be checked against the new SID. */
1878         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1879                           PROCESS__SIGINH, NULL);
1880         if (rc) {
1881                 memset(&itimer, 0, sizeof itimer);
1882                 for (i = 0; i < 3; i++)
1883                         do_setitimer(i, &itimer, NULL);
1884                 flush_signals(current);
1885                 spin_lock_irq(&current->sighand->siglock);
1886                 flush_signal_handlers(current, 1);
1887                 sigemptyset(&current->blocked);
1888                 recalc_sigpending();
1889                 spin_unlock_irq(&current->sighand->siglock);
1890         }
1891
1892         /* Check whether the new SID can inherit resource limits
1893            from the old SID.  If not, reset all soft limits to
1894            the lower of the current task's hard limit and the init
1895            task's soft limit.  Note that the setting of hard limits
1896            (even to lower them) can be controlled by the setrlimit
1897            check. The inclusion of the init task's soft limit into
1898            the computation is to avoid resetting soft limits higher
1899            than the default soft limit for cases where the default
1900            is lower than the hard limit, e.g. RLIMIT_CORE or
1901            RLIMIT_STACK.*/
1902         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1903                           PROCESS__RLIMITINH, NULL);
1904         if (rc) {
1905                 for (i = 0; i < RLIM_NLIMITS; i++) {
1906                         rlim = current->signal->rlim + i;
1907                         initrlim = init_task.signal->rlim+i;
1908                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1909                 }
1910                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1911                         /*
1912                          * This will cause RLIMIT_CPU calculations
1913                          * to be refigured.
1914                          */
1915                         current->it_prof_expires = jiffies_to_cputime(1);
1916                 }
1917         }
1918
1919         /* Wake up the parent if it is waiting so that it can
1920            recheck wait permission to the new task SID. */
1921         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1922 }
1923
1924 /* superblock security operations */
1925
1926 static int selinux_sb_alloc_security(struct super_block *sb)
1927 {
1928         return superblock_alloc_security(sb);
1929 }
1930
1931 static void selinux_sb_free_security(struct super_block *sb)
1932 {
1933         superblock_free_security(sb);
1934 }
1935
1936 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1937 {
1938         if (plen > olen)
1939                 return 0;
1940
1941         return !memcmp(prefix, option, plen);
1942 }
1943
1944 static inline int selinux_option(char *option, int len)
1945 {
1946         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1947                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1948                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1949                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1950 }
1951
1952 static inline void take_option(char **to, char *from, int *first, int len)
1953 {
1954         if (!*first) {
1955                 **to = ',';
1956                 *to += 1;
1957         }
1958         else
1959                 *first = 0;
1960         memcpy(*to, from, len);
1961         *to += len;
1962 }
1963
1964 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1965 {
1966         int fnosec, fsec, rc = 0;
1967         char *in_save, *in_curr, *in_end;
1968         char *sec_curr, *nosec_save, *nosec;
1969
1970         in_curr = orig;
1971         sec_curr = copy;
1972
1973         /* Binary mount data: just copy */
1974         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1975                 copy_page(sec_curr, in_curr);
1976                 goto out;
1977         }
1978
1979         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1980         if (!nosec) {
1981                 rc = -ENOMEM;
1982                 goto out;
1983         }
1984
1985         nosec_save = nosec;
1986         fnosec = fsec = 1;
1987         in_save = in_end = orig;
1988
1989         do {
1990                 if (*in_end == ',' || *in_end == '\0') {
1991                         int len = in_end - in_curr;
1992
1993                         if (selinux_option(in_curr, len))
1994                                 take_option(&sec_curr, in_curr, &fsec, len);
1995                         else
1996                                 take_option(&nosec, in_curr, &fnosec, len);
1997
1998                         in_curr = in_end + 1;
1999                 }
2000         } while (*in_end++);
2001
2002         strcpy(in_save, nosec_save);
2003         free_page((unsigned long)nosec_save);
2004 out:
2005         return rc;
2006 }
2007
2008 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2009 {
2010         struct avc_audit_data ad;
2011         int rc;
2012
2013         rc = superblock_doinit(sb, data);
2014         if (rc)
2015                 return rc;
2016
2017         AVC_AUDIT_DATA_INIT(&ad,FS);
2018         ad.u.fs.dentry = sb->s_root;
2019         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2020 }
2021
2022 static int selinux_sb_statfs(struct dentry *dentry)
2023 {
2024         struct avc_audit_data ad;
2025
2026         AVC_AUDIT_DATA_INIT(&ad,FS);
2027         ad.u.fs.dentry = dentry->d_sb->s_root;
2028         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2029 }
2030
2031 static int selinux_mount(char * dev_name,
2032                          struct nameidata *nd,
2033                          char * type,
2034                          unsigned long flags,
2035                          void * data)
2036 {
2037         int rc;
2038
2039         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2040         if (rc)
2041                 return rc;
2042
2043         if (flags & MS_REMOUNT)
2044                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2045                                            FILESYSTEM__REMOUNT, NULL);
2046         else
2047                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2048                                        FILE__MOUNTON);
2049 }
2050
2051 static int selinux_umount(struct vfsmount *mnt, int flags)
2052 {
2053         int rc;
2054
2055         rc = secondary_ops->sb_umount(mnt, flags);
2056         if (rc)
2057                 return rc;
2058
2059         return superblock_has_perm(current,mnt->mnt_sb,
2060                                    FILESYSTEM__UNMOUNT,NULL);
2061 }
2062
2063 /* inode security operations */
2064
2065 static int selinux_inode_alloc_security(struct inode *inode)
2066 {
2067         return inode_alloc_security(inode);
2068 }
2069
2070 static void selinux_inode_free_security(struct inode *inode)
2071 {
2072         inode_free_security(inode);
2073 }
2074
2075 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2076                                        char **name, void **value,
2077                                        size_t *len)
2078 {
2079         struct task_security_struct *tsec;
2080         struct inode_security_struct *dsec;
2081         struct superblock_security_struct *sbsec;
2082         u32 newsid, clen;
2083         int rc;
2084         char *namep = NULL, *context;
2085
2086         tsec = current->security;
2087         dsec = dir->i_security;
2088         sbsec = dir->i_sb->s_security;
2089
2090         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2091                 newsid = tsec->create_sid;
2092         } else {
2093                 rc = security_transition_sid(tsec->sid, dsec->sid,
2094                                              inode_mode_to_security_class(inode->i_mode),
2095                                              &newsid);
2096                 if (rc) {
2097                         printk(KERN_WARNING "%s:  "
2098                                "security_transition_sid failed, rc=%d (dev=%s "
2099                                "ino=%ld)\n",
2100                                __FUNCTION__,
2101                                -rc, inode->i_sb->s_id, inode->i_ino);
2102                         return rc;
2103                 }
2104         }
2105
2106         inode_security_set_sid(inode, newsid);
2107
2108         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2109                 return -EOPNOTSUPP;
2110
2111         if (name) {
2112                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2113                 if (!namep)
2114                         return -ENOMEM;
2115                 *name = namep;
2116         }
2117
2118         if (value && len) {
2119                 rc = security_sid_to_context(newsid, &context, &clen);
2120                 if (rc) {
2121                         kfree(namep);
2122                         return rc;
2123                 }
2124                 *value = context;
2125                 *len = clen;
2126         }
2127
2128         return 0;
2129 }
2130
2131 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2132 {
2133         return may_create(dir, dentry, SECCLASS_FILE);
2134 }
2135
2136 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2137 {
2138         int rc;
2139
2140         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2141         if (rc)
2142                 return rc;
2143         return may_link(dir, old_dentry, MAY_LINK);
2144 }
2145
2146 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2147 {
2148         int rc;
2149
2150         rc = secondary_ops->inode_unlink(dir, dentry);
2151         if (rc)
2152                 return rc;
2153         return may_link(dir, dentry, MAY_UNLINK);
2154 }
2155
2156 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2157 {
2158         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2159 }
2160
2161 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2162 {
2163         return may_create(dir, dentry, SECCLASS_DIR);
2164 }
2165
2166 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2167 {
2168         return may_link(dir, dentry, MAY_RMDIR);
2169 }
2170
2171 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2172 {
2173         int rc;
2174
2175         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2176         if (rc)
2177                 return rc;
2178
2179         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2180 }
2181
2182 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2183                                 struct inode *new_inode, struct dentry *new_dentry)
2184 {
2185         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2186 }
2187
2188 static int selinux_inode_readlink(struct dentry *dentry)
2189 {
2190         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2191 }
2192
2193 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2194 {
2195         int rc;
2196
2197         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2198         if (rc)
2199                 return rc;
2200         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2201 }
2202
2203 static int selinux_inode_permission(struct inode *inode, int mask,
2204                                     struct nameidata *nd)
2205 {
2206         int rc;
2207
2208         rc = secondary_ops->inode_permission(inode, mask, nd);
2209         if (rc)
2210                 return rc;
2211
2212         if (!mask) {
2213                 /* No permission to check.  Existence test. */
2214                 return 0;
2215         }
2216
2217         return inode_has_perm(current, inode,
2218                                file_mask_to_av(inode->i_mode, mask), NULL);
2219 }
2220
2221 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2222 {
2223         int rc;
2224
2225         rc = secondary_ops->inode_setattr(dentry, iattr);
2226         if (rc)
2227                 return rc;
2228
2229         if (iattr->ia_valid & ATTR_FORCE)
2230                 return 0;
2231
2232         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2233                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2234                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2235
2236         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2237 }
2238
2239 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2240 {
2241         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2242 }
2243
2244 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2245 {
2246         struct task_security_struct *tsec = current->security;
2247         struct inode *inode = dentry->d_inode;
2248         struct inode_security_struct *isec = inode->i_security;
2249         struct superblock_security_struct *sbsec;
2250         struct avc_audit_data ad;
2251         u32 newsid;
2252         int rc = 0;
2253
2254         if (strcmp(name, XATTR_NAME_SELINUX)) {
2255                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2256                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2257                     !capable(CAP_SYS_ADMIN)) {
2258                         /* A different attribute in the security namespace.
