security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *
  14  *      This program is free software; you can redistribute it and/or modify
  15  *      it under the terms of the GNU General Public License version 2,
  16  *      as published by the Free Software Foundation.
  17  */
  18
  19 #include <linux/config.h>
  20 #include <linux/module.h>
  21 #include <linux/init.h>
  22 #include <linux/kernel.h>
  23 #include <linux/ptrace.h>
  24 #include <linux/errno.h>
  25 #include <linux/sched.h>
  26 #include <linux/security.h>
  27 #include <linux/xattr.h>
  28 #include <linux/capability.h>
  29 #include <linux/unistd.h>
  30 #include <linux/mm.h>
  31 #include <linux/mman.h>
  32 #include <linux/slab.h>
  33 #include <linux/pagemap.h>
  34 #include <linux/swap.h>
  35 #include <linux/smp_lock.h>
  36 #include <linux/spinlock.h>
  37 #include <linux/syscalls.h>
  38 #include <linux/file.h>
  39 #include <linux/namei.h>
  40 #include <linux/mount.h>
  41 #include <linux/ext2_fs.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/kd.h>
  44 #include <linux/netfilter_ipv4.h>
  45 #include <linux/netfilter_ipv6.h>
  46 #include <net/icmp.h>
  47 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  48 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  49 #include <asm/uaccess.h>
  50 #include <asm/semaphore.h>
  51 #include <asm/ioctls.h>
  52 #include <linux/bitops.h>
  53 #include <linux/interrupt.h>
  54 #include <linux/netdevice.h>    /* for network interface checks */
  55 #include <linux/netlink.h>
  56 #include <linux/tcp.h>
  57 #include <linux/udp.h>
  58 #include <linux/quota.h>
  59 #include <linux/un.h>           /* for Unix socket types */
  60 #include <net/af_unix.h>        /* for Unix socket types */
  61 #include <linux/parser.h>
  62 #include <linux/nfs_mount.h>
  63 #include <net/ipv6.h>
  64 #include <linux/hugetlb.h>
  65 #include <linux/major.h>
  66 #include <linux/personality.h>
  67
  68 #include "avc.h"
  69 #include "objsec.h"
  70 #include "netif.h"
  71
  72 #define XATTR_SELINUX_SUFFIX "selinux"
  73 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  74
  75 extern int policydb_loaded_version;
  76 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  77
  78 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  79 int selinux_enforcing = 0;
  80
  81 static int __init enforcing_setup(char *str)
  82 {
  83         selinux_enforcing = simple_strtol(str,NULL,0);
  84         return 1;
  85 }
  86 __setup("enforcing=", enforcing_setup);
  87 #endif
  88
  89 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  90 int selinux_enabled = 0;
  91
  92 static int __init selinux_enabled_setup(char *str)
  93 {
  94         selinux_enabled = simple_strtol(str, NULL, 0);
  95         return 1;
  96 }
  97 __setup("selinux=", selinux_enabled_setup);
  98 #endif
  99
 100 /* Original (dummy) security module. */
 101 static struct security_operations *original_ops = NULL;
 102
 103 /* Minimal support for a secondary security module,
 104    just to allow the use of the dummy or capability modules.
 105    The owlsm module can alternatively be used as a secondary
 106    module as long as CONFIG_OWLSM_FD is not enabled. */
 107 static struct security_operations *secondary_ops = NULL;
 108
 109 /* Lists of inode and superblock security structures initialized
 110    before the policy was loaded. */
 111 static LIST_HEAD(superblock_security_head);
 112 static spinlock_t sb_security_lock = SPIN_LOCK_UNLOCKED;
 113
 114 /* Allocate and free functions for each kind of security blob. */
 115
 116 static int task_alloc_security(struct task_struct *task)
 117 {
 118         struct task_security_struct *tsec;
 119
 120         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 121         if (!tsec)
 122                 return -ENOMEM;
 123
 124         memset(tsec, 0, sizeof(struct task_security_struct));
 125         tsec->magic = SELINUX_MAGIC;
 126         tsec->task = task;
 127         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 128         task->security = tsec;
 129
 130         return 0;
 131 }
 132
 133 static void task_free_security(struct task_struct *task)
 134 {
 135         struct task_security_struct *tsec = task->security;
 136
 137         if (!tsec || tsec->magic != SELINUX_MAGIC)
 138                 return;
 139
 140         task->security = NULL;
 141         kfree(tsec);
 142 }
 143
 144 static int inode_alloc_security(struct inode *inode)
 145 {
 146         struct task_security_struct *tsec = current->security;
 147         struct inode_security_struct *isec;
 148
 149         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 150         if (!isec)
 151                 return -ENOMEM;
 152
 153         memset(isec, 0, sizeof(struct inode_security_struct));
 154         init_MUTEX(&isec->sem);
 155         INIT_LIST_HEAD(&isec->list);
 156         isec->magic = SELINUX_MAGIC;
 157         isec->inode = inode;
 158         isec->sid = SECINITSID_UNLABELED;
 159         isec->sclass = SECCLASS_FILE;
 160         if (tsec && tsec->magic == SELINUX_MAGIC)
 161                 isec->task_sid = tsec->sid;
 162         else
 163                 isec->task_sid = SECINITSID_UNLABELED;
 164         inode->i_security = isec;
 165
 166         return 0;
 167 }
 168
 169 static void inode_free_security(struct inode *inode)
 170 {
 171         struct inode_security_struct *isec = inode->i_security;
 172         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 173
 174         if (!isec || isec->magic != SELINUX_MAGIC)
 175                 return;
 176
 177         spin_lock(&sbsec->isec_lock);
 178         if (!list_empty(&isec->list))
 179                 list_del_init(&isec->list);
 180         spin_unlock(&sbsec->isec_lock);
 181
 182         inode->i_security = NULL;
 183         kfree(isec);
 184 }
 185
 186 static int file_alloc_security(struct file *file)
 187 {
 188         struct task_security_struct *tsec = current->security;
 189         struct file_security_struct *fsec;
 190
 191         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 192         if (!fsec)
 193                 return -ENOMEM;
 194
 195         memset(fsec, 0, sizeof(struct file_security_struct));
 196         fsec->magic = SELINUX_MAGIC;
 197         fsec->file = file;
 198         if (tsec && tsec->magic == SELINUX_MAGIC) {
 199                 fsec->sid = tsec->sid;
 200                 fsec->fown_sid = tsec->sid;
 201         } else {
 202                 fsec->sid = SECINITSID_UNLABELED;
 203                 fsec->fown_sid = SECINITSID_UNLABELED;
 204         }
 205         file->f_security = fsec;
 206
 207         return 0;
 208 }
 209
 210 static void file_free_security(struct file *file)
 211 {
 212         struct file_security_struct *fsec = file->f_security;
 213
 214         if (!fsec || fsec->magic != SELINUX_MAGIC)
 215                 return;
 216
 217         file->f_security = NULL;
 218         kfree(fsec);
 219 }
 220
 221 static int superblock_alloc_security(struct super_block *sb)
 222 {
 223         struct superblock_security_struct *sbsec;
 224
 225         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 226         if (!sbsec)
 227                 return -ENOMEM;
 228
 229         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 230         init_MUTEX(&sbsec->sem);
 231         INIT_LIST_HEAD(&sbsec->list);
 232         INIT_LIST_HEAD(&sbsec->isec_head);
 233         spin_lock_init(&sbsec->isec_lock);
 234         sbsec->magic = SELINUX_MAGIC;
 235         sbsec->sb = sb;
 236         sbsec->sid = SECINITSID_UNLABELED;
 237         sbsec->def_sid = SECINITSID_FILE;
 238         sb->s_security = sbsec;
 239
 240         return 0;
 241 }
 242
 243 static void superblock_free_security(struct super_block *sb)
 244 {
 245         struct superblock_security_struct *sbsec = sb->s_security;
 246
 247         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 248                 return;
 249
 250         spin_lock(&sb_security_lock);
 251         if (!list_empty(&sbsec->list))
 252                 list_del_init(&sbsec->list);
 253         spin_unlock(&sb_security_lock);
 254
 255         sb->s_security = NULL;
 256         kfree(sbsec);
 257 }
 258
 259 #ifdef CONFIG_SECURITY_NETWORK
 260 static int sk_alloc_security(struct sock *sk, int family, int priority)
 261 {
 262         struct sk_security_struct *ssec;
 263
 264         if (family != PF_UNIX)
 265                 return 0;
 266
 267         ssec = kmalloc(sizeof(*ssec), priority);
 268         if (!ssec)
 269                 return -ENOMEM;
 270
 271         memset(ssec, 0, sizeof(*ssec));
 272         ssec->magic = SELINUX_MAGIC;
 273         ssec->sk = sk;
 274         ssec->peer_sid = SECINITSID_UNLABELED;
 275         sk->sk_security = ssec;
 276
 277         return 0;
 278 }
 279
 280 static void sk_free_security(struct sock *sk)
 281 {
 282         struct sk_security_struct *ssec = sk->sk_security;
 283
 284         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 285                 return;
 286
 287         sk->sk_security = NULL;
 288         kfree(ssec);
 289 }
 290 #endif  /* CONFIG_SECURITY_NETWORK */
 291
 292 /* The security server must be initialized before
 293    any labeling or access decisions can be provided. */
 294 extern int ss_initialized;
 295
 296 /* The file system's label must be initialized prior to use. */
 297
 298 static char *labeling_behaviors[6] = {
 299         "uses xattr",
 300         "uses transition SIDs",
 301         "uses task SIDs",
 302         "uses genfs_contexts",
 303         "not configured for labeling",
 304         "uses mountpoint labeling",
 305 };
 306
 307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 308
 309 static inline int inode_doinit(struct inode *inode)
 310 {
 311         return inode_doinit_with_dentry(inode, NULL);
 312 }
 313
 314 enum {
 315         Opt_context = 1,
 316         Opt_fscontext = 2,
 317         Opt_defcontext = 4,
 318 };
 319
 320 static match_table_t tokens = {
 321         {Opt_context, "context=%s"},
 322         {Opt_fscontext, "fscontext=%s"},
 323         {Opt_defcontext, "defcontext=%s"},
 324 };
 325
 326 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 327
 328 static int try_context_mount(struct super_block *sb, void *data)
 329 {
 330         char *context = NULL, *defcontext = NULL;
 331         const char *name;
 332         u32 sid;
 333         int alloc = 0, rc = 0, seen = 0;
 334         struct task_security_struct *tsec = current->security;
 335         struct superblock_security_struct *sbsec = sb->s_security;
 336
 337         if (!data)
 338                 goto out;
 339
 340         name = sb->s_type->name;
 341
 342         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 343
 344                 /* NFS we understand. */
 345                 if (!strcmp(name, "nfs")) {
 346                         struct nfs_mount_data *d = data;
 347
 348                         if (d->version <  NFS_MOUNT_VERSION)
 349                                 goto out;
 350
 351                         if (d->context[0]) {
 352                                 context = d->context;
 353                                 seen |= Opt_context;
 354                         }
 355                 } else
 356                         goto out;
 357
 358         } else {
 359                 /* Standard string-based options. */
 360                 char *p, *options = data;
 361
 362                 while ((p = strsep(&options, ",")) != NULL) {
 363                         int token;
 364                         substring_t args[MAX_OPT_ARGS];
 365
 366                         if (!*p)
 367                                 continue;
 368
 369                         token = match_token(p, tokens, args);
 370
 371                         switch (token) {
 372                         case Opt_context:
 373                                 if (seen) {
 374                                         rc = -EINVAL;
 375                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 376                                         goto out_free;
 377                                 }
 378                                 context = match_strdup(&args[0]);
 379                                 if (!context) {
 380                                         rc = -ENOMEM;
 381                                         goto out_free;
 382                                 }
 383                                 if (!alloc)
 384                                         alloc = 1;
 385                                 seen |= Opt_context;
 386                                 break;
 387
 388                         case Opt_fscontext:
 389                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 390                                         rc = -EINVAL;
 391                                         printk(KERN_WARNING "SELinux:  "
 392                                                "fscontext option is invalid for"
 393                                                " this filesystem type\n");
 394                                         goto out_free;
 395                                 }
 396                                 if (seen & (Opt_context|Opt_fscontext)) {
 397                                         rc = -EINVAL;
 398                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 399                                         goto out_free;
 400                                 }
 401                                 context = match_strdup(&args[0]);
 402                                 if (!context) {
 403                                         rc = -ENOMEM;
 404                                         goto out_free;
 405                                 }
 406                                 if (!alloc)
 407                                         alloc = 1;
 408                                 seen |= Opt_fscontext;
 409                                 break;
 410
 411                         case Opt_defcontext:
 412                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 413                                         rc = -EINVAL;
 414                                         printk(KERN_WARNING "SELinux:  "
 415                                                "defcontext option is invalid "
 416                                                "for this filesystem type\n");
 417                                         goto out_free;
 418                                 }
 419                                 if (seen & (Opt_context|Opt_defcontext)) {
 420                                         rc = -EINVAL;
 421                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 422                                         goto out_free;
 423                                 }
 424                                 defcontext = match_strdup(&args[0]);
 425                                 if (!defcontext) {
 426                                         rc = -ENOMEM;
 427                                         goto out_free;
 428                                 }
 429                                 if (!alloc)
 430                                         alloc = 1;
 431                                 seen |= Opt_defcontext;
 432                                 break;
 433
 434                         default:
 435                                 rc = -EINVAL;
 436                                 printk(KERN_WARNING "SELinux:  unknown mount "
 437                                        "option\n");
 438                                 goto out_free;
 439
 440                         }
 441                 }
 442         }
 443
 444         if (!seen)
 445                 goto out;
 446
 447         if (context) {
 448                 rc = security_context_to_sid(context, strlen(context), &sid);
 449                 if (rc) {
 450                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 451                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 452                                context, sb->s_id, name, rc);
 453                         goto out_free;
 454                 }
 455
 456                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 457                                   FILESYSTEM__RELABELFROM, NULL, NULL);
 458                 if (rc)
 459                         goto out_free;
 460
 461                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 462                                   FILESYSTEM__RELABELTO, NULL, NULL);
 463                 if (rc)
 464                         goto out_free;
 465
 466                 sbsec->sid = sid;
 467
 468                 if (seen & Opt_context)
 469                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 470         }
 471
 472         if (defcontext) {
 473                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 474                 if (rc) {
 475                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 476                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 477                                defcontext, sb->s_id, name, rc);
 478                         goto out_free;
 479                 }
 480
 481                 if (sid == sbsec->def_sid)
 482                         goto out_free;
 483
 484                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 485                                   FILESYSTEM__RELABELFROM, NULL, NULL);
 486                 if (rc)
 487                         goto out_free;
 488
 489                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 490                                   FILESYSTEM__ASSOCIATE, NULL, NULL);
 491                 if (rc)
 492                         goto out_free;
 493
 494                 sbsec->def_sid = sid;
 495         }
 496
 497 out_free:
 498         if (alloc) {
 499                 kfree(context);
 500                 kfree(defcontext);
 501         }
 502 out:
 503         return rc;
 504 }
 505
 506 static int superblock_doinit(struct super_block *sb, void *data)
 507 {
 508         struct superblock_security_struct *sbsec = sb->s_security;
 509         struct dentry *root = sb->s_root;
 510         struct inode *inode = root->d_inode;
 511         int rc = 0;
 512
 513         down(&sbsec->sem);
 514         if (sbsec->initialized)
 515                 goto out;
 516
 517         if (!ss_initialized) {
 518                 /* Defer initialization until selinux_complete_init,
 519                    after the initial policy is loaded and the security
 520                    server is ready to handle calls. */
 521                 spin_lock(&sb_security_lock);
 522                 if (list_empty(&sbsec->list))
 523                         list_add(&sbsec->list, &superblock_security_head);
 524                 spin_unlock(&sb_security_lock);
 525                 goto out;
 526         }
 527
 528         /* Determine the labeling behavior to use for this filesystem type. */
 529         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 530         if (rc) {
 531                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 532                        __FUNCTION__, sb->s_type->name, rc);
 533                 goto out;
 534         }
 535
 536         rc = try_context_mount(sb, data);
 537         if (rc)
 538                 goto out;
 539
 540         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 541                 /* Make sure that the xattr handler exists and that no
 542                    error other than -ENODATA is returned by getxattr on
 543                    the root directory.  -ENODATA is ok, as this may be
 544                    the first boot of the SELinux kernel before we have
 545                    assigned xattr values to the filesystem. */
 546                 if (!inode->i_op->getxattr) {
 547                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 548                                "xattr support\n", sb->s_id, sb->s_type->name);
 549                         rc = -EOPNOTSUPP;
 550                         goto out;
 551                 }
 552                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 553                 if (rc < 0 && rc != -ENODATA) {
 554                         if (rc == -EOPNOTSUPP)
 555                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 556                                        "%s) has no security xattr handler\n",
 557                                        sb->s_id, sb->s_type->name);
 558                         else
 559                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 560                                        "%s) getxattr errno %d\n", sb->s_id,
 561                                        sb->s_type->name, -rc);
 562                         goto out;
 563                 }
 564         }
 565
 566         if (strcmp(sb->s_type->name, "proc") == 0)
 567                 sbsec->proc = 1;
 568
 569         sbsec->initialized = 1;
 570
 571         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 572                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 573                        sb->s_id, sb->s_type->name);
 574         }
 575         else {
 576                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 577                        sb->s_id, sb->s_type->name,
 578                        labeling_behaviors[sbsec->behavior-1]);
 579         }
 580
 581         /* Initialize the root inode. */
 582         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 583
 584         /* Initialize any other inodes associated with the superblock, e.g.
