~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/selinux/hooks.c

Version: ~ [ linux-5.19-rc8 ] ~ [ linux-5.18.14 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.57 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.133 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.207 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.253 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.289 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.324 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *  NSA Security-Enhanced Linux (SELinux) security module
  3  *
  4  *  This file contains the SELinux hook function implementations.
  5  *
  6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
  7  *            Chris Vance, <cvance@nai.com>
  8  *            Wayne Salamon, <wsalamon@nai.com>
  9  *            James Morris <jmorris@redhat.com>
 10  *
 11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
 12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
 13  *                                         Eric Paris <eparis@redhat.com>
 14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
 15  *                          <dgoeddel@trustedcs.com>
 16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
 17  *      Paul Moore <paul@paul-moore.com>
 18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
 19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
 20  *
 21  *      This program is free software; you can redistribute it and/or modify
 22  *      it under the terms of the GNU General Public License version 2,
 23  *      as published by the Free Software Foundation.
 24  */
 25 
 26 #include <linux/init.h>
 27 #include <linux/kd.h>
 28 #include <linux/kernel.h>
 29 #include <linux/tracehook.h>
 30 #include <linux/errno.h>
 31 #include <linux/sched.h>
 32 #include <linux/lsm_hooks.h>
 33 #include <linux/xattr.h>
 34 #include <linux/capability.h>
 35 #include <linux/unistd.h>
 36 #include <linux/mm.h>
 37 #include <linux/mman.h>
 38 #include <linux/slab.h>
 39 #include <linux/pagemap.h>
 40 #include <linux/proc_fs.h>
 41 #include <linux/swap.h>
 42 #include <linux/spinlock.h>
 43 #include <linux/syscalls.h>
 44 #include <linux/dcache.h>
 45 #include <linux/file.h>
 46 #include <linux/fdtable.h>
 47 #include <linux/namei.h>
 48 #include <linux/mount.h>
 49 #include <linux/netfilter_ipv4.h>
 50 #include <linux/netfilter_ipv6.h>
 51 #include <linux/tty.h>
 52 #include <net/icmp.h>
 53 #include <net/ip.h>             /* for local_port_range[] */
 54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 55 #include <net/inet_connection_sock.h>
 56 #include <net/net_namespace.h>
 57 #include <net/netlabel.h>
 58 #include <linux/uaccess.h>
 59 #include <asm/ioctls.h>
 60 #include <linux/atomic.h>
 61 #include <linux/bitops.h>
 62 #include <linux/interrupt.h>
 63 #include <linux/netdevice.h>    /* for network interface checks */
 64 #include <net/netlink.h>
 65 #include <linux/tcp.h>
 66 #include <linux/udp.h>
 67 #include <linux/dccp.h>
 68 #include <linux/quota.h>
 69 #include <linux/un.h>           /* for Unix socket types */
 70 #include <net/af_unix.h>        /* for Unix socket types */
 71 #include <linux/parser.h>
 72 #include <linux/nfs_mount.h>
 73 #include <net/ipv6.h>
 74 #include <linux/hugetlb.h>
 75 #include <linux/personality.h>
 76 #include <linux/audit.h>
 77 #include <linux/string.h>
 78 #include <linux/selinux.h>
 79 #include <linux/mutex.h>
 80 #include <linux/posix-timers.h>
 81 #include <linux/syslog.h>
 82 #include <linux/user_namespace.h>
 83 #include <linux/export.h>
 84 #include <linux/msg.h>
 85 #include <linux/shm.h>
 86 
 87 #include "avc.h"
 88 #include "objsec.h"
 89 #include "netif.h"
 90 #include "netnode.h"
 91 #include "netport.h"
 92 #include "xfrm.h"
 93 #include "netlabel.h"
 94 #include "audit.h"
 95 #include "avc_ss.h"
 96 
 97 /* SECMARK reference count */
 98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 99 
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102 
103 static int __init enforcing_setup(char *str)
104 {
105         unsigned long enforcing;
106         if (!kstrtoul(str, 0, &enforcing))
107                 selinux_enforcing = enforcing ? 1 : 0;
108         return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112 
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115 
116 static int __init selinux_enabled_setup(char *str)
117 {
118         unsigned long enabled;
119         if (!kstrtoul(str, 0, &enabled))
120                 selinux_enabled = enabled ? 1 : 0;
121         return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127 
128 static struct kmem_cache *sel_inode_cache;
129 
130 /**
131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
132  *
133  * Description:
134  * This function checks the SECMARK reference counter to see if any SECMARK
135  * targets are currently configured, if the reference counter is greater than
136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
138  * policy capability is enabled, SECMARK is always considered enabled.
139  *
140  */
141 static int selinux_secmark_enabled(void)
142 {
143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
144 }
145 
146 /**
147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
148  *
149  * Description:
150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
151  * (1) if any are enabled or false (0) if neither are enabled.  If the
152  * always_check_network policy capability is enabled, peer labeling
153  * is always considered enabled.
154  *
155  */
156 static int selinux_peerlbl_enabled(void)
157 {
158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
159 }
160 
161 static int selinux_netcache_avc_callback(u32 event)
162 {
163         if (event == AVC_CALLBACK_RESET) {
164                 sel_netif_flush();
165                 sel_netnode_flush();
166                 sel_netport_flush();
167                 synchronize_net();
168         }
169         return 0;
170 }
171 
172 /*
173  * initialise the security for the init task
174  */
175 static void cred_init_security(void)
176 {
177         struct cred *cred = (struct cred *) current->real_cred;
178         struct task_security_struct *tsec;
179 
180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
181         if (!tsec)
182                 panic("SELinux:  Failed to initialize initial task.\n");
183 
184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
185         cred->security = tsec;
186 }
187 
188 /*
189  * get the security ID of a set of credentials
190  */
191 static inline u32 cred_sid(const struct cred *cred)
192 {
193         const struct task_security_struct *tsec;
194 
195         tsec = cred->security;
196         return tsec->sid;
197 }
198 
199 /*
200  * get the objective security ID of a task
201  */
202 static inline u32 task_sid(const struct task_struct *task)
203 {
204         u32 sid;
205 
206         rcu_read_lock();
207         sid = cred_sid(__task_cred(task));
208         rcu_read_unlock();
209         return sid;
210 }
211 
212 /*
213  * get the subjective security ID of the current task
214  */
215 static inline u32 current_sid(void)
216 {
217         const struct task_security_struct *tsec = current_security();
218 
219         return tsec->sid;
220 }
221 
222 /* Allocate and free functions for each kind of security blob. */
223 
224 static int inode_alloc_security(struct inode *inode)
225 {
226         struct inode_security_struct *isec;
227         u32 sid = current_sid();
228 
229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
230         if (!isec)
231                 return -ENOMEM;
232 
233         mutex_init(&isec->lock);
234         INIT_LIST_HEAD(&isec->list);
235         isec->inode = inode;
236         isec->sid = SECINITSID_UNLABELED;
237         isec->sclass = SECCLASS_FILE;
238         isec->task_sid = sid;
239         inode->i_security = isec;
240 
241         return 0;
242 }
243 
244 static void inode_free_rcu(struct rcu_head *head)
245 {
246         struct inode_security_struct *isec;
247 
248         isec = container_of(head, struct inode_security_struct, rcu);
249         kmem_cache_free(sel_inode_cache, isec);
250 }
251 
252 static void inode_free_security(struct inode *inode)
253 {
254         struct inode_security_struct *isec = inode->i_security;
255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
256 
257         /*
258          * As not all inode security structures are in a list, we check for
259          * empty list outside of the lock to make sure that we won't waste
260          * time taking a lock doing nothing.
261          *
262          * The list_del_init() function can be safely called more than once.
263          * It should not be possible for this function to be called with
264          * concurrent list_add(), but for better safety against future changes
265          * in the code, we use list_empty_careful() here.
266          */
267         if (!list_empty_careful(&isec->list)) {
268                 spin_lock(&sbsec->isec_lock);
269                 list_del_init(&isec->list);
270                 spin_unlock(&sbsec->isec_lock);
271         }
272 
273         /*
274          * The inode may still be referenced in a path walk and
275          * a call to selinux_inode_permission() can be made
276          * after inode_free_security() is called. Ideally, the VFS
277          * wouldn't do this, but fixing that is a much harder
278          * job. For now, simply free the i_security via RCU, and
279          * leave the current inode->i_security pointer intact.
280          * The inode will be freed after the RCU grace period too.
281          */
282         call_rcu(&isec->rcu, inode_free_rcu);
283 }
284 
285 static int file_alloc_security(struct file *file)
286 {
287         struct file_security_struct *fsec;
288         u32 sid = current_sid();
289 
290         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
291         if (!fsec)
292                 return -ENOMEM;
293 
294         fsec->sid = sid;
295         fsec->fown_sid = sid;
296         file->f_security = fsec;
297 
298         return 0;
299 }
300 
301 static void file_free_security(struct file *file)
302 {
303         struct file_security_struct *fsec = file->f_security;
304         file->f_security = NULL;
305         kfree(fsec);
306 }
307 
308 static int superblock_alloc_security(struct super_block *sb)
309 {
310         struct superblock_security_struct *sbsec;
311 
312         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
313         if (!sbsec)
314                 return -ENOMEM;
315 
316         mutex_init(&sbsec->lock);
317         INIT_LIST_HEAD(&sbsec->isec_head);
318         spin_lock_init(&sbsec->isec_lock);
319         sbsec->sb = sb;
320         sbsec->sid = SECINITSID_UNLABELED;
321         sbsec->def_sid = SECINITSID_FILE;
322         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
323         sb->s_security = sbsec;
324 
325         return 0;
326 }
327 
328 static void superblock_free_security(struct super_block *sb)
329 {
330         struct superblock_security_struct *sbsec = sb->s_security;
331         sb->s_security = NULL;
332         kfree(sbsec);
333 }
334 
335 /* The file system's label must be initialized prior to use. */
336 
337 static const char *labeling_behaviors[7] = {
338         "uses xattr",
339         "uses transition SIDs",
340         "uses task SIDs",
341         "uses genfs_contexts",
342         "not configured for labeling",
343         "uses mountpoint labeling",
344         "uses native labeling",
345 };
346 
347 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
348 
349 static inline int inode_doinit(struct inode *inode)
350 {
351         return inode_doinit_with_dentry(inode, NULL);
352 }
353 
354 enum {
355         Opt_error = -1,
356         Opt_context = 1,
357         Opt_fscontext = 2,
358         Opt_defcontext = 3,
359         Opt_rootcontext = 4,
360         Opt_labelsupport = 5,
361         Opt_nextmntopt = 6,
362 };
363 
364 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
365 
366 static const match_table_t tokens = {
367         {Opt_context, CONTEXT_STR "%s"},
368         {Opt_fscontext, FSCONTEXT_STR "%s"},
369         {Opt_defcontext, DEFCONTEXT_STR "%s"},
370         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
371         {Opt_labelsupport, LABELSUPP_STR},
372         {Opt_error, NULL},
373 };
374 
375 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
376 
377 static int may_context_mount_sb_relabel(u32 sid,
378                         struct superblock_security_struct *sbsec,
379                         const struct cred *cred)
380 {
381         const struct task_security_struct *tsec = cred->security;
382         int rc;
383 
384         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
385                           FILESYSTEM__RELABELFROM, NULL);
386         if (rc)
387                 return rc;
388 
389         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
390                           FILESYSTEM__RELABELTO, NULL);
391         return rc;
392 }
393 
394 static int may_context_mount_inode_relabel(u32 sid,
395                         struct superblock_security_struct *sbsec,
396                         const struct cred *cred)
397 {
398         const struct task_security_struct *tsec = cred->security;
399         int rc;
400         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
401                           FILESYSTEM__RELABELFROM, NULL);
402         if (rc)
403                 return rc;
404 
405         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
406                           FILESYSTEM__ASSOCIATE, NULL);
407         return rc;
408 }
409 
410 static int selinux_is_sblabel_mnt(struct super_block *sb)
411 {
412         struct superblock_security_struct *sbsec = sb->s_security;
413 
414         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
415                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
416                 sbsec->behavior == SECURITY_FS_USE_TASK ||
417                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
418                 /* Special handling. Genfs but also in-core setxattr handler */
419                 !strcmp(sb->s_type->name, "sysfs") ||
420                 !strcmp(sb->s_type->name, "pstore") ||
421                 !strcmp(sb->s_type->name, "debugfs") ||
422                 !strcmp(sb->s_type->name, "rootfs");
423 }
424 
425 static int sb_finish_set_opts(struct super_block *sb)
426 {
427         struct superblock_security_struct *sbsec = sb->s_security;
428         struct dentry *root = sb->s_root;
429         struct inode *root_inode = d_backing_inode(root);
430         int rc = 0;
431 
432         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
433                 /* Make sure that the xattr handler exists and that no
434                    error other than -ENODATA is returned by getxattr on
435                    the root directory.  -ENODATA is ok, as this may be
436                    the first boot of the SELinux kernel before we have
437                    assigned xattr values to the filesystem. */
438                 if (!root_inode->i_op->getxattr) {
439                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
440                                "xattr support\n", sb->s_id, sb->s_type->name);
441                         rc = -EOPNOTSUPP;
442                         goto out;
443                 }
444                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
445                 if (rc < 0 && rc != -ENODATA) {
446                         if (rc == -EOPNOTSUPP)
447                                 printk(KERN_WARNING "SELinux: (dev %s, type "
448                                        "%s) has no security xattr handler\n",
449                                        sb->s_id, sb->s_type->name);
450                         else
451                                 printk(KERN_WARNING "SELinux: (dev %s, type "
452                                        "%s) getxattr errno %d\n", sb->s_id,
453                                        sb->s_type->name, -rc);
454                         goto out;
455                 }
456         }
457 
458         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
459                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
460                        sb->s_id, sb->s_type->name);
461 
462         sbsec->flags |= SE_SBINITIALIZED;
463         if (selinux_is_sblabel_mnt(sb))
464                 sbsec->flags |= SBLABEL_MNT;
465 
466         /* Initialize the root inode. */
467         rc = inode_doinit_with_dentry(root_inode, root);
468 
469         /* Initialize any other inodes associated with the superblock, e.g.
470            inodes created prior to initial policy load or inodes created
471            during get_sb by a pseudo filesystem that directly
472            populates itself. */
473         spin_lock(&sbsec->isec_lock);
474 next_inode:
475         if (!list_empty(&sbsec->isec_head)) {
476                 struct inode_security_struct *isec =
477                                 list_entry(sbsec->isec_head.next,
478                                            struct inode_security_struct, list);
479                 struct inode *inode = isec->inode;
480                 list_del_init(&isec->list);
481                 spin_unlock(&sbsec->isec_lock);
482                 inode = igrab(inode);
483                 if (inode) {
484                         if (!IS_PRIVATE(inode))
485                                 inode_doinit(inode);
486                         iput(inode);
487                 }
488                 spin_lock(&sbsec->isec_lock);
489                 goto next_inode;
490         }
491         spin_unlock(&sbsec->isec_lock);
492 out:
493         return rc;
494 }
495 
496 /*
497  * This function should allow an FS to ask what it's mount security
498  * options were so it can use those later for submounts, displaying
499  * mount options, or whatever.
500  */
501 static int selinux_get_mnt_opts(const struct super_block *sb,
502                                 struct security_mnt_opts *opts)
503 {
504         int rc = 0, i;
505         struct superblock_security_struct *sbsec = sb->s_security;
506         char *context = NULL;
507         u32 len;
508         char tmp;
509 
510         security_init_mnt_opts(opts);
511 
512         if (!(sbsec->flags & SE_SBINITIALIZED))
513                 return -EINVAL;
514 
515         if (!ss_initialized)
516                 return -EINVAL;
517 
518         /* make sure we always check enough bits to cover the mask */
519         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
520 
521         tmp = sbsec->flags & SE_MNTMASK;
522         /* count the number of mount options for this sb */
523         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
524                 if (tmp & 0x01)
525                         opts->num_mnt_opts++;
526                 tmp >>= 1;
527         }
528         /* Check if the Label support flag is set */
529         if (sbsec->flags & SBLABEL_MNT)
530                 opts->num_mnt_opts++;
531 
532         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
533         if (!opts->mnt_opts) {
534                 rc = -ENOMEM;
535                 goto out_free;
536         }
537 
538         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
539         if (!opts->mnt_opts_flags) {
540                 rc = -ENOMEM;
541                 goto out_free;
542         }
543 
544         i = 0;
545         if (sbsec->flags & FSCONTEXT_MNT) {
546                 rc = security_sid_to_context(sbsec->sid, &context, &len);
547                 if (rc)
548                         goto out_free;
549                 opts->mnt_opts[i] = context;
550                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
551         }
552         if (sbsec->flags & CONTEXT_MNT) {
553                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
554                 if (rc)
555                         goto out_free;
556                 opts->mnt_opts[i] = context;
557                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
558         }
559         if (sbsec->flags & DEFCONTEXT_MNT) {
560                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
561                 if (rc)
562                         goto out_free;
563                 opts->mnt_opts[i] = context;
564                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
565         }
566         if (sbsec->flags & ROOTCONTEXT_MNT) {
567                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
568                 struct inode_security_struct *isec = root->i_security;
569 
570                 rc = security_sid_to_context(isec->sid, &context, &len);
571                 if (rc)
572                         goto out_free;
573                 opts->mnt_opts[i] = context;
574                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
575         }
576         if (sbsec->flags & SBLABEL_MNT) {
577                 opts->mnt_opts[i] = NULL;
578                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
579         }
580 
581         BUG_ON(i != opts->num_mnt_opts);
582 
583         return 0;
584 
585 out_free:
586         security_free_mnt_opts(opts);
587         return rc;
588 }
589 
590 static int bad_option(struct superblock_security_struct *sbsec, char flag,
591                       u32 old_sid, u32 new_sid)
592 {
593         char mnt_flags = sbsec->flags & SE_MNTMASK;
594 
595         /* check if the old mount command had the same options */
596         if (sbsec->flags & SE_SBINITIALIZED)
597                 if (!(sbsec->flags & flag) ||
598                     (old_sid != new_sid))
599                         return 1;
600 
601         /* check if we were passed the same options twice,
602          * aka someone passed context=a,context=b
603          */
604         if (!(sbsec->flags & SE_SBINITIALIZED))
605                 if (mnt_flags & flag)
606                         return 1;
607         return 0;
608 }
609 
610 /*
611  * Allow filesystems with binary mount data to explicitly set mount point
612  * labeling information.
613  */
614 static int selinux_set_mnt_opts(struct super_block *sb,
615                                 struct security_mnt_opts *opts,
616                                 unsigned long kern_flags,
617                                 unsigned long *set_kern_flags)
618 {
619         const struct cred *cred = current_cred();
620         int rc = 0, i;
621         struct superblock_security_struct *sbsec = sb->s_security;
622         const char *name = sb->s_type->name;
623         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
624         struct inode_security_struct *root_isec = inode->i_security;
625         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
626         u32 defcontext_sid = 0;
627         char **mount_options = opts->mnt_opts;
628         int *flags = opts->mnt_opts_flags;
629         int num_opts = opts->num_mnt_opts;
630 
631         mutex_lock(&sbsec->lock);
632 
633         if (!ss_initialized) {
634                 if (!num_opts) {
635                         /* Defer initialization until selinux_complete_init,
636                            after the initial policy is loaded and the security
637                            server is ready to handle calls. */
638                         goto out;
639                 }
640                 rc = -EINVAL;
641                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
642                         "before the security server is initialized\n");
643                 goto out;
644         }
645         if (kern_flags && !set_kern_flags) {
646                 /* Specifying internal flags without providing a place to
647                  * place the results is not allowed */
648                 rc = -EINVAL;
649                 goto out;
650         }
651 
652         /*
653          * Binary mount data FS will come through this function twice.  Once
654          * from an explicit call and once from the generic calls from the vfs.
655          * Since the generic VFS calls will not contain any security mount data
656          * we need to skip the double mount verification.
657          *
658          * This does open a hole in which we will not notice if the first
659          * mount using this sb set explict options and a second mount using
660          * this sb does not set any security options.  (The first options
661          * will be used for both mounts)
662          */
663         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
664             && (num_opts == 0))
665                 goto out;
666 
667         /*
668          * parse the mount options, check if they are valid sids.
669          * also check if someone is trying to mount the same sb more
670          * than once with different security options.