2259                            Restrict to administrator. */
2260                         return -EPERM;
2261                 }
2262
2263                 /* Not an attribute we recognize, so just check the
2264                    ordinary setattr permission. */
2265                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2266         }
2267
2268         sbsec = inode->i_sb->s_security;
2269         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2270                 return -EOPNOTSUPP;
2271
2272         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2273                 return -EPERM;
2274
2275         AVC_AUDIT_DATA_INIT(&ad,FS);
2276         ad.u.fs.dentry = dentry;
2277
2278         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2279                           FILE__RELABELFROM, &ad);
2280         if (rc)
2281                 return rc;
2282
2283         rc = security_context_to_sid(value, size, &newsid);
2284         if (rc)
2285                 return rc;
2286
2287         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2288                           FILE__RELABELTO, &ad);
2289         if (rc)
2290                 return rc;
2291
2292         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2293                                           isec->sclass);
2294         if (rc)
2295                 return rc;
2296
2297         return avc_has_perm(newsid,
2298                             sbsec->sid,
2299                             SECCLASS_FILESYSTEM,
2300                             FILESYSTEM__ASSOCIATE,
2301                             &ad);
2302 }
2303
2304 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2305                                         void *value, size_t size, int flags)
2306 {
2307         struct inode *inode = dentry->d_inode;
2308         struct inode_security_struct *isec = inode->i_security;
2309         u32 newsid;
2310         int rc;
2311
2312         if (strcmp(name, XATTR_NAME_SELINUX)) {
2313                 /* Not an attribute we recognize, so nothing to do. */
2314                 return;
2315         }
2316
2317         rc = security_context_to_sid(value, size, &newsid);
2318         if (rc) {
2319                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2320                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2321                 return;
2322         }
2323
2324         isec->sid = newsid;
2325         return;
2326 }
2327
2328 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2329 {
2330         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2331 }
2332
2333 static int selinux_inode_listxattr (struct dentry *dentry)
2334 {
2335         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2336 }
2337
2338 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2339 {
2340         if (strcmp(name, XATTR_NAME_SELINUX)) {
2341                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2342                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2343                     !capable(CAP_SYS_ADMIN)) {
2344                         /* A different attribute in the security namespace.
2345                            Restrict to administrator. */
2346                         return -EPERM;
2347                 }
2348
2349                 /* Not an attribute we recognize, so just check the
2350                    ordinary setattr permission. Might want a separate
2351                    permission for removexattr. */
2352                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2353         }
2354
2355         /* No one is allowed to remove a SELinux security label.
2356            You can change the label, but all data must be labeled. */
2357         return -EACCES;
2358 }
2359
2360 static const char *selinux_inode_xattr_getsuffix(void)
2361 {
2362       return XATTR_SELINUX_SUFFIX;
2363 }
2364
2365 /*
2366  * Copy the in-core inode security context value to the user.  If the
2367  * getxattr() prior to this succeeded, check to see if we need to
2368  * canonicalize the value to be finally returned to the user.
2369  *
2370  * Permission check is handled by selinux_inode_getxattr hook.
2371  */
2372 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2373 {
2374         struct inode_security_struct *isec = inode->i_security;
2375
2376         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2377                 return -EOPNOTSUPP;
2378
2379         return selinux_getsecurity(isec->sid, buffer, size);
2380 }
2381
2382 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2383                                      const void *value, size_t size, int flags)
2384 {
2385         struct inode_security_struct *isec = inode->i_security;
2386         u32 newsid;
2387         int rc;
2388
2389         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2390                 return -EOPNOTSUPP;
2391
2392         if (!value || !size)
2393                 return -EACCES;
2394
2395         rc = security_context_to_sid((void*)value, size, &newsid);
2396         if (rc)
2397                 return rc;
2398
2399         isec->sid = newsid;
2400         return 0;
2401 }
2402
2403 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2404 {
2405         const int len = sizeof(XATTR_NAME_SELINUX);
2406         if (buffer && len <= buffer_size)
2407                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2408         return len;
2409 }
2410
2411 /* file security operations */
2412
2413 static int selinux_file_permission(struct file *file, int mask)
2414 {
2415         struct inode *inode = file->f_dentry->d_inode;
2416
2417         if (!mask) {
2418                 /* No permission to check.  Existence test. */
2419                 return 0;
2420         }
2421
2422         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2423         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2424                 mask |= MAY_APPEND;
2425
2426         return file_has_perm(current, file,
2427                              file_mask_to_av(inode->i_mode, mask));
2428 }
2429
2430 static int selinux_file_alloc_security(struct file *file)
2431 {
2432         return file_alloc_security(file);
2433 }
2434
2435 static void selinux_file_free_security(struct file *file)
2436 {
2437         file_free_security(file);
2438 }
2439
2440 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2441                               unsigned long arg)
2442 {
2443         int error = 0;
2444
2445         switch (cmd) {
2446                 case FIONREAD:
2447                 /* fall through */
2448                 case FIBMAP:
2449                 /* fall through */
2450                 case FIGETBSZ:
2451                 /* fall through */
2452                 case EXT2_IOC_GETFLAGS:
2453                 /* fall through */
2454                 case EXT2_IOC_GETVERSION:
2455                         error = file_has_perm(current, file, FILE__GETATTR);
2456                         break;
2457
2458                 case EXT2_IOC_SETFLAGS:
2459                 /* fall through */
2460                 case EXT2_IOC_SETVERSION:
2461                         error = file_has_perm(current, file, FILE__SETATTR);
2462                         break;
2463
2464                 /* sys_ioctl() checks */
2465                 case FIONBIO:
2466                 /* fall through */
2467                 case FIOASYNC:
2468                         error = file_has_perm(current, file, 0);
2469                         break;
2470
2471                 case KDSKBENT:
2472                 case KDSKBSENT:
2473                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2474                         break;
2475
2476                 /* default case assumes that the command will go
2477                  * to the file's ioctl() function.
2478                  */
2479                 default:
2480                         error = file_has_perm(current, file, FILE__IOCTL);
2481
2482         }
2483         return error;
2484 }
2485
2486 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2487 {
2488         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2489                 /*
2490                  * We are making executable an anonymous mapping or a
2491                  * private file mapping that will also be writable.
2492                  * This has an additional check.
2493                  */
2494                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2495                 if (rc)
2496                         return rc;
2497         }
2498
2499         if (file) {
2500                 /* read access is always possible with a mapping */
2501                 u32 av = FILE__READ;
2502
2503                 /* write access only matters if the mapping is shared */
2504                 if (shared && (prot & PROT_WRITE))
2505                         av |= FILE__WRITE;
2506
2507                 if (prot & PROT_EXEC)
2508                         av |= FILE__EXECUTE;
2509
2510                 return file_has_perm(current, file, av);
2511         }
2512         return 0;
2513 }
2514
2515 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2516                              unsigned long prot, unsigned long flags)
2517 {
2518         int rc;
2519
2520         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2521         if (rc)
2522                 return rc;
2523
2524         if (selinux_checkreqprot)
2525                 prot = reqprot;
2526
2527         return file_map_prot_check(file, prot,
2528                                    (flags & MAP_TYPE) == MAP_SHARED);
2529 }
2530
2531 static int selinux_file_mprotect(struct vm_area_struct *vma,
2532                                  unsigned long reqprot,
2533                                  unsigned long prot)
2534 {
2535         int rc;
2536
2537         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2538         if (rc)
2539                 return rc;
2540
2541         if (selinux_checkreqprot)
2542                 prot = reqprot;
2543
2544         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2545                 rc = 0;
2546                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2547                     vma->vm_end <= vma->vm_mm->brk) {
2548                         rc = task_has_perm(current, current,
2549                                            PROCESS__EXECHEAP);
2550                 } else if (!vma->vm_file &&
2551                            vma->vm_start <= vma->vm_mm->start_stack &&
2552                            vma->vm_end >= vma->vm_mm->start_stack) {
2553                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2554                 } else if (vma->vm_file && vma->anon_vma) {
2555                         /*
2556                          * We are making executable a file mapping that has
2557                          * had some COW done. Since pages might have been
2558                          * written, check ability to execute the possibly
2559                          * modified content.  This typically should only
2560                          * occur for text relocations.
2561                          */
2562                         rc = file_has_perm(current, vma->vm_file,
2563                                            FILE__EXECMOD);
2564                 }
2565                 if (rc)
2566                         return rc;
2567         }
2568
2569         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2570 }
2571
2572 static int selinux_file_lock(struct file *file, unsigned int cmd)
2573 {
2574         return file_has_perm(current, file, FILE__LOCK);
2575 }
2576
2577 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2578                               unsigned long arg)
2579 {
2580         int err = 0;
2581
2582         switch (cmd) {
2583                 case F_SETFL:
2584                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2585                                 err = -EINVAL;
2586                                 break;
2587                         }
2588
2589                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2590                                 err = file_has_perm(current, file,FILE__WRITE);
2591                                 break;
2592                         }
2593                         /* fall through */
2594                 case F_SETOWN:
2595                 case F_SETSIG:
2596                 case F_GETFL:
2597                 case F_GETOWN:
2598                 case F_GETSIG:
2599                         /* Just check FD__USE permission */
2600                         err = file_has_perm(current, file, 0);
2601                         break;
2602                 case F_GETLK:
2603                 case F_SETLK:
2604                 case F_SETLKW:
2605 #if BITS_PER_LONG == 32
2606                 case F_GETLK64:
2607                 case F_SETLK64:
2608                 case F_SETLKW64:
2609 #endif
2610                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2611                                 err = -EINVAL;
2612                                 break;
2613                         }
2614                         err = file_has_perm(current, file, FILE__LOCK);
2615                         break;
2616         }
2617
2618         return err;
2619 }
2620
2621 static int selinux_file_set_fowner(struct file *file)
2622 {
2623         struct task_security_struct *tsec;
2624         struct file_security_struct *fsec;
2625
2626         tsec = current->security;
2627         fsec = file->f_security;
2628         fsec->fown_sid = tsec->sid;
2629
2630         return 0;
2631 }
2632
2633 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2634                                        struct fown_struct *fown, int signum)
2635 {
2636         struct file *file;
2637         u32 perm;
2638         struct task_security_struct *tsec;
2639         struct file_security_struct *fsec;
2640
2641         /* struct fown_struct is never outside the context of a struct file */
2642         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2643