 585            inodes created prior to initial policy load or inodes created
 586            during get_sb by a pseudo filesystem that directly
 587            populates itself. */
 588         spin_lock(&sbsec->isec_lock);
 589 next_inode:
 590         if (!list_empty(&sbsec->isec_head)) {
 591                 struct inode_security_struct *isec =
 592                                 list_entry(sbsec->isec_head.next,
 593                                            struct inode_security_struct, list);
 594                 struct inode *inode = isec->inode;
 595                 spin_unlock(&sbsec->isec_lock);
 596                 inode = igrab(inode);
 597                 if (inode) {
 598                         inode_doinit(inode);
 599                         iput(inode);
 600                 }
 601                 spin_lock(&sbsec->isec_lock);
 602                 list_del_init(&isec->list);
 603                 goto next_inode;
 604         }
 605         spin_unlock(&sbsec->isec_lock);
 606 out:
 607         up(&sbsec->sem);
 608         return rc;
 609 }
 610
 611 static inline u16 inode_mode_to_security_class(umode_t mode)
 612 {
 613         switch (mode & S_IFMT) {
 614         case S_IFSOCK:
 615                 return SECCLASS_SOCK_FILE;
 616         case S_IFLNK:
 617                 return SECCLASS_LNK_FILE;
 618         case S_IFREG:
 619                 return SECCLASS_FILE;
 620         case S_IFBLK:
 621                 return SECCLASS_BLK_FILE;
 622         case S_IFDIR:
 623                 return SECCLASS_DIR;
 624         case S_IFCHR:
 625                 return SECCLASS_CHR_FILE;
 626         case S_IFIFO:
 627                 return SECCLASS_FIFO_FILE;
 628
 629         }
 630
 631         return SECCLASS_FILE;
 632 }
 633
 634 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 635 {
 636         switch (family) {
 637         case PF_UNIX:
 638                 switch (type) {
 639                 case SOCK_STREAM:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644         case PF_INET:
 645         case PF_INET6:
 646                 switch (type) {
 647                 case SOCK_STREAM:
 648                         return SECCLASS_TCP_SOCKET;
 649                 case SOCK_DGRAM:
 650                         return SECCLASS_UDP_SOCKET;
 651                 case SOCK_RAW:
 652                         return SECCLASS_RAWIP_SOCKET;
 653                 }
 654         case PF_NETLINK:
 655                 switch (protocol) {
 656                 case NETLINK_ROUTE:
 657                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 658                 case NETLINK_FIREWALL:
 659                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 660                 case NETLINK_TCPDIAG:
 661                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 662                 case NETLINK_NFLOG:
 663                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 664                 case NETLINK_XFRM:
 665                         return SECCLASS_NETLINK_XFRM_SOCKET;
 666                 case NETLINK_SELINUX:
 667                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 668                 case NETLINK_AUDIT:
 669                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 670                 case NETLINK_IP6_FW:
 671                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 672                 case NETLINK_DNRTMSG:
 673                         return SECCLASS_NETLINK_DNRT_SOCKET;
 674                 default:
 675                         return SECCLASS_NETLINK_SOCKET;
 676                 }
 677         case PF_PACKET:
 678                 return SECCLASS_PACKET_SOCKET;
 679         case PF_KEY:
 680                 return SECCLASS_KEY_SOCKET;
 681         }
 682
 683         return SECCLASS_SOCKET;
 684 }
 685
 686 #ifdef CONFIG_PROC_FS
 687 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 688                                 u16 tclass,
 689                                 u32 *sid)
 690 {
 691         int buflen, rc;
 692         char *buffer, *path, *end;
 693
 694         buffer = (char*)__get_free_page(GFP_KERNEL);
 695         if (!buffer)
 696                 return -ENOMEM;
 697
 698         buflen = PAGE_SIZE;
 699         end = buffer+buflen;
 700         *--end = '\0';
 701         buflen--;
 702         path = end-1;
 703         *path = '/';
 704         while (de && de != de->parent) {
 705                 buflen -= de->namelen + 1;
 706                 if (buflen < 0)
 707                         break;
 708                 end -= de->namelen;
 709                 memcpy(end, de->name, de->namelen);
 710                 *--end = '/';
 711                 path = end;
 712                 de = de->parent;
 713         }
 714         rc = security_genfs_sid("proc", path, tclass, sid);
 715         free_page((unsigned long)buffer);
 716         return rc;
 717 }
 718 #else
 719 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 720                                 u16 tclass,
 721                                 u32 *sid)
 722 {
 723         return -EINVAL;
 724 }
 725 #endif
 726
 727 /* The inode's security attributes must be initialized before first use. */
 728 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 729 {
 730         struct superblock_security_struct *sbsec = NULL;
 731         struct inode_security_struct *isec = inode->i_security;
 732         u32 sid;
 733         struct dentry *dentry;
 734 #define INITCONTEXTLEN 255
 735         char *context = NULL;
 736         unsigned len = 0;
 737         int rc = 0;
 738         int hold_sem = 0;
 739
 740         if (isec->initialized)
 741                 goto out;
 742
 743         down(&isec->sem);
 744         hold_sem = 1;
 745         if (isec->initialized)
 746                 goto out;
 747
 748         sbsec = inode->i_sb->s_security;
 749         if (!sbsec->initialized) {
 750                 /* Defer initialization until selinux_complete_init,
 751                    after the initial policy is loaded and the security
 752                    server is ready to handle calls. */
 753                 spin_lock(&sbsec->isec_lock);
 754                 if (list_empty(&isec->list))
 755                         list_add(&isec->list, &sbsec->isec_head);
 756                 spin_unlock(&sbsec->isec_lock);
 757                 goto out;
 758         }
 759
 760         switch (sbsec->behavior) {
 761         case SECURITY_FS_USE_XATTR:
 762                 if (!inode->i_op->getxattr) {
 763                         isec->sid = sbsec->def_sid;
 764                         break;
 765                 }
 766
 767                 /* Need a dentry, since the xattr API requires one.
 768                    Life would be simpler if we could just pass the inode. */
 769                 if (opt_dentry) {
 770                         /* Called from d_instantiate or d_splice_alias. */
 771                         dentry = dget(opt_dentry);
 772                 } else {
 773                         /* Called from selinux_complete_init, try to find a dentry. */
 774                         dentry = d_find_alias(inode);
 775                 }
 776                 if (!dentry) {
 777                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 778                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 779                                inode->i_ino);
 780                         goto out;
 781                 }
 782
 783                 len = INITCONTEXTLEN;
 784                 context = kmalloc(len, GFP_KERNEL);
 785                 if (!context) {
 786                         rc = -ENOMEM;
 787                         dput(dentry);
 788                         goto out;
 789                 }
 790                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 791                                            context, len);
 792                 if (rc == -ERANGE) {
 793                         /* Need a larger buffer.  Query for the right size. */
 794                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                                    NULL, 0);
 796                         if (rc < 0) {
 797                                 dput(dentry);
 798                                 goto out;
 799                         }
 800                         kfree(context);
 801                         len = rc;
 802                         context = kmalloc(len, GFP_KERNEL);
 803                         if (!context) {
 804                                 rc = -ENOMEM;
 805                                 dput(dentry);
 806                                 goto out;
 807                         }
 808                         rc = inode->i_op->getxattr(dentry,
 809                                                    XATTR_NAME_SELINUX,
 810                                                    context, len);
 811                 }
 812                 dput(dentry);
 813                 if (rc < 0) {
 814                         if (rc != -ENODATA) {
 815                                 printk(KERN_WARNING "%s:  getxattr returned "
 816                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 817                                        -rc, inode->i_sb->s_id, inode->i_ino);
 818                                 kfree(context);
 819                                 goto out;
 820                         }
 821                         /* Map ENODATA to the default file SID */
 822                         sid = sbsec->def_sid;
 823                         rc = 0;
 824                 } else {
 825                         rc = security_context_to_sid(context, rc, &sid);
 826                         if (rc) {
 827                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 828                                        "returned %d for dev=%s ino=%ld\n",
 829                                        __FUNCTION__, context, -rc,
 830                                        inode->i_sb->s_id, inode->i_ino);
 831                                 kfree(context);
 832                                 goto out;
 833                         }
 834                 }
 835                 kfree(context);
 836                 isec->sid = sid;
 837                 break;
 838         case SECURITY_FS_USE_TASK:
 839                 isec->sid = isec->task_sid;
 840                 break;
 841         case SECURITY_FS_USE_TRANS:
 842                 /* Default to the fs SID. */
 843                 isec->sid = sbsec->sid;
 844
 845                 /* Try to obtain a transition SID. */
 846                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 847                 rc = security_transition_sid(isec->task_sid,
 848                                              sbsec->sid,
 849                                              isec->sclass,
 850                                              &sid);
 851                 if (rc)
 852                         goto out;
 853                 isec->sid = sid;
 854                 break;
 855         default:
 856                 /* Default to the fs SID. */
 857                 isec->sid = sbsec->sid;
 858
 859                 if (sbsec->proc) {
 860                         struct proc_inode *proci = PROC_I(inode);
 861                         if (proci->pde) {
 862                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 863                                 rc = selinux_proc_get_sid(proci->pde,
 864                                                           isec->sclass,
 865                                                           &sid);
 866                                 if (rc)
 867                                         goto out;
 868                                 isec->sid = sid;
 869                         }
 870                 }
 871                 break;
 872         }
 873
 874         isec->initialized = 1;
 875
 876 out:
 877         if (inode->i_sock) {
 878                 struct socket *sock = SOCKET_I(inode);
 879                 if (sock->sk) {
 880                         isec->sclass = socket_type_to_security_class(sock->sk->sk_family,
 881                                                                      sock->sk->sk_type,
 882                                                                      sock->sk->sk_protocol);
 883                 } else {
 884                         isec->sclass = SECCLASS_SOCKET;
 885                 }
 886         } else {
 887                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 888         }
 889
 890         if (hold_sem)
 891                 up(&isec->sem);
 892         return rc;
 893 }
 894
 895 /* Convert a Linux signal to an access vector. */
 896 static inline u32 signal_to_av(int sig)
 897 {
 898         u32 perm = 0;
 899
 900         switch (sig) {
 901         case SIGCHLD:
 902                 /* Commonly granted from child to parent. */
 903                 perm = PROCESS__SIGCHLD;
 904                 break;
 905         case SIGKILL:
 906                 /* Cannot be caught or ignored */
 907                 perm = PROCESS__SIGKILL;
 908                 break;
 909         case SIGSTOP:
 910                 /* Cannot be caught or ignored */
 911                 perm = PROCESS__SIGSTOP;
 912                 break;
 913         default:
 914                 /* All other signals. */
 915                 perm = PROCESS__SIGNAL;
 916                 break;
 917         }
 918
 919         return perm;
 920 }
 921
 922 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 923    fork check, ptrace check, etc. */
 924 int task_has_perm(struct task_struct *tsk1,
 925                   struct task_struct *tsk2,
 926                   u32 perms)
 927 {
 928         struct task_security_struct *tsec1, *tsec2;
 929
 930         tsec1 = tsk1->security;
 931         tsec2 = tsk2->security;
 932         return avc_has_perm(tsec1->sid, tsec2->sid,
 933                             SECCLASS_PROCESS, perms, &tsec2->avcr, NULL);
 934 }
 935
 936 /* Check whether a task is allowed to use a capability. */
 937 int task_has_capability(struct task_struct *tsk,
 938                         int cap)
 939 {
 940         struct task_security_struct *tsec;
 941         struct avc_audit_data ad;
 942
 943         tsec = tsk->security;
 944
 945         AVC_AUDIT_DATA_INIT(&ad,CAP);
 946         ad.tsk = tsk;
 947         ad.u.cap = cap;
 948
 949         return avc_has_perm(tsec->sid, tsec->sid,
 950                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), NULL, &ad);
 951 }
 952
 953 /* Check whether a task is allowed to use a system operation. */
 954 int task_has_system(struct task_struct *tsk,
 955                     u32 perms)
 956 {
 957         struct task_security_struct *tsec;
 958
 959         tsec = tsk->security;
 960
 961         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 962                             SECCLASS_SYSTEM, perms, NULL, NULL);
 963 }
 964
 965 /* Check whether a task has a particular permission to an inode.
 966    The 'aeref' parameter is optional and allows other AVC
 967    entry references to be passed (e.g. the one in the struct file).
 968    The 'adp' parameter is optional and allows other audit
 969    data to be passed (e.g. the dentry). */
 970 int inode_has_perm(struct task_struct *tsk,
 971                    struct inode *inode,
 972                    u32 perms,
 973                    struct avc_entry_ref *aeref,
 974                    struct avc_audit_data *adp)
 975 {
 976         struct task_security_struct *tsec;
 977         struct inode_security_struct *isec;
 978         struct avc_audit_data ad;
 979
 980         tsec = tsk->security;
 981         isec = inode->i_security;
 982
 983         if (!adp) {
 984                 adp = &ad;
 985                 AVC_AUDIT_DATA_INIT(&ad, FS);
 986                 ad.u.fs.inode = inode;
 987         }
 988
 989         return avc_has_perm(tsec->sid, isec->sid, isec->sclass,
 990                             perms, aeref ? aeref : &isec->avcr, adp);
 991 }
 992
 993 /* Same as inode_has_perm, but pass explicit audit data containing
 994    the dentry to help the auditing code to more easily generate the
 995    pathname if needed. */
 996 static inline int dentry_has_perm(struct task_struct *tsk,
 997                                   struct vfsmount *mnt,
 998                                   struct dentry *dentry,
 999                                   u32 av)
1000 {
1001         struct inode *inode = dentry->d_inode;
1002         struct avc_audit_data ad;
1003         AVC_AUDIT_DATA_INIT(&ad,FS);
1004         ad.u.fs.mnt = mnt;
1005         ad.u.fs.dentry = dentry;
1006         return inode_has_perm(tsk, inode, av, NULL, &ad);
1007 }
1008
1009 /* Check whether a task can use an open file descriptor to
1010    access an inode in a given way.  Check access to the
1011    descriptor itself, and then use dentry_has_perm to
1012    check a particular permission to the file.
