1/* Updated: Karl MacMillan <kmacmillan@tresys.com>
   2 *
   3 *	Added conditional policy language extensions
   4 *
   5 *  Updated: Hewlett-Packard <paul@paul-moore.com>
   6 *
   7 *	Added support for the policy capability bitmap
   8 *
   9 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
  10 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  11 * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
  12 *	This program is free software; you can redistribute it and/or modify
  13 *	it under the terms of the GNU General Public License as published by
  14 *	the Free Software Foundation, version 2.
  15 */
  16
  17#include <linux/kernel.h>
  18#include <linux/pagemap.h>
  19#include <linux/slab.h>
  20#include <linux/vmalloc.h>
  21#include <linux/fs.h>
  22#include <linux/mount.h>
  23#include <linux/mutex.h>
  24#include <linux/init.h>
  25#include <linux/string.h>
  26#include <linux/security.h>
  27#include <linux/major.h>
  28#include <linux/seq_file.h>
  29#include <linux/percpu.h>
  30#include <linux/audit.h>
  31#include <linux/uaccess.h>
  32#include <linux/kobject.h>
  33#include <linux/ctype.h>
  34
  35/* selinuxfs pseudo filesystem for exporting the security policy API.
  36   Based on the proc code and the fs/nfsd/nfsctl.c code. */
  37
  38#include "flask.h"
  39#include "avc.h"
  40#include "avc_ss.h"
  41#include "security.h"
  42#include "objsec.h"
  43#include "conditional.h"
  44
  45enum sel_inos {
  46	SEL_ROOT_INO = 2,
  47	SEL_LOAD,	/* load policy */
  48	SEL_ENFORCE,	/* get or set enforcing status */
  49	SEL_CONTEXT,	/* validate context */
  50	SEL_ACCESS,	/* compute access decision */
  51	SEL_CREATE,	/* compute create labeling decision */
  52	SEL_RELABEL,	/* compute relabeling decision */
  53	SEL_USER,	/* compute reachable user contexts */
  54	SEL_POLICYVERS,	/* return policy version for this kernel */
  55	SEL_COMMIT_BOOLS, /* commit new boolean values */
  56	SEL_MLS,	/* return if MLS policy is enabled */
  57	SEL_DISABLE,	/* disable SELinux until next reboot */
  58	SEL_MEMBER,	/* compute polyinstantiation membership decision */
  59	SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */
  60	SEL_COMPAT_NET,	/* whether to use old compat network packet controls */
  61	SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */
  62	SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */
  63	SEL_STATUS,	/* export current status using mmap() */
  64	SEL_POLICY,	/* allow userspace to read the in kernel policy */
  65	SEL_VALIDATE_TRANS, /* compute validatetrans decision */
  66	SEL_INO_NEXT,	/* The next inode number to use */
  67};
  68
  69struct selinux_fs_info {
  70	struct dentry *bool_dir;
  71	unsigned int bool_num;
  72	char **bool_pending_names;
  73	unsigned int *bool_pending_values;
  74	struct dentry *class_dir;
  75	unsigned long last_class_ino;
  76	bool policy_opened;
  77	struct dentry *policycap_dir;
  78	struct mutex mutex;
  79	unsigned long last_ino;
  80	struct selinux_state *state;
  81	struct super_block *sb;
  82};
  83
  84static int selinux_fs_info_create(struct super_block *sb)
  85{
  86	struct selinux_fs_info *fsi;
  87
  88	fsi = kzalloc(sizeof(*fsi), GFP_KERNEL);
  89	if (!fsi)
  90		return -ENOMEM;
  91
  92	mutex_init(&fsi->mutex);
  93	fsi->last_ino = SEL_INO_NEXT - 1;
  94	fsi->state = &selinux_state;
  95	fsi->sb = sb;
  96	sb->s_fs_info = fsi;
  97	return 0;
  98}
  99
 100static void selinux_fs_info_free(struct super_block *sb)
 101{
 102	struct selinux_fs_info *fsi = sb->s_fs_info;
 103	int i;
 104
 105	if (fsi) {
 106		for (i = 0; i < fsi->bool_num; i++)
 107			kfree(fsi->bool_pending_names[i]);
 108		kfree(fsi->bool_pending_names);
 109		kfree(fsi->bool_pending_values);
 110	}
 111	kfree(sb->s_fs_info);
 112	sb->s_fs_info = NULL;
 113}
 114
 115#define SEL_INITCON_INO_OFFSET		0x01000000
 116#define SEL_BOOL_INO_OFFSET		0x02000000
 117#define SEL_CLASS_INO_OFFSET		0x04000000
 118#define SEL_POLICYCAP_INO_OFFSET	0x08000000
 119#define SEL_INO_MASK			0x00ffffff
 120
 121#define TMPBUFLEN	12
 122static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
 123				size_t count, loff_t *ppos)
 124{
 125	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 126	char tmpbuf[TMPBUFLEN];
 127	ssize_t length;
 128
 129	length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
 130			   enforcing_enabled(fsi->state));
 131	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 132}
 133
 134#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 135static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
 136				 size_t count, loff_t *ppos)
 137
 138{
 139	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 140	struct selinux_state *state = fsi->state;
 141	char *page = NULL;
 142	ssize_t length;
 143	int old_value, new_value;
 144
 145	if (count >= PAGE_SIZE)
 146		return -ENOMEM;
 147
 148	/* No partial writes. */
 149	if (*ppos != 0)
 150		return -EINVAL;
 151
 152	page = memdup_user_nul(buf, count);
 153	if (IS_ERR(page))
 154		return PTR_ERR(page);
 155
 156	length = -EINVAL;
 157	if (sscanf(page, "%d", &new_value) != 1)
 158		goto out;
 159
 160	new_value = !!new_value;
 161
 162	old_value = enforcing_enabled(state);
 163	if (new_value != old_value) {
 164		length = avc_has_perm(&selinux_state,
 165				      current_sid(), SECINITSID_SECURITY,
 166				      SECCLASS_SECURITY, SECURITY__SETENFORCE,
 167				      NULL);
 168		if (length)
 169			goto out;
 170		audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
 171			"enforcing=%d old_enforcing=%d auid=%u ses=%u",
 172			new_value, old_value,
 173			from_kuid(&init_user_ns, audit_get_loginuid(current)),
 174			audit_get_sessionid(current));
 175		enforcing_set(state, new_value);
 176		if (new_value)
 177			avc_ss_reset(state->avc, 0);
 178		selnl_notify_setenforce(new_value);
 179		selinux_status_update_setenforce(state, new_value);
 180		if (!new_value)
 181			call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 182	}
 183	length = count;
 184out:
 185	kfree(page);
 186	return length;
 187}
 188#else
 189#define sel_write_enforce NULL
 190#endif
 191
 192static const struct file_operations sel_enforce_ops = {
 193	.read		= sel_read_enforce,
 194	.write		= sel_write_enforce,
 195	.llseek		= generic_file_llseek,
 196};
 197
 198static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
 199					size_t count, loff_t *ppos)
 200{
 201	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 202	struct selinux_state *state = fsi->state;
 203	char tmpbuf[TMPBUFLEN];
 204	ssize_t length;
 205	ino_t ino = file_inode(filp)->i_ino;
 206	int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
 207		security_get_reject_unknown(state) :
 208		!security_get_allow_unknown(state);
 209
 210	length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
 211	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 212}
 213
 214static const struct file_operations sel_handle_unknown_ops = {
 215	.read		= sel_read_handle_unknown,
 216	.llseek		= generic_file_llseek,
 217};
 218
 219static int sel_open_handle_status(struct inode *inode, struct file *filp)
 220{
 221	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 222	struct page    *status = selinux_kernel_status_page(fsi->state);
 223
 224	if (!status)
 225		return -ENOMEM;
 226
 227	filp->private_data = status;
 228
 229	return 0;
 230}
 231
 232static ssize_t sel_read_handle_status(struct file *filp, char __user *buf,
 233				      size_t count, loff_t *ppos)
 234{
 235	struct page    *status = filp->private_data;
 236
 237	BUG_ON(!status);
 238
 239	return simple_read_from_buffer(buf, count, ppos,