2644         tsec = tsk->security;
2645         fsec = file->f_security;
2646
2647         if (!signum)
2648                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2649         else
2650                 perm = signal_to_av(signum);
2651
2652         return avc_has_perm(fsec->fown_sid, tsec->sid,
2653                             SECCLASS_PROCESS, perm, NULL);
2654 }
2655
2656 static int selinux_file_receive(struct file *file)
2657 {
2658         return file_has_perm(current, file, file_to_av(file));
2659 }
2660
2661 /* task security operations */
2662
2663 static int selinux_task_create(unsigned long clone_flags)
2664 {
2665         int rc;
2666
2667         rc = secondary_ops->task_create(clone_flags);
2668         if (rc)
2669                 return rc;
2670
2671         return task_has_perm(current, current, PROCESS__FORK);
2672 }
2673
2674 static int selinux_task_alloc_security(struct task_struct *tsk)
2675 {
2676         struct task_security_struct *tsec1, *tsec2;
2677         int rc;
2678
2679         tsec1 = current->security;
2680
2681         rc = task_alloc_security(tsk);
2682         if (rc)
2683                 return rc;
2684         tsec2 = tsk->security;
2685
2686         tsec2->osid = tsec1->osid;
2687         tsec2->sid = tsec1->sid;
2688
2689         /* Retain the exec, fs, key, and sock SIDs across fork */
2690         tsec2->exec_sid = tsec1->exec_sid;
2691         tsec2->create_sid = tsec1->create_sid;
2692         tsec2->keycreate_sid = tsec1->keycreate_sid;
2693         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2694
2695         return 0;
2696 }
2697
2698 static void selinux_task_free_security(struct task_struct *tsk)
2699 {
2700         task_free_security(tsk);
2701 }
2702
2703 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2704 {
2705         /* Since setuid only affects the current process, and
2706            since the SELinux controls are not based on the Linux
2707            identity attributes, SELinux does not need to control
2708            this operation.  However, SELinux does control the use
2709            of the CAP_SETUID and CAP_SETGID capabilities using the
2710            capable hook. */
2711         return 0;
2712 }
2713
2714 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2715 {
2716         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2717 }
2718
2719 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2720 {
2721         /* See the comment for setuid above. */
2722         return 0;
2723 }
2724
2725 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2726 {
2727         return task_has_perm(current, p, PROCESS__SETPGID);
2728 }
2729
2730 static int selinux_task_getpgid(struct task_struct *p)
2731 {
2732         return task_has_perm(current, p, PROCESS__GETPGID);
2733 }
2734
2735 static int selinux_task_getsid(struct task_struct *p)
2736 {
2737         return task_has_perm(current, p, PROCESS__GETSESSION);
2738 }
2739
2740 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2741 {
2742         selinux_get_task_sid(p, secid);
2743 }
2744
2745 static int selinux_task_setgroups(struct group_info *group_info)
2746 {
2747         /* See the comment for setuid above. */
2748         return 0;
2749 }
2750
2751 static int selinux_task_setnice(struct task_struct *p, int nice)
2752 {
2753         int rc;
2754
2755         rc = secondary_ops->task_setnice(p, nice);
2756         if (rc)
2757                 return rc;
2758
2759         return task_has_perm(current,p, PROCESS__SETSCHED);
2760 }
2761
2762 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2763 {
2764         return task_has_perm(current, p, PROCESS__SETSCHED);
2765 }
2766
2767 static int selinux_task_getioprio(struct task_struct *p)
2768 {
2769         return task_has_perm(current, p, PROCESS__GETSCHED);
2770 }
2771
2772 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2773 {
2774         struct rlimit *old_rlim = current->signal->rlim + resource;
2775         int rc;
2776
2777         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2778         if (rc)
2779                 return rc;
2780
2781         /* Control the ability to change the hard limit (whether
2782            lowering or raising it), so that the hard limit can
2783            later be used as a safe reset point for the soft limit
2784            upon context transitions. See selinux_bprm_apply_creds. */
2785         if (old_rlim->rlim_max != new_rlim->rlim_max)
2786                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2787
2788         return 0;
2789 }
2790
2791 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2792 {
2793         return task_has_perm(current, p, PROCESS__SETSCHED);
2794 }
2795
2796 static int selinux_task_getscheduler(struct task_struct *p)
2797 {
2798         return task_has_perm(current, p, PROCESS__GETSCHED);
2799 }
2800
2801 static int selinux_task_movememory(struct task_struct *p)
2802 {
2803         return task_has_perm(current, p, PROCESS__SETSCHED);
2804 }
2805
2806 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2807                                 int sig, u32 secid)
2808 {
2809         u32 perm;
2810         int rc;
2811         struct task_security_struct *tsec;
2812
2813         rc = secondary_ops->task_kill(p, info, sig, secid);
2814         if (rc)
2815                 return rc;
2816
2817         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2818                 return 0;
2819
2820         if (!sig)
2821                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2822         else
2823                 perm = signal_to_av(sig);
2824         tsec = p->security;
2825         if (secid)
2826                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2827         else
2828                 rc = task_has_perm(current, p, perm);
2829         return rc;
2830 }
2831
2832 static int selinux_task_prctl(int option,
2833                               unsigned long arg2,
2834                               unsigned long arg3,
2835                               unsigned long arg4,
2836                               unsigned long arg5)
2837 {
2838         /* The current prctl operations do not appear to require
2839            any SELinux controls since they merely observe or modify
2840            the state of the current process. */
2841         return 0;
2842 }
2843
2844 static int selinux_task_wait(struct task_struct *p)
2845 {
2846         u32 perm;
2847
2848         perm = signal_to_av(p->exit_signal);
2849
2850         return task_has_perm(p, current, perm);
2851 }
2852
2853 static void selinux_task_reparent_to_init(struct task_struct *p)
2854 {
2855         struct task_security_struct *tsec;
2856
2857         secondary_ops->task_reparent_to_init(p);
2858
2859         tsec = p->security;
2860         tsec->osid = tsec->sid;
2861         tsec->sid = SECINITSID_KERNEL;
2862         return;
2863 }
2864
2865 static void selinux_task_to_inode(struct task_struct *p,
2866                                   struct inode *inode)
2867 {
2868         struct task_security_struct *tsec = p->security;
2869         struct inode_security_struct *isec = inode->i_security;
2870
2871         isec->sid = tsec->sid;
2872         isec->initialized = 1;
2873         return;
2874 }
2875
2876 /* Returns error only if unable to parse addresses */
2877 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2878 {
2879         int offset, ihlen, ret = -EINVAL;
2880         struct iphdr _iph, *ih;
2881
2882         offset = skb->nh.raw - skb->data;
2883         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2884         if (ih == NULL)
2885                 goto out;
2886
2887         ihlen = ih->ihl * 4;
2888         if (ihlen < sizeof(_iph))
2889                 goto out;
2890
2891         ad->u.net.v4info.saddr = ih->saddr;
2892         ad->u.net.v4info.daddr = ih->daddr;
2893         ret = 0;
2894
2895         switch (ih->protocol) {
2896         case IPPROTO_TCP: {
2897                 struct tcphdr _tcph, *th;
2898
2899                 if (ntohs(ih->frag_off) & IP_OFFSET)
2900                         break;
2901
2902                 offset += ihlen;
2903                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2904                 if (th == NULL)
2905                         break;
2906
2907                 ad->u.net.sport = th->source;
2908                 ad->u.net.dport = th->dest;
2909                 break;
2910         }
2911
2912         case IPPROTO_UDP: {
2913                 struct udphdr _udph, *uh;
2914
2915                 if (ntohs(ih->frag_off) & IP_OFFSET)
2916                         break;
2917
2918                 offset += ihlen;
2919                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2920                 if (uh == NULL)
2921                         break;
2922
2923                 ad->u.net.sport = uh->source;
2924                 ad->u.net.dport = uh->dest;
2925                 break;
2926         }
2927
2928         default:
2929                 break;
2930         }
2931 out:
2932         return ret;
2933 }
2934
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2936
2937 /* Returns error only if unable to parse addresses */
2938 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2939 {
2940         u8 nexthdr;
2941         int ret = -EINVAL, offset;
2942         struct ipv6hdr _ipv6h, *ip6;
2943
2944         offset = skb->nh.raw - skb->data;
2945         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2946         if (ip6 == NULL)
2947                 goto out;
2948
2949         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2950         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2951         ret = 0;
2952
2953         nexthdr = ip6->nexthdr;
2954         offset += sizeof(_ipv6h);
2955         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2956         if (offset < 0)
2957                 goto out;
2958
2959         switch (nexthdr) {
2960         case IPPROTO_TCP: {
2961                 struct tcphdr _tcph, *th;
2962
2963                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2964                 if (th == NULL)
2965                         break;
2966
2967                 ad->u.net.sport = th->source;
2968                 ad->u.net.dport = th->dest;
2969                 break;
2970         }
2971
2972         case IPPROTO_UDP: {
2973                 struct udphdr _udph, *uh;
2974
2975                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2976                 if (uh == NULL)
2977                         break;
2978
2979                 ad->u.net.sport = uh->source;
2980                 ad->u.net.dport = uh->dest;
2981                 break;
2982         }
2983
2984         /* includes fragments */
2985         default:
2986                 break;
2987         }
2988 out:
2989         return ret;
2990 }
2991
2992 #endif /* IPV6 */
2993
2994 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2995                              char **addrp, int *len, int src)
2996 {
2997         int ret = 0;
2998
2999         switch (ad->u.net.family) {
3000         case PF_INET:
3001                 ret = selinux_parse_skb_ipv4(skb, ad);
3002                 if (ret || !addrp)
3003                         break;
3004                 *len = 4;
3005                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3006                                         &ad->u.net.v4info.daddr);
3007                 break;
3008
3009 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3010         case PF_INET6:
3011                 ret = selinux_parse_skb_ipv6(skb, ad);
3012                 if (ret || !addrp)
3013                         break;
3014                 *len = 16;
3015                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3016                                         &ad->u.net.v6info.daddr);
3017                 break;
3018 #endif  /* IPV6 */
3019         default:
3020                 break;
3021         }
3022
3023         return ret;
3024 }
3025
3026 /* socket security operations */
3027 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3028                            u32 perms)
3029 {
3030         struct inode_security_struct *isec;
3031         struct task_security_struct *tsec;
3032         struct avc_audit_data ad;
3033         int err = 0;
3034
3035         tsec = task->security;
3036         isec = SOCK_INODE(sock)->i_security;
3037
3038         if (isec->sid == SECINITSID_KERNEL)
3039                 goto out;
3040
3041         AVC_AUDIT_DATA_INIT(&ad,NET);
3042         ad.u.net.sk = sock->sk;
3043         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3044
3045 out:
3046         return err;
3047 }
3048
3049 static int selinux_socket_create(int family, int type,
3050                                  int protocol, int kern)
3051 {
3052         int err = 0;
3053         struct task_security_struct *tsec;
3054         u32 newsid;
3055
3056         if (kern)
3057                 goto out;
3058
3059         tsec = current->security;
3060         newsid = tsec->sockcreate_sid ? : tsec->sid;
3061         err = avc_has_perm(tsec->sid, newsid,
3062                            socket_type_to_security_class(family, type,
3063                            protocol), SOCKET__CREATE, NULL);
3064
3065 out:
3066         return err;
3067 }
3068
3069 static void selinux_socket_post_create(struct socket *sock, int family,
3070                                        int type, int protocol, int kern)
3071 {
3072         struct inode_security_struct *isec;
3073         struct task_security_struct *tsec;
3074         u32 newsid;
3075
3076         isec = SOCK_INODE(sock)->i_security;
3077
3078         tsec = current->security;
3079         newsid = tsec->sockcreate_sid ? : tsec->sid;
3080         isec->sclass = socket_type_to_security_class(family, type, protocol);
3081         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3082         isec->initialized = 1;
3083
3084         return;
3085 }
3086
3087 /* Range of port numbers used to automatically bind.