1013    Access to the descriptor is implicitly granted if it
1014    has the same SID as the process.  If av is zero, then
1015    access to the file is not checked, e.g. for cases
1016    where only the descriptor is affected like seek. */
1017 static inline int file_has_perm(struct task_struct *tsk,
1018                                 struct file *file,
1019                                 u32 av)
1020 {
1021         struct task_security_struct *tsec = tsk->security;
1022         struct file_security_struct *fsec = file->f_security;
1023         struct vfsmount *mnt = file->f_vfsmnt;
1024         struct dentry *dentry = file->f_dentry;
1025         struct inode *inode = dentry->d_inode;
1026         struct avc_audit_data ad;
1027         int rc;
1028
1029         AVC_AUDIT_DATA_INIT(&ad, FS);
1030         ad.u.fs.mnt = mnt;
1031         ad.u.fs.dentry = dentry;
1032
1033         if (tsec->sid != fsec->sid) {
1034                 rc = avc_has_perm(tsec->sid, fsec->sid,
1035                                   SECCLASS_FD,
1036                                   FD__USE,
1037                                   &fsec->avcr, &ad);
1038                 if (rc)
1039                         return rc;
1040         }
1041
1042         /* av is zero if only checking access to the descriptor. */
1043         if (av)
1044                 return inode_has_perm(tsk, inode, av, &fsec->inode_avcr, &ad);
1045
1046         return 0;
1047 }
1048
1049 /* Check whether a task can create a file. */
1050 static int may_create(struct inode *dir,
1051                       struct dentry *dentry,
1052                       u16 tclass)
1053 {
1054         struct task_security_struct *tsec;
1055         struct inode_security_struct *dsec;
1056         struct superblock_security_struct *sbsec;
1057         u32 newsid;
1058         struct avc_audit_data ad;
1059         int rc;
1060
1061         tsec = current->security;
1062         dsec = dir->i_security;
1063         sbsec = dir->i_sb->s_security;
1064
1065         AVC_AUDIT_DATA_INIT(&ad, FS);
1066         ad.u.fs.dentry = dentry;
1067
1068         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1069                           DIR__ADD_NAME | DIR__SEARCH,
1070                           &dsec->avcr, &ad);
1071         if (rc)
1072                 return rc;
1073
1074         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1075                 newsid = tsec->create_sid;
1076         } else {
1077                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1078                                              &newsid);
1079                 if (rc)
1080                         return rc;
1081         }
1082
1083         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, NULL, &ad);
1084         if (rc)
1085                 return rc;
1086
1087         return avc_has_perm(newsid, sbsec->sid,
1088                             SECCLASS_FILESYSTEM,
1089                             FILESYSTEM__ASSOCIATE, NULL, &ad);
1090 }
1091
1092 #define MAY_LINK   0
1093 #define MAY_UNLINK 1
1094 #define MAY_RMDIR  2
1095
1096 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1097 static int may_link(struct inode *dir,
1098                     struct dentry *dentry,
1099                     int kind)
1100
1101 {
1102         struct task_security_struct *tsec;
1103         struct inode_security_struct *dsec, *isec;
1104         struct avc_audit_data ad;
1105         u32 av;
1106         int rc;
1107
1108         tsec = current->security;
1109         dsec = dir->i_security;
1110         isec = dentry->d_inode->i_security;
1111
1112         AVC_AUDIT_DATA_INIT(&ad, FS);
1113         ad.u.fs.dentry = dentry;
1114
1115         av = DIR__SEARCH;
1116         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1117         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1118                           av, &dsec->avcr, &ad);
1119         if (rc)
1120                 return rc;
1121
1122         switch (kind) {
1123         case MAY_LINK:
1124                 av = FILE__LINK;
1125                 break;
1126         case MAY_UNLINK:
1127                 av = FILE__UNLINK;
1128                 break;
1129         case MAY_RMDIR:
1130                 av = DIR__RMDIR;
1131                 break;
1132         default:
1133                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1134                 return 0;
1135         }
1136
1137         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
1138                           av, &isec->avcr, &ad);
1139         return rc;
1140 }
1141
1142 static inline int may_rename(struct inode *old_dir,
1143                              struct dentry *old_dentry,
1144                              struct inode *new_dir,
1145                              struct dentry *new_dentry)
1146 {
1147         struct task_security_struct *tsec;
1148         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1149         struct avc_audit_data ad;
1150         u32 av;
1151         int old_is_dir, new_is_dir;
1152         int rc;
1153
1154         tsec = current->security;
1155         old_dsec = old_dir->i_security;
1156         old_isec = old_dentry->d_inode->i_security;
1157         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1158         new_dsec = new_dir->i_security;
1159
1160         AVC_AUDIT_DATA_INIT(&ad, FS);
1161
1162         ad.u.fs.dentry = old_dentry;
1163         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1164                           DIR__REMOVE_NAME | DIR__SEARCH,
1165                           &old_dsec->avcr, &ad);
1166         if (rc)
1167                 return rc;
1168         rc = avc_has_perm(tsec->sid, old_isec->sid,
1169                           old_isec->sclass,
1170                           FILE__RENAME,
1171                           &old_isec->avcr, &ad);
1172         if (rc)
1173                 return rc;
1174         if (old_is_dir && new_dir != old_dir) {
1175                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1176                                   old_isec->sclass,
1177                                   DIR__REPARENT,
1178                                   &old_isec->avcr, &ad);
1179                 if (rc)
1180                         return rc;
1181         }
1182
1183         ad.u.fs.dentry = new_dentry;
1184         av = DIR__ADD_NAME | DIR__SEARCH;
1185         if (new_dentry->d_inode)
1186                 av |= DIR__REMOVE_NAME;
1187         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR,
1188                           av,&new_dsec->avcr, &ad);
1189         if (rc)
1190                 return rc;
1191         if (new_dentry->d_inode) {
1192                 new_isec = new_dentry->d_inode->i_security;
1193                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1194                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1195                                   new_isec->sclass,
1196                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK),
1197                                   &new_isec->avcr, &ad);
1198                 if (rc)
1199                         return rc;
1200         }
1201
1202         return 0;
1203 }
1204
1205 /* Check whether a task can perform a filesystem operation. */
1206 int superblock_has_perm(struct task_struct *tsk,
1207                         struct super_block *sb,
1208                         u32 perms,
1209                         struct avc_audit_data *ad)
1210 {
1211         struct task_security_struct *tsec;
1212         struct superblock_security_struct *sbsec;
1213
1214         tsec = tsk->security;
1215         sbsec = sb->s_security;
1216         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1217                             perms, NULL, ad);
1218 }
1219
1220 /* Convert a Linux mode and permission mask to an access vector. */
1221 static inline u32 file_mask_to_av(int mode, int mask)
1222 {
1223         u32 av = 0;
1224
1225         if ((mode & S_IFMT) != S_IFDIR) {
1226                 if (mask & MAY_EXEC)
1227                         av |= FILE__EXECUTE;
1228                 if (mask & MAY_READ)
1229                         av |= FILE__READ;
1230
1231                 if (mask & MAY_APPEND)
1232                         av |= FILE__APPEND;
1233                 else if (mask & MAY_WRITE)
1234                         av |= FILE__WRITE;
1235
1236         } else {
1237                 if (mask & MAY_EXEC)
1238                         av |= DIR__SEARCH;
1239                 if (mask & MAY_WRITE)
1240                         av |= DIR__WRITE;
1241                 if (mask & MAY_READ)
1242                         av |= DIR__READ;
1243         }
1244
1245         return av;
1246 }
1247
1248 /* Convert a Linux file to an access vector. */
1249 static inline u32 file_to_av(struct file *file)
1250 {
1251         u32 av = 0;
1252
1253         if (file->f_mode & FMODE_READ)
1254                 av |= FILE__READ;
1255         if (file->f_mode & FMODE_WRITE) {
1256                 if (file->f_flags & O_APPEND)
1257                         av |= FILE__APPEND;
1258                 else
1259                         av |= FILE__WRITE;
1260         }
1261
1262         return av;
1263 }
1264
1265 /* Set an inode's SID to a specified value. */
1266 int inode_security_set_sid(struct inode *inode, u32 sid)
1267 {
1268         struct inode_security_struct *isec = inode->i_security;
1269
1270         down(&isec->sem);
1271         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1272         isec->sid = sid;
1273         isec->initialized = 1;
1274         up(&isec->sem);
1275         return 0;
1276 }
1277
1278 /* Set the security attributes on a newly created file. */
1279 static int post_create(struct inode *dir,
1280                        struct dentry *dentry)
1281 {
1282
1283         struct task_security_struct *tsec;
1284         struct inode *inode;
1285         struct inode_security_struct *dsec;
1286         struct superblock_security_struct *sbsec;
1287         u32 newsid;
1288         char *context;
1289         unsigned int len;
1290         int rc;
1291
1292         tsec = current->security;
1293         dsec = dir->i_security;
1294         sbsec = dir->i_sb->s_security;
1295
1296         inode = dentry->d_inode;
1297         if (!inode) {
1298                 /* Some file system types (e.g. NFS) may not instantiate
1299                    a dentry for all create operations (e.g. symlink),
1300                    so we have to check to see if the inode is non-NULL. */
1301                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1302                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1303                 return 0;
1304         }
1305
1306         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1307                 newsid = tsec->create_sid;
1308         } else {
1309                 rc = security_transition_sid(tsec->sid, dsec->sid,
1310                                              inode_mode_to_security_class(inode->i_mode),
1311                                              &newsid);
1312                 if (rc) {
1313                         printk(KERN_WARNING "post_create:  "
1314                                "security_transition_sid failed, rc=%d (dev=%s "
1315                                "ino=%ld)\n",
1316                                -rc, inode->i_sb->s_id, inode->i_ino);
1317                         return rc;
1318                 }
1319         }
1320
1321         rc = inode_security_set_sid(inode, newsid);
1322         if (rc) {
1323                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1324                        "failed, rc=%d (dev=%s ino=%ld)\n",
1325                        -rc, inode->i_sb->s_id, inode->i_ino);
1326                 return rc;
1327         }
1328
1329         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1330             inode->i_op->setxattr) {
1331                 /* Use extended attributes. */
1332                 rc = security_sid_to_context(newsid, &context, &len);
1333                 if (rc) {
1334                         printk(KERN_WARNING "post_create:  sid_to_context "
1335                                "failed, rc=%d (dev=%s ino=%ld)\n",
1336                                -rc, inode->i_sb->s_id, inode->i_ino);
1337                         return rc;
1338                 }
1339                 down(&inode->i_sem);
1340                 rc = inode->i_op->setxattr(dentry,
1341                                            XATTR_NAME_SELINUX,
1342                                            context, len, 0);
1343                 up(&inode->i_sem);
1344                 kfree(context);
1345                 if (rc < 0) {
1346                         printk(KERN_WARNING "post_create:  setxattr failed, "
1347                                "rc=%d (dev=%s ino=%ld)\n",
1348                                -rc, inode->i_sb->s_id, inode->i_ino);
1349                         return rc;
1350                 }
1351         }
1352
1353         return 0;
1354 }
1355
1356
1357 /* Hook functions begin here. */
1358
1359 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1360 {
1361         struct task_security_struct *psec = parent->security;
1362         struct task_security_struct *csec = child->security;
1363         int rc;
1364
1365         rc = secondary_ops->ptrace(parent,child);
1366         if (rc)
1367                 return rc;
1368
1369         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1370         /* Save the SID of the tracing process for later use in apply_creds. */
1371         if (!rc)
1372                 csec->ptrace_sid = psec->sid;
1373         return rc;
1374 }
1375
1376 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1377                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1378 {
1379         int error;
1380
1381         error = task_has_perm(current, target, PROCESS__GETCAP);
1382         if (error)
1383                 return error;
1384
1385         return secondary_ops->capget(target, effective, inheritable, permitted);
1386 }
1387
1388 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1389                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391         int error;
1392
1393         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1394         if (error)
1395                 return error;
1396
1397         return task_has_perm(current, target, PROCESS__SETCAP);
1398 }
1399
1400 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1401                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1402 {
1403         int error;
1404
1405         error = task_has_perm(current, target, PROCESS__SETCAP);
1406         if (error)
1407                 return;
1408
1409         secondary_ops->capset_set(target, effective, inheritable, permitted);
1410 }
1411
1412 static int selinux_capable(struct task_struct *tsk, int cap)
1413 {
1414         int rc;
1415
1416         rc = secondary_ops->capable(tsk, cap);
1417         if (rc)
1418                 return rc;
1419
1420         return task_has_capability(tsk,cap);
1421 }
1422
1423 static int selinux_sysctl(ctl_table *table, int op)
1424 {
1425         int error = 0;
1426         u32 av;
1427         struct task_security_struct *tsec;
1428         u32 tsid;
1429         int rc;
1430
1431         rc = secondary_ops->sysctl(table, op);
1432         if (rc)
1433                 return rc;
1434
1435         tsec = current->security;
1436
1437         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1438                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1439         if (rc) {
1440                 /* Default to the well-defined sysctl SID. */
1441                 tsid = SECINITSID_SYSCTL;
1442         }
1443
1444         /* The op values are "defined" in sysctl.c, thereby creating
1445          * a bad coupling between this module and sysctl.c */
1446         if(op == 001) {
1447                 error = avc_has_perm(tsec->sid, tsid,
1448                                      SECCLASS_DIR, DIR__SEARCH, NULL, NULL);
1449         } else {
1450                 av = 0;
1451                 if (op & 004)
1452                         av |= FILE__READ;
1453                 if (op & 002)
1454                         av |= FILE__WRITE;
1455                 if (av)
1456                         error = avc_has_perm(tsec->sid, tsid,
1457                                              SECCLASS_FILE, av, NULL, NULL);
1458         }
1459
1460         return error;
1461 }
1462
1463 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1464 {
1465         int rc = 0;
1466
1467         if (!sb)
1468                 return 0;
1469
1470         switch (cmds) {
1471                 case Q_SYNC:
1472                 case Q_QUOTAON:
1473                 case Q_QUOTAOFF:
1474                 case Q_SETINFO:
1475                 case Q_SETQUOTA:
1476                         rc = superblock_has_perm(current,
1477                                                  sb,
1478                                                  FILESYSTEM__QUOTAMOD, NULL);
1479                         break;
1480                 case Q_GETFMT:
1481                 case Q_GETINFO:
1482                 case Q_GETQUOTA:
1483                         rc = superblock_has_perm(current,
1484                                                  sb,
1485                                                  FILESYSTEM__QUOTAGET, NULL);
1486                         break;
1487                 default:
1488                         rc = 0;  /* let the kernel handle invalid cmds */
1489                         break;
1490         }
1491         return rc;
1492 }
1493
1494 static int selinux_quota_on(struct file *f)
1495 {
1496         return file_has_perm(current, f, FILE__QUOTAON);
1497 }
1498
1499 static int selinux_syslog(int type)
1500 {
1501         int rc;
1502
1503         rc = secondary_ops->syslog(type);
1504         if (rc)
1505                 return rc;
1506
1507         switch (type) {
1508                 case 3:         /* Read last kernel messages */
1509                 case 10:        /* Return size of the log buffer */
1510                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1511                         break;
1512                 case 6:         /* Disable logging to console */
1513                 case 7:         /* Enable logging to console */
1514                 case 8:         /* Set level of messages printed to console */
1515                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1516                         break;
1517                 case 0:         /* Close log */
1518                 case 1:         /* Open log */
1519                 case 2:         /* Read from log */
1520                 case 4:         /* Read/clear last kernel messages */
1521                 case 5:         /* Clear ring buffer */
1522                 default:
1523                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1524                         break;
1525         }
1526         return rc;
1527 }
1528
1529 /*
1530  * Check that a process has enough memory to allocate a new virtual
1531  * mapping. 0 means there is enough memory for the allocation to
1532  * succeed and -ENOMEM implies there is not.
1533  *
1534  * We currently support three overcommit policies, which are set via the
1535  * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting
1536  *
1537  * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
1538  * Additional code 2002 Jul 20 by Robert Love.
1539  */
1540 static int selinux_vm_enough_memory(long pages)
1541 {
1542         unsigned long free, allowed;
1543         int rc;
1544         struct task_security_struct *tsec = current->security;
1545
1546         vm_acct_memory(pages);
1547
1548         /*
1549          * Sometimes we want to use more memory than we have
1550          */
1551         if (sysctl_overcommit_memory == 1)
1552                 return 0;
1553
1554         if (sysctl_overcommit_memory == 0) {
1555                 free = get_page_cache_size();
1556                 free += nr_free_pages();
1557                 free += nr_swap_pages;
1558
1559                 /*
1560                  * Any slabs which are created with the
1561                  * SLAB_RECLAIM_ACCOUNT flag claim to have contents
1562                  * which are reclaimable, under pressure.  The dentry
1563                  * cache and most inode caches should fall into this
1564                  */
1565                 free += atomic_read(&slab_reclaim_pages);
1566
1567                 /*
1568                  * Leave the last 3% for privileged processes.
1569                  * Don't audit the check, as it is applied to all processes
1570                  * that allocate mappings.
