1/*
   2 *  NSA Security-Enhanced Linux (SELinux) security module
   3 *
   4 *  This file contains the SELinux hook function implementations.
   5 *
   6 *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7 *	      Chris Vance, <cvance@nai.com>
   8 *	      Wayne Salamon, <wsalamon@nai.com>
   9 *	      James Morris <jmorris@redhat.com>
  10 *
  11 *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12 *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13 *					   Eric Paris <eparis@redhat.com>
  14 *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15 *			    <dgoeddel@trustedcs.com>
  16 *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17 *	Paul Moore <paul@paul-moore.com>
  18 *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19 *		       Yuichi Nakamura <ynakam@hitachisoft.jp>
  20 *
  21 *	This program is free software; you can redistribute it and/or modify
  22 *	it under the terms of the GNU General Public License version 2,
  23 *	as published by the Free Software Foundation.
  24 */
  25
  26#include <linux/init.h>
  27#include <linux/kd.h>
  28#include <linux/kernel.h>
  29#include <linux/tracehook.h>
  30#include <linux/errno.h>
  31#include <linux/sched.h>
  32#include <linux/security.h>
  33#include <linux/xattr.h>
  34#include <linux/capability.h>
  35#include <linux/unistd.h>
  36#include <linux/mm.h>
  37#include <linux/mman.h>
  38#include <linux/slab.h>
  39#include <linux/pagemap.h>
  40#include <linux/proc_fs.h>
  41#include <linux/swap.h>
  42#include <linux/spinlock.h>
  43#include <linux/syscalls.h>
  44#include <linux/dcache.h>
  45#include <linux/file.h>
  46#include <linux/fdtable.h>
  47#include <linux/namei.h>
  48#include <linux/mount.h>
  49#include <linux/netfilter_ipv4.h>
  50#include <linux/netfilter_ipv6.h>
  51#include <linux/tty.h>
  52#include <net/icmp.h>
  53#include <net/ip.h>		/* for local_port_range[] */
  54#include <net/sock.h>
  55#include <net/tcp.h>		/* struct or_callable used in sock_rcv_skb */
  56#include <net/inet_connection_sock.h>
  57#include <net/net_namespace.h>
  58#include <net/netlabel.h>
  59#include <linux/uaccess.h>
  60#include <asm/ioctls.h>
  61#include <linux/atomic.h>
  62#include <linux/bitops.h>
  63#include <linux/interrupt.h>
  64#include <linux/netdevice.h>	/* for network interface checks */
  65#include <net/netlink.h>
  66#include <linux/tcp.h>
  67#include <linux/udp.h>
  68#include <linux/dccp.h>
  69#include <linux/quota.h>
  70#include <linux/un.h>		/* for Unix socket types */
  71#include <net/af_unix.h>	/* for Unix socket types */
  72#include <linux/parser.h>
  73#include <linux/nfs_mount.h>
  74#include <net/ipv6.h>
  75#include <linux/hugetlb.h>
  76#include <linux/personality.h>
  77#include <linux/audit.h>
  78#include <linux/string.h>
  79#include <linux/selinux.h>
  80#include <linux/mutex.h>
  81#include <linux/posix-timers.h>
  82#include <linux/syslog.h>
  83#include <linux/user_namespace.h>
  84#include <linux/export.h>
  85#include <linux/msg.h>
  86#include <linux/shm.h>
  87
  88#include "avc.h"
  89#include "objsec.h"
  90#include "netif.h"
  91#include "netnode.h"
  92#include "netport.h"
  93#include "xfrm.h"
  94#include "netlabel.h"
  95#include "audit.h"
  96#include "avc_ss.h"
  97
 
 
  98extern struct security_operations *security_ops;
  99
 100/* SECMARK reference count */
 101static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104int selinux_enforcing;
 105
 106static int __init enforcing_setup(char *str)
 107{
 108	unsigned long enforcing;
 109	if (!kstrtoul(str, 0, &enforcing))
 110		selinux_enforcing = enforcing ? 1 : 0;
 111	return 1;
 112}
 113__setup("enforcing=", enforcing_setup);
 114#endif
 115
 116#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119static int __init selinux_enabled_setup(char *str)
 120{
 121	unsigned long enabled;
 122	if (!kstrtoul(str, 0, &enabled))
 123		selinux_enabled = enabled ? 1 : 0;
 124	return 1;
 125}
 126__setup("selinux=", selinux_enabled_setup);
 127#else
 128int selinux_enabled = 1;
 129#endif
 130
 131static struct kmem_cache *sel_inode_cache;
 132
 133/**
 134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135 *
 136 * Description:
 137 * This function checks the SECMARK reference counter to see if any SECMARK
 138 * targets are currently configured, if the reference counter is greater than
 139 * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140 * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 141 * policy capability is enabled, SECMARK is always considered enabled.
 142 *
 143 */
 144static int selinux_secmark_enabled(void)
 145{
 146	return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 147}
 148
 149/**
 150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 151 *
 152 * Description:
 153 * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 154 * (1) if any are enabled or false (0) if neither are enabled.  If the
 155 * always_check_network policy capability is enabled, peer labeling
 156 * is always considered enabled.
 157 *
 158 */
 159static int selinux_peerlbl_enabled(void)
 160{
 161	return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 162}
 163
 164/*
 165 * initialise the security for the init task
 166 */
 167static void cred_init_security(void)
 168{
 169	struct cred *cred = (struct cred *) current->real_cred;
 170	struct task_security_struct *tsec;
 171
 172	tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 173	if (!tsec)
 174		panic("SELinux:  Failed to initialize initial task.\n");
 175
 176	tsec->osid = tsec->sid = SECINITSID_KERNEL;
 177	cred->security = tsec;
 178}
 179
 180/*
 181 * get the security ID of a set of credentials
 182 */
 183static inline u32 cred_sid(const struct cred *cred)
 184{
 185	const struct task_security_struct *tsec;
 186
 187	tsec = cred->security;
 188	return tsec->sid;
 189}
 190
 191/*
 192 * get the objective security ID of a task
 193 */
 194static inline u32 task_sid(const struct task_struct *task)
 195{
 196	u32 sid;
 197
 198	rcu_read_lock();
 199	sid = cred_sid(__task_cred(task));
 200	rcu_read_unlock();
 201	return sid;
 202}
 203
 204/*
 205 * get the subjective security ID of the current task
 206 */
 207static inline u32 current_sid(void)
 208{
 209	const struct task_security_struct *tsec = current_security();
 210
 211	return tsec->sid;
 212}
 213
 214/* Allocate and free functions for each kind of security blob. */
 215
 216static int inode_alloc_security(struct inode *inode)
 217{
 218	struct inode_security_struct *isec;
 219	u32 sid = current_sid();
 220
 221	isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222	if (!isec)
 223		return -ENOMEM;
 224
 225	mutex_init(&isec->lock);
 226	INIT_LIST_HEAD(&isec->list);
 227	isec->inode = inode;
 228	isec->sid = SECINITSID_UNLABELED;
 229	isec->sclass = SECCLASS_FILE;
 230	isec->task_sid = sid;
 231	inode->i_security = isec;
 232
 233	return 0;
 234}
 235
 236static void inode_free_rcu(struct rcu_head *head)
 237{
 238	struct inode_security_struct *isec;
 239
 240	isec = container_of(head, struct inode_security_struct, rcu);
 241	kmem_cache_free(sel_inode_cache, isec);
 242}
 243
 244static void inode_free_security(struct inode *inode)
 245{
 246	struct inode_security_struct *isec = inode->i_security;
 247	struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 248
 249	spin_lock(&sbsec->isec_lock);
 250	if (!list_empty(&isec->list))
 251		list_del_init(&isec->list);
 252	spin_unlock(&sbsec->isec_lock);
 253
 254	/*
 255	 * The inode may still be referenced in a path walk and
 256	 * a call to selinux_inode_permission() can be made
 257	 * after inode_free_security() is called. Ideally, the VFS
 258	 * wouldn't do this, but fixing that is a much harder
 259	 * job. For now, simply free the i_security via RCU, and
 260	 * leave the current inode->i_security pointer intact.
 261	 * The inode will be freed after the RCU grace period too.
 262	 */
 263	call_rcu(&isec->rcu, inode_free_rcu);
 264}
 265
 266static int file_alloc_security(struct file *file)
 267{
 268	struct file_security_struct *fsec;
 269	u32 sid = current_sid();
 270
 271	fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 272	if (!fsec)
 273		return -ENOMEM;
 274
 275	fsec->sid = sid;
 276	fsec->fown_sid = sid;
 277	file->f_security = fsec;
 278
 279	return 0;
 280}
 281
 282static void file_free_security(struct file *file)
 283{
 284	struct file_security_struct *fsec = file->f_security;
 285	file->f_security = NULL;
 286	kfree(fsec);
 287}
 288
 289static int superblock_alloc_security(struct super_block *sb)
 290{
 291	struct superblock_security_struct *sbsec;
 292
 293	sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 294	if (!sbsec)
 295		return -ENOMEM;
 296
 297	mutex_init(&sbsec->lock);
 298	INIT_LIST_HEAD(&sbsec->isec_head);
 299	spin_lock_init(&sbsec->isec_lock);
 300	sbsec->sb = sb;
 301	sbsec->sid = SECINITSID_UNLABELED;
 302	sbsec->def_sid = SECINITSID_FILE;
 303	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 304	sb->s_security = sbsec;
 305
 306	return 0;
 307}
 308
 309static void superblock_free_security(struct super_block *sb)
 310{
 311	struct superblock_security_struct *sbsec = sb->s_security;
 312	sb->s_security = NULL;
 313	kfree(sbsec);
 314}
 315
 316/* The file system's label must be initialized prior to use. */
 317
 318static const char *labeling_behaviors[7] = {
 319	"uses xattr",
 320	"uses transition SIDs",
 321	"uses task SIDs",
 322	"uses genfs_contexts",
 323	"not configured for labeling",
 324	"uses mountpoint labeling",
 325	"uses native labeling",
 326};
 327
 328static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 329
 330static inline int inode_doinit(struct inode *inode)
 331{
 332	return inode_doinit_with_dentry(inode, NULL);
 333}
 334
 335enum {
 336	Opt_error = -1,
 337	Opt_context = 1,
 338	Opt_fscontext = 2,
 339	Opt_defcontext = 3,
 340	Opt_rootcontext = 4,
 341	Opt_labelsupport = 5,
 342	Opt_nextmntopt = 6,
 343};
 344
 345#define NUM_SEL_MNT_OPTS	(Opt_nextmntopt - 1)
 346
 347static const match_table_t tokens = {
 348	{Opt_context, CONTEXT_STR "%s"},
 349	{Opt_fscontext, FSCONTEXT_STR "%s"},
 350	{Opt_defcontext, DEFCONTEXT_STR "%s"},
 351	{Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 352	{Opt_labelsupport, LABELSUPP_STR},
 353	{Opt_error, NULL},
 354};
 355
 356#define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 357
 358static int may_context_mount_sb_relabel(u32 sid,
 359			struct superblock_security_struct *sbsec,
 360			const struct cred *cred)
 361{
 362	const struct task_security_struct *tsec = cred->security;
 363	int rc;
 364
 365	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 366			  FILESYSTEM__RELABELFROM, NULL);
 367	if (rc)
 368		return rc;
 369
 370	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 371			  FILESYSTEM__RELABELTO, NULL);
 372	return rc;
 373}
 374
 375static int may_context_mount_inode_relabel(u32 sid,
 376			struct superblock_security_struct *sbsec,
 377			const struct cred *cred)
 378{
 379	const struct task_security_struct *tsec = cred->security;
 380	int rc;
 381	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 382			  FILESYSTEM__RELABELFROM, NULL);
 383	if (rc)
 384		return rc;
 385
 386	rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 387			  FILESYSTEM__ASSOCIATE, NULL);
 388	return rc;
 389}
 390
 391static int selinux_is_sblabel_mnt(struct super_block *sb)
 392{
 393	struct superblock_security_struct *sbsec = sb->s_security;
 394
 395	if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 396	    sbsec->behavior == SECURITY_FS_USE_TRANS ||
 397	    sbsec->behavior == SECURITY_FS_USE_TASK)
 398		return 1;
 399
 400	/* Special handling for sysfs. Is genfs but also has setxattr handler*/
 401	if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 402		return 1;
 403
 404	/*
 405	 * Special handling for rootfs. Is genfs but supports
 406	 * setting SELinux context on in-core inodes.
 407	 */
 408	if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 409		return 1;
 410
 411	return 0;
 412}
 413
 414static int sb_finish_set_opts(struct super_block *sb)
 415{
 416	struct superblock_security_struct *sbsec = sb->s_security;
 417	struct dentry *root = sb->s_root;
 418	struct inode *root_inode = root->d_inode;
 419	int rc = 0;
 420
 421	if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422		/* Make sure that the xattr handler exists and that no
 423		   error other than -ENODATA is returned by getxattr on
 424		   the root directory.  -ENODATA is ok, as this may be
 425		   the first boot of the SELinux kernel before we have
 426		   assigned xattr values to the filesystem. */
 427		if (!root_inode->i_op->getxattr) {
 428			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429			       "xattr support\n", sb->s_id, sb->s_type->name);
 430			rc = -EOPNOTSUPP;
 431			goto out;
 432		}
 433		rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434		if (rc < 0 && rc != -ENODATA) {
 435			if (rc == -EOPNOTSUPP)
 436				printk(KERN_WARNING "SELinux: (dev %s, type "
 437				       "%s) has no security xattr handler\n",
 438				       sb->s_id, sb->s_type->name);
 439			else
 440				printk(KERN_WARNING "SELinux: (dev %s, type "
 441				       "%s) getxattr errno %d\n", sb->s_id,
 442				       sb->s_type->name, -rc);
 443			goto out;
 444		}
 445	}
 446
 
 
 447	if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448		printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449		       sb->s_id, sb->s_type->name);
 450	else
 451		printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 452		       sb->s_id, sb->s_type->name,
 453		       labeling_behaviors[sbsec->behavior-1]);
 454
 455	sbsec->flags |= SE_SBINITIALIZED;
 456	if (selinux_is_sblabel_mnt(sb))
 457		sbsec->flags |= SBLABEL_MNT;
 
 
 
 
 
 
 458
 459	/* Initialize the root inode. */
 460	rc = inode_doinit_with_dentry(root_inode, root);
 461
 462	/* Initialize any other inodes associated with the superblock, e.g.
 463	   inodes created prior to initial policy load or inodes created
 464	   during get_sb by a pseudo filesystem that directly
 465	   populates itself. */
 466	spin_lock(&sbsec->isec_lock);
 467next_inode:
 468	if (!list_empty(&sbsec->isec_head)) {
 469		struct inode_security_struct *isec =
 470				list_entry(sbsec->isec_head.next,
 471					   struct inode_security_struct, list);
 472		struct inode *inode = isec->inode;
 473		spin_unlock(&sbsec->isec_lock);
 474		inode = igrab(inode);
 475		if (inode) {
 476			if (!IS_PRIVATE(inode))
 477				inode_doinit(inode);
 478			iput(inode);
 479		}
 480		spin_lock(&sbsec->isec_lock);
 481		list_del_init(&isec->list);
 482		goto next_inode;
 483	}
 484	spin_unlock(&sbsec->isec_lock);
 485out:
 486	return rc;
 487}
 488
 489/*
 490 * This function should allow an FS to ask what it's mount security
 491 * options were so it can use those later for submounts, displaying
 492 * mount options, or whatever.
 493 */
 494static int selinux_get_mnt_opts(const struct super_block *sb,
 495				struct security_mnt_opts *opts)
 496{
 497	int rc = 0, i;
 498	struct superblock_security_struct *sbsec = sb->s_security;
 499	char *context = NULL;
 500	u32 len;
 501	char tmp;
 502
 503	security_init_mnt_opts(opts);
 504
 505	if (!(sbsec->flags & SE_SBINITIALIZED))
 506		return -EINVAL;
 507
 508	if (!ss_initialized)
 509		return -EINVAL;
 510
 511	/* make sure we always check enough bits to cover the mask */
 512	BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 513
 514	tmp = sbsec->flags & SE_MNTMASK;
 515	/* count the number of mount options for this sb */
 516	for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 517		if (tmp & 0x01)
 518			opts->num_mnt_opts++;
 519		tmp >>= 1;
 520	}
 521	/* Check if the Label support flag is set */
 522	if (sbsec->flags & SBLABEL_MNT)
 523		opts->num_mnt_opts++;
 524
 525	opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 526	if (!opts->mnt_opts) {
 527		rc = -ENOMEM;
 528		goto out_free;
 529	}
 530
 531	opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 532	if (!opts->mnt_opts_flags) {
 533		rc = -ENOMEM;
 534		goto out_free;
 535	}
 536
 537	i = 0;
 538	if (sbsec->flags & FSCONTEXT_MNT) {
 539		rc = security_sid_to_context(sbsec->sid, &context, &len);
 540		if (rc)
 541			goto out_free;
 542		opts->mnt_opts[i] = context;
 543		opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 544	}
 545	if (sbsec->flags & CONTEXT_MNT) {
 546		rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 547		if (rc)
 548			goto out_free;
 549		opts->mnt_opts[i] = context;
 550		opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 551	}
 552	if (sbsec->flags & DEFCONTEXT_MNT) {
 553		rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 554		if (rc)
 555			goto out_free;
 556		opts->mnt_opts[i] = context;
 557		opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 558	}
 559	if (sbsec->flags & ROOTCONTEXT_MNT) {
 560		struct inode *root = sbsec->sb->s_root->d_inode;
 561		struct inode_security_struct *isec = root->i_security;
 562
 563		rc = security_sid_to_context(isec->sid, &context, &len);
 564		if (rc)
 565			goto out_free;
 566		opts->mnt_opts[i] = context;
 567		opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 568	}
 569	if (sbsec->flags & SBLABEL_MNT) {
 570		opts->mnt_opts[i] = NULL;
 571		opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 572	}
 573
 574	BUG_ON(i != opts->num_mnt_opts);
 575
 576	return 0;
 577
 578out_free:
 579	security_free_mnt_opts(opts);
 580	return rc;
 581}
 582
 583static int bad_option(struct superblock_security_struct *sbsec, char flag,
 584		      u32 old_sid, u32 new_sid)
 585{
 586	char mnt_flags = sbsec->flags & SE_MNTMASK;
 587
 588	/* check if the old mount command had the same options */
 589	if (sbsec->flags & SE_SBINITIALIZED)
 590		if (!(sbsec->flags & flag) ||
 591		    (old_sid != new_sid))
 592			return 1;
 593
 594	/* check if we were passed the same options twice,
 595	 * aka someone passed context=a,context=b
 596	 */
 597	if (!(sbsec->flags & SE_SBINITIALIZED))
 598		if (mnt_flags & flag)
 599			return 1;
 600	return 0;
 601}
 602
 603/*
 604 * Allow filesystems with binary mount data to explicitly set mount point
 605 * labeling information.
 606 */
 607static int selinux_set_mnt_opts(struct super_block *sb,
 608				struct security_mnt_opts *opts,
 609				unsigned long kern_flags,
 610				unsigned long *set_kern_flags)
 611{
 612	const struct cred *cred = current_cred();
 613	int rc = 0, i;
 614	struct superblock_security_struct *sbsec = sb->s_security;
 615	const char *name = sb->s_type->name;
 616	struct inode *inode = sbsec->sb->s_root->d_inode;
 617	struct inode_security_struct *root_isec = inode->i_security;
 618	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 619	u32 defcontext_sid = 0;
 620	char **mount_options = opts->mnt_opts;
 621	int *flags = opts->mnt_opts_flags;
 622	int num_opts = opts->num_mnt_opts;
 623
 624	mutex_lock(&sbsec->lock);
 625
 626	if (!ss_initialized) {
 627		if (!num_opts) {
 628			/* Defer initialization until selinux_complete_init,
 629			   after the initial policy is loaded and the security
 630			   server is ready to handle calls. */
 631			goto out;
 632		}
 633		rc = -EINVAL;
 634		printk(KERN_WARNING "SELinux: Unable to set superblock options "
 635			"before the security server is initialized\n");
 636		goto out;
 637	}
 638	if (kern_flags && !set_kern_flags) {
 639		/* Specifying internal flags without providing a place to
 640		 * place the results is not allowed */
 641		rc = -EINVAL;
 642		goto out;
 643	}
 644
 645	/*
 646	 * Binary mount data FS will come through this function twice.  Once
 647	 * from an explicit call and once from the generic calls from the vfs.
 648	 * Since the generic VFS calls will not contain any security mount data
 649	 * we need to skip the double mount verification.
 650	 *
 651	 * This does open a hole in which we will not notice if the first
 652	 * mount using this sb set explict options and a second mount using
 653	 * this sb does not set any security options.  (The first options
 654	 * will be used for both mounts)
 655	 */
 656	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 657	    && (num_opts == 0))
 658		goto out;
 659
 660	/*
 661	 * parse the mount options, check if they are valid sids.
 662	 * also check if someone is trying to mount the same sb more
 663	 * than once with different security options.
 664	 */
 665	for (i = 0; i < num_opts; i++) {
 666		u32 sid;
 667
 668		if (flags[i] == SBLABEL_MNT)
 669			continue;
 670		rc = security_context_to_sid(mount_options[i],
 671					     strlen(mount_options[i]), &sid, GFP_KERNEL);
 672		if (rc) {
 673			printk(KERN_WARNING "SELinux: security_context_to_sid"
 674			       "(%s) failed for (dev %s, type %s) errno=%d\n",
 675			       mount_options[i], sb->s_id, name, rc);
 676			goto out;
 677		}
 678		switch (flags[i]) {
 679		case FSCONTEXT_MNT:
 680			fscontext_sid = sid;
 681
 682			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 683					fscontext_sid))
 684				goto out_double_mount;
 685
 686			sbsec->flags |= FSCONTEXT_MNT;
 687			break;
 688		case CONTEXT_MNT:
 689			context_sid = sid;
 690
 691			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 692					context_sid))
 693				goto out_double_mount;
 694
 695			sbsec->flags |= CONTEXT_MNT;
 696			break;
 697		case ROOTCONTEXT_MNT:
 698			rootcontext_sid = sid;
 699
 700			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 701					rootcontext_sid))
 702				goto out_double_mount;
 703
 704			sbsec->flags |= ROOTCONTEXT_MNT;
 705
 706			break;
 707		case DEFCONTEXT_MNT:
 708			defcontext_sid = sid;
 709
 710			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 711					defcontext_sid))
 712				goto out_double_mount;
 713
 714			sbsec->flags |= DEFCONTEXT_MNT;
 715
 716			break;
 717		default:
 718			rc = -EINVAL;
 719			goto out;
 720		}
 721	}
 722
 723	if (sbsec->flags & SE_SBINITIALIZED) {
 724		/* previously mounted with options, but not on this attempt? */
 725		if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 726			goto out_double_mount;
 727		rc = 0;
 728		goto out;
 729	}
 730
 731	if (strcmp(sb->s_type->name, "proc") == 0)
 732		sbsec->flags |= SE_SBPROC;
 733
 734	if (!sbsec->behavior) {
 735		/*
 736		 * Determine the labeling behavior to use for this
 737		 * filesystem type.
 738		 */
 739		rc = security_fs_use(sb);
 740		if (rc) {
 741			printk(KERN_WARNING
 742				"%s: security_fs_use(%s) returned %d\n",
 743					__func__, sb->s_type->name, rc);
 744			goto out;
 745		}
 746	}
 