3088    Need to determine whether we should perform a name_bind
3089    permission check between the socket and the port number. */
3090 #define ip_local_port_range_0 sysctl_local_port_range[0]
3091 #define ip_local_port_range_1 sysctl_local_port_range[1]
3092
3093 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3094 {
3095         u16 family;
3096         int err;
3097
3098         err = socket_has_perm(current, sock, SOCKET__BIND);
3099         if (err)
3100                 goto out;
3101
3102         /*
3103          * If PF_INET or PF_INET6, check name_bind permission for the port.
3104          * Multiple address binding for SCTP is not supported yet: we just
3105          * check the first address now.
3106          */
3107         family = sock->sk->sk_family;
3108         if (family == PF_INET || family == PF_INET6) {
3109                 char *addrp;
3110                 struct inode_security_struct *isec;
3111                 struct task_security_struct *tsec;
3112                 struct avc_audit_data ad;
3113                 struct sockaddr_in *addr4 = NULL;
3114                 struct sockaddr_in6 *addr6 = NULL;
3115                 unsigned short snum;
3116                 struct sock *sk = sock->sk;
3117                 u32 sid, node_perm, addrlen;
3118
3119                 tsec = current->security;
3120                 isec = SOCK_INODE(sock)->i_security;
3121
3122                 if (family == PF_INET) {
3123                         addr4 = (struct sockaddr_in *)address;
3124                         snum = ntohs(addr4->sin_port);
3125                         addrlen = sizeof(addr4->sin_addr.s_addr);
3126                         addrp = (char *)&addr4->sin_addr.s_addr;
3127                 } else {
3128                         addr6 = (struct sockaddr_in6 *)address;
3129                         snum = ntohs(addr6->sin6_port);
3130                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3131                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3132                 }
3133
3134                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3135                            snum > ip_local_port_range_1)) {
3136                         err = security_port_sid(sk->sk_family, sk->sk_type,
3137                                                 sk->sk_protocol, snum, &sid);
3138                         if (err)
3139                                 goto out;
3140                         AVC_AUDIT_DATA_INIT(&ad,NET);
3141                         ad.u.net.sport = htons(snum);
3142                         ad.u.net.family = family;
3143                         err = avc_has_perm(isec->sid, sid,
3144                                            isec->sclass,
3145                                            SOCKET__NAME_BIND, &ad);
3146                         if (err)
3147                                 goto out;
3148                 }
3149
3150                 switch(isec->sclass) {
3151                 case SECCLASS_TCP_SOCKET:
3152                         node_perm = TCP_SOCKET__NODE_BIND;
3153                         break;
3154
3155                 case SECCLASS_UDP_SOCKET:
3156                         node_perm = UDP_SOCKET__NODE_BIND;
3157                         break;
3158
3159                 default:
3160                         node_perm = RAWIP_SOCKET__NODE_BIND;
3161                         break;
3162                 }
3163
3164                 err = security_node_sid(family, addrp, addrlen, &sid);
3165                 if (err)
3166                         goto out;
3167
3168                 AVC_AUDIT_DATA_INIT(&ad,NET);
3169                 ad.u.net.sport = htons(snum);
3170                 ad.u.net.family = family;
3171
3172                 if (family == PF_INET)
3173                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3174                 else
3175                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3176
3177                 err = avc_has_perm(isec->sid, sid,
3178                                    isec->sclass, node_perm, &ad);
3179                 if (err)
3180                         goto out;
3181         }
3182 out:
3183         return err;
3184 }
3185
3186 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3187 {
3188         struct inode_security_struct *isec;
3189         int err;
3190
3191         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3192         if (err)
3193                 return err;
3194
3195         /*
3196          * If a TCP socket, check name_connect permission for the port.
3197          */
3198         isec = SOCK_INODE(sock)->i_security;
3199         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3200                 struct sock *sk = sock->sk;
3201                 struct avc_audit_data ad;
3202                 struct sockaddr_in *addr4 = NULL;
3203                 struct sockaddr_in6 *addr6 = NULL;
3204                 unsigned short snum;
3205                 u32 sid;
3206
3207                 if (sk->sk_family == PF_INET) {
3208                         addr4 = (struct sockaddr_in *)address;
3209                         if (addrlen < sizeof(struct sockaddr_in))
3210                                 return -EINVAL;
3211                         snum = ntohs(addr4->sin_port);
3212                 } else {
3213                         addr6 = (struct sockaddr_in6 *)address;
3214                         if (addrlen < SIN6_LEN_RFC2133)
3215                                 return -EINVAL;
3216                         snum = ntohs(addr6->sin6_port);
3217                 }
3218
3219                 err = security_port_sid(sk->sk_family, sk->sk_type,
3220                                         sk->sk_protocol, snum, &sid);
3221                 if (err)
3222                         goto out;
3223
3224                 AVC_AUDIT_DATA_INIT(&ad,NET);
3225                 ad.u.net.dport = htons(snum);
3226                 ad.u.net.family = sk->sk_family;
3227                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3228                                    TCP_SOCKET__NAME_CONNECT, &ad);
3229                 if (err)
3230                         goto out;
3231         }
3232
3233 out:
3234         return err;
3235 }
3236
3237 static int selinux_socket_listen(struct socket *sock, int backlog)
3238 {
3239         return socket_has_perm(current, sock, SOCKET__LISTEN);
3240 }
3241
3242 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3243 {
3244         int err;
3245         struct inode_security_struct *isec;
3246         struct inode_security_struct *newisec;
3247
3248         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3249         if (err)
3250                 return err;
3251
3252         newisec = SOCK_INODE(newsock)->i_security;
3253
3254         isec = SOCK_INODE(sock)->i_security;
3255         newisec->sclass = isec->sclass;
3256         newisec->sid = isec->sid;
3257         newisec->initialized = 1;
3258
3259         return 0;
3260 }
3261
3262 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3263                                   int size)
3264 {
3265         return socket_has_perm(current, sock, SOCKET__WRITE);
3266 }
3267
3268 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3269                                   int size, int flags)
3270 {
3271         return socket_has_perm(current, sock, SOCKET__READ);
3272 }
3273
3274 static int selinux_socket_getsockname(struct socket *sock)
3275 {
3276         return socket_has_perm(current, sock, SOCKET__GETATTR);
3277 }
3278
3279 static int selinux_socket_getpeername(struct socket *sock)
3280 {
3281         return socket_has_perm(current, sock, SOCKET__GETATTR);
3282 }
3283
3284 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3285 {
3286         return socket_has_perm(current, sock, SOCKET__SETOPT);
3287 }
3288
3289 static int selinux_socket_getsockopt(struct socket *sock, int level,
3290                                      int optname)
3291 {
3292         return socket_has_perm(current, sock, SOCKET__GETOPT);
3293 }
3294
3295 static int selinux_socket_shutdown(struct socket *sock, int how)
3296 {
3297         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3298 }
3299
3300 static int selinux_socket_unix_stream_connect(struct socket *sock,
3301                                               struct socket *other,
3302                                               struct sock *newsk)
3303 {
3304         struct sk_security_struct *ssec;
3305         struct inode_security_struct *isec;
3306         struct inode_security_struct *other_isec;
3307         struct avc_audit_data ad;
3308         int err;
3309
3310         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3311         if (err)
3312                 return err;
3313
3314         isec = SOCK_INODE(sock)->i_security;
3315         other_isec = SOCK_INODE(other)->i_security;
3316
3317         AVC_AUDIT_DATA_INIT(&ad,NET);
3318         ad.u.net.sk = other->sk;
3319
3320         err = avc_has_perm(isec->sid, other_isec->sid,
3321                            isec->sclass,
3322                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3323         if (err)
3324                 return err;
3325
3326         /* connecting socket */
3327         ssec = sock->sk->sk_security;
3328         ssec->peer_sid = other_isec->sid;
3329
3330         /* server child socket */
3331         ssec = newsk->sk_security;
3332         ssec->peer_sid = isec->sid;
3333
3334         return 0;
3335 }
3336
3337 static int selinux_socket_unix_may_send(struct socket *sock,
3338                                         struct socket *other)
3339 {
3340         struct inode_security_struct *isec;
3341         struct inode_security_struct *other_isec;
3342         struct avc_audit_data ad;
3343         int err;
3344
3345         isec = SOCK_INODE(sock)->i_security;
3346         other_isec = SOCK_INODE(other)->i_security;
3347
3348         AVC_AUDIT_DATA_INIT(&ad,NET);
3349         ad.u.net.sk = other->sk;
3350
3351         err = avc_has_perm(isec->sid, other_isec->sid,
3352                            isec->sclass, SOCKET__SENDTO, &ad);
3353         if (err)
3354                 return err;
3355
3356         return 0;
3357 }
3358
3359 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3360                 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3361                 u16 family, char *addrp, int len)
3362 {
3363         int err = 0;
3364         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3365
3366         if (!skb->dev)
3367                 goto out;
3368
3369         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3370         if (err)
3371                 goto out;
3372
3373         switch (sock_class) {
3374         case SECCLASS_UDP_SOCKET:
3375                 netif_perm = NETIF__UDP_RECV;
3376                 node_perm = NODE__UDP_RECV;
3377                 recv_perm = UDP_SOCKET__RECV_MSG;
3378                 break;
3379
3380         case SECCLASS_TCP_SOCKET:
3381                 netif_perm = NETIF__TCP_RECV;
3382                 node_perm = NODE__TCP_RECV;
3383                 recv_perm = TCP_SOCKET__RECV_MSG;
3384                 break;
3385
3386         default:
3387                 netif_perm = NETIF__RAWIP_RECV;
3388                 node_perm = NODE__RAWIP_RECV;
3389                 break;
3390         }
3391
3392         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3393         if (err)
3394                 goto out;
3395
3396         err = security_node_sid(family, addrp, len, &node_sid);
3397         if (err)
3398                 goto out;
3399
3400         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3401         if (err)
3402                 goto out;
3403
3404         if (recv_perm) {
3405                 u32 port_sid;
3406
3407                 err = security_port_sid(sk->sk_family, sk->sk_type,
3408                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3409                                         &port_sid);
3410                 if (err)
3411                         goto out;
3412
3413                 err = avc_has_perm(sock_sid, port_sid,
3414                                    sock_class, recv_perm, ad);
3415         }
3416
3417 out:
3418         return err;
3419 }
3420
3421 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3422 {
3423         u16 family;
3424         u16 sock_class = 0;
3425         char *addrp;
3426         int len, err = 0;
3427         u32 sock_sid = 0;
3428         struct socket *sock;
3429         struct avc_audit_data ad;
3430
3431         family = sk->sk_family;
3432         if (family != PF_INET && family != PF_INET6)
3433                 goto out;
3434
3435         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3436         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3437                 family = PF_INET;
3438
3439         read_lock_bh(&sk->sk_callback_lock);
3440         sock = sk->sk_socket;
3441         if (sock) {
3442                 struct inode *inode;
3443                 inode = SOCK_INODE(sock);
3444                 if (inode) {
3445                         struct inode_security_struct *isec;
3446                         isec = inode->i_security;
3447                         sock_sid = isec->sid;
3448                         sock_class = isec->sclass;
3449                 }
3450         }
3451         read_unlock_bh(&sk->sk_callback_lock);
3452         if (!sock_sid)
3453                 goto out;
3454
3455         AVC_AUDIT_DATA_INIT(&ad, NET);
3456         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3457         ad.u.net.family = family;
3458
3459         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3460         if (err)
3461                 goto out;
3462
3463         if (selinux_compat_net)