 240				       page_address(status),
 241				       sizeof(struct selinux_kernel_status));
 242}
 243
 244static int sel_mmap_handle_status(struct file *filp,
 245				  struct vm_area_struct *vma)
 246{
 247	struct page    *status = filp->private_data;
 248	unsigned long	size = vma->vm_end - vma->vm_start;
 249
 250	BUG_ON(!status);
 251
 252	/* only allows one page from the head */
 253	if (vma->vm_pgoff > 0 || size != PAGE_SIZE)
 254		return -EIO;
 255	/* disallow writable mapping */
 256	if (vma->vm_flags & VM_WRITE)
 257		return -EPERM;
 258	/* disallow mprotect() turns it into writable */
 259	vma->vm_flags &= ~VM_MAYWRITE;
 260
 261	return remap_pfn_range(vma, vma->vm_start,
 262			       page_to_pfn(status),
 263			       size, vma->vm_page_prot);
 264}
 265
 266static const struct file_operations sel_handle_status_ops = {
 267	.open		= sel_open_handle_status,
 268	.read		= sel_read_handle_status,
 269	.mmap		= sel_mmap_handle_status,
 270	.llseek		= generic_file_llseek,
 271};
 272
 273#ifdef CONFIG_SECURITY_SELINUX_DISABLE
 274static ssize_t sel_write_disable(struct file *file, const char __user *buf,
 275				 size_t count, loff_t *ppos)
 276
 277{
 278	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 279	char *page;
 280	ssize_t length;
 281	int new_value;
 282
 283	if (count >= PAGE_SIZE)
 284		return -ENOMEM;
 285
 286	/* No partial writes. */
 287	if (*ppos != 0)
 288		return -EINVAL;
 289
 290	page = memdup_user_nul(buf, count);
 291	if (IS_ERR(page))
 292		return PTR_ERR(page);
 293
 294	length = -EINVAL;
 295	if (sscanf(page, "%d", &new_value) != 1)
 296		goto out;
 297
 298	if (new_value) {
 299		length = selinux_disable(fsi->state);
 300		if (length)
 301			goto out;
 302		audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
 303			"selinux=0 auid=%u ses=%u",
 304			from_kuid(&init_user_ns, audit_get_loginuid(current)),
 305			audit_get_sessionid(current));
 306	}
 307
 308	length = count;
 309out:
 310	kfree(page);
 311	return length;
 312}
 313#else
 314#define sel_write_disable NULL
 315#endif
 316
 317static const struct file_operations sel_disable_ops = {
 318	.write		= sel_write_disable,
 319	.llseek		= generic_file_llseek,
 320};
 321
 322static ssize_t sel_read_policyvers(struct file *filp, char __user *buf,
 323				   size_t count, loff_t *ppos)
 324{
 325	char tmpbuf[TMPBUFLEN];
 326	ssize_t length;
 327
 328	length = scnprintf(tmpbuf, TMPBUFLEN, "%u", POLICYDB_VERSION_MAX);
 329	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 330}
 331
 332static const struct file_operations sel_policyvers_ops = {
 333	.read		= sel_read_policyvers,
 334	.llseek		= generic_file_llseek,
 335};
 336
 337/* declaration for sel_write_load */
 338static int sel_make_bools(struct selinux_fs_info *fsi);
 339static int sel_make_classes(struct selinux_fs_info *fsi);
 340static int sel_make_policycap(struct selinux_fs_info *fsi);
 341
 342/* declaration for sel_make_class_dirs */
 343static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
 344			unsigned long *ino);
 345
 346static ssize_t sel_read_mls(struct file *filp, char __user *buf,
 347				size_t count, loff_t *ppos)
 348{
 349	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 350	char tmpbuf[TMPBUFLEN];
 351	ssize_t length;
 352
 353	length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
 354			   security_mls_enabled(fsi->state));
 355	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 356}
 357
 358static const struct file_operations sel_mls_ops = {
 359	.read		= sel_read_mls,
 360	.llseek		= generic_file_llseek,
 361};
 362
 363struct policy_load_memory {
 364	size_t len;
 365	void *data;
 366};
 367
 368static int sel_open_policy(struct inode *inode, struct file *filp)
 369{
 370	struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
 371	struct selinux_state *state = fsi->state;
 372	struct policy_load_memory *plm = NULL;
 373	int rc;
 374
 375	BUG_ON(filp->private_data);
 376
 377	mutex_lock(&fsi->mutex);
 378
 379	rc = avc_has_perm(&selinux_state,
 380			  current_sid(), SECINITSID_SECURITY,
 381			  SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
 382	if (rc)
 383		goto err;
 384
 385	rc = -EBUSY;
 386	if (fsi->policy_opened)
 387		goto err;
 388
 389	rc = -ENOMEM;
 390	plm = kzalloc(sizeof(*plm), GFP_KERNEL);
 391	if (!plm)
 392		goto err;
 393
 394	if (i_size_read(inode) != security_policydb_len(state)) {
 395		inode_lock(inode);
 396		i_size_write(inode, security_policydb_len(state));
 397		inode_unlock(inode);
 398	}
 399
 400	rc = security_read_policy(state, &plm->data, &plm->len);
 401	if (rc)
 402		goto err;
 403
 404	fsi->policy_opened = 1;
 405
 406	filp->private_data = plm;
 407
 408	mutex_unlock(&fsi->mutex);
 409
 410	return 0;
 411err:
 412	mutex_unlock(&fsi->mutex);
 413
 414	if (plm)
 415		vfree(plm->data);
 416	kfree(plm);
 417	return rc;
 418}
 419
 420static int sel_release_policy(struct inode *inode, struct file *filp)
 421{
 422	struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
 423	struct policy_load_memory *plm = filp->private_data;
 424
 425	BUG_ON(!plm);
 426
 427	fsi->policy_opened = 0;
 428
 429	vfree(plm->data);
 430	kfree(plm);
 431
 432	return 0;
 433}
 434
 435static ssize_t sel_read_policy(struct file *filp, char __user *buf,
 436			       size_t count, loff_t *ppos)
 437{
 438	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 439	struct policy_load_memory *plm = filp->private_data;
 440	int ret;
 441
 442	mutex_lock(&fsi->mutex);
 443
 444	ret = avc_has_perm(&selinux_state,
 445			   current_sid(), SECINITSID_SECURITY,
 446			  SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
 447	if (ret)
 448		goto out;
 449
 450	ret = simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
 451out:
 452	mutex_unlock(&fsi->mutex);
 453	return ret;
 454}
 455
 456static int sel_mmap_policy_fault(struct vm_fault *vmf)
 457{
 458	struct policy_load_memory *plm = vmf->vma->vm_file->private_data;
 459	unsigned long offset;
 460	struct page *page;
 461
 462	if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
 463		return VM_FAULT_SIGBUS;
 464
 465	offset = vmf->pgoff << PAGE_SHIFT;
 466	if (offset >= roundup(plm->len, PAGE_SIZE))
 467		return VM_FAULT_SIGBUS;
 468
 469	page = vmalloc_to_page(plm->data + offset);
 470	get_page(page);
 471
 472	vmf->page = page;
 473
 474	return 0;
 475}
 476
 477static const struct vm_operations_struct sel_mmap_policy_ops = {
 478	.fault = sel_mmap_policy_fault,
 479	.page_mkwrite = sel_mmap_policy_fault,
 480};
 481
 482static int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma)
 483{
 484	if (vma->vm_flags & VM_SHARED) {
 485		/* do not allow mprotect to make mapping writable */
 486		vma->vm_flags &= ~VM_MAYWRITE;
 487
 488		if (vma->vm_flags & VM_WRITE)
 489			return -EACCES;
 490	}
 491
 492	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
 493	vma->vm_ops = &sel_mmap_policy_ops;
 494
 495	return 0;
 496}
 497
 498static const struct file_operations sel_policy_ops = {
 499	.open		= sel_open_policy,
 500	.read		= sel_read_policy,
 501	.mmap		= sel_mmap_policy,
 502	.release	= sel_release_policy,
 503	.llseek		= generic_file_llseek,
 504};
 505
 506static int sel_make_policy_nodes(struct selinux_fs_info *fsi)
 507{
 508	int ret;
 509
 510	ret = sel_make_bools(fsi);
 511	if (ret) {
 512		pr_err("SELinux: failed to load policy booleans\n");
 513		return ret;
 514	}
 515
 516	ret = sel_make_classes(fsi);
 517	if (ret) {
 518		pr_err("SELinux: failed to load policy classes\n");
 519		return ret;
 520	}
 521
 522	ret = sel_make_policycap(fsi);
 523	if (ret) {
 524		pr_err("SELinux: failed to load policy capabilities\n");