671          */
672         for (i = 0; i < num_opts; i++) {
673                 u32 sid;
674 
675                 if (flags[i] == SBLABEL_MNT)
676                         continue;
677                 rc = security_context_to_sid(mount_options[i],
678                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
679                 if (rc) {
680                         printk(KERN_WARNING "SELinux: security_context_to_sid"
681                                "(%s) failed for (dev %s, type %s) errno=%d\n",
682                                mount_options[i], sb->s_id, name, rc);
683                         goto out;
684                 }
685                 switch (flags[i]) {
686                 case FSCONTEXT_MNT:
687                         fscontext_sid = sid;
688 
689                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
690                                         fscontext_sid))
691                                 goto out_double_mount;
692 
693                         sbsec->flags |= FSCONTEXT_MNT;
694                         break;
695                 case CONTEXT_MNT:
696                         context_sid = sid;
697 
698                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
699                                         context_sid))
700                                 goto out_double_mount;
701 
702                         sbsec->flags |= CONTEXT_MNT;
703                         break;
704                 case ROOTCONTEXT_MNT:
705                         rootcontext_sid = sid;
706 
707                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
708                                         rootcontext_sid))
709                                 goto out_double_mount;
710 
711                         sbsec->flags |= ROOTCONTEXT_MNT;
712 
713                         break;
714                 case DEFCONTEXT_MNT:
715                         defcontext_sid = sid;
716 
717                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
718                                         defcontext_sid))
719                                 goto out_double_mount;
720 
721                         sbsec->flags |= DEFCONTEXT_MNT;
722 
723                         break;
724                 default:
725                         rc = -EINVAL;
726                         goto out;
727                 }
728         }
729 
730         if (sbsec->flags & SE_SBINITIALIZED) {
731                 /* previously mounted with options, but not on this attempt? */
732                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
733                         goto out_double_mount;
734                 rc = 0;
735                 goto out;
736         }
737 
738         if (strcmp(sb->s_type->name, "proc") == 0)
739                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
740 
741         if (!strcmp(sb->s_type->name, "debugfs") ||
742             !strcmp(sb->s_type->name, "sysfs") ||
743             !strcmp(sb->s_type->name, "pstore"))
744                 sbsec->flags |= SE_SBGENFS;
745 
746         if (!sbsec->behavior) {
747                 /*
748                  * Determine the labeling behavior to use for this
749                  * filesystem type.
750                  */
751                 rc = security_fs_use(sb);
752                 if (rc) {
753                         printk(KERN_WARNING
754                                 "%s: security_fs_use(%s) returned %d\n",
755                                         __func__, sb->s_type->name, rc);
756                         goto out;
757                 }
758         }
759         /* sets the context of the superblock for the fs being mounted. */
760         if (fscontext_sid) {
761                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
762                 if (rc)
763                         goto out;
764 
765                 sbsec->sid = fscontext_sid;
766         }
767 
768         /*
769          * Switch to using mount point labeling behavior.
770          * sets the label used on all file below the mountpoint, and will set
771          * the superblock context if not already set.
772          */
773         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
774                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
775                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
776         }
777 
778         if (context_sid) {
779                 if (!fscontext_sid) {
780                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
781                                                           cred);
782                         if (rc)
783                                 goto out;
784                         sbsec->sid = context_sid;
785                 } else {
786                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
787                                                              cred);
788                         if (rc)
789                                 goto out;
790                 }
791                 if (!rootcontext_sid)
792                         rootcontext_sid = context_sid;
793 
794                 sbsec->mntpoint_sid = context_sid;
795                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
796         }
797 
798         if (rootcontext_sid) {
799                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
800                                                      cred);
801                 if (rc)
802                         goto out;
803 
804                 root_isec->sid = rootcontext_sid;
805                 root_isec->initialized = 1;
806         }
807 
808         if (defcontext_sid) {
809                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
810                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
811                         rc = -EINVAL;
812                         printk(KERN_WARNING "SELinux: defcontext option is "
813                                "invalid for this filesystem type\n");
814                         goto out;
815                 }
816 
817                 if (defcontext_sid != sbsec->def_sid) {
818                         rc = may_context_mount_inode_relabel(defcontext_sid,
819                                                              sbsec, cred);
820                         if (rc)
821                                 goto out;
822                 }
823 
824                 sbsec->def_sid = defcontext_sid;
825         }
826 
827         rc = sb_finish_set_opts(sb);
828 out:
829         mutex_unlock(&sbsec->lock);
830         return rc;
831 out_double_mount:
832         rc = -EINVAL;
833         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
834                "security settings for (dev %s, type %s)\n", sb->s_id, name);
835         goto out;
836 }
837 
838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
839                                     const struct super_block *newsb)
840 {
841         struct superblock_security_struct *old = oldsb->s_security;
842         struct superblock_security_struct *new = newsb->s_security;
843         char oldflags = old->flags & SE_MNTMASK;
844         char newflags = new->flags & SE_MNTMASK;
845 
846         if (oldflags != newflags)
847                 goto mismatch;
848         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
849                 goto mismatch;
850         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
851                 goto mismatch;
852         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
853                 goto mismatch;
854         if (oldflags & ROOTCONTEXT_MNT) {
855                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
856                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
857                 if (oldroot->sid != newroot->sid)
858                         goto mismatch;
859         }
860         return 0;
861 mismatch:
862         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
863                             "different security settings for (dev %s, "
864                             "type %s)\n", newsb->s_id, newsb->s_type->name);
865         return -EBUSY;
866 }
867 
868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
869                                         struct super_block *newsb)
870 {
871         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
872         struct superblock_security_struct *newsbsec = newsb->s_security;
873 
874         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
875         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
876         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
877 
878         /*
879          * if the parent was able to be mounted it clearly had no special lsm
880          * mount options.  thus we can safely deal with this superblock later
881          */
882         if (!ss_initialized)
883                 return 0;
884 
885         /* how can we clone if the old one wasn't set up?? */
886         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
887 
888         /* if fs is reusing a sb, make sure that the contexts match */
889         if (newsbsec->flags & SE_SBINITIALIZED)
890                 return selinux_cmp_sb_context(oldsb, newsb);
891 
892         mutex_lock(&newsbsec->lock);
893 
894         newsbsec->flags = oldsbsec->flags;
895 
896         newsbsec->sid = oldsbsec->sid;
897         newsbsec->def_sid = oldsbsec->def_sid;
898         newsbsec->behavior = oldsbsec->behavior;
899 
900         if (set_context) {
901                 u32 sid = oldsbsec->mntpoint_sid;
902 
903                 if (!set_fscontext)
904                         newsbsec->sid = sid;
905                 if (!set_rootcontext) {
906                         struct inode *newinode = d_backing_inode(newsb->s_root);
907                         struct inode_security_struct *newisec = newinode->i_security;
908                         newisec->sid = sid;
909                 }
910                 newsbsec->mntpoint_sid = sid;
911         }
912         if (set_rootcontext) {
913                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
914                 const struct inode_security_struct *oldisec = oldinode->i_security;
915                 struct inode *newinode = d_backing_inode(newsb->s_root);
916                 struct inode_security_struct *newisec = newinode->i_security;
917 
918                 newisec->sid = oldisec->sid;
919         }
920 
921         sb_finish_set_opts(newsb);
922         mutex_unlock(&newsbsec->lock);
923         return 0;
924 }
925 
926 static int selinux_parse_opts_str(char *options,
927                                   struct security_mnt_opts *opts)
928 {
929         char *p;
930         char *context = NULL, *defcontext = NULL;
931         char *fscontext = NULL, *rootcontext = NULL;
932         int rc, num_mnt_opts = 0;
933 
934         opts->num_mnt_opts = 0;
935 
936         /* Standard string-based options. */
937         while ((p = strsep(&options, "|")) != NULL) {
938                 int token;
939                 substring_t args[MAX_OPT_ARGS];
940 
941                 if (!*p)
942                         continue;
943 
944                 token = match_token(p, tokens, args);
945 
946                 switch (token) {
947                 case Opt_context:
948                         if (context || defcontext) {
949                                 rc = -EINVAL;
950                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
951                                 goto out_err;
952                         }
953                         context = match_strdup(&args[0]);
954                         if (!context) {
955                                 rc = -ENOMEM;
956                                 goto out_err;
957                         }
958                         break;
959 
960                 case Opt_fscontext:
961                         if (fscontext) {
962                                 rc = -EINVAL;
963                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
964                                 goto out_err;
965                         }
966                         fscontext = match_strdup(&args[0]);
967                         if (!fscontext) {
968                                 rc = -ENOMEM;
969                                 goto out_err;
970                         }
971                         break;
972 
973                 case Opt_rootcontext:
974                         if (rootcontext) {
975                                 rc = -EINVAL;
976                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
977                                 goto out_err;
978                         }
979                         rootcontext = match_strdup(&args[0]);
980                         if (!rootcontext) {
981                                 rc = -ENOMEM;
982                                 goto out_err;
983                         }
984                         break;
985 
986                 case Opt_defcontext:
987                         if (context || defcontext) {
988                                 rc = -EINVAL;
989                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
990                                 goto out_err;
991                         }
992                         defcontext = match_strdup(&args[0]);
993                         if (!defcontext) {
994                                 rc = -ENOMEM;
995                                 goto out_err;
996                         }
997                         break;
998                 case Opt_labelsupport:
999                         break;
1000                 default:
1001                         rc = -EINVAL;
1002                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1003                         goto out_err;
1004 
1005                 }
1006         }
1007 
1008         rc = -ENOMEM;
1009         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010         if (!opts->mnt_opts)
1011                 goto out_err;
1012 
1013         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014         if (!opts->mnt_opts_flags) {
1015                 kfree(opts->mnt_opts);
1016                 goto out_err;
1017         }
1018 
1019         if (fscontext) {
1020                 opts->mnt_opts[num_mnt_opts] = fscontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1022         }
1023         if (context) {
1024                 opts->mnt_opts[num_mnt_opts] = context;
1025                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1026         }
1027         if (rootcontext) {
1028                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1030         }
1031         if (defcontext) {
1032                 opts->mnt_opts[num_mnt_opts] = defcontext;
1033                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1034         }
1035 
1036         opts->num_mnt_opts = num_mnt_opts;
1037         return 0;
1038 
1039 out_err:
1040         kfree(context);
1041         kfree(defcontext);
1042         kfree(fscontext);
1043         kfree(rootcontext);
1044         return rc;
1045 }
1046 /*
1047  * string mount options parsing and call set the sbsec
1048  */
1049 static int superblock_doinit(struct super_block *sb, void *data)
1050 {
1051         int rc = 0;
1052         char *options = data;
1053         struct security_mnt_opts opts;
1054 
1055         security_init_mnt_opts(&opts);
1056 
1057         if (!data)
1058                 goto out;
1059 
1060         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061 
1062         rc = selinux_parse_opts_str(options, &opts);
1063         if (rc)
1064                 goto out_err;
1065 
1066 out:
1067         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1068 
1069 out_err:
1070         security_free_mnt_opts(&opts);
1071         return rc;
1072 }
1073 
1074 static void selinux_write_opts(struct seq_file *m,
1075                                struct security_mnt_opts *opts)
1076 {
1077         int i;
1078         char *prefix;
1079 
1080         for (i = 0; i < opts->num_mnt_opts; i++) {
1081                 char *has_comma;
1082 
1083                 if (opts->mnt_opts[i])
1084                         has_comma = strchr(opts->mnt_opts[i], ',');
1085                 else
1086                         has_comma = NULL;
1087 
1088                 switch (opts->mnt_opts_flags[i]) {
1089                 case CONTEXT_MNT:
1090                         prefix = CONTEXT_STR;
1091                         break;
1092                 case FSCONTEXT_MNT:
1093                         prefix = FSCONTEXT_STR;
1094                         break;
1095                 case ROOTCONTEXT_MNT:
1096                         prefix = ROOTCONTEXT_STR;
1097                         break;
1098                 case DEFCONTEXT_MNT:
1099                         prefix = DEFCONTEXT_STR;
1100                         break;
1101                 case SBLABEL_MNT:
1102                         seq_putc(m, ',');
1103                         seq_puts(m, LABELSUPP_STR);
1104                         continue;
1105                 default:
1106                         BUG();
1107                         return;
1108                 };
1109                 /* we need a comma before each option */
1110                 seq_putc(m, ',');
1111                 seq_puts(m, prefix);
1112                 if (has_comma)
1113                         seq_putc(m, '\"');
1114                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1115                 if (has_comma)
1116                         seq_putc(m, '\"');
1117         }
1118 }
1119 
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121 {
1122         struct security_mnt_opts opts;
1123         int rc;
1124 
1125         rc = selinux_get_mnt_opts(sb, &opts);
1126         if (rc) {
1127                 /* before policy load we may get EINVAL, don't show anything */
1128                 if (rc == -EINVAL)
1129                         rc = 0;
1130                 return rc;
1131         }
1132 
1133         selinux_write_opts(m, &opts);
1134 
1135         security_free_mnt_opts(&opts);
1136 
1137         return rc;
1138 }
1139 
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1141 {
1142         switch (mode & S_IFMT) {
1143         case S_IFSOCK:
1144                 return SECCLASS_SOCK_FILE;
1145         case S_IFLNK:
1146                 return SECCLASS_LNK_FILE;
1147         case S_IFREG:
1148                 return SECCLASS_FILE;
1149         case S_IFBLK:
1150                 return SECCLASS_BLK_FILE;
1151         case S_IFDIR:
1152                 return SECCLASS_DIR;
1153         case S_IFCHR:
1154                 return SECCLASS_CHR_FILE;
1155         case S_IFIFO:
1156                 return SECCLASS_FIFO_FILE;
1157 
1158         }
1159 
1160         return SECCLASS_FILE;
1161 }
1162 
1163 static inline int default_protocol_stream(int protocol)
1164 {
1165         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166 }
1167 
1168 static inline int default_protocol_dgram(int protocol)
1169 {
1170         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171 }
1172 
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174 {
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                         return SECCLASS_UNIX_DGRAM_SOCKET;
1183                 }
1184                 break;
1185         case PF_INET:
1186         case PF_INET6:
1187                 switch (type) {
1188                 case SOCK_STREAM:
1189                         if (default_protocol_stream(protocol))
1190                                 return SECCLASS_TCP_SOCKET;
1191                         else
1192                                 return SECCLASS_RAWIP_SOCKET;
1193                 case SOCK_DGRAM:
1194                         if (default_protocol_dgram(protocol))
1195                                 return SECCLASS_UDP_SOCKET;
1196                         else
1197                                 return SECCLASS_RAWIP_SOCKET;
1198                 case SOCK_DCCP:
1199                         return SECCLASS_DCCP_SOCKET;
1200                 default:
1201                         return SECCLASS_RAWIP_SOCKET;
1202                 }
1203                 break;
1204         case PF_NETLINK:
1205                 switch (protocol) {
1206                 case NETLINK_ROUTE:
1207                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1208                 case NETLINK_SOCK_DIAG:
1209                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210                 case NETLINK_NFLOG:
1211                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1212                 case NETLINK_XFRM:
1213                         return SECCLASS_NETLINK_XFRM_SOCKET;
1214                 case NETLINK_SELINUX:
1215                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1216                 case NETLINK_ISCSI:
1217                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1218                 case NETLINK_AUDIT:
1219                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1220                 case NETLINK_FIB_LOOKUP:
1221                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222                 case NETLINK_CONNECTOR:
1223                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224                 case NETLINK_NETFILTER:
1225                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226                 case NETLINK_DNRTMSG:
1227                         return SECCLASS_NETLINK_DNRT_SOCKET;
1228                 case NETLINK_KOBJECT_UEVENT:
1229                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230                 case NETLINK_GENERIC:
1231                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1232                 case NETLINK_SCSITRANSPORT:
1233                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234                 case NETLINK_RDMA:
1235                         return SECCLASS_NETLINK_RDMA_SOCKET;
1236                 case NETLINK_CRYPTO:
1237                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1238                 default:
1239                         return SECCLASS_NETLINK_SOCKET;
1240                 }
1241         case PF_PACKET:
1242                 return SECCLASS_PACKET_SOCKET;
1243         case PF_KEY:
1244                 return SECCLASS_KEY_SOCKET;
1245         case PF_APPLETALK:
1246                 return SECCLASS_APPLETALK_SOCKET;
1247         }
1248 
1249         return SECCLASS_SOCKET;
1250 }
1251 
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1253                                  u16 tclass,
1254                                  u16 flags,
1255                                  u32 *sid)
1256 {
1257         int rc;
1258         struct super_block *sb = dentry->d_inode->i_sb;
1259         char *buffer, *path;
1260 
1261         buffer = (char *)__get_free_page(GFP_KERNEL);
1262         if (!buffer)
1263                 return -ENOMEM;
1264 
1265         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266         if (IS_ERR(path))
1267                 rc = PTR_ERR(path);
1268         else {
1269                 if (flags & SE_SBPROC) {
1270                         /* each process gets a /proc/PID/ entry. Strip off the
1271                          * PID part to get a valid selinux labeling.
1272                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273                         while (path[1] >= '' && path[1] <= '9') {
1274                                 path[1] = '/';
1275                                 path++;
1276                         }
1277                 }
1278                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1279         }
1280         free_page((unsigned long)buffer);
1281         return rc;
1282 }
1283 
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286 {
1287         struct superblock_security_struct *sbsec = NULL;
1288         struct inode_security_struct *isec = inode->i_security;
1289         u32 sid;
1290         struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292         char *context = NULL;
1293         unsigned len = 0;
1294         int rc = 0;
1295 
1296         if (isec->initialized)
1297                 goto out;
1298 
1299         mutex_lock(&isec->lock);
1300         if (isec->initialized)
1301                 goto out_unlock;
1302 
1303         sbsec = inode->i_sb->s_security;
1304         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305                 /* Defer initialization until selinux_complete_init,
1306                    after the initial policy is loaded and the security
1307                    server is ready to handle calls. */
1308                 spin_lock(&sbsec->isec_lock);
1309                 if (list_empty(&isec->list))
1310                         list_add(&isec->list, &sbsec->isec_head);
1311                 spin_unlock(&sbsec->isec_lock);
1312                 goto out_unlock;
1313         }
1314 
1315         switch (sbsec->behavior) {
1316         case SECURITY_FS_USE_NATIVE:
1317                 break;
1318         case SECURITY_FS_USE_XATTR:
1319                 if (!inode->i_op->getxattr) {
1320                         isec->sid = sbsec->def_sid;
1321                         break;
1322                 }
1323 
1324                 /* Need a dentry, since the xattr API requires one.
1325                    Life would be simpler if we could just pass the inode. */
1326                 if (opt_dentry) {
1327                         /* Called from d_instantiate or d_splice_alias. */
1328                         dentry = dget(opt_dentry);
1329                 } else {
1330                         /* Called from selinux_complete_init, try to find a dentry. */
1331                         dentry = d_find_alias(inode);
1332                 }
1333                 if (!dentry) {
1334                         /*
1335                          * this is can be hit on boot when a file is accessed
1336                          * before the policy is loaded.  When we load policy we
1337                          * may find inodes that have no dentry on the
1338                          * sbsec->isec_head list.  No reason to complain as these
1339                          * will get fixed up the next time we go through
1340                          * inode_doinit with a dentry, before these inodes could
1341                          * be used again by userspace.
1342                          */
1343                         goto out_unlock;
1344                 }
1345 
1346                 len = INITCONTEXTLEN;
1347                 context = kmalloc(len+1, GFP_NOFS);
1348                 if (!context) {
1349                         rc = -ENOMEM;
1350                         dput(dentry);
1351                         goto out_unlock;
1352                 }
1353                 context[len] = '\0';
1354                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355                                            context, len);
1356                 if (rc == -ERANGE) {
1357                         kfree(context);
1358 
1359                         /* Need a larger buffer.  Query for the right size. */
1360                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361                                                    NULL, 0);
1362                         if (rc < 0) {
1363                                 dput(dentry);
1364                                 goto out_unlock;
1365                         }
1366                         len = rc;
1367                         context = kmalloc(len+1, GFP_NOFS);
1368                         if (!context) {
1369                                 rc = -ENOMEM;
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         context[len] = '\0';
1374                         rc = inode->i_op->getxattr(dentry,
1375                                                    XATTR_NAME_SELINUX,
1376                                                    context, len);
1377                 }
1378                 dput(dentry);
1379                 if (rc < 0) {
1380                         if (rc != -ENODATA) {
1381                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1382                                        "%d for dev=%s ino=%ld\n", __func__,
1383                                        -rc, inode->i_sb->s_id, inode->i_ino);
1384                                 kfree(context);
1385                                 goto out_unlock;
1386                         }
1387                         /* Map ENODATA to the default file SID */
1388                         sid = sbsec->def_sid;
1389                         rc = 0;
1390                 } else {
1391                         rc = security_context_to_sid_default(context, rc, &sid,
1392                                                              sbsec->def_sid,
1393                                                              GFP_NOFS);
1394                         if (rc) {
1395                                 char *dev = inode->i_sb->s_id;
1396                                 unsigned long ino = inode->i_ino;
1397 
1398                                 if (rc == -EINVAL) {
1399                                         if (printk_ratelimit())
1400                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1402                                                         "filesystem in question.\n", ino, dev, context);
1403                                 } else {
1404                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1405                                                "returned %d for dev=%s ino=%ld\n",
1406                                                __func__, context, -rc, dev, ino);
1407                                 }
1408                                 kfree(context);
1409                                 /* Leave with the unlabeled SID */
1410                                 rc = 0;
1411                                 break;
1412                         }
1413                 }
1414                 kfree(context);
1415                 isec->sid = sid;
1416                 break;
1417         case SECURITY_FS_USE_TASK:
1418                 isec->sid = isec->task_sid;
1419                 break;
1420         case SECURITY_FS_USE_TRANS:
1421                 /* Default to the fs SID. */
1422                 isec->sid = sbsec->sid;
1423 
1424                 /* Try to obtain a transition SID. */
1425                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427                                              isec->sclass, NULL, &sid);
1428                 if (rc)
1429                         goto out_unlock;
1430                 isec->sid = sid;
1431                 break;
1432         case SECURITY_FS_USE_MNTPOINT:
1433                 isec->sid = sbsec->mntpoint_sid;
1434                 break;
1435         default:
1436                 /* Default to the fs superblock SID. */
1437                 isec->sid = sbsec->sid;
1438 
1439                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440                         /* We must have a dentry to determine the label on
1441                          * procfs inodes */
1442                         if (opt_dentry)
1443                                 /* Called from d_instantiate or
1444                                  * d_splice_alias. */
1445                                 dentry = dget(opt_dentry);
1446                         else
1447                                 /* Called from selinux_complete_init, try to
1448                                  * find a dentry. */
1449                                 dentry = d_find_alias(inode);
1450                         /*
1451                          * This can be hit on boot when a file is accessed
1452                          * before the policy is loaded.  When we load policy we
1453                          * may find inodes that have no dentry on the
1454                          * sbsec->isec_head list.  No reason to complain as
1455                          * these will get fixed up the next time we go through
1456                          * inode_doinit() with a dentry, before these inodes
1457                          * could be used again by userspace.