3464                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3465                                                   sock_class, family,
3466                                                   addrp, len);
3467         else
3468                 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3469                                    PACKET__RECV, &ad);
3470         if (err)
3471                 goto out;
3472
3473         err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3474 out:
3475         return err;
3476 }
3477
3478 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3479                                             int __user *optlen, unsigned len)
3480 {
3481         int err = 0;
3482         char *scontext;
3483         u32 scontext_len;
3484         struct sk_security_struct *ssec;
3485         struct inode_security_struct *isec;
3486         u32 peer_sid = 0;
3487
3488         isec = SOCK_INODE(sock)->i_security;
3489
3490         /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3491         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3492                 ssec = sock->sk->sk_security;
3493                 peer_sid = ssec->peer_sid;
3494         }
3495         else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3496                 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3497
3498                 if (peer_sid == SECSID_NULL) {
3499                         err = -ENOPROTOOPT;
3500                         goto out;
3501                 }
3502         }
3503         else {
3504                 err = -ENOPROTOOPT;
3505                 goto out;
3506         }
3507
3508         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3509
3510         if (err)
3511                 goto out;
3512
3513         if (scontext_len > len) {
3514                 err = -ERANGE;
3515                 goto out_len;
3516         }
3517
3518         if (copy_to_user(optval, scontext, scontext_len))
3519                 err = -EFAULT;
3520
3521 out_len:
3522         if (put_user(scontext_len, optlen))
3523                 err = -EFAULT;
3524
3525         kfree(scontext);
3526 out:
3527         return err;
3528 }
3529
3530 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3531 {
3532         u32 peer_secid = SECSID_NULL;
3533         int err = 0;
3534
3535         if (sock && (sock->sk->sk_family == PF_UNIX))
3536                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3537         else if (skb)
3538                 peer_secid = selinux_socket_getpeer_dgram(skb);
3539
3540         if (peer_secid == SECSID_NULL)
3541                 err = -EINVAL;
3542         *secid = peer_secid;
3543
3544         return err;
3545 }
3546
3547 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3548 {
3549         return sk_alloc_security(sk, family, priority);
3550 }
3551
3552 static void selinux_sk_free_security(struct sock *sk)
3553 {
3554         sk_free_security(sk);
3555 }
3556
3557 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3558 {
3559         struct inode_security_struct *isec;
3560         u32 sock_sid = SECINITSID_ANY_SOCKET;
3561
3562         if (!sk)
3563                 return selinux_no_sk_sid(fl);
3564
3565         read_lock_bh(&sk->sk_callback_lock);
3566         isec = get_sock_isec(sk);
3567
3568         if (isec)
3569                 sock_sid = isec->sid;
3570
3571         read_unlock_bh(&sk->sk_callback_lock);
3572         return sock_sid;
3573 }
3574
3575 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3576 {
3577         int err = 0;
3578         u32 perm;
3579         struct nlmsghdr *nlh;
3580         struct socket *sock = sk->sk_socket;
3581         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3582
3583         if (skb->len < NLMSG_SPACE(0)) {
3584                 err = -EINVAL;
3585                 goto out;
3586         }
3587         nlh = (struct nlmsghdr *)skb->data;
3588
3589         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3590         if (err) {
3591                 if (err == -EINVAL) {
3592                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3593                                   "SELinux:  unrecognized netlink message"
3594                                   " type=%hu for sclass=%hu\n",
3595                                   nlh->nlmsg_type, isec->sclass);
3596                         if (!selinux_enforcing)
3597                                 err = 0;
3598                 }
3599
3600                 /* Ignore */
3601                 if (err == -ENOENT)
3602                         err = 0;
3603                 goto out;
3604         }
3605
3606         err = socket_has_perm(current, sock, perm);
3607 out:
3608         return err;
3609 }
3610
3611 #ifdef CONFIG_NETFILTER
3612
3613 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3614                                             struct inode_security_struct *isec,
3615                                             struct avc_audit_data *ad,
3616                                             u16 family, char *addrp, int len)
3617 {
3618         int err;
3619         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3620
3621         err = sel_netif_sids(dev, &if_sid, NULL);
3622         if (err)
3623                 goto out;
3624
3625         switch (isec->sclass) {
3626         case SECCLASS_UDP_SOCKET:
3627                 netif_perm = NETIF__UDP_SEND;
3628                 node_perm = NODE__UDP_SEND;
3629                 send_perm = UDP_SOCKET__SEND_MSG;
3630                 break;
3631
3632         case SECCLASS_TCP_SOCKET:
3633                 netif_perm = NETIF__TCP_SEND;
3634                 node_perm = NODE__TCP_SEND;
3635                 send_perm = TCP_SOCKET__SEND_MSG;
3636                 break;
3637
3638         default:
3639                 netif_perm = NETIF__RAWIP_SEND;
3640                 node_perm = NODE__RAWIP_SEND;
3641                 break;
3642         }
3643
3644         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3645         if (err)
3646                 goto out;
3647
3648         err = security_node_sid(family, addrp, len, &node_sid);
3649         if (err)
3650                 goto out;
3651
3652         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3653         if (err)
3654                 goto out;
3655
3656         if (send_perm) {
3657                 u32 port_sid;
3658
3659                 err = security_port_sid(sk->sk_family,
3660                                         sk->sk_type,
3661                                         sk->sk_protocol,
3662                                         ntohs(ad->u.net.dport),
3663                                         &port_sid);
3664                 if (err)
3665                         goto out;
3666
3667                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3668                                    send_perm, ad);
3669         }
3670 out:
3671         return err;
3672 }
3673
3674 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3675                                               struct sk_buff **pskb,
3676                                               const struct net_device *in,
3677                                               const struct net_device *out,
3678                                               int (*okfn)(struct sk_buff *),
3679                                               u16 family)
3680 {
3681         char *addrp;
3682         int len, err = 0;
3683         struct sock *sk;
3684         struct socket *sock;
3685         struct inode *inode;
3686         struct sk_buff *skb = *pskb;
3687         struct inode_security_struct *isec;
3688         struct avc_audit_data ad;
3689         struct net_device *dev = (struct net_device *)out;
3690
3691         sk = skb->sk;
3692         if (!sk)
3693                 goto out;
3694
3695         sock = sk->sk_socket;
3696         if (!sock)
3697                 goto out;
3698
3699         inode = SOCK_INODE(sock);
3700         if (!inode)
3701                 goto out;
3702
3703         isec = inode->i_security;
3704
3705         AVC_AUDIT_DATA_INIT(&ad, NET);
3706         ad.u.net.netif = dev->name;
3707         ad.u.net.family = family;
3708
3709         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3710         if (err)
3711                 goto out;
3712
3713         if (selinux_compat_net)
3714                 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3715                                                        family, addrp, len);
3716         else
3717                 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3718                                    PACKET__SEND, &ad);
3719
3720         if (err)
3721                 goto out;
3722
3723         err = selinux_xfrm_postroute_last(isec->sid, skb);
3724 out:
3725         return err ? NF_DROP : NF_ACCEPT;
3726 }
3727
3728 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3729                                                 struct sk_buff **pskb,
3730                                                 const struct net_device *in,
3731                                                 const struct net_device *out,
3732                                                 int (*okfn)(struct sk_buff *))
3733 {
3734         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3735 }
3736
3737 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3738
3739 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3740                                                 struct sk_buff **pskb,
3741                                                 const struct net_device *in,
3742                                                 const struct net_device *out,
3743                                                 int (*okfn)(struct sk_buff *))
3744 {
3745         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3746 }
3747
3748 #endif  /* IPV6 */
3749
3750 #endif  /* CONFIG_NETFILTER */
3751
3752 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3753 {
3754         int err;
3755
3756         err = secondary_ops->netlink_send(sk, skb);
3757         if (err)
3758                 return err;
3759
3760         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3761                 err = selinux_nlmsg_perm(sk, skb);
3762
3763         return err;
3764 }
3765
3766 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3767 {
3768         int err;
3769         struct avc_audit_data ad;
3770
3771         err = secondary_ops->netlink_recv(skb, capability);
3772         if (err)
3773                 return err;
3774
3775         AVC_AUDIT_DATA_INIT(&ad, CAP);
3776         ad.u.cap = capability;
3777
3778         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3779                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3780 }
3781
3782 static int ipc_alloc_security(struct task_struct *task,
3783                               struct kern_ipc_perm *perm,
3784                               u16 sclass)
3785 {
3786         struct task_security_struct *tsec = task->security;
3787         struct ipc_security_struct *isec;
3788
3789         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3790         if (!isec)
3791                 return -ENOMEM;
3792
3793         isec->sclass = sclass;
3794         isec->ipc_perm = perm;
3795         isec->sid = tsec->sid;
3796         perm->security = isec;
3797
3798         return 0;
3799 }
3800
3801 static void ipc_free_security(struct kern_ipc_perm *perm)
3802 {
3803         struct ipc_security_struct *isec = perm->security;
3804         perm->security = NULL;
3805         kfree(isec);
3806 }
3807
3808 static int msg_msg_alloc_security(struct msg_msg *msg)
3809 {
3810         struct msg_security_struct *msec;
3811
3812         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3813         if (!msec)
3814                 return -ENOMEM;
3815
3816         msec->msg = msg;
3817         msec->sid = SECINITSID_UNLABELED;
3818         msg->security = msec;
3819
3820         return 0;
3821 }
3822
3823 static void msg_msg_free_security(struct msg_msg *msg)
3824 {
3825         struct msg_security_struct *msec = msg->security;
3826
3827         msg->security = NULL;
3828         kfree(msec);
3829 }
3830
3831 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3832                         u32 perms)
3833 {
3834         struct task_security_struct *tsec;
3835         struct ipc_security_struct *isec;
3836         struct avc_audit_data ad;
3837
3838         tsec = current->security;
3839         isec = ipc_perms->security;
3840
3841         AVC_AUDIT_DATA_INIT(&ad, IPC);
3842         ad.u.ipc_id = ipc_perms->key;
3843
3844         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3845 }
3846
3847 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3848 {
3849         return msg_msg_alloc_security(msg);
3850 }
3851
3852 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3853 {
3854         msg_msg_free_security(msg);
3855 }
3856
3857 /* message queue security operations */
3858 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3859 {
3860         struct task_security_struct *tsec;
3861         struct ipc_security_struct *isec;
3862         struct avc_audit_data ad;
3863         int rc;
3864
3865         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3866         if (rc)
3867                 return rc;
3868
3869         tsec = current->security;
3870         isec = msq->q_perm.security;
3871
3872         AVC_AUDIT_DATA_INIT(&ad, IPC);
3873         ad.u.ipc_id = msq->q_perm.key;
3874
3875         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3876                           MSGQ__CREATE, &ad);
3877         if (rc) {
3878                 ipc_free_security(&msq->q_perm);
3879                 return rc;
3880         }
3881         return 0;
3882 }
3883
3884 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3885 {