 747	/* sets the context of the superblock for the fs being mounted. */
 748	if (fscontext_sid) {
 749		rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 750		if (rc)
 751			goto out;
 752
 753		sbsec->sid = fscontext_sid;
 754	}
 755
 756	/*
 757	 * Switch to using mount point labeling behavior.
 758	 * sets the label used on all file below the mountpoint, and will set
 759	 * the superblock context if not already set.
 760	 */
 761	if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 762		sbsec->behavior = SECURITY_FS_USE_NATIVE;
 763		*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 764	}
 765
 766	if (context_sid) {
 767		if (!fscontext_sid) {
 768			rc = may_context_mount_sb_relabel(context_sid, sbsec,
 769							  cred);
 770			if (rc)
 771				goto out;
 772			sbsec->sid = context_sid;
 773		} else {
 774			rc = may_context_mount_inode_relabel(context_sid, sbsec,
 775							     cred);
 776			if (rc)
 777				goto out;
 778		}
 779		if (!rootcontext_sid)
 780			rootcontext_sid = context_sid;
 781
 782		sbsec->mntpoint_sid = context_sid;
 783		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 784	}
 785
 786	if (rootcontext_sid) {
 787		rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 788						     cred);
 789		if (rc)
 790			goto out;
 791
 792		root_isec->sid = rootcontext_sid;
 793		root_isec->initialized = 1;
 794	}
 795
 796	if (defcontext_sid) {
 797		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 798			sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 799			rc = -EINVAL;
 800			printk(KERN_WARNING "SELinux: defcontext option is "
 801			       "invalid for this filesystem type\n");
 802			goto out;
 803		}
 804
 805		if (defcontext_sid != sbsec->def_sid) {
 806			rc = may_context_mount_inode_relabel(defcontext_sid,
 807							     sbsec, cred);
 808			if (rc)
 809				goto out;
 810		}
 811
 812		sbsec->def_sid = defcontext_sid;
 813	}
 814
 815	rc = sb_finish_set_opts(sb);
 816out:
 817	mutex_unlock(&sbsec->lock);
 818	return rc;
 819out_double_mount:
 820	rc = -EINVAL;
 821	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 822	       "security settings for (dev %s, type %s)\n", sb->s_id, name);
 823	goto out;
 824}
 825
 826static int selinux_cmp_sb_context(const struct super_block *oldsb,
 827				    const struct super_block *newsb)
 828{
 829	struct superblock_security_struct *old = oldsb->s_security;
 830	struct superblock_security_struct *new = newsb->s_security;
 831	char oldflags = old->flags & SE_MNTMASK;
 832	char newflags = new->flags & SE_MNTMASK;
 833
 834	if (oldflags != newflags)
 835		goto mismatch;
 836	if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 837		goto mismatch;
 838	if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 839		goto mismatch;
 840	if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 841		goto mismatch;
 842	if (oldflags & ROOTCONTEXT_MNT) {
 843		struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 844		struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 845		if (oldroot->sid != newroot->sid)
 846			goto mismatch;
 847	}
 848	return 0;
 849mismatch:
 850	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 851			    "different security settings for (dev %s, "
 852			    "type %s)\n", newsb->s_id, newsb->s_type->name);
 853	return -EBUSY;
 854}
 855
 856static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 857					struct super_block *newsb)
 858{
 859	const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 860	struct superblock_security_struct *newsbsec = newsb->s_security;
 861
 862	int set_fscontext =	(oldsbsec->flags & FSCONTEXT_MNT);
 863	int set_context =	(oldsbsec->flags & CONTEXT_MNT);
 864	int set_rootcontext =	(oldsbsec->flags & ROOTCONTEXT_MNT);
 865
 866	/*
 867	 * if the parent was able to be mounted it clearly had no special lsm
 868	 * mount options.  thus we can safely deal with this superblock later
 869	 */
 870	if (!ss_initialized)
 871		return 0;
 872
 873	/* how can we clone if the old one wasn't set up?? */
 874	BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 875
 876	/* if fs is reusing a sb, make sure that the contexts match */
 877	if (newsbsec->flags & SE_SBINITIALIZED)
 878		return selinux_cmp_sb_context(oldsb, newsb);
 879
 880	mutex_lock(&newsbsec->lock);
 881
 882	newsbsec->flags = oldsbsec->flags;
 883
 884	newsbsec->sid = oldsbsec->sid;
 885	newsbsec->def_sid = oldsbsec->def_sid;
 886	newsbsec->behavior = oldsbsec->behavior;
 887
 888	if (set_context) {
 889		u32 sid = oldsbsec->mntpoint_sid;
 890
 891		if (!set_fscontext)
 892			newsbsec->sid = sid;
 893		if (!set_rootcontext) {
 894			struct inode *newinode = newsb->s_root->d_inode;
 895			struct inode_security_struct *newisec = newinode->i_security;
 896			newisec->sid = sid;
 897		}
 898		newsbsec->mntpoint_sid = sid;
 899	}
 900	if (set_rootcontext) {
 901		const struct inode *oldinode = oldsb->s_root->d_inode;
 902		const struct inode_security_struct *oldisec = oldinode->i_security;
 903		struct inode *newinode = newsb->s_root->d_inode;
 904		struct inode_security_struct *newisec = newinode->i_security;
 905
 906		newisec->sid = oldisec->sid;
 907	}
 908
 909	sb_finish_set_opts(newsb);
 910	mutex_unlock(&newsbsec->lock);
 911	return 0;
 912}
 913
 914static int selinux_parse_opts_str(char *options,
 915				  struct security_mnt_opts *opts)
 916{
 917	char *p;
 918	char *context = NULL, *defcontext = NULL;
 919	char *fscontext = NULL, *rootcontext = NULL;
 920	int rc, num_mnt_opts = 0;
 921
 922	opts->num_mnt_opts = 0;
 923
 924	/* Standard string-based options. */
 925	while ((p = strsep(&options, "|")) != NULL) {
 926		int token;
 927		substring_t args[MAX_OPT_ARGS];
 928
 929		if (!*p)
 930			continue;
 931
 932		token = match_token(p, tokens, args);
 933
 934		switch (token) {
 935		case Opt_context:
 936			if (context || defcontext) {
 937				rc = -EINVAL;
 938				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 939				goto out_err;
 940			}
 941			context = match_strdup(&args[0]);
 942			if (!context) {
 943				rc = -ENOMEM;
 944				goto out_err;
 945			}
 946			break;
 947
 948		case Opt_fscontext:
 949			if (fscontext) {
 950				rc = -EINVAL;
 951				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 952				goto out_err;
 953			}
 954			fscontext = match_strdup(&args[0]);
 955			if (!fscontext) {
 956				rc = -ENOMEM;
 957				goto out_err;
 958			}
 959			break;
 960
 961		case Opt_rootcontext:
 962			if (rootcontext) {
 963				rc = -EINVAL;
 964				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 965				goto out_err;
 966			}
 967			rootcontext = match_strdup(&args[0]);
 968			if (!rootcontext) {
 969				rc = -ENOMEM;
 970				goto out_err;
 971			}
 972			break;
 973
 974		case Opt_defcontext:
 975			if (context || defcontext) {
 976				rc = -EINVAL;
 977				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 978				goto out_err;
 979			}
 980			defcontext = match_strdup(&args[0]);
 981			if (!defcontext) {
 982				rc = -ENOMEM;
 983				goto out_err;
 984			}
 985			break;
 986		case Opt_labelsupport:
 987			break;
 988		default:
 989			rc = -EINVAL;
 990			printk(KERN_WARNING "SELinux:  unknown mount option\n");
 991			goto out_err;
 992
 993		}
 994	}
 995
 996	rc = -ENOMEM;
 997	opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 998	if (!opts->mnt_opts)
 999		goto out_err;
1000
1001	opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002	if (!opts->mnt_opts_flags) {
1003		kfree(opts->mnt_opts);
1004		goto out_err;
1005	}
1006
1007	if (fscontext) {
1008		opts->mnt_opts[num_mnt_opts] = fscontext;
1009		opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010	}
1011	if (context) {
1012		opts->mnt_opts[num_mnt_opts] = context;
1013		opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014	}
1015	if (rootcontext) {
1016		opts->mnt_opts[num_mnt_opts] = rootcontext;
1017		opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018	}
1019	if (defcontext) {
1020		opts->mnt_opts[num_mnt_opts] = defcontext;
1021		opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022	}
1023
1024	opts->num_mnt_opts = num_mnt_opts;
1025	return 0;
1026
1027out_err:
1028	kfree(context);
1029	kfree(defcontext);
1030	kfree(fscontext);
1031	kfree(rootcontext);
1032	return rc;
1033}
1034/*
1035 * string mount options parsing and call set the sbsec
1036 */
1037static int superblock_doinit(struct super_block *sb, void *data)
1038{
1039	int rc = 0;
1040	char *options = data;
1041	struct security_mnt_opts opts;
1042
1043	security_init_mnt_opts(&opts);
1044
1045	if (!data)
1046		goto out;
1047
1048	BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050	rc = selinux_parse_opts_str(options, &opts);
1051	if (rc)
1052		goto out_err;
1053
1054out:
1055	rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057out_err:
1058	security_free_mnt_opts(&opts);
1059	return rc;
1060}
1061
1062static void selinux_write_opts(struct seq_file *m,
1063			       struct security_mnt_opts *opts)
1064{
1065	int i;
1066	char *prefix;
1067
1068	for (i = 0; i < opts->num_mnt_opts; i++) {
1069		char *has_comma;
1070
1071		if (opts->mnt_opts[i])
1072			has_comma = strchr(opts->mnt_opts[i], ',');
1073		else
1074			has_comma = NULL;
1075
1076		switch (opts->mnt_opts_flags[i]) {
1077		case CONTEXT_MNT:
1078			prefix = CONTEXT_STR;
1079			break;
1080		case FSCONTEXT_MNT:
1081			prefix = FSCONTEXT_STR;
1082			break;
1083		case ROOTCONTEXT_MNT:
1084			prefix = ROOTCONTEXT_STR;
1085			break;
1086		case DEFCONTEXT_MNT:
1087			prefix = DEFCONTEXT_STR;
1088			break;
1089		case SBLABEL_MNT:
1090			seq_putc(m, ',');
1091			seq_puts(m, LABELSUPP_STR);
1092			continue;
1093		default:
1094			BUG();
1095			return;
1096		};
1097		/* we need a comma before each option */
1098		seq_putc(m, ',');
1099		seq_puts(m, prefix);
1100		if (has_comma)
1101			seq_putc(m, '\"');
1102		seq_puts(m, opts->mnt_opts[i]);
1103		if (has_comma)
1104			seq_putc(m, '\"');
1105	}
1106}
1107
1108static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109{
1110	struct security_mnt_opts opts;
1111	int rc;
1112
1113	rc = selinux_get_mnt_opts(sb, &opts);
1114	if (rc) {
1115		/* before policy load we may get EINVAL, don't show anything */
1116		if (rc == -EINVAL)
1117			rc = 0;
1118		return rc;
1119	}
1120
1121	selinux_write_opts(m, &opts);
1122
1123	security_free_mnt_opts(&opts);
1124
1125	return rc;
1126}
1127
1128static inline u16 inode_mode_to_security_class(umode_t mode)
1129{
1130	switch (mode & S_IFMT) {
1131	case S_IFSOCK:
1132		return SECCLASS_SOCK_FILE;
1133	case S_IFLNK:
1134		return SECCLASS_LNK_FILE;
1135	case S_IFREG:
1136		return SECCLASS_FILE;
1137	case S_IFBLK:
1138		return SECCLASS_BLK_FILE;
1139	case S_IFDIR:
1140		return SECCLASS_DIR;
1141	case S_IFCHR:
1142		return SECCLASS_CHR_FILE;
1143	case S_IFIFO:
1144		return SECCLASS_FIFO_FILE;
1145
1146	}
1147
1148	return SECCLASS_FILE;
1149}
1150
1151static inline int default_protocol_stream(int protocol)
1152{
1153	return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154}
1155
1156static inline int default_protocol_dgram(int protocol)
1157{
1158	return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159}
1160
1161static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162{
1163	switch (family) {
1164	case PF_UNIX:
1165		switch (type) {
1166		case SOCK_STREAM:
1167		case SOCK_SEQPACKET:
1168			return SECCLASS_UNIX_STREAM_SOCKET;
1169		case SOCK_DGRAM:
1170			return SECCLASS_UNIX_DGRAM_SOCKET;
1171		}
1172		break;
1173	case PF_INET:
1174	case PF_INET6:
1175		switch (type) {
1176		case SOCK_STREAM:
1177			if (default_protocol_stream(protocol))
1178				return SECCLASS_TCP_SOCKET;
1179			else
1180				return SECCLASS_RAWIP_SOCKET;
1181		case SOCK_DGRAM:
1182			if (default_protocol_dgram(protocol))
1183				return SECCLASS_UDP_SOCKET;
1184			else
1185				return SECCLASS_RAWIP_SOCKET;
1186		case SOCK_DCCP:
1187			return SECCLASS_DCCP_SOCKET;
1188		default:
1189			return SECCLASS_RAWIP_SOCKET;
1190		}
1191		break;
1192	case PF_NETLINK:
1193		switch (protocol) {
1194		case NETLINK_ROUTE:
1195			return SECCLASS_NETLINK_ROUTE_SOCKET;
1196		case NETLINK_FIREWALL:
1197			return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198		case NETLINK_SOCK_DIAG:
1199			return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200		case NETLINK_NFLOG:
1201			return SECCLASS_NETLINK_NFLOG_SOCKET;
1202		case NETLINK_XFRM:
1203			return SECCLASS_NETLINK_XFRM_SOCKET;
1204		case NETLINK_SELINUX:
1205			return SECCLASS_NETLINK_SELINUX_SOCKET;
1206		case NETLINK_AUDIT:
1207			return SECCLASS_NETLINK_AUDIT_SOCKET;
1208		case NETLINK_IP6_FW:
1209			return SECCLASS_NETLINK_IP6FW_SOCKET;
1210		case NETLINK_DNRTMSG:
1211			return SECCLASS_NETLINK_DNRT_SOCKET;
1212		case NETLINK_KOBJECT_UEVENT:
1213			return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214		default:
1215			return SECCLASS_NETLINK_SOCKET;
1216		}
1217	case PF_PACKET:
1218		return SECCLASS_PACKET_SOCKET;
1219	case PF_KEY:
1220		return SECCLASS_KEY_SOCKET;
1221	case PF_APPLETALK:
1222		return SECCLASS_APPLETALK_SOCKET;
1223	}
1224
1225	return SECCLASS_SOCKET;
1226}
1227
1228#ifdef CONFIG_PROC_FS
1229static int selinux_proc_get_sid(struct dentry *dentry,
1230				u16 tclass,
1231				u32 *sid)
1232{
1233	int rc;
1234	char *buffer, *path;
1235
1236	buffer = (char *)__get_free_page(GFP_KERNEL);
1237	if (!buffer)
1238		return -ENOMEM;
1239
1240	path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241	if (IS_ERR(path))
1242		rc = PTR_ERR(path);
1243	else {
1244		/* each process gets a /proc/PID/ entry. Strip off the
1245		 * PID part to get a valid selinux labeling.
1246		 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247		while (path[1] >= '0' && path[1] <= '9') {
1248			path[1] = '/';
1249			path++;
1250		}
1251		rc = security_genfs_sid("proc", path, tclass, sid);
1252	}
1253	free_page((unsigned long)buffer);
1254	return rc;
1255}
1256#else
1257static int selinux_proc_get_sid(struct dentry *dentry,
1258				u16 tclass,
1259				u32 *sid)
1260{
1261	return -EINVAL;
1262}
1263#endif
1264
1265/* The inode's security attributes must be initialized before first use. */
1266static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267{
1268	struct superblock_security_struct *sbsec = NULL;
1269	struct inode_security_struct *isec = inode->i_security;
1270	u32 sid;
1271	struct dentry *dentry;
1272#define INITCONTEXTLEN 255
1273	char *context = NULL;
1274	unsigned len = 0;
1275	int rc = 0;
1276
1277	if (isec->initialized)
1278		goto out;
1279
1280	mutex_lock(&isec->lock);
1281	if (isec->initialized)
1282		goto out_unlock;
1283
1284	sbsec = inode->i_sb->s_security;
1285	if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286		/* Defer initialization until selinux_complete_init,
1287		   after the initial policy is loaded and the security
1288		   server is ready to handle calls. */
1289		spin_lock(&sbsec->isec_lock);
1290		if (list_empty(&isec->list))
1291			list_add(&isec->list, &sbsec->isec_head);
1292		spin_unlock(&sbsec->isec_lock);
1293		goto out_unlock;
1294	}
1295
1296	switch (sbsec->behavior) {
1297	case SECURITY_FS_USE_NATIVE:
1298		break;
1299	case SECURITY_FS_USE_XATTR:
1300		if (!inode->i_op->getxattr) {
1301			isec->sid = sbsec->def_sid;
1302			break;
1303		}
1304
1305		/* Need a dentry, since the xattr API requires one.
1306		   Life would be simpler if we could just pass the inode. */
1307		if (opt_dentry) {
1308			/* Called from d_instantiate or d_splice_alias. */
1309			dentry = dget(opt_dentry);
1310		} else {
1311			/* Called from selinux_complete_init, try to find a dentry. */
1312			dentry = d_find_alias(inode);
1313		}
1314		if (!dentry) {
1315			/*
1316			 * this is can be hit on boot when a file is accessed
1317			 * before the policy is loaded.  When we load policy we
1318			 * may find inodes that have no dentry on the
1319			 * sbsec->isec_head list.  No reason to complain as these
1320			 * will get fixed up the next time we go through
1321			 * inode_doinit with a dentry, before these inodes could
1322			 * be used again by userspace.
1323			 */
1324			goto out_unlock;
1325		}
1326
1327		len = INITCONTEXTLEN;
1328		context = kmalloc(len+1, GFP_NOFS);
1329		if (!context) {
1330			rc = -ENOMEM;
1331			dput(dentry);
1332			goto out_unlock;
1333		}
1334		context[len] = '\0';
1335		rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336					   context, len);
1337		if (rc == -ERANGE) {
1338			kfree(context);
1339
1340			/* Need a larger buffer.  Query for the right size. */
1341			rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342						   NULL, 0);
1343			if (rc < 0) {
1344				dput(dentry);
1345				goto out_unlock;
1346			}
1347			len = rc;
1348			context = kmalloc(len+1, GFP_NOFS);
1349			if (!context) {
1350				rc = -ENOMEM;
1351				dput(dentry);
1352				goto out_unlock;
1353			}
1354			context[len] = '\0';
1355			rc = inode->i_op->getxattr(dentry,
1356						   XATTR_NAME_SELINUX,
1357						   context, len);
1358		}
1359		dput(dentry);
1360		if (rc < 0) {
1361			if (rc != -ENODATA) {
1362				printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1363				       "%d for dev=%s ino=%ld\n", __func__,
1364				       -rc, inode->i_sb->s_id, inode->i_ino);
1365				kfree(context);
1366				goto out_unlock;
1367			}
1368			/* Map ENODATA to the default file SID */
1369			sid = sbsec->def_sid;
1370			rc = 0;
1371		} else {
1372			rc = security_context_to_sid_default(context, rc, &sid,
1373							     sbsec->def_sid,
1374							     GFP_NOFS);
1375			if (rc) {
1376				char *dev = inode->i_sb->s_id;
1377				unsigned long ino = inode->i_ino;
1378
1379				if (rc == -EINVAL) {
1380					if (printk_ratelimit())
1381						printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382							"context=%s.  This indicates you may need to relabel the inode or the "
1383							"filesystem in question.\n", ino, dev, context);
1384				} else {
1385					printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1386					       "returned %d for dev=%s ino=%ld\n",
1387					       __func__, context, -rc, dev, ino);
1388				}
1389				kfree(context);
1390				/* Leave with the unlabeled SID */
1391				rc = 0;
1392				break;
1393			}
1394		}
1395		kfree(context);
1396		isec->sid = sid;
1397		break;
1398	case SECURITY_FS_USE_TASK:
1399		isec->sid = isec->task_sid;
1400		break;
1401	case SECURITY_FS_USE_TRANS:
1402		/* Default to the fs SID. */
1403		isec->sid = sbsec->sid;
1404
1405		/* Try to obtain a transition SID. */
1406		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407		rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408					     isec->sclass, NULL, &sid);
1409		if (rc)
1410			goto out_unlock;
1411		isec->sid = sid;
1412		break;
1413	case SECURITY_FS_USE_MNTPOINT:
1414		isec->sid = sbsec->mntpoint_sid;
1415		break;
1416	default:
1417		/* Default to the fs superblock SID. */
1418		isec->sid = sbsec->sid;
1419
1420		if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421			/* We must have a dentry to determine the label on
1422			 * procfs inodes */
1423			if (opt_dentry)
1424				/* Called from d_instantiate or
1425				 * d_splice_alias. */
1426				dentry = dget(opt_dentry);
1427			else
1428				/* Called from selinux_complete_init, try to
1429				 * find a dentry. */
1430				dentry = d_find_alias(inode);
1431			/*
1432			 * This can be hit on boot when a file is accessed
1433			 * before the policy is loaded.  When we load policy we
1434			 * may find inodes that have no dentry on the
1435			 * sbsec->isec_head list.  No reason to complain as
1436			 * these will get fixed up the next time we go through
1437			 * inode_doinit() with a dentry, before these inodes
1438			 * could be used again by userspace.
1439			 */
1440			if (!dentry)
1441				goto out_unlock;
1442			isec->sclass = inode_mode_to_security_class(inode->i_mode);
1443			rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1444			dput(dentry);
1445			if (rc)
1446				goto out_unlock;
1447			isec->sid = sid;
1448		}
1449		break;
1450	}
1451
1452	isec->initialized = 1;
1453
1454out_unlock:
1455	mutex_unlock(&isec->lock);
1456out:
1457	if (isec->sclass == SECCLASS_FILE)
1458		isec->sclass = inode_mode_to_security_class(inode->i_mode);
1459	return rc;
1460}
1461
1462/* Convert a Linux signal to an access vector. */
1463static inline u32 signal_to_av(int sig)
1464{
1465	u32 perm = 0;
1466
1467	switch (sig) {
1468	case SIGCHLD:
1469		/* Commonly granted from child to parent. */
1470		perm = PROCESS__SIGCHLD;
1471		break;
1472	case SIGKILL:
1473		/* Cannot be caught or ignored */
1474		perm = PROCESS__SIGKILL;
1475		break;
1476	case SIGSTOP:
1477		/* Cannot be caught or ignored */
1478		perm = PROCESS__SIGSTOP;
1479		break;
1480	default:
1481		/* All other signals. */
1482		perm = PROCESS__SIGNAL;
1483		break;
1484	}
1485
1486	return perm;
1487}
1488
1489/*
1490 * Check permission between a pair of credentials
1491 * fork check, ptrace check, etc.
1492 */
1493static int cred_has_perm(const struct cred *actor,
1494			 const struct cred *target,
1495			 u32 perms)
1496{
1497	u32 asid = cred_sid(actor), tsid = cred_sid(target);
1498
1499	return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1500}
1501
1502/*
1503 * Check permission between a pair of tasks, e.g. signal checks,
1504 * fork check, ptrace check, etc.
1505 * tsk1 is the actor and tsk2 is the target
1506 * - this uses the default subjective creds of tsk1
1507 */
1508static int task_has_perm(const struct task_struct *tsk1,
1509			 const struct task_struct *tsk2,
1510			 u32 perms)
1511{
1512	const struct task_security_struct *__tsec1, *__tsec2;
1513	u32 sid1, sid2;
1514
1515	rcu_read_lock();
1516	__tsec1 = __task_cred(tsk1)->security;	sid1 = __tsec1->sid;
1517	__tsec2 = __task_cred(tsk2)->security;	sid2 = __tsec2->sid;
1518	rcu_read_unlock();
1519	return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1520}
1521
1522/*
1523 * Check permission between current and another task, e.g. signal checks,
1524 * fork check, ptrace check, etc.
1525 * current is the actor and tsk2 is the target
1526 * - this uses current's subjective creds
1527 */
1528static int current_has_perm(const struct task_struct *tsk,
1529			    u32 perms)
1530{
1531	u32 sid, tsid;
1532
1533	sid = current_sid();
1534	tsid = task_sid(tsk);
1535	return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1536}
1537
1538#if CAP_LAST_CAP > 63
1539#error Fix SELinux to handle capabilities > 63.
1540#endif
1541
1542/* Check whether a task is allowed to use a capability. */
1543static int cred_has_capability(const struct cred *cred,
1544			       int cap, int audit)
1545{
1546	struct common_audit_data ad;
1547	struct av_decision avd;
1548	u16 sclass;
1549	u32 sid = cred_sid(cred);
1550	u32 av = CAP_TO_MASK(cap);
1551	int rc;
1552
1553	ad.type = LSM_AUDIT_DATA_CAP;
1554	ad.u.cap = cap;
1555
1556	switch (CAP_TO_INDEX(cap)) {
1557	case 0:
1558		sclass = SECCLASS_CAPABILITY;
1559		break;
1560	case 1:
1561		sclass = SECCLASS_CAPABILITY2;
1562		break;
1563	default:
1564		printk(KERN_ERR
1565		       "SELinux:  out of range capability %d\n", cap);
1566		BUG();
1567		return -EINVAL;
1568	}
1569
1570	rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1571	if (audit == SECURITY_CAP_AUDIT) {
1572		int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1573		if (rc2)
1574			return rc2;
1575	}
1576	return rc;
1577}
1578
1579/* Check whether a task is allowed to use a system operation. */
1580static int task_has_system(struct task_struct *tsk,
1581			   u32 perms)
1582{
1583	u32 sid = task_sid(tsk);
1584
1585	return avc_has_perm(sid, SECINITSID_KERNEL,
1586			    SECCLASS_SYSTEM, perms, NULL);
1587}
1588
1589/* Check whether a task has a particular permission to an inode.
1590   The 'adp' parameter is optional and allows other audit
1591   data to be passed (e.g. the dentry). */
1592static int inode_has_perm(const struct cred *cred,
1593			  struct inode *inode,
1594			  u32 perms,
1595			  struct common_audit_data *adp)
 