1458                          */
1459                         if (!dentry)
1460                                 goto out_unlock;
1461                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463                                                    sbsec->flags, &sid);
1464                         dput(dentry);
1465                         if (rc)
1466                                 goto out_unlock;
1467                         isec->sid = sid;
1468                 }
1469                 break;
1470         }
1471 
1472         isec->initialized = 1;
1473 
1474 out_unlock:
1475         mutex_unlock(&isec->lock);
1476 out:
1477         if (isec->sclass == SECCLASS_FILE)
1478                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1479         return rc;
1480 }
1481 
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1484 {
1485         u32 perm = 0;
1486 
1487         switch (sig) {
1488         case SIGCHLD:
1489                 /* Commonly granted from child to parent. */
1490                 perm = PROCESS__SIGCHLD;
1491                 break;
1492         case SIGKILL:
1493                 /* Cannot be caught or ignored */
1494                 perm = PROCESS__SIGKILL;
1495                 break;
1496         case SIGSTOP:
1497                 /* Cannot be caught or ignored */
1498                 perm = PROCESS__SIGSTOP;
1499                 break;
1500         default:
1501                 /* All other signals. */
1502                 perm = PROCESS__SIGNAL;
1503                 break;
1504         }
1505 
1506         return perm;
1507 }
1508 
1509 /*
1510  * Check permission between a pair of credentials
1511  * fork check, ptrace check, etc.
1512  */
1513 static int cred_has_perm(const struct cred *actor,
1514                          const struct cred *target,
1515                          u32 perms)
1516 {
1517         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518 
1519         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521 
1522 /*
1523  * Check permission between a pair of tasks, e.g. signal checks,
1524  * fork check, ptrace check, etc.
1525  * tsk1 is the actor and tsk2 is the target
1526  * - this uses the default subjective creds of tsk1
1527  */
1528 static int task_has_perm(const struct task_struct *tsk1,
1529                          const struct task_struct *tsk2,
1530                          u32 perms)
1531 {
1532         const struct task_security_struct *__tsec1, *__tsec2;
1533         u32 sid1, sid2;
1534 
1535         rcu_read_lock();
1536         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1537         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1538         rcu_read_unlock();
1539         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1540 }
1541 
1542 /*
1543  * Check permission between current and another task, e.g. signal checks,
1544  * fork check, ptrace check, etc.
1545  * current is the actor and tsk2 is the target
1546  * - this uses current's subjective creds
1547  */
1548 static int current_has_perm(const struct task_struct *tsk,
1549                             u32 perms)
1550 {
1551         u32 sid, tsid;
1552 
1553         sid = current_sid();
1554         tsid = task_sid(tsk);
1555         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556 }
1557 
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1560 #endif
1561 
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1564                                int cap, int audit)
1565 {
1566         struct common_audit_data ad;
1567         struct av_decision avd;
1568         u16 sclass;
1569         u32 sid = cred_sid(cred);
1570         u32 av = CAP_TO_MASK(cap);
1571         int rc;
1572 
1573         ad.type = LSM_AUDIT_DATA_CAP;
1574         ad.u.cap = cap;
1575 
1576         switch (CAP_TO_INDEX(cap)) {
1577         case 0:
1578                 sclass = SECCLASS_CAPABILITY;
1579                 break;
1580         case 1:
1581                 sclass = SECCLASS_CAPABILITY2;
1582                 break;
1583         default:
1584                 printk(KERN_ERR
1585                        "SELinux:  out of range capability %d\n", cap);
1586                 BUG();
1587                 return -EINVAL;
1588         }
1589 
1590         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591         if (audit == SECURITY_CAP_AUDIT) {
1592                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1593                 if (rc2)
1594                         return rc2;
1595         }
1596         return rc;
1597 }
1598 
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1601                            u32 perms)
1602 {
1603         u32 sid = task_sid(tsk);
1604 
1605         return avc_has_perm(sid, SECINITSID_KERNEL,
1606                             SECCLASS_SYSTEM, perms, NULL);
1607 }
1608 
1609 /* Check whether a task has a particular permission to an inode.
1610    The 'adp' parameter is optional and allows other audit
1611    data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613                           struct inode *inode,
1614                           u32 perms,
1615                           struct common_audit_data *adp)
1616 {
1617         struct inode_security_struct *isec;
1618         u32 sid;
1619 
1620         validate_creds(cred);
1621 
1622         if (unlikely(IS_PRIVATE(inode)))
1623                 return 0;
1624 
1625         sid = cred_sid(cred);
1626         isec = inode->i_security;
1627 
1628         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1629 }
1630 
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632    the dentry to help the auditing code to more easily generate the
1633    pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635                                   struct dentry *dentry,
1636                                   u32 av)
1637 {
1638         struct inode *inode = d_backing_inode(dentry);
1639         struct common_audit_data ad;
1640 
1641         ad.type = LSM_AUDIT_DATA_DENTRY;
1642         ad.u.dentry = dentry;
1643         return inode_has_perm(cred, inode, av, &ad);
1644 }
1645 
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647    the path to help the auditing code to more easily generate the
1648    pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650                                 const struct path *path,
1651                                 u32 av)
1652 {
1653         struct inode *inode = d_backing_inode(path->dentry);
1654         struct common_audit_data ad;
1655 
1656         ad.type = LSM_AUDIT_DATA_PATH;
1657         ad.u.path = *path;
1658         return inode_has_perm(cred, inode, av, &ad);
1659 }
1660 
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1663                                      struct file *file,
1664                                      u32 av)
1665 {
1666         struct common_audit_data ad;
1667 
1668         ad.type = LSM_AUDIT_DATA_PATH;
1669         ad.u.path = file->f_path;
1670         return inode_has_perm(cred, file_inode(file), av, &ad);
1671 }
1672 
1673 /* Check whether a task can use an open file descriptor to
1674    access an inode in a given way.  Check access to the
1675    descriptor itself, and then use dentry_has_perm to
1676    check a particular permission to the file.
1677    Access to the descriptor is implicitly granted if it
1678    has the same SID as the process.  If av is zero, then
1679    access to the file is not checked, e.g. for cases
1680    where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1682                          struct file *file,
1683                          u32 av)
1684 {
1685         struct file_security_struct *fsec = file->f_security;
1686         struct inode *inode = file_inode(file);
1687         struct common_audit_data ad;
1688         u32 sid = cred_sid(cred);
1689         int rc;
1690 
1691         ad.type = LSM_AUDIT_DATA_PATH;
1692         ad.u.path = file->f_path;
1693 
1694         if (sid != fsec->sid) {
1695                 rc = avc_has_perm(sid, fsec->sid,
1696                                   SECCLASS_FD,
1697                                   FD__USE,
1698                                   &ad);
1699                 if (rc)
1700                         goto out;
1701         }
1702 
1703         /* av is zero if only checking access to the descriptor. */
1704         rc = 0;
1705         if (av)
1706                 rc = inode_has_perm(cred, inode, av, &ad);
1707 
1708 out:
1709         return rc;
1710 }
1711 
1712 /*
1713  * Determine the label for an inode that might be unioned.
1714  */
1715 static int selinux_determine_inode_label(const struct inode *dir,
1716                                          const struct qstr *name,
1717                                          u16 tclass,
1718                                          u32 *_new_isid)
1719 {
1720         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721         const struct inode_security_struct *dsec = dir->i_security;
1722         const struct task_security_struct *tsec = current_security();
1723 
1724         if ((sbsec->flags & SE_SBINITIALIZED) &&
1725             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726                 *_new_isid = sbsec->mntpoint_sid;
1727         } else if ((sbsec->flags & SBLABEL_MNT) &&
1728                    tsec->create_sid) {
1729                 *_new_isid = tsec->create_sid;
1730         } else {
1731                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1732                                                name, _new_isid);
1733         }
1734 
1735         return 0;
1736 }
1737 
1738 /* Check whether a task can create a file. */
1739 static int may_create(struct inode *dir,
1740                       struct dentry *dentry,
1741                       u16 tclass)
1742 {
1743         const struct task_security_struct *tsec = current_security();
1744         struct inode_security_struct *dsec;
1745         struct superblock_security_struct *sbsec;
1746         u32 sid, newsid;
1747         struct common_audit_data ad;
1748         int rc;
1749 
1750         dsec = dir->i_security;
1751         sbsec = dir->i_sb->s_security;
1752 
1753         sid = tsec->sid;
1754 
1755         ad.type = LSM_AUDIT_DATA_DENTRY;
1756         ad.u.dentry = dentry;
1757 
1758         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1759                           DIR__ADD_NAME | DIR__SEARCH,
1760                           &ad);
1761         if (rc)
1762                 return rc;
1763 
1764         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1765                                            &newsid);
1766         if (rc)
1767                 return rc;
1768 
1769         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1770         if (rc)
1771                 return rc;
1772 
1773         return avc_has_perm(newsid, sbsec->sid,
1774                             SECCLASS_FILESYSTEM,
1775                             FILESYSTEM__ASSOCIATE, &ad);
1776 }
1777 
1778 /* Check whether a task can create a key. */
1779 static int may_create_key(u32 ksid,
1780                           struct task_struct *ctx)
1781 {
1782         u32 sid = task_sid(ctx);
1783 
1784         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1785 }
1786 
1787 #define MAY_LINK        0
1788 #define MAY_UNLINK      1
1789 #define MAY_RMDIR       2
1790 
1791 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1792 static int may_link(struct inode *dir,
1793                     struct dentry *dentry,
1794                     int kind)
1795 
1796 {
1797         struct inode_security_struct *dsec, *isec;
1798         struct common_audit_data ad;
1799         u32 sid = current_sid();
1800         u32 av;
1801         int rc;
1802 
1803         dsec = dir->i_security;
1804         isec = d_backing_inode(dentry)->i_security;
1805 
1806         ad.type = LSM_AUDIT_DATA_DENTRY;
1807         ad.u.dentry = dentry;
1808 
1809         av = DIR__SEARCH;
1810         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1811         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1812         if (rc)
1813                 return rc;
1814 
1815         switch (kind) {
1816         case MAY_LINK:
1817                 av = FILE__LINK;
1818                 break;
1819         case MAY_UNLINK:
1820                 av = FILE__UNLINK;
1821                 break;
1822         case MAY_RMDIR:
1823                 av = DIR__RMDIR;
1824                 break;
1825         default:
1826                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1827                         __func__, kind);
1828                 return 0;
1829         }
1830 
1831         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1832         return rc;
1833 }
1834 
1835 static inline int may_rename(struct inode *old_dir,
1836                              struct dentry *old_dentry,
1837                              struct inode *new_dir,
1838                              struct dentry *new_dentry)
1839 {
1840         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1841         struct common_audit_data ad;
1842         u32 sid = current_sid();
1843         u32 av;
1844         int old_is_dir, new_is_dir;
1845         int rc;
1846 
1847         old_dsec = old_dir->i_security;
1848         old_isec = d_backing_inode(old_dentry)->i_security;
1849         old_is_dir = d_is_dir(old_dentry);
1850         new_dsec = new_dir->i_security;
1851 
1852         ad.type = LSM_AUDIT_DATA_DENTRY;
1853 
1854         ad.u.dentry = old_dentry;
1855         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1856                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1857         if (rc)
1858                 return rc;
1859         rc = avc_has_perm(sid, old_isec->sid,
1860                           old_isec->sclass, FILE__RENAME, &ad);
1861         if (rc)
1862                 return rc;
1863         if (old_is_dir && new_dir != old_dir) {
1864                 rc = avc_has_perm(sid, old_isec->sid,
1865                                   old_isec->sclass, DIR__REPARENT, &ad);
1866                 if (rc)
1867                         return rc;
1868         }
1869 
1870         ad.u.dentry = new_dentry;
1871         av = DIR__ADD_NAME | DIR__SEARCH;
1872         if (d_is_positive(new_dentry))
1873                 av |= DIR__REMOVE_NAME;
1874         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1875         if (rc)
1876                 return rc;
1877         if (d_is_positive(new_dentry)) {
1878                 new_isec = d_backing_inode(new_dentry)->i_security;
1879                 new_is_dir = d_is_dir(new_dentry);
1880                 rc = avc_has_perm(sid, new_isec->sid,
1881                                   new_isec->sclass,
1882                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1883                 if (rc)
1884                         return rc;
1885         }
1886 
1887         return 0;
1888 }
1889 
1890 /* Check whether a task can perform a filesystem operation. */
1891 static int superblock_has_perm(const struct cred *cred,
1892                                struct super_block *sb,
1893                                u32 perms,
1894                                struct common_audit_data *ad)
1895 {
1896         struct superblock_security_struct *sbsec;
1897         u32 sid = cred_sid(cred);
1898 
1899         sbsec = sb->s_security;
1900         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1901 }
1902 
1903 /* Convert a Linux mode and permission mask to an access vector. */
1904 static inline u32 file_mask_to_av(int mode, int mask)
1905 {
1906         u32 av = 0;
1907 
1908         if (!S_ISDIR(mode)) {
1909                 if (mask & MAY_EXEC)
1910                         av |= FILE__EXECUTE;
1911                 if (mask & MAY_READ)
1912                         av |= FILE__READ;
1913 
1914                 if (mask & MAY_APPEND)
1915                         av |= FILE__APPEND;
1916                 else if (mask & MAY_WRITE)
1917                         av |= FILE__WRITE;
1918 
1919         } else {
1920                 if (mask & MAY_EXEC)
1921                         av |= DIR__SEARCH;
1922                 if (mask & MAY_WRITE)
1923                         av |= DIR__WRITE;
1924                 if (mask & MAY_READ)
1925                         av |= DIR__READ;
1926         }
1927 
1928         return av;
1929 }
1930 
1931 /* Convert a Linux file to an access vector. */
1932 static inline u32 file_to_av(struct file *file)
1933 {
1934         u32 av = 0;
1935 
1936         if (file->f_mode & FMODE_READ)
1937                 av |= FILE__READ;
1938         if (file->f_mode & FMODE_WRITE) {
1939                 if (file->f_flags & O_APPEND)
1940                         av |= FILE__APPEND;
1941                 else
1942                         av |= FILE__WRITE;
1943         }
1944         if (!av) {
1945                 /*
1946                  * Special file opened with flags 3 for ioctl-only use.
1947                  */
1948                 av = FILE__IOCTL;
1949         }
1950 
1951         return av;
1952 }
1953 
1954 /*
1955  * Convert a file to an access vector and include the correct open
1956  * open permission.
1957  */
1958 static inline u32 open_file_to_av(struct file *file)
1959 {
1960         u32 av = file_to_av(file);
1961 
1962         if (selinux_policycap_openperm)
1963                 av |= FILE__OPEN;
1964 
1965         return av;
1966 }
1967 
1968 /* Hook functions begin here. */
1969 
1970 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1971 {
1972         u32 mysid = current_sid();
1973         u32 mgrsid = task_sid(mgr);
1974 
1975         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976                             BINDER__SET_CONTEXT_MGR, NULL);
1977 }
1978 
1979 static int selinux_binder_transaction(struct task_struct *from,
1980                                       struct task_struct *to)
1981 {
1982         u32 mysid = current_sid();
1983         u32 fromsid = task_sid(from);
1984         u32 tosid = task_sid(to);
1985         int rc;
1986 
1987         if (mysid != fromsid) {
1988                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989                                   BINDER__IMPERSONATE, NULL);
1990                 if (rc)
1991                         return rc;
1992         }
1993 
1994         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1995                             NULL);
1996 }
1997 
1998 static int selinux_binder_transfer_binder(struct task_struct *from,
1999                                           struct task_struct *to)
2000 {
2001         u32 fromsid = task_sid(from);
2002         u32 tosid = task_sid(to);
2003 
2004         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2005                             NULL);
2006 }
2007 
2008 static int selinux_binder_transfer_file(struct task_struct *from,
2009                                         struct task_struct *to,
2010                                         struct file *file)
2011 {
2012         u32 sid = task_sid(to);
2013         struct file_security_struct *fsec = file->f_security;
2014         struct inode *inode = d_backing_inode(file->f_path.dentry);
2015         struct inode_security_struct *isec = inode->i_security;
2016         struct common_audit_data ad;
2017         int rc;
2018 
2019         ad.type = LSM_AUDIT_DATA_PATH;
2020         ad.u.path = file->f_path;
2021 
2022         if (sid != fsec->sid) {
2023                 rc = avc_has_perm(sid, fsec->sid,
2024                                   SECCLASS_FD,
2025                                   FD__USE,
2026                                   &ad);
2027                 if (rc)
2028                         return rc;
2029         }
2030 
2031         if (unlikely(IS_PRIVATE(inode)))
2032                 return 0;
2033 
2034         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2035                             &ad);
2036 }
2037 
2038 static int selinux_ptrace_access_check(struct task_struct *child,
2039                                      unsigned int mode)
2040 {
2041         if (mode & PTRACE_MODE_READ) {
2042                 u32 sid = current_sid();
2043                 u32 csid = task_sid(child);
2044                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2045         }
2046 
2047         return current_has_perm(child, PROCESS__PTRACE);
2048 }
2049 
2050 static int selinux_ptrace_traceme(struct task_struct *parent)
2051 {
2052         return task_has_perm(parent, current, PROCESS__PTRACE);
2053 }
2054 
2055 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2056                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2057 {
2058         return current_has_perm(target, PROCESS__GETCAP);
2059 }
2060 
2061 static int selinux_capset(struct cred *new, const struct cred *old,
2062                           const kernel_cap_t *effective,
2063                           const kernel_cap_t *inheritable,
2064                           const kernel_cap_t *permitted)
2065 {
2066         return cred_has_perm(old, new, PROCESS__SETCAP);
2067 }
2068 
2069 /*
2070  * (This comment used to live with the selinux_task_setuid hook,
2071  * which was removed).
2072  *
2073  * Since setuid only affects the current process, and since the SELinux
2074  * controls are not based on the Linux identity attributes, SELinux does not
2075  * need to control this operation.  However, SELinux does control the use of
2076  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2077  */
2078 
2079 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2080                            int cap, int audit)
2081 {
2082         return cred_has_capability(cred, cap, audit);
2083 }
2084 
2085 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2086 {
2087         const struct cred *cred = current_cred();
2088         int rc = 0;
2089 
2090         if (!sb)
2091                 return 0;
2092 
2093         switch (cmds) {
2094         case Q_SYNC:
2095         case Q_QUOTAON:
2096         case Q_QUOTAOFF:
2097         case Q_SETINFO:
2098         case Q_SETQUOTA:
2099                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2100                 break;
2101         case Q_GETFMT:
2102         case Q_GETINFO:
2103         case Q_GETQUOTA:
2104                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2105                 break;
2106         default:
2107                 rc = 0;  /* let the kernel handle invalid cmds */
2108                 break;
2109         }
2110         return rc;
2111 }
2112 
2113 static int selinux_quota_on(struct dentry *dentry)
2114 {
2115         const struct cred *cred = current_cred();
2116 
2117         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2118 }
2119 
2120 static int selinux_syslog(int type)
2121 {
2122         int rc;
2123 
2124         switch (type) {
2125         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2126         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2127                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2128                 break;
2129         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2131         /* Set level of messages printed to console */
2132         case SYSLOG_ACTION_CONSOLE_LEVEL:
2133                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2134                 break;
2135         case SYSLOG_ACTION_CLOSE:       /* Close log */
2136         case SYSLOG_ACTION_OPEN:        /* Open log */
2137         case SYSLOG_ACTION_READ:        /* Read from log */
2138         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2139         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2140         default:
2141                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2142                 break;
2143         }
2144         return rc;
2145 }
2146 
2147 /*
2148  * Check that a process has enough memory to allocate a new virtual
2149  * mapping. 0 means there is enough memory for the allocation to
2150  * succeed and -ENOMEM implies there is not.
2151  *
2152  * Do not audit the selinux permission check, as this is applied to all
2153  * processes that allocate mappings.