3886         ipc_free_security(&msq->q_perm);
3887 }
3888
3889 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3890 {
3891         struct task_security_struct *tsec;
3892         struct ipc_security_struct *isec;
3893         struct avc_audit_data ad;
3894
3895         tsec = current->security;
3896         isec = msq->q_perm.security;
3897
3898         AVC_AUDIT_DATA_INIT(&ad, IPC);
3899         ad.u.ipc_id = msq->q_perm.key;
3900
3901         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3902                             MSGQ__ASSOCIATE, &ad);
3903 }
3904
3905 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3906 {
3907         int err;
3908         int perms;
3909
3910         switch(cmd) {
3911         case IPC_INFO:
3912         case MSG_INFO:
3913                 /* No specific object, just general system-wide information. */
3914                 return task_has_system(current, SYSTEM__IPC_INFO);
3915         case IPC_STAT:
3916         case MSG_STAT:
3917                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3918                 break;
3919         case IPC_SET:
3920                 perms = MSGQ__SETATTR;
3921                 break;
3922         case IPC_RMID:
3923                 perms = MSGQ__DESTROY;
3924                 break;
3925         default:
3926                 return 0;
3927         }
3928
3929         err = ipc_has_perm(&msq->q_perm, perms);
3930         return err;
3931 }
3932
3933 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3934 {
3935         struct task_security_struct *tsec;
3936         struct ipc_security_struct *isec;
3937         struct msg_security_struct *msec;
3938         struct avc_audit_data ad;
3939         int rc;
3940
3941         tsec = current->security;
3942         isec = msq->q_perm.security;
3943         msec = msg->security;
3944
3945         /*
3946          * First time through, need to assign label to the message
3947          */
3948         if (msec->sid == SECINITSID_UNLABELED) {
3949                 /*
3950                  * Compute new sid based on current process and
3951                  * message queue this message will be stored in
3952                  */
3953                 rc = security_transition_sid(tsec->sid,
3954                                              isec->sid,
3955                                              SECCLASS_MSG,
3956                                              &msec->sid);
3957                 if (rc)
3958                         return rc;
3959         }
3960
3961         AVC_AUDIT_DATA_INIT(&ad, IPC);
3962         ad.u.ipc_id = msq->q_perm.key;
3963
3964         /* Can this process write to the queue? */
3965         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3966                           MSGQ__WRITE, &ad);
3967         if (!rc)
3968                 /* Can this process send the message */
3969                 rc = avc_has_perm(tsec->sid, msec->sid,
3970                                   SECCLASS_MSG, MSG__SEND, &ad);
3971         if (!rc)
3972                 /* Can the message be put in the queue? */
3973                 rc = avc_has_perm(msec->sid, isec->sid,
3974                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3975
3976         return rc;
3977 }
3978
3979 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3980                                     struct task_struct *target,
3981                                     long type, int mode)
3982 {
3983         struct task_security_struct *tsec;
3984         struct ipc_security_struct *isec;
3985         struct msg_security_struct *msec;
3986         struct avc_audit_data ad;
3987         int rc;
3988
3989         tsec = target->security;
3990         isec = msq->q_perm.security;
3991         msec = msg->security;
3992
3993         AVC_AUDIT_DATA_INIT(&ad, IPC);
3994         ad.u.ipc_id = msq->q_perm.key;
3995
3996         rc = avc_has_perm(tsec->sid, isec->sid,
3997                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3998         if (!rc)
3999                 rc = avc_has_perm(tsec->sid, msec->sid,
4000                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4001         return rc;
4002 }
4003
4004 /* Shared Memory security operations */
4005 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4006 {
4007         struct task_security_struct *tsec;
4008         struct ipc_security_struct *isec;
4009         struct avc_audit_data ad;
4010         int rc;
4011
4012         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4013         if (rc)
4014                 return rc;
4015
4016         tsec = current->security;
4017         isec = shp->shm_perm.security;
4018
4019         AVC_AUDIT_DATA_INIT(&ad, IPC);
4020         ad.u.ipc_id = shp->shm_perm.key;
4021
4022         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4023                           SHM__CREATE, &ad);
4024         if (rc) {
4025                 ipc_free_security(&shp->shm_perm);
4026                 return rc;
4027         }
4028         return 0;
4029 }
4030
4031 static void selinux_shm_free_security(struct shmid_kernel *shp)
4032 {
4033         ipc_free_security(&shp->shm_perm);
4034 }
4035
4036 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4037 {
4038         struct task_security_struct *tsec;
4039         struct ipc_security_struct *isec;
4040         struct avc_audit_data ad;
4041
4042         tsec = current->security;
4043         isec = shp->shm_perm.security;
4044
4045         AVC_AUDIT_DATA_INIT(&ad, IPC);
4046         ad.u.ipc_id = shp->shm_perm.key;
4047
4048         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4049                             SHM__ASSOCIATE, &ad);
4050 }
4051
4052 /* Note, at this point, shp is locked down */
4053 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4054 {
4055         int perms;
4056         int err;
4057
4058         switch(cmd) {
4059         case IPC_INFO:
4060         case SHM_INFO:
4061                 /* No specific object, just general system-wide information. */
4062                 return task_has_system(current, SYSTEM__IPC_INFO);
4063         case IPC_STAT:
4064         case SHM_STAT:
4065                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4066                 break;
4067         case IPC_SET:
4068                 perms = SHM__SETATTR;
4069                 break;
4070         case SHM_LOCK:
4071         case SHM_UNLOCK:
4072                 perms = SHM__LOCK;
4073                 break;
4074         case IPC_RMID:
4075                 perms = SHM__DESTROY;
4076                 break;
4077         default:
4078                 return 0;
4079         }
4080
4081         err = ipc_has_perm(&shp->shm_perm, perms);
4082         return err;
4083 }
4084
4085 static int selinux_shm_shmat(struct shmid_kernel *shp,
4086                              char __user *shmaddr, int shmflg)
4087 {
4088         u32 perms;
4089         int rc;
4090
4091         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4092         if (rc)
4093                 return rc;
4094
4095         if (shmflg & SHM_RDONLY)
4096                 perms = SHM__READ;
4097         else
4098                 perms = SHM__READ | SHM__WRITE;
4099
4100         return ipc_has_perm(&shp->shm_perm, perms);
4101 }
4102
4103 /* Semaphore security operations */
4104 static int selinux_sem_alloc_security(struct sem_array *sma)
4105 {
4106         struct task_security_struct *tsec;
4107         struct ipc_security_struct *isec;
4108         struct avc_audit_data ad;
4109         int rc;
4110
4111         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4112         if (rc)
4113                 return rc;
4114
4115         tsec = current->security;
4116         isec = sma->sem_perm.security;
4117
4118         AVC_AUDIT_DATA_INIT(&ad, IPC);
4119         ad.u.ipc_id = sma->sem_perm.key;
4120
4121         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4122                           SEM__CREATE, &ad);
4123         if (rc) {
4124                 ipc_free_security(&sma->sem_perm);
4125                 return rc;
4126         }
4127         return 0;
4128 }
4129
4130 static void selinux_sem_free_security(struct sem_array *sma)
4131 {
4132         ipc_free_security(&sma->sem_perm);
4133 }
4134
4135 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4136 {
4137         struct task_security_struct *tsec;
4138         struct ipc_security_struct *isec;
4139         struct avc_audit_data ad;
4140
4141         tsec = current->security;
4142         isec = sma->sem_perm.security;
4143
4144         AVC_AUDIT_DATA_INIT(&ad, IPC);
4145         ad.u.ipc_id = sma->sem_perm.key;
4146
4147         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4148                             SEM__ASSOCIATE, &ad);
4149 }
4150
4151 /* Note, at this point, sma is locked down */
4152 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4153 {
4154         int err;
4155         u32 perms;
4156
4157         switch(cmd) {
4158         case IPC_INFO:
4159         case SEM_INFO:
4160                 /* No specific object, just general system-wide information. */
4161                 return task_has_system(current, SYSTEM__IPC_INFO);
4162         case GETPID:
4163         case GETNCNT:
4164         case GETZCNT:
4165                 perms = SEM__GETATTR;
4166                 break;
4167         case GETVAL:
4168         case GETALL:
4169                 perms = SEM__READ;
4170                 break;
4171         case SETVAL:
4172         case SETALL:
4173                 perms = SEM__WRITE;
4174                 break;
4175         case IPC_RMID:
4176                 perms = SEM__DESTROY;
4177                 break;
4178         case IPC_SET:
4179                 perms = SEM__SETATTR;
4180                 break;
4181         case IPC_STAT:
4182         case SEM_STAT:
4183                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4184                 break;
4185         default:
4186                 return 0;
4187         }
4188
4189         err = ipc_has_perm(&sma->sem_perm, perms);
4190         return err;
4191 }
4192
4193 static int selinux_sem_semop(struct sem_array *sma,
4194                              struct sembuf *sops, unsigned nsops, int alter)
4195 {
4196         u32 perms;
4197
4198         if (alter)
4199                 perms = SEM__READ | SEM__WRITE;
4200         else
4201                 perms = SEM__READ;
4202
4203         return ipc_has_perm(&sma->sem_perm, perms);
4204 }
4205
4206 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4207 {
4208         u32 av = 0;
4209
4210         av = 0;
4211         if (flag & S_IRUGO)
4212                 av |= IPC__UNIX_READ;
4213         if (flag & S_IWUGO)
4214                 av |= IPC__UNIX_WRITE;
4215
4216         if (av == 0)
4217                 return 0;
4218
4219         return ipc_has_perm(ipcp, av);
4220 }
4221
4222 /* module stacking operations */
4223 static int selinux_register_security (const char *name, struct security_operations *ops)
4224 {
4225         if (secondary_ops != original_ops) {
4226                 printk(KERN_INFO "%s:  There is already a secondary security "
4227                        "module registered.\n", __FUNCTION__);
4228                 return -EINVAL;
4229         }
4230
4231         secondary_ops = ops;
4232
4233         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4234                __FUNCTION__,
4235                name);
4236
4237         return 0;
4238 }
4239
4240 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4241 {
4242         if (ops != secondary_ops) {
4243                 printk (KERN_INFO "%s:  trying to unregister a security module "
4244                         "that is not registered.\n", __FUNCTION__);
4245                 return -EINVAL;
4246         }
4247
4248         secondary_ops = original_ops;
4249
4250         return 0;
4251 }
4252
4253 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4254 {
4255         if (inode)
4256                 inode_doinit_with_dentry(inode, dentry);
4257 }
4258
4259 static int selinux_getprocattr(struct task_struct *p,
4260                                char *name, void *value, size_t size)
4261 {
4262         struct task_security_struct *tsec;
4263         u32 sid;
4264         int error;
4265
4266         if (current != p) {
4267                 error = task_has_perm(current, p, PROCESS__GETATTR);
4268                 if (error)
4269                         return error;
4270         }
4271
4272         tsec = p->security;
4273
4274         if (!strcmp(name, "current"))
4275                 sid = tsec->sid;
4276         else if (!strcmp(name, "prev"))
4277                 sid = tsec->osid;
4278         else if (!strcmp(name, "exec"))
4279                 sid = tsec->exec_sid;
4280         else if (!strcmp(name, "fscreate"))
4281                 sid = tsec->create_sid;
4282         else if (!strcmp(name, "keycreate"))
4283                 sid = tsec->keycreate_sid;
4284         else if (!strcmp(name, "sockcreate"))
4285                 sid = tsec->sockcreate_sid;
4286         else
4287                 return -EINVAL;
4288
4289         if (!sid)
4290                 return 0;
4291
4292         return selinux_getsecurity(sid, value, size);
4293 }
4294
4295 static int selinux_setprocattr(struct task_struct *p,
4296                                char *name, void *value, size_t size)
4297 {
4298         struct task_security_struct *tsec;
4299         struct task_struct *tracer;
4300         u32 sid = 0;
4301         int error;
4302         char *str = value;
4303
4304         if (current != p) {
4305                 /* SELinux only allows a process to change its own
4306                    security attributes. */
4307                 return -EACCES;
4308         }
4309
4310         /*
4311          * Basic control over ability to set these attributes at all.