 525		return ret;
 526	}
 527
 528	return 0;
 529}
 530
 531static ssize_t sel_write_load(struct file *file, const char __user *buf,
 532			      size_t count, loff_t *ppos)
 533
 534{
 535	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 536	ssize_t length;
 537	void *data = NULL;
 538
 539	mutex_lock(&fsi->mutex);
 540
 541	length = avc_has_perm(&selinux_state,
 542			      current_sid(), SECINITSID_SECURITY,
 543			      SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
 544	if (length)
 545		goto out;
 546
 547	/* No partial writes. */
 548	length = -EINVAL;
 549	if (*ppos != 0)
 550		goto out;
 551
 552	length = -EFBIG;
 553	if (count > 64 * 1024 * 1024)
 554		goto out;
 555
 556	length = -ENOMEM;
 557	data = vmalloc(count);
 558	if (!data)
 559		goto out;
 560
 561	length = -EFAULT;
 562	if (copy_from_user(data, buf, count) != 0)
 563		goto out;
 564
 565	length = security_load_policy(fsi->state, data, count);
 566	if (length) {
 567		pr_warn_ratelimited("SELinux: failed to load policy\n");
 568		goto out;
 569	}
 570
 571	length = sel_make_policy_nodes(fsi);
 572	if (length)
 573		goto out1;
 574
 575	length = count;
 576
 577out1:
 578	audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
 579		"policy loaded auid=%u ses=%u",
 580		from_kuid(&init_user_ns, audit_get_loginuid(current)),
 581		audit_get_sessionid(current));
 582out:
 583	mutex_unlock(&fsi->mutex);
 584	vfree(data);
 585	return length;
 586}
 587
 588static const struct file_operations sel_load_ops = {
 589	.write		= sel_write_load,
 590	.llseek		= generic_file_llseek,
 591};
 592
 593static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
 594{
 595	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 596	struct selinux_state *state = fsi->state;
 597	char *canon = NULL;
 598	u32 sid, len;
 599	ssize_t length;
 600
 601	length = avc_has_perm(&selinux_state,
 602			      current_sid(), SECINITSID_SECURITY,
 603			      SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
 604	if (length)
 605		goto out;
 606
 607	length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL);
 608	if (length)
 609		goto out;
 610
 611	length = security_sid_to_context(state, sid, &canon, &len);
 612	if (length)
 613		goto out;
 614
 615	length = -ERANGE;
 616	if (len > SIMPLE_TRANSACTION_LIMIT) {
 617		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
 618			"payload max\n", __func__, len);
 619		goto out;
 620	}
 621
 622	memcpy(buf, canon, len);
 623	length = len;
 624out:
 625	kfree(canon);
 626	return length;
 627}
 628
 629static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
 630				     size_t count, loff_t *ppos)
 631{
 632	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 633	char tmpbuf[TMPBUFLEN];
 634	ssize_t length;
 635
 636	length = scnprintf(tmpbuf, TMPBUFLEN, "%u", fsi->state->checkreqprot);
 637	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 638}
 639
 640static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
 641				      size_t count, loff_t *ppos)
 642{
 643	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 644	char *page;
 645	ssize_t length;
 646	unsigned int new_value;
 647
 648	length = avc_has_perm(&selinux_state,
 649			      current_sid(), SECINITSID_SECURITY,
 650			      SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
 651			      NULL);
 652	if (length)
 653		return length;
 654
 655	if (count >= PAGE_SIZE)
 656		return -ENOMEM;
 657
 658	/* No partial writes. */
 659	if (*ppos != 0)
 660		return -EINVAL;
 661
 662	page = memdup_user_nul(buf, count);
 663	if (IS_ERR(page))
 664		return PTR_ERR(page);
 665
 666	length = -EINVAL;
 667	if (sscanf(page, "%u", &new_value) != 1)
 668		goto out;
 669
 670	fsi->state->checkreqprot = new_value ? 1 : 0;
 671	length = count;
 672out:
 673	kfree(page);
 674	return length;
 675}
 676static const struct file_operations sel_checkreqprot_ops = {
 677	.read		= sel_read_checkreqprot,
 678	.write		= sel_write_checkreqprot,
 679	.llseek		= generic_file_llseek,
 680};
 681
 682static ssize_t sel_write_validatetrans(struct file *file,
 683					const char __user *buf,
 684					size_t count, loff_t *ppos)
 685{
 686	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 687	struct selinux_state *state = fsi->state;
 688	char *oldcon = NULL, *newcon = NULL, *taskcon = NULL;
 689	char *req = NULL;
 690	u32 osid, nsid, tsid;
 691	u16 tclass;
 692	int rc;
 693
 694	rc = avc_has_perm(&selinux_state,
 695			  current_sid(), SECINITSID_SECURITY,
 696			  SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
 697	if (rc)
 698		goto out;
 699
 700	rc = -ENOMEM;
 701	if (count >= PAGE_SIZE)
 702		goto out;
 703
 704	/* No partial writes. */
 705	rc = -EINVAL;
 706	if (*ppos != 0)
 707		goto out;
 708
 709	req = memdup_user_nul(buf, count);
 710	if (IS_ERR(req)) {
 711		rc = PTR_ERR(req);
 712		req = NULL;
 713		goto out;
 714	}
 715
 716	rc = -ENOMEM;
 717	oldcon = kzalloc(count + 1, GFP_KERNEL);
 718	if (!oldcon)
 719		goto out;
 720
 721	newcon = kzalloc(count + 1, GFP_KERNEL);
 722	if (!newcon)
 723		goto out;
 724
 725	taskcon = kzalloc(count + 1, GFP_KERNEL);
 726	if (!taskcon)
 727		goto out;
 728
 729	rc = -EINVAL;
 730	if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
 731		goto out;
 732
 733	rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL);
 734	if (rc)
 735		goto out;
 736
 737	rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL);
 738	if (rc)
 739		goto out;
 740
 741	rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL);
 742	if (rc)
 743		goto out;
 744
 745	rc = security_validate_transition_user(state, osid, nsid, tsid, tclass);
 746	if (!rc)
 747		rc = count;
 748out:
 749	kfree(req);
 750	kfree(oldcon);
 751	kfree(newcon);
 752	kfree(taskcon);
 753	return rc;
 754}
 755
 756static const struct file_operations sel_transition_ops = {
 757	.write		= sel_write_validatetrans,
 758	.llseek		= generic_file_llseek,
 759};
 760
 761/*
 762 * Remaining nodes use transaction based IO methods like nfsd/nfsctl.c
 763 */
 764static ssize_t sel_write_access(struct file *file, char *buf, size_t size);
 765static ssize_t sel_write_create(struct file *file, char *buf, size_t size);
 766static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size);
 767static ssize_t sel_write_user(struct file *file, char *buf, size_t size);
 768static ssize_t sel_write_member(struct file *file, char *buf, size_t size);
 769
 770static ssize_t (*write_op[])(struct file *, char *, size_t) = {
 771	[SEL_ACCESS] = sel_write_access,
 772	[SEL_CREATE] = sel_write_create,
 773	[SEL_RELABEL] = sel_write_relabel,
 774	[SEL_USER] = sel_write_user,
 775	[SEL_MEMBER] = sel_write_member,
 776	[SEL_CONTEXT] = sel_write_context,
 777};
 778
 779static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 780{
 781	ino_t ino = file_inode(file)->i_ino;
 782	char *data;
 783	ssize_t rv;
 784
 785	if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
 786		return -EINVAL;
 787
 788	data = simple_transaction_get(file, buf, size);
 789	if (IS_ERR(data))
 790		return PTR_ERR(data);
 791
 792	rv = write_op[ino](file, data, size);
 793	if (rv > 0) {
 794		simple_transaction_set(file, rv);
 795		rv = size;
 796	}
 797	return rv;
 798}
 799
 800static const struct file_operations transaction_ops = {
 801	.write		= selinux_transaction_write,
 802	.read		= simple_transaction_read,
 803	.release	= simple_transaction_release,
 804	.llseek		= generic_file_llseek,
 805};
 806
 807/*
 808 * payload - write methods
 809 * If the method has a response, the response should be put in buf,
 810 * and the length returned.  Otherwise return 0 or and -error.