2154  */
2155 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2156 {
2157         int rc, cap_sys_admin = 0;
2158 
2159         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160                                         SECURITY_CAP_NOAUDIT);
2161         if (rc == 0)
2162                 cap_sys_admin = 1;
2163 
2164         return cap_sys_admin;
2165 }
2166 
2167 /* binprm security operations */
2168 
2169 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170                             const struct task_security_struct *old_tsec,
2171                             const struct task_security_struct *new_tsec)
2172 {
2173         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2175         int rc;
2176 
2177         if (!nnp && !nosuid)
2178                 return 0; /* neither NNP nor nosuid */
2179 
2180         if (new_tsec->sid == old_tsec->sid)
2181                 return 0; /* No change in credentials */
2182 
2183         /*
2184          * The only transitions we permit under NNP or nosuid
2185          * are transitions to bounded SIDs, i.e. SIDs that are
2186          * guaranteed to only be allowed a subset of the permissions
2187          * of the current SID.
2188          */
2189         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2190         if (rc) {
2191                 /*
2192                  * On failure, preserve the errno values for NNP vs nosuid.
2193                  * NNP:  Operation not permitted for caller.
2194                  * nosuid:  Permission denied to file.
2195                  */
2196                 if (nnp)
2197                         return -EPERM;
2198                 else
2199                         return -EACCES;
2200         }
2201         return 0;
2202 }
2203 
2204 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2205 {
2206         const struct task_security_struct *old_tsec;
2207         struct task_security_struct *new_tsec;
2208         struct inode_security_struct *isec;
2209         struct common_audit_data ad;
2210         struct inode *inode = file_inode(bprm->file);
2211         int rc;
2212 
2213         /* SELinux context only depends on initial program or script and not
2214          * the script interpreter */
2215         if (bprm->cred_prepared)
2216                 return 0;
2217 
2218         old_tsec = current_security();
2219         new_tsec = bprm->cred->security;
2220         isec = inode->i_security;
2221 
2222         /* Default to the current task SID. */
2223         new_tsec->sid = old_tsec->sid;
2224         new_tsec->osid = old_tsec->sid;
2225 
2226         /* Reset fs, key, and sock SIDs on execve. */
2227         new_tsec->create_sid = 0;
2228         new_tsec->keycreate_sid = 0;
2229         new_tsec->sockcreate_sid = 0;
2230 
2231         if (old_tsec->exec_sid) {
2232                 new_tsec->sid = old_tsec->exec_sid;
2233                 /* Reset exec SID on execve. */
2234                 new_tsec->exec_sid = 0;
2235 
2236                 /* Fail on NNP or nosuid if not an allowed transition. */
2237                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2238                 if (rc)
2239                         return rc;
2240         } else {
2241                 /* Check for a default transition on this program. */
2242                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2243                                              SECCLASS_PROCESS, NULL,
2244                                              &new_tsec->sid);
2245                 if (rc)
2246                         return rc;
2247 
2248                 /*
2249                  * Fallback to old SID on NNP or nosuid if not an allowed
2250                  * transition.
2251                  */
2252                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253                 if (rc)
2254                         new_tsec->sid = old_tsec->sid;
2255         }
2256 
2257         ad.type = LSM_AUDIT_DATA_PATH;
2258         ad.u.path = bprm->file->f_path;
2259 
2260         if (new_tsec->sid == old_tsec->sid) {
2261                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2262                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2263                 if (rc)
2264                         return rc;
2265         } else {
2266                 /* Check permissions for the transition. */
2267                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2269                 if (rc)
2270                         return rc;
2271 
2272                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2273                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2274                 if (rc)
2275                         return rc;
2276 
2277                 /* Check for shared state */
2278                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280                                           SECCLASS_PROCESS, PROCESS__SHARE,
2281                                           NULL);
2282                         if (rc)
2283                                 return -EPERM;
2284                 }
2285 
2286                 /* Make sure that anyone attempting to ptrace over a task that
2287                  * changes its SID has the appropriate permit */
2288                 if (bprm->unsafe &
2289                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290                         struct task_struct *tracer;
2291                         struct task_security_struct *sec;
2292                         u32 ptsid = 0;
2293 
2294                         rcu_read_lock();
2295                         tracer = ptrace_parent(current);
2296                         if (likely(tracer != NULL)) {
2297                                 sec = __task_cred(tracer)->security;
2298                                 ptsid = sec->sid;
2299                         }
2300                         rcu_read_unlock();
2301 
2302                         if (ptsid != 0) {
2303                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2304                                                   SECCLASS_PROCESS,
2305                                                   PROCESS__PTRACE, NULL);
2306                                 if (rc)
2307                                         return -EPERM;
2308                         }
2309                 }
2310 
2311                 /* Clear any possibly unsafe personality bits on exec: */
2312                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2313         }
2314 
2315         return 0;
2316 }
2317 
2318 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2319 {
2320         const struct task_security_struct *tsec = current_security();
2321         u32 sid, osid;
2322         int atsecure = 0;
2323 
2324         sid = tsec->sid;
2325         osid = tsec->osid;
2326 
2327         if (osid != sid) {
2328                 /* Enable secure mode for SIDs transitions unless
2329                    the noatsecure permission is granted between
2330                    the two SIDs, i.e. ahp returns 0. */
2331                 atsecure = avc_has_perm(osid, sid,
2332                                         SECCLASS_PROCESS,
2333                                         PROCESS__NOATSECURE, NULL);
2334         }
2335 
2336         return !!atsecure;
2337 }
2338 
2339 static int match_file(const void *p, struct file *file, unsigned fd)
2340 {
2341         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2342 }
2343 
2344 /* Derived from fs/exec.c:flush_old_files. */
2345 static inline void flush_unauthorized_files(const struct cred *cred,
2346                                             struct files_struct *files)
2347 {
2348         struct file *file, *devnull = NULL;
2349         struct tty_struct *tty;
2350         int drop_tty = 0;
2351         unsigned n;
2352 
2353         tty = get_current_tty();
2354         if (tty) {
2355                 spin_lock(&tty_files_lock);
2356                 if (!list_empty(&tty->tty_files)) {
2357                         struct tty_file_private *file_priv;
2358 
2359                         /* Revalidate access to controlling tty.
2360                            Use file_path_has_perm on the tty path directly
2361                            rather than using file_has_perm, as this particular
2362                            open file may belong to another process and we are
2363                            only interested in the inode-based check here. */
2364                         file_priv = list_first_entry(&tty->tty_files,
2365                                                 struct tty_file_private, list);
2366                         file = file_priv->file;
2367                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2368                                 drop_tty = 1;
2369                 }
2370                 spin_unlock(&tty_files_lock);
2371                 tty_kref_put(tty);
2372         }
2373         /* Reset controlling tty. */
2374         if (drop_tty)
2375                 no_tty();
2376 
2377         /* Revalidate access to inherited open files. */
2378         n = iterate_fd(files, 0, match_file, cred);
2379         if (!n) /* none found? */
2380                 return;
2381 
2382         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2383         if (IS_ERR(devnull))
2384                 devnull = NULL;
2385         /* replace all the matching ones with this */
2386         do {
2387                 replace_fd(n - 1, devnull, 0);
2388         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2389         if (devnull)
2390                 fput(devnull);
2391 }
2392 
2393 /*
2394  * Prepare a process for imminent new credential changes due to exec
2395  */
2396 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2397 {
2398         struct task_security_struct *new_tsec;
2399         struct rlimit *rlim, *initrlim;
2400         int rc, i;
2401 
2402         new_tsec = bprm->cred->security;
2403         if (new_tsec->sid == new_tsec->osid)
2404                 return;
2405 
2406         /* Close files for which the new task SID is not authorized. */
2407         flush_unauthorized_files(bprm->cred, current->files);
2408 
2409         /* Always clear parent death signal on SID transitions. */
2410         current->pdeath_signal = 0;
2411 
2412         /* Check whether the new SID can inherit resource limits from the old
2413          * SID.  If not, reset all soft limits to the lower of the current
2414          * task's hard limit and the init task's soft limit.
2415          *
2416          * Note that the setting of hard limits (even to lower them) can be
2417          * controlled by the setrlimit check.  The inclusion of the init task's
2418          * soft limit into the computation is to avoid resetting soft limits
2419          * higher than the default soft limit for cases where the default is
2420          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2421          */
2422         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423                           PROCESS__RLIMITINH, NULL);
2424         if (rc) {
2425                 /* protect against do_prlimit() */
2426                 task_lock(current);
2427                 for (i = 0; i < RLIM_NLIMITS; i++) {
2428                         rlim = current->signal->rlim + i;
2429                         initrlim = init_task.signal->rlim + i;
2430                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2431                 }
2432                 task_unlock(current);
2433                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2434         }
2435 }
2436 
2437 /*
2438  * Clean up the process immediately after the installation of new credentials
2439  * due to exec
2440  */
2441 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2442 {
2443         const struct task_security_struct *tsec = current_security();
2444         struct itimerval itimer;
2445         u32 osid, sid;
2446         int rc, i;
2447 
2448         osid = tsec->osid;
2449         sid = tsec->sid;
2450 
2451         if (sid == osid)
2452                 return;
2453 
2454         /* Check whether the new SID can inherit signal state from the old SID.
2455          * If not, clear itimers to avoid subsequent signal generation and
2456          * flush and unblock signals.
2457          *
2458          * This must occur _after_ the task SID has been updated so that any
2459          * kill done after the flush will be checked against the new SID.
2460          */
2461         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2462         if (rc) {
2463                 memset(&itimer, 0, sizeof itimer);
2464                 for (i = 0; i < 3; i++)
2465                         do_setitimer(i, &itimer, NULL);
2466                 spin_lock_irq(&current->sighand->siglock);
2467                 if (!fatal_signal_pending(current)) {
2468                         flush_sigqueue(&current->pending);
2469                         flush_sigqueue(&current->signal->shared_pending);
2470                         flush_signal_handlers(current, 1);
2471                         sigemptyset(&current->blocked);
2472                         recalc_sigpending();
2473                 }
2474                 spin_unlock_irq(&current->sighand->siglock);
2475         }
2476 
2477         /* Wake up the parent if it is waiting so that it can recheck
2478          * wait permission to the new task SID. */
2479         read_lock(&tasklist_lock);
2480         __wake_up_parent(current, current->real_parent);
2481         read_unlock(&tasklist_lock);
2482 }
2483 
2484 /* superblock security operations */
2485 
2486 static int selinux_sb_alloc_security(struct super_block *sb)
2487 {
2488         return superblock_alloc_security(sb);
2489 }
2490 
2491 static void selinux_sb_free_security(struct super_block *sb)
2492 {
2493         superblock_free_security(sb);
2494 }
2495 
2496 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2497 {
2498         if (plen > olen)
2499                 return 0;
2500 
2501         return !memcmp(prefix, option, plen);
2502 }
2503 
2504 static inline int selinux_option(char *option, int len)
2505 {
2506         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2511 }
2512 
2513 static inline void take_option(char **to, char *from, int *first, int len)
2514 {
2515         if (!*first) {
2516                 **to = ',';
2517                 *to += 1;
2518         } else
2519                 *first = 0;
2520         memcpy(*to, from, len);
2521         *to += len;
2522 }
2523 
2524 static inline void take_selinux_option(char **to, char *from, int *first,
2525                                        int len)
2526 {
2527         int current_size = 0;
2528 
2529         if (!*first) {
2530                 **to = '|';
2531                 *to += 1;
2532         } else
2533                 *first = 0;
2534 
2535         while (current_size < len) {
2536                 if (*from != '"') {
2537                         **to = *from;
2538                         *to += 1;
2539                 }
2540                 from += 1;
2541                 current_size += 1;
2542         }
2543 }
2544 
2545 static int selinux_sb_copy_data(char *orig, char *copy)
2546 {
2547         int fnosec, fsec, rc = 0;
2548         char *in_save, *in_curr, *in_end;
2549         char *sec_curr, *nosec_save, *nosec;
2550         int open_quote = 0;
2551 
2552         in_curr = orig;
2553         sec_curr = copy;
2554 
2555         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2556         if (!nosec) {
2557                 rc = -ENOMEM;
2558                 goto out;
2559         }
2560 
2561         nosec_save = nosec;
2562         fnosec = fsec = 1;
2563         in_save = in_end = orig;
2564 
2565         do {
2566                 if (*in_end == '"')
2567                         open_quote = !open_quote;
2568                 if ((*in_end == ',' && open_quote == 0) ||
2569                                 *in_end == '\0') {
2570                         int len = in_end - in_curr;
2571 
2572                         if (selinux_option(in_curr, len))
2573                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2574                         else
2575                                 take_option(&nosec, in_curr, &fnosec, len);
2576 
2577                         in_curr = in_end + 1;
2578                 }
2579         } while (*in_end++);
2580 
2581         strcpy(in_save, nosec_save);
2582         free_page((unsigned long)nosec_save);
2583 out:
2584         return rc;
2585 }
2586 
2587 static int selinux_sb_remount(struct super_block *sb, void *data)
2588 {
2589         int rc, i, *flags;
2590         struct security_mnt_opts opts;
2591         char *secdata, **mount_options;
2592         struct superblock_security_struct *sbsec = sb->s_security;
2593 
2594         if (!(sbsec->flags & SE_SBINITIALIZED))
2595                 return 0;
2596 
2597         if (!data)
2598                 return 0;
2599 
2600         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2601                 return 0;
2602 
2603         security_init_mnt_opts(&opts);
2604         secdata = alloc_secdata();
2605         if (!secdata)
2606                 return -ENOMEM;
2607         rc = selinux_sb_copy_data(data, secdata);
2608         if (rc)
2609                 goto out_free_secdata;
2610 
2611         rc = selinux_parse_opts_str(secdata, &opts);
2612         if (rc)
2613                 goto out_free_secdata;
2614 
2615         mount_options = opts.mnt_opts;
2616         flags = opts.mnt_opts_flags;
2617 
2618         for (i = 0; i < opts.num_mnt_opts; i++) {
2619                 u32 sid;
2620                 size_t len;
2621 
2622                 if (flags[i] == SBLABEL_MNT)
2623                         continue;
2624                 len = strlen(mount_options[i]);
2625                 rc = security_context_to_sid(mount_options[i], len, &sid,
2626                                              GFP_KERNEL);
2627                 if (rc) {
2628                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2629                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2630                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2631                         goto out_free_opts;
2632                 }
2633                 rc = -EINVAL;
2634                 switch (flags[i]) {
2635                 case FSCONTEXT_MNT:
2636                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2637                                 goto out_bad_option;
2638                         break;
2639                 case CONTEXT_MNT:
2640                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2641                                 goto out_bad_option;
2642                         break;
2643                 case ROOTCONTEXT_MNT: {
2644                         struct inode_security_struct *root_isec;
2645                         root_isec = d_backing_inode(sb->s_root)->i_security;
2646 
2647                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2648                                 goto out_bad_option;
2649                         break;
2650                 }
2651                 case DEFCONTEXT_MNT:
2652                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2653                                 goto out_bad_option;
2654                         break;
2655                 default:
2656                         goto out_free_opts;
2657                 }
2658         }
2659 
2660         rc = 0;
2661 out_free_opts:
2662         security_free_mnt_opts(&opts);
2663 out_free_secdata:
2664         free_secdata(secdata);
2665         return rc;
2666 out_bad_option:
2667         printk(KERN_WARNING "SELinux: unable to change security options "
2668                "during remount (dev %s, type=%s)\n", sb->s_id,
2669                sb->s_type->name);
2670         goto out_free_opts;
2671 }
2672 
2673 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2674 {
2675         const struct cred *cred = current_cred();
2676         struct common_audit_data ad;
2677         int rc;
2678 
2679         rc = superblock_doinit(sb, data);
2680         if (rc)
2681                 return rc;
2682 
2683         /* Allow all mounts performed by the kernel */
2684         if (flags & MS_KERNMOUNT)
2685                 return 0;
2686 
2687         ad.type = LSM_AUDIT_DATA_DENTRY;
2688         ad.u.dentry = sb->s_root;
2689         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2690 }
2691 
2692 static int selinux_sb_statfs(struct dentry *dentry)
2693 {
2694         const struct cred *cred = current_cred();
2695         struct common_audit_data ad;
2696 
2697         ad.type = LSM_AUDIT_DATA_DENTRY;
2698         ad.u.dentry = dentry->d_sb->s_root;
2699         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2700 }
2701 
2702 static int selinux_mount(const char *dev_name,
2703                          struct path *path,
2704                          const char *type,
2705                          unsigned long flags,
2706                          void *data)
2707 {
2708         const struct cred *cred = current_cred();
2709 
2710         if (flags & MS_REMOUNT)
2711                 return superblock_has_perm(cred, path->dentry->d_sb,
2712                                            FILESYSTEM__REMOUNT, NULL);
2713         else
2714                 return path_has_perm(cred, path, FILE__MOUNTON);
2715 }
2716 
2717 static int selinux_umount(struct vfsmount *mnt, int flags)
2718 {
2719         const struct cred *cred = current_cred();
2720 
2721         return superblock_has_perm(cred, mnt->mnt_sb,
2722                                    FILESYSTEM__UNMOUNT, NULL);
2723 }
2724 
2725 /* inode security operations */
2726 
2727 static int selinux_inode_alloc_security(struct inode *inode)
2728 {
2729         return inode_alloc_security(inode);
2730 }
2731 
2732 static void selinux_inode_free_security(struct inode *inode)
2733 {
2734         inode_free_security(inode);
2735 }
2736 
2737 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2738                                         struct qstr *name, void **ctx,
2739                                         u32 *ctxlen)
2740 {
2741         u32 newsid;
2742         int rc;
2743 
2744         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2745                                            inode_mode_to_security_class(mode),
2746                                            &newsid);
2747         if (rc)
2748                 return rc;
2749 
2750         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2751 }
2752 
2753 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2754                                        const struct qstr *qstr,
2755                                        const char **name,
2756                                        void **value, size_t *len)
2757 {
2758         const struct task_security_struct *tsec = current_security();
2759         struct inode_security_struct *dsec;
2760         struct superblock_security_struct *sbsec;
2761         u32 sid, newsid, clen;
2762         int rc;
2763         char *context;
2764 
2765         dsec = dir->i_security;
2766         sbsec = dir->i_sb->s_security;
2767 
2768         sid = tsec->sid;
2769         newsid = tsec->create_sid;
2770 
2771         rc = selinux_determine_inode_label(
2772                 dir, qstr,
2773                 inode_mode_to_security_class(inode->i_mode),
2774                 &newsid);
2775         if (rc)
2776                 return rc;
2777 
2778         /* Possibly defer initialization to selinux_complete_init. */
2779         if (sbsec->flags & SE_SBINITIALIZED) {
2780                 struct inode_security_struct *isec = inode->i_security;
2781                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2782                 isec->sid = newsid;
2783                 isec->initialized = 1;
2784         }
2785 
2786         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2787                 return -EOPNOTSUPP;
2788 
2789         if (name)
2790                 *name = XATTR_SELINUX_SUFFIX;
2791 
2792         if (value && len) {
2793                 rc = security_sid_to_context_force(newsid, &context, &clen);
2794                 if (rc)
2795                         return rc;
2796                 *value = context;
2797                 *len = clen;
2798         }
2799 
2800         return 0;
2801 }
2802 
2803 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2804 {
2805         return may_create(dir, dentry, SECCLASS_FILE);
2806 }
2807 
2808 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2809 {
2810         return may_link(dir, old_dentry, MAY_LINK);
2811 }
2812 
2813 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2814 {
2815         return may_link(dir, dentry, MAY_UNLINK);
2816 }
2817 
2818 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2819 {
2820         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2821 }
2822 
2823 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2824 {
2825         return may_create(dir, dentry, SECCLASS_DIR);
2826 }
2827 
2828 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2829 {
2830         return may_link(dir, dentry, MAY_RMDIR);
2831 }
2832 
2833 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2834 {
2835         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2836 }
2837 
2838 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2839                                 struct inode *new_inode, struct dentry *new_dentry)
2840 {
2841         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2842 }
2843 
2844 static int selinux_inode_readlink(struct dentry *dentry)
2845 {
2846         const struct cred *cred = current_cred();
2847 
2848         return dentry_has_perm(cred, dentry, FILE__READ);
2849 }
2850 
2851 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2852                                      bool rcu)
2853 {
2854         const struct cred *cred = current_cred();
2855         struct common_audit_data ad;
2856         struct inode_security_struct *isec;
2857         u32 sid;
2858 
2859         validate_creds(cred);
2860 
2861         ad.type = LSM_AUDIT_DATA_DENTRY;
2862         ad.u.dentry = dentry;
2863         sid = cred_sid(cred);
2864         isec = inode->i_security;
2865 
2866         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2867                                   rcu ? MAY_NOT_BLOCK : 0);
2868 }
2869 
2870 static noinline int audit_inode_permission(struct inode *inode,
2871                                            u32 perms, u32 audited, u32 denied,
2872                                            int result,
2873                                            unsigned flags)
2874 {
2875         struct common_audit_data ad;
2876         struct inode_security_struct *isec = inode->i_security;
2877         int rc;
2878 
2879         ad.type = LSM_AUDIT_DATA_INODE;
2880         ad.u.inode = inode;
2881 
2882         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2883                             audited, denied, result, &ad, flags);
2884         if (rc)
2885                 return rc;
2886         return 0;
2887 }
2888 
2889 static int selinux_inode_permission(struct inode *inode, int mask)
2890 {
2891         const struct cred *cred = current_cred();
2892         u32 perms;
2893         bool from_access;
2894         unsigned flags = mask & MAY_NOT_BLOCK;
2895         struct inode_security_struct *isec;
2896         u32 sid;
2897         struct av_decision avd;
2898         int rc, rc2;
2899         u32 audited, denied;
2900 
2901         from_access = mask & MAY_ACCESS;
2902         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2903 
2904         /* No permission to check.  Existence test. */
2905         if (!mask)
2906                 return 0;
2907 
2908         validate_creds(cred);
2909 
2910         if (unlikely(IS_PRIVATE(inode)))
2911                 return 0;
2912 
2913         perms = file_mask_to_av(inode->i_mode, mask);
2914 
2915         sid = cred_sid(cred);
2916         isec = inode->i_security;
2917 
2918         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2919         audited = avc_audit_required(perms, &avd, rc,
2920                                      from_access ? FILE__AUDIT_ACCESS : 0,
2921                                      &denied);
2922         if (likely(!audited))
2923                 return rc;
2924 
2925         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2926         if (rc2)
2927                 return rc2;
2928         return rc;
2929 }
2930 
2931 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2932 {
2933         const struct cred *cred = current_cred();
2934         unsigned int ia_valid = iattr->ia_valid;
2935         __u32 av = FILE__WRITE;
2936 
2937         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2938         if (ia_valid & ATTR_FORCE) {
2939                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2940                               ATTR_FORCE);
2941                 if (!ia_valid)
2942                         return 0;
2943         }
2944 
2945         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2946                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2947                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2948 
2949         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2950                 av |= FILE__OPEN;
2951 
2952         return dentry_has_perm(cred, dentry, av);
2953 }
2954 
2955 static int selinux_inode_getattr(const struct path *path)
2956 {
2957         return path_has_perm(current_cred(), path, FILE__GETATTR);
2958 }
2959 
2960 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2961 {
2962         const struct cred *cred = current_cred();
2963 
2964         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2965                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2966                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2967                         if (!capable(CAP_SETFCAP))
2968                                 return -EPERM;
2969                 } else if (!capable(CAP_SYS_ADMIN)) {
2970                         /* A different attribute in the security namespace.