4312          * current == p, but we'll pass them separately in case the
4313          * above restriction is ever removed.
4314          */
4315         if (!strcmp(name, "exec"))
4316                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4317         else if (!strcmp(name, "fscreate"))
4318                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4319         else if (!strcmp(name, "keycreate"))
4320                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4321         else if (!strcmp(name, "sockcreate"))
4322                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4323         else if (!strcmp(name, "current"))
4324                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4325         else
4326                 error = -EINVAL;
4327         if (error)
4328                 return error;
4329
4330         /* Obtain a SID for the context, if one was specified. */
4331         if (size && str[1] && str[1] != '\n') {
4332                 if (str[size-1] == '\n') {
4333                         str[size-1] = 0;
4334                         size--;
4335                 }
4336                 error = security_context_to_sid(value, size, &sid);
4337                 if (error)
4338                         return error;
4339         }
4340
4341         /* Permission checking based on the specified context is
4342            performed during the actual operation (execve,
4343            open/mkdir/...), when we know the full context of the
4344            operation.  See selinux_bprm_set_security for the execve
4345            checks and may_create for the file creation checks. The
4346            operation will then fail if the context is not permitted. */
4347         tsec = p->security;
4348         if (!strcmp(name, "exec"))
4349                 tsec->exec_sid = sid;
4350         else if (!strcmp(name, "fscreate"))
4351                 tsec->create_sid = sid;
4352         else if (!strcmp(name, "keycreate")) {
4353                 error = may_create_key(sid, p);
4354                 if (error)
4355                         return error;
4356                 tsec->keycreate_sid = sid;
4357         } else if (!strcmp(name, "sockcreate"))
4358                 tsec->sockcreate_sid = sid;
4359         else if (!strcmp(name, "current")) {
4360                 struct av_decision avd;
4361
4362                 if (sid == 0)
4363                         return -EINVAL;
4364
4365                 /* Only allow single threaded processes to change context */
4366                 if (atomic_read(&p->mm->mm_users) != 1) {
4367                         struct task_struct *g, *t;
4368                         struct mm_struct *mm = p->mm;
4369                         read_lock(&tasklist_lock);
4370                         do_each_thread(g, t)
4371                                 if (t->mm == mm && t != p) {
4372                                         read_unlock(&tasklist_lock);
4373                                         return -EPERM;
4374                                 }
4375                         while_each_thread(g, t);
4376                         read_unlock(&tasklist_lock);
4377                 }
4378
4379                 /* Check permissions for the transition. */
4380                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4381                                      PROCESS__DYNTRANSITION, NULL);
4382                 if (error)
4383                         return error;
4384
4385                 /* Check for ptracing, and update the task SID if ok.
4386                    Otherwise, leave SID unchanged and fail. */
4387                 task_lock(p);
4388                 rcu_read_lock();
4389                 tracer = tracehook_tracer_task(p);
4390                 if (tracer != NULL) {
4391                         struct task_security_struct *ptsec = tracer->security;
4392                         u32 ptsid = ptsec->sid;
4393                         rcu_read_unlock();
4394                         error = avc_has_perm_noaudit(ptsid, sid,
4395                                                      SECCLASS_PROCESS,
4396                                                      PROCESS__PTRACE, &avd);
4397                         if (!error)
4398                                 tsec->sid = sid;
4399                         task_unlock(p);
4400                         avc_audit(ptsid, sid, SECCLASS_PROCESS,
4401                                   PROCESS__PTRACE, &avd, error, NULL);
4402                         if (error)
4403                                 return error;
4404                 } else {
4405                         rcu_read_unlock();
4406                         tsec->sid = sid;
4407                         task_unlock(p);
4408                 }
4409         }
4410         else
4411                 return -EINVAL;
4412
4413         return size;
4414 }
4415
4416 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4417 {
4418         return security_sid_to_context(secid, secdata, seclen);
4419 }
4420
4421 static void selinux_release_secctx(char *secdata, u32 seclen)
4422 {
4423         if (secdata)
4424                 kfree(secdata);
4425 }
4426
4427 #ifdef CONFIG_KEYS
4428
4429 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4430                              unsigned long flags)
4431 {
4432         struct task_security_struct *tsec = tsk->security;
4433         struct key_security_struct *ksec;
4434
4435         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4436         if (!ksec)
4437                 return -ENOMEM;
4438
4439         ksec->obj = k;
4440         if (tsec->keycreate_sid)
4441                 ksec->sid = tsec->keycreate_sid;
4442         else
4443                 ksec->sid = tsec->sid;
4444         k->security = ksec;
4445
4446         return 0;
4447 }
4448
4449 static void selinux_key_free(struct key *k)
4450 {
4451         struct key_security_struct *ksec = k->security;
4452
4453         k->security = NULL;
4454         kfree(ksec);
4455 }
4456
4457 static int selinux_key_permission(key_ref_t key_ref,
4458                             struct task_struct *ctx,
4459                             key_perm_t perm)
4460 {
4461         struct key *key;
4462         struct task_security_struct *tsec;
4463         struct key_security_struct *ksec;
4464
4465         key = key_ref_to_ptr(key_ref);
4466
4467         tsec = ctx->security;
4468         ksec = key->security;
4469
4470         /* if no specific permissions are requested, we skip the
4471            permission check. No serious, additional covert channels
4472            appear to be created. */
4473         if (perm == 0)
4474                 return 0;
4475
4476         return avc_has_perm(tsec->sid, ksec->sid,
4477                             SECCLASS_KEY, perm, NULL);
4478 }
4479
4480 #endif
4481
4482 static struct security_operations selinux_ops = {
4483         .ptrace =                       selinux_ptrace,
4484         .capget =                       selinux_capget,
4485         .capset_check =                 selinux_capset_check,
4486         .capset_set =                   selinux_capset_set,
4487         .sysctl =                       selinux_sysctl,
4488         .capable =                      selinux_capable,
4489         .quotactl =                     selinux_quotactl,
4490         .quota_on =                     selinux_quota_on,
4491         .syslog =                       selinux_syslog,
4492         .vm_enough_memory =             selinux_vm_enough_memory,
4493
4494         .netlink_send =                 selinux_netlink_send,
4495         .netlink_recv =                 selinux_netlink_recv,
4496
4497         .bprm_alloc_security =          selinux_bprm_alloc_security,
4498         .bprm_free_security =           selinux_bprm_free_security,
4499         .bprm_apply_creds =             selinux_bprm_apply_creds,
4500         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4501         .bprm_set_security =            selinux_bprm_set_security,
4502         .bprm_check_security =          selinux_bprm_check_security,
4503         .bprm_secureexec =              selinux_bprm_secureexec,
4504
4505         .sb_alloc_security =            selinux_sb_alloc_security,
4506         .sb_free_security =             selinux_sb_free_security,
4507         .sb_copy_data =                 selinux_sb_copy_data,
4508         .sb_kern_mount =                selinux_sb_kern_mount,
4509         .sb_statfs =                    selinux_sb_statfs,
4510         .sb_mount =                     selinux_mount,
4511         .sb_umount =                    selinux_umount,
4512
4513         .inode_alloc_security =         selinux_inode_alloc_security,
4514         .inode_free_security =          selinux_inode_free_security,
4515         .inode_init_security =          selinux_inode_init_security,
4516         .inode_create =                 selinux_inode_create,
4517         .inode_link =                   selinux_inode_link,
4518         .inode_unlink =                 selinux_inode_unlink,
4519         .inode_symlink =                selinux_inode_symlink,
4520         .inode_mkdir =                  selinux_inode_mkdir,
4521         .inode_rmdir =                  selinux_inode_rmdir,
4522         .inode_mknod =                  selinux_inode_mknod,
4523         .inode_rename =                 selinux_inode_rename,
4524         .inode_readlink =               selinux_inode_readlink,
4525         .inode_follow_link =            selinux_inode_follow_link,
4526         .inode_permission =             selinux_inode_permission,
4527         .inode_setattr =                selinux_inode_setattr,
4528         .inode_getattr =                selinux_inode_getattr,
4529         .inode_setxattr =               selinux_inode_setxattr,
4530         .inode_post_setxattr =          selinux_inode_post_setxattr,
4531         .inode_getxattr =               selinux_inode_getxattr,
4532         .inode_listxattr =              selinux_inode_listxattr,
4533         .inode_removexattr =            selinux_inode_removexattr,
4534         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4535         .inode_getsecurity =            selinux_inode_getsecurity,
4536         .inode_setsecurity =            selinux_inode_setsecurity,
4537         .inode_listsecurity =           selinux_inode_listsecurity,
4538
4539         .file_permission =              selinux_file_permission,
4540         .file_alloc_security =          selinux_file_alloc_security,
4541         .file_free_security =           selinux_file_free_security,
4542         .file_ioctl =                   selinux_file_ioctl,
4543         .file_mmap =                    selinux_file_mmap,
4544         .file_mprotect =                selinux_file_mprotect,
4545         .file_lock =                    selinux_file_lock,
4546         .file_fcntl =                   selinux_file_fcntl,
4547         .file_set_fowner =              selinux_file_set_fowner,
4548         .file_send_sigiotask =          selinux_file_send_sigiotask,
4549         .file_receive =                 selinux_file_receive,
4550
4551         .task_create =                  selinux_task_create,
4552         .task_alloc_security =          selinux_task_alloc_security,
4553         .task_free_security =           selinux_task_free_security,
4554         .task_setuid =                  selinux_task_setuid,
4555         .task_post_setuid =             selinux_task_post_setuid,
4556         .task_setgid =                  selinux_task_setgid,