 811 */
 812
 813static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
 814{
 815	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 816	struct selinux_state *state = fsi->state;
 817	char *scon = NULL, *tcon = NULL;
 818	u32 ssid, tsid;
 819	u16 tclass;
 820	struct av_decision avd;
 821	ssize_t length;
 822
 823	length = avc_has_perm(&selinux_state,
 824			      current_sid(), SECINITSID_SECURITY,
 825			      SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
 826	if (length)
 827		goto out;
 828
 829	length = -ENOMEM;
 830	scon = kzalloc(size + 1, GFP_KERNEL);
 831	if (!scon)
 832		goto out;
 833
 834	length = -ENOMEM;
 835	tcon = kzalloc(size + 1, GFP_KERNEL);
 836	if (!tcon)
 837		goto out;
 838
 839	length = -EINVAL;
 840	if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 841		goto out;
 842
 843	length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
 844	if (length)
 845		goto out;
 846
 847	length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
 848	if (length)
 849		goto out;
 850
 851	security_compute_av_user(state, ssid, tsid, tclass, &avd);
 852
 853	length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
 854			  "%x %x %x %x %u %x",
 855			  avd.allowed, 0xffffffff,
 856			  avd.auditallow, avd.auditdeny,
 857			  avd.seqno, avd.flags);
 858out:
 859	kfree(tcon);
 860	kfree(scon);
 861	return length;
 862}
 863
 864static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
 865{
 866	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 867	struct selinux_state *state = fsi->state;
 868	char *scon = NULL, *tcon = NULL;
 869	char *namebuf = NULL, *objname = NULL;
 870	u32 ssid, tsid, newsid;
 871	u16 tclass;
 872	ssize_t length;
 873	char *newcon = NULL;
 874	u32 len;
 875	int nargs;
 876
 877	length = avc_has_perm(&selinux_state,
 878			      current_sid(), SECINITSID_SECURITY,
 879			      SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
 880			      NULL);
 881	if (length)
 882		goto out;
 883
 884	length = -ENOMEM;
 885	scon = kzalloc(size + 1, GFP_KERNEL);
 886	if (!scon)
 887		goto out;
 888
 889	length = -ENOMEM;
 890	tcon = kzalloc(size + 1, GFP_KERNEL);
 891	if (!tcon)
 892		goto out;
 893
 894	length = -ENOMEM;
 895	namebuf = kzalloc(size + 1, GFP_KERNEL);
 896	if (!namebuf)
 897		goto out;
 898
 899	length = -EINVAL;
 900	nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf);
 901	if (nargs < 3 || nargs > 4)
 902		goto out;
 903	if (nargs == 4) {
 904		/*
 905		 * If and when the name of new object to be queried contains
 906		 * either whitespace or multibyte characters, they shall be
 907		 * encoded based on the percentage-encoding rule.
 908		 * If not encoded, the sscanf logic picks up only left-half
 909		 * of the supplied name; splitted by a whitespace unexpectedly.
 910		 */
 911		char   *r, *w;
 912		int     c1, c2;
 913
 914		r = w = namebuf;
 915		do {
 916			c1 = *r++;
 917			if (c1 == '+')
 918				c1 = ' ';
 919			else if (c1 == '%') {
 920				c1 = hex_to_bin(*r++);
 921				if (c1 < 0)
 922					goto out;
 923				c2 = hex_to_bin(*r++);
 924				if (c2 < 0)
 925					goto out;
 926				c1 = (c1 << 4) | c2;
 927			}
 928			*w++ = c1;
 929		} while (c1 != '\0');
 930
 931		objname = namebuf;
 932	}
 933
 934	length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
 935	if (length)
 936		goto out;
 937
 938	length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
 939	if (length)
 940		goto out;
 941
 942	length = security_transition_sid_user(state, ssid, tsid, tclass,
 943					      objname, &newsid);
 944	if (length)
 945		goto out;
 946
 947	length = security_sid_to_context(state, newsid, &newcon, &len);
 948	if (length)
 949		goto out;
 950
 951	length = -ERANGE;
 952	if (len > SIMPLE_TRANSACTION_LIMIT) {
 953		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
 954			"payload max\n", __func__, len);
 955		goto out;
 956	}
 957
 958	memcpy(buf, newcon, len);
 959	length = len;
 960out:
 961	kfree(newcon);
 962	kfree(namebuf);
 963	kfree(tcon);
 964	kfree(scon);
 965	return length;
 966}
 967
 968static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
 969{
 970	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 971	struct selinux_state *state = fsi->state;
 972	char *scon = NULL, *tcon = NULL;
 973	u32 ssid, tsid, newsid;
 974	u16 tclass;
 975	ssize_t length;
 976	char *newcon = NULL;
 977	u32 len;
 978
 979	length = avc_has_perm(&selinux_state,
 980			      current_sid(), SECINITSID_SECURITY,
 981			      SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
 982			      NULL);
 983	if (length)
 984		goto out;
 985
 986	length = -ENOMEM;
 987	scon = kzalloc(size + 1, GFP_KERNEL);
 988	if (!scon)
 989		goto out;
 990
 991	length = -ENOMEM;
 992	tcon = kzalloc(size + 1, GFP_KERNEL);
 993	if (!tcon)
 994		goto out;
 995
 996	length = -EINVAL;
 997	if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 998		goto out;
 999
1000	length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
1001	if (length)
1002		goto out;
1003
1004	length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
1005	if (length)
1006		goto out;
1007
1008	length = security_change_sid(state, ssid, tsid, tclass, &newsid);
1009	if (length)
1010		goto out;
1011
1012	length = security_sid_to_context(state, newsid, &newcon, &len);
1013	if (length)
1014		goto out;
1015
1016	length = -ERANGE;
1017	if (len > SIMPLE_TRANSACTION_LIMIT)
1018		goto out;
1019
1020	memcpy(buf, newcon, len);
1021	length = len;
1022out:
1023	kfree(newcon);
1024	kfree(tcon);
1025	kfree(scon);
1026	return length;
1027}
1028
1029static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
1030{
1031	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1032	struct selinux_state *state = fsi->state;
1033	char *con = NULL, *user = NULL, *ptr;
1034	u32 sid, *sids = NULL;
1035	ssize_t length;
1036	char *newcon;
1037	int i, rc;
1038	u32 len, nsids;
1039
1040	length = avc_has_perm(&selinux_state,
1041			      current_sid(), SECINITSID_SECURITY,
1042			      SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
1043			      NULL);
1044	if (length)
1045		goto out;
1046
1047	length = -ENOMEM;
1048	con = kzalloc(size + 1, GFP_KERNEL);
1049	if (!con)
1050		goto out;
1051
1052	length = -ENOMEM;
1053	user = kzalloc(size + 1, GFP_KERNEL);
1054	if (!user)
1055		goto out;
1056
1057	length = -EINVAL;
1058	if (sscanf(buf, "%s %s", con, user) != 2)
1059		goto out;
1060
1061	length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL);
1062	if (length)
1063		goto out;
1064
1065	length = security_get_user_sids(state, sid, user, &sids, &nsids);
1066	if (length)
1067		goto out;
1068
1069	length = sprintf(buf, "%u", nsids) + 1;
1070	ptr = buf + length;
1071	for (i = 0; i < nsids; i++) {
1072		rc = security_sid_to_context(state, sids[i], &newcon, &len);