1571                  */
1572                 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1573                 if (!rc) {
1574                         rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1575                                                   SECCLASS_CAPABILITY,
1576                                                   CAP_TO_MASK(CAP_SYS_ADMIN),
1577                                                   NULL, NULL);
1578                 }
1579                 if (rc)
1580                         free -= free / 32;
1581
1582                 if (free > pages)
1583                         return 0;
1584                 vm_unacct_memory(pages);
1585                 return -ENOMEM;
1586         }
1587
1588         allowed = (totalram_pages - hugetlb_total_pages())
1589                 * sysctl_overcommit_ratio / 100;
1590         allowed += total_swap_pages;
1591
1592         if (atomic_read(&vm_committed_space) < allowed)
1593                 return 0;
1594
1595         vm_unacct_memory(pages);
1596
1597         return -ENOMEM;
1598 }
1599
1600 /* binprm security operations */
1601
1602 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1603 {
1604         struct bprm_security_struct *bsec;
1605
1606         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1607         if (!bsec)
1608                 return -ENOMEM;
1609
1610         memset(bsec, 0, sizeof *bsec);
1611         bsec->magic = SELINUX_MAGIC;
1612         bsec->bprm = bprm;
1613         bsec->sid = SECINITSID_UNLABELED;
1614         bsec->set = 0;
1615
1616         bprm->security = bsec;
1617         return 0;
1618 }
1619
1620 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1621 {
1622         struct task_security_struct *tsec;
1623         struct inode *inode = bprm->file->f_dentry->d_inode;
1624         struct inode_security_struct *isec;
1625         struct bprm_security_struct *bsec;
1626         u32 newsid;
1627         struct avc_audit_data ad;
1628         int rc;
1629
1630         rc = secondary_ops->bprm_set_security(bprm);
1631         if (rc)
1632                 return rc;
1633
1634         bsec = bprm->security;
1635
1636         if (bsec->set)
1637                 return 0;
1638
1639         tsec = current->security;
1640         isec = inode->i_security;
1641
1642         /* Default to the current task SID. */
1643         bsec->sid = tsec->sid;
1644
1645         /* Reset create SID on execve. */
1646         tsec->create_sid = 0;
1647
1648         if (tsec->exec_sid) {
1649                 newsid = tsec->exec_sid;
1650                 /* Reset exec SID on execve. */
1651                 tsec->exec_sid = 0;
1652         } else {
1653                 /* Check for a default transition on this program. */
1654                 rc = security_transition_sid(tsec->sid, isec->sid,
1655                                              SECCLASS_PROCESS, &newsid);
1656                 if (rc)
1657                         return rc;
1658         }
1659
1660         AVC_AUDIT_DATA_INIT(&ad, FS);
1661         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1662         ad.u.fs.dentry = bprm->file->f_dentry;
1663
1664         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1665                 newsid = tsec->sid;
1666
1667         if (tsec->sid == newsid) {
1668                 rc = avc_has_perm(tsec->sid, isec->sid,
1669                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS,
1670                                   &isec->avcr, &ad);
1671                 if (rc)
1672                         return rc;
1673         } else {
1674                 /* Check permissions for the transition. */
1675                 rc = avc_has_perm(tsec->sid, newsid,
1676                                   SECCLASS_PROCESS, PROCESS__TRANSITION,
1677                                   NULL,
1678                                   &ad);
1679                 if (rc)
1680                         return rc;
1681
1682                 rc = avc_has_perm(newsid, isec->sid,
1683                                   SECCLASS_FILE, FILE__ENTRYPOINT,
1684                                   &isec->avcr, &ad);
1685                 if (rc)
1686                         return rc;
1687
1688                 /* Clear any possibly unsafe personality bits on exec: */
1689                 current->personality &= ~PER_CLEAR_ON_SETID;
1690
1691                 /* Set the security field to the new SID. */
1692                 bsec->sid = newsid;
1693         }
1694
1695         bsec->set = 1;
1696         return 0;
1697 }
1698
1699 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1700 {
1701         return secondary_ops->bprm_check_security(bprm);
1702 }
1703
1704
1705 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1706 {
1707         struct task_security_struct *tsec = current->security;
1708         int atsecure = 0;
1709
1710         if (tsec->osid != tsec->sid) {
1711                 /* Enable secure mode for SIDs transitions unless
1712                    the noatsecure permission is granted between
1713                    the two SIDs, i.e. ahp returns 0. */
1714                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1715                                          SECCLASS_PROCESS,
1716                                          PROCESS__NOATSECURE, NULL, NULL);
1717         }
1718
1719         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1720 }
1721
1722 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1723 {
1724         struct bprm_security_struct *bsec = bprm->security;
1725         bprm->security = NULL;
1726         kfree(bsec);
1727 }
1728
1729 /* Create an open file that refers to the null device.
1730    Derived from the OpenWall LSM. */
1731 struct file *open_devnull(void)
1732 {
1733         struct inode *inode;
1734         struct dentry *dentry;
1735         struct file *file = NULL;
1736         struct inode_security_struct *isec;
1737         dev_t dev;
1738
1739         inode = new_inode(current->fs->rootmnt->mnt_sb);
1740         if (!inode)
1741                 goto out;
1742
1743         dentry = dget(d_alloc_root(inode));
1744         if (!dentry)
1745                 goto out_iput;
1746
1747         file = get_empty_filp();
1748         if (!file)
1749                 goto out_dput;
1750
1751         dev = MKDEV(MEM_MAJOR, 3); /* null device */
1752
1753         inode->i_uid = current->fsuid;
1754         inode->i_gid = current->fsgid;
1755         inode->i_blksize = PAGE_SIZE;
1756         inode->i_blocks = 0;
1757         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
1758         inode->i_state = I_DIRTY; /* so that mark_inode_dirty won't touch us */
1759
1760         isec = inode->i_security;
1761         isec->sid = SECINITSID_DEVNULL;
1762         isec->sclass = SECCLASS_CHR_FILE;
1763         isec->initialized = 1;
1764
1765         file->f_flags = O_RDWR;
1766         file->f_mode = FMODE_READ | FMODE_WRITE;
1767         file->f_dentry = dentry;
1768         file->f_vfsmnt = mntget(current->fs->rootmnt);
1769         file->f_pos = 0;
1770
1771         init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, dev);
1772         if (inode->i_fop->open(inode, file))
1773                 goto out_fput;
1774
1775 out:
1776         return file;
1777 out_fput:
1778         mntput(file->f_vfsmnt);
1779         put_filp(file);
1780 out_dput:
1781         dput(dentry);
1782 out_iput:
1783         iput(inode);
1784         file = NULL;
1785         goto out;
1786 }
1787
1788 /* Derived from fs/exec.c:flush_old_files. */
1789 static inline void flush_unauthorized_files(struct files_struct * files)
1790 {
1791         struct avc_audit_data ad;
1792         struct file *file, *devnull = NULL;
1793         long j = -1;
1794
1795         AVC_AUDIT_DATA_INIT(&ad,FS);
1796
1797         spin_lock(&files->file_lock);
1798         for (;;) {
1799                 unsigned long set, i;
1800                 int fd;
1801
1802                 j++;
1803                 i = j * __NFDBITS;
1804                 if (i >= files->max_fds || i >= files->max_fdset)
1805                         break;
1806                 set = files->open_fds->fds_bits[j];
1807                 if (!set)
1808                         continue;
1809                 spin_unlock(&files->file_lock);
1810                 for ( ; set ; i++,set >>= 1) {
1811                         if (set & 1) {
1812                                 file = fget(i);
1813                                 if (!file)
1814                                         continue;
1815                                 if (file_has_perm(current,
1816                                                   file,
1817                                                   file_to_av(file))) {
1818                                         sys_close(i);
1819                                         fd = get_unused_fd();
1820                                         if (fd != i) {
1821                                                 if (fd >= 0)
1822                                                         put_unused_fd(fd);
1823                                                 fput(file);
1824                                                 continue;
1825                                         }
1826                                         if (devnull) {
1827                                                 atomic_inc(&devnull->f_count);
1828                                         } else {
1829                                                 devnull = open_devnull();
1830                                                 if (!devnull) {
1831                                                         put_unused_fd(fd);
1832                                                         fput(file);
1833                                                         continue;
1834                                                 }
1835                                         }
1836                                         fd_install(fd, devnull);
1837                                 }
1838                                 fput(file);
1839                         }
1840                 }
1841                 spin_lock(&files->file_lock);
1842
1843         }
1844         spin_unlock(&files->file_lock);
1845 }
1846
1847 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1848 {
1849         struct task_security_struct *tsec;
1850         struct bprm_security_struct *bsec;
1851         u32 sid;
1852         struct av_decision avd;
1853         struct itimerval itimer;
1854         struct rlimit *rlim, *initrlim;
1855         int rc, i;
1856
1857         secondary_ops->bprm_apply_creds(bprm, unsafe);
1858
1859         tsec = current->security;
1860
1861         bsec = bprm->security;
1862         sid = bsec->sid;
1863
1864         tsec->osid = tsec->sid;
1865         if (tsec->sid != sid) {
1866                 /* Check for shared state.  If not ok, leave SID
1867                    unchanged and kill. */
1868                 if (unsafe & LSM_UNSAFE_SHARE) {
1869                         rc = avc_has_perm_noaudit(tsec->sid, sid,
1870                                           SECCLASS_PROCESS, PROCESS__SHARE,
1871                                           NULL, &avd);
1872                         if (rc) {
1873                                 task_unlock(current);
1874                                 avc_audit(tsec->sid, sid, SECCLASS_PROCESS,
1875                                     PROCESS__SHARE, &avd, rc, NULL);
1876                                 force_sig_specific(SIGKILL, current);
1877                                 goto lock_out;
1878                         }
1879                 }
1880
1881                 /* Check for ptracing, and update the task SID if ok.
1882                    Otherwise, leave SID unchanged and kill. */
1883                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1884                         rc = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
1885                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1886                                           NULL, &avd);
1887                         if (!rc)
1888                                 tsec->sid = sid;
1889                         task_unlock(current);
1890                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
1891                                   PROCESS__PTRACE, &avd, rc, NULL);
1892                         if (rc) {
1893                                 force_sig_specific(SIGKILL, current);
1894                                 goto lock_out;
1895                         }
1896                 } else {
1897                         tsec->sid = sid;
1898                         task_unlock(current);
1899                 }
1900
1901                 /* Close files for which the new task SID is not authorized. */
1902                 flush_unauthorized_files(current->files);
1903
1904                 /* Check whether the new SID can inherit signal state
1905                    from the old SID.  If not, clear itimers to avoid
1906                    subsequent signal generation and flush and unblock
1907                    signals. This must occur _after_ the task SID has
1908                   been updated so that any kill done after the flush
1909                   will be checked against the new SID. */
1910                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1911                                   PROCESS__SIGINH, NULL, NULL);
1912                 if (rc) {
1913                         memset(&itimer, 0, sizeof itimer);
1914                         for (i = 0; i < 3; i++)
1915                                 do_setitimer(i, &itimer, NULL);
1916                         flush_signals(current);
1917                         spin_lock_irq(&current->sighand->siglock);
1918                         flush_signal_handlers(current, 1);
1919                         sigemptyset(&current->blocked);
1920                         recalc_sigpending();
1921                         spin_unlock_irq(&current->sighand->siglock);
1922                 }
1923
1924                 /* Check whether the new SID can inherit resource limits
1925                    from the old SID.  If not, reset all soft limits to
1926                    the lower of the current task's hard limit and the init
1927                    task's soft limit.  Note that the setting of hard limits
1928                    (even to lower them) can be controlled by the setrlimit
1929                    check. The inclusion of the init task's soft limit into
1930                    the computation is to avoid resetting soft limits higher
1931                    than the default soft limit for cases where the default
1932                    is lower than the hard limit, e.g. RLIMIT_CORE or
1933                    RLIMIT_STACK.*/
1934                 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1935                                   PROCESS__RLIMITINH, NULL, NULL);
1936                 if (rc) {
1937                         for (i = 0; i < RLIM_NLIMITS; i++) {
1938                                 rlim = current->rlim + i;
1939                                 initrlim = init_task.rlim+i;
1940                                 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1941                         }
1942                 }
1943
1944                 /* Wake up the parent if it is waiting so that it can
1945                    recheck wait permission to the new task SID. */
1946                 wake_up_interruptible(&current->parent->wait_chldexit);
1947
1948 lock_out:
1949                 task_lock(current);
1950                 return;
1951         }
1952 }
1953
1954 /* superblock security operations */
1955
1956 static int selinux_sb_alloc_security(struct super_block *sb)
1957 {
1958         return superblock_alloc_security(sb);
1959 }
1960
1961 static void selinux_sb_free_security(struct super_block *sb)
1962 {
1963         superblock_free_security(sb);
1964 }
1965
1966 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1967 {
1968         if (plen > olen)
1969                 return 0;
1970
1971         return !memcmp(prefix, option, plen);
1972 }
1973
1974 static inline int selinux_option(char *option, int len)
1975 {
1976         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1977                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1978                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1979 }
1980
1981 static inline void take_option(char **to, char *from, int *first, int len)
1982 {
1983         if (!*first) {
1984                 **to = ',';
1985                 *to += 1;
1986         }
1987         else
1988                 *first = 0;
1989         memcpy(*to, from, len);
1990         *to += len;
1991 }
1992
1993 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1994 {
1995         int fnosec, fsec, rc = 0;
1996         char *in_save, *in_curr, *in_end;
1997         char *sec_curr, *nosec_save, *nosec;
1998
1999         in_curr = orig;
2000         sec_curr = copy;
2001
2002         /* Binary mount data: just copy */
2003         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2004                 copy_page(sec_curr, in_curr);
2005                 goto out;
2006         }
2007
2008         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2009         if (!nosec) {
2010                 rc = -ENOMEM;
2011                 goto out;
2012         }
2013
2014         nosec_save = nosec;
2015         fnosec = fsec = 1;
2016         in_save = in_end = orig;
2017
2018         do {
2019                 if (*in_end == ',' || *in_end == '\0') {
2020                         int len = in_end - in_curr;
2021
2022                         if (selinux_option(in_curr, len))
2023                                 take_option(&sec_curr, in_curr, &fsec, len);
2024                         else
2025                                 take_option(&nosec, in_curr, &fnosec, len);
2026
2027                         in_curr = in_end + 1;
2028                 }
2029         } while (*in_end++);
2030
2031         copy_page(in_save, nosec_save);
2032 out:
2033         return rc;
2034 }
2035
2036 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2037 {
2038         struct avc_audit_data ad;
2039         int rc;
2040
2041         rc = superblock_doinit(sb, data);
2042         if (rc)
2043                 return rc;
2044
2045         AVC_AUDIT_DATA_INIT(&ad,FS);
2046         ad.u.fs.dentry = sb->s_root;
2047         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2048 }
2049
2050 static int selinux_sb_statfs(struct super_block *sb)
2051 {
2052         struct avc_audit_data ad;
2053
2054         AVC_AUDIT_DATA_INIT(&ad,FS);
2055         ad.u.fs.dentry = sb->s_root;
2056         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
2057 }
2058
2059 static int selinux_mount(char * dev_name,
2060                          struct nameidata *nd,
2061                          char * type,
2062                          unsigned long flags,
2063                          void * data)
2064 {
2065         int rc;
2066
2067         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2068         if (rc)
2069                 return rc;
2070
2071         if (flags & MS_REMOUNT)
2072                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2073                                            FILESYSTEM__REMOUNT, NULL);
2074         else
2075                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2076                                        FILE__MOUNTON);
2077 }
2078
2079 static int selinux_umount(struct vfsmount *mnt, int flags)
2080 {
2081         int rc;
2082
2083         rc = secondary_ops->sb_umount(mnt, flags);
2084         if (rc)
2085                 return rc;
2086
2087         return superblock_has_perm(current,mnt->mnt_sb,
2088                                    FILESYSTEM__UNMOUNT,NULL);
2089 }
2090
2091 /* inode security operations */
2092
2093 static int selinux_inode_alloc_security(struct inode *inode)
2094 {
2095         return inode_alloc_security(inode);
2096 }
2097
2098 static void selinux_inode_free_security(struct inode *inode)
2099 {
2100         inode_free_security(inode);
2101 }
2102
2103 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2104 {
2105         return may_create(dir, dentry, SECCLASS_FILE);
2106 }
2107
2108 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2109 {
2110         post_create(dir, dentry);
2111 }
2112
2113 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2114 {
2115         int rc;
2116
2117         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2118         if (rc)
2119                 return rc;
2120         return may_link(dir, old_dentry, MAY_LINK);
2121 }
2122
2123 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2124 {
2125         return;
2126 }
2127
2128 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2129 {
2130         int rc;
2131
2132         rc = secondary_ops->inode_unlink(dir, dentry);
2133         if (rc)
2134                 return rc;
2135         return may_link(dir, dentry, MAY_UNLINK);
2136 }
2137
2138 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2139 {
2140         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2141 }
2142
2143 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2144 {
2145         post_create(dir, dentry);
2146 }
2147
2148 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2149 {
2150         return may_create(dir, dentry, SECCLASS_DIR);
2151 }
2152
2153 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2154 {
2155         post_create(dir, dentry);
2156 }
2157
2158 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2159 {
2160         return may_link(dir, dentry, MAY_RMDIR);
2161 }
2162
2163 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2164 {
2165         int rc;
2166
2167         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2168         if (rc)
2169                 return rc;
2170
2171         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2172 }
2173
2174 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2175 {
2176         post_create(dir, dentry);
2177 }
2178
2179 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2180                                 struct inode *new_inode, struct dentry *new_dentry)
2181 {
2182         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2183 }
2184
2185 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2186                                       struct inode *new_inode, struct dentry *new_dentry)
2187 {
2188         return;
2189 }
2190
2191 static int selinux_inode_readlink(struct dentry *dentry)
2192 {
2193         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2194 }
2195
2196 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2197 {
2198         int rc;
2199
2200         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2201         if (rc)
2202                 return rc;
2203         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2204 }
2205
2206 static int selinux_inode_permission(struct inode *inode, int mask,
2207                                     struct nameidata *nd)
2208 {
2209         int rc;
2210
2211         rc = secondary_ops->inode_permission(inode, mask, nd);
2212         if (rc)
2213                 return rc;
2214
2215         if (!mask) {
2216                 /* No permission to check.  Existence test. */
2217                 return 0;
2218         }
2219
2220         return inode_has_perm(current, inode,
2221                                file_mask_to_av(inode->i_mode, mask), NULL, NULL);
2222 }
2223
2224 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2225 {
2226         int rc;
2227
2228         rc = secondary_ops->inode_setattr(dentry, iattr);
2229         if (rc)
2230                 return rc;
2231
2232         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2233                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2234                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2235
2236         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2237 }
2238
2239 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2240 {
2241         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2242 }
2243
2244 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2245 {
2246         struct task_security_struct *tsec = current->security;
2247         struct inode *inode = dentry->d_inode;
2248         struct inode_security_struct *isec = inode->i_security;
2249         struct superblock_security_struct *sbsec;
2250         struct avc_audit_data ad;
2251         u32 newsid;
2252         int rc = 0;
2253
2254         if (strcmp(name, XATTR_NAME_SELINUX)) {
2255                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2256                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2257                     !capable(CAP_SYS_ADMIN)) {
2258                         /* A different attribute in the security namespace.