1596{
1597	struct inode_security_struct *isec;
1598	u32 sid;
1599
1600	validate_creds(cred);
1601
1602	if (unlikely(IS_PRIVATE(inode)))
1603		return 0;
1604
1605	sid = cred_sid(cred);
1606	isec = inode->i_security;
1607
1608	return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1609}
1610
1611/* Same as inode_has_perm, but pass explicit audit data containing
1612   the dentry to help the auditing code to more easily generate the
1613   pathname if needed. */
1614static inline int dentry_has_perm(const struct cred *cred,
1615				  struct dentry *dentry,
1616				  u32 av)
1617{
1618	struct inode *inode = dentry->d_inode;
1619	struct common_audit_data ad;
1620
1621	ad.type = LSM_AUDIT_DATA_DENTRY;
1622	ad.u.dentry = dentry;
1623	return inode_has_perm(cred, inode, av, &ad);
1624}
1625
1626/* Same as inode_has_perm, but pass explicit audit data containing
1627   the path to help the auditing code to more easily generate the
1628   pathname if needed. */
1629static inline int path_has_perm(const struct cred *cred,
1630				struct path *path,
1631				u32 av)
1632{
1633	struct inode *inode = path->dentry->d_inode;
1634	struct common_audit_data ad;
1635
1636	ad.type = LSM_AUDIT_DATA_PATH;
1637	ad.u.path = *path;
1638	return inode_has_perm(cred, inode, av, &ad);
1639}
1640
1641/* Same as path_has_perm, but uses the inode from the file struct. */
1642static inline int file_path_has_perm(const struct cred *cred,
1643				     struct file *file,
1644				     u32 av)
1645{
1646	struct common_audit_data ad;
1647
1648	ad.type = LSM_AUDIT_DATA_PATH;
1649	ad.u.path = file->f_path;
1650	return inode_has_perm(cred, file_inode(file), av, &ad);
1651}
1652
1653/* Check whether a task can use an open file descriptor to
1654   access an inode in a given way.  Check access to the
1655   descriptor itself, and then use dentry_has_perm to
1656   check a particular permission to the file.
1657   Access to the descriptor is implicitly granted if it
1658   has the same SID as the process.  If av is zero, then
1659   access to the file is not checked, e.g. for cases
1660   where only the descriptor is affected like seek. */
1661static int file_has_perm(const struct cred *cred,
1662			 struct file *file,
1663			 u32 av)
1664{
1665	struct file_security_struct *fsec = file->f_security;
1666	struct inode *inode = file_inode(file);
1667	struct common_audit_data ad;
1668	u32 sid = cred_sid(cred);
1669	int rc;
1670
1671	ad.type = LSM_AUDIT_DATA_PATH;
1672	ad.u.path = file->f_path;
1673
1674	if (sid != fsec->sid) {
1675		rc = avc_has_perm(sid, fsec->sid,
1676				  SECCLASS_FD,
1677				  FD__USE,
1678				  &ad);
1679		if (rc)
1680			goto out;
1681	}
1682
1683	/* av is zero if only checking access to the descriptor. */
1684	rc = 0;
1685	if (av)
1686		rc = inode_has_perm(cred, inode, av, &ad);
1687
1688out:
1689	return rc;
1690}
1691
1692/* Check whether a task can create a file. */
1693static int may_create(struct inode *dir,
1694		      struct dentry *dentry,
1695		      u16 tclass)
1696{
1697	const struct task_security_struct *tsec = current_security();
1698	struct inode_security_struct *dsec;
1699	struct superblock_security_struct *sbsec;
1700	u32 sid, newsid;
1701	struct common_audit_data ad;
1702	int rc;
1703
1704	dsec = dir->i_security;
1705	sbsec = dir->i_sb->s_security;
1706
1707	sid = tsec->sid;
1708	newsid = tsec->create_sid;
1709
1710	ad.type = LSM_AUDIT_DATA_DENTRY;
1711	ad.u.dentry = dentry;
1712
1713	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1714			  DIR__ADD_NAME | DIR__SEARCH,
1715			  &ad);
1716	if (rc)
1717		return rc;
1718
1719	if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1720		rc = security_transition_sid(sid, dsec->sid, tclass,
1721					     &dentry->d_name, &newsid);
1722		if (rc)
1723			return rc;
1724	}
1725
1726	rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1727	if (rc)
1728		return rc;
1729
1730	return avc_has_perm(newsid, sbsec->sid,
1731			    SECCLASS_FILESYSTEM,
1732			    FILESYSTEM__ASSOCIATE, &ad);
1733}
1734
1735/* Check whether a task can create a key. */
1736static int may_create_key(u32 ksid,
1737			  struct task_struct *ctx)
1738{
1739	u32 sid = task_sid(ctx);
1740
1741	return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1742}
1743
1744#define MAY_LINK	0
1745#define MAY_UNLINK	1
1746#define MAY_RMDIR	2
1747
1748/* Check whether a task can link, unlink, or rmdir a file/directory. */
1749static int may_link(struct inode *dir,
1750		    struct dentry *dentry,
1751		    int kind)
1752
1753{
1754	struct inode_security_struct *dsec, *isec;
1755	struct common_audit_data ad;
1756	u32 sid = current_sid();
1757	u32 av;
1758	int rc;
1759
1760	dsec = dir->i_security;
1761	isec = dentry->d_inode->i_security;
1762
1763	ad.type = LSM_AUDIT_DATA_DENTRY;
1764	ad.u.dentry = dentry;
1765
1766	av = DIR__SEARCH;
1767	av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1768	rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1769	if (rc)
1770		return rc;
1771
1772	switch (kind) {
1773	case MAY_LINK:
1774		av = FILE__LINK;
1775		break;
1776	case MAY_UNLINK:
1777		av = FILE__UNLINK;
1778		break;
1779	case MAY_RMDIR:
1780		av = DIR__RMDIR;
1781		break;
1782	default:
1783		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1784			__func__, kind);
1785		return 0;
1786	}
1787
1788	rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1789	return rc;
1790}
1791
1792static inline int may_rename(struct inode *old_dir,
1793			     struct dentry *old_dentry,
1794			     struct inode *new_dir,
1795			     struct dentry *new_dentry)
1796{
1797	struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1798	struct common_audit_data ad;
1799	u32 sid = current_sid();
1800	u32 av;
1801	int old_is_dir, new_is_dir;
1802	int rc;
1803
1804	old_dsec = old_dir->i_security;
1805	old_isec = old_dentry->d_inode->i_security;
1806	old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1807	new_dsec = new_dir->i_security;
1808
1809	ad.type = LSM_AUDIT_DATA_DENTRY;
1810
1811	ad.u.dentry = old_dentry;
1812	rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1813			  DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1814	if (rc)
1815		return rc;
1816	rc = avc_has_perm(sid, old_isec->sid,
1817			  old_isec->sclass, FILE__RENAME, &ad);
1818	if (rc)
1819		return rc;
1820	if (old_is_dir && new_dir != old_dir) {
1821		rc = avc_has_perm(sid, old_isec->sid,
1822				  old_isec->sclass, DIR__REPARENT, &ad);
1823		if (rc)
1824			return rc;
1825	}
1826
1827	ad.u.dentry = new_dentry;
1828	av = DIR__ADD_NAME | DIR__SEARCH;
1829	if (new_dentry->d_inode)
1830		av |= DIR__REMOVE_NAME;
1831	rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1832	if (rc)
1833		return rc;
1834	if (new_dentry->d_inode) {
1835		new_isec = new_dentry->d_inode->i_security;
1836		new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1837		rc = avc_has_perm(sid, new_isec->sid,
1838				  new_isec->sclass,
1839				  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1840		if (rc)
1841			return rc;
1842	}
1843
1844	return 0;
1845}
1846
1847/* Check whether a task can perform a filesystem operation. */
1848static int superblock_has_perm(const struct cred *cred,
1849			       struct super_block *sb,
1850			       u32 perms,
1851			       struct common_audit_data *ad)
1852{
1853	struct superblock_security_struct *sbsec;
1854	u32 sid = cred_sid(cred);
1855
1856	sbsec = sb->s_security;
1857	return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1858}
1859
1860/* Convert a Linux mode and permission mask to an access vector. */
1861static inline u32 file_mask_to_av(int mode, int mask)
1862{
1863	u32 av = 0;
1864
1865	if (!S_ISDIR(mode)) {
1866		if (mask & MAY_EXEC)
1867			av |= FILE__EXECUTE;
1868		if (mask & MAY_READ)
1869			av |= FILE__READ;
1870
1871		if (mask & MAY_APPEND)
1872			av |= FILE__APPEND;
1873		else if (mask & MAY_WRITE)
1874			av |= FILE__WRITE;
1875
1876	} else {
1877		if (mask & MAY_EXEC)
1878			av |= DIR__SEARCH;
1879		if (mask & MAY_WRITE)
1880			av |= DIR__WRITE;
1881		if (mask & MAY_READ)
1882			av |= DIR__READ;
1883	}
1884
1885	return av;
1886}
1887
1888/* Convert a Linux file to an access vector. */
1889static inline u32 file_to_av(struct file *file)
1890{
1891	u32 av = 0;
1892
1893	if (file->f_mode & FMODE_READ)
1894		av |= FILE__READ;
1895	if (file->f_mode & FMODE_WRITE) {
1896		if (file->f_flags & O_APPEND)
1897			av |= FILE__APPEND;
1898		else
1899			av |= FILE__WRITE;
1900	}
1901	if (!av) {
1902		/*
1903		 * Special file opened with flags 3 for ioctl-only use.
1904		 */
1905		av = FILE__IOCTL;
1906	}
1907
1908	return av;
1909}
1910
1911/*
1912 * Convert a file to an access vector and include the correct open
1913 * open permission.
1914 */
1915static inline u32 open_file_to_av(struct file *file)
1916{
1917	u32 av = file_to_av(file);
1918
1919	if (selinux_policycap_openperm)
1920		av |= FILE__OPEN;
1921
1922	return av;
1923}
1924
1925/* Hook functions begin here. */
1926
1927static int selinux_ptrace_access_check(struct task_struct *child,
1928				     unsigned int mode)
1929{
1930	int rc;
1931
1932	rc = cap_ptrace_access_check(child, mode);
1933	if (rc)
1934		return rc;
1935
1936	if (mode & PTRACE_MODE_READ) {
1937		u32 sid = current_sid();
1938		u32 csid = task_sid(child);
1939		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1940	}
1941
1942	return current_has_perm(child, PROCESS__PTRACE);
1943}
1944
1945static int selinux_ptrace_traceme(struct task_struct *parent)
1946{
1947	int rc;
1948
1949	rc = cap_ptrace_traceme(parent);
1950	if (rc)
1951		return rc;
1952
1953	return task_has_perm(parent, current, PROCESS__PTRACE);
1954}
1955
1956static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1957			  kernel_cap_t *inheritable, kernel_cap_t *permitted)
1958{
1959	int error;
1960
1961	error = current_has_perm(target, PROCESS__GETCAP);
1962	if (error)
1963		return error;
1964
1965	return cap_capget(target, effective, inheritable, permitted);
1966}
1967
1968static int selinux_capset(struct cred *new, const struct cred *old,
1969			  const kernel_cap_t *effective,
1970			  const kernel_cap_t *inheritable,
1971			  const kernel_cap_t *permitted)
1972{
1973	int error;
1974
1975	error = cap_capset(new, old,
1976				      effective, inheritable, permitted);
1977	if (error)
1978		return error;
1979
1980	return cred_has_perm(old, new, PROCESS__SETCAP);
1981}
1982
1983/*
1984 * (This comment used to live with the selinux_task_setuid hook,
1985 * which was removed).
1986 *
1987 * Since setuid only affects the current process, and since the SELinux
1988 * controls are not based on the Linux identity attributes, SELinux does not
1989 * need to control this operation.  However, SELinux does control the use of
1990 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1991 */
1992
1993static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1994			   int cap, int audit)
1995{
1996	int rc;
1997
1998	rc = cap_capable(cred, ns, cap, audit);
1999	if (rc)
2000		return rc;
2001
2002	return cred_has_capability(cred, cap, audit);
2003}
2004
2005static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2006{
2007	const struct cred *cred = current_cred();
2008	int rc = 0;
2009
2010	if (!sb)
2011		return 0;
2012
2013	switch (cmds) {
2014	case Q_SYNC:
2015	case Q_QUOTAON:
2016	case Q_QUOTAOFF:
2017	case Q_SETINFO:
2018	case Q_SETQUOTA:
2019		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2020		break;
2021	case Q_GETFMT:
2022	case Q_GETINFO:
2023	case Q_GETQUOTA:
2024		rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2025		break;
2026	default:
2027		rc = 0;  /* let the kernel handle invalid cmds */
2028		break;
2029	}
2030	return rc;
2031}
2032
2033static int selinux_quota_on(struct dentry *dentry)
2034{
2035	const struct cred *cred = current_cred();
2036
2037	return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2038}
2039
2040static int selinux_syslog(int type)
2041{
2042	int rc;
2043
2044	switch (type) {
2045	case SYSLOG_ACTION_READ_ALL:	/* Read last kernel messages */
2046	case SYSLOG_ACTION_SIZE_BUFFER:	/* Return size of the log buffer */
2047		rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2048		break;
2049	case SYSLOG_ACTION_CONSOLE_OFF:	/* Disable logging to console */
2050	case SYSLOG_ACTION_CONSOLE_ON:	/* Enable logging to console */
2051	/* Set level of messages printed to console */
2052	case SYSLOG_ACTION_CONSOLE_LEVEL:
2053		rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2054		break;
2055	case SYSLOG_ACTION_CLOSE:	/* Close log */
2056	case SYSLOG_ACTION_OPEN:	/* Open log */
2057	case SYSLOG_ACTION_READ:	/* Read from log */
2058	case SYSLOG_ACTION_READ_CLEAR:	/* Read/clear last kernel messages */
2059	case SYSLOG_ACTION_CLEAR:	/* Clear ring buffer */
2060	default:
2061		rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2062		break;
2063	}
2064	return rc;
2065}
2066
2067/*
2068 * Check that a process has enough memory to allocate a new virtual
2069 * mapping. 0 means there is enough memory for the allocation to
2070 * succeed and -ENOMEM implies there is not.
2071 *
2072 * Do not audit the selinux permission check, as this is applied to all
2073 * processes that allocate mappings.
2074 */
2075static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2076{
2077	int rc, cap_sys_admin = 0;
2078
2079	rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2080			     SECURITY_CAP_NOAUDIT);
2081	if (rc == 0)
2082		cap_sys_admin = 1;
2083
2084	return __vm_enough_memory(mm, pages, cap_sys_admin);
2085}
2086
2087/* binprm security operations */
2088
2089static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2090{
2091	const struct task_security_struct *old_tsec;
2092	struct task_security_struct *new_tsec;
2093	struct inode_security_struct *isec;
2094	struct common_audit_data ad;
2095	struct inode *inode = file_inode(bprm->file);
2096	int rc;
2097
2098	rc = cap_bprm_set_creds(bprm);
2099	if (rc)
2100		return rc;
2101
2102	/* SELinux context only depends on initial program or script and not
2103	 * the script interpreter */
2104	if (bprm->cred_prepared)
2105		return 0;
2106
2107	old_tsec = current_security();
2108	new_tsec = bprm->cred->security;
2109	isec = inode->i_security;
2110
2111	/* Default to the current task SID. */
2112	new_tsec->sid = old_tsec->sid;
2113	new_tsec->osid = old_tsec->sid;
2114
2115	/* Reset fs, key, and sock SIDs on execve. */
2116	new_tsec->create_sid = 0;
2117	new_tsec->keycreate_sid = 0;
2118	new_tsec->sockcreate_sid = 0;
2119
2120	if (old_tsec->exec_sid) {
2121		new_tsec->sid = old_tsec->exec_sid;
2122		/* Reset exec SID on execve. */
2123		new_tsec->exec_sid = 0;
2124
2125		/*
2126		 * Minimize confusion: if no_new_privs and a transition is
2127		 * explicitly requested, then fail the exec.
2128		 */
2129		if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2130			return -EPERM;
2131	} else {
2132		/* Check for a default transition on this program. */
2133		rc = security_transition_sid(old_tsec->sid, isec->sid,
2134					     SECCLASS_PROCESS, NULL,
2135					     &new_tsec->sid);
2136		if (rc)
2137			return rc;
2138	}
2139
2140	ad.type = LSM_AUDIT_DATA_PATH;
2141	ad.u.path = bprm->file->f_path;
2142
2143	if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2144	    (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2145		new_tsec->sid = old_tsec->sid;
2146
2147	if (new_tsec->sid == old_tsec->sid) {
2148		rc = avc_has_perm(old_tsec->sid, isec->sid,
2149				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2150		if (rc)
2151			return rc;
2152	} else {
2153		/* Check permissions for the transition. */
2154		rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155				  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2156		if (rc)
2157			return rc;
2158
2159		rc = avc_has_perm(new_tsec->sid, isec->sid,
2160				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2161		if (rc)
2162			return rc;
2163
2164		/* Check for shared state */
2165		if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2166			rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2167					  SECCLASS_PROCESS, PROCESS__SHARE,
2168					  NULL);
2169			if (rc)
2170				return -EPERM;
2171		}
2172
2173		/* Make sure that anyone attempting to ptrace over a task that
2174		 * changes its SID has the appropriate permit */
2175		if (bprm->unsafe &
2176		    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2177			struct task_struct *tracer;
2178			struct task_security_struct *sec;
2179			u32 ptsid = 0;
2180
2181			rcu_read_lock();
2182			tracer = ptrace_parent(current);
2183			if (likely(tracer != NULL)) {
2184				sec = __task_cred(tracer)->security;
2185				ptsid = sec->sid;
2186			}
2187			rcu_read_unlock();
2188
2189			if (ptsid != 0) {
2190				rc = avc_has_perm(ptsid, new_tsec->sid,
2191						  SECCLASS_PROCESS,
2192						  PROCESS__PTRACE, NULL);
2193				if (rc)
2194					return -EPERM;
2195			}
2196		}
2197
2198		/* Clear any possibly unsafe personality bits on exec: */
2199		bprm->per_clear |= PER_CLEAR_ON_SETID;
2200	}
2201
2202	return 0;
2203}
2204
2205static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2206{
2207	const struct task_security_struct *tsec = current_security();
2208	u32 sid, osid;
2209	int atsecure = 0;
2210
2211	sid = tsec->sid;
2212	osid = tsec->osid;
2213
2214	if (osid != sid) {
2215		/* Enable secure mode for SIDs transitions unless
2216		   the noatsecure permission is granted between
2217		   the two SIDs, i.e. ahp returns 0. */
2218		atsecure = avc_has_perm(osid, sid,
2219					SECCLASS_PROCESS,
2220					PROCESS__NOATSECURE, NULL);
2221	}
2222
2223	return (atsecure || cap_bprm_secureexec(bprm));
2224}
2225
2226static int match_file(const void *p, struct file *file, unsigned fd)
2227{
2228	return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2229}
2230
2231/* Derived from fs/exec.c:flush_old_files. */
2232static inline void flush_unauthorized_files(const struct cred *cred,
2233					    struct files_struct *files)
2234{
2235	struct file *file, *devnull = NULL;
2236	struct tty_struct *tty;
 