1073		if (rc) {
1074			length = rc;
1075			goto out;
1076		}
1077		if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {
1078			kfree(newcon);
1079			length = -ERANGE;
1080			goto out;
1081		}
1082		memcpy(ptr, newcon, len);
1083		kfree(newcon);
1084		ptr += len;
1085		length += len;
1086	}
1087out:
1088	kfree(sids);
1089	kfree(user);
1090	kfree(con);
1091	return length;
1092}
1093
1094static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
1095{
1096	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1097	struct selinux_state *state = fsi->state;
1098	char *scon = NULL, *tcon = NULL;
1099	u32 ssid, tsid, newsid;
1100	u16 tclass;
1101	ssize_t length;
1102	char *newcon = NULL;
1103	u32 len;
1104
1105	length = avc_has_perm(&selinux_state,
1106			      current_sid(), SECINITSID_SECURITY,
1107			      SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
1108			      NULL);
1109	if (length)
1110		goto out;
1111
1112	length = -ENOMEM;
1113	scon = kzalloc(size + 1, GFP_KERNEL);
1114	if (!scon)
1115		goto out;
1116
1117	length = -ENOMEM;
1118	tcon = kzalloc(size + 1, GFP_KERNEL);
1119	if (!tcon)
1120		goto out;
1121
1122	length = -EINVAL;
1123	if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
1124		goto out;
1125
1126	length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
1127	if (length)
1128		goto out;
1129
1130	length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
1131	if (length)
1132		goto out;
1133
1134	length = security_member_sid(state, ssid, tsid, tclass, &newsid);
1135	if (length)
1136		goto out;
1137
1138	length = security_sid_to_context(state, newsid, &newcon, &len);
1139	if (length)
1140		goto out;
1141
1142	length = -ERANGE;
1143	if (len > SIMPLE_TRANSACTION_LIMIT) {
1144		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
1145			"payload max\n", __func__, len);
1146		goto out;
1147	}
1148
1149	memcpy(buf, newcon, len);
1150	length = len;
1151out:
1152	kfree(newcon);
1153	kfree(tcon);
1154	kfree(scon);
1155	return length;
1156}
1157
1158static struct inode *sel_make_inode(struct super_block *sb, int mode)
1159{
1160	struct inode *ret = new_inode(sb);
1161
1162	if (ret) {
1163		ret->i_mode = mode;
1164		ret->i_atime = ret->i_mtime = ret->i_ctime = current_time(ret);
1165	}
1166	return ret;
1167}
1168
1169static ssize_t sel_read_bool(struct file *filep, char __user *buf,
1170			     size_t count, loff_t *ppos)
1171{
1172	struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1173	char *page = NULL;
1174	ssize_t length;
1175	ssize_t ret;
1176	int cur_enforcing;
1177	unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
1178	const char *name = filep->f_path.dentry->d_name.name;
1179
1180	mutex_lock(&fsi->mutex);
1181
1182	ret = -EINVAL;
1183	if (index >= fsi->bool_num || strcmp(name,
1184					     fsi->bool_pending_names[index]))
1185		goto out;
1186
1187	ret = -ENOMEM;
1188	page = (char *)get_zeroed_page(GFP_KERNEL);
1189	if (!page)
1190		goto out;
1191
1192	cur_enforcing = security_get_bool_value(fsi->state, index);
1193	if (cur_enforcing < 0) {
1194		ret = cur_enforcing;
1195		goto out;
1196	}
1197	length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
1198			  fsi->bool_pending_values[index]);
1199	ret = simple_read_from_buffer(buf, count, ppos, page, length);
1200out:
1201	mutex_unlock(&fsi->mutex);
1202	free_page((unsigned long)page);
1203	return ret;
1204}
1205
1206static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
1207			      size_t count, loff_t *ppos)
1208{
1209	struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1210	char *page = NULL;
1211	ssize_t length;
1212	int new_value;
1213	unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
1214	const char *name = filep->f_path.dentry->d_name.name;
1215
1216	mutex_lock(&fsi->mutex);
1217
1218	length = avc_has_perm(&selinux_state,
1219			      current_sid(), SECINITSID_SECURITY,
1220			      SECCLASS_SECURITY, SECURITY__SETBOOL,
1221			      NULL);
1222	if (length)
1223		goto out;
1224
1225	length = -EINVAL;
1226	if (index >= fsi->bool_num || strcmp(name,
1227					     fsi->bool_pending_names[index]))
1228		goto out;
1229
1230	length = -ENOMEM;
1231	if (count >= PAGE_SIZE)
1232		goto out;
1233
1234	/* No partial writes. */
1235	length = -EINVAL;
1236	if (*ppos != 0)
1237		goto out;
1238
1239	page = memdup_user_nul(buf, count);
1240	if (IS_ERR(page)) {
1241		length = PTR_ERR(page);
1242		page = NULL;
1243		goto out;
1244	}
1245
1246	length = -EINVAL;
1247	if (sscanf(page, "%d", &new_value) != 1)
1248		goto out;
1249
1250	if (new_value)
1251		new_value = 1;
1252
1253	fsi->bool_pending_values[index] = new_value;
1254	length = count;
1255
1256out:
1257	mutex_unlock(&fsi->mutex);
1258	kfree(page);
1259	return length;
1260}
1261
1262static const struct file_operations sel_bool_ops = {
1263	.read		= sel_read_bool,
1264	.write		= sel_write_bool,
1265	.llseek		= generic_file_llseek,
1266};
1267
1268static ssize_t sel_commit_bools_write(struct file *filep,
1269				      const char __user *buf,
1270				      size_t count, loff_t *ppos)
1271{
1272	struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1273	char *page = NULL;
1274	ssize_t length;
1275	int new_value;
1276
1277	mutex_lock(&fsi->mutex);
1278
1279	length = avc_has_perm(&selinux_state,
1280			      current_sid(), SECINITSID_SECURITY,
1281			      SECCLASS_SECURITY, SECURITY__SETBOOL,
1282			      NULL);
1283	if (length)
1284		goto out;
1285
1286	length = -ENOMEM;
1287	if (count >= PAGE_SIZE)
1288		goto out;
1289
1290	/* No partial writes. */
1291	length = -EINVAL;
1292	if (*ppos != 0)
1293		goto out;
1294
1295	page = memdup_user_nul(buf, count);
1296	if (IS_ERR(page)) {
1297		length = PTR_ERR(page);
1298		page = NULL;
1299		goto out;
1300	}
1301
1302	length = -EINVAL;
1303	if (sscanf(page, "%d", &new_value) != 1)
1304		goto out;
1305
1306	length = 0;
1307	if (new_value && fsi->bool_pending_values)
1308		length = security_set_bools(fsi->state, fsi->bool_num,
1309					    fsi->bool_pending_values);
1310
1311	if (!length)
1312		length = count;
1313
1314out:
1315	mutex_unlock(&fsi->mutex);
1316	kfree(page);
1317	return length;
1318}
1319
1320static const struct file_operations sel_commit_bools_ops = {
1321	.write		= sel_commit_bools_write,
1322	.llseek		= generic_file_llseek,
1323};
1324
1325static void sel_remove_entries(struct dentry *de)
1326{
1327	d_genocide(de);
1328	shrink_dcache_parent(de);
1329}
1330
1331#define BOOL_DIR_NAME "booleans"
1332
1333static int sel_make_bools(struct selinux_fs_info *fsi)
1334{
1335	int i, ret;
1336	ssize_t len;
1337	struct dentry *dentry = NULL;
1338	struct dentry *dir = fsi->bool_dir;
1339	struct inode *inode = NULL;
1340	struct inode_security_struct *isec;
1341	char **names = NULL, *page;
1342	int num;
1343	int *values = NULL;