2259                            Restrict to administrator. */
2260                         return -EPERM;
2261                 }
2262
2263                 /* Not an attribute we recognize, so just check the
2264                    ordinary setattr permission. */
2265                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2266         }
2267
2268         sbsec = inode->i_sb->s_security;
2269         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2270                 return -EOPNOTSUPP;
2271
2272         AVC_AUDIT_DATA_INIT(&ad,FS);
2273         ad.u.fs.dentry = dentry;
2274
2275         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2276                           FILE__RELABELFROM,
2277                           &isec->avcr, &ad);
2278         if (rc)
2279                 return rc;
2280
2281         rc = security_context_to_sid(value, size, &newsid);
2282         if (rc)
2283                 return rc;
2284
2285         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2286                           FILE__RELABELTO, NULL, &ad);
2287         if (rc)
2288                 return rc;
2289
2290         return avc_has_perm(newsid,
2291                             sbsec->sid,
2292                             SECCLASS_FILESYSTEM,
2293                             FILESYSTEM__ASSOCIATE,
2294                             NULL,
2295                             &ad);
2296 }
2297
2298 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2299                                         void *value, size_t size, int flags)
2300 {
2301         struct inode *inode = dentry->d_inode;
2302         struct inode_security_struct *isec = inode->i_security;
2303         u32 newsid;
2304         int rc;
2305
2306         if (strcmp(name, XATTR_NAME_SELINUX)) {
2307                 /* Not an attribute we recognize, so nothing to do. */
2308                 return;
2309         }
2310
2311         rc = security_context_to_sid(value, size, &newsid);
2312         if (rc) {
2313                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2314                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2315                 return;
2316         }
2317
2318         isec->sid = newsid;
2319         return;
2320 }
2321
2322 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2323 {
2324         struct inode *inode = dentry->d_inode;
2325         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2326
2327         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2328                 return -EOPNOTSUPP;
2329
2330         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2331 }
2332
2333 static int selinux_inode_listxattr (struct dentry *dentry)
2334 {
2335         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2336 }
2337
2338 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2339 {
2340         if (strcmp(name, XATTR_NAME_SELINUX)) {
2341                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2342                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2343                     !capable(CAP_SYS_ADMIN)) {
2344                         /* A different attribute in the security namespace.
2345                            Restrict to administrator. */
2346                         return -EPERM;
2347                 }
2348
2349                 /* Not an attribute we recognize, so just check the
2350                    ordinary setattr permission. Might want a separate
2351                    permission for removexattr. */
2352                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2353         }
2354
2355         /* No one is allowed to remove a SELinux security label.
2356            You can change the label, but all data must be labeled. */
2357         return -EACCES;
2358 }
2359
2360 static int selinux_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size)
2361 {
2362         struct inode *inode = dentry->d_inode;
2363         struct inode_security_struct *isec = inode->i_security;
2364         char *context;
2365         unsigned len;
2366         int rc;
2367
2368         /* Permission check handled by selinux_inode_getxattr hook.*/
2369
2370         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2371                 return -EOPNOTSUPP;
2372
2373         rc = security_sid_to_context(isec->sid, &context, &len);
2374         if (rc)
2375                 return rc;
2376
2377         if (!buffer || !size) {
2378                 kfree(context);
2379                 return len;
2380         }
2381         if (size < len) {
2382                 kfree(context);
2383                 return -ERANGE;
2384         }
2385         memcpy(buffer, context, len);
2386         kfree(context);
2387         return len;
2388 }
2389
2390 static int selinux_inode_setsecurity(struct dentry *dentry, const char *name,
2391                                      const void *value, size_t size, int flags)
2392 {
2393         struct inode *inode = dentry->d_inode;
2394         struct inode_security_struct *isec = inode->i_security;
2395         u32 newsid;
2396         int rc;
2397
2398         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2399                 return -EOPNOTSUPP;
2400
2401         if (!value || !size)
2402                 return -EACCES;
2403
2404         rc = security_context_to_sid((void*)value, size, &newsid);
2405         if (rc)
2406                 return rc;
2407
2408         isec->sid = newsid;
2409         return 0;
2410 }
2411
2412 static int selinux_inode_listsecurity(struct dentry *dentry, char *buffer)
2413 {
2414         const int len = sizeof(XATTR_NAME_SELINUX);
2415         if (buffer)
2416                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2417         return len;
2418 }
2419
2420 /* file security operations */
2421
2422 static int selinux_file_permission(struct file *file, int mask)
2423 {
2424         struct inode *inode = file->f_dentry->d_inode;
2425
2426         if (!mask) {
2427                 /* No permission to check.  Existence test. */
2428                 return 0;
2429         }
2430
2431         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2432         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2433                 mask |= MAY_APPEND;
2434
2435         return file_has_perm(current, file,
2436                              file_mask_to_av(inode->i_mode, mask));
2437 }
2438
2439 static int selinux_file_alloc_security(struct file *file)
2440 {
2441         return file_alloc_security(file);
2442 }
2443
2444 static void selinux_file_free_security(struct file *file)
2445 {
2446         file_free_security(file);
2447 }
2448
2449 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2450                               unsigned long arg)
2451 {
2452         int error = 0;
2453
2454         switch (cmd) {
2455                 case FIONREAD:
2456                 /* fall through */
2457                 case FIBMAP:
2458                 /* fall through */
2459                 case FIGETBSZ:
2460                 /* fall through */
2461                 case EXT2_IOC_GETFLAGS:
2462                 /* fall through */
2463                 case EXT2_IOC_GETVERSION:
2464                         error = file_has_perm(current, file, FILE__GETATTR);
2465                         break;
2466
2467                 case EXT2_IOC_SETFLAGS:
2468                 /* fall through */
2469                 case EXT2_IOC_SETVERSION:
2470                         error = file_has_perm(current, file, FILE__SETATTR);
2471                         break;
2472
2473                 /* sys_ioctl() checks */
2474                 case FIONBIO:
2475                 /* fall through */
2476                 case FIOASYNC:
2477                         error = file_has_perm(current, file, 0);
2478                         break;
2479
2480                 case KDSKBENT:
2481                 case KDSKBSENT:
2482                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2483                         break;
2484
2485                 /* default case assumes that the command will go
2486                  * to the file's ioctl() function.
2487                  */
2488                 default:
2489                         error = file_has_perm(current, file, FILE__IOCTL);
2490
2491         }
2492         return error;
2493 }
2494
2495 static int selinux_file_mmap(struct file *file, unsigned long prot, unsigned long flags)
2496 {
2497         u32 av;
2498         int rc;
2499
2500         rc = secondary_ops->file_mmap(file, prot, flags);
2501         if (rc)
2502                 return rc;
2503
2504         if (file) {
2505                 /* read access is always possible with a mapping */
2506                 av = FILE__READ;
2507
2508                 /* write access only matters if the mapping is shared */
2509                 if ((flags & MAP_TYPE) == MAP_SHARED && (prot & PROT_WRITE))
2510                         av |= FILE__WRITE;
2511
2512                 if (prot & PROT_EXEC)
2513                         av |= FILE__EXECUTE;
2514
2515                 return file_has_perm(current, file, av);
2516         }
2517         return 0;
2518 }
2519
2520 static int selinux_file_mprotect(struct vm_area_struct *vma,
2521                                  unsigned long prot)
2522 {
2523         int rc;
2524
2525         rc = secondary_ops->file_mprotect(vma, prot);
2526         if (rc)
2527                 return rc;
2528
2529         return selinux_file_mmap(vma->vm_file, prot, vma->vm_flags);
2530 }
2531
2532 static int selinux_file_lock(struct file *file, unsigned int cmd)
2533 {
2534         return file_has_perm(current, file, FILE__LOCK);
2535 }
2536
2537 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2538                               unsigned long arg)
2539 {
2540         int err = 0;
2541
2542         switch (cmd) {
2543                 case F_SETFL:
2544                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2545                                 err = -EINVAL;
2546                                 break;
2547                         }
2548
2549                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2550                                 err = file_has_perm(current, file,FILE__WRITE);
2551                                 break;
2552                         }
2553                         /* fall through */
2554                 case F_SETOWN:
2555                 case F_SETSIG:
2556                 case F_GETFL:
2557                 case F_GETOWN:
2558                 case F_GETSIG:
2559                         /* Just check FD__USE permission */
2560                         err = file_has_perm(current, file, 0);
2561                         break;
2562                 case F_GETLK:
2563                 case F_SETLK:
2564                 case F_SETLKW:
2565 #if BITS_PER_LONG == 32
2566                 case F_GETLK64:
2567                 case F_SETLK64:
2568                 case F_SETLKW64:
2569 #endif
2570                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2571                                 err = -EINVAL;
2572                                 break;
2573                         }
2574                         err = file_has_perm(current, file, FILE__LOCK);
2575                         break;
2576         }
2577
2578         return err;
2579 }
2580
2581 static int selinux_file_set_fowner(struct file *file)
2582 {
2583         struct task_security_struct *tsec;
2584         struct file_security_struct *fsec;
2585
2586         tsec = current->security;
2587         fsec = file->f_security;
2588         fsec->fown_sid = tsec->sid;
2589
2590         return 0;
2591 }
2592
2593 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2594                                        struct fown_struct *fown,
2595                                        int fd, int reason)
2596 {
2597         struct file *file;
2598         u32 perm;
2599         struct task_security_struct *tsec;
2600         struct file_security_struct *fsec;
2601
2602         /* struct fown_struct is never outside the context of a struct file */
2603         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2604
2605         tsec = tsk->security;
2606         fsec = file->f_security;
2607
2608         if (!fown->signum)
2609                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2610         else
2611                 perm = signal_to_av(fown->signum);
2612
2613         return avc_has_perm(fsec->fown_sid, tsec->sid,
2614                             SECCLASS_PROCESS, perm, NULL, NULL);
2615 }
2616
2617 static int selinux_file_receive(struct file *file)
2618 {
2619         return file_has_perm(current, file, file_to_av(file));
2620 }
2621
2622 /* task security operations */
2623
2624 static int selinux_task_create(unsigned long clone_flags)
2625 {
2626         int rc;
2627
2628         rc = secondary_ops->task_create(clone_flags);
2629         if (rc)
2630                 return rc;
2631
2632         return task_has_perm(current, current, PROCESS__FORK);
2633 }
2634
2635 static int selinux_task_alloc_security(struct task_struct *tsk)
2636 {
2637         struct task_security_struct *tsec1, *tsec2;
2638         int rc;
2639
2640         tsec1 = current->security;
2641
2642         rc = task_alloc_security(tsk);
2643         if (rc)
2644                 return rc;
2645         tsec2 = tsk->security;
2646
2647         tsec2->osid = tsec1->osid;
2648         tsec2->sid = tsec1->sid;
2649
2650         /* Retain the exec and create SIDs across fork */
2651         tsec2->exec_sid = tsec1->exec_sid;
2652         tsec2->create_sid = tsec1->create_sid;
2653
2654         return 0;
2655 }
2656
2657 static void selinux_task_free_security(struct task_struct *tsk)
2658 {
2659         task_free_security(tsk);
2660 }
2661
2662 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2663 {
2664         /* Since setuid only affects the current process, and
2665            since the SELinux controls are not based on the Linux
2666            identity attributes, SELinux does not need to control
2667            this operation.  However, SELinux does control the use
2668            of the CAP_SETUID and CAP_SETGID capabilities using the
2669            capable hook. */
2670         return 0;
2671 }
2672
2673 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2674 {
2675         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2676 }
2677
2678 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2679 {
2680         /* See the comment for setuid above. */
2681         return 0;
2682 }
2683
2684 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2685 {
2686         return task_has_perm(current, p, PROCESS__SETPGID);
2687 }
2688
2689 static int selinux_task_getpgid(struct task_struct *p)
2690 {
2691         return task_has_perm(current, p, PROCESS__GETPGID);
2692 }
2693
2694 static int selinux_task_getsid(struct task_struct *p)
2695 {
2696         return task_has_perm(current, p, PROCESS__GETSESSION);
2697 }
2698
2699 static int selinux_task_setgroups(struct group_info *group_info)
2700 {
2701         /* See the comment for setuid above. */
2702         return 0;
2703 }
2704
2705 static int selinux_task_setnice(struct task_struct *p, int nice)
2706 {
2707         int rc;
2708
2709         rc = secondary_ops->task_setnice(p, nice);
2710         if (rc)
2711                 return rc;
2712
2713         return task_has_perm(current,p, PROCESS__SETSCHED);
2714 }
2715
2716 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2717 {
2718         struct rlimit *old_rlim = current->rlim + resource;
2719         int rc;
2720
2721         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2722         if (rc)
2723                 return rc;
2724
2725         /* Control the ability to change the hard limit (whether
2726            lowering or raising it), so that the hard limit can
2727            later be used as a safe reset point for the soft limit
2728            upon context transitions. See selinux_bprm_apply_creds. */
2729         if (old_rlim->rlim_max != new_rlim->rlim_max)
2730                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2731
2732         return 0;
2733 }
2734
2735 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2736 {
2737         struct task_security_struct *tsec1, *tsec2;
2738
2739         tsec1 = current->security;
2740         tsec2 = p->security;
2741
2742         /* No auditing from the setscheduler hook, since the runqueue lock
2743            is held and the system will deadlock if we try to log an audit
2744            message. */
2745         return avc_has_perm_noaudit(tsec1->sid, tsec2->sid,
2746                                     SECCLASS_PROCESS, PROCESS__SETSCHED,
2747                                     &tsec2->avcr, NULL);
2748 }
2749
2750 static int selinux_task_getscheduler(struct task_struct *p)
2751 {
2752         return task_has_perm(current, p, PROCESS__GETSCHED);
2753 }
2754
2755 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2756 {
2757         u32 perm;
2758         int rc;
2759
2760         rc = secondary_ops->task_kill(p, info, sig);
2761         if (rc)
2762                 return rc;
2763
2764         if (info && ((unsigned long)info == 1 ||
2765                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2766                 return 0;
2767
2768         if (!sig)
2769                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2770         else
2771                 perm = signal_to_av(sig);
2772
2773         return task_has_perm(current, p, perm);
2774 }
2775
2776 static int selinux_task_prctl(int option,
2777                               unsigned long arg2,
2778                               unsigned long arg3,
2779                               unsigned long arg4,
2780                               unsigned long arg5)
2781 {
2782         /* The current prctl operations do not appear to require
2783            any SELinux controls since they merely observe or modify
2784            the state of the current process. */
2785         return 0;
2786 }
2787
2788 static int selinux_task_wait(struct task_struct *p)
2789 {
2790         u32 perm;
2791
2792         perm = signal_to_av(p->exit_signal);
2793
2794         return task_has_perm(p, current, perm);
2795 }
2796
2797 static void selinux_task_reparent_to_init(struct task_struct *p)
2798 {
2799         struct task_security_struct *tsec;
2800
2801         secondary_ops->task_reparent_to_init(p);
2802
2803         tsec = p->security;
2804         tsec->osid = tsec->sid;
2805         tsec->sid = SECINITSID_KERNEL;
2806         return;
2807 }
2808
2809 static void selinux_task_to_inode(struct task_struct *p,
2810                                   struct inode *inode)
2811 {
2812         struct task_security_struct *tsec = p->security;
2813         struct inode_security_struct *isec = inode->i_security;
2814
2815         isec->sid = tsec->sid;
2816         isec->initialized = 1;
2817         return;
2818 }
2819
2820 #ifdef CONFIG_SECURITY_NETWORK
2821
2822 /* Returns error only if unable to parse addresses */
2823 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2824 {
2825         int offset, ihlen, ret;
2826         struct iphdr _iph, *ih;
2827
2828         offset = skb->nh.raw - skb->data;
2829         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2830         if (ih == NULL)
2831                 goto out;
2832
2833         ihlen = ih->ihl * 4;
2834         if (ihlen < sizeof(_iph))
2835                 goto out;
2836
2837         ad->u.net.v4info.saddr = ih->saddr;
2838         ad->u.net.v4info.daddr = ih->daddr;
2839
2840         switch (ih->protocol) {
2841         case IPPROTO_TCP: {
2842                 struct tcphdr _tcph, *th;
2843
2844                 if (ntohs(ih->frag_off) & IP_OFFSET)
2845                         break;
2846
2847                 offset += ihlen;
2848                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2849                 if (th == NULL)
2850                         break;
2851
2852                 ad->u.net.sport = th->source;
2853                 ad->u.net.dport = th->dest;
2854                 break;
2855         }
2856
2857         case IPPROTO_UDP: {
2858                 struct udphdr _udph, *uh;
2859
2860                 if (ntohs(ih->frag_off) & IP_OFFSET)
2861                         break;
2862
2863                 offset += ihlen;
2864                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2865                 if (uh == NULL)
2866                         break;
2867
2868                 ad->u.net.sport = uh->source;
2869                 ad->u.net.dport = uh->dest;
2870                 break;
2871         }
2872
2873         default:
2874                 break;
2875         }
2876 out:
2877         return ret;
2878 }
2879
2880 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2881
2882 /* Returns error only if unable to parse addresses */
2883 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2884 {
2885         u8 nexthdr;
2886         int ret, offset;
2887         struct ipv6hdr _ipv6h, *ip6;
2888
2889         offset = skb->nh.raw - skb->data;
2890         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2891         if (ip6 == NULL)
2892                 goto out;
2893
2894         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2895         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2896
2897         nexthdr = ip6->nexthdr;
2898         offset += sizeof(_ipv6h);
2899         offset = ipv6_skip_exthdr(skb, offset, &nexthdr,
2900                                   skb->tail - skb->head - offset);
2901         if (offset < 0)
2902                 goto out;
2903
2904         switch (nexthdr) {
2905         case IPPROTO_TCP: {
2906                 struct tcphdr _tcph, *th;
2907
2908                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2909                 if (th == NULL)
2910                         break;
2911
2912                 ad->u.net.sport = th->source;
2913                 ad->u.net.dport = th->dest;
2914                 break;
2915         }
2916
2917         case IPPROTO_UDP: {
2918                 struct udphdr _udph, *uh;
2919
2920                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2921                 if (uh == NULL)
2922                         break;
2923
2924                 ad->u.net.sport = uh->source;
2925                 ad->u.net.dport = uh->dest;
2926                 break;
2927         }
2928
2929         /* includes fragments */
2930         default:
2931                 break;
2932         }
2933 out:
2934         return ret;
2935 }
2936
2937 #endif /* IPV6 */
2938
2939 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2940                              char **addrp, int *len, int src)
2941 {
2942         int ret = 0;
2943
2944         switch (ad->u.net.family) {
2945         case PF_INET:
2946                 ret = selinux_parse_skb_ipv4(skb, ad);
2947                 if (ret || !addrp)
2948                         break;
2949                 *len = 4;
2950                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2951                                         &ad->u.net.v4info.daddr);
2952                 break;
2953
2954 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2955         case PF_INET6:
2956                 ret = selinux_parse_skb_ipv6(skb, ad);
2957                 if (ret || !addrp)
2958                         break;
2959                 *len = 16;
2960                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2961                                         &ad->u.net.v6info.daddr);
2962                 break;
2963 #endif  /* IPV6 */
2964         default:
2965                 break;
2966         }
2967
2968         return ret;
2969 }
2970
2971 /* socket security operations */
2972 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2973                            u32 perms)
2974 {
2975         struct inode_security_struct *isec;
2976         struct task_security_struct *tsec;
2977         struct avc_audit_data ad;
2978         int err = 0;
2979
2980         tsec = task->security;
2981         isec = SOCK_INODE(sock)->i_security;
2982
2983         if (isec->sid == SECINITSID_KERNEL)
2984                 goto out;
2985
2986         AVC_AUDIT_DATA_INIT(&ad,NET);
2987         ad.u.net.sk = sock->sk;
2988         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2989                            perms, &isec->avcr, &ad);
2990
2991 out:
2992         return err;
2993 }
2994
2995 static int selinux_socket_create(int family, int type,
2996                                  int protocol, int kern)
2997 {
2998         int err = 0;
2999         struct task_security_struct *tsec;
3000
3001         if (kern)
3002                 goto out;
3003
3004         tsec = current->security;
3005         err = avc_has_perm(tsec->sid, tsec->sid,
3006                            socket_type_to_security_class(family, type,
3007                            protocol), SOCKET__CREATE, NULL, NULL);
3008
3009 out:
3010         return err;
3011 }
3012
3013 static void selinux_socket_post_create(struct socket *sock, int family,
3014                                        int type, int protocol, int kern)
3015 {
3016         int err;
3017         struct inode_security_struct *isec;
3018         struct task_security_struct *tsec;
3019
3020         err = inode_doinit(SOCK_INODE(sock));
3021         if (err < 0)
3022                 return;
3023         isec = SOCK_INODE(sock)->i_security;
3024
3025         tsec = current->security;
3026         isec->sclass = socket_type_to_security_class(family, type, protocol);
3027         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3028
3029         return;
3030 }
3031
3032 /* Range of port numbers used to automatically bind.