2971                            Restrict to administrator. */
2972                         return -EPERM;
2973                 }
2974         }
2975 
2976         /* Not an attribute we recognize, so just check the
2977            ordinary setattr permission. */
2978         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2979 }
2980 
2981 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2982                                   const void *value, size_t size, int flags)
2983 {
2984         struct inode *inode = d_backing_inode(dentry);
2985         struct inode_security_struct *isec = inode->i_security;
2986         struct superblock_security_struct *sbsec;
2987         struct common_audit_data ad;
2988         u32 newsid, sid = current_sid();
2989         int rc = 0;
2990 
2991         if (strcmp(name, XATTR_NAME_SELINUX))
2992                 return selinux_inode_setotherxattr(dentry, name);
2993 
2994         sbsec = inode->i_sb->s_security;
2995         if (!(sbsec->flags & SBLABEL_MNT))
2996                 return -EOPNOTSUPP;
2997 
2998         if (!inode_owner_or_capable(inode))
2999                 return -EPERM;
3000 
3001         ad.type = LSM_AUDIT_DATA_DENTRY;
3002         ad.u.dentry = dentry;
3003 
3004         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3005                           FILE__RELABELFROM, &ad);
3006         if (rc)
3007                 return rc;
3008 
3009         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3010         if (rc == -EINVAL) {
3011                 if (!capable(CAP_MAC_ADMIN)) {
3012                         struct audit_buffer *ab;
3013                         size_t audit_size;
3014                         const char *str;
3015 
3016                         /* We strip a nul only if it is at the end, otherwise the
3017                          * context contains a nul and we should audit that */
3018                         if (value) {
3019                                 str = value;
3020                                 if (str[size - 1] == '\0')
3021                                         audit_size = size - 1;
3022                                 else
3023                                         audit_size = size;
3024                         } else {
3025                                 str = "";
3026                                 audit_size = 0;
3027                         }
3028                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3029                         audit_log_format(ab, "op=setxattr invalid_context=");
3030                         audit_log_n_untrustedstring(ab, value, audit_size);
3031                         audit_log_end(ab);
3032 
3033                         return rc;
3034                 }
3035                 rc = security_context_to_sid_force(value, size, &newsid);
3036         }
3037         if (rc)
3038                 return rc;
3039 
3040         rc = avc_has_perm(sid, newsid, isec->sclass,
3041                           FILE__RELABELTO, &ad);
3042         if (rc)
3043                 return rc;
3044 
3045         rc = security_validate_transition(isec->sid, newsid, sid,
3046                                           isec->sclass);
3047         if (rc)
3048                 return rc;
3049 
3050         return avc_has_perm(newsid,
3051                             sbsec->sid,
3052                             SECCLASS_FILESYSTEM,
3053                             FILESYSTEM__ASSOCIATE,
3054                             &ad);
3055 }
3056 
3057 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3058                                         const void *value, size_t size,
3059                                         int flags)
3060 {
3061         struct inode *inode = d_backing_inode(dentry);
3062         struct inode_security_struct *isec = inode->i_security;
3063         u32 newsid;
3064         int rc;
3065 
3066         if (strcmp(name, XATTR_NAME_SELINUX)) {
3067                 /* Not an attribute we recognize, so nothing to do. */
3068                 return;
3069         }
3070 
3071         rc = security_context_to_sid_force(value, size, &newsid);
3072         if (rc) {
3073                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3074                        "for (%s, %lu), rc=%d\n",
3075                        inode->i_sb->s_id, inode->i_ino, -rc);
3076                 return;
3077         }
3078 
3079         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3080         isec->sid = newsid;
3081         isec->initialized = 1;
3082 
3083         return;
3084 }
3085 
3086 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3087 {
3088         const struct cred *cred = current_cred();
3089 
3090         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3091 }
3092 
3093 static int selinux_inode_listxattr(struct dentry *dentry)
3094 {
3095         const struct cred *cred = current_cred();
3096 
3097         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3098 }
3099 
3100 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3101 {
3102         if (strcmp(name, XATTR_NAME_SELINUX))
3103                 return selinux_inode_setotherxattr(dentry, name);
3104 
3105         /* No one is allowed to remove a SELinux security label.
3106            You can change the label, but all data must be labeled. */
3107         return -EACCES;
3108 }
3109 
3110 /*
3111  * Copy the inode security context value to the user.
3112  *
3113  * Permission check is handled by selinux_inode_getxattr hook.
3114  */
3115 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3116 {
3117         u32 size;
3118         int error;
3119         char *context = NULL;
3120         struct inode_security_struct *isec = inode->i_security;
3121 
3122         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3123                 return -EOPNOTSUPP;
3124 
3125         /*
3126          * If the caller has CAP_MAC_ADMIN, then get the raw context
3127          * value even if it is not defined by current policy; otherwise,
3128          * use the in-core value under current policy.
3129          * Use the non-auditing forms of the permission checks since
3130          * getxattr may be called by unprivileged processes commonly
3131          * and lack of permission just means that we fall back to the
3132          * in-core context value, not a denial.
3133          */
3134         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3135                             SECURITY_CAP_NOAUDIT);
3136         if (!error)
3137                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3138                                             SECURITY_CAP_NOAUDIT);
3139         if (!error)
3140                 error = security_sid_to_context_force(isec->sid, &context,
3141                                                       &size);
3142         else
3143                 error = security_sid_to_context(isec->sid, &context, &size);
3144         if (error)
3145                 return error;
3146         error = size;
3147         if (alloc) {
3148                 *buffer = context;
3149                 goto out_nofree;
3150         }
3151         kfree(context);
3152 out_nofree:
3153         return error;
3154 }
3155 
3156 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3157                                      const void *value, size_t size, int flags)
3158 {
3159         struct inode_security_struct *isec = inode->i_security;
3160         u32 newsid;
3161         int rc;
3162 
3163         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3164                 return -EOPNOTSUPP;
3165 
3166         if (!value || !size)
3167                 return -EACCES;
3168 
3169         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3170         if (rc)
3171                 return rc;
3172 
3173         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3174         isec->sid = newsid;
3175         isec->initialized = 1;
3176         return 0;
3177 }
3178 
3179 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3180 {
3181         const int len = sizeof(XATTR_NAME_SELINUX);
3182         if (buffer && len <= buffer_size)
3183                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3184         return len;
3185 }
3186 
3187 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3188 {
3189         struct inode_security_struct *isec = inode->i_security;
3190         *secid = isec->sid;
3191 }
3192 
3193 /* file security operations */
3194 
3195 static int selinux_revalidate_file_permission(struct file *file, int mask)
3196 {
3197         const struct cred *cred = current_cred();
3198         struct inode *inode = file_inode(file);
3199 
3200         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3201         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3202                 mask |= MAY_APPEND;
3203 
3204         return file_has_perm(cred, file,
3205                              file_mask_to_av(inode->i_mode, mask));
3206 }
3207 
3208 static int selinux_file_permission(struct file *file, int mask)
3209 {
3210         struct inode *inode = file_inode(file);
3211         struct file_security_struct *fsec = file->f_security;
3212         struct inode_security_struct *isec = inode->i_security;
3213         u32 sid = current_sid();
3214 
3215         if (!mask)
3216                 /* No permission to check.  Existence test. */
3217                 return 0;
3218 
3219         if (sid == fsec->sid && fsec->isid == isec->sid &&
3220             fsec->pseqno == avc_policy_seqno())
3221                 /* No change since file_open check. */
3222                 return 0;
3223 
3224         return selinux_revalidate_file_permission(file, mask);
3225 }
3226 
3227 static int selinux_file_alloc_security(struct file *file)
3228 {
3229         return file_alloc_security(file);
3230 }
3231 
3232 static void selinux_file_free_security(struct file *file)
3233 {
3234         file_free_security(file);
3235 }
3236 
3237 /*
3238  * Check whether a task has the ioctl permission and cmd
3239  * operation to an inode.
3240  */
3241 int ioctl_has_perm(const struct cred *cred, struct file *file,
3242                 u32 requested, u16 cmd)
3243 {
3244         struct common_audit_data ad;
3245         struct file_security_struct *fsec = file->f_security;
3246         struct inode *inode = file_inode(file);
3247         struct inode_security_struct *isec = inode->i_security;
3248         struct lsm_ioctlop_audit ioctl;
3249         u32 ssid = cred_sid(cred);
3250         int rc;
3251         u8 driver = cmd >> 8;
3252         u8 xperm = cmd & 0xff;
3253 
3254         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3255         ad.u.op = &ioctl;
3256         ad.u.op->cmd = cmd;
3257         ad.u.op->path = file->f_path;
3258 
3259         if (ssid != fsec->sid) {
3260                 rc = avc_has_perm(ssid, fsec->sid,
3261                                 SECCLASS_FD,
3262                                 FD__USE,
3263                                 &ad);
3264                 if (rc)
3265                         goto out;
3266         }
3267 
3268         if (unlikely(IS_PRIVATE(inode)))
3269                 return 0;
3270 
3271         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3272                         requested, driver, xperm, &ad);
3273 out:
3274         return rc;
3275 }
3276 
3277 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3278                               unsigned long arg)
3279 {
3280         const struct cred *cred = current_cred();
3281         int error = 0;
3282 
3283         switch (cmd) {
3284         case FIONREAD:
3285         /* fall through */
3286         case FIBMAP:
3287         /* fall through */
3288         case FIGETBSZ:
3289         /* fall through */
3290         case FS_IOC_GETFLAGS:
3291         /* fall through */
3292         case FS_IOC_GETVERSION:
3293                 error = file_has_perm(cred, file, FILE__GETATTR);
3294                 break;
3295 
3296         case FS_IOC_SETFLAGS:
3297         /* fall through */
3298         case FS_IOC_SETVERSION:
3299                 error = file_has_perm(cred, file, FILE__SETATTR);
3300                 break;
3301 
3302         /* sys_ioctl() checks */
3303         case FIONBIO:
3304         /* fall through */
3305         case FIOASYNC:
3306                 error = file_has_perm(cred, file, 0);
3307                 break;
3308 
3309         case KDSKBENT:
3310         case KDSKBSENT:
3311                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3312                                             SECURITY_CAP_AUDIT);
3313                 break;
3314 
3315         /* default case assumes that the command will go
3316          * to the file's ioctl() function.
3317          */
3318         default:
3319                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3320         }
3321         return error;
3322 }
3323 
3324 static int default_noexec;
3325 
3326 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3327 {
3328         const struct cred *cred = current_cred();
3329         int rc = 0;
3330 
3331         if (default_noexec &&
3332             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3333                                    (!shared && (prot & PROT_WRITE)))) {
3334                 /*
3335                  * We are making executable an anonymous mapping or a
3336                  * private file mapping that will also be writable.
3337                  * This has an additional check.
3338                  */
3339                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3340                 if (rc)
3341                         goto error;
3342         }
3343 
3344         if (file) {
3345                 /* read access is always possible with a mapping */
3346                 u32 av = FILE__READ;
3347 
3348                 /* write access only matters if the mapping is shared */
3349                 if (shared && (prot & PROT_WRITE))
3350                         av |= FILE__WRITE;
3351 
3352                 if (prot & PROT_EXEC)
3353                         av |= FILE__EXECUTE;
3354 
3355                 return file_has_perm(cred, file, av);
3356         }
3357 
3358 error:
3359         return rc;
3360 }
3361 
3362 static int selinux_mmap_addr(unsigned long addr)
3363 {
3364         int rc = 0;
3365 
3366         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3367                 u32 sid = current_sid();
3368                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3369                                   MEMPROTECT__MMAP_ZERO, NULL);
3370         }
3371 
3372         return rc;
3373 }
3374 
3375 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3376                              unsigned long prot, unsigned long flags)
3377 {
3378         if (selinux_checkreqprot)
3379                 prot = reqprot;
3380 
3381         return file_map_prot_check(file, prot,
3382                                    (flags & MAP_TYPE) == MAP_SHARED);
3383 }
3384 
3385 static int selinux_file_mprotect(struct vm_area_struct *vma,
3386                                  unsigned long reqprot,
3387                                  unsigned long prot)
3388 {
3389         const struct cred *cred = current_cred();
3390 
3391         if (selinux_checkreqprot)
3392                 prot = reqprot;
3393 
3394         if (default_noexec &&
3395             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3396                 int rc = 0;
3397                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3398                     vma->vm_end <= vma->vm_mm->brk) {
3399                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3400                 } else if (!vma->vm_file &&
3401                            vma->vm_start <= vma->vm_mm->start_stack &&
3402                            vma->vm_end >= vma->vm_mm->start_stack) {
3403                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3404                 } else if (vma->vm_file && vma->anon_vma) {
3405                         /*
3406                          * We are making executable a file mapping that has
3407                          * had some COW done. Since pages might have been
3408                          * written, check ability to execute the possibly
3409                          * modified content.  This typically should only
3410                          * occur for text relocations.
3411                          */
3412                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3413                 }
3414                 if (rc)
3415                         return rc;
3416         }
3417 
3418         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3419 }
3420 
3421 static int selinux_file_lock(struct file *file, unsigned int cmd)
3422 {
3423         const struct cred *cred = current_cred();
3424 
3425         return file_has_perm(cred, file, FILE__LOCK);
3426 }
3427 
3428 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3429                               unsigned long arg)
3430 {
3431         const struct cred *cred = current_cred();
3432         int err = 0;
3433 
3434         switch (cmd) {
3435         case F_SETFL:
3436                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3437                         err = file_has_perm(cred, file, FILE__WRITE);
3438                         break;
3439                 }
3440                 /* fall through */
3441         case F_SETOWN:
3442         case F_SETSIG:
3443         case F_GETFL:
3444         case F_GETOWN:
3445         case F_GETSIG:
3446         case F_GETOWNER_UIDS:
3447                 /* Just check FD__USE permission */
3448                 err = file_has_perm(cred, file, 0);
3449                 break;
3450         case F_GETLK:
3451         case F_SETLK:
3452         case F_SETLKW:
3453         case F_OFD_GETLK:
3454         case F_OFD_SETLK:
3455         case F_OFD_SETLKW:
3456 #if BITS_PER_LONG == 32
3457         case F_GETLK64:
3458         case F_SETLK64:
3459         case F_SETLKW64:
3460 #endif
3461                 err = file_has_perm(cred, file, FILE__LOCK);
3462                 break;
3463         }
3464 
3465         return err;
3466 }
3467 
3468 static void selinux_file_set_fowner(struct file *file)
3469 {
3470         struct file_security_struct *fsec;
3471 
3472         fsec = file->f_security;
3473         fsec->fown_sid = current_sid();
3474 }
3475 
3476 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3477                                        struct fown_struct *fown, int signum)
3478 {
3479         struct file *file;
3480         u32 sid = task_sid(tsk);
3481         u32 perm;
3482         struct file_security_struct *fsec;
3483 
3484         /* struct fown_struct is never outside the context of a struct file */
3485         file = container_of(fown, struct file, f_owner);
3486 
3487         fsec = file->f_security;
3488 
3489         if (!signum)
3490                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3491         else
3492                 perm = signal_to_av(signum);
3493 
3494         return avc_has_perm(fsec->fown_sid, sid,
3495                             SECCLASS_PROCESS, perm, NULL);
3496 }
3497 
3498 static int selinux_file_receive(struct file *file)
3499 {
3500         const struct cred *cred = current_cred();
3501 
3502         return file_has_perm(cred, file, file_to_av(file));
3503 }
3504 
3505 static int selinux_file_open(struct file *file, const struct cred *cred)
3506 {
3507         struct file_security_struct *fsec;
3508         struct inode_security_struct *isec;
3509 
3510         fsec = file->f_security;
3511         isec = file_inode(file)->i_security;
3512         /*
3513          * Save inode label and policy sequence number
3514          * at open-time so that selinux_file_permission
3515          * can determine whether revalidation is necessary.
3516          * Task label is already saved in the file security
3517          * struct as its SID.
3518          */
3519         fsec->isid = isec->sid;
3520         fsec->pseqno = avc_policy_seqno();
3521         /*
3522          * Since the inode label or policy seqno may have changed
3523          * between the selinux_inode_permission check and the saving
3524          * of state above, recheck that access is still permitted.
3525          * Otherwise, access might never be revalidated against the
3526          * new inode label or new policy.
3527          * This check is not redundant - do not remove.
3528          */
3529         return file_path_has_perm(cred, file, open_file_to_av(file));
3530 }
3531 
3532 /* task security operations */
3533 
3534 static int selinux_task_create(unsigned long clone_flags)
3535 {
3536         return current_has_perm(current, PROCESS__FORK);
3537 }
3538 
3539 /*
3540  * allocate the SELinux part of blank credentials
3541  */
3542 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3543 {
3544         struct task_security_struct *tsec;
3545 
3546         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3547         if (!tsec)
3548                 return -ENOMEM;
3549 
3550         cred->security = tsec;
3551         return 0;
3552 }
3553 
3554 /*
3555  * detach and free the LSM part of a set of credentials
3556  */
3557 static void selinux_cred_free(struct cred *cred)
3558 {
3559         struct task_security_struct *tsec = cred->security;
3560 
3561         /*
3562          * cred->security == NULL if security_cred_alloc_blank() or
3563          * security_prepare_creds() returned an error.