 
2237	int drop_tty = 0;
2238	unsigned n;
2239
2240	tty = get_current_tty();
2241	if (tty) {
2242		spin_lock(&tty_files_lock);
2243		if (!list_empty(&tty->tty_files)) {
2244			struct tty_file_private *file_priv;
2245
2246			/* Revalidate access to controlling tty.
2247			   Use file_path_has_perm on the tty path directly
2248			   rather than using file_has_perm, as this particular
2249			   open file may belong to another process and we are
2250			   only interested in the inode-based check here. */
2251			file_priv = list_first_entry(&tty->tty_files,
2252						struct tty_file_private, list);
2253			file = file_priv->file;
2254			if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2255				drop_tty = 1;
2256		}
2257		spin_unlock(&tty_files_lock);
2258		tty_kref_put(tty);
2259	}
2260	/* Reset controlling tty. */
2261	if (drop_tty)
2262		no_tty();
2263
2264	/* Revalidate access to inherited open files. */
2265	n = iterate_fd(files, 0, match_file, cred);
2266	if (!n) /* none found? */
2267		return;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2268
2269	devnull = dentry_open(&selinux_null, O_RDWR, cred);
2270	if (IS_ERR(devnull))
2271		devnull = NULL;
2272	/* replace all the matching ones with this */
2273	do {
2274		replace_fd(n - 1, devnull, 0);
2275	} while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2276	if (devnull)
2277		fput(devnull);
2278}
2279
2280/*
2281 * Prepare a process for imminent new credential changes due to exec
2282 */
2283static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2284{
2285	struct task_security_struct *new_tsec;
2286	struct rlimit *rlim, *initrlim;
2287	int rc, i;
2288
2289	new_tsec = bprm->cred->security;
2290	if (new_tsec->sid == new_tsec->osid)
2291		return;
2292
2293	/* Close files for which the new task SID is not authorized. */
2294	flush_unauthorized_files(bprm->cred, current->files);
2295
2296	/* Always clear parent death signal on SID transitions. */
2297	current->pdeath_signal = 0;
2298
2299	/* Check whether the new SID can inherit resource limits from the old
2300	 * SID.  If not, reset all soft limits to the lower of the current
2301	 * task's hard limit and the init task's soft limit.
2302	 *
2303	 * Note that the setting of hard limits (even to lower them) can be
2304	 * controlled by the setrlimit check.  The inclusion of the init task's
2305	 * soft limit into the computation is to avoid resetting soft limits
2306	 * higher than the default soft limit for cases where the default is
2307	 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2308	 */
2309	rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2310			  PROCESS__RLIMITINH, NULL);
2311	if (rc) {
2312		/* protect against do_prlimit() */
2313		task_lock(current);
2314		for (i = 0; i < RLIM_NLIMITS; i++) {
2315			rlim = current->signal->rlim + i;
2316			initrlim = init_task.signal->rlim + i;
2317			rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2318		}
2319		task_unlock(current);
2320		update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2321	}
2322}
2323
2324/*
2325 * Clean up the process immediately after the installation of new credentials
2326 * due to exec
2327 */
2328static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2329{
2330	const struct task_security_struct *tsec = current_security();
2331	struct itimerval itimer;
2332	u32 osid, sid;
2333	int rc, i;
2334
2335	osid = tsec->osid;
2336	sid = tsec->sid;
2337
2338	if (sid == osid)
2339		return;
2340
2341	/* Check whether the new SID can inherit signal state from the old SID.
2342	 * If not, clear itimers to avoid subsequent signal generation and
2343	 * flush and unblock signals.
2344	 *
2345	 * This must occur _after_ the task SID has been updated so that any
2346	 * kill done after the flush will be checked against the new SID.
2347	 */
2348	rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2349	if (rc) {
2350		memset(&itimer, 0, sizeof itimer);
2351		for (i = 0; i < 3; i++)
2352			do_setitimer(i, &itimer, NULL);
2353		spin_lock_irq(&current->sighand->siglock);
2354		if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2355			__flush_signals(current);
2356			flush_signal_handlers(current, 1);
2357			sigemptyset(&current->blocked);
2358		}
2359		spin_unlock_irq(&current->sighand->siglock);
2360	}
2361
2362	/* Wake up the parent if it is waiting so that it can recheck
2363	 * wait permission to the new task SID. */
2364	read_lock(&tasklist_lock);
2365	__wake_up_parent(current, current->real_parent);
2366	read_unlock(&tasklist_lock);
2367}
2368
2369/* superblock security operations */
2370
2371static int selinux_sb_alloc_security(struct super_block *sb)
2372{
2373	return superblock_alloc_security(sb);
2374}
2375
2376static void selinux_sb_free_security(struct super_block *sb)
2377{
2378	superblock_free_security(sb);
2379}
2380
2381static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2382{
2383	if (plen > olen)
2384		return 0;
2385
2386	return !memcmp(prefix, option, plen);
2387}
2388
2389static inline int selinux_option(char *option, int len)
2390{
2391	return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2392		match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2393		match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2394		match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2395		match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2396}
2397
2398static inline void take_option(char **to, char *from, int *first, int len)
2399{
2400	if (!*first) {
2401		**to = ',';
2402		*to += 1;
2403	} else
2404		*first = 0;
2405	memcpy(*to, from, len);
2406	*to += len;
2407}
2408
2409static inline void take_selinux_option(char **to, char *from, int *first,
2410				       int len)
2411{
2412	int current_size = 0;
2413
2414	if (!*first) {
2415		**to = '|';
2416		*to += 1;
2417	} else
2418		*first = 0;
2419
2420	while (current_size < len) {
2421		if (*from != '"') {
2422			**to = *from;
2423			*to += 1;
2424		}
2425		from += 1;
2426		current_size += 1;
2427	}
2428}
2429
2430static int selinux_sb_copy_data(char *orig, char *copy)
2431{
2432	int fnosec, fsec, rc = 0;
2433	char *in_save, *in_curr, *in_end;
2434	char *sec_curr, *nosec_save, *nosec;
2435	int open_quote = 0;
2436
2437	in_curr = orig;
2438	sec_curr = copy;
2439
2440	nosec = (char *)get_zeroed_page(GFP_KERNEL);
2441	if (!nosec) {
2442		rc = -ENOMEM;
2443		goto out;
2444	}
2445
2446	nosec_save = nosec;
2447	fnosec = fsec = 1;
2448	in_save = in_end = orig;
2449
2450	do {
2451		if (*in_end == '"')
2452			open_quote = !open_quote;
2453		if ((*in_end == ',' && open_quote == 0) ||
2454				*in_end == '\0') {
2455			int len = in_end - in_curr;
2456
2457			if (selinux_option(in_curr, len))
2458				take_selinux_option(&sec_curr, in_curr, &fsec, len);
2459			else
2460				take_option(&nosec, in_curr, &fnosec, len);
2461
2462			in_curr = in_end + 1;
2463		}
2464	} while (*in_end++);
2465
2466	strcpy(in_save, nosec_save);
2467	free_page((unsigned long)nosec_save);
2468out:
2469	return rc;
2470}
2471
2472static int selinux_sb_remount(struct super_block *sb, void *data)
2473{
2474	int rc, i, *flags;
2475	struct security_mnt_opts opts;
2476	char *secdata, **mount_options;
2477	struct superblock_security_struct *sbsec = sb->s_security;
2478
2479	if (!(sbsec->flags & SE_SBINITIALIZED))
2480		return 0;
2481
2482	if (!data)
2483		return 0;
2484
2485	if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2486		return 0;
2487
2488	security_init_mnt_opts(&opts);
2489	secdata = alloc_secdata();
2490	if (!secdata)
2491		return -ENOMEM;
2492	rc = selinux_sb_copy_data(data, secdata);
2493	if (rc)
2494		goto out_free_secdata;
2495
2496	rc = selinux_parse_opts_str(secdata, &opts);
2497	if (rc)
2498		goto out_free_secdata;
2499
2500	mount_options = opts.mnt_opts;
2501	flags = opts.mnt_opts_flags;
2502
2503	for (i = 0; i < opts.num_mnt_opts; i++) {
2504		u32 sid;
2505		size_t len;
2506
2507		if (flags[i] == SBLABEL_MNT)
2508			continue;
2509		len = strlen(mount_options[i]);
2510		rc = security_context_to_sid(mount_options[i], len, &sid,
2511					     GFP_KERNEL);
2512		if (rc) {
2513			printk(KERN_WARNING "SELinux: security_context_to_sid"
2514			       "(%s) failed for (dev %s, type %s) errno=%d\n",
2515			       mount_options[i], sb->s_id, sb->s_type->name, rc);
2516			goto out_free_opts;
2517		}
2518		rc = -EINVAL;
2519		switch (flags[i]) {
2520		case FSCONTEXT_MNT:
2521			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2522				goto out_bad_option;
2523			break;
2524		case CONTEXT_MNT:
2525			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2526				goto out_bad_option;
2527			break;
2528		case ROOTCONTEXT_MNT: {
2529			struct inode_security_struct *root_isec;
2530			root_isec = sb->s_root->d_inode->i_security;
2531
2532			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2533				goto out_bad_option;
2534			break;
2535		}
2536		case DEFCONTEXT_MNT:
2537			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2538				goto out_bad_option;
2539			break;
2540		default:
2541			goto out_free_opts;
2542		}
2543	}
2544
2545	rc = 0;
2546out_free_opts:
2547	security_free_mnt_opts(&opts);
2548out_free_secdata:
2549	free_secdata(secdata);
2550	return rc;
2551out_bad_option:
2552	printk(KERN_WARNING "SELinux: unable to change security options "
2553	       "during remount (dev %s, type=%s)\n", sb->s_id,
2554	       sb->s_type->name);
2555	goto out_free_opts;
2556}
2557
2558static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2559{
2560	const struct cred *cred = current_cred();
2561	struct common_audit_data ad;
2562	int rc;
2563
2564	rc = superblock_doinit(sb, data);
2565	if (rc)
2566		return rc;
2567
2568	/* Allow all mounts performed by the kernel */
2569	if (flags & MS_KERNMOUNT)
2570		return 0;
2571
2572	ad.type = LSM_AUDIT_DATA_DENTRY;
2573	ad.u.dentry = sb->s_root;
2574	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2575}
2576
2577static int selinux_sb_statfs(struct dentry *dentry)
2578{
2579	const struct cred *cred = current_cred();
2580	struct common_audit_data ad;
2581
2582	ad.type = LSM_AUDIT_DATA_DENTRY;
2583	ad.u.dentry = dentry->d_sb->s_root;
2584	return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2585}
2586
2587static int selinux_mount(const char *dev_name,
2588			 struct path *path,
2589			 const char *type,
2590			 unsigned long flags,
2591			 void *data)
2592{
2593	const struct cred *cred = current_cred();
2594
2595	if (flags & MS_REMOUNT)
2596		return superblock_has_perm(cred, path->dentry->d_sb,
2597					   FILESYSTEM__REMOUNT, NULL);
2598	else
2599		return path_has_perm(cred, path, FILE__MOUNTON);
2600}
2601
2602static int selinux_umount(struct vfsmount *mnt, int flags)
2603{
2604	const struct cred *cred = current_cred();
2605
2606	return superblock_has_perm(cred, mnt->mnt_sb,
2607				   FILESYSTEM__UNMOUNT, NULL);
2608}
2609
2610/* inode security operations */
2611
2612static int selinux_inode_alloc_security(struct inode *inode)
2613{
2614	return inode_alloc_security(inode);
2615}
2616
2617static void selinux_inode_free_security(struct inode *inode)
2618{
2619	inode_free_security(inode);
2620}
2621
2622static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2623					struct qstr *name, void **ctx,
2624					u32 *ctxlen)
2625{
2626	const struct cred *cred = current_cred();
2627	struct task_security_struct *tsec;
2628	struct inode_security_struct *dsec;
2629	struct superblock_security_struct *sbsec;
2630	struct inode *dir = dentry->d_parent->d_inode;
2631	u32 newsid;
2632	int rc;
2633
2634	tsec = cred->security;
2635	dsec = dir->i_security;
2636	sbsec = dir->i_sb->s_security;
2637
2638	if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2639		newsid = tsec->create_sid;
2640	} else {
2641		rc = security_transition_sid(tsec->sid, dsec->sid,
2642					     inode_mode_to_security_class(mode),
2643					     name,
2644					     &newsid);
2645		if (rc) {
2646			printk(KERN_WARNING
2647				"%s: security_transition_sid failed, rc=%d\n",
2648			       __func__, -rc);
2649			return rc;
2650		}
2651	}
2652
2653	return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2654}
2655
2656static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2657				       const struct qstr *qstr,
2658				       const char **name,
2659				       void **value, size_t *len)
2660{
2661	const struct task_security_struct *tsec = current_security();
2662	struct inode_security_struct *dsec;
2663	struct superblock_security_struct *sbsec;
2664	u32 sid, newsid, clen;
2665	int rc;
2666	char *context;
2667
2668	dsec = dir->i_security;
2669	sbsec = dir->i_sb->s_security;
2670
2671	sid = tsec->sid;
2672	newsid = tsec->create_sid;
2673
2674	if ((sbsec->flags & SE_SBINITIALIZED) &&
2675	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2676		newsid = sbsec->mntpoint_sid;
2677	else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2678		rc = security_transition_sid(sid, dsec->sid,
2679					     inode_mode_to_security_class(inode->i_mode),
2680					     qstr, &newsid);
2681		if (rc) {
2682			printk(KERN_WARNING "%s:  "
2683			       "security_transition_sid failed, rc=%d (dev=%s "
2684			       "ino=%ld)\n",
2685			       __func__,
2686			       -rc, inode->i_sb->s_id, inode->i_ino);
2687			return rc;
2688		}
2689	}
2690
2691	/* Possibly defer initialization to selinux_complete_init. */
2692	if (sbsec->flags & SE_SBINITIALIZED) {
2693		struct inode_security_struct *isec = inode->i_security;
2694		isec->sclass = inode_mode_to_security_class(inode->i_mode);
2695		isec->sid = newsid;
2696		isec->initialized = 1;
2697	}
2698
2699	if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2700		return -EOPNOTSUPP;
2701
2702	if (name)
2703		*name = XATTR_SELINUX_SUFFIX;
 
 
 
 
2704
2705	if (value && len) {
2706		rc = security_sid_to_context_force(newsid, &context, &clen);
2707		if (rc)
 
2708			return rc;
 
2709		*value = context;
2710		*len = clen;
2711	}
2712
2713	return 0;
2714}
2715
2716static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2717{
2718	return may_create(dir, dentry, SECCLASS_FILE);
2719}
2720
2721static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2722{
2723	return may_link(dir, old_dentry, MAY_LINK);
2724}
2725
2726static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2727{
2728	return may_link(dir, dentry, MAY_UNLINK);
2729}
2730
2731static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2732{
2733	return may_create(dir, dentry, SECCLASS_LNK_FILE);
2734}
2735
2736static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2737{
2738	return may_create(dir, dentry, SECCLASS_DIR);
2739}
2740
2741static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2742{
2743	return may_link(dir, dentry, MAY_RMDIR);
2744}
2745
2746static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2747{
2748	return may_create(dir, dentry, inode_mode_to_security_class(mode));
2749}
2750
2751static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2752				struct inode *new_inode, struct dentry *new_dentry)
2753{
2754	return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2755}
2756
2757static int selinux_inode_readlink(struct dentry *dentry)
2758{
2759	const struct cred *cred = current_cred();
2760
2761	return dentry_has_perm(cred, dentry, FILE__READ);
2762}
2763
2764static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2765{
2766	const struct cred *cred = current_cred();
2767
2768	return dentry_has_perm(cred, dentry, FILE__READ);
2769}
2770
2771static noinline int audit_inode_permission(struct inode *inode,
2772					   u32 perms, u32 audited, u32 denied,
2773					   unsigned flags)
2774{
2775	struct common_audit_data ad;
2776	struct inode_security_struct *isec = inode->i_security;
2777	int rc;
2778
2779	ad.type = LSM_AUDIT_DATA_INODE;
2780	ad.u.inode = inode;
2781
2782	rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2783			    audited, denied, &ad, flags);
2784	if (rc)
2785		return rc;
2786	return 0;
2787}
2788
2789static int selinux_inode_permission(struct inode *inode, int mask)
2790{
2791	const struct cred *cred = current_cred();
2792	u32 perms;
2793	bool from_access;
2794	unsigned flags = mask & MAY_NOT_BLOCK;
2795	struct inode_security_struct *isec;
2796	u32 sid;
2797	struct av_decision avd;
2798	int rc, rc2;
2799	u32 audited, denied;
2800
2801	from_access = mask & MAY_ACCESS;
2802	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2803
2804	/* No permission to check.  Existence test. */
2805	if (!mask)
2806		return 0;
2807
2808	validate_creds(cred);
2809
2810	if (unlikely(IS_PRIVATE(inode)))
2811		return 0;
2812
2813	perms = file_mask_to_av(inode->i_mode, mask);
2814
2815	sid = cred_sid(cred);
2816	isec = inode->i_security;
2817
2818	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2819	audited = avc_audit_required(perms, &avd, rc,
2820				     from_access ? FILE__AUDIT_ACCESS : 0,
2821				     &denied);
2822	if (likely(!audited))
2823		return rc;
2824
2825	rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2826	if (rc2)
2827		return rc2;
2828	return rc;
2829}
2830
2831static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2832{
2833	const struct cred *cred = current_cred();
2834	unsigned int ia_valid = iattr->ia_valid;
2835	__u32 av = FILE__WRITE;
2836
2837	/* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2838	if (ia_valid & ATTR_FORCE) {
2839		ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2840			      ATTR_FORCE);
2841		if (!ia_valid)
2842			return 0;
2843	}
2844
2845	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2846			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2847		return dentry_has_perm(cred, dentry, FILE__SETATTR);
2848
2849	if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2850		av |= FILE__OPEN;
2851
2852	return dentry_has_perm(cred, dentry, av);
2853}
2854
2855static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2856{
2857	const struct cred *cred = current_cred();
2858	struct path path;
2859
2860	path.dentry = dentry;
2861	path.mnt = mnt;
2862
2863	return path_has_perm(cred, &path, FILE__GETATTR);
2864}
2865
2866static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2867{
2868	const struct cred *cred = current_cred();
2869
2870	if (!strncmp(name, XATTR_SECURITY_PREFIX,
2871		     sizeof XATTR_SECURITY_PREFIX - 1)) {
2872		if (!strcmp(name, XATTR_NAME_CAPS)) {
2873			if (!capable(CAP_SETFCAP))
2874				return -EPERM;
2875		} else if (!capable(CAP_SYS_ADMIN)) {
2876			/* A different attribute in the security namespace.
2877			   Restrict to administrator. */
2878			return -EPERM;
2879		}
2880	}
2881
2882	/* Not an attribute we recognize, so just check the
2883	   ordinary setattr permission. */
2884	return dentry_has_perm(cred, dentry, FILE__SETATTR);
2885}
2886
2887static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2888				  const void *value, size_t size, int flags)
2889{
2890	struct inode *inode = dentry->d_inode;
2891	struct inode_security_struct *isec = inode->i_security;
2892	struct superblock_security_struct *sbsec;
2893	struct common_audit_data ad;
2894	u32 newsid, sid = current_sid();
2895	int rc = 0;
2896
2897	if (strcmp(name, XATTR_NAME_SELINUX))
2898		return selinux_inode_setotherxattr(dentry, name);
2899
2900	sbsec = inode->i_sb->s_security;
2901	if (!(sbsec->flags & SBLABEL_MNT))
2902		return -EOPNOTSUPP;
2903
2904	if (!inode_owner_or_capable(inode))
2905		return -EPERM;
2906
2907	ad.type = LSM_AUDIT_DATA_DENTRY;
2908	ad.u.dentry = dentry;
2909
2910	rc = avc_has_perm(sid, isec->sid, isec->sclass,
2911			  FILE__RELABELFROM, &ad);
2912	if (rc)
2913		return rc;
2914
2915	rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2916	if (rc == -EINVAL) {
2917		if (!capable(CAP_MAC_ADMIN)) {
2918			struct audit_buffer *ab;
2919			size_t audit_size;
2920			const char *str;
2921
2922			/* We strip a nul only if it is at the end, otherwise the
2923			 * context contains a nul and we should audit that */
2924			if (value) {
2925				str = value;
2926				if (str[size - 1] == '\0')
2927					audit_size = size - 1;
2928				else
2929					audit_size = size;
2930			} else {
2931				str = "";
2932				audit_size = 0;
2933			}
2934			ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2935			audit_log_format(ab, "op=setxattr invalid_context=");
2936			audit_log_n_untrustedstring(ab, value, audit_size);
2937			audit_log_end(ab);
2938
2939			return rc;
2940		}
2941		rc = security_context_to_sid_force(value, size, &newsid);
2942	}
2943	if (rc)
2944		return rc;
2945
2946	rc = avc_has_perm(sid, newsid, isec->sclass,
2947			  FILE__RELABELTO, &ad);
2948	if (rc)
2949		return rc;
2950
2951	rc = security_validate_transition(isec->sid, newsid, sid,
2952					  isec->sclass);
2953	if (rc)
2954		return rc;
2955
2956	return avc_has_perm(newsid,
2957			    sbsec->sid,
2958			    SECCLASS_FILESYSTEM,
2959			    FILESYSTEM__ASSOCIATE,
2960			    &ad);
2961}
2962
2963static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2964					const void *value, size_t size,
2965					int flags)
2966{
2967	struct inode *inode = dentry->d_inode;
2968	struct inode_security_struct *isec = inode->i_security;
2969	u32 newsid;
2970	int rc;
2971
2972	if (strcmp(name, XATTR_NAME_SELINUX)) {
2973		/* Not an attribute we recognize, so nothing to do. */
2974		return;
2975	}
2976
2977	rc = security_context_to_sid_force(value, size, &newsid);
2978	if (rc) {
2979		printk(KERN_ERR "SELinux:  unable to map context to SID"
2980		       "for (%s, %lu), rc=%d\n",
2981		       inode->i_sb->s_id, inode->i_ino, -rc);
2982		return;
2983	}
2984
2985	isec->sclass = inode_mode_to_security_class(inode->i_mode);
2986	isec->sid = newsid;
2987	isec->initialized = 1;
2988
2989	return;
2990}
2991
2992static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2993{
2994	const struct cred *cred = current_cred();
2995
2996	return dentry_has_perm(cred, dentry, FILE__GETATTR);
2997}
2998
2999static int selinux_inode_listxattr(struct dentry *dentry)
3000{
3001	const struct cred *cred = current_cred();
3002
3003	return dentry_has_perm(cred, dentry, FILE__GETATTR);
3004}
3005
3006static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3007{
3008	if (strcmp(name, XATTR_NAME_SELINUX))
3009		return selinux_inode_setotherxattr(dentry, name);
3010
3011	/* No one is allowed to remove a SELinux security label.
3012	   You can change the label, but all data must be labeled. */
3013	return -EACCES;
3014}
3015
3016/*
3017 * Copy the inode security context value to the user.
3018 *
3019 * Permission check is handled by selinux_inode_getxattr hook.
3020 */
3021static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3022{
3023	u32 size;
3024	int error;
3025	char *context = NULL;
3026	struct inode_security_struct *isec = inode->i_security;
3027
3028	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3029		return -EOPNOTSUPP;
3030
3031	/*
3032	 * If the caller has CAP_MAC_ADMIN, then get the raw context
3033	 * value even if it is not defined by current policy; otherwise,
3034	 * use the in-core value under current policy.
3035	 * Use the non-auditing forms of the permission checks since
3036	 * getxattr may be called by unprivileged processes commonly
3037	 * and lack of permission just means that we fall back to the
3038	 * in-core context value, not a denial.
3039	 */
3040	error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3041				SECURITY_CAP_NOAUDIT);
3042	if (!error)
3043		error = security_sid_to_context_force(isec->sid, &context,
3044						      &size);
3045	else
3046		error = security_sid_to_context(isec->sid, &context, &size);
3047	if (error)
3048		return error;
3049	error = size;
3050	if (alloc) {
3051		*buffer = context;
3052		goto out_nofree;
3053	}
3054	kfree(context);
3055out_nofree:
3056	return error;
3057}
3058
3059static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3060				     const void *value, size_t size, int flags)
3061{
3062	struct inode_security_struct *isec = inode->i_security;
3063	u32 newsid;
3064	int rc;
3065
3066	if (strcmp(name, XATTR_SELINUX_SUFFIX))
3067		return -EOPNOTSUPP;
3068
3069	if (!value || !size)
3070		return -EACCES;
3071
3072	rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3073	if (rc)
3074		return rc;
3075
3076	isec->sclass = inode_mode_to_security_class(inode->i_mode);
3077	isec->sid = newsid;
3078	isec->initialized = 1;
3079	return 0;
3080}
3081
3082static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3083{
3084	const int len = sizeof(XATTR_NAME_SELINUX);
3085	if (buffer && len <= buffer_size)
3086		memcpy(buffer, XATTR_NAME_SELINUX, len);
3087	return len;
3088}
3089
3090static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3091{
3092	struct inode_security_struct *isec = inode->i_security;
3093	*secid = isec->sid;
3094}
3095
3096/* file security operations */
3097
3098static int selinux_revalidate_file_permission(struct file *file, int mask)
3099{
3100	const struct cred *cred = current_cred();
3101	struct inode *inode = file_inode(file);
3102
3103	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3104	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3105		mask |= MAY_APPEND;
3106
3107	return file_has_perm(cred, file,
3108			     file_mask_to_av(inode->i_mode, mask));
3109}
3110
3111static int selinux_file_permission(struct file *file, int mask)
3112{
3113	struct inode *inode = file_inode(file);
3114	struct file_security_struct *fsec = file->f_security;
3115	struct inode_security_struct *isec = inode->i_security;
3116	u32 sid = current_sid();
3117
3118	if (!mask)
3119		/* No permission to check.  Existence test. */
3120		return 0;
3121
3122	if (sid == fsec->sid && fsec->isid == isec->sid &&
3123	    fsec->pseqno == avc_policy_seqno())
3124		/* No change since file_open check. */
3125		return 0;
3126
3127	return selinux_revalidate_file_permission(file, mask);
3128}
3129
3130static int selinux_file_alloc_security(struct file *file)
3131{
3132	return file_alloc_security(file);
3133}
3134
3135static void selinux_file_free_security(struct file *file)
3136{
3137	file_free_security(file);
3138}
3139
3140static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3141			      unsigned long arg)
3142{
3143	const struct cred *cred = current_cred();
3144	int error = 0;
3145
3146	switch (cmd) {
3147	case FIONREAD:
3148	/* fall through */
3149	case FIBMAP:
3150	/* fall through */
3151	case FIGETBSZ:
3152	/* fall through */
3153	case FS_IOC_GETFLAGS:
3154	/* fall through */
3155	case FS_IOC_GETVERSION:
3156		error = file_has_perm(cred, file, FILE__GETATTR);
3157		break;
3158
3159	case FS_IOC_SETFLAGS:
3160	/* fall through */
3161	case FS_IOC_SETVERSION:
3162		error = file_has_perm(cred, file, FILE__SETATTR);
3163		break;
3164
3165	/* sys_ioctl() checks */
3166	case FIONBIO:
3167	/* fall through */
3168	case FIOASYNC:
3169		error = file_has_perm(cred, file, 0);
3170		break;
3171
3172	case KDSKBENT:
3173	case KDSKBSENT:
3174		error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3175					    SECURITY_CAP_AUDIT);
3176		break;
3177
3178	/* default case assumes that the command will go
3179	 * to the file's ioctl() function.
3180	 */
3181	default:
3182		error = file_has_perm(cred, file, FILE__IOCTL);
3183	}
3184	return error;
3185}
3186
3187static int default_noexec;
3188
3189static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3190{
3191	const struct cred *cred = current_cred();
3192	int rc = 0;
3193
3194	if (default_noexec &&
3195	    (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3196		/*
3197		 * We are making executable an anonymous mapping or a
3198		 * private file mapping that will also be writable.
3199		 * This has an additional check.
3200		 */
3201		rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3202		if (rc)
3203			goto error;
3204	}
3205
3206	if (file) {
3207		/* read access is always possible with a mapping */
3208		u32 av = FILE__READ;
3209
3210		/* write access only matters if the mapping is shared */
3211		if (shared && (prot & PROT_WRITE))
3212			av |= FILE__WRITE;
3213
3214		if (prot & PROT_EXEC)
3215			av |= FILE__EXECUTE;
3216
3217		return file_has_perm(cred, file, av);
3218	}
3219
3220error:
3221	return rc;
3222}
3223
3224static int selinux_mmap_addr(unsigned long addr)
3225{
3226	int rc;
3227
3228	/* do DAC check on address space usage */
3229	rc = cap_mmap_addr(addr);
3230	if (rc)
3231		return rc;
3232
 