3033    Need to determine whether we should perform a name_bind
3034    permission check between the socket and the port number. */
3035 #define ip_local_port_range_0 sysctl_local_port_range[0]
3036 #define ip_local_port_range_1 sysctl_local_port_range[1]
3037
3038 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3039 {
3040         u16 family;
3041         int err;
3042
3043         err = socket_has_perm(current, sock, SOCKET__BIND);
3044         if (err)
3045                 goto out;
3046
3047         /*
3048          * If PF_INET or PF_INET6, check name_bind permission for the port.
3049          */
3050         family = sock->sk->sk_family;
3051         if (family == PF_INET || family == PF_INET6) {
3052                 char *addrp;
3053                 struct inode_security_struct *isec;
3054                 struct task_security_struct *tsec;
3055                 struct avc_audit_data ad;
3056                 struct sockaddr_in *addr4 = NULL;
3057                 struct sockaddr_in6 *addr6 = NULL;
3058                 unsigned short snum;
3059                 struct sock *sk = sock->sk;
3060                 u32 sid, node_perm, addrlen;
3061
3062                 tsec = current->security;
3063                 isec = SOCK_INODE(sock)->i_security;
3064
3065                 if (family == PF_INET) {
3066                         addr4 = (struct sockaddr_in *)address;
3067                         snum = ntohs(addr4->sin_port);
3068                         addrlen = sizeof(addr4->sin_addr.s_addr);
3069                         addrp = (char *)&addr4->sin_addr.s_addr;
3070                 } else {
3071                         addr6 = (struct sockaddr_in6 *)address;
3072                         snum = ntohs(addr6->sin6_port);
3073                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3074                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3075                 }
3076
3077                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3078                            snum > ip_local_port_range_1)) {
3079                         err = security_port_sid(sk->sk_family, sk->sk_type,
3080                                                 sk->sk_protocol, snum, &sid);
3081                         if (err)
3082                                 goto out;
3083                         AVC_AUDIT_DATA_INIT(&ad,NET);
3084                         ad.u.net.sport = htons(snum);
3085                         err = avc_has_perm(isec->sid, sid,
3086                                            isec->sclass,
3087                                            SOCKET__NAME_BIND, NULL, &ad);
3088                         if (err)
3089                                 goto out;
3090                 }
3091
3092                 switch(sk->sk_protocol) {
3093                 case IPPROTO_TCP:
3094                         node_perm = TCP_SOCKET__NODE_BIND;
3095                         break;
3096
3097                 case IPPROTO_UDP:
3098                         node_perm = UDP_SOCKET__NODE_BIND;
3099                         break;
3100
3101                 default:
3102                         node_perm = RAWIP_SOCKET__NODE_BIND;
3103                         break;
3104                 }
3105
3106                 err = security_node_sid(family, addrp, addrlen, &sid);
3107                 if (err)
3108                         goto out;
3109
3110                 AVC_AUDIT_DATA_INIT(&ad,NET);
3111                 ad.u.net.sport = htons(snum);
3112                 ad.u.net.family = family;
3113
3114                 if (family == PF_INET)
3115                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3116                 else
3117                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3118
3119                 err = avc_has_perm(isec->sid, sid,
3120                                    isec->sclass, node_perm, NULL, &ad);
3121                 if (err)
3122                         goto out;
3123         }
3124 out:
3125         return err;
3126 }
3127
3128 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3129 {
3130         return socket_has_perm(current, sock, SOCKET__CONNECT);
3131 }
3132
3133 static int selinux_socket_listen(struct socket *sock, int backlog)
3134 {
3135         return socket_has_perm(current, sock, SOCKET__LISTEN);
3136 }
3137
3138 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3139 {
3140         int err;
3141         struct inode_security_struct *isec;
3142         struct inode_security_struct *newisec;
3143
3144         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3145         if (err)
3146                 return err;
3147
3148         err = inode_doinit(SOCK_INODE(newsock));
3149         if (err < 0)
3150                 return err;
3151         newisec = SOCK_INODE(newsock)->i_security;
3152
3153         isec = SOCK_INODE(sock)->i_security;
3154         newisec->sclass = isec->sclass;
3155         newisec->sid = isec->sid;
3156
3157         return 0;
3158 }
3159
3160 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3161                                   int size)
3162 {
3163         return socket_has_perm(current, sock, SOCKET__WRITE);
3164 }
3165
3166 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3167                                   int size, int flags)
3168 {
3169         return socket_has_perm(current, sock, SOCKET__READ);
3170 }
3171
3172 static int selinux_socket_getsockname(struct socket *sock)
3173 {
3174         return socket_has_perm(current, sock, SOCKET__GETATTR);
3175 }
3176
3177 static int selinux_socket_getpeername(struct socket *sock)
3178 {
3179         return socket_has_perm(current, sock, SOCKET__GETATTR);
3180 }
3181
3182 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3183 {
3184         return socket_has_perm(current, sock, SOCKET__SETOPT);
3185 }
3186
3187 static int selinux_socket_getsockopt(struct socket *sock, int level,
3188                                      int optname)
3189 {
3190         return socket_has_perm(current, sock, SOCKET__GETOPT);
3191 }
3192
3193 static int selinux_socket_shutdown(struct socket *sock, int how)
3194 {
3195         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3196 }
3197
3198 static int selinux_socket_unix_stream_connect(struct socket *sock,
3199                                               struct socket *other,
3200                                               struct sock *newsk)
3201 {
3202         struct sk_security_struct *ssec;
3203         struct inode_security_struct *isec;
3204         struct inode_security_struct *other_isec;
3205         struct avc_audit_data ad;
3206         int err;
3207
3208         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3209         if (err)
3210                 return err;
3211
3212         isec = SOCK_INODE(sock)->i_security;
3213         other_isec = SOCK_INODE(other)->i_security;
3214
3215         AVC_AUDIT_DATA_INIT(&ad,NET);
3216         ad.u.net.sk = other->sk;
3217
3218         err = avc_has_perm(isec->sid, other_isec->sid,
3219                            isec->sclass,
3220                            UNIX_STREAM_SOCKET__CONNECTTO,
3221                            &other_isec->avcr, &ad);
3222         if (err)
3223                 return err;
3224
3225         /* connecting socket */
3226         ssec = sock->sk->sk_security;
3227         ssec->peer_sid = other_isec->sid;
3228
3229         /* server child socket */
3230         ssec = newsk->sk_security;
3231         ssec->peer_sid = isec->sid;
3232
3233         return 0;
3234 }
3235
3236 static int selinux_socket_unix_may_send(struct socket *sock,
3237                                         struct socket *other)
3238 {
3239         struct inode_security_struct *isec;
3240         struct inode_security_struct *other_isec;
3241         struct avc_audit_data ad;
3242         int err;
3243
3244         isec = SOCK_INODE(sock)->i_security;
3245         other_isec = SOCK_INODE(other)->i_security;
3246
3247         AVC_AUDIT_DATA_INIT(&ad,NET);
3248         ad.u.net.sk = other->sk;
3249
3250         err = avc_has_perm(isec->sid, other_isec->sid,
3251                            isec->sclass,
3252                            SOCKET__SENDTO,
3253                            &other_isec->avcr, &ad);
3254         if (err)
3255                 return err;
3256
3257         return 0;
3258 }
3259
3260 static int __selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3261 {
3262         u16 family;
3263         char *addrp;
3264         int len, err = 0;
3265         u32 netif_perm, node_perm, node_sid, recv_perm = 0;
3266         u32 sock_sid = 0;
3267         u16 sock_class = 0;
3268         struct socket *sock;
3269         struct net_device *dev;
3270         struct sel_netif *netif;
3271         struct netif_security_struct *nsec;
3272         struct avc_audit_data ad;
3273
3274         family = sk->sk_family;
3275         if (family != PF_INET && family != PF_INET6)
3276                 goto out;
3277
3278         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3279         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3280                 family = PF_INET;
3281
3282         read_lock_bh(&sk->sk_callback_lock);
3283         sock = sk->sk_socket;
3284         if (sock) {
3285                 struct inode *inode;
3286                 inode = SOCK_INODE(sock);
3287                 if (inode) {
3288                         struct inode_security_struct *isec;
3289                         isec = inode->i_security;
3290                         sock_sid = isec->sid;
3291                         sock_class = isec->sclass;
3292                 }
3293         }
3294         read_unlock_bh(&sk->sk_callback_lock);
3295         if (!sock_sid)
3296                 goto out;
3297
3298         dev = skb->dev;
3299         if (!dev)
3300                 goto out;
3301
3302         netif = sel_netif_lookup(dev);
3303         if (IS_ERR(netif)) {
3304                 err = PTR_ERR(netif);
3305                 goto out;
3306         }
3307
3308         nsec = &netif->nsec;
3309
3310         switch (sock_class) {
3311         case SECCLASS_UDP_SOCKET:
3312                 netif_perm = NETIF__UDP_RECV;
3313                 node_perm = NODE__UDP_RECV;
3314                 recv_perm = UDP_SOCKET__RECV_MSG;
3315                 break;
3316
3317         case SECCLASS_TCP_SOCKET:
3318                 netif_perm = NETIF__TCP_RECV;
3319                 node_perm = NODE__TCP_RECV;
3320                 recv_perm = TCP_SOCKET__RECV_MSG;
3321                 break;
3322
3323         default:
3324                 netif_perm = NETIF__RAWIP_RECV;
3325                 node_perm = NODE__RAWIP_RECV;
3326                 break;
3327         }
3328
3329         AVC_AUDIT_DATA_INIT(&ad, NET);
3330         ad.u.net.netif = dev->name;
3331         ad.u.net.family = family;
3332
3333         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3334         if (err) {
3335                 sel_netif_put(netif);
3336                 goto out;
3337         }
3338
3339         err = avc_has_perm(sock_sid, nsec->if_sid, SECCLASS_NETIF,
3340                            netif_perm, &nsec->avcr, &ad);
3341         sel_netif_put(netif);
3342         if (err)
3343                 goto out;
3344
3345         /* Fixme: this lookup is inefficient */
3346         err = security_node_sid(family, addrp, len, &node_sid);
3347         if (err)
3348                 goto out;
3349
3350         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);
3351         if (err)
3352                 goto out;
3353
3354         if (recv_perm) {
3355                 u32 port_sid;
3356
3357                 /* Fixme: make this more efficient */
3358                 err = security_port_sid(sk->sk_family, sk->sk_type,
3359                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3360                                         &port_sid);
3361                 if (err)
3362                         goto out;
3363
3364                 err = avc_has_perm(sock_sid, port_sid, sock_class,
3365                                    recv_perm, NULL, &ad);
3366         }
3367 out:
3368         return err;
3369 }
3370
3371 /* To make sure sk->sk_socket doesn't disappear while we mess
3372  * with this skb, we need to take sk_callback_lock.