1344	u32 sid;
1345
1346	/* remove any existing files */
1347	for (i = 0; i < fsi->bool_num; i++)
1348		kfree(fsi->bool_pending_names[i]);
1349	kfree(fsi->bool_pending_names);
1350	kfree(fsi->bool_pending_values);
1351	fsi->bool_num = 0;
1352	fsi->bool_pending_names = NULL;
1353	fsi->bool_pending_values = NULL;
1354
1355	sel_remove_entries(dir);
1356
1357	ret = -ENOMEM;
1358	page = (char *)get_zeroed_page(GFP_KERNEL);
1359	if (!page)
1360		goto out;
1361
1362	ret = security_get_bools(fsi->state, &num, &names, &values);
1363	if (ret)
1364		goto out;
1365
1366	for (i = 0; i < num; i++) {
1367		ret = -ENOMEM;
1368		dentry = d_alloc_name(dir, names[i]);
1369		if (!dentry)
1370			goto out;
1371
1372		ret = -ENOMEM;
1373		inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
1374		if (!inode)
1375			goto out;
1376
1377		ret = -ENAMETOOLONG;
1378		len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
1379		if (len >= PAGE_SIZE)
1380			goto out;
1381
1382		isec = (struct inode_security_struct *)inode->i_security;
1383		ret = security_genfs_sid(fsi->state, "selinuxfs", page,
1384					 SECCLASS_FILE, &sid);
1385		if (ret) {
1386			pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
1387					   page);
1388			sid = SECINITSID_SECURITY;
1389		}
1390
1391		isec->sid = sid;
1392		isec->initialized = LABEL_INITIALIZED;
1393		inode->i_fop = &sel_bool_ops;
1394		inode->i_ino = i|SEL_BOOL_INO_OFFSET;
1395		d_add(dentry, inode);
1396	}
1397	fsi->bool_num = num;
1398	fsi->bool_pending_names = names;
1399	fsi->bool_pending_values = values;
1400
1401	free_page((unsigned long)page);
1402	return 0;
1403out:
1404	free_page((unsigned long)page);
1405
1406	if (names) {
1407		for (i = 0; i < num; i++)
1408			kfree(names[i]);
1409		kfree(names);
1410	}
1411	kfree(values);
1412	sel_remove_entries(dir);
1413
1414	return ret;
1415}
1416
1417static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
1418					    size_t count, loff_t *ppos)
1419{
1420	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
1421	struct selinux_state *state = fsi->state;
1422	char tmpbuf[TMPBUFLEN];
1423	ssize_t length;
1424
1425	length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1426			   avc_get_cache_threshold(state->avc));
1427	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1428}
1429
1430static ssize_t sel_write_avc_cache_threshold(struct file *file,
1431					     const char __user *buf,
1432					     size_t count, loff_t *ppos)
1433
1434{
1435	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1436	struct selinux_state *state = fsi->state;
1437	char *page;
1438	ssize_t ret;
1439	unsigned int new_value;
1440
1441	ret = avc_has_perm(&selinux_state,
1442			   current_sid(), SECINITSID_SECURITY,
1443			   SECCLASS_SECURITY, SECURITY__SETSECPARAM,
1444			   NULL);
1445	if (ret)
1446		return ret;
1447
1448	if (count >= PAGE_SIZE)
1449		return -ENOMEM;
1450
1451	/* No partial writes. */
1452	if (*ppos != 0)
1453		return -EINVAL;
1454
1455	page = memdup_user_nul(buf, count);
1456	if (IS_ERR(page))
1457		return PTR_ERR(page);
1458
1459	ret = -EINVAL;
1460	if (sscanf(page, "%u", &new_value) != 1)
1461		goto out;
1462
1463	avc_set_cache_threshold(state->avc, new_value);
1464
1465	ret = count;
1466out:
1467	kfree(page);
1468	return ret;
1469}
1470
1471static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
1472				       size_t count, loff_t *ppos)
1473{
1474	struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
1475	struct selinux_state *state = fsi->state;
1476	char *page;
1477	ssize_t length;
1478
1479	page = (char *)__get_free_page(GFP_KERNEL);
1480	if (!page)
1481		return -ENOMEM;
1482
1483	length = avc_get_hash_stats(state->avc, page);
1484	if (length >= 0)
1485		length = simple_read_from_buffer(buf, count, ppos, page, length);
1486	free_page((unsigned long)page);
1487
1488	return length;
1489}
1490
1491static const struct file_operations sel_avc_cache_threshold_ops = {
1492	.read		= sel_read_avc_cache_threshold,
1493	.write		= sel_write_avc_cache_threshold,
1494	.llseek		= generic_file_llseek,
1495};
1496
1497static const struct file_operations sel_avc_hash_stats_ops = {
1498	.read		= sel_read_avc_hash_stats,
1499	.llseek		= generic_file_llseek,
1500};
1501
1502#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1503static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
1504{
1505	int cpu;
1506
1507	for (cpu = *idx; cpu < nr_cpu_ids; ++cpu) {
1508		if (!cpu_possible(cpu))
1509			continue;
1510		*idx = cpu + 1;
1511		return &per_cpu(avc_cache_stats, cpu);
1512	}
1513	return NULL;
1514}
1515
1516static void *sel_avc_stats_seq_start(struct seq_file *seq, loff_t *pos)
1517{
1518	loff_t n = *pos - 1;
1519
1520	if (*pos == 0)
1521		return SEQ_START_TOKEN;
1522
1523	return sel_avc_get_stat_idx(&n);
1524}
1525
1526static void *sel_avc_stats_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1527{
1528	return sel_avc_get_stat_idx(pos);
1529}
1530
1531static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
1532{
1533	struct avc_cache_stats *st = v;
1534
1535	if (v == SEQ_START_TOKEN) {
1536		seq_puts(seq,
1537			 "lookups hits misses allocations reclaims frees\n");
1538	} else {
1539		unsigned int lookups = st->lookups;
1540		unsigned int misses = st->misses;
1541		unsigned int hits = lookups - misses;
1542		seq_printf(seq, "%u %u %u %u %u %u\n", lookups,
1543			   hits, misses, st->allocations,
1544			   st->reclaims, st->frees);
1545	}
1546	return 0;
1547}
1548
1549static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v)
1550{ }
1551
1552static const struct seq_operations sel_avc_cache_stats_seq_ops = {
1553	.start		= sel_avc_stats_seq_start,
1554	.next		= sel_avc_stats_seq_next,
1555	.show		= sel_avc_stats_seq_show,
1556	.stop		= sel_avc_stats_seq_stop,
1557};
1558
1559static int sel_open_avc_cache_stats(struct inode *inode, struct file *file)
1560{
1561	return seq_open(file, &sel_avc_cache_stats_seq_ops);
1562}
1563
1564static const struct file_operations sel_avc_cache_stats_ops = {
1565	.open		= sel_open_avc_cache_stats,
1566	.read		= seq_read,
1567	.llseek		= seq_lseek,
1568	.release	= seq_release,
1569};
1570#endif
1571
1572static int sel_make_avc_files(struct dentry *dir)
1573{
1574	struct super_block *sb = dir->d_sb;
1575	struct selinux_fs_info *fsi = sb->s_fs_info;
1576	int i;
1577	static const struct tree_descr files[] = {
1578		{ "cache_threshold",
1579		  &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR },
1580		{ "hash_stats", &sel_avc_hash_stats_ops, S_IRUGO },
1581#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1582		{ "cache_stats", &sel_avc_cache_stats_ops, S_IRUGO },
1583#endif
1584	};
1585
1586	for (i = 0; i < ARRAY_SIZE(files); i++) {
1587		struct inode *inode;
1588		struct dentry *dentry;
1589