3564          */
3565         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3566         cred->security = (void *) 0x7UL;
3567         kfree(tsec);
3568 }
3569 
3570 /*
3571  * prepare a new set of credentials for modification
3572  */
3573 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3574                                 gfp_t gfp)
3575 {
3576         const struct task_security_struct *old_tsec;
3577         struct task_security_struct *tsec;
3578 
3579         old_tsec = old->security;
3580 
3581         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3582         if (!tsec)
3583                 return -ENOMEM;
3584 
3585         new->security = tsec;
3586         return 0;
3587 }
3588 
3589 /*
3590  * transfer the SELinux data to a blank set of creds
3591  */
3592 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3593 {
3594         const struct task_security_struct *old_tsec = old->security;
3595         struct task_security_struct *tsec = new->security;
3596 
3597         *tsec = *old_tsec;
3598 }
3599 
3600 /*
3601  * set the security data for a kernel service
3602  * - all the creation contexts are set to unlabelled
3603  */
3604 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3605 {
3606         struct task_security_struct *tsec = new->security;
3607         u32 sid = current_sid();
3608         int ret;
3609 
3610         ret = avc_has_perm(sid, secid,
3611                            SECCLASS_KERNEL_SERVICE,
3612                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3613                            NULL);
3614         if (ret == 0) {
3615                 tsec->sid = secid;
3616                 tsec->create_sid = 0;
3617                 tsec->keycreate_sid = 0;
3618                 tsec->sockcreate_sid = 0;
3619         }
3620         return ret;
3621 }
3622 
3623 /*
3624  * set the file creation context in a security record to the same as the
3625  * objective context of the specified inode
3626  */
3627 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3628 {
3629         struct inode_security_struct *isec = inode->i_security;
3630         struct task_security_struct *tsec = new->security;
3631         u32 sid = current_sid();
3632         int ret;
3633 
3634         ret = avc_has_perm(sid, isec->sid,
3635                            SECCLASS_KERNEL_SERVICE,
3636                            KERNEL_SERVICE__CREATE_FILES_AS,
3637                            NULL);
3638 
3639         if (ret == 0)
3640                 tsec->create_sid = isec->sid;
3641         return ret;
3642 }
3643 
3644 static int selinux_kernel_module_request(char *kmod_name)
3645 {
3646         u32 sid;
3647         struct common_audit_data ad;
3648 
3649         sid = task_sid(current);
3650 
3651         ad.type = LSM_AUDIT_DATA_KMOD;
3652         ad.u.kmod_name = kmod_name;
3653 
3654         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3655                             SYSTEM__MODULE_REQUEST, &ad);
3656 }
3657 
3658 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3659 {
3660         return current_has_perm(p, PROCESS__SETPGID);
3661 }
3662 
3663 static int selinux_task_getpgid(struct task_struct *p)
3664 {
3665         return current_has_perm(p, PROCESS__GETPGID);
3666 }
3667 
3668 static int selinux_task_getsid(struct task_struct *p)
3669 {
3670         return current_has_perm(p, PROCESS__GETSESSION);
3671 }
3672 
3673 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3674 {
3675         *secid = task_sid(p);
3676 }
3677 
3678 static int selinux_task_setnice(struct task_struct *p, int nice)
3679 {
3680         return current_has_perm(p, PROCESS__SETSCHED);
3681 }
3682 
3683 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3684 {
3685         return current_has_perm(p, PROCESS__SETSCHED);
3686 }
3687 
3688 static int selinux_task_getioprio(struct task_struct *p)
3689 {
3690         return current_has_perm(p, PROCESS__GETSCHED);
3691 }
3692 
3693 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3694                 struct rlimit *new_rlim)
3695 {
3696         struct rlimit *old_rlim = p->signal->rlim + resource;
3697 
3698         /* Control the ability to change the hard limit (whether
3699            lowering or raising it), so that the hard limit can
3700            later be used as a safe reset point for the soft limit
3701            upon context transitions.  See selinux_bprm_committing_creds. */
3702         if (old_rlim->rlim_max != new_rlim->rlim_max)
3703                 return current_has_perm(p, PROCESS__SETRLIMIT);
3704 
3705         return 0;
3706 }
3707 
3708 static int selinux_task_setscheduler(struct task_struct *p)
3709 {
3710         return current_has_perm(p, PROCESS__SETSCHED);
3711 }
3712 
3713 static int selinux_task_getscheduler(struct task_struct *p)
3714 {
3715         return current_has_perm(p, PROCESS__GETSCHED);
3716 }
3717 
3718 static int selinux_task_movememory(struct task_struct *p)
3719 {
3720         return current_has_perm(p, PROCESS__SETSCHED);
3721 }
3722 
3723 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3724                                 int sig, u32 secid)
3725 {
3726         u32 perm;
3727         int rc;
3728 
3729         if (!sig)
3730                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3731         else
3732                 perm = signal_to_av(sig);
3733         if (secid)
3734                 rc = avc_has_perm(secid, task_sid(p),
3735                                   SECCLASS_PROCESS, perm, NULL);
3736         else
3737                 rc = current_has_perm(p, perm);
3738         return rc;
3739 }
3740 
3741 static int selinux_task_wait(struct task_struct *p)
3742 {
3743         return task_has_perm(p, current, PROCESS__SIGCHLD);
3744 }
3745 
3746 static void selinux_task_to_inode(struct task_struct *p,
3747                                   struct inode *inode)
3748 {
3749         struct inode_security_struct *isec = inode->i_security;
3750         u32 sid = task_sid(p);
3751 
3752         isec->sid = sid;
3753         isec->initialized = 1;
3754 }
3755 
3756 /* Returns error only if unable to parse addresses */
3757 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3758                         struct common_audit_data *ad, u8 *proto)
3759 {
3760         int offset, ihlen, ret = -EINVAL;
3761         struct iphdr _iph, *ih;
3762 
3763         offset = skb_network_offset(skb);
3764         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3765         if (ih == NULL)
3766                 goto out;
3767 
3768         ihlen = ih->ihl * 4;
3769         if (ihlen < sizeof(_iph))
3770                 goto out;
3771 
3772         ad->u.net->v4info.saddr = ih->saddr;
3773         ad->u.net->v4info.daddr = ih->daddr;
3774         ret = 0;
3775 
3776         if (proto)
3777                 *proto = ih->protocol;
3778 
3779         switch (ih->protocol) {
3780         case IPPROTO_TCP: {
3781                 struct tcphdr _tcph, *th;
3782 
3783                 if (ntohs(ih->frag_off) & IP_OFFSET)
3784                         break;
3785 
3786                 offset += ihlen;
3787                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3788                 if (th == NULL)
3789                         break;
3790 
3791                 ad->u.net->sport = th->source;
3792                 ad->u.net->dport = th->dest;
3793                 break;
3794         }
3795 
3796         case IPPROTO_UDP: {
3797                 struct udphdr _udph, *uh;
3798 
3799                 if (ntohs(ih->frag_off) & IP_OFFSET)
3800                         break;
3801 
3802                 offset += ihlen;
3803                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3804                 if (uh == NULL)
3805                         break;
3806 
3807                 ad->u.net->sport = uh->source;
3808                 ad->u.net->dport = uh->dest;
3809                 break;
3810         }
3811 
3812         case IPPROTO_DCCP: {
3813                 struct dccp_hdr _dccph, *dh;
3814 
3815                 if (ntohs(ih->frag_off) & IP_OFFSET)
3816                         break;
3817 
3818                 offset += ihlen;
3819                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3820                 if (dh == NULL)
3821                         break;
3822 
3823                 ad->u.net->sport = dh->dccph_sport;
3824                 ad->u.net->dport = dh->dccph_dport;
3825                 break;
3826         }
3827 
3828         default:
3829                 break;
3830         }
3831 out:
3832         return ret;
3833 }
3834 
3835 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3836 
3837 /* Returns error only if unable to parse addresses */
3838 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3839                         struct common_audit_data *ad, u8 *proto)
3840 {
3841         u8 nexthdr;
3842         int ret = -EINVAL, offset;
3843         struct ipv6hdr _ipv6h, *ip6;
3844         __be16 frag_off;
3845 
3846         offset = skb_network_offset(skb);
3847         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3848         if (ip6 == NULL)
3849                 goto out;
3850 
3851         ad->u.net->v6info.saddr = ip6->saddr;
3852         ad->u.net->v6info.daddr = ip6->daddr;
3853         ret = 0;
3854 
3855         nexthdr = ip6->nexthdr;
3856         offset += sizeof(_ipv6h);
3857         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3858         if (offset < 0)
3859                 goto out;
3860 
3861         if (proto)
3862                 *proto = nexthdr;
3863 
3864         switch (nexthdr) {
3865         case IPPROTO_TCP: {
3866                 struct tcphdr _tcph, *th;
3867 
3868                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3869                 if (th == NULL)
3870                         break;
3871 
3872                 ad->u.net->sport = th->source;
3873                 ad->u.net->dport = th->dest;
3874                 break;
3875         }
3876 
3877         case IPPROTO_UDP: {
3878                 struct udphdr _udph, *uh;
3879 
3880                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3881                 if (uh == NULL)
3882                         break;
3883 
3884                 ad->u.net->sport = uh->source;
3885                 ad->u.net->dport = uh->dest;
3886                 break;
3887         }
3888 
3889         case IPPROTO_DCCP: {
3890                 struct dccp_hdr _dccph, *dh;
3891 
3892                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3893                 if (dh == NULL)
3894                         break;
3895 
3896                 ad->u.net->sport = dh->dccph_sport;
3897                 ad->u.net->dport = dh->dccph_dport;
3898                 break;
3899         }
3900 
3901         /* includes fragments */
3902         default:
3903                 break;
3904         }
3905 out:
3906         return ret;
3907 }
3908 
3909 #endif /* IPV6 */
3910 
3911 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3912                              char **_addrp, int src, u8 *proto)
3913 {
3914         char *addrp;
3915         int ret;
3916 
3917         switch (ad->u.net->family) {
3918         case PF_INET:
3919                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3920                 if (ret)
3921                         goto parse_error;
3922                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3923                                        &ad->u.net->v4info.daddr);
3924                 goto okay;
3925 
3926 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3927         case PF_INET6:
3928                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3929                 if (ret)
3930                         goto parse_error;
3931                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3932                                        &ad->u.net->v6info.daddr);
3933                 goto okay;
3934 #endif  /* IPV6 */
3935         default:
3936                 addrp = NULL;
3937                 goto okay;
3938         }
3939 
3940 parse_error:
3941         printk(KERN_WARNING
3942                "SELinux: failure in selinux_parse_skb(),"
3943                " unable to parse packet\n");
3944         return ret;
3945 
3946 okay:
3947         if (_addrp)
3948                 *_addrp = addrp;
3949         return 0;
3950 }
3951 
3952 /**
3953  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3954  * @skb: the packet
3955  * @family: protocol family
3956  * @sid: the packet's peer label SID
3957  *
3958  * Description:
3959  * Check the various different forms of network peer labeling and determine
3960  * the peer label/SID for the packet; most of the magic actually occurs in
3961  * the security server function security_net_peersid_cmp().  The function
3962  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3963  * or -EACCES if @sid is invalid due to inconsistencies with the different
3964  * peer labels.
3965  *
3966  */
3967 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3968 {
3969         int err;
3970         u32 xfrm_sid;
3971         u32 nlbl_sid;
3972         u32 nlbl_type;
3973 
3974         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3975         if (unlikely(err))
3976                 return -EACCES;
3977         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3978         if (unlikely(err))
3979                 return -EACCES;
3980 
3981         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3982         if (unlikely(err)) {
3983                 printk(KERN_WARNING
3984                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3985                        " unable to determine packet's peer label\n");
3986                 return -EACCES;
3987         }
3988 
3989         return 0;
3990 }
3991 
3992 /**
3993  * selinux_conn_sid - Determine the child socket label for a connection
3994  * @sk_sid: the parent socket's SID
3995  * @skb_sid: the packet's SID
3996  * @conn_sid: the resulting connection SID
3997  *
3998  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3999  * combined with the MLS information from @skb_sid in order to create
4000  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4001  * of @sk_sid.  Returns zero on success, negative values on failure.
4002  *
4003  */
4004 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4005 {
4006         int err = 0;
4007 
4008         if (skb_sid != SECSID_NULL)
4009                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4010         else
4011                 *conn_sid = sk_sid;
4012 
4013         return err;
4014 }
4015 
4016 /* socket security operations */
4017 
4018 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4019                                  u16 secclass, u32 *socksid)
4020 {
4021         if (tsec->sockcreate_sid > SECSID_NULL) {
4022                 *socksid = tsec->sockcreate_sid;
4023                 return 0;
4024         }
4025 
4026         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4027                                        socksid);
4028 }
4029 
4030 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4031 {
4032         struct sk_security_struct *sksec = sk->sk_security;
4033         struct common_audit_data ad;
4034         struct lsm_network_audit net = {0,};
4035         u32 tsid = task_sid(task);
4036 
4037         if (sksec->sid == SECINITSID_KERNEL)
4038                 return 0;
4039 
4040         ad.type = LSM_AUDIT_DATA_NET;
4041         ad.u.net = &net;
4042         ad.u.net->sk = sk;
4043 
4044         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4045 }
4046 
4047 static int selinux_socket_create(int family, int type,
4048                                  int protocol, int kern)
4049 {
4050         const struct task_security_struct *tsec = current_security();
4051         u32 newsid;
4052         u16 secclass;
4053         int rc;
4054 
4055         if (kern)
4056                 return 0;
4057 
4058         secclass = socket_type_to_security_class(family, type, protocol);
4059         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4060         if (rc)
4061                 return rc;
4062 
4063         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4064 }
4065 
4066 static int selinux_socket_post_create(struct socket *sock, int family,
4067                                       int type, int protocol, int kern)
4068 {
4069         const struct task_security_struct *tsec = current_security();
4070         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4071         struct sk_security_struct *sksec;
4072         int err = 0;
4073 
4074         isec->sclass = socket_type_to_security_class(family, type, protocol);
4075 
4076         if (kern)
4077                 isec->sid = SECINITSID_KERNEL;
4078         else {
4079                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4080                 if (err)
4081                         return err;
4082         }
4083 
4084         isec->initialized = 1;
4085 
4086         if (sock->sk) {
4087                 sksec = sock->sk->sk_security;
4088                 sksec->sid = isec->sid;
4089                 sksec->sclass = isec->sclass;
4090                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4091         }
4092 
4093         return err;
4094 }
4095 
4096 /* Range of port numbers used to automatically bind.
4097    Need to determine whether we should perform a name_bind
4098    permission check between the socket and the port number. */
4099 
4100 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4101 {
4102         struct sock *sk = sock->sk;
4103         u16 family;
4104         int err;
4105 
4106         err = sock_has_perm(current, sk, SOCKET__BIND);
4107         if (err)
4108                 goto out;
4109 
4110         /*
4111          * If PF_INET or PF_INET6, check name_bind permission for the port.
4112          * Multiple address binding for SCTP is not supported yet: we just
4113          * check the first address now.
4114          */
4115         family = sk->sk_family;
4116         if (family == PF_INET || family == PF_INET6) {
4117                 char *addrp;
4118                 struct sk_security_struct *sksec = sk->sk_security;
4119                 struct common_audit_data ad;
4120                 struct lsm_network_audit net = {0,};
4121                 struct sockaddr_in *addr4 = NULL;
4122                 struct sockaddr_in6 *addr6 = NULL;
4123                 unsigned short snum;
4124                 u32 sid, node_perm;
4125 
4126                 if (family == PF_INET) {
4127                         addr4 = (struct sockaddr_in *)address;
4128                         snum = ntohs(addr4->sin_port);
4129                         addrp = (char *)&addr4->sin_addr.s_addr;
4130                 } else {
4131                         addr6 = (struct sockaddr_in6 *)address;
4132                         snum = ntohs(addr6->sin6_port);
4133                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4134                 }
4135 
4136                 if (snum) {
4137                         int low, high;
4138 
4139                         inet_get_local_port_range(sock_net(sk), &low, &high);
4140 
4141                         if (snum < max(PROT_SOCK, low) || snum > high) {
4142                                 err = sel_netport_sid(sk->sk_protocol,
4143                                                       snum, &sid);
4144                                 if (err)
4145                                         goto out;
4146                                 ad.type = LSM_AUDIT_DATA_NET;
4147                                 ad.u.net = &net;
4148                                 ad.u.net->sport = htons(snum);
4149                                 ad.u.net->family = family;
4150                                 err = avc_has_perm(sksec->sid, sid,
4151                                                    sksec->sclass,
4152                                                    SOCKET__NAME_BIND, &ad);
4153                                 if (err)
4154                                         goto out;
4155                         }
4156                 }
4157 
4158                 switch (sksec->sclass) {
4159                 case SECCLASS_TCP_SOCKET:
4160                         node_perm = TCP_SOCKET__NODE_BIND;
4161                         break;
4162 
4163                 case SECCLASS_UDP_SOCKET:
4164                         node_perm = UDP_SOCKET__NODE_BIND;
4165                         break;
4166 
4167                 case SECCLASS_DCCP_SOCKET:
4168                         node_perm = DCCP_SOCKET__NODE_BIND;
4169                         break;
4170 
4171                 default:
4172                         node_perm = RAWIP_SOCKET__NODE_BIND;
4173                         break;
4174                 }
4175 
4176                 err = sel_netnode_sid(addrp, family, &sid);
4177                 if (err)
4178                         goto out;
4179 
4180                 ad.type = LSM_AUDIT_DATA_NET;
4181                 ad.u.net = &net;
4182                 ad.u.net->sport = htons(snum);
4183                 ad.u.net->family = family;
4184 
4185                 if (family == PF_INET)
4186                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4187                 else
4188                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4189 
4190                 err = avc_has_perm(sksec->sid, sid,
4191                                    sksec->sclass, node_perm, &ad);
4192                 if (err)
4193                         goto out;
4194         }
4195 out:
4196         return err;
4197 }
4198 
4199 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4200 {
4201         struct sock *sk = sock->sk;
4202         struct sk_security_struct *sksec = sk->sk_security;
4203         int err;
4204 
4205         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4206         if (err)
4207                 return err;
4208 
4209         /*
4210          * If a TCP or DCCP socket, check name_connect permission for the port.