 
 
 
 
 
3233	if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3234		u32 sid = current_sid();
3235		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3236				  MEMPROTECT__MMAP_ZERO, NULL);
 
 
3237	}
3238
3239	return rc;
 
3240}
3241
3242static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3243			     unsigned long prot, unsigned long flags)
3244{
3245	if (selinux_checkreqprot)
3246		prot = reqprot;
3247
3248	return file_map_prot_check(file, prot,
3249				   (flags & MAP_TYPE) == MAP_SHARED);
3250}
3251
3252static int selinux_file_mprotect(struct vm_area_struct *vma,
3253				 unsigned long reqprot,
3254				 unsigned long prot)
3255{
3256	const struct cred *cred = current_cred();
3257
3258	if (selinux_checkreqprot)
3259		prot = reqprot;
3260
3261	if (default_noexec &&
3262	    (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3263		int rc = 0;
3264		if (vma->vm_start >= vma->vm_mm->start_brk &&
3265		    vma->vm_end <= vma->vm_mm->brk) {
3266			rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3267		} else if (!vma->vm_file &&
3268			   vma->vm_start <= vma->vm_mm->start_stack &&
3269			   vma->vm_end >= vma->vm_mm->start_stack) {
3270			rc = current_has_perm(current, PROCESS__EXECSTACK);
3271		} else if (vma->vm_file && vma->anon_vma) {
3272			/*
3273			 * We are making executable a file mapping that has
3274			 * had some COW done. Since pages might have been
3275			 * written, check ability to execute the possibly
3276			 * modified content.  This typically should only
3277			 * occur for text relocations.
3278			 */
3279			rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3280		}
3281		if (rc)
3282			return rc;
3283	}
3284
3285	return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3286}
3287
3288static int selinux_file_lock(struct file *file, unsigned int cmd)
3289{
3290	const struct cred *cred = current_cred();
3291
3292	return file_has_perm(cred, file, FILE__LOCK);
3293}
3294
3295static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3296			      unsigned long arg)
3297{
3298	const struct cred *cred = current_cred();
3299	int err = 0;
3300
3301	switch (cmd) {
3302	case F_SETFL:
 
 
 
 
 
3303		if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3304			err = file_has_perm(cred, file, FILE__WRITE);
3305			break;
3306		}
3307		/* fall through */
3308	case F_SETOWN:
3309	case F_SETSIG:
3310	case F_GETFL:
3311	case F_GETOWN:
3312	case F_GETSIG:
3313	case F_GETOWNER_UIDS:
3314		/* Just check FD__USE permission */
3315		err = file_has_perm(cred, file, 0);
3316		break;
3317	case F_GETLK:
3318	case F_SETLK:
3319	case F_SETLKW:
3320	case F_OFD_GETLK:
3321	case F_OFD_SETLK:
3322	case F_OFD_SETLKW:
3323#if BITS_PER_LONG == 32
3324	case F_GETLK64:
3325	case F_SETLK64:
3326	case F_SETLKW64:
3327#endif
 
 
 