1590		dentry = d_alloc_name(dir, files[i].name);
1591		if (!dentry)
1592			return -ENOMEM;
1593
1594		inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
1595		if (!inode)
1596			return -ENOMEM;
1597
1598		inode->i_fop = files[i].ops;
1599		inode->i_ino = ++fsi->last_ino;
1600		d_add(dentry, inode);
1601	}
1602
1603	return 0;
1604}
1605
1606static ssize_t sel_read_initcon(struct file *file, char __user *buf,
1607				size_t count, loff_t *ppos)
1608{
1609	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1610	char *con;
1611	u32 sid, len;
1612	ssize_t ret;
1613
1614	sid = file_inode(file)->i_ino&SEL_INO_MASK;
1615	ret = security_sid_to_context(fsi->state, sid, &con, &len);
1616	if (ret)
1617		return ret;
1618
1619	ret = simple_read_from_buffer(buf, count, ppos, con, len);
1620	kfree(con);
1621	return ret;
1622}
1623
1624static const struct file_operations sel_initcon_ops = {
1625	.read		= sel_read_initcon,
1626	.llseek		= generic_file_llseek,
1627};
1628
1629static int sel_make_initcon_files(struct dentry *dir)
1630{
1631	int i;
1632
1633	for (i = 1; i <= SECINITSID_NUM; i++) {
1634		struct inode *inode;
1635		struct dentry *dentry;
1636		dentry = d_alloc_name(dir, security_get_initial_sid_context(i));
1637		if (!dentry)
1638			return -ENOMEM;
1639
1640		inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1641		if (!inode)
1642			return -ENOMEM;
1643
1644		inode->i_fop = &sel_initcon_ops;
1645		inode->i_ino = i|SEL_INITCON_INO_OFFSET;
1646		d_add(dentry, inode);
1647	}
1648
1649	return 0;
1650}
1651
1652static inline unsigned long sel_class_to_ino(u16 class)
1653{
1654	return (class * (SEL_VEC_MAX + 1)) | SEL_CLASS_INO_OFFSET;
1655}
1656
1657static inline u16 sel_ino_to_class(unsigned long ino)
1658{
1659	return (ino & SEL_INO_MASK) / (SEL_VEC_MAX + 1);
1660}
1661
1662static inline unsigned long sel_perm_to_ino(u16 class, u32 perm)
1663{
1664	return (class * (SEL_VEC_MAX + 1) + perm) | SEL_CLASS_INO_OFFSET;
1665}
1666
1667static inline u32 sel_ino_to_perm(unsigned long ino)
1668{
1669	return (ino & SEL_INO_MASK) % (SEL_VEC_MAX + 1);
1670}
1671
1672static ssize_t sel_read_class(struct file *file, char __user *buf,
1673				size_t count, loff_t *ppos)
1674{
1675	unsigned long ino = file_inode(file)->i_ino;
1676	char res[TMPBUFLEN];
1677	ssize_t len = snprintf(res, sizeof(res), "%d", sel_ino_to_class(ino));
1678	return simple_read_from_buffer(buf, count, ppos, res, len);
1679}
1680
1681static const struct file_operations sel_class_ops = {
1682	.read		= sel_read_class,
1683	.llseek		= generic_file_llseek,
1684};
1685
1686static ssize_t sel_read_perm(struct file *file, char __user *buf,
1687				size_t count, loff_t *ppos)
1688{
1689	unsigned long ino = file_inode(file)->i_ino;
1690	char res[TMPBUFLEN];
1691	ssize_t len = snprintf(res, sizeof(res), "%d", sel_ino_to_perm(ino));
1692	return simple_read_from_buffer(buf, count, ppos, res, len);
1693}
1694
1695static const struct file_operations sel_perm_ops = {
1696	.read		= sel_read_perm,
1697	.llseek		= generic_file_llseek,
1698};
1699
1700static ssize_t sel_read_policycap(struct file *file, char __user *buf,
1701				  size_t count, loff_t *ppos)
1702{
1703	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1704	int value;
1705	char tmpbuf[TMPBUFLEN];
1706	ssize_t length;
1707	unsigned long i_ino = file_inode(file)->i_ino;
1708
1709	value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK);
1710	length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
1711
1712	return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1713}
1714
1715static const struct file_operations sel_policycap_ops = {
1716	.read		= sel_read_policycap,
1717	.llseek		= generic_file_llseek,
1718};
1719
1720static int sel_make_perm_files(char *objclass, int classvalue,
1721				struct dentry *dir)
1722{
1723	struct selinux_fs_info *fsi = dir->d_sb->s_fs_info;
1724	int i, rc, nperms;
1725	char **perms;
1726
1727	rc = security_get_permissions(fsi->state, objclass, &perms, &nperms);
1728	if (rc)
1729		return rc;
1730
1731	for (i = 0; i < nperms; i++) {
1732		struct inode *inode;
1733		struct dentry *dentry;
1734
1735		rc = -ENOMEM;
1736		dentry = d_alloc_name(dir, perms[i]);
1737		if (!dentry)
1738			goto out;
1739
1740		rc = -ENOMEM;
1741		inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1742		if (!inode)
1743			goto out;
1744
1745		inode->i_fop = &sel_perm_ops;
1746		/* i+1 since perm values are 1-indexed */
1747		inode->i_ino = sel_perm_to_ino(classvalue, i + 1);
1748		d_add(dentry, inode);
1749	}
1750	rc = 0;
1751out:
1752	for (i = 0; i < nperms; i++)
1753		kfree(perms[i]);
1754	kfree(perms);
1755	return rc;
1756}
1757
1758static int sel_make_class_dir_entries(char *classname, int index,
1759					struct dentry *dir)
1760{
1761	struct super_block *sb = dir->d_sb;
1762	struct selinux_fs_info *fsi = sb->s_fs_info;
1763	struct dentry *dentry = NULL;
1764	struct inode *inode = NULL;
1765	int rc;
1766
1767	dentry = d_alloc_name(dir, "index");
1768	if (!dentry)
1769		return -ENOMEM;
1770
1771	inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1772	if (!inode)
1773		return -ENOMEM;
1774
1775	inode->i_fop = &sel_class_ops;
1776	inode->i_ino = sel_class_to_ino(index);
1777	d_add(dentry, inode);
1778
1779	dentry = sel_make_dir(dir, "perms", &fsi->last_class_ino);
1780	if (IS_ERR(dentry))
1781		return PTR_ERR(dentry);
1782
1783	rc = sel_make_perm_files(classname, index, dentry);
1784
1785	return rc;
1786}
1787
1788static int sel_make_classes(struct selinux_fs_info *fsi)
1789{
1790
1791	int rc, nclasses, i;
1792	char **classes;
1793
1794	/* delete any existing entries */
1795	sel_remove_entries(fsi->class_dir);
1796
1797	rc = security_get_classes(fsi->state, &classes, &nclasses);
1798	if (rc)
1799		return rc;
1800
1801	/* +2 since classes are 1-indexed */
1802	fsi->last_class_ino = sel_class_to_ino(nclasses + 2);
1803
1804	for (i = 0; i < nclasses; i++) {
1805		struct dentry *class_name_dir;
1806
1807		class_name_dir = sel_make_dir(fsi->class_dir, classes[i],
1808					      &fsi->last_class_ino);
1809		if (IS_ERR(class_name_dir)) {
1810			rc = PTR_ERR(class_name_dir);
1811			goto out;
1812		}
1813
1814		/* i+1 since class values are 1-indexed */
1815		rc = sel_make_class_dir_entries(classes[i], i + 1,
1816				class_name_dir);
1817		if (rc)
1818			goto out;
1819	}
1820	rc = 0;
1821out:
1822	for (i = 0; i < nclasses; i++)
1823		kfree(classes[i]);
1824	kfree(classes);
1825	return rc;
1826}
1827
1828static int sel_make_policycap(struct selinux_fs_info *fsi)
1829{
1830	unsigned int iter;
1831	struct dentry *dentry = NULL;
1832	struct inode *inode = NULL;
1833
1834	sel_remove_entries(fsi->policycap_dir);
1835
1836	for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) {
1837		if (iter < ARRAY_SIZE(selinux_policycap_names))