4211          */
4212         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4213             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4214                 struct common_audit_data ad;
4215                 struct lsm_network_audit net = {0,};
4216                 struct sockaddr_in *addr4 = NULL;
4217                 struct sockaddr_in6 *addr6 = NULL;
4218                 unsigned short snum;
4219                 u32 sid, perm;
4220 
4221                 if (sk->sk_family == PF_INET) {
4222                         addr4 = (struct sockaddr_in *)address;
4223                         if (addrlen < sizeof(struct sockaddr_in))
4224                                 return -EINVAL;
4225                         snum = ntohs(addr4->sin_port);
4226                 } else {
4227                         addr6 = (struct sockaddr_in6 *)address;
4228                         if (addrlen < SIN6_LEN_RFC2133)
4229                                 return -EINVAL;
4230                         snum = ntohs(addr6->sin6_port);
4231                 }
4232 
4233                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4234                 if (err)
4235                         goto out;
4236 
4237                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4238                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4239 
4240                 ad.type = LSM_AUDIT_DATA_NET;
4241                 ad.u.net = &net;
4242                 ad.u.net->dport = htons(snum);
4243                 ad.u.net->family = sk->sk_family;
4244                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4245                 if (err)
4246                         goto out;
4247         }
4248 
4249         err = selinux_netlbl_socket_connect(sk, address);
4250 
4251 out:
4252         return err;
4253 }
4254 
4255 static int selinux_socket_listen(struct socket *sock, int backlog)
4256 {
4257         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4258 }
4259 
4260 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4261 {
4262         int err;
4263         struct inode_security_struct *isec;
4264         struct inode_security_struct *newisec;
4265 
4266         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4267         if (err)
4268                 return err;
4269 
4270         newisec = SOCK_INODE(newsock)->i_security;
4271 
4272         isec = SOCK_INODE(sock)->i_security;
4273         newisec->sclass = isec->sclass;
4274         newisec->sid = isec->sid;
4275         newisec->initialized = 1;
4276 
4277         return 0;
4278 }
4279 
4280 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4281                                   int size)
4282 {
4283         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4284 }
4285 
4286 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4287                                   int size, int flags)
4288 {
4289         return sock_has_perm(current, sock->sk, SOCKET__READ);
4290 }
4291 
4292 static int selinux_socket_getsockname(struct socket *sock)
4293 {
4294         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4295 }
4296 
4297 static int selinux_socket_getpeername(struct socket *sock)
4298 {
4299         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4300 }
4301 
4302 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4303 {
4304         int err;
4305 
4306         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4307         if (err)
4308                 return err;
4309 
4310         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4311 }
4312 
4313 static int selinux_socket_getsockopt(struct socket *sock, int level,
4314                                      int optname)
4315 {
4316         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4317 }
4318 
4319 static int selinux_socket_shutdown(struct socket *sock, int how)
4320 {
4321         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4322 }
4323 
4324 static int selinux_socket_unix_stream_connect(struct sock *sock,
4325                                               struct sock *other,
4326                                               struct sock *newsk)
4327 {
4328         struct sk_security_struct *sksec_sock = sock->sk_security;
4329         struct sk_security_struct *sksec_other = other->sk_security;
4330         struct sk_security_struct *sksec_new = newsk->sk_security;
4331         struct common_audit_data ad;
4332         struct lsm_network_audit net = {0,};
4333         int err;
4334 
4335         ad.type = LSM_AUDIT_DATA_NET;
4336         ad.u.net = &net;
4337         ad.u.net->sk = other;
4338 
4339         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4340                            sksec_other->sclass,
4341                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4342         if (err)
4343                 return err;
4344 
4345         /* server child socket */
4346         sksec_new->peer_sid = sksec_sock->sid;
4347         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4348                                     &sksec_new->sid);
4349         if (err)
4350                 return err;
4351 
4352         /* connecting socket */
4353         sksec_sock->peer_sid = sksec_new->sid;
4354 
4355         return 0;
4356 }
4357 
4358 static int selinux_socket_unix_may_send(struct socket *sock,
4359                                         struct socket *other)
4360 {
4361         struct sk_security_struct *ssec = sock->sk->sk_security;
4362         struct sk_security_struct *osec = other->sk->sk_security;
4363         struct common_audit_data ad;
4364         struct lsm_network_audit net = {0,};
4365 
4366         ad.type = LSM_AUDIT_DATA_NET;
4367         ad.u.net = &net;
4368         ad.u.net->sk = other->sk;
4369 
4370         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4371                             &ad);
4372 }
4373 
4374 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4375                                     char *addrp, u16 family, u32 peer_sid,
4376                                     struct common_audit_data *ad)
4377 {
4378         int err;
4379         u32 if_sid;
4380         u32 node_sid;
4381 
4382         err = sel_netif_sid(ns, ifindex, &if_sid);
4383         if (err)
4384                 return err;
4385         err = avc_has_perm(peer_sid, if_sid,
4386                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4387         if (err)
4388                 return err;
4389 
4390         err = sel_netnode_sid(addrp, family, &node_sid);
4391         if (err)
4392                 return err;
4393         return avc_has_perm(peer_sid, node_sid,
4394                             SECCLASS_NODE, NODE__RECVFROM, ad);
4395 }
4396 
4397 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4398                                        u16 family)
4399 {
4400         int err = 0;
4401         struct sk_security_struct *sksec = sk->sk_security;
4402         u32 sk_sid = sksec->sid;
4403         struct common_audit_data ad;
4404         struct lsm_network_audit net = {0,};
4405         char *addrp;
4406 
4407         ad.type = LSM_AUDIT_DATA_NET;
4408         ad.u.net = &net;
4409         ad.u.net->netif = skb->skb_iif;
4410         ad.u.net->family = family;
4411         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4412         if (err)
4413                 return err;
4414 
4415         if (selinux_secmark_enabled()) {
4416                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4417                                    PACKET__RECV, &ad);
4418                 if (err)
4419                         return err;
4420         }
4421 
4422         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4423         if (err)
4424                 return err;
4425         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4426 
4427         return err;
4428 }
4429 
4430 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4431 {
4432         int err;
4433         struct sk_security_struct *sksec = sk->sk_security;
4434         u16 family = sk->sk_family;
4435         u32 sk_sid = sksec->sid;
4436         struct common_audit_data ad;
4437         struct lsm_network_audit net = {0,};
4438         char *addrp;
4439         u8 secmark_active;
4440         u8 peerlbl_active;
4441 
4442         if (family != PF_INET && family != PF_INET6)
4443                 return 0;
4444 
4445         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4446         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4447                 family = PF_INET;
4448 
4449         /* If any sort of compatibility mode is enabled then handoff processing
4450          * to the selinux_sock_rcv_skb_compat() function to deal with the
4451          * special handling.  We do this in an attempt to keep this function
4452          * as fast and as clean as possible. */
4453         if (!selinux_policycap_netpeer)
4454                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4455 
4456         secmark_active = selinux_secmark_enabled();
4457         peerlbl_active = selinux_peerlbl_enabled();
4458         if (!secmark_active && !peerlbl_active)
4459                 return 0;
4460 
4461         ad.type = LSM_AUDIT_DATA_NET;
4462         ad.u.net = &net;
4463         ad.u.net->netif = skb->skb_iif;
4464         ad.u.net->family = family;
4465         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4466         if (err)
4467                 return err;
4468 
4469         if (peerlbl_active) {
4470                 u32 peer_sid;
4471 
4472                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4473                 if (err)
4474                         return err;
4475                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4476                                                addrp, family, peer_sid, &ad);
4477                 if (err) {
4478                         selinux_netlbl_err(skb, err, 0);
4479                         return err;
4480                 }
4481                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4482                                    PEER__RECV, &ad);
4483                 if (err) {
4484                         selinux_netlbl_err(skb, err, 0);
4485                         return err;
4486                 }
4487         }
4488 
4489         if (secmark_active) {
4490                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4491                                    PACKET__RECV, &ad);
4492                 if (err)
4493                         return err;
4494         }
4495 
4496         return err;
4497 }
4498 
4499 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4500                                             int __user *optlen, unsigned len)
4501 {
4502         int err = 0;
4503         char *scontext;
4504         u32 scontext_len;
4505         struct sk_security_struct *sksec = sock->sk->sk_security;
4506         u32 peer_sid = SECSID_NULL;
4507 
4508         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4509             sksec->sclass == SECCLASS_TCP_SOCKET)
4510                 peer_sid = sksec->peer_sid;
4511         if (peer_sid == SECSID_NULL)
4512                 return -ENOPROTOOPT;
4513 
4514         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4515         if (err)
4516                 return err;
4517 
4518         if (scontext_len > len) {
4519                 err = -ERANGE;
4520                 goto out_len;
4521         }
4522 
4523         if (copy_to_user(optval, scontext, scontext_len))
4524                 err = -EFAULT;
4525 
4526 out_len:
4527         if (put_user(scontext_len, optlen))
4528                 err = -EFAULT;
4529         kfree(scontext);
4530         return err;
4531 }
4532 
4533 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4534 {
4535         u32 peer_secid = SECSID_NULL;
4536         u16 family;
4537 
4538         if (skb && skb->protocol == htons(ETH_P_IP))
4539                 family = PF_INET;
4540         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4541                 family = PF_INET6;
4542         else if (sock)
4543                 family = sock->sk->sk_family;
4544         else
4545                 goto out;
4546 
4547         if (sock && family == PF_UNIX)
4548                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4549         else if (skb)
4550                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4551 
4552 out:
4553         *secid = peer_secid;
4554         if (peer_secid == SECSID_NULL)
4555                 return -EINVAL;
4556         return 0;
4557 }
4558 
4559 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4560 {
4561         struct sk_security_struct *sksec;
4562 
4563         sksec = kzalloc(sizeof(*sksec), priority);
4564         if (!sksec)
4565                 return -ENOMEM;
4566 
4567         sksec->peer_sid = SECINITSID_UNLABELED;
4568         sksec->sid = SECINITSID_UNLABELED;
4569         sksec->sclass = SECCLASS_SOCKET;
4570         selinux_netlbl_sk_security_reset(sksec);
4571         sk->sk_security = sksec;
4572 
4573         return 0;
4574 }
4575 
4576 static void selinux_sk_free_security(struct sock *sk)
4577 {
4578         struct sk_security_struct *sksec = sk->sk_security;
4579 
4580         sk->sk_security = NULL;
4581         selinux_netlbl_sk_security_free(sksec);
4582         kfree(sksec);
4583 }
4584 
4585 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4586 {
4587         struct sk_security_struct *sksec = sk->sk_security;
4588         struct sk_security_struct *newsksec = newsk->sk_security;
4589 
4590         newsksec->sid = sksec->sid;
4591         newsksec->peer_sid = sksec->peer_sid;
4592         newsksec->sclass = sksec->sclass;
4593 
4594         selinux_netlbl_sk_security_reset(newsksec);
4595 }
4596 
4597 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4598 {
4599         if (!sk)
4600                 *secid = SECINITSID_ANY_SOCKET;
4601         else {
4602                 struct sk_security_struct *sksec = sk->sk_security;
4603 
4604                 *secid = sksec->sid;
4605         }
4606 }
4607 
4608 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4609 {
4610         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4611         struct sk_security_struct *sksec = sk->sk_security;
4612 
4613         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4614             sk->sk_family == PF_UNIX)
4615                 isec->sid = sksec->sid;
4616         sksec->sclass = isec->sclass;
4617 }
4618 
4619 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4620                                      struct request_sock *req)
4621 {
4622         struct sk_security_struct *sksec = sk->sk_security;
4623         int err;
4624         u16 family = req->rsk_ops->family;
4625         u32 connsid;
4626         u32 peersid;
4627 
4628         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4629         if (err)
4630                 return err;
4631         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4632         if (err)
4633                 return err;
4634         req->secid = connsid;
4635         req->peer_secid = peersid;
4636 
4637         return selinux_netlbl_inet_conn_request(req, family);
4638 }
4639 
4640 static void selinux_inet_csk_clone(struct sock *newsk,
4641                                    const struct request_sock *req)
4642 {
4643         struct sk_security_struct *newsksec = newsk->sk_security;
4644 
4645         newsksec->sid = req->secid;
4646         newsksec->peer_sid = req->peer_secid;
4647         /* NOTE: Ideally, we should also get the isec->sid for the
4648            new socket in sync, but we don't have the isec available yet.
4649            So we will wait until sock_graft to do it, by which
4650            time it will have been created and available. */
4651 
4652         /* We don't need to take any sort of lock here as we are the only
4653          * thread with access to newsksec */
4654         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4655 }
4656 
4657 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4658 {
4659         u16 family = sk->sk_family;
4660         struct sk_security_struct *sksec = sk->sk_security;
4661 
4662         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4663         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4664                 family = PF_INET;
4665 
4666         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4667 }
4668 
4669 static int selinux_secmark_relabel_packet(u32 sid)
4670 {
4671         const struct task_security_struct *__tsec;
4672         u32 tsid;
4673 
4674         __tsec = current_security();
4675         tsid = __tsec->sid;
4676 
4677         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4678 }
4679 
4680 static void selinux_secmark_refcount_inc(void)
4681 {
4682         atomic_inc(&selinux_secmark_refcount);
4683 }
4684 
4685 static void selinux_secmark_refcount_dec(void)
4686 {
4687         atomic_dec(&selinux_secmark_refcount);
4688 }
4689 
4690 static void selinux_req_classify_flow(const struct request_sock *req,
4691                                       struct flowi *fl)
4692 {
4693         fl->flowi_secid = req->secid;
4694 }
4695 
4696 static int selinux_tun_dev_alloc_security(void **security)
4697 {
4698         struct tun_security_struct *tunsec;
4699 
4700         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4701         if (!tunsec)
4702                 return -ENOMEM;
4703         tunsec->sid = current_sid();
4704 
4705         *security = tunsec;
4706         return 0;
4707 }
4708 
4709 static void selinux_tun_dev_free_security(void *security)
4710 {
4711         kfree(security);
4712 }
4713 
4714 static int selinux_tun_dev_create(void)
4715 {
4716         u32 sid = current_sid();
4717 
4718         /* we aren't taking into account the "sockcreate" SID since the socket
4719          * that is being created here is not a socket in the traditional sense,
4720          * instead it is a private sock, accessible only to the kernel, and
4721          * representing a wide range of network traffic spanning multiple
4722          * connections unlike traditional sockets - check the TUN driver to
4723          * get a better understanding of why this socket is special */
4724 
4725         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4726                             NULL);
4727 }
4728 
4729 static int selinux_tun_dev_attach_queue(void *security)
4730 {
4731         struct tun_security_struct *tunsec = security;
4732 
4733         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4734                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4735 }
4736 
4737 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4738 {
4739         struct tun_security_struct *tunsec = security;
4740         struct sk_security_struct *sksec = sk->sk_security;
4741 
4742         /* we don't currently perform any NetLabel based labeling here and it
4743          * isn't clear that we would want to do so anyway; while we could apply
4744          * labeling without the support of the TUN user the resulting labeled
4745          * traffic from the other end of the connection would almost certainly
4746          * cause confusion to the TUN user that had no idea network labeling
4747          * protocols were being used */
4748 
4749         sksec->sid = tunsec->sid;
4750         sksec->sclass = SECCLASS_TUN_SOCKET;
4751 
4752         return 0;
4753 }
4754 
4755 static int selinux_tun_dev_open(void *security)
4756 {
4757         struct tun_security_struct *tunsec = security;
4758         u32 sid = current_sid();
4759         int err;
4760 
4761         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4762                            TUN_SOCKET__RELABELFROM, NULL);
4763         if (err)
4764                 return err;
4765         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4766                            TUN_SOCKET__RELABELTO, NULL);
4767         if (err)
4768                 return err;
4769         tunsec->sid = sid;
4770 
4771         return 0;
4772 }
4773 
4774 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4775 {
4776         int err = 0;
4777         u32 perm;
4778         struct nlmsghdr *nlh;
4779         struct sk_security_struct *sksec = sk->sk_security;
4780 
4781         if (skb->len < NLMSG_HDRLEN) {
4782                 err = -EINVAL;
4783                 goto out;
4784         }
4785         nlh = nlmsg_hdr(skb);
4786 
4787         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4788         if (err) {
4789                 if (err == -EINVAL) {
4790                         printk(KERN_WARNING
4791                                "SELinux: unrecognized netlink message:"
4792                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4793                                sk->sk_protocol, nlh->nlmsg_type,
4794                                secclass_map[sksec->sclass - 1].name);
4795                         if (!selinux_enforcing || security_get_allow_unknown())
4796                                 err = 0;
4797                 }
4798 
4799                 /* Ignore */
4800                 if (err == -ENOENT)
4801                         err = 0;
4802                 goto out;
4803         }
4804 
4805         err = sock_has_perm(current, sk, perm);
4806 out:
4807         return err;
4808 }
4809 
4810 #ifdef CONFIG_NETFILTER
4811 
4812 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4813                                        const struct net_device *indev,
4814                                        u16 family)
4815 {
4816         int err;
4817         char *addrp;
4818         u32 peer_sid;
4819         struct common_audit_data ad;
4820         struct lsm_network_audit net = {0,};
4821         u8 secmark_active;
4822         u8 netlbl_active;
4823         u8 peerlbl_active;
4824 
4825         if (!selinux_policycap_netpeer)
4826                 return NF_ACCEPT;
4827 
4828         secmark_active = selinux_secmark_enabled();
4829         netlbl_active = netlbl_enabled();
4830         peerlbl_active = selinux_peerlbl_enabled();
4831         if (!secmark_active && !peerlbl_active)
4832                 return NF_ACCEPT;
4833 
4834         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4835                 return NF_DROP;
4836 
4837         ad.type = LSM_AUDIT_DATA_NET;
4838         ad.u.net = &net;
4839         ad.u.net->netif = indev->ifindex;
4840         ad.u.net->family = family;
4841         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4842                 return NF_DROP;
4843 
4844         if (peerlbl_active) {
4845                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4846                                                addrp, family, peer_sid, &ad);
4847                 if (err) {
4848                         selinux_netlbl_err(skb, err, 1);
4849                         return NF_DROP;
4850                 }
4851         }
4852 
4853         if (secmark_active)
4854                 if (avc_has_perm(peer_sid, skb->secmark,
4855                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4856                         return NF_DROP;
4857 
4858         if (netlbl_active)
4859                 /* we do this in the FORWARD path and not the POST_ROUTING
4860                  * path because we want to make sure we apply the necessary
4861                  * labeling before IPsec is applied so we can leverage AH
4862                  * protection */
4863                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4864                         return NF_DROP;
4865 
4866         return NF_ACCEPT;
4867 }
4868 
4869 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4870                                          struct sk_buff *skb,
4871                                          const struct nf_hook_state *state)
4872 {
4873         return selinux_ip_forward(skb, state->in, PF_INET);
4874 }
4875 
4876 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4877 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4878                                          struct sk_buff *skb,
4879                                          const struct nf_hook_state *state)
4880 {
4881         return selinux_ip_forward(skb, state->in, PF_INET6);
4882 }
4883 #endif  /* IPV6 */
4884 
4885 static unsigned int selinux_ip_output(struct sk_buff *skb,
4886                                       u16 family)
4887 {
4888         struct sock *sk;
4889         u32 sid;
4890 
4891         if (!netlbl_enabled())
4892                 return NF_ACCEPT;
4893 
4894         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4895          * because we want to make sure we apply the necessary labeling
4896          * before IPsec is applied so we can leverage AH protection */
4897         sk = skb->sk;
4898         if (sk) {
4899                 struct sk_security_struct *sksec;
4900 
4901                 if (sk->sk_state == TCP_LISTEN)
4902                         /* if the socket is the listening state then this
4903                          * packet is a SYN-ACK packet which means it needs to
4904                          * be labeled based on the connection/request_sock and
4905                          * not the parent socket.  unfortunately, we can't
4906                          * lookup the request_sock yet as it isn't queued on
4907                          * the parent socket until after the SYN-ACK is sent.
4908                          * the "solution" is to simply pass the packet as-is
4909                          * as any IP option based labeling should be copied
4910                          * from the initial connection request (in the IP
4911                          * layer).  it is far from ideal, but until we get a
4912                          * security label in the packet itself this is the
4913                          * best we can do. */
4914                         return NF_ACCEPT;
4915 
4916                 /* standard practice, label using the parent socket */
4917                 sksec = sk->sk_security;
4918                 sid = sksec->sid;
4919         } else
4920                 sid = SECINITSID_KERNEL;
4921         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4922                 return NF_DROP;
4923 
4924         return NF_ACCEPT;
4925 }
4926 
4927 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4928                                         struct sk_buff *skb,
4929                                         const struct nf_hook_state *state)
4930 {
4931         return selinux_ip_output(skb, PF_INET);
4932 }
4933 
4934 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4935                                                 int ifindex,
4936                                                 u16 family)
4937 {
4938         struct sock *sk = skb->sk;
4939         struct sk_security_struct *sksec;
4940         struct common_audit_data ad;
4941         struct lsm_network_audit net = {0,};
4942         char *addrp;
4943         u8 proto;
4944 
4945         if (sk == NULL)
4946                 return NF_ACCEPT;
4947         sksec = sk->sk_security;
4948 
4949         ad.type = LSM_AUDIT_DATA_NET;
4950         ad.u.net = &net;
4951         ad.u.net->netif = ifindex;
4952         ad.u.net->family = family;
4953         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4954                 return NF_DROP;
4955 
4956         if (selinux_secmark_enabled())
4957                 if (avc_has_perm(sksec->sid, skb->secmark,
4958                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4959                         return NF_DROP_ERR(-ECONNREFUSED);
4960 
4961         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4962                 return NF_DROP_ERR(-ECONNREFUSED);
4963 
4964         return NF_ACCEPT;
4965 }
4966 
4967 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4968                                          const struct net_device *outdev,
4969                                          u16 family)
4970 {
4971         u32 secmark_perm;
4972         u32 peer_sid;
4973         int ifindex = outdev->ifindex;
4974         struct sock *sk;
4975         struct common_audit_data ad;
4976         struct lsm_network_audit net = {0,};
4977         char *addrp;
4978         u8 secmark_active;
4979         u8 peerlbl_active;
4980 
4981         /* If any sort of compatibility mode is enabled then handoff processing
4982          * to the selinux_ip_postroute_compat() function to deal with the
4983          * special handling.  We do this in an attempt to keep this function
4984          * as fast and as clean as possible. */
4985         if (!selinux_policycap_netpeer)
4986                 return selinux_ip_postroute_compat(skb, ifindex, family);
4987 
4988         secmark_active = selinux_secmark_enabled();
4989         peerlbl_active = selinux_peerlbl_enabled();
4990         if (!secmark_active && !peerlbl_active)
4991                 return NF_ACCEPT;
4992 
4993         sk = skb->sk;
4994 
4995 #ifdef CONFIG_XFRM
4996         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4997          * packet transformation so allow the packet to pass without any checks
4998          * since we'll have another chance to perform access control checks
4999          * when the packet is on it's final way out.
5000          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5001          *       is NULL, in this case go ahead and apply access control.