 
3328		err = file_has_perm(cred, file, FILE__LOCK);
3329		break;
3330	}
3331
3332	return err;
3333}
3334
3335static int selinux_file_set_fowner(struct file *file)
3336{
3337	struct file_security_struct *fsec;
3338
3339	fsec = file->f_security;
3340	fsec->fown_sid = current_sid();
3341
3342	return 0;
3343}
3344
3345static int selinux_file_send_sigiotask(struct task_struct *tsk,
3346				       struct fown_struct *fown, int signum)
3347{
3348	struct file *file;
3349	u32 sid = task_sid(tsk);
3350	u32 perm;
3351	struct file_security_struct *fsec;
3352
3353	/* struct fown_struct is never outside the context of a struct file */
3354	file = container_of(fown, struct file, f_owner);
3355
3356	fsec = file->f_security;
3357
3358	if (!signum)
3359		perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3360	else
3361		perm = signal_to_av(signum);
3362
3363	return avc_has_perm(fsec->fown_sid, sid,
3364			    SECCLASS_PROCESS, perm, NULL);
3365}
3366
3367static int selinux_file_receive(struct file *file)
3368{
3369	const struct cred *cred = current_cred();
3370
3371	return file_has_perm(cred, file, file_to_av(file));
3372}
3373
3374static int selinux_file_open(struct file *file, const struct cred *cred)
3375{
3376	struct file_security_struct *fsec;
3377	struct inode_security_struct *isec;
3378
3379	fsec = file->f_security;
3380	isec = file_inode(file)->i_security;
3381	/*
3382	 * Save inode label and policy sequence number
3383	 * at open-time so that selinux_file_permission
3384	 * can determine whether revalidation is necessary.
3385	 * Task label is already saved in the file security
3386	 * struct as its SID.
3387	 */
3388	fsec->isid = isec->sid;
3389	fsec->pseqno = avc_policy_seqno();
3390	/*
3391	 * Since the inode label or policy seqno may have changed
3392	 * between the selinux_inode_permission check and the saving
3393	 * of state above, recheck that access is still permitted.
3394	 * Otherwise, access might never be revalidated against the
3395	 * new inode label or new policy.
3396	 * This check is not redundant - do not remove.
3397	 */
3398	return file_path_has_perm(cred, file, open_file_to_av(file));
3399}
3400
3401/* task security operations */
3402
3403static int selinux_task_create(unsigned long clone_flags)
3404{
3405	return current_has_perm(current, PROCESS__FORK);
3406}
3407
3408/*
3409 * allocate the SELinux part of blank credentials
3410 */
3411static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3412{
3413	struct task_security_struct *tsec;
3414
3415	tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3416	if (!tsec)
3417		return -ENOMEM;
3418
3419	cred->security = tsec;
3420	return 0;
3421}
3422
3423/*
3424 * detach and free the LSM part of a set of credentials
3425 */
3426static void selinux_cred_free(struct cred *cred)
3427{
3428	struct task_security_struct *tsec = cred->security;
3429
3430	/*
3431	 * cred->security == NULL if security_cred_alloc_blank() or
3432	 * security_prepare_creds() returned an error.
3433	 */
3434	BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3435	cred->security = (void *) 0x7UL;
3436	kfree(tsec);
3437}
3438
3439/*
3440 * prepare a new set of credentials for modification
3441 */
3442static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3443				gfp_t gfp)
3444{
3445	const struct task_security_struct *old_tsec;
3446	struct task_security_struct *tsec;
3447
3448	old_tsec = old->security;
3449
3450	tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3451	if (!tsec)
3452		return -ENOMEM;
3453
3454	new->security = tsec;
3455	return 0;
3456}
3457
3458/*
3459 * transfer the SELinux data to a blank set of creds
3460 */
3461static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3462{
3463	const struct task_security_struct *old_tsec = old->security;
3464	struct task_security_struct *tsec = new->security;
3465
3466	*tsec = *old_tsec;
3467}
3468
3469/*
3470 * set the security data for a kernel service
3471 * - all the creation contexts are set to unlabelled
3472 */
3473static int selinux_kernel_act_as(struct cred *new, u32 secid)
3474{
3475	struct task_security_struct *tsec = new->security;
3476	u32 sid = current_sid();
3477	int ret;
3478
3479	ret = avc_has_perm(sid, secid,
3480			   SECCLASS_KERNEL_SERVICE,
3481			   KERNEL_SERVICE__USE_AS_OVERRIDE,
3482			   NULL);
3483	if (ret == 0) {
3484		tsec->sid = secid;
3485		tsec->create_sid = 0;
3486		tsec->keycreate_sid = 0;
3487		tsec->sockcreate_sid = 0;
3488	}
3489	return ret;
3490}
3491
3492/*
3493 * set the file creation context in a security record to the same as the
3494 * objective context of the specified inode
3495 */
3496static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3497{
3498	struct inode_security_struct *isec = inode->i_security;
3499	struct task_security_struct *tsec = new->security;
3500	u32 sid = current_sid();
3501	int ret;
3502
3503	ret = avc_has_perm(sid, isec->sid,
3504			   SECCLASS_KERNEL_SERVICE,
3505			   KERNEL_SERVICE__CREATE_FILES_AS,
3506			   NULL);
3507
3508	if (ret == 0)
3509		tsec->create_sid = isec->sid;
3510	return ret;
3511}
3512
3513static int selinux_kernel_module_request(char *kmod_name)
3514{
3515	u32 sid;
3516	struct common_audit_data ad;
3517
3518	sid = task_sid(current);
3519
3520	ad.type = LSM_AUDIT_DATA_KMOD;
3521	ad.u.kmod_name = kmod_name;
3522
3523	return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3524			    SYSTEM__MODULE_REQUEST, &ad);
3525}
3526
3527static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3528{
3529	return current_has_perm(p, PROCESS__SETPGID);
3530}
3531
3532static int selinux_task_getpgid(struct task_struct *p)
3533{
3534	return current_has_perm(p, PROCESS__GETPGID);
3535}
3536
3537static int selinux_task_getsid(struct task_struct *p)
3538{
3539	return current_has_perm(p, PROCESS__GETSESSION);
3540}
3541
3542static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3543{
3544	*secid = task_sid(p);
3545}
3546
3547static int selinux_task_setnice(struct task_struct *p, int nice)
3548{
3549	int rc;
3550
3551	rc = cap_task_setnice(p, nice);
3552	if (rc)
3553		return rc;
3554
3555	return current_has_perm(p, PROCESS__SETSCHED);
3556}
3557
3558static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3559{
3560	int rc;
3561
3562	rc = cap_task_setioprio(p, ioprio);
3563	if (rc)
3564		return rc;
3565
3566	return current_has_perm(p, PROCESS__SETSCHED);
3567}
3568
3569static int selinux_task_getioprio(struct task_struct *p)
3570{
3571	return current_has_perm(p, PROCESS__GETSCHED);
3572}
3573
3574static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3575		struct rlimit *new_rlim)
3576{
3577	struct rlimit *old_rlim = p->signal->rlim + resource;
3578
3579	/* Control the ability to change the hard limit (whether
3580	   lowering or raising it), so that the hard limit can
3581	   later be used as a safe reset point for the soft limit
3582	   upon context transitions.  See selinux_bprm_committing_creds. */
3583	if (old_rlim->rlim_max != new_rlim->rlim_max)
3584		return current_has_perm(p, PROCESS__SETRLIMIT);
3585
3586	return 0;
3587}
3588
3589static int selinux_task_setscheduler(struct task_struct *p)
3590{
3591	int rc;
3592
3593	rc = cap_task_setscheduler(p);
3594	if (rc)
3595		return rc;
3596
3597	return current_has_perm(p, PROCESS__SETSCHED);
3598}
3599
3600static int selinux_task_getscheduler(struct task_struct *p)
3601{
3602	return current_has_perm(p, PROCESS__GETSCHED);
3603}
3604
3605static int selinux_task_movememory(struct task_struct *p)
3606{
3607	return current_has_perm(p, PROCESS__SETSCHED);
3608}
3609
3610static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3611				int sig, u32 secid)
3612{
3613	u32 perm;
3614	int rc;
3615
3616	if (!sig)
3617		perm = PROCESS__SIGNULL; /* null signal; existence test */
3618	else
3619		perm = signal_to_av(sig);
3620	if (secid)
3621		rc = avc_has_perm(secid, task_sid(p),
3622				  SECCLASS_PROCESS, perm, NULL);
3623	else
3624		rc = current_has_perm(p, perm);
3625	return rc;
3626}
3627
3628static int selinux_task_wait(struct task_struct *p)
3629{
3630	return task_has_perm(p, current, PROCESS__SIGCHLD);
3631}
3632
3633static void selinux_task_to_inode(struct task_struct *p,
3634				  struct inode *inode)
3635{
3636	struct inode_security_struct *isec = inode->i_security;
3637	u32 sid = task_sid(p);
3638
3639	isec->sid = sid;
3640	isec->initialized = 1;
3641}
3642
3643/* Returns error only if unable to parse addresses */
3644static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3645			struct common_audit_data *ad, u8 *proto)
3646{
3647	int offset, ihlen, ret = -EINVAL;
3648	struct iphdr _iph, *ih;
3649
3650	offset = skb_network_offset(skb);
3651	ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3652	if (ih == NULL)
3653		goto out;
3654
3655	ihlen = ih->ihl * 4;
3656	if (ihlen < sizeof(_iph))
3657		goto out;
3658
3659	ad->u.net->v4info.saddr = ih->saddr;
3660	ad->u.net->v4info.daddr = ih->daddr;
3661	ret = 0;
3662
3663	if (proto)
3664		*proto = ih->protocol;
3665
3666	switch (ih->protocol) {
3667	case IPPROTO_TCP: {
3668		struct tcphdr _tcph, *th;
3669
3670		if (ntohs(ih->frag_off) & IP_OFFSET)
3671			break;
3672
3673		offset += ihlen;
3674		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3675		if (th == NULL)
3676			break;
3677
3678		ad->u.net->sport = th->source;
3679		ad->u.net->dport = th->dest;
3680		break;
3681	}
3682
3683	case IPPROTO_UDP: {
3684		struct udphdr _udph, *uh;
3685
3686		if (ntohs(ih->frag_off) & IP_OFFSET)
3687			break;
3688
3689		offset += ihlen;
3690		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3691		if (uh == NULL)
3692			break;
3693
3694		ad->u.net->sport = uh->source;
3695		ad->u.net->dport = uh->dest;
3696		break;
3697	}
3698
3699	case IPPROTO_DCCP: {
3700		struct dccp_hdr _dccph, *dh;
3701
3702		if (ntohs(ih->frag_off) & IP_OFFSET)
3703			break;
3704
3705		offset += ihlen;
3706		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3707		if (dh == NULL)
3708			break;
3709
3710		ad->u.net->sport = dh->dccph_sport;
3711		ad->u.net->dport = dh->dccph_dport;
3712		break;
3713	}
3714
3715	default:
3716		break;
3717	}
3718out:
3719	return ret;
3720}
3721
3722#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3723
3724/* Returns error only if unable to parse addresses */
3725static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3726			struct common_audit_data *ad, u8 *proto)
3727{
3728	u8 nexthdr;
3729	int ret = -EINVAL, offset;
3730	struct ipv6hdr _ipv6h, *ip6;
3731	__be16 frag_off;
3732
3733	offset = skb_network_offset(skb);
3734	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3735	if (ip6 == NULL)
3736		goto out;
3737
3738	ad->u.net->v6info.saddr = ip6->saddr;
3739	ad->u.net->v6info.daddr = ip6->daddr;
3740	ret = 0;
3741
3742	nexthdr = ip6->nexthdr;
3743	offset += sizeof(_ipv6h);
3744	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3745	if (offset < 0)
3746		goto out;
3747
3748	if (proto)
3749		*proto = nexthdr;
3750
3751	switch (nexthdr) {
3752	case IPPROTO_TCP: {
3753		struct tcphdr _tcph, *th;
3754
3755		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3756		if (th == NULL)
3757			break;
3758
3759		ad->u.net->sport = th->source;
3760		ad->u.net->dport = th->dest;
3761		break;
3762	}
3763
3764	case IPPROTO_UDP: {
3765		struct udphdr _udph, *uh;
3766
3767		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3768		if (uh == NULL)
3769			break;
3770
3771		ad->u.net->sport = uh->source;
3772		ad->u.net->dport = uh->dest;
3773		break;
3774	}
3775
3776	case IPPROTO_DCCP: {
3777		struct dccp_hdr _dccph, *dh;
3778
3779		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3780		if (dh == NULL)
3781			break;
3782
3783		ad->u.net->sport = dh->dccph_sport;
3784		ad->u.net->dport = dh->dccph_dport;
3785		break;
3786	}
3787
3788	/* includes fragments */
3789	default:
3790		break;
3791	}
3792out:
3793	return ret;
3794}
3795
3796#endif /* IPV6 */
3797
3798static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3799			     char **_addrp, int src, u8 *proto)
3800{
3801	char *addrp;
3802	int ret;
3803
3804	switch (ad->u.net->family) {
3805	case PF_INET:
3806		ret = selinux_parse_skb_ipv4(skb, ad, proto);
3807		if (ret)
3808			goto parse_error;
3809		addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3810				       &ad->u.net->v4info.daddr);
3811		goto okay;
3812
3813#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3814	case PF_INET6:
3815		ret = selinux_parse_skb_ipv6(skb, ad, proto);
3816		if (ret)
3817			goto parse_error;
3818		addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3819				       &ad->u.net->v6info.daddr);
3820		goto okay;
3821#endif	/* IPV6 */
3822	default:
3823		addrp = NULL;
3824		goto okay;
3825	}
3826
3827parse_error:
3828	printk(KERN_WARNING
3829	       "SELinux: failure in selinux_parse_skb(),"
3830	       " unable to parse packet\n");
3831	return ret;
3832
3833okay:
3834	if (_addrp)
3835		*_addrp = addrp;
3836	return 0;
3837}
3838
3839/**
3840 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3841 * @skb: the packet
3842 * @family: protocol family
3843 * @sid: the packet's peer label SID
3844 *
3845 * Description:
3846 * Check the various different forms of network peer labeling and determine
3847 * the peer label/SID for the packet; most of the magic actually occurs in
3848 * the security server function security_net_peersid_cmp().  The function
3849 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3850 * or -EACCES if @sid is invalid due to inconsistencies with the different
3851 * peer labels.
3852 *
3853 */
3854static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3855{
3856	int err;
3857	u32 xfrm_sid;
3858	u32 nlbl_sid;
3859	u32 nlbl_type;
3860
3861	err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3862	if (unlikely(err))
3863		return -EACCES;
3864	err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3865	if (unlikely(err))
3866		return -EACCES;
3867
3868	err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3869	if (unlikely(err)) {
3870		printk(KERN_WARNING
3871		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
3872		       " unable to determine packet's peer label\n");
3873		return -EACCES;
3874	}
3875
3876	return 0;
3877}
3878
3879/**
3880 * selinux_conn_sid - Determine the child socket label for a connection
3881 * @sk_sid: the parent socket's SID
3882 * @skb_sid: the packet's SID
3883 * @conn_sid: the resulting connection SID
3884 *
3885 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3886 * combined with the MLS information from @skb_sid in order to create
3887 * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3888 * of @sk_sid.  Returns zero on success, negative values on failure.
3889 *
3890 */
3891static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3892{
3893	int err = 0;
3894
3895	if (skb_sid != SECSID_NULL)
3896		err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3897	else
3898		*conn_sid = sk_sid;
3899
3900	return err;
3901}
3902
3903/* socket security operations */
3904
3905static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3906				 u16 secclass, u32 *socksid)
3907{
3908	if (tsec->sockcreate_sid > SECSID_NULL) {
3909		*socksid = tsec->sockcreate_sid;
3910		return 0;
3911	}
3912
3913	return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3914				       socksid);
3915}
3916
3917static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3918{
3919	struct sk_security_struct *sksec = sk->sk_security;
3920	struct common_audit_data ad;
3921	struct lsm_network_audit net = {0,};
3922	u32 tsid = task_sid(task);
3923
3924	if (sksec->sid == SECINITSID_KERNEL)
3925		return 0;
3926
3927	ad.type = LSM_AUDIT_DATA_NET;
3928	ad.u.net = &net;
3929	ad.u.net->sk = sk;
3930
3931	return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3932}
3933
3934static int selinux_socket_create(int family, int type,
3935				 int protocol, int kern)
3936{
3937	const struct task_security_struct *tsec = current_security();
3938	u32 newsid;
3939	u16 secclass;
3940	int rc;
3941
3942	if (kern)
3943		return 0;
3944
3945	secclass = socket_type_to_security_class(family, type, protocol);
3946	rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3947	if (rc)
3948		return rc;
3949
3950	return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3951}
3952
3953static int selinux_socket_post_create(struct socket *sock, int family,
3954				      int type, int protocol, int kern)
3955{
3956	const struct task_security_struct *tsec = current_security();
3957	struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3958	struct sk_security_struct *sksec;
3959	int err = 0;
3960
3961	isec->sclass = socket_type_to_security_class(family, type, protocol);
3962
3963	if (kern)
3964		isec->sid = SECINITSID_KERNEL;
3965	else {
3966		err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3967		if (err)
3968			return err;
3969	}
3970
3971	isec->initialized = 1;
3972
3973	if (sock->sk) {
3974		sksec = sock->sk->sk_security;
3975		sksec->sid = isec->sid;
3976		sksec->sclass = isec->sclass;
3977		err = selinux_netlbl_socket_post_create(sock->sk, family);
3978	}
3979
3980	return err;
3981}
3982
3983/* Range of port numbers used to automatically bind.
3984   Need to determine whether we should perform a name_bind
3985   permission check between the socket and the port number. */
3986
3987static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3988{
3989	struct sock *sk = sock->sk;
3990	u16 family;
3991	int err;
3992
3993	err = sock_has_perm(current, sk, SOCKET__BIND);
3994	if (err)
3995		goto out;
3996
3997	/*
3998	 * If PF_INET or PF_INET6, check name_bind permission for the port.
3999	 * Multiple address binding for SCTP is not supported yet: we just
4000	 * check the first address now.
4001	 */
4002	family = sk->sk_family;
4003	if (family == PF_INET || family == PF_INET6) {
4004		char *addrp;
4005		struct sk_security_struct *sksec = sk->sk_security;
4006		struct common_audit_data ad;
4007		struct lsm_network_audit net = {0,};
4008		struct sockaddr_in *addr4 = NULL;
4009		struct sockaddr_in6 *addr6 = NULL;
4010		unsigned short snum;
4011		u32 sid, node_perm;
4012
4013		if (family == PF_INET) {
4014			addr4 = (struct sockaddr_in *)address;
4015			snum = ntohs(addr4->sin_port);
4016			addrp = (char *)&addr4->sin_addr.s_addr;
4017		} else {
4018			addr6 = (struct sockaddr_in6 *)address;
4019			snum = ntohs(addr6->sin6_port);
4020			addrp = (char *)&addr6->sin6_addr.s6_addr;
4021		}
4022
4023		if (snum) {
4024			int low, high;
4025
4026			inet_get_local_port_range(sock_net(sk), &low, &high);
4027
4028			if (snum < max(PROT_SOCK, low) || snum > high) {
4029				err = sel_netport_sid(sk->sk_protocol,
4030						      snum, &sid);
4031				if (err)
4032					goto out;
4033				ad.type = LSM_AUDIT_DATA_NET;
4034				ad.u.net = &net;
4035				ad.u.net->sport = htons(snum);
4036				ad.u.net->family = family;
4037				err = avc_has_perm(sksec->sid, sid,
4038						   sksec->sclass,
4039						   SOCKET__NAME_BIND, &ad);
4040				if (err)
4041					goto out;
4042			}
4043		}
4044
4045		switch (sksec->sclass) {
4046		case SECCLASS_TCP_SOCKET:
4047			node_perm = TCP_SOCKET__NODE_BIND;
4048			break;
4049
4050		case SECCLASS_UDP_SOCKET:
4051			node_perm = UDP_SOCKET__NODE_BIND;
4052			break;
4053
4054		case SECCLASS_DCCP_SOCKET:
4055			node_perm = DCCP_SOCKET__NODE_BIND;
4056			break;
4057
4058		default:
4059			node_perm = RAWIP_SOCKET__NODE_BIND;
4060			break;
4061		}
4062
4063		err = sel_netnode_sid(addrp, family, &sid);
4064		if (err)
4065			goto out;
4066
4067		ad.type = LSM_AUDIT_DATA_NET;
4068		ad.u.net = &net;
4069		ad.u.net->sport = htons(snum);
4070		ad.u.net->family = family;
4071
4072		if (family == PF_INET)
4073			ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4074		else
4075			ad.u.net->v6info.saddr = addr6->sin6_addr;
4076
4077		err = avc_has_perm(sksec->sid, sid,
4078				   sksec->sclass, node_perm, &ad);
4079		if (err)
4080			goto out;
4081	}
4082out:
4083	return err;
4084}
4085
4086static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4087{
4088	struct sock *sk = sock->sk;
4089	struct sk_security_struct *sksec = sk->sk_security;
4090	int err;
4091
4092	err = sock_has_perm(current, sk, SOCKET__CONNECT);
4093	if (err)
4094		return err;
4095
4096	/*
4097	 * If a TCP or DCCP socket, check name_connect permission for the port.
4098	 */
4099	if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4100	    sksec->sclass == SECCLASS_DCCP_SOCKET) {
4101		struct common_audit_data ad;
4102		struct lsm_network_audit net = {0,};
4103		struct sockaddr_in *addr4 = NULL;
4104		struct sockaddr_in6 *addr6 = NULL;
4105		unsigned short snum;
4106		u32 sid, perm;
4107
4108		if (sk->sk_family == PF_INET) {
4109			addr4 = (struct sockaddr_in *)address;
4110			if (addrlen < sizeof(struct sockaddr_in))
4111				return -EINVAL;
4112			snum = ntohs(addr4->sin_port);
4113		} else {
4114			addr6 = (struct sockaddr_in6 *)address;
4115			if (addrlen < SIN6_LEN_RFC2133)
4116				return -EINVAL;
4117			snum = ntohs(addr6->sin6_port);
4118		}
4119
4120		err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4121		if (err)
4122			goto out;
4123
4124		perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4125		       TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4126
4127		ad.type = LSM_AUDIT_DATA_NET;
4128		ad.u.net = &net;
4129		ad.u.net->dport = htons(snum);
4130		ad.u.net->family = sk->sk_family;
4131		err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4132		if (err)
4133			goto out;
4134	}
4135
4136	err = selinux_netlbl_socket_connect(sk, address);
4137
4138out:
4139	return err;
4140}
4141
4142static int selinux_socket_listen(struct socket *sock, int backlog)
4143{
4144	return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4145}
4146
4147static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4148{
4149	int err;
4150	struct inode_security_struct *isec;
4151	struct inode_security_struct *newisec;
4152
4153	err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4154	if (err)
4155		return err;
4156
4157	newisec = SOCK_INODE(newsock)->i_security;
4158
4159	isec = SOCK_INODE(sock)->i_security;
4160	newisec->sclass = isec->sclass;
4161	newisec->sid = isec->sid;
4162	newisec->initialized = 1;
4163
4164	return 0;
4165}
4166
4167static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4168				  int size)
4169{
4170	return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4171}
4172
4173static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4174				  int size, int flags)
4175{
4176	return sock_has_perm(current, sock->sk, SOCKET__READ);
4177}
4178
4179static int selinux_socket_getsockname(struct socket *sock)
4180{
4181	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4182}
4183
4184static int selinux_socket_getpeername(struct socket *sock)
4185{
4186	return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4187}
4188
4189static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4190{
4191	int err;
4192
4193	err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4194	if (err)
4195		return err;
4196
4197	return selinux_netlbl_socket_setsockopt(sock, level, optname);
4198}
4199
4200static int selinux_socket_getsockopt(struct socket *sock, int level,
4201				     int optname)
4202{
4203	return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4204}
4205
4206static int selinux_socket_shutdown(struct socket *sock, int how)
4207{
4208	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4209}
4210
4211static int selinux_socket_unix_stream_connect(struct sock *sock,
4212					      struct sock *other,
4213					      struct sock *newsk)
4214{
4215	struct sk_security_struct *sksec_sock = sock->sk_security;
4216	struct sk_security_struct *sksec_other = other->sk_security;
4217	struct sk_security_struct *sksec_new = newsk->sk_security;
4218	struct common_audit_data ad;
4219	struct lsm_network_audit net = {0,};
4220	int err;
4221
4222	ad.type = LSM_AUDIT_DATA_NET;
4223	ad.u.net = &net;
4224	ad.u.net->sk = other;
4225
4226	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4227			   sksec_other->sclass,
4228			   UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4229	if (err)
4230		return err;
4231
4232	/* server child socket */
4233	sksec_new->peer_sid = sksec_sock->sid;
4234	err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4235				    &sksec_new->sid);
4236	if (err)
4237		return err;
4238
4239	/* connecting socket */
4240	sksec_sock->peer_sid = sksec_new->sid;
4241
4242	return 0;
4243}
4244
4245static int selinux_socket_unix_may_send(struct socket *sock,
4246					struct socket *other)
4247{
4248	struct sk_security_struct *ssec = sock->sk->sk_security;
4249	struct sk_security_struct *osec = other->sk->sk_security;
4250	struct common_audit_data ad;
4251	struct lsm_network_audit net = {0,};
4252
4253	ad.type = LSM_AUDIT_DATA_NET;
4254	ad.u.net = &net;
4255	ad.u.net->sk = other->sk;
4256
4257	return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4258			    &ad);
4259}
4260
4261static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4262				    u32 peer_sid,
4263				    struct common_audit_data *ad)
4264{
4265	int err;
4266	u32 if_sid;
4267	u32 node_sid;
4268
4269	err = sel_netif_sid(ifindex, &if_sid);
4270	if (err)
4271		return err;
4272	err = avc_has_perm(peer_sid, if_sid,
4273			   SECCLASS_NETIF, NETIF__INGRESS, ad);
4274	if (err)
4275		return err;
4276
4277	err = sel_netnode_sid(addrp, family, &node_sid);
4278	if (err)
4279		return err;
4280	return avc_has_perm(peer_sid, node_sid,
4281			    SECCLASS_NODE, NODE__RECVFROM, ad);
4282}
4283
4284static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4285				       u16 family)
4286{
4287	int err = 0;
4288	struct sk_security_struct *sksec = sk->sk_security;
4289	u32 sk_sid = sksec->sid;
4290	struct common_audit_data ad;
4291	struct lsm_network_audit net = {0,};
4292	char *addrp;
4293
4294	ad.type = LSM_AUDIT_DATA_NET;
4295	ad.u.net = &net;
4296	ad.u.net->netif = skb->skb_iif;
4297	ad.u.net->family = family;
4298	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4299	if (err)
4300		return err;
4301
4302	if (selinux_secmark_enabled()) {
4303		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4304				   PACKET__RECV, &ad);
4305		if (err)
4306			return err;
4307	}
4308
4309	err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4310	if (err)
4311		return err;
4312	err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4313
4314	return err;
4315}
4316
4317static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4318{
4319	int err;
4320	struct sk_security_struct *sksec = sk->sk_security;
4321	u16 family = sk->sk_family;
4322	u32 sk_sid = sksec->sid;
4323	struct common_audit_data ad;
4324	struct lsm_network_audit net = {0,};
4325	char *addrp;
4326	u8 secmark_active;
4327	u8 peerlbl_active;
4328
4329	if (family != PF_INET && family != PF_INET6)
4330		return 0;
4331
4332	/* Handle mapped IPv4 packets arriving via IPv6 sockets */
4333	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4334		family = PF_INET;
4335
4336	/* If any sort of compatibility mode is enabled then handoff processing
4337	 * to the selinux_sock_rcv_skb_compat() function to deal with the
4338	 * special handling.  We do this in an attempt to keep this function
4339	 * as fast and as clean as possible. */
4340	if (!selinux_policycap_netpeer)
4341		return selinux_sock_rcv_skb_compat(sk, skb, family);
4342
4343	secmark_active = selinux_secmark_enabled();
4344	peerlbl_active = selinux_peerlbl_enabled();
4345	if (!secmark_active && !peerlbl_active)
4346		return 0;
4347
4348	ad.type = LSM_AUDIT_DATA_NET;
4349	ad.u.net = &net;
4350	ad.u.net->netif = skb->skb_iif;
4351	ad.u.net->family = family;
4352	err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4353	if (err)
4354		return err;
4355
4356	if (peerlbl_active) {
4357		u32 peer_sid;
4358
4359		err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4360		if (err)
4361			return err;
4362		err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4363					       peer_sid, &ad);
4364		if (err) {
4365			selinux_netlbl_err(skb, err, 0);
4366			return err;
4367		}
4368		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4369				   PEER__RECV, &ad);
4370		if (err) {
4371			selinux_netlbl_err(skb, err, 0);
4372			return err;
4373		}
4374	}
4375
4376	if (secmark_active) {
4377		err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4378				   PACKET__RECV, &ad);
4379		if (err)
4380			return err;
4381	}
4382
4383	return err;
4384}
4385
4386static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4387					    int __user *optlen, unsigned len)
4388{
4389	int err = 0;
4390	char *scontext;
4391	u32 scontext_len;
4392	struct sk_security_struct *sksec = sock->sk->sk_security;
4393	u32 peer_sid = SECSID_NULL;
4394
4395	if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4396	    sksec->sclass == SECCLASS_TCP_SOCKET)
4397		peer_sid = sksec->peer_sid;
4398	if (peer_sid == SECSID_NULL)
4399		return -ENOPROTOOPT;
4400
4401	err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4402	if (err)
4403		return err;
4404
4405	if (scontext_len > len) {
4406		err = -ERANGE;
4407		goto out_len;
4408	}
4409
4410	if (copy_to_user(optval, scontext, scontext_len))
4411		err = -EFAULT;
4412
4413out_len:
4414	if (put_user(scontext_len, optlen))
4415		err = -EFAULT;
4416	kfree(scontext);
4417	return err;
4418}
4419
4420static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4421{
4422	u32 peer_secid = SECSID_NULL;
4423	u16 family;
4424
4425	if (skb && skb->protocol == htons(ETH_P_IP))
4426		family = PF_INET;
4427	else if (skb && skb->protocol == htons(ETH_P_IPV6))
4428		family = PF_INET6;
4429	else if (sock)
4430		family = sock->sk->sk_family;
4431	else
4432		goto out;
4433
4434	if (sock && family == PF_UNIX)
4435		selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4436	else if (skb)
4437		selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4438
4439out:
4440	*secid = peer_secid;
4441	if (peer_secid == SECSID_NULL)
4442		return -EINVAL;
4443	return 0;
4444}
4445
4446static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4447{
4448	struct sk_security_struct *sksec;
4449
4450	sksec = kzalloc(sizeof(*sksec), priority);
4451	if (!sksec)
4452		return -ENOMEM;
4453
4454	sksec->peer_sid = SECINITSID_UNLABELED;
4455	sksec->sid = SECINITSID_UNLABELED;
4456	selinux_netlbl_sk_security_reset(sksec);
4457	sk->sk_security = sksec;
4458
4459	return 0;
4460}
4461
4462static void selinux_sk_free_security(struct sock *sk)
4463{
4464	struct sk_security_struct *sksec = sk->sk_security;
4465
4466	sk->sk_security = NULL;
4467	selinux_netlbl_sk_security_free(sksec);
4468	kfree(sksec);
4469}
4470
4471static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4472{
4473	struct sk_security_struct *sksec = sk->sk_security;
4474	struct sk_security_struct *newsksec = newsk->sk_security;
4475
4476	newsksec->sid = sksec->sid;
4477	newsksec->peer_sid = sksec->peer_sid;
4478	newsksec->sclass = sksec->sclass;
4479
4480	selinux_netlbl_sk_security_reset(newsksec);
4481}
4482
4483static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4484{
4485	if (!sk)
4486		*secid = SECINITSID_ANY_SOCKET;
4487	else {
4488		struct sk_security_struct *sksec = sk->sk_security;
4489
4490		*secid = sksec->sid;
4491	}
4492}
4493
4494static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4495{
4496	struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4497	struct sk_security_struct *sksec = sk->sk_security;
4498
4499	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4500	    sk->sk_family == PF_UNIX)
4501		isec->sid = sksec->sid;
4502	sksec->sclass = isec->sclass;
4503}
4504
4505static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4506				     struct request_sock *req)
4507{
4508	struct sk_security_struct *sksec = sk->sk_security;
4509	int err;
4510	u16 family = req->rsk_ops->family;
4511	u32 connsid;
4512	u32 peersid;
4513
 
 
 
 
4514	err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4515	if (err)
4516		return err;
4517	err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4518	if (err)
4519		return err;
4520	req->secid = connsid;
4521	req->peer_secid = peersid;
 
 
 
 
 
4522
4523	return selinux_netlbl_inet_conn_request(req, family);
4524}
4525
4526static void selinux_inet_csk_clone(struct sock *newsk,
4527				   const struct request_sock *req)
4528{
4529	struct sk_security_struct *newsksec = newsk->sk_security;
4530
4531	newsksec->sid = req->secid;
4532	newsksec->peer_sid = req->peer_secid;
4533	/* NOTE: Ideally, we should also get the isec->sid for the
4534	   new socket in sync, but we don't have the isec available yet.
4535	   So we will wait until sock_graft to do it, by which
4536	   time it will have been created and available. */
4537
4538	/* We don't need to take any sort of lock here as we are the only
4539	 * thread with access to newsksec */
4540	selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4541}
4542
4543static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4544{
4545	u16 family = sk->sk_family;
4546	struct sk_security_struct *sksec = sk->sk_security;
4547
4548	/* handle mapped IPv4 packets arriving via IPv6 sockets */
4549	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4550		family = PF_INET;
4551
4552	selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4553}
4554
4555static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4556{
4557	skb_set_owner_w(skb, sk);
4558}
4559
4560static int selinux_secmark_relabel_packet(u32 sid)
4561{
4562	const struct task_security_struct *__tsec;
4563	u32 tsid;
4564
4565	__tsec = current_security();
4566	tsid = __tsec->sid;
4567
4568	return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4569}
4570
4571static void selinux_secmark_refcount_inc(void)
4572{
4573	atomic_inc(&selinux_secmark_refcount);
4574}
4575
4576static void selinux_secmark_refcount_dec(void)
4577{
4578	atomic_dec(&selinux_secmark_refcount);
4579}
4580
4581static void selinux_req_classify_flow(const struct request_sock *req,
4582				      struct flowi *fl)
4583{
4584	fl->flowi_secid = req->secid;
4585}
4586
4587static int selinux_tun_dev_alloc_security(void **security)
4588{
4589	struct tun_security_struct *tunsec;
4590
4591	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4592	if (!tunsec)
4593		return -ENOMEM;
4594	tunsec->sid = current_sid();
4595
4596	*security = tunsec;
4597	return 0;
4598}
4599
4600static void selinux_tun_dev_free_security(void *security)
4601{
4602	kfree(security);
4603}
4604
4605static int selinux_tun_dev_create(void)
4606{
4607	u32 sid = current_sid();
4608
4609	/* we aren't taking into account the "sockcreate" SID since the socket
4610	 * that is being created here is not a socket in the traditional sense,
4611	 * instead it is a private sock, accessible only to the kernel, and
4612	 * representing a wide range of network traffic spanning multiple
4613	 * connections unlike traditional sockets - check the TUN driver to
4614	 * get a better understanding of why this socket is special */
4615
4616	return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4617			    NULL);
4618}
4619
4620static int selinux_tun_dev_attach_queue(void *security)
4621{
4622	struct tun_security_struct *tunsec = security;
4623
4624	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4625			    TUN_SOCKET__ATTACH_QUEUE, NULL);
4626}
4627
4628static int selinux_tun_dev_attach(struct sock *sk, void *security)
4629{
4630	struct tun_security_struct *tunsec = security;
4631	struct sk_security_struct *sksec = sk->sk_security;
4632
4633	/* we don't currently perform any NetLabel based labeling here and it
4634	 * isn't clear that we would want to do so anyway; while we could apply
4635	 * labeling without the support of the TUN user the resulting labeled
4636	 * traffic from the other end of the connection would almost certainly
4637	 * cause confusion to the TUN user that had no idea network labeling
4638	 * protocols were being used */
4639
4640	sksec->sid = tunsec->sid;
4641	sksec->sclass = SECCLASS_TUN_SOCKET;
4642
4643	return 0;
 
4644}
4645
4646static int selinux_tun_dev_open(void *security)
4647{
4648	struct tun_security_struct *tunsec = security;
4649	u32 sid = current_sid();
4650	int err;
4651
4652	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4653			   TUN_SOCKET__RELABELFROM, NULL);
4654	if (err)
4655		return err;
4656	err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4657			   TUN_SOCKET__RELABELTO, NULL);
4658	if (err)
4659		return err;
4660	tunsec->sid = sid;
 