1838			dentry = d_alloc_name(fsi->policycap_dir,
1839					      selinux_policycap_names[iter]);
1840		else
1841			dentry = d_alloc_name(fsi->policycap_dir, "unknown");
1842
1843		if (dentry == NULL)
1844			return -ENOMEM;
1845
1846		inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
1847		if (inode == NULL)
1848			return -ENOMEM;
1849
1850		inode->i_fop = &sel_policycap_ops;
1851		inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET;
1852		d_add(dentry, inode);
1853	}
1854
1855	return 0;
1856}
1857
1858static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
1859			unsigned long *ino)
1860{
1861	struct dentry *dentry = d_alloc_name(dir, name);
1862	struct inode *inode;
1863
1864	if (!dentry)
1865		return ERR_PTR(-ENOMEM);
1866
1867	inode = sel_make_inode(dir->d_sb, S_IFDIR | S_IRUGO | S_IXUGO);
1868	if (!inode) {
1869		dput(dentry);
1870		return ERR_PTR(-ENOMEM);
1871	}
1872
1873	inode->i_op = &simple_dir_inode_operations;
1874	inode->i_fop = &simple_dir_operations;
1875	inode->i_ino = ++(*ino);
1876	/* directory inodes start off with i_nlink == 2 (for "." entry) */
1877	inc_nlink(inode);
1878	d_add(dentry, inode);
1879	/* bump link count on parent directory, too */
1880	inc_nlink(d_inode(dir));
1881
1882	return dentry;
1883}
1884
1885#define NULL_FILE_NAME "null"
1886
1887static int sel_fill_super(struct super_block *sb, void *data, int silent)
1888{
1889	struct selinux_fs_info *fsi;
1890	int ret;
1891	struct dentry *dentry;
1892	struct inode *inode;
1893	struct inode_security_struct *isec;
1894
1895	static const struct tree_descr selinux_files[] = {
1896		[SEL_LOAD] = {"load", &sel_load_ops, S_IRUSR|S_IWUSR},
1897		[SEL_ENFORCE] = {"enforce", &sel_enforce_ops, S_IRUGO|S_IWUSR},
1898		[SEL_CONTEXT] = {"context", &transaction_ops, S_IRUGO|S_IWUGO},
1899		[SEL_ACCESS] = {"access", &transaction_ops, S_IRUGO|S_IWUGO},
1900		[SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO},
1901		[SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO},
1902		[SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO},
1903		[SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO},
1904		[SEL_COMMIT_BOOLS] = {"commit_pending_bools", &sel_commit_bools_ops, S_IWUSR},
1905		[SEL_MLS] = {"mls", &sel_mls_ops, S_IRUGO},
1906		[SEL_DISABLE] = {"disable", &sel_disable_ops, S_IWUSR},
1907		[SEL_MEMBER] = {"member", &transaction_ops, S_IRUGO|S_IWUGO},
1908		[SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
1909		[SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO},
1910		[SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO},
1911		[SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO},
1912		[SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO},
1913		[SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops,
1914					S_IWUGO},
1915		/* last one */ {""}
1916	};
1917
1918	ret = selinux_fs_info_create(sb);
1919	if (ret)
1920		goto err;
1921
1922	ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
1923	if (ret)
1924		goto err;
1925
1926	fsi = sb->s_fs_info;
1927	fsi->bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &fsi->last_ino);
1928	if (IS_ERR(fsi->bool_dir)) {
1929		ret = PTR_ERR(fsi->bool_dir);
1930		fsi->bool_dir = NULL;
1931		goto err;
1932	}
1933
1934	ret = -ENOMEM;
1935	dentry = d_alloc_name(sb->s_root, NULL_FILE_NAME);
1936	if (!dentry)
1937		goto err;
1938
1939	ret = -ENOMEM;
1940	inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
1941	if (!inode)
1942		goto err;
1943
1944	inode->i_ino = ++fsi->last_ino;
1945	isec = (struct inode_security_struct *)inode->i_security;
1946	isec->sid = SECINITSID_DEVNULL;
1947	isec->sclass = SECCLASS_CHR_FILE;
1948	isec->initialized = LABEL_INITIALIZED;
1949
1950	init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3));
1951	d_add(dentry, inode);
1952
1953	dentry = sel_make_dir(sb->s_root, "avc", &fsi->last_ino);
1954	if (IS_ERR(dentry)) {
1955		ret = PTR_ERR(dentry);
1956		goto err;
1957	}
1958
1959	ret = sel_make_avc_files(dentry);
1960	if (ret)
1961		goto err;
1962
1963	dentry = sel_make_dir(sb->s_root, "initial_contexts", &fsi->last_ino);
1964	if (IS_ERR(dentry)) {
1965		ret = PTR_ERR(dentry);
1966		goto err;
1967	}
1968
1969	ret = sel_make_initcon_files(dentry);
1970	if (ret)
1971		goto err;
1972
1973	fsi->class_dir = sel_make_dir(sb->s_root, "class", &fsi->last_ino);
1974	if (IS_ERR(fsi->class_dir)) {
1975		ret = PTR_ERR(fsi->class_dir);
1976		fsi->class_dir = NULL;
1977		goto err;
1978	}
1979
1980	fsi->policycap_dir = sel_make_dir(sb->s_root, "policy_capabilities",
1981					  &fsi->last_ino);
1982	if (IS_ERR(fsi->policycap_dir)) {
1983		ret = PTR_ERR(fsi->policycap_dir);
1984		fsi->policycap_dir = NULL;
1985		goto err;
1986	}
1987
1988	ret = sel_make_policy_nodes(fsi);
1989	if (ret)
1990		goto err;
1991	return 0;
1992err:
1993	printk(KERN_ERR "SELinux: %s:  failed while creating inodes\n",
1994		__func__);
1995
1996	selinux_fs_info_free(sb);
1997
1998	return ret;
1999}
2000
2001static struct dentry *sel_mount(struct file_system_type *fs_type,
2002		      int flags, const char *dev_name, void *data)
2003{
2004	return mount_single(fs_type, flags, data, sel_fill_super);
2005}
2006
2007static void sel_kill_sb(struct super_block *sb)
2008{
2009	selinux_fs_info_free(sb);
2010	kill_litter_super(sb);
2011}
2012
2013static struct file_system_type sel_fs_type = {
2014	.name		= "selinuxfs",
2015	.mount		= sel_mount,
2016	.kill_sb	= sel_kill_sb,
2017};
2018
2019struct vfsmount *selinuxfs_mount;
2020struct path selinux_null;
2021
2022static int __init init_sel_fs(void)
2023{
2024	struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
2025					  sizeof(NULL_FILE_NAME)-1);
2026	int err;
2027
2028	if (!selinux_enabled)
2029		return 0;
2030
2031	err = sysfs_create_mount_point(fs_kobj, "selinux");
2032	if (err)
2033		return err;
2034
2035	err = register_filesystem(&sel_fs_type);
2036	if (err) {
2037		sysfs_remove_mount_point(fs_kobj, "selinux");
2038		return err;
2039	}
2040
2041	selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);
2042	if (IS_ERR(selinuxfs_mount)) {
2043		printk(KERN_ERR "selinuxfs:  could not mount!\n");
2044		err = PTR_ERR(selinuxfs_mount);
2045		selinuxfs_mount = NULL;
2046	}
2047	selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root,
2048						&null_name);
2049	if (IS_ERR(selinux_null.dentry)) {
2050		pr_err("selinuxfs:  could not lookup null!\n");
2051		err = PTR_ERR(selinux_null.dentry);
2052		selinux_null.dentry = NULL;
2053	}
2054
2055	return err;
2056}
2057
2058__initcall(init_sel_fs);
2059
2060#ifdef CONFIG_SECURITY_SELINUX_DISABLE
2061void exit_sel_fs(void)
2062{
2063	sysfs_remove_mount_point(fs_kobj, "selinux");
2064	dput(selinux_null.dentry);
2065	kern_unmount(selinuxfs_mount);
2066	unregister_filesystem(&sel_fs_type);
2067}
2068#endif