4557         .task_setpgid =                 selinux_task_setpgid,
4558         .task_getpgid =                 selinux_task_getpgid,
4559         .task_getsid =                  selinux_task_getsid,
4560         .task_getsecid =                selinux_task_getsecid,
4561         .task_setgroups =               selinux_task_setgroups,
4562         .task_setnice =                 selinux_task_setnice,
4563         .task_setioprio =               selinux_task_setioprio,
4564         .task_getioprio =               selinux_task_getioprio,
4565         .task_setrlimit =               selinux_task_setrlimit,
4566         .task_setscheduler =            selinux_task_setscheduler,
4567         .task_getscheduler =            selinux_task_getscheduler,
4568         .task_movememory =              selinux_task_movememory,
4569         .task_kill =                    selinux_task_kill,
4570         .task_wait =                    selinux_task_wait,
4571         .task_prctl =                   selinux_task_prctl,
4572         .task_reparent_to_init =        selinux_task_reparent_to_init,
4573         .task_to_inode =                selinux_task_to_inode,
4574
4575         .ipc_permission =               selinux_ipc_permission,
4576
4577         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4578         .msg_msg_free_security =        selinux_msg_msg_free_security,
4579
4580         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4581         .msg_queue_free_security =      selinux_msg_queue_free_security,
4582         .msg_queue_associate =          selinux_msg_queue_associate,
4583         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4584         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4585         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4586
4587         .shm_alloc_security =           selinux_shm_alloc_security,
4588         .shm_free_security =            selinux_shm_free_security,
4589         .shm_associate =                selinux_shm_associate,
4590         .shm_shmctl =                   selinux_shm_shmctl,
4591         .shm_shmat =                    selinux_shm_shmat,
4592
4593         .sem_alloc_security =           selinux_sem_alloc_security,
4594         .sem_free_security =            selinux_sem_free_security,
4595         .sem_associate =                selinux_sem_associate,
4596         .sem_semctl =                   selinux_sem_semctl,
4597         .sem_semop =                    selinux_sem_semop,
4598
4599         .register_security =            selinux_register_security,
4600         .unregister_security =          selinux_unregister_security,
4601
4602         .d_instantiate =                selinux_d_instantiate,
4603
4604         .getprocattr =                  selinux_getprocattr,
4605         .setprocattr =                  selinux_setprocattr,
4606
4607         .secid_to_secctx =              selinux_secid_to_secctx,
4608         .release_secctx =               selinux_release_secctx,
4609
4610         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4611         .unix_may_send =                selinux_socket_unix_may_send,
4612
4613         .socket_create =                selinux_socket_create,
4614         .socket_post_create =           selinux_socket_post_create,
4615         .socket_bind =                  selinux_socket_bind,
4616         .socket_connect =               selinux_socket_connect,
4617         .socket_listen =                selinux_socket_listen,
4618         .socket_accept =                selinux_socket_accept,
4619         .socket_sendmsg =               selinux_socket_sendmsg,
4620         .socket_recvmsg =               selinux_socket_recvmsg,
4621         .socket_getsockname =           selinux_socket_getsockname,
4622         .socket_getpeername =           selinux_socket_getpeername,
4623         .socket_getsockopt =            selinux_socket_getsockopt,
4624         .socket_setsockopt =            selinux_socket_setsockopt,
4625         .socket_shutdown =              selinux_socket_shutdown,
4626         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4627         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4628         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4629         .sk_alloc_security =            selinux_sk_alloc_security,
4630         .sk_free_security =             selinux_sk_free_security,
4631         .sk_getsid =                    selinux_sk_getsid_security,
4632
4633 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4634         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4635         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4636         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4637         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4638         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4639         .xfrm_state_free_security =     selinux_xfrm_state_free,
4640         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4641         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4642 #endif
4643
4644 #ifdef CONFIG_KEYS
4645         .key_alloc =                    selinux_key_alloc,
4646         .key_free =                     selinux_key_free,
4647         .key_permission =               selinux_key_permission,
4648 #endif
4649 };
4650
4651 static __init int selinux_init(void)
4652 {
4653         struct task_security_struct *tsec;
4654
4655         if (!selinux_enabled) {
4656                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4657                 return 0;
4658         }
4659
4660         printk(KERN_INFO "SELinux:  Initializing.\n");
4661
4662         /* Set the security state for the initial task. */
4663         if (task_alloc_security(current))
4664                 panic("SELinux:  Failed to initialize initial task.\n");
4665         tsec = current->security;
4666         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4667
4668         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4669                                             sizeof(struct inode_security_struct),
4670                                             0, SLAB_PANIC, NULL, NULL);
4671         avc_init();
4672
4673         original_ops = secondary_ops = security_ops;
4674         if (!secondary_ops)
4675                 panic ("SELinux: No initial security operations\n");
4676         if (register_security (&selinux_ops))
4677                 panic("SELinux: Unable to register with kernel.\n");
4678
4679         if (selinux_enforcing) {
4680                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4681         } else {
4682                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4683         }
4684
4685 #ifdef CONFIG_KEYS
4686         /* Add security information to initial keyrings */
4687         selinux_key_alloc(&root_user_keyring, current,
4688                           KEY_ALLOC_NOT_IN_QUOTA);
4689         selinux_key_alloc(&root_session_keyring, current,
4690                           KEY_ALLOC_NOT_IN_QUOTA);
4691 #endif
4692
4693         return 0;
4694 }
4695
4696 void selinux_complete_init(void)
4697 {
4698         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4699
4700         /* Set up any superblocks initialized prior to the policy load. */
4701         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4702         spin_lock(&sb_lock);
4703         spin_lock(&sb_security_lock);
4704 next_sb:
4705         if (!list_empty(&superblock_security_head)) {
4706                 struct superblock_security_struct *sbsec =
4707                                 list_entry(superblock_security_head.next,
4708                                            struct superblock_security_struct,
4709                                            list);
4710                 struct super_block *sb = sbsec->sb;
4711                 sb->s_count++;
4712                 spin_unlock(&sb_security_lock);
4713                 spin_unlock(&sb_lock);
4714                 down_read(&sb->s_umount);
4715                 if (sb->s_root)
4716                         superblock_doinit(sb, NULL);
4717                 drop_super(sb);
4718                 spin_lock(&sb_lock);
4719                 spin_lock(&sb_security_lock);
4720                 list_del_init(&sbsec->list);
4721                 goto next_sb;
4722         }
4723         spin_unlock(&sb_security_lock);
4724         spin_unlock(&sb_lock);
4725 }
4726
4727 /* SELinux requires early initialization in order to label
4728    all processes and objects when they are created. */
4729 security_initcall(selinux_init);
4730
4731 #if defined(CONFIG_NETFILTER)
4732
4733 static struct nf_hook_ops selinux_ipv4_op = {
4734         .hook =         selinux_ipv4_postroute_last,
4735         .owner =        THIS_MODULE,
4736         .pf =           PF_INET,
4737         .hooknum =      NF_IP_POST_ROUTING,
4738         .priority =     NF_IP_PRI_SELINUX_LAST,
4739 };
4740
4741 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4742
4743 static struct nf_hook_ops selinux_ipv6_op = {
4744         .hook =         selinux_ipv6_postroute_last,
4745         .owner =        THIS_MODULE,
4746         .pf =           PF_INET6,
4747         .hooknum =      NF_IP6_POST_ROUTING,
4748         .priority =     NF_IP6_PRI_SELINUX_LAST,
4749 };
4750
4751 #endif  /* IPV6 */
4752
4753 static int __init selinux_nf_ip_init(void)
4754 {
4755         int err = 0;
4756
4757         if (!selinux_enabled)
4758                 goto out;
4759
4760         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4761
4762         err = nf_register_hook(&selinux_ipv4_op);
4763         if (err)
4764                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4765
4766 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4767
4768         err = nf_register_hook(&selinux_ipv6_op);
4769         if (err)
4770                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4771
4772 #endif  /* IPV6 */
4773
4774 out:
4775         return err;
4776 }
4777
4778 __initcall(selinux_nf_ip_init);
4779
4780 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4781 static void selinux_nf_ip_exit(void)
4782 {
4783         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4784
4785         nf_unregister_hook(&selinux_ipv4_op);
4786 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4787         nf_unregister_hook(&selinux_ipv6_op);
4788 #endif  /* IPV6 */
4789 }
4790 #endif
4791
4792 #else /* CONFIG_NETFILTER */
4793
4794 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4795 #define selinux_nf_ip_exit()
4796 #endif
4797
4798 #endif /* CONFIG_NETFILTER */
4799
4800 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4801 int selinux_disable(void)
4802 {
4803         extern void exit_sel_fs(void);
4804         static int selinux_disabled = 0;
4805
4806         if (ss_initialized) {
4807                 /* Not permitted after initial policy load. */
4808                 return -EINVAL;
4809         }
4810
4811         if (selinux_disabled) {
4812                 /* Only do this once. */
4813                 return -EINVAL;
4814         }
4815
4816         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4817
4818         selinux_disabled = 1;
4819         selinux_enabled = 0;
4820
4821         /* Reset security_ops to the secondary module, dummy or capability. */
4822         security_ops = secondary_ops;
4823
4824         /* Unregister netfilter hooks. */
4825         selinux_nf_ip_exit();
4826
4827         /* Unregister selinuxfs. */
4828         exit_sel_fs();
4829
4830         return 0;
4831 }
4832 #endif
4833
4834