4661
4662	return 0;
4663}
4664
4665static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4666{
4667	int err = 0;
4668	u32 perm;
4669	struct nlmsghdr *nlh;
4670	struct sk_security_struct *sksec = sk->sk_security;
4671
4672	if (skb->len < NLMSG_HDRLEN) {
4673		err = -EINVAL;
4674		goto out;
4675	}
4676	nlh = nlmsg_hdr(skb);
4677
4678	err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4679	if (err) {
4680		if (err == -EINVAL) {
4681			audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4682				  "SELinux:  unrecognized netlink message"
4683				  " type=%hu for sclass=%hu\n",
4684				  nlh->nlmsg_type, sksec->sclass);
4685			if (!selinux_enforcing || security_get_allow_unknown())
4686				err = 0;
4687		}
4688
4689		/* Ignore */
4690		if (err == -ENOENT)
4691			err = 0;
4692		goto out;
4693	}
4694
4695	err = sock_has_perm(current, sk, perm);
4696out:
4697	return err;
4698}
4699
4700#ifdef CONFIG_NETFILTER
4701
4702static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4703				       u16 family)
4704{
4705	int err;
4706	char *addrp;
4707	u32 peer_sid;
4708	struct common_audit_data ad;
4709	struct lsm_network_audit net = {0,};
4710	u8 secmark_active;
4711	u8 netlbl_active;
4712	u8 peerlbl_active;
4713
4714	if (!selinux_policycap_netpeer)
4715		return NF_ACCEPT;
4716
4717	secmark_active = selinux_secmark_enabled();
4718	netlbl_active = netlbl_enabled();
4719	peerlbl_active = selinux_peerlbl_enabled();
4720	if (!secmark_active && !peerlbl_active)
4721		return NF_ACCEPT;
4722
4723	if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4724		return NF_DROP;
4725
4726	ad.type = LSM_AUDIT_DATA_NET;
4727	ad.u.net = &net;
4728	ad.u.net->netif = ifindex;
4729	ad.u.net->family = family;
4730	if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4731		return NF_DROP;
4732
4733	if (peerlbl_active) {
4734		err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4735					       peer_sid, &ad);
4736		if (err) {
4737			selinux_netlbl_err(skb, err, 1);
4738			return NF_DROP;
4739		}
4740	}
4741
4742	if (secmark_active)
4743		if (avc_has_perm(peer_sid, skb->secmark,
4744				 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4745			return NF_DROP;
4746
4747	if (netlbl_active)
4748		/* we do this in the FORWARD path and not the POST_ROUTING
4749		 * path because we want to make sure we apply the necessary
4750		 * labeling before IPsec is applied so we can leverage AH
4751		 * protection */
4752		if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4753			return NF_DROP;
4754
4755	return NF_ACCEPT;
4756}
4757
4758static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4759					 struct sk_buff *skb,
4760					 const struct net_device *in,
4761					 const struct net_device *out,
4762					 int (*okfn)(struct sk_buff *))
4763{
4764	return selinux_ip_forward(skb, in->ifindex, PF_INET);
4765}
4766
4767#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4768static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4769					 struct sk_buff *skb,
4770					 const struct net_device *in,
4771					 const struct net_device *out,
4772					 int (*okfn)(struct sk_buff *))
4773{
4774	return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4775}
4776#endif	/* IPV6 */
4777
4778static unsigned int selinux_ip_output(struct sk_buff *skb,
4779				      u16 family)
4780{
4781	struct sock *sk;
4782	u32 sid;
4783
4784	if (!netlbl_enabled())
4785		return NF_ACCEPT;
4786
4787	/* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4788	 * because we want to make sure we apply the necessary labeling
4789	 * before IPsec is applied so we can leverage AH protection */
4790	sk = skb->sk;
4791	if (sk) {
4792		struct sk_security_struct *sksec;
4793
4794		if (sk->sk_state == TCP_LISTEN)
4795			/* if the socket is the listening state then this
4796			 * packet is a SYN-ACK packet which means it needs to
4797			 * be labeled based on the connection/request_sock and
4798			 * not the parent socket.  unfortunately, we can't
4799			 * lookup the request_sock yet as it isn't queued on
4800			 * the parent socket until after the SYN-ACK is sent.
4801			 * the "solution" is to simply pass the packet as-is
4802			 * as any IP option based labeling should be copied
4803			 * from the initial connection request (in the IP
4804			 * layer).  it is far from ideal, but until we get a
4805			 * security label in the packet itself this is the
4806			 * best we can do. */
4807			return NF_ACCEPT;
4808
4809		/* standard practice, label using the parent socket */
4810		sksec = sk->sk_security;
4811		sid = sksec->sid;
4812	} else
4813		sid = SECINITSID_KERNEL;
4814	if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4815		return NF_DROP;
4816
4817	return NF_ACCEPT;
4818}
4819
4820static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4821					struct sk_buff *skb,
4822					const struct net_device *in,
4823					const struct net_device *out,
4824					int (*okfn)(struct sk_buff *))
4825{
4826	return selinux_ip_output(skb, PF_INET);
4827}
4828
4829static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4830						int ifindex,
4831						u16 family)
4832{
4833	struct sock *sk = skb->sk;
4834	struct sk_security_struct *sksec;
4835	struct common_audit_data ad;
4836	struct lsm_network_audit net = {0,};
4837	char *addrp;
4838	u8 proto;
4839
4840	if (sk == NULL)
4841		return NF_ACCEPT;
4842	sksec = sk->sk_security;
4843
4844	ad.type = LSM_AUDIT_DATA_NET;
4845	ad.u.net = &net;
4846	ad.u.net->netif = ifindex;
4847	ad.u.net->family = family;
4848	if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4849		return NF_DROP;
4850
4851	if (selinux_secmark_enabled())
4852		if (avc_has_perm(sksec->sid, skb->secmark,
4853				 SECCLASS_PACKET, PACKET__SEND, &ad))
4854			return NF_DROP_ERR(-ECONNREFUSED);
4855
4856	if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4857		return NF_DROP_ERR(-ECONNREFUSED);
4858
4859	return NF_ACCEPT;
4860}
4861
4862static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4863					 u16 family)
4864{
4865	u32 secmark_perm;
4866	u32 peer_sid;
4867	struct sock *sk;
4868	struct common_audit_data ad;
4869	struct lsm_network_audit net = {0,};
4870	char *addrp;
4871	u8 secmark_active;
4872	u8 peerlbl_active;
4873
4874	/* If any sort of compatibility mode is enabled then handoff processing
4875	 * to the selinux_ip_postroute_compat() function to deal with the
4876	 * special handling.  We do this in an attempt to keep this function
4877	 * as fast and as clean as possible. */
4878	if (!selinux_policycap_netpeer)
4879		return selinux_ip_postroute_compat(skb, ifindex, family);
4880
4881	secmark_active = selinux_secmark_enabled();
4882	peerlbl_active = selinux_peerlbl_enabled();
4883	if (!secmark_active && !peerlbl_active)
4884		return NF_ACCEPT;
4885
4886	sk = skb->sk;
4887
4888#ifdef CONFIG_XFRM
4889	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4890	 * packet transformation so allow the packet to pass without any checks
4891	 * since we'll have another chance to perform access control checks
4892	 * when the packet is on it's final way out.
4893	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4894	 *       is NULL, in this case go ahead and apply access control.
4895	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4896	 *       TCP listening state we cannot wait until the XFRM processing
4897	 *       is done as we will miss out on the SA label if we do;
4898	 *       unfortunately, this means more work, but it is only once per
4899	 *       connection. */
4900	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4901	    !(sk != NULL && sk->sk_state == TCP_LISTEN))
4902		return NF_ACCEPT;
4903#endif
 
 
 
 
4904
 
 
 
 
 