3373  * See sock_orphan()
3374  */
3375 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3376 {
3377         int res;
3378
3379         read_lock_bh(&sk->sk_callback_lock);
3380         res = __selinux_socket_sock_rcv_skb(sk, skb);
3381         read_unlock_bh(&sk->sk_callback_lock);
3382         return res;
3383 }
3384
3385 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3386                                      int __user *optlen, unsigned len)
3387 {
3388         int err = 0;
3389         char *scontext;
3390         u32 scontext_len;
3391         struct sk_security_struct *ssec;
3392         struct inode_security_struct *isec;
3393
3394         isec = SOCK_INODE(sock)->i_security;
3395         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3396                 err = -ENOPROTOOPT;
3397                 goto out;
3398         }
3399
3400         ssec = sock->sk->sk_security;
3401
3402         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3403         if (err)
3404                 goto out;
3405
3406         if (scontext_len > len) {
3407                 err = -ERANGE;
3408                 goto out_len;
3409         }
3410
3411         if (copy_to_user(optval, scontext, scontext_len))
3412                 err = -EFAULT;
3413
3414 out_len:
3415         if (put_user(scontext_len, optlen))
3416                 err = -EFAULT;
3417
3418         kfree(scontext);
3419 out:
3420         return err;
3421 }
3422
3423 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3424 {
3425         return sk_alloc_security(sk, family, priority);
3426 }
3427
3428 static void selinux_sk_free_security(struct sock *sk)
3429 {
3430         sk_free_security(sk);
3431 }
3432
3433 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3434 {
3435         int err = 0;
3436         u32 perm;
3437         struct nlmsghdr *nlh;
3438         struct socket *sock = sk->sk_socket;
3439         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3440
3441         if (skb->len < NLMSG_SPACE(0)) {
3442                 err = -EINVAL;
3443                 goto out;
3444         }
3445         nlh = (struct nlmsghdr *)skb->data;
3446
3447         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3448         if (err) {
3449                 /* Ignore */
3450                 if (err == -ENOENT)
3451                         err = 0;
3452                 goto out;
3453         }
3454
3455         err = socket_has_perm(current, sock, perm);
3456 out:
3457         return err;
3458 }
3459
3460 #ifdef CONFIG_NETFILTER
3461
3462 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3463                                               struct sk_buff **pskb,
3464                                               const struct net_device *in,
3465                                               const struct net_device *out,
3466                                               int (*okfn)(struct sk_buff *),
3467                                               u16 family)
3468 {
3469         char *addrp;
3470         int len, err = NF_ACCEPT;
3471         u32 netif_perm, node_perm, node_sid, send_perm = 0;
3472         struct sock *sk;
3473         struct socket *sock;
3474         struct inode *inode;
3475         struct sel_netif *netif;
3476         struct sk_buff *skb = *pskb;
3477         struct netif_security_struct *nsec;
3478         struct inode_security_struct *isec;
3479         struct avc_audit_data ad;
3480         struct net_device *dev = (struct net_device *)out;
3481
3482         sk = skb->sk;
3483         if (!sk)
3484                 goto out;
3485
3486         sock = sk->sk_socket;
3487         if (!sock)
3488                 goto out;
3489
3490         inode = SOCK_INODE(sock);
3491         if (!inode)
3492                 goto out;
3493
3494         netif = sel_netif_lookup(dev);
3495         if (IS_ERR(netif)) {
3496                 err = NF_DROP;
3497                 goto out;
3498         }
3499
3500         nsec = &netif->nsec;
3501         isec = inode->i_security;
3502
3503         switch (isec->sclass) {
3504         case SECCLASS_UDP_SOCKET:
3505                 netif_perm = NETIF__UDP_SEND;
3506                 node_perm = NODE__UDP_SEND;
3507                 send_perm = UDP_SOCKET__SEND_MSG;
3508                 break;
3509
3510         case SECCLASS_TCP_SOCKET:
3511                 netif_perm = NETIF__TCP_SEND;
3512                 node_perm = NODE__TCP_SEND;
3513                 send_perm = TCP_SOCKET__SEND_MSG;
3514                 break;
3515
3516         default:
3517                 netif_perm = NETIF__RAWIP_SEND;
3518                 node_perm = NODE__RAWIP_SEND;
3519                 break;
3520         }
3521
3522
3523         AVC_AUDIT_DATA_INIT(&ad, NET);
3524         ad.u.net.netif = dev->name;
3525         ad.u.net.family = family;
3526
3527         err = selinux_parse_skb(skb, &ad, &addrp,
3528                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3529         if (err != NF_ACCEPT) {
3530                 sel_netif_put(netif);
3531                 goto out;
3532         }
3533
3534         err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
3535                            netif_perm, &nsec->avcr, &ad) ? NF_DROP : NF_ACCEPT;
3536         sel_netif_put(netif);
3537         if (err != NF_ACCEPT)
3538                 goto out;
3539
3540         /* Fixme: this lookup is inefficient */
3541         err = security_node_sid(family, addrp, len,
3542                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3543         if (err != NF_ACCEPT)
3544                 goto out;
3545
3546         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3547                            node_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3548         if (err != NF_ACCEPT)
3549                 goto out;
3550
3551         if (send_perm) {
3552                 u32 port_sid;
3553
3554                 /* Fixme: make this more efficient */
3555                 err = security_port_sid(sk->sk_family,
3556                                         sk->sk_type,
3557                                         sk->sk_protocol,
3558                                         ntohs(ad.u.net.dport),
3559                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3560                 if (err != NF_ACCEPT)
3561                         goto out;
3562
3563                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3564                                    send_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3565         }
3566
3567 out:
3568         return err;
3569 }
3570
3571 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3572                                                 struct sk_buff **pskb,
3573                                                 const struct net_device *in,
3574                                                 const struct net_device *out,
3575                                                 int (*okfn)(struct sk_buff *))
3576 {
3577         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3578 }
3579
3580 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3581
3582 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3583                                                 struct sk_buff **pskb,
3584                                                 const struct net_device *in,
3585                                                 const struct net_device *out,
3586                                                 int (*okfn)(struct sk_buff *))
3587 {
3588         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3589 }
3590
3591 #endif  /* IPV6 */
3592
3593 #endif  /* CONFIG_NETFILTER */
3594
3595 #else
3596
3597 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3598 {
3599         return 0;
3600 }
3601
3602 #endif  /* CONFIG_SECURITY_NETWORK */
3603
3604 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3605 {
3606         int err = 0;
3607
3608         if (capable(CAP_NET_ADMIN))
3609                 cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
3610         else
3611                 NETLINK_CB(skb).eff_cap = 0;
3612
3613         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3614                 err = selinux_nlmsg_perm(sk, skb);
3615
3616         return err;
3617 }
3618
3619 static int selinux_netlink_recv(struct sk_buff *skb)
3620 {
3621         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3622                 return -EPERM;
3623         return 0;
3624 }
3625
3626 static int ipc_alloc_security(struct task_struct *task,
3627                               struct kern_ipc_perm *perm,
3628                               u16 sclass)
3629 {
3630         struct task_security_struct *tsec = task->security;
3631         struct ipc_security_struct *isec;
3632
3633         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3634         if (!isec)
3635                 return -ENOMEM;
3636
3637         memset(isec, 0, sizeof(struct ipc_security_struct));
3638         isec->magic = SELINUX_MAGIC;
3639         isec->sclass = sclass;
3640         isec->ipc_perm = perm;
3641         if (tsec) {
3642                 isec->sid = tsec->sid;
3643         } else {
3644                 isec->sid = SECINITSID_UNLABELED;
3645         }
3646         perm->security = isec;
3647
3648         return 0;
3649 }
3650
3651 static void ipc_free_security(struct kern_ipc_perm *perm)
3652 {
3653         struct ipc_security_struct *isec = perm->security;
3654         if (!isec || isec->magic != SELINUX_MAGIC)
3655                 return;
3656
3657         perm->security = NULL;
3658         kfree(isec);
3659 }
3660
3661 static int msg_msg_alloc_security(struct msg_msg *msg)
3662 {
3663         struct msg_security_struct *msec;
3664
3665         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3666         if (!msec)
3667                 return -ENOMEM;
3668
3669         memset(msec, 0, sizeof(struct msg_security_struct));
3670         msec->magic = SELINUX_MAGIC;
3671         msec->msg = msg;
3672         msec->sid = SECINITSID_UNLABELED;
3673         msg->security = msec;
3674
3675         return 0;
3676 }
3677
3678 static void msg_msg_free_security(struct msg_msg *msg)
3679 {
3680         struct msg_security_struct *msec = msg->security;
3681         if (!msec || msec->magic != SELINUX_MAGIC)
3682                 return;
3683
3684         msg->security = NULL;
3685         kfree(msec);
3686 }
3687
3688 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3689                         u16 sclass, u32 perms)
3690 {
3691         struct task_security_struct *tsec;
3692         struct ipc_security_struct *isec;
3693         struct avc_audit_data ad;
3694
3695         tsec = current->security;
3696         isec = ipc_perms->security;
3697
3698         AVC_AUDIT_DATA_INIT(&ad, IPC);
3699         ad.u.ipc_id = ipc_perms->key;
3700
3701         return avc_has_perm(tsec->sid, isec->sid, sclass,
3702                             perms, &isec->avcr, &ad);
3703 }
3704
3705 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3706 {
3707         return msg_msg_alloc_security(msg);
3708 }
3709
3710 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3711 {
3712         msg_msg_free_security(msg);
3713 }
3714
3715 /* message queue security operations */
3716 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3717 {
3718         struct task_security_struct *tsec;
3719         struct ipc_security_struct *isec;
3720         struct avc_audit_data ad;
3721         int rc;
3722
3723         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3724         if (rc)
3725                 return rc;
3726
3727         tsec = current->security;
3728         isec = msq->q_perm.security;
3729
3730         AVC_AUDIT_DATA_INIT(&ad, IPC);
3731         ad.u.ipc_id = msq->q_perm.key;
3732
3733         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3734                           MSGQ__CREATE, &isec->avcr, &ad);
3735         if (rc) {
3736                 ipc_free_security(&msq->q_perm);
3737                 return rc;
3738         }
3739         return 0;
3740 }
3741
3742 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3743 {
3744         ipc_free_security(&msq->q_perm);
3745 }
3746
3747 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3748 {
3749         struct task_security_struct *tsec;
3750         struct ipc_security_struct *isec;
3751         struct avc_audit_data ad;
3752
3753         tsec = current->security;
3754         isec = msq->q_perm.security;
3755
3756         AVC_AUDIT_DATA_INIT(&ad, IPC);
3757         ad.u.ipc_id = msq->q_perm.key;
3758
3759         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3760                             MSGQ__ASSOCIATE, &isec->avcr, &ad);
3761 }
3762
3763 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3764 {
3765         int err;
3766         int perms;
3767
3768         switch(cmd) {
3769         case IPC_INFO:
3770         case MSG_INFO:
3771                 /* No specific object, just general system-wide information. */
3772                 return task_has_system(current, SYSTEM__IPC_INFO);
3773         case IPC_STAT:
3774         case MSG_STAT:
3775                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3776                 break;
3777         case IPC_SET:
3778                 perms = MSGQ__SETATTR;
3779                 break;
3780         case IPC_RMID:
3781                 perms = MSGQ__DESTROY;
3782                 break;
3783         default:
3784                 return 0;
3785         }
3786
3787         err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
3788         return err;
3789 }
3790
3791 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3792 {
3793         struct task_security_struct *tsec;
3794         struct ipc_security_struct *isec;
3795         struct msg_security_struct *msec;
3796         struct avc_audit_data ad;
3797         int rc;
3798
3799         tsec = current->security;
3800         isec = msq->q_perm.security;
3801         msec = msg->security;
3802
3803         /*
3804          * First time through, need to assign label to the message
3805          */
3806         if (msec->sid == SECINITSID_UNLABELED) {
3807                 /*
3808                  * Compute new sid based on current process and
3809                  * message queue this message will be stored in
3810                  */
3811                 rc = security_transition_sid(tsec->sid,
3812                                              isec->sid,
3813                                              SECCLASS_MSG,
3814                                              &msec->sid);
3815                 if (rc)
3816                         return rc;
3817         }
3818
3819         AVC_AUDIT_DATA_INIT(&ad, IPC);
3820         ad.u.ipc_id = msq->q_perm.key;
3821
3822         /* Can this process write to the queue? */
3823         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3824                           MSGQ__WRITE, &isec->avcr, &ad);
3825         if (!rc)
3826                 /* Can this process send the message */
3827                 rc = avc_has_perm(tsec->sid, msec->sid,
3828                                   SECCLASS_MSG, MSG__SEND,
3829                                   &msec->avcr, &ad);
3830         if (!rc)
3831                 /* Can the message be put in the queue? */
3832                 rc = avc_has_perm(msec->sid, isec->sid,
3833                                   SECCLASS_MSGQ, MSGQ__ENQUEUE,
3834                                   &isec->avcr, &ad);
3835
3836         return rc;
3837 }
3838
3839 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3840                                     struct task_struct *target,
3841                                     long type, int mode)
3842 {
3843         struct task_security_struct *tsec;
3844         struct ipc_security_struct *isec;
3845         struct msg_security_struct *msec;
3846         struct avc_audit_data ad;
3847         int rc;
3848
3849         tsec = target->security;
3850         isec = msq->q_perm.security;
3851         msec = msg->security;
3852
3853         AVC_AUDIT_DATA_INIT(&ad, IPC);
3854         ad.u.ipc_id = msq->q_perm.key;
3855
3856         rc = avc_has_perm(tsec->sid, isec->sid,
3857                           SECCLASS_MSGQ, MSGQ__READ,
3858                           &isec->avcr, &ad);
3859         if (!rc)
3860                 rc = avc_has_perm(tsec->sid, msec->sid,
3861                                   SECCLASS_MSG, MSG__RECEIVE,
3862                                   &msec->avcr, &ad);
3863         return rc;
3864 }
3865
3866 /* Shared Memory security operations */
3867 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3868 {
3869         struct task_security_struct *tsec;
3870         struct ipc_security_struct *isec;
3871         struct avc_audit_data ad;
3872         int rc;
3873
3874         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3875         if (rc)
3876                 return rc;
3877
3878         tsec = current->security;
3879         isec = shp->shm_perm.security;
3880
3881         AVC_AUDIT_DATA_INIT(&ad, IPC);
3882         ad.u.ipc_id = shp->shm_perm.key;
3883
3884         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3885                           SHM__CREATE, &isec->avcr, &ad);
3886         if (rc) {
3887                 ipc_free_security(&shp->shm_perm);
3888                 return rc;
3889         }
3890         return 0;
3891 }
3892
3893 static void selinux_shm_free_security(struct shmid_kernel *shp)
3894 {
3895         ipc_free_security(&shp->shm_perm);
3896 }
3897
3898 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3899 {
3900         struct task_security_struct *tsec;
3901         struct ipc_security_struct *isec;
3902         struct avc_audit_data ad;
3903
3904         tsec = current->security;
3905         isec = shp->shm_perm.security;
3906
3907         AVC_AUDIT_DATA_INIT(&ad, IPC);
3908         ad.u.ipc_id = shp->shm_perm.key;
3909
3910         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3911                             SHM__ASSOCIATE, &isec->avcr, &ad);
3912 }
3913
3914 /* Note, at this point, shp is locked down */
3915 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3916 {
3917         int perms;
3918         int err;
3919
3920         switch(cmd) {
3921         case IPC_INFO:
3922         case SHM_INFO:
3923                 /* No specific object, just general system-wide information. */
3924                 return task_has_system(current, SYSTEM__IPC_INFO);
3925         case IPC_STAT:
3926         case SHM_STAT:
3927                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3928                 break;
3929         case IPC_SET:
3930                 perms = SHM__SETATTR;
3931                 break;
3932         case SHM_LOCK:
3933         case SHM_UNLOCK:
3934                 perms = SHM__LOCK;
3935                 break;
3936         case IPC_RMID:
3937                 perms = SHM__DESTROY;
3938                 break;
3939         default:
3940                 return 0;
3941         }
3942
3943         err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3944         return err;
3945 }
3946
3947 static int selinux_shm_shmat(struct shmid_kernel *shp,
3948                              char __user *shmaddr, int shmflg)
3949 {
3950         u32 perms;
3951         int rc;
3952
3953         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3954         if (rc)
3955                 return rc;
3956
3957         if (shmflg & SHM_RDONLY)
3958                 perms = SHM__READ;
3959         else
3960                 perms = SHM__READ | SHM__WRITE;
3961
3962         return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3963 }
3964
3965 /* Semaphore security operations */
3966 static int selinux_sem_alloc_security(struct sem_array *sma)
3967 {
3968         struct task_security_struct *tsec;
3969         struct ipc_security_struct *isec;
3970         struct avc_audit_data ad;
3971         int rc;
3972
3973         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3974         if (rc)
3975                 return rc;
3976
3977         tsec = current->security;
3978         isec = sma->sem_perm.security;
3979
3980         AVC_AUDIT_DATA_INIT(&ad, IPC);
3981         ad.u.ipc_id = sma->sem_perm.key;
3982
3983         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3984                           SEM__CREATE, &isec->avcr, &ad);
3985         if (rc) {
3986                 ipc_free_security(&sma->sem_perm);
3987                 return rc;
3988         }
3989         return 0;
3990 }
3991
3992 static void selinux_sem_free_security(struct sem_array *sma)
3993 {
3994         ipc_free_security(&sma->sem_perm);
3995 }
3996
3997 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3998 {
3999         struct task_security_struct *tsec;
4000         struct ipc_security_struct *isec;
4001         struct avc_audit_data ad;
4002
4003         tsec = current->security;
4004         isec = sma->sem_perm.security;
4005
4006         AVC_AUDIT_DATA_INIT(&ad, IPC);
4007         ad.u.ipc_id = sma->sem_perm.key;
4008
4009         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4010                             SEM__ASSOCIATE, &isec->avcr, &ad);
4011 }
4012
4013 /* Note, at this point, sma is locked down */
4014 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4015 {
4016         int err;
4017         u32 perms;
4018
4019         switch(cmd) {
4020         case IPC_INFO:
4021         case SEM_INFO:
4022                 /* No specific object, just general system-wide information. */
4023                 return task_has_system(current, SYSTEM__IPC_INFO);
4024         case GETPID:
4025         case GETNCNT:
4026         case GETZCNT:
4027                 perms = SEM__GETATTR;
4028                 break;
4029         case GETVAL:
4030         case GETALL:
4031                 perms = SEM__READ;
4032                 break;
4033         case SETVAL:
4034         case SETALL:
4035                 perms = SEM__WRITE;
4036                 break;
4037         case IPC_RMID:
4038                 perms = SEM__DESTROY;
4039                 break;
4040         case IPC_SET:
4041                 perms = SEM__SETATTR;
4042                 break;
4043         case IPC_STAT:
4044         case SEM_STAT:
4045                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4046                 break;
4047         default:
4048                 return 0;
4049         }
4050
4051         err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4052         return err;
4053 }
4054
4055 static int selinux_sem_semop(struct sem_array *sma,
4056                              struct sembuf *sops, unsigned nsops, int alter)
4057 {
4058         u32 perms;
4059
4060         if (alter)
4061                 perms = SEM__READ | SEM__WRITE;
4062         else
4063                 perms = SEM__READ;
4064
4065         return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4066 }
4067
4068 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4069 {
4070         struct ipc_security_struct *isec = ipcp->security;
4071         u16 sclass = SECCLASS_IPC;
4072         u32 av = 0;
4073
4074         if (isec && isec->magic == SELINUX_MAGIC)
4075                 sclass = isec->sclass;
4076
4077         av = 0;
4078         if (flag & S_IRUGO)
4079                 av |= IPC__UNIX_READ;
4080         if (flag & S_IWUGO)
4081                 av |= IPC__UNIX_WRITE;
4082
4083         if (av == 0)
4084                 return 0;
4085
4086         return ipc_has_perm(ipcp, sclass, av);
4087 }
4088
4089 /* module stacking operations */
4090 int selinux_register_security (const char *name, struct security_operations *ops)
4091 {
4092         if (secondary_ops != original_ops) {
4093                 printk(KERN_INFO "%s:  There is already a secondary security "
4094                        "module registered.\n", __FUNCTION__);
4095                 return -EINVAL;
4096         }
4097
4098         secondary_ops = ops;
4099
4100         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4101                __FUNCTION__,
4102                name);
4103
4104         return 0;
4105 }
4106
4107 int selinux_unregister_security (const char *name, struct security_operations *ops)
4108 {
4109         if (ops != secondary_ops) {
4110                 printk (KERN_INFO "%s:  trying to unregister a security module "
4111                         "that is not registered.\n", __FUNCTION__);
4112                 return -EINVAL;
4113         }
4114
4115         secondary_ops = original_ops;
4116
4117         return 0;
4118 }
4119
4120 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4121 {
4122         if (inode)
4123                 inode_doinit_with_dentry(inode, dentry);
4124 }
4125
4126 static int selinux_getprocattr(struct task_struct *p,
4127                                char *name, void *value, size_t size)
4128 {
4129         struct task_security_struct *tsec;
4130         u32 sid, len;
4131         char *context;
4132         int error;
4133
4134         if (current != p) {
4135                 error = task_has_perm(current, p, PROCESS__GETATTR);
4136                 if (error)
4137                         return error;
4138         }
4139
4140         if (!size)
4141                 return -ERANGE;
4142
4143         tsec = p->security;
4144
4145         if (!strcmp(name, "current"))
4146                 sid = tsec->sid;
4147         else if (!strcmp(name, "prev"))
4148                 sid = tsec->osid;
4149         else if (!strcmp(name, "exec"))
4150                 sid = tsec->exec_sid;
4151         else if (!strcmp(name, "fscreate"))
4152                 sid = tsec->create_sid;
4153         else
4154                 return -EINVAL;
4155
4156         if (!sid)
4157                 return 0;
4158
4159         error = security_sid_to_context(sid, &context, &len);
4160         if (error)
4161                 return error;
4162         if (len > size) {
4163                 kfree(context);
4164                 return -ERANGE;
4165         }
4166         memcpy(value, context, len);
4167         kfree(context);
4168         return len;
4169 }
4170
4171 static int selinux_setprocattr(struct task_struct *p,
4172                                char *name, void *value, size_t size)
4173 {
4174         struct task_security_struct *tsec;
4175         u32 sid = 0;
4176         int error;
4177
4178         if (current != p || !strcmp(name, "current")) {
4179                 /* SELinux only allows a process to change its own
4180                    security attributes, and it only allows the process
4181                    current SID to change via exec. */
4182                 return -EACCES;
4183         }
4184
4185         /*
4186          * Basic control over ability to set these attributes at all.