4905	if (sk == NULL) {
4906		/* Without an associated socket the packet is either coming
4907		 * from the kernel or it is being forwarded; check the packet
4908		 * to determine which and if the packet is being forwarded
4909		 * query the packet directly to determine the security label. */
4910		if (skb->skb_iif) {
4911			secmark_perm = PACKET__FORWARD_OUT;
4912			if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4913				return NF_DROP;
4914		} else {
4915			secmark_perm = PACKET__SEND;
4916			peer_sid = SECINITSID_KERNEL;
4917		}
4918	} else if (sk->sk_state == TCP_LISTEN) {
4919		/* Locally generated packet but the associated socket is in the
4920		 * listening state which means this is a SYN-ACK packet.  In
4921		 * this particular case the correct security label is assigned
4922		 * to the connection/request_sock but unfortunately we can't
4923		 * query the request_sock as it isn't queued on the parent
4924		 * socket until after the SYN-ACK packet is sent; the only
4925		 * viable choice is to regenerate the label like we do in
4926		 * selinux_inet_conn_request().  See also selinux_ip_output()
4927		 * for similar problems. */
4928		u32 skb_sid;
4929		struct sk_security_struct *sksec = sk->sk_security;
4930		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4931			return NF_DROP;
4932		/* At this point, if the returned skb peerlbl is SECSID_NULL
4933		 * and the packet has been through at least one XFRM
4934		 * transformation then we must be dealing with the "final"
4935		 * form of labeled IPsec packet; since we've already applied
4936		 * all of our access controls on this packet we can safely
4937		 * pass the packet. */
4938		if (skb_sid == SECSID_NULL) {
4939			switch (family) {
4940			case PF_INET:
4941				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4942					return NF_ACCEPT;
4943				break;
4944			case PF_INET6:
4945				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4946					return NF_ACCEPT;
4947			default:
4948				return NF_DROP_ERR(-ECONNREFUSED);
4949			}
4950		}
4951		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4952			return NF_DROP;
4953		secmark_perm = PACKET__SEND;
4954	} else {
4955		/* Locally generated packet, fetch the security label from the
4956		 * associated socket. */
4957		struct sk_security_struct *sksec = sk->sk_security;
4958		peer_sid = sksec->sid;
4959		secmark_perm = PACKET__SEND;
4960	}
4961
4962	ad.type = LSM_AUDIT_DATA_NET;
4963	ad.u.net = &net;
4964	ad.u.net->netif = ifindex;
4965	ad.u.net->family = family;
4966	if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4967		return NF_DROP;
4968
4969	if (secmark_active)
4970		if (avc_has_perm(peer_sid, skb->secmark,
4971				 SECCLASS_PACKET, secmark_perm, &ad))
4972			return NF_DROP_ERR(-ECONNREFUSED);
4973
4974	if (peerlbl_active) {
4975		u32 if_sid;
4976		u32 node_sid;
4977
4978		if (sel_netif_sid(ifindex, &if_sid))
4979			return NF_DROP;
4980		if (avc_has_perm(peer_sid, if_sid,
4981				 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4982			return NF_DROP_ERR(-ECONNREFUSED);
4983
4984		if (sel_netnode_sid(addrp, family, &node_sid))
4985			return NF_DROP;
4986		if (avc_has_perm(peer_sid, node_sid,
4987				 SECCLASS_NODE, NODE__SENDTO, &ad))
4988			return NF_DROP_ERR(-ECONNREFUSED);
4989	}
4990
4991	return NF_ACCEPT;
4992}
4993
4994static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4995					   struct sk_buff *skb,
4996					   const struct net_device *in,
4997					   const struct net_device *out,
4998					   int (*okfn)(struct sk_buff *))
4999{
5000	return selinux_ip_postroute(skb, out->ifindex, PF_INET);
5001}
5002
5003#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5004static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5005					   struct sk_buff *skb,
5006					   const struct net_device *in,
5007					   const struct net_device *out,
5008					   int (*okfn)(struct sk_buff *))
5009{
5010	return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
5011}
5012#endif	/* IPV6 */
5013
5014#endif	/* CONFIG_NETFILTER */
5015
5016static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5017{
5018	int err;
5019
5020	err = cap_netlink_send(sk, skb);
5021	if (err)
5022		return err;
5023
5024	return selinux_nlmsg_perm(sk, skb);
5025}
5026
5027static int ipc_alloc_security(struct task_struct *task,
5028			      struct kern_ipc_perm *perm,
5029			      u16 sclass)
5030{
5031	struct ipc_security_struct *isec;
5032	u32 sid;
5033
5034	isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5035	if (!isec)
5036		return -ENOMEM;
5037
5038	sid = task_sid(task);
5039	isec->sclass = sclass;
5040	isec->sid = sid;
5041	perm->security = isec;
5042
5043	return 0;
5044}
5045
5046static void ipc_free_security(struct kern_ipc_perm *perm)
5047{
5048	struct ipc_security_struct *isec = perm->security;
5049	perm->security = NULL;
5050	kfree(isec);
5051}
5052
5053static int msg_msg_alloc_security(struct msg_msg *msg)
5054{
5055	struct msg_security_struct *msec;
5056
5057	msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5058	if (!msec)
5059		return -ENOMEM;
5060
5061	msec->sid = SECINITSID_UNLABELED;
5062	msg->security = msec;
5063
5064	return 0;
5065}
5066
5067static void msg_msg_free_security(struct msg_msg *msg)
5068{
5069	struct msg_security_struct *msec = msg->security;
5070
5071	msg->security = NULL;
5072	kfree(msec);
5073}
5074
5075static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5076			u32 perms)
5077{
5078	struct ipc_security_struct *isec;
5079	struct common_audit_data ad;
5080	u32 sid = current_sid();
5081
5082	isec = ipc_perms->security;
5083
5084	ad.type = LSM_AUDIT_DATA_IPC;
5085	ad.u.ipc_id = ipc_perms->key;
5086
5087	return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5088}
5089
5090static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5091{
5092	return msg_msg_alloc_security(msg);
5093}
5094
5095static void selinux_msg_msg_free_security(struct msg_msg *msg)
5096{
5097	msg_msg_free_security(msg);
5098}
5099
5100/* message queue security operations */
5101static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5102{
5103	struct ipc_security_struct *isec;
5104	struct common_audit_data ad;
5105	u32 sid = current_sid();
5106	int rc;
5107
5108	rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5109	if (rc)
5110		return rc;
5111
5112	isec = msq->q_perm.security;
5113
5114	ad.type = LSM_AUDIT_DATA_IPC;
5115	ad.u.ipc_id = msq->q_perm.key;
5116
5117	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5118			  MSGQ__CREATE, &ad);
5119	if (rc) {
5120		ipc_free_security(&msq->q_perm);
5121		return rc;
5122	}
5123	return 0;
5124}
5125
5126static void selinux_msg_queue_free_security(struct msg_queue *msq)
5127{
5128	ipc_free_security(&msq->q_perm);
5129}
5130
5131static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5132{
5133	struct ipc_security_struct *isec;
5134	struct common_audit_data ad;
5135	u32 sid = current_sid();
5136
5137	isec = msq->q_perm.security;
5138
5139	ad.type = LSM_AUDIT_DATA_IPC;
5140	ad.u.ipc_id = msq->q_perm.key;
5141
5142	return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5143			    MSGQ__ASSOCIATE, &ad);
5144}
5145
5146static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5147{
5148	int err;
5149	int perms;
5150
5151	switch (cmd) {
5152	case IPC_INFO:
5153	case MSG_INFO:
5154		/* No specific object, just general system-wide information. */
5155		return task_has_system(current, SYSTEM__IPC_INFO);
5156	case IPC_STAT:
5157	case MSG_STAT:
5158		perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5159		break;
5160	case IPC_SET:
5161		perms = MSGQ__SETATTR;
5162		break;
5163	case IPC_RMID:
5164		perms = MSGQ__DESTROY;
5165		break;
5166	default:
5167		return 0;
5168	}
5169
5170	err = ipc_has_perm(&msq->q_perm, perms);
5171	return err;
5172}
5173
5174static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5175{
5176	struct ipc_security_struct *isec;
5177	struct msg_security_struct *msec;
5178	struct common_audit_data ad;
5179	u32 sid = current_sid();
5180	int rc;
5181
5182	isec = msq->q_perm.security;
5183	msec = msg->security;
5184
5185	/*
5186	 * First time through, need to assign label to the message
5187	 */
5188	if (msec->sid == SECINITSID_UNLABELED) {
5189		/*
5190		 * Compute new sid based on current process and
5191		 * message queue this message will be stored in
5192		 */
5193		rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5194					     NULL, &msec->sid);
5195		if (rc)
5196			return rc;
5197	}
5198
5199	ad.type = LSM_AUDIT_DATA_IPC;
5200	ad.u.ipc_id = msq->q_perm.key;
5201
5202	/* Can this process write to the queue? */
5203	rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5204			  MSGQ__WRITE, &ad);
5205	if (!rc)
5206		/* Can this process send the message */
5207		rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5208				  MSG__SEND, &ad);
5209	if (!rc)
5210		/* Can the message be put in the queue? */
5211		rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5212				  MSGQ__ENQUEUE, &ad);
5213
5214	return rc;
5215}
5216
5217static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5218				    struct task_struct *target,
5219				    long type, int mode)
5220{
5221	struct ipc_security_struct *isec;
5222	struct msg_security_struct *msec;
5223	struct common_audit_data ad;
5224	u32 sid = task_sid(target);
5225	int rc;
5226
5227	isec = msq->q_perm.security;
5228	msec = msg->security;
5229
5230	ad.type = LSM_AUDIT_DATA_IPC;
5231	ad.u.ipc_id = msq->q_perm.key;
5232
5233	rc = avc_has_perm(sid, isec->sid,
5234			  SECCLASS_MSGQ, MSGQ__READ, &ad);
5235	if (!rc)
5236		rc = avc_has_perm(sid, msec->sid,
5237				  SECCLASS_MSG, MSG__RECEIVE, &ad);
5238	return rc;
5239}
5240
5241/* Shared Memory security operations */
5242static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5243{
5244	struct ipc_security_struct *isec;
5245	struct common_audit_data ad;
5246	u32 sid = current_sid();
5247	int rc;
5248
5249	rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5250	if (rc)
5251		return rc;
5252
5253	isec = shp->shm_perm.security;
5254
5255	ad.type = LSM_AUDIT_DATA_IPC;
5256	ad.u.ipc_id = shp->shm_perm.key;
5257
5258	rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5259			  SHM__CREATE, &ad);
5260	if (rc) {
5261		ipc_free_security(&shp->shm_perm);
5262		return rc;
5263	}
5264	return 0;
5265}
5266
5267static void selinux_shm_free_security(struct shmid_kernel *shp)
5268{
5269	ipc_free_security(&shp->shm_perm);
5270}
5271
5272static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5273{
5274	struct ipc_security_struct *isec;
5275	struct common_audit_data ad;
5276	u32 sid = current_sid();
5277
5278	isec = shp->shm_perm.security;
5279
5280	ad.type = LSM_AUDIT_DATA_IPC;
5281	ad.u.ipc_id = shp->shm_perm.key;
5282
5283	return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5284			    SHM__ASSOCIATE, &ad);
5285}
5286
5287/* Note, at this point, shp is locked down */
5288static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5289{
5290	int perms;
5291	int err;
5292
5293	switch (cmd) {
5294	case IPC_INFO:
5295	case SHM_INFO:
5296		/* No specific object, just general system-wide information. */
5297		return task_has_system(current, SYSTEM__IPC_INFO);
5298	case IPC_STAT:
5299	case SHM_STAT:
5300		perms = SHM__GETATTR | SHM__ASSOCIATE;
5301		break;
5302	case IPC_SET:
5303		perms = SHM__SETATTR;
5304		break;
5305	case SHM_LOCK:
5306	case SHM_UNLOCK:
5307		perms = SHM__LOCK;
5308		break;
5309	case IPC_RMID:
5310		perms = SHM__DESTROY;
5311		break;
5312	default:
5313		return 0;
5314	}
5315
5316	err = ipc_has_perm(&shp->shm_perm, perms);
5317	return err;
5318}
5319
5320static int selinux_shm_shmat(struct shmid_kernel *shp,
5321			     char __user *shmaddr, int shmflg)
5322{
5323	u32 perms;
5324
5325	if (shmflg & SHM_RDONLY)
5326		perms = SHM__READ;
5327	else
5328		perms = SHM__READ | SHM__WRITE;
5329
5330	return ipc_has_perm(&shp->shm_perm, perms);
5331}
5332
5333/* Semaphore security operations */
5334static int selinux_sem_alloc_security(struct sem_array *sma)
5335{
5336	struct ipc_security_struct *isec;
5337	struct common_audit_data ad;
5338	u32 sid = current_sid();
5339	int rc;
5340
5341	rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5342	if (rc)
5343		return rc;
5344
5345	isec = sma->sem_perm.security;
5346
5347	ad.type = LSM_AUDIT_DATA_IPC;
5348	ad.u.ipc_id = sma->sem_perm.key;
5349
5350	rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5351			  SEM__CREATE, &ad);
5352	if (rc) {
5353		ipc_free_security(&sma->sem_perm);
5354		return rc;
5355	}
5356	return 0;
5357}
5358
5359static void selinux_sem_free_security(struct sem_array *sma)
5360{
5361	ipc_free_security(&sma->sem_perm);
5362}
5363
5364static int selinux_sem_associate(struct sem_array *sma, int semflg)
5365{
5366	struct ipc_security_struct *isec;
5367	struct common_audit_data ad;
5368	u32 sid = current_sid();
5369
5370	isec = sma->sem_perm.security;
5371
5372	ad.type = LSM_AUDIT_DATA_IPC;
5373	ad.u.ipc_id = sma->sem_perm.key;
5374
5375	return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5376			    SEM__ASSOCIATE, &ad);
5377}
5378
5379/* Note, at this point, sma is locked down */
5380static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5381{
5382	int err;
5383	u32 perms;
5384
5385	switch (cmd) {
5386	case IPC_INFO:
5387	case SEM_INFO:
5388		/* No specific object, just general system-wide information. */
5389		return task_has_system(current, SYSTEM__IPC_INFO);
5390	case GETPID:
5391	case GETNCNT:
5392	case GETZCNT:
5393		perms = SEM__GETATTR;
5394		break;
5395	case GETVAL:
5396	case GETALL:
5397		perms = SEM__READ;
5398		break;
5399	case SETVAL:
5400	case SETALL:
5401		perms = SEM__WRITE;
5402		break;
5403	case IPC_RMID:
5404		perms = SEM__DESTROY;
5405		break;
5406	case IPC_SET:
5407		perms = SEM__SETATTR;
5408		break;
5409	case IPC_STAT:
5410	case SEM_STAT:
5411		perms = SEM__GETATTR | SEM__ASSOCIATE;
5412		break;
5413	default:
5414		return 0;
5415	}
5416
5417	err = ipc_has_perm(&sma->sem_perm, perms);
5418	return err;
5419}
5420
5421static int selinux_sem_semop(struct sem_array *sma,
5422			     struct sembuf *sops, unsigned nsops, int alter)
5423{
5424	u32 perms;
5425
5426	if (alter)
5427		perms = SEM__READ | SEM__WRITE;
5428	else
5429		perms = SEM__READ;
5430
5431	return ipc_has_perm(&sma->sem_perm, perms);
5432}
5433
5434static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5435{
5436	u32 av = 0;
5437
5438	av = 0;
5439	if (flag & S_IRUGO)
5440		av |= IPC__UNIX_READ;
5441	if (flag & S_IWUGO)
5442		av |= IPC__UNIX_WRITE;
5443
5444	if (av == 0)
5445		return 0;
5446
5447	return ipc_has_perm(ipcp, av);
5448}
5449
5450static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5451{
5452	struct ipc_security_struct *isec = ipcp->security;
5453	*secid = isec->sid;
5454}
5455
5456static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5457{
5458	if (inode)
5459		inode_doinit_with_dentry(inode, dentry);
5460}
5461
5462static int selinux_getprocattr(struct task_struct *p,
5463			       char *name, char **value)
5464{
5465	const struct task_security_struct *__tsec;
5466	u32 sid;
5467	int error;
5468	unsigned len;
5469
5470	if (current != p) {
5471		error = current_has_perm(p, PROCESS__GETATTR);
5472		if (error)
5473			return error;
5474	}
5475
5476	rcu_read_lock();
5477	__tsec = __task_cred(p)->security;
5478
5479	if (!strcmp(name, "current"))
5480		sid = __tsec->sid;
5481	else if (!strcmp(name, "prev"))
5482		sid = __tsec->osid;
5483	else if (!strcmp(name, "exec"))
5484		sid = __tsec->exec_sid;
5485	else if (!strcmp(name, "fscreate"))
5486		sid = __tsec->create_sid;
5487	else if (!strcmp(name, "keycreate"))
5488		sid = __tsec->keycreate_sid;
5489	else if (!strcmp(name, "sockcreate"))
5490		sid = __tsec->sockcreate_sid;
5491	else
5492		goto invalid;
5493	rcu_read_unlock();
5494
5495	if (!sid)
5496		return 0;
5497
5498	error = security_sid_to_context(sid, value, &len);
5499	if (error)
5500		return error;
5501	return len;
5502
5503invalid:
5504	rcu_read_unlock();
5505	return -EINVAL;
5506}
5507
5508static int selinux_setprocattr(struct task_struct *p,
5509			       char *name, void *value, size_t size)
5510{
5511	struct task_security_struct *tsec;
5512	struct task_struct *tracer;
5513	struct cred *new;
5514	u32 sid = 0, ptsid;
5515	int error;
5516	char *str = value;
5517
5518	if (current != p) {
5519		/* SELinux only allows a process to change its own
5520		   security attributes. */
5521		return -EACCES;
5522	}
5523
5524	/*
5525	 * Basic control over ability to set these attributes at all.
5526	 * current == p, but we'll pass them separately in case the
5527	 * above restriction is ever removed.
5528	 */
5529	if (!strcmp(name, "exec"))
5530		error = current_has_perm(p, PROCESS__SETEXEC);
5531	else if (!strcmp(name, "fscreate"))
5532		error = current_has_perm(p, PROCESS__SETFSCREATE);
5533	else if (!strcmp(name, "keycreate"))
5534		error = current_has_perm(p, PROCESS__SETKEYCREATE);
5535	else if (!strcmp(name, "sockcreate"))
5536		error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5537	else if (!strcmp(name, "current"))
5538		error = current_has_perm(p, PROCESS__SETCURRENT);
5539	else
5540		error = -EINVAL;
5541	if (error)
5542		return error;
5543
5544	/* Obtain a SID for the context, if one was specified. */
5545	if (size && str[1] && str[1] != '\n') {
5546		if (str[size-1] == '\n') {
5547			str[size-1] = 0;
5548			size--;
5549		}
5550		error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5551		if (error == -EINVAL && !strcmp(name, "fscreate")) {
5552			if (!capable(CAP_MAC_ADMIN)) {
5553				struct audit_buffer *ab;
5554				size_t audit_size;
5555
5556				/* We strip a nul only if it is at the end, otherwise the
5557				 * context contains a nul and we should audit that */
5558				if (str[size - 1] == '\0')
5559					audit_size = size - 1;
5560				else
5561					audit_size = size;
5562				ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5563				audit_log_format(ab, "op=fscreate invalid_context=");
5564				audit_log_n_untrustedstring(ab, value, audit_size);
5565				audit_log_end(ab);
5566
5567				return error;
5568			}
5569			error = security_context_to_sid_force(value, size,
5570							      &sid);
5571		}
5572		if (error)
5573			return error;
5574	}
5575
5576	new = prepare_creds();
5577	if (!new)
5578		return -ENOMEM;
5579
5580	/* Permission checking based on the specified context is
5581	   performed during the actual operation (execve,
5582	   open/mkdir/...), when we know the full context of the
5583	   operation.  See selinux_bprm_set_creds for the execve
5584	   checks and may_create for the file creation checks. The
5585	   operation will then fail if the context is not permitted. */
5586	tsec = new->security;
5587	if (!strcmp(name, "exec")) {
5588		tsec->exec_sid = sid;
5589	} else if (!strcmp(name, "fscreate")) {
5590		tsec->create_sid = sid;
5591	} else if (!strcmp(name, "keycreate")) {
5592		error = may_create_key(sid, p);
5593		if (error)
5594			goto abort_change;
5595		tsec->keycreate_sid = sid;
5596	} else if (!strcmp(name, "sockcreate")) {
5597		tsec->sockcreate_sid = sid;
5598	} else if (!strcmp(name, "current")) {
5599		error = -EINVAL;
5600		if (sid == 0)
5601			goto abort_change;
5602
5603		/* Only allow single threaded processes to change context */
5604		error = -EPERM;
5605		if (!current_is_single_threaded()) {
5606			error = security_bounded_transition(tsec->sid, sid);
5607			if (error)
5608				goto abort_change;
5609		}
5610
5611		/* Check permissions for the transition. */
5612		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5613				     PROCESS__DYNTRANSITION, NULL);
5614		if (error)
5615			goto abort_change;
5616
5617		/* Check for ptracing, and update the task SID if ok.
5618		   Otherwise, leave SID unchanged and fail. */
5619		ptsid = 0;
5620		rcu_read_lock();
5621		tracer = ptrace_parent(p);
5622		if (tracer)
5623			ptsid = task_sid(tracer);
5624		rcu_read_unlock();
5625
5626		if (tracer) {
5627			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5628					     PROCESS__PTRACE, NULL);
5629			if (error)
5630				goto abort_change;
5631		}
5632
5633		tsec->sid = sid;
5634	} else {
5635		error = -EINVAL;
5636		goto abort_change;
5637	}
5638
5639	commit_creds(new);
5640	return size;
5641
5642abort_change:
5643	abort_creds(new);
5644	return error;
5645}
5646
5647static int selinux_ismaclabel(const char *name)
5648{
5649	return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5650}
5651
5652static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5653{
5654	return security_sid_to_context(secid, secdata, seclen);
5655}
5656
5657static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5658{
5659	return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5660}
5661
5662static void selinux_release_secctx(char *secdata, u32 seclen)
5663{
5664	kfree(secdata);
5665}
5666
5667/*
5668 *	called with inode->i_mutex locked
5669 */
5670static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5671{
5672	return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5673}
5674
5675/*
5676 *	called with inode->i_mutex locked
5677 */
5678static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5679{
5680	return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5681}
5682
5683static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5684{
5685	int len = 0;
5686	len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5687						ctx, true);
5688	if (len < 0)
5689		return len;
5690	*ctxlen = len;
5691	return 0;
5692}
5693#ifdef CONFIG_KEYS
5694
5695static int selinux_key_alloc(struct key *k, const struct cred *cred,
5696			     unsigned long flags)
5697{
5698	const struct task_security_struct *tsec;
5699	struct key_security_struct *ksec;
5700
5701	ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5702	if (!ksec)
5703		return -ENOMEM;
5704
5705	tsec = cred->security;
5706	if (tsec->keycreate_sid)
5707		ksec->sid = tsec->keycreate_sid;
5708	else
5709		ksec->sid = tsec->sid;
5710
5711	k->security = ksec;
5712	return 0;
5713}
5714
5715static void selinux_key_free(struct key *k)
5716{
5717	struct key_security_struct *ksec = k->security;
5718
5719	k->security = NULL;
5720	kfree(ksec);
5721}
5722
5723static int selinux_key_permission(key_ref_t key_ref,
5724				  const struct cred *cred,
5725				  key_perm_t perm)
5726{
5727	struct key *key;
5728	struct key_security_struct *ksec;
5729	u32 sid;
5730
5731	/* if no specific permissions are requested, we skip the
5732	   permission check. No serious, additional covert channels
5733	   appear to be created. */
5734	if (perm == 0)
5735		return 0;
5736
5737	sid = cred_sid(cred);
5738
5739	key = key_ref_to_ptr(key_ref);
5740	ksec = key->security;
5741
5742	return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5743}
5744
5745static int selinux_key_getsecurity(struct key *key, char **_buffer)
5746{
5747	struct key_security_struct *ksec = key->security;
5748	char *context = NULL;
5749	unsigned len;
5750	int rc;
5751
5752	rc = security_sid_to_context(ksec->sid, &context, &len);
5753	if (!rc)
5754		rc = len;
5755	*_buffer = context;
5756	return rc;
5757}
5758
5759#endif
5760
5761static struct security_operations selinux_ops = {
5762	.name =				"selinux",
5763
5764	.ptrace_access_check =		selinux_ptrace_access_check,
5765	.ptrace_traceme =		selinux_ptrace_traceme,
5766	.capget =			selinux_capget,
5767	.capset =			selinux_capset,
5768	.capable =			selinux_capable,
5769	.quotactl =			selinux_quotactl,
5770	.quota_on =			selinux_quota_on,
5771	.syslog =			selinux_syslog,
5772	.vm_enough_memory =		selinux_vm_enough_memory,
5773
5774	.netlink_send =			selinux_netlink_send,
5775
5776	.bprm_set_creds =		selinux_bprm_set_creds,
5777	.bprm_committing_creds =	selinux_bprm_committing_creds,
5778	.bprm_committed_creds =		selinux_bprm_committed_creds,
5779	.bprm_secureexec =		selinux_bprm_secureexec,
5780
5781	.sb_alloc_security =		selinux_sb_alloc_security,
5782	.sb_free_security =		selinux_sb_free_security,
5783	.sb_copy_data =			selinux_sb_copy_data,
5784	.sb_remount =			selinux_sb_remount,
5785	.sb_kern_mount =		selinux_sb_kern_mount,
5786	.sb_show_options =		selinux_sb_show_options,
5787	.sb_statfs =			selinux_sb_statfs,
5788	.sb_mount =			selinux_mount,
5789	.sb_umount =			selinux_umount,
5790	.sb_set_mnt_opts =		selinux_set_mnt_opts,
5791	.sb_clone_mnt_opts =		selinux_sb_clone_mnt_opts,
5792	.sb_parse_opts_str = 		selinux_parse_opts_str,
5793
5794	.dentry_init_security =		selinux_dentry_init_security,
5795
5796	.inode_alloc_security =		selinux_inode_alloc_security,
5797	.inode_free_security =		selinux_inode_free_security,
5798	.inode_init_security =		selinux_inode_init_security,
5799	.inode_create =			selinux_inode_create,
5800	.inode_link =			selinux_inode_link,
5801	.inode_unlink =			selinux_inode_unlink,
5802	.inode_symlink =		selinux_inode_symlink,
5803	.inode_mkdir =			selinux_inode_mkdir,
5804	.inode_rmdir =			selinux_inode_rmdir,
5805	.inode_mknod =			selinux_inode_mknod,
5806	.inode_rename =			selinux_inode_rename,
5807	.inode_readlink =		selinux_inode_readlink,
5808	.inode_follow_link =		selinux_inode_follow_link,
5809	.inode_permission =		selinux_inode_permission,
5810	.inode_setattr =		selinux_inode_setattr,
5811	.inode_getattr =		selinux_inode_getattr,
5812	.inode_setxattr =		selinux_inode_setxattr,
5813	.inode_post_setxattr =		selinux_inode_post_setxattr,
5814	.inode_getxattr =		selinux_inode_getxattr,
5815	.inode_listxattr =		selinux_inode_listxattr,
5816	.inode_removexattr =		selinux_inode_removexattr,
5817	.inode_getsecurity =		selinux_inode_getsecurity,
5818	.inode_setsecurity =		selinux_inode_setsecurity,
5819	.inode_listsecurity =		selinux_inode_listsecurity,
5820	.inode_getsecid =		selinux_inode_getsecid,
5821
5822	.file_permission =		selinux_file_permission,
5823	.file_alloc_security =		selinux_file_alloc_security,
5824	.file_free_security =		selinux_file_free_security,
5825	.file_ioctl =			selinux_file_ioctl,
5826	.mmap_file =			selinux_mmap_file,
5827	.mmap_addr =			selinux_mmap_addr,
5828	.file_mprotect =		selinux_file_mprotect,
5829	.file_lock =			selinux_file_lock,
5830	.file_fcntl =			selinux_file_fcntl,
5831	.file_set_fowner =		selinux_file_set_fowner,
5832	.file_send_sigiotask =		selinux_file_send_sigiotask,
5833	.file_receive =			selinux_file_receive,
5834
5835	.file_open =			selinux_file_open,
5836
5837	.task_create =			selinux_task_create,
5838	.cred_alloc_blank =		selinux_cred_alloc_blank,
5839	.cred_free =			selinux_cred_free,
5840	.cred_prepare =			selinux_cred_prepare,
5841	.cred_transfer =		selinux_cred_transfer,
5842	.kernel_act_as =		selinux_kernel_act_as,
5843	.kernel_create_files_as =	selinux_kernel_create_files_as,
5844	.kernel_module_request =	selinux_kernel_module_request,
5845	.task_setpgid =			selinux_task_setpgid,
5846	.task_getpgid =			selinux_task_getpgid,
5847	.task_getsid =			selinux_task_getsid,
5848	.task_getsecid =		selinux_task_getsecid,
5849	.task_setnice =			selinux_task_setnice,
5850	.task_setioprio =		selinux_task_setioprio,
5851	.task_getioprio =		selinux_task_getioprio,
5852	.task_setrlimit =		selinux_task_setrlimit,
5853	.task_setscheduler =		selinux_task_setscheduler,
5854	.task_getscheduler =		selinux_task_getscheduler,
5855	.task_movememory =		selinux_task_movememory,
5856	.task_kill =			selinux_task_kill,
5857	.task_wait =			selinux_task_wait,
5858	.task_to_inode =		selinux_task_to_inode,
5859
5860	.ipc_permission =		selinux_ipc_permission,
5861	.ipc_getsecid =			selinux_ipc_getsecid,
5862
5863	.msg_msg_alloc_security =	selinux_msg_msg_alloc_security,
5864	.msg_msg_free_security =	selinux_msg_msg_free_security,
5865
5866	.msg_queue_alloc_security =	selinux_msg_queue_alloc_security,
5867	.msg_queue_free_security =	selinux_msg_queue_free_security,
5868	.msg_queue_associate =		selinux_msg_queue_associate,
5869	.msg_queue_msgctl =		selinux_msg_queue_msgctl,
5870	.msg_queue_msgsnd =		selinux_msg_queue_msgsnd,
5871	.msg_queue_msgrcv =		selinux_msg_queue_msgrcv,
5872
5873	.shm_alloc_security =		selinux_shm_alloc_security,
5874	.shm_free_security =		selinux_shm_free_security,
5875	.shm_associate =		selinux_shm_associate,
5876	.shm_shmctl =			selinux_shm_shmctl,
5877	.shm_shmat =			selinux_shm_shmat,
5878
5879	.sem_alloc_security =		selinux_sem_alloc_security,
5880	.sem_free_security =		selinux_sem_free_security,
5881	.sem_associate =		selinux_sem_associate,
5882	.sem_semctl =			selinux_sem_semctl,
5883	.sem_semop =			selinux_sem_semop,
5884
5885	.d_instantiate =		selinux_d_instantiate,
5886
5887	.getprocattr =			selinux_getprocattr,
5888	.setprocattr =			selinux_setprocattr,
5889
5890	.ismaclabel =			selinux_ismaclabel,
5891	.secid_to_secctx =		selinux_secid_to_secctx,
5892	.secctx_to_secid =		selinux_secctx_to_secid,
5893	.release_secctx =		selinux_release_secctx,
5894	.inode_notifysecctx =		selinux_inode_notifysecctx,
5895	.inode_setsecctx =		selinux_inode_setsecctx,
5896	.inode_getsecctx =		selinux_inode_getsecctx,
5897
5898	.unix_stream_connect =		selinux_socket_unix_stream_connect,
5899	.unix_may_send =		selinux_socket_unix_may_send,
5900
5901	.socket_create =		selinux_socket_create,
5902	.socket_post_create =		selinux_socket_post_create,
5903	.socket_bind =			selinux_socket_bind,
5904	.socket_connect =		selinux_socket_connect,
5905	.socket_listen =		selinux_socket_listen,
5906	.socket_accept =		selinux_socket_accept,
5907	.socket_sendmsg =		selinux_socket_sendmsg,
5908	.socket_recvmsg =		selinux_socket_recvmsg,
5909	.socket_getsockname =		selinux_socket_getsockname,
5910	.socket_getpeername =		selinux_socket_getpeername,
5911	.socket_getsockopt =		selinux_socket_getsockopt,
5912	.socket_setsockopt =		selinux_socket_setsockopt,
5913	.socket_shutdown =		selinux_socket_shutdown,
5914	.socket_sock_rcv_skb =		selinux_socket_sock_rcv_skb,
5915	.socket_getpeersec_stream =	selinux_socket_getpeersec_stream,
5916	.socket_getpeersec_dgram =	selinux_socket_getpeersec_dgram,
5917	.sk_alloc_security =		selinux_sk_alloc_security,
5918	.sk_free_security =		selinux_sk_free_security,
5919	.sk_clone_security =		selinux_sk_clone_security,
5920	.sk_getsecid =			selinux_sk_getsecid,
5921	.sock_graft =			selinux_sock_graft,
5922	.inet_conn_request =		selinux_inet_conn_request,
5923	.inet_csk_clone =		selinux_inet_csk_clone,
5924	.inet_conn_established =	selinux_inet_conn_established,
5925	.secmark_relabel_packet =	selinux_secmark_relabel_packet,
5926	.secmark_refcount_inc =		selinux_secmark_refcount_inc,
5927	.secmark_refcount_dec =		selinux_secmark_refcount_dec,
5928	.req_classify_flow =		selinux_req_classify_flow,
5929	.tun_dev_alloc_security =	selinux_tun_dev_alloc_security,
5930	.tun_dev_free_security =	selinux_tun_dev_free_security,
5931	.tun_dev_create =		selinux_tun_dev_create,
5932	.tun_dev_attach_queue =		selinux_tun_dev_attach_queue,
5933	.tun_dev_attach =		selinux_tun_dev_attach,
5934	.tun_dev_open =			selinux_tun_dev_open,
5935	.skb_owned_by =			selinux_skb_owned_by,
5936
5937#ifdef CONFIG_SECURITY_NETWORK_XFRM
5938	.xfrm_policy_alloc_security =	selinux_xfrm_policy_alloc,
5939	.xfrm_policy_clone_security =	selinux_xfrm_policy_clone,
5940	.xfrm_policy_free_security =	selinux_xfrm_policy_free,
5941	.xfrm_policy_delete_security =	selinux_xfrm_policy_delete,
5942	.xfrm_state_alloc =		selinux_xfrm_state_alloc,
5943	.xfrm_state_alloc_acquire =	selinux_xfrm_state_alloc_acquire,
5944	.xfrm_state_free_security =	selinux_xfrm_state_free,
5945	.xfrm_state_delete_security =	selinux_xfrm_state_delete,
5946	.xfrm_policy_lookup =		selinux_xfrm_policy_lookup,
5947	.xfrm_state_pol_flow_match =	selinux_xfrm_state_pol_flow_match,
5948	.xfrm_decode_session =		selinux_xfrm_decode_session,
5949#endif
5950
5951#ifdef CONFIG_KEYS
5952	.key_alloc =			selinux_key_alloc,
5953	.key_free =			selinux_key_free,
5954	.key_permission =		selinux_key_permission,
5955	.key_getsecurity =		selinux_key_getsecurity,
5956#endif
5957
5958#ifdef CONFIG_AUDIT
5959	.audit_rule_init =		selinux_audit_rule_init,
5960	.audit_rule_known =		selinux_audit_rule_known,
5961	.audit_rule_match =		selinux_audit_rule_match,
5962	.audit_rule_free =		selinux_audit_rule_free,
5963#endif
5964};
5965
5966static __init int selinux_init(void)
5967{
5968	if (!security_module_enable(&selinux_ops)) {
5969		selinux_enabled = 0;
5970		return 0;
5971	}
5972
5973	if (!selinux_enabled) {
5974		printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5975		return 0;
5976	}
5977
5978	printk(KERN_INFO "SELinux:  Initializing.\n");
5979
5980	/* Set the security state for the initial task. */
5981	cred_init_security();
5982
5983	default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5984
5985	sel_inode_cache = kmem_cache_create("selinux_inode_security",
5986					    sizeof(struct inode_security_struct),
5987					    0, SLAB_PANIC, NULL);
5988	avc_init();
5989
5990	if (register_security(&selinux_ops))
5991		panic("SELinux: Unable to register with kernel.\n");
5992
5993	if (selinux_enforcing)
5994		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5995	else
5996		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5997
5998	return 0;
5999}
6000
6001static void delayed_superblock_init(struct super_block *sb, void *unused)
6002{
6003	superblock_doinit(sb, NULL);
6004}
6005
6006void selinux_complete_init(void)
6007{
6008	printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6009
6010	/* Set up any superblocks initialized prior to the policy load. */
6011	printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6012	iterate_supers(delayed_superblock_init, NULL);
6013}
6014
6015/* SELinux requires early initialization in order to label
6016   all processes and objects when they are created. */
6017security_initcall(selinux_init);
6018
6019#if defined(CONFIG_NETFILTER)
6020
6021static struct nf_hook_ops selinux_ipv4_ops[] = {
6022	{
6023		.hook =		selinux_ipv4_postroute,
6024		.owner =	THIS_MODULE,
6025		.pf =		NFPROTO_IPV4,
6026		.hooknum =	NF_INET_POST_ROUTING,
6027		.priority =	NF_IP_PRI_SELINUX_LAST,
6028	},
6029	{
6030		.hook =		selinux_ipv4_forward,
6031		.owner =	THIS_MODULE,
6032		.pf =		NFPROTO_IPV4,
6033		.hooknum =	NF_INET_FORWARD,
6034		.priority =	NF_IP_PRI_SELINUX_FIRST,
6035	},
6036	{
6037		.hook =		selinux_ipv4_output,
6038		.owner =	THIS_MODULE,
6039		.pf =		NFPROTO_IPV4,
6040		.hooknum =	NF_INET_LOCAL_OUT,
6041		.priority =	NF_IP_PRI_SELINUX_FIRST,
6042	}
6043};
6044
6045#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6046
6047static struct nf_hook_ops selinux_ipv6_ops[] = {
6048	{
6049		.hook =		selinux_ipv6_postroute,
6050		.owner =	THIS_MODULE,
6051		.pf =		NFPROTO_IPV6,
6052		.hooknum =	NF_INET_POST_ROUTING,
6053		.priority =	NF_IP6_PRI_SELINUX_LAST,
6054	},
6055	{
6056		.hook =		selinux_ipv6_forward,
6057		.owner =	THIS_MODULE,
6058		.pf =		NFPROTO_IPV6,
6059		.hooknum =	NF_INET_FORWARD,
6060		.priority =	NF_IP6_PRI_SELINUX_FIRST,
6061	}
6062};
6063
6064#endif	/* IPV6 */
6065
6066static int __init selinux_nf_ip_init(void)
6067{
6068	int err = 0;
6069
6070	if (!selinux_enabled)
6071		goto out;
6072
6073	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6074
6075	err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6076	if (err)
6077		panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6078
6079#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6080	err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6081	if (err)
6082		panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6083#endif	/* IPV6 */
6084
6085out:
6086	return err;
6087}
6088
6089__initcall(selinux_nf_ip_init);
6090
6091#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6092static void selinux_nf_ip_exit(void)
6093{
6094	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6095
6096	nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6097#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6098	nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6099#endif	/* IPV6 */
6100}
6101#endif
6102
6103#else /* CONFIG_NETFILTER */
6104
6105#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6106#define selinux_nf_ip_exit()
6107#endif
6108
6109#endif /* CONFIG_NETFILTER */
6110
6111#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6112static int selinux_disabled;
6113
6114int selinux_disable(void)
6115{
6116	if (ss_initialized) {
6117		/* Not permitted after initial policy load. */
6118		return -EINVAL;
6119	}
6120
6121	if (selinux_disabled) {
6122		/* Only do this once. */
6123		return -EINVAL;
6124	}
6125
6126	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6127
6128	selinux_disabled = 1;
6129	selinux_enabled = 0;
6130
6131	reset_security_ops();
6132
6133	/* Try to destroy the avc node cache */
6134	avc_disable();
6135
6136	/* Unregister netfilter hooks. */
6137	selinux_nf_ip_exit();
6138
6139	/* Unregister selinuxfs. */
6140	exit_sel_fs();
6141
6142	return 0;
6143}
6144#endif