4187          * current == p, but we'll pass them separately in case the
4188          * above restriction is ever removed.
4189          */
4190         if (!strcmp(name, "exec"))
4191                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4192         else if (!strcmp(name, "fscreate"))
4193                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4194         else
4195                 error = -EINVAL;
4196         if (error)
4197                 return error;
4198
4199         /* Obtain a SID for the context, if one was specified. */
4200         if (size) {
4201                 int error;
4202                 error = security_context_to_sid(value, size, &sid);
4203                 if (error)
4204                         return error;
4205         }
4206
4207         /* Permission checking based on the specified context is
4208            performed during the actual operation (execve,
4209            open/mkdir/...), when we know the full context of the
4210            operation.  See selinux_bprm_set_security for the execve
4211            checks and may_create for the file creation checks. The
4212            operation will then fail if the context is not permitted. */
4213         tsec = p->security;
4214         if (!strcmp(name, "exec"))
4215                 tsec->exec_sid = sid;
4216         else if (!strcmp(name, "fscreate"))
4217                 tsec->create_sid = sid;
4218         else
4219                 return -EINVAL;
4220
4221         return size;
4222 }
4223
4224 struct security_operations selinux_ops = {
4225         .ptrace =                       selinux_ptrace,
4226         .capget =                       selinux_capget,
4227         .capset_check =                 selinux_capset_check,
4228         .capset_set =                   selinux_capset_set,
4229         .sysctl =                       selinux_sysctl,
4230         .capable =                      selinux_capable,
4231         .quotactl =                     selinux_quotactl,
4232         .quota_on =                     selinux_quota_on,
4233         .syslog =                       selinux_syslog,
4234         .vm_enough_memory =             selinux_vm_enough_memory,
4235
4236         .netlink_send =                 selinux_netlink_send,
4237         .netlink_recv =                 selinux_netlink_recv,
4238
4239         .bprm_alloc_security =          selinux_bprm_alloc_security,
4240         .bprm_free_security =           selinux_bprm_free_security,
4241         .bprm_apply_creds =             selinux_bprm_apply_creds,
4242         .bprm_set_security =            selinux_bprm_set_security,
4243         .bprm_check_security =          selinux_bprm_check_security,
4244         .bprm_secureexec =              selinux_bprm_secureexec,
4245
4246         .sb_alloc_security =            selinux_sb_alloc_security,
4247         .sb_free_security =             selinux_sb_free_security,
4248         .sb_copy_data =                 selinux_sb_copy_data,
4249         .sb_kern_mount =                selinux_sb_kern_mount,
4250         .sb_statfs =                    selinux_sb_statfs,
4251         .sb_mount =                     selinux_mount,
4252         .sb_umount =                    selinux_umount,
4253
4254         .inode_alloc_security =         selinux_inode_alloc_security,
4255         .inode_free_security =          selinux_inode_free_security,
4256         .inode_create =                 selinux_inode_create,
4257         .inode_post_create =            selinux_inode_post_create,
4258         .inode_link =                   selinux_inode_link,
4259         .inode_post_link =              selinux_inode_post_link,
4260         .inode_unlink =                 selinux_inode_unlink,
4261         .inode_symlink =                selinux_inode_symlink,
4262         .inode_post_symlink =           selinux_inode_post_symlink,
4263         .inode_mkdir =                  selinux_inode_mkdir,
4264         .inode_post_mkdir =             selinux_inode_post_mkdir,
4265         .inode_rmdir =                  selinux_inode_rmdir,
4266         .inode_mknod =                  selinux_inode_mknod,
4267         .inode_post_mknod =             selinux_inode_post_mknod,
4268         .inode_rename =                 selinux_inode_rename,
4269         .inode_post_rename =            selinux_inode_post_rename,
4270         .inode_readlink =               selinux_inode_readlink,
4271         .inode_follow_link =            selinux_inode_follow_link,
4272         .inode_permission =             selinux_inode_permission,
4273         .inode_setattr =                selinux_inode_setattr,
4274         .inode_getattr =                selinux_inode_getattr,
4275         .inode_setxattr =               selinux_inode_setxattr,
4276         .inode_post_setxattr =          selinux_inode_post_setxattr,
4277         .inode_getxattr =               selinux_inode_getxattr,
4278         .inode_listxattr =              selinux_inode_listxattr,
4279         .inode_removexattr =            selinux_inode_removexattr,
4280         .inode_getsecurity =            selinux_inode_getsecurity,
4281         .inode_setsecurity =            selinux_inode_setsecurity,
4282         .inode_listsecurity =           selinux_inode_listsecurity,
4283
4284         .file_permission =              selinux_file_permission,
4285         .file_alloc_security =          selinux_file_alloc_security,
4286         .file_free_security =           selinux_file_free_security,
4287         .file_ioctl =                   selinux_file_ioctl,
4288         .file_mmap =                    selinux_file_mmap,
4289         .file_mprotect =                selinux_file_mprotect,
4290         .file_lock =                    selinux_file_lock,
4291         .file_fcntl =                   selinux_file_fcntl,
4292         .file_set_fowner =              selinux_file_set_fowner,
4293         .file_send_sigiotask =          selinux_file_send_sigiotask,
4294         .file_receive =                 selinux_file_receive,
4295
4296         .task_create =                  selinux_task_create,
4297         .task_alloc_security =          selinux_task_alloc_security,
4298         .task_free_security =           selinux_task_free_security,
4299         .task_setuid =                  selinux_task_setuid,
4300         .task_post_setuid =             selinux_task_post_setuid,
4301         .task_setgid =                  selinux_task_setgid,
4302         .task_setpgid =                 selinux_task_setpgid,
4303         .task_getpgid =                 selinux_task_getpgid,
4304         .task_getsid =                  selinux_task_getsid,
4305         .task_setgroups =               selinux_task_setgroups,
4306         .task_setnice =                 selinux_task_setnice,
4307         .task_setrlimit =               selinux_task_setrlimit,
4308         .task_setscheduler =            selinux_task_setscheduler,
4309         .task_getscheduler =            selinux_task_getscheduler,
4310         .task_kill =                    selinux_task_kill,
4311         .task_wait =                    selinux_task_wait,
4312         .task_prctl =                   selinux_task_prctl,
4313         .task_reparent_to_init =        selinux_task_reparent_to_init,
4314         .task_to_inode =                selinux_task_to_inode,
4315
4316         .ipc_permission =               selinux_ipc_permission,
4317
4318         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4319         .msg_msg_free_security =        selinux_msg_msg_free_security,
4320
4321         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4322         .msg_queue_free_security =      selinux_msg_queue_free_security,
4323         .msg_queue_associate =          selinux_msg_queue_associate,
4324         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4325         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4326         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4327
4328         .shm_alloc_security =           selinux_shm_alloc_security,
4329         .shm_free_security =            selinux_shm_free_security,
4330         .shm_associate =                selinux_shm_associate,
4331         .shm_shmctl =                   selinux_shm_shmctl,
4332         .shm_shmat =                    selinux_shm_shmat,
4333
4334         .sem_alloc_security =           selinux_sem_alloc_security,
4335         .sem_free_security =            selinux_sem_free_security,
4336         .sem_associate =                selinux_sem_associate,
4337         .sem_semctl =                   selinux_sem_semctl,
4338         .sem_semop =                    selinux_sem_semop,
4339
4340         .register_security =            selinux_register_security,
4341         .unregister_security =          selinux_unregister_security,
4342
4343         .d_instantiate =                selinux_d_instantiate,
4344
4345         .getprocattr =                  selinux_getprocattr,
4346         .setprocattr =                  selinux_setprocattr,
4347
4348 #ifdef CONFIG_SECURITY_NETWORK
4349         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4350         .unix_may_send =                selinux_socket_unix_may_send,
4351
4352         .socket_create =                selinux_socket_create,
4353         .socket_post_create =           selinux_socket_post_create,
4354         .socket_bind =                  selinux_socket_bind,
4355         .socket_connect =               selinux_socket_connect,
4356         .socket_listen =                selinux_socket_listen,
4357         .socket_accept =                selinux_socket_accept,
4358         .socket_sendmsg =               selinux_socket_sendmsg,
4359         .socket_recvmsg =               selinux_socket_recvmsg,
4360         .socket_getsockname =           selinux_socket_getsockname,
4361         .socket_getpeername =           selinux_socket_getpeername,
4362         .socket_getsockopt =            selinux_socket_getsockopt,
4363         .socket_setsockopt =            selinux_socket_setsockopt,
4364         .socket_shutdown =              selinux_socket_shutdown,
4365         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4366         .socket_getpeersec =            selinux_socket_getpeersec,
4367         .sk_alloc_security =            selinux_sk_alloc_security,
4368         .sk_free_security =             selinux_sk_free_security,
4369 #endif
4370 };
4371
4372 __init int selinux_init(void)
4373 {
4374         struct task_security_struct *tsec;
4375
4376         if (!selinux_enabled) {
4377                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4378                 return 0;
4379         }
4380
4381         printk(KERN_INFO "SELinux:  Initializing.\n");
4382
4383         /* Set the security state for the initial task. */
4384         if (task_alloc_security(current))
4385                 panic("SELinux:  Failed to initialize initial task.\n");
4386         tsec = current->security;
4387         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4388
4389         avc_init();
4390
4391         original_ops = secondary_ops = security_ops;
4392         if (!secondary_ops)
4393                 panic ("SELinux: No initial security operations\n");
4394         if (register_security (&selinux_ops))
4395                 panic("SELinux: Unable to register with kernel.\n");
4396
4397         if (selinux_enforcing) {
4398                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4399         } else {
4400                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4401         }
4402         return 0;
4403 }
4404
4405 void selinux_complete_init(void)
4406 {
4407         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4408
4409         /* Set up any superblocks initialized prior to the policy load. */
4410         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4411         spin_lock(&sb_security_lock);
4412 next_sb:
4413         if (!list_empty(&superblock_security_head)) {
4414                 struct superblock_security_struct *sbsec =
4415                                 list_entry(superblock_security_head.next,
4416                                            struct superblock_security_struct,
4417                                            list);
4418                 struct super_block *sb = sbsec->sb;
4419                 spin_lock(&sb_lock);
4420                 sb->s_count++;
4421                 spin_unlock(&sb_lock);
4422                 spin_unlock(&sb_security_lock);
4423                 down_read(&sb->s_umount);
4424                 if (sb->s_root)
4425                         superblock_doinit(sb, NULL);
4426                 drop_super(sb);
4427                 spin_lock(&sb_security_lock);
4428                 list_del_init(&sbsec->list);
4429                 goto next_sb;
4430         }
4431         spin_unlock(&sb_security_lock);
4432 }
4433
4434 /* SELinux requires early initialization in order to label
4435    all processes and objects when they are created. */
4436 security_initcall(selinux_init);
4437
4438 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4439
4440 static struct nf_hook_ops selinux_ipv4_op = {
4441         .hook =         selinux_ipv4_postroute_last,
4442         .owner =        THIS_MODULE,
4443         .pf =           PF_INET,
4444         .hooknum =      NF_IP_POST_ROUTING,
4445         .priority =     NF_IP_PRI_SELINUX_LAST,
4446 };
4447
4448 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4449
4450 static struct nf_hook_ops selinux_ipv6_op = {
4451         .hook =         selinux_ipv6_postroute_last,
4452         .owner =        THIS_MODULE,
4453         .pf =           PF_INET6,
4454         .hooknum =      NF_IP6_POST_ROUTING,
4455         .priority =     NF_IP6_PRI_SELINUX_LAST,
4456 };
4457
4458 #endif  /* IPV6 */
4459
4460 static int __init selinux_nf_ip_init(void)
4461 {
4462         int err = 0;
4463
4464         if (!selinux_enabled)
4465                 goto out;
4466
4467         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4468
4469         err = nf_register_hook(&selinux_ipv4_op);
4470         if (err)
4471                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4472
4473 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4474
4475         err = nf_register_hook(&selinux_ipv6_op);
4476         if (err)
4477                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4478
4479 #endif  /* IPV6 */
4480 out:
4481         return err;
4482 }
4483
4484 __initcall(selinux_nf_ip_init);
4485
4486 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4487 static void selinux_nf_ip_exit(void)
4488 {
4489         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4490
4491         nf_unregister_hook(&selinux_ipv4_op);
4492 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4493         nf_unregister_hook(&selinux_ipv6_op);
4494 #endif  /* IPV6 */
4495 }
4496 #endif
4497
4498 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4499
4500 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4501 #define selinux_nf_ip_exit()
4502 #endif
4503
4504 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4505
4506 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4507 int selinux_disable(void)
4508 {
4509         extern void exit_sel_fs(void);
4510         static int selinux_disabled = 0;
4511
4512         if (ss_initialized) {
4513                 /* Not permitted after initial policy load. */
4514                 return -EINVAL;
4515         }
4516
4517         if (selinux_disabled) {
4518                 /* Only do this once. */
4519                 return -EINVAL;
4520         }
4521
4522         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4523
4524         selinux_disabled = 1;
4525
4526         /* Reset security_ops to the secondary module, dummy or capability. */
4527         security_ops = secondary_ops;
4528
4529         /* Unregister netfilter hooks. */
4530         selinux_nf_ip_exit();
4531
4532         /* Unregister selinuxfs. */
4533         exit_sel_fs();
4534
4535         return 0;
4536 }
4537 #endif
4538
4539