5002          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5003          *       TCP listening state we cannot wait until the XFRM processing
5004          *       is done as we will miss out on the SA label if we do;
5005          *       unfortunately, this means more work, but it is only once per
5006          *       connection. */
5007         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5008             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5009                 return NF_ACCEPT;
5010 #endif
5011 
5012         if (sk == NULL) {
5013                 /* Without an associated socket the packet is either coming
5014                  * from the kernel or it is being forwarded; check the packet
5015                  * to determine which and if the packet is being forwarded
5016                  * query the packet directly to determine the security label. */
5017                 if (skb->skb_iif) {
5018                         secmark_perm = PACKET__FORWARD_OUT;
5019                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5020                                 return NF_DROP;
5021                 } else {
5022                         secmark_perm = PACKET__SEND;
5023                         peer_sid = SECINITSID_KERNEL;
5024                 }
5025         } else if (sk->sk_state == TCP_LISTEN) {
5026                 /* Locally generated packet but the associated socket is in the
5027                  * listening state which means this is a SYN-ACK packet.  In
5028                  * this particular case the correct security label is assigned
5029                  * to the connection/request_sock but unfortunately we can't
5030                  * query the request_sock as it isn't queued on the parent
5031                  * socket until after the SYN-ACK packet is sent; the only
5032                  * viable choice is to regenerate the label like we do in
5033                  * selinux_inet_conn_request().  See also selinux_ip_output()
5034                  * for similar problems. */
5035                 u32 skb_sid;
5036                 struct sk_security_struct *sksec = sk->sk_security;
5037                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5038                         return NF_DROP;
5039                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5040                  * and the packet has been through at least one XFRM
5041                  * transformation then we must be dealing with the "final"
5042                  * form of labeled IPsec packet; since we've already applied
5043                  * all of our access controls on this packet we can safely
5044                  * pass the packet. */
5045                 if (skb_sid == SECSID_NULL) {
5046                         switch (family) {
5047                         case PF_INET:
5048                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5049                                         return NF_ACCEPT;
5050                                 break;
5051                         case PF_INET6:
5052                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5053                                         return NF_ACCEPT;
5054                                 break;
5055                         default:
5056                                 return NF_DROP_ERR(-ECONNREFUSED);
5057                         }
5058                 }
5059                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5060                         return NF_DROP;
5061                 secmark_perm = PACKET__SEND;
5062         } else {
5063                 /* Locally generated packet, fetch the security label from the
5064                  * associated socket. */
5065                 struct sk_security_struct *sksec = sk->sk_security;
5066                 peer_sid = sksec->sid;
5067                 secmark_perm = PACKET__SEND;
5068         }
5069 
5070         ad.type = LSM_AUDIT_DATA_NET;
5071         ad.u.net = &net;
5072         ad.u.net->netif = ifindex;
5073         ad.u.net->family = family;
5074         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5075                 return NF_DROP;
5076 
5077         if (secmark_active)
5078                 if (avc_has_perm(peer_sid, skb->secmark,
5079                                  SECCLASS_PACKET, secmark_perm, &ad))
5080                         return NF_DROP_ERR(-ECONNREFUSED);
5081 
5082         if (peerlbl_active) {
5083                 u32 if_sid;
5084                 u32 node_sid;
5085 
5086                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5087                         return NF_DROP;
5088                 if (avc_has_perm(peer_sid, if_sid,
5089                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5090                         return NF_DROP_ERR(-ECONNREFUSED);
5091 
5092                 if (sel_netnode_sid(addrp, family, &node_sid))
5093                         return NF_DROP;
5094                 if (avc_has_perm(peer_sid, node_sid,
5095                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5096                         return NF_DROP_ERR(-ECONNREFUSED);
5097         }
5098 
5099         return NF_ACCEPT;
5100 }
5101 
5102 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5103                                            struct sk_buff *skb,
5104                                            const struct nf_hook_state *state)
5105 {
5106         return selinux_ip_postroute(skb, state->out, PF_INET);
5107 }
5108 
5109 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5110 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5111                                            struct sk_buff *skb,
5112                                            const struct nf_hook_state *state)
5113 {
5114         return selinux_ip_postroute(skb, state->out, PF_INET6);
5115 }
5116 #endif  /* IPV6 */
5117 
5118 #endif  /* CONFIG_NETFILTER */
5119 
5120 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5121 {
5122         return selinux_nlmsg_perm(sk, skb);
5123 }
5124 
5125 static int ipc_alloc_security(struct task_struct *task,
5126                               struct kern_ipc_perm *perm,
5127                               u16 sclass)
5128 {
5129         struct ipc_security_struct *isec;
5130         u32 sid;
5131 
5132         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5133         if (!isec)
5134                 return -ENOMEM;
5135 
5136         sid = task_sid(task);
5137         isec->sclass = sclass;
5138         isec->sid = sid;
5139         perm->security = isec;
5140 
5141         return 0;
5142 }
5143 
5144 static void ipc_free_security(struct kern_ipc_perm *perm)
5145 {
5146         struct ipc_security_struct *isec = perm->security;
5147         perm->security = NULL;
5148         kfree(isec);
5149 }
5150 
5151 static int msg_msg_alloc_security(struct msg_msg *msg)
5152 {
5153         struct msg_security_struct *msec;
5154 
5155         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5156         if (!msec)
5157                 return -ENOMEM;
5158 
5159         msec->sid = SECINITSID_UNLABELED;
5160         msg->security = msec;
5161 
5162         return 0;
5163 }
5164 
5165 static void msg_msg_free_security(struct msg_msg *msg)
5166 {
5167         struct msg_security_struct *msec = msg->security;
5168 
5169         msg->security = NULL;
5170         kfree(msec);
5171 }
5172 
5173 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5174                         u32 perms)
5175 {
5176         struct ipc_security_struct *isec;
5177         struct common_audit_data ad;
5178         u32 sid = current_sid();
5179 
5180         isec = ipc_perms->security;
5181 
5182         ad.type = LSM_AUDIT_DATA_IPC;
5183         ad.u.ipc_id = ipc_perms->key;
5184 
5185         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5186 }
5187 
5188 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5189 {
5190         return msg_msg_alloc_security(msg);
5191 }
5192 
5193 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5194 {
5195         msg_msg_free_security(msg);
5196 }
5197 
5198 /* message queue security operations */
5199 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5200 {
5201         struct ipc_security_struct *isec;
5202         struct common_audit_data ad;
5203         u32 sid = current_sid();
5204         int rc;
5205 
5206         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5207         if (rc)
5208                 return rc;
5209 
5210         isec = msq->q_perm.security;
5211 
5212         ad.type = LSM_AUDIT_DATA_IPC;
5213         ad.u.ipc_id = msq->q_perm.key;
5214 
5215         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5216                           MSGQ__CREATE, &ad);
5217         if (rc) {
5218                 ipc_free_security(&msq->q_perm);
5219                 return rc;
5220         }
5221         return 0;
5222 }
5223 
5224 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5225 {
5226         ipc_free_security(&msq->q_perm);
5227 }
5228 
5229 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5230 {
5231         struct ipc_security_struct *isec;
5232         struct common_audit_data ad;
5233         u32 sid = current_sid();
5234 
5235         isec = msq->q_perm.security;
5236 
5237         ad.type = LSM_AUDIT_DATA_IPC;
5238         ad.u.ipc_id = msq->q_perm.key;
5239 
5240         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5241                             MSGQ__ASSOCIATE, &ad);
5242 }
5243 
5244 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5245 {
5246         int err;
5247         int perms;
5248 
5249         switch (cmd) {
5250         case IPC_INFO:
5251         case MSG_INFO:
5252                 /* No specific object, just general system-wide information. */
5253                 return task_has_system(current, SYSTEM__IPC_INFO);
5254         case IPC_STAT:
5255         case MSG_STAT:
5256                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5257                 break;
5258         case IPC_SET:
5259                 perms = MSGQ__SETATTR;
5260                 break;
5261         case IPC_RMID:
5262                 perms = MSGQ__DESTROY;
5263                 break;
5264         default:
5265                 return 0;
5266         }
5267 
5268         err = ipc_has_perm(&msq->q_perm, perms);
5269         return err;
5270 }
5271 
5272 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5273 {
5274         struct ipc_security_struct *isec;
5275         struct msg_security_struct *msec;
5276         struct common_audit_data ad;
5277         u32 sid = current_sid();
5278         int rc;
5279 
5280         isec = msq->q_perm.security;
5281         msec = msg->security;
5282 
5283         /*
5284          * First time through, need to assign label to the message
5285          */
5286         if (msec->sid == SECINITSID_UNLABELED) {
5287                 /*
5288                  * Compute new sid based on current process and
5289                  * message queue this message will be stored in
5290                  */
5291                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5292                                              NULL, &msec->sid);
5293                 if (rc)
5294                         return rc;
5295         }
5296 
5297         ad.type = LSM_AUDIT_DATA_IPC;
5298         ad.u.ipc_id = msq->q_perm.key;
5299 
5300         /* Can this process write to the queue? */
5301         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5302                           MSGQ__WRITE, &ad);
5303         if (!rc)
5304                 /* Can this process send the message */
5305                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5306                                   MSG__SEND, &ad);
5307         if (!rc)
5308                 /* Can the message be put in the queue? */
5309                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5310                                   MSGQ__ENQUEUE, &ad);
5311 
5312         return rc;
5313 }
5314 
5315 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5316                                     struct task_struct *target,
5317                                     long type, int mode)
5318 {
5319         struct ipc_security_struct *isec;
5320         struct msg_security_struct *msec;
5321         struct common_audit_data ad;
5322         u32 sid = task_sid(target);
5323         int rc;
5324 
5325         isec = msq->q_perm.security;
5326         msec = msg->security;
5327 
5328         ad.type = LSM_AUDIT_DATA_IPC;
5329         ad.u.ipc_id = msq->q_perm.key;
5330 
5331         rc = avc_has_perm(sid, isec->sid,
5332                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5333         if (!rc)
5334                 rc = avc_has_perm(sid, msec->sid,
5335                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5336         return rc;
5337 }
5338 
5339 /* Shared Memory security operations */
5340 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5341 {
5342         struct ipc_security_struct *isec;
5343         struct common_audit_data ad;
5344         u32 sid = current_sid();
5345         int rc;
5346 
5347         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5348         if (rc)
5349                 return rc;
5350 
5351         isec = shp->shm_perm.security;
5352 
5353         ad.type = LSM_AUDIT_DATA_IPC;
5354         ad.u.ipc_id = shp->shm_perm.key;
5355 
5356         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5357                           SHM__CREATE, &ad);
5358         if (rc) {
5359                 ipc_free_security(&shp->shm_perm);
5360                 return rc;
5361         }
5362         return 0;
5363 }
5364 
5365 static void selinux_shm_free_security(struct shmid_kernel *shp)
5366 {
5367         ipc_free_security(&shp->shm_perm);
5368 }
5369 
5370 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5371 {
5372         struct ipc_security_struct *isec;
5373         struct common_audit_data ad;
5374         u32 sid = current_sid();
5375 
5376         isec = shp->shm_perm.security;
5377 
5378         ad.type = LSM_AUDIT_DATA_IPC;
5379         ad.u.ipc_id = shp->shm_perm.key;
5380 
5381         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5382                             SHM__ASSOCIATE, &ad);
5383 }
5384 
5385 /* Note, at this point, shp is locked down */
5386 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5387 {
5388         int perms;
5389         int err;
5390 
5391         switch (cmd) {
5392         case IPC_INFO:
5393         case SHM_INFO:
5394                 /* No specific object, just general system-wide information. */
5395                 return task_has_system(current, SYSTEM__IPC_INFO);
5396         case IPC_STAT:
5397         case SHM_STAT:
5398                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5399                 break;
5400         case IPC_SET:
5401                 perms = SHM__SETATTR;
5402                 break;
5403         case SHM_LOCK:
5404         case SHM_UNLOCK:
5405                 perms = SHM__LOCK;
5406                 break;
5407         case IPC_RMID:
5408                 perms = SHM__DESTROY;
5409                 break;
5410         default:
5411                 return 0;
5412         }
5413 
5414         err = ipc_has_perm(&shp->shm_perm, perms);
5415         return err;
5416 }
5417 
5418 static int selinux_shm_shmat(struct shmid_kernel *shp,
5419                              char __user *shmaddr, int shmflg)
5420 {
5421         u32 perms;
5422 
5423         if (shmflg & SHM_RDONLY)
5424                 perms = SHM__READ;
5425         else
5426                 perms = SHM__READ | SHM__WRITE;
5427 
5428         return ipc_has_perm(&shp->shm_perm, perms);
5429 }
5430 
5431 /* Semaphore security operations */
5432 static int selinux_sem_alloc_security(struct sem_array *sma)
5433 {
5434         struct ipc_security_struct *isec;
5435         struct common_audit_data ad;
5436         u32 sid = current_sid();
5437         int rc;
5438 
5439         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5440         if (rc)
5441                 return rc;
5442 
5443         isec = sma->sem_perm.security;
5444 
5445         ad.type = LSM_AUDIT_DATA_IPC;
5446         ad.u.ipc_id = sma->sem_perm.key;
5447 
5448         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5449                           SEM__CREATE, &ad);
5450         if (rc) {
5451                 ipc_free_security(&sma->sem_perm);
5452                 return rc;
5453         }
5454         return 0;
5455 }
5456 
5457 static void selinux_sem_free_security(struct sem_array *sma)
5458 {
5459         ipc_free_security(&sma->sem_perm);
5460 }
5461 
5462 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5463 {
5464         struct ipc_security_struct *isec;
5465         struct common_audit_data ad;
5466         u32 sid = current_sid();
5467 
5468         isec = sma->sem_perm.security;
5469 
5470         ad.type = LSM_AUDIT_DATA_IPC;
5471         ad.u.ipc_id = sma->sem_perm.key;
5472 
5473         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5474                             SEM__ASSOCIATE, &ad);
5475 }
5476 
5477 /* Note, at this point, sma is locked down */
5478 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5479 {
5480         int err;
5481         u32 perms;
5482 
5483         switch (cmd) {
5484         case IPC_INFO:
5485         case SEM_INFO:
5486                 /* No specific object, just general system-wide information. */
5487                 return task_has_system(current, SYSTEM__IPC_INFO);
5488         case GETPID:
5489         case GETNCNT:
5490         case GETZCNT:
5491                 perms = SEM__GETATTR;
5492                 break;
5493         case GETVAL:
5494         case GETALL:
5495                 perms = SEM__READ;
5496                 break;
5497         case SETVAL:
5498         case SETALL:
5499                 perms = SEM__WRITE;
5500                 break;
5501         case IPC_RMID:
5502                 perms = SEM__DESTROY;
5503                 break;
5504         case IPC_SET:
5505                 perms = SEM__SETATTR;
5506                 break;
5507         case IPC_STAT:
5508         case SEM_STAT:
5509                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5510                 break;
5511         default:
5512                 return 0;
5513         }
5514 
5515         err = ipc_has_perm(&sma->sem_perm, perms);
5516         return err;
5517 }
5518 
5519 static int selinux_sem_semop(struct sem_array *sma,
5520                              struct sembuf *sops, unsigned nsops, int alter)
5521 {
5522         u32 perms;
5523 
5524         if (alter)
5525                 perms = SEM__READ | SEM__WRITE;
5526         else
5527                 perms = SEM__READ;
5528 
5529         return ipc_has_perm(&sma->sem_perm, perms);
5530 }
5531 
5532 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5533 {
5534         u32 av = 0;
5535 
5536         av = 0;
5537         if (flag & S_IRUGO)
5538                 av |= IPC__UNIX_READ;
5539         if (flag & S_IWUGO)
5540                 av |= IPC__UNIX_WRITE;
5541 
5542         if (av == 0)
5543                 return 0;
5544 
5545         return ipc_has_perm(ipcp, av);
5546 }
5547 
5548 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5549 {
5550         struct ipc_security_struct *isec = ipcp->security;
5551         *secid = isec->sid;
5552 }
5553 
5554 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5555 {
5556         if (inode)
5557                 inode_doinit_with_dentry(inode, dentry);
5558 }
5559 
5560 static int selinux_getprocattr(struct task_struct *p,
5561                                char *name, char **value)
5562 {
5563         const struct task_security_struct *__tsec;
5564         u32 sid;
5565         int error;
5566         unsigned len;
5567 
5568         if (current != p) {
5569                 error = current_has_perm(p, PROCESS__GETATTR);
5570                 if (error)
5571                         return error;
5572         }
5573 
5574         rcu_read_lock();
5575         __tsec = __task_cred(p)->security;
5576 
5577         if (!strcmp(name, "current"))
5578                 sid = __tsec->sid;
5579         else if (!strcmp(name, "prev"))
5580                 sid = __tsec->osid;
5581         else if (!strcmp(name, "exec"))
5582                 sid = __tsec->exec_sid;
5583         else if (!strcmp(name, "fscreate"))
5584                 sid = __tsec->create_sid;
5585         else if (!strcmp(name, "keycreate"))
5586                 sid = __tsec->keycreate_sid;
5587         else if (!strcmp(name, "sockcreate"))
5588                 sid = __tsec->sockcreate_sid;
5589         else
5590                 goto invalid;
5591         rcu_read_unlock();
5592 
5593         if (!sid)
5594                 return 0;
5595 
5596         error = security_sid_to_context(sid, value, &len);
5597         if (error)
5598                 return error;
5599         return len;
5600 
5601 invalid:
5602         rcu_read_unlock();
5603         return -EINVAL;
5604 }
5605 
5606 static int selinux_setprocattr(struct task_struct *p,
5607                                char *name, void *value, size_t size)
5608 {
5609         struct task_security_struct *tsec;
5610         struct task_struct *tracer;
5611         struct cred *new;
5612         u32 sid = 0, ptsid;
5613         int error;
5614         char *str = value;
5615 
5616         if (current != p) {
5617                 /* SELinux only allows a process to change its own
5618                    security attributes. */
5619                 return -EACCES;
5620         }
5621 
5622         /*
5623          * Basic control over ability to set these attributes at all.
5624          * current == p, but we'll pass them separately in case the
5625          * above restriction is ever removed.
5626          */
5627         if (!strcmp(name, "exec"))
5628                 error = current_has_perm(p, PROCESS__SETEXEC);
5629         else if (!strcmp(name, "fscreate"))
5630                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5631         else if (!strcmp(name, "keycreate"))
5632                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5633         else if (!strcmp(name, "sockcreate"))
5634                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5635         else if (!strcmp(name, "current"))
5636                 error = current_has_perm(p, PROCESS__SETCURRENT);
5637         else
5638                 error = -EINVAL;
5639         if (error)
5640                 return error;
5641 
5642         /* Obtain a SID for the context, if one was specified. */
5643         if (size && str[1] && str[1] != '\n') {
5644                 if (str[size-1] == '\n') {
5645                         str[size-1] = 0;
5646                         size--;
5647                 }
5648                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5649                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5650                         if (!capable(CAP_MAC_ADMIN)) {
5651                                 struct audit_buffer *ab;
5652                                 size_t audit_size;
5653 
5654                                 /* We strip a nul only if it is at the end, otherwise the
5655                                  * context contains a nul and we should audit that */
5656                                 if (str[size - 1] == '\0')
5657                                         audit_size = size - 1;
5658                                 else
5659                                         audit_size = size;
5660                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5661                                 audit_log_format(ab, "op=fscreate invalid_context=");
5662                                 audit_log_n_untrustedstring(ab, value, audit_size);
5663                                 audit_log_end(ab);
5664 
5665                                 return error;
5666                         }
5667                         error = security_context_to_sid_force(value, size,
5668                                                               &sid);
5669                 }
5670                 if (error)
5671                         return error;
5672         }
5673 
5674         new = prepare_creds();
5675         if (!new)
5676                 return -ENOMEM;
5677 
5678         /* Permission checking based on the specified context is
5679            performed during the actual operation (execve,
5680            open/mkdir/...), when we know the full context of the
5681            operation.  See selinux_bprm_set_creds for the execve
5682            checks and may_create for the file creation checks. The
5683            operation will then fail if the context is not permitted. */
5684         tsec = new->security;
5685         if (!strcmp(name, "exec")) {
5686                 tsec->exec_sid = sid;
5687         } else if (!strcmp(name, "fscreate")) {
5688                 tsec->create_sid = sid;
5689         } else if (!strcmp(name, "keycreate")) {
5690                 error = may_create_key(sid, p);
5691                 if (error)
5692                         goto abort_change;
5693                 tsec->keycreate_sid = sid;
5694         } else if (!strcmp(name, "sockcreate")) {
5695                 tsec->sockcreate_sid = sid;
5696         } else if (!strcmp(name, "current")) {
5697                 error = -EINVAL;
5698                 if (sid == 0)
5699                         goto abort_change;
5700 
5701                 /* Only allow single threaded processes to change context */
5702                 error = -EPERM;
5703                 if (!current_is_single_threaded()) {
5704                         error = security_bounded_transition(tsec->sid, sid);
5705                         if (error)
5706                                 goto abort_change;
5707                 }
5708 
5709                 /* Check permissions for the transition. */
5710                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5711                                      PROCESS__DYNTRANSITION, NULL);
5712                 if (error)
5713                         goto abort_change;
5714 
5715                 /* Check for ptracing, and update the task SID if ok.
5716                    Otherwise, leave SID unchanged and fail. */
5717                 ptsid = 0;
5718                 rcu_read_lock();
5719                 tracer = ptrace_parent(p);
5720                 if (tracer)
5721                         ptsid = task_sid(tracer);
5722                 rcu_read_unlock();
5723 
5724                 if (tracer) {
5725                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5726                                              PROCESS__PTRACE, NULL);
5727                         if (error)
5728                                 goto abort_change;
5729                 }
5730 
5731                 tsec->sid = sid;
5732         } else {
5733                 error = -EINVAL;
5734                 goto abort_change;
5735         }
5736 
5737         commit_creds(new);
5738         return size;
5739 
5740 abort_change:
5741         abort_creds(new);
5742         return error;
5743 }
5744 
5745 static int selinux_ismaclabel(const char *name)
5746 {
5747         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5748 }
5749 
5750 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5751 {
5752         return security_sid_to_context(secid, secdata, seclen);
5753 }
5754 
5755 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5756 {
5757         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5758 }
5759 
5760 static void selinux_release_secctx(char *secdata, u32 seclen)
5761 {
5762         kfree(secdata);
5763 }
5764 
5765 /*
5766  *      called with inode->i_mutex locked
5767  */
5768 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5769 {
5770         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5771 }
5772 
5773 /*
5774  *      called with inode->i_mutex locked
5775  */
5776 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5777 {
5778         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5779 }
5780 
5781 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5782 {
5783         int len = 0;
5784         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5785                                                 ctx, true);
5786         if (len < 0)
5787                 return len;
5788         *ctxlen = len;
5789         return 0;
5790 }
5791 #ifdef CONFIG_KEYS
5792 
5793 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5794                              unsigned long flags)
5795 {
5796         const struct task_security_struct *tsec;
5797         struct key_security_struct *ksec;
5798 
5799         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5800         if (!ksec)
5801                 return -ENOMEM;
5802 
5803         tsec = cred->security;
5804         if (tsec->keycreate_sid)
5805                 ksec->sid = tsec->keycreate_sid;
5806         else
5807                 ksec->sid = tsec->sid;
5808 
5809         k->security = ksec;
5810         return 0;
5811 }
5812 
5813 static void selinux_key_free(struct key *k)
5814 {
5815         struct key_security_struct *ksec = k->security;
5816 
5817         k->security = NULL;
5818         kfree(ksec);
5819 }
5820 
5821 static int selinux_key_permission(key_ref_t key_ref,
5822                                   const struct cred *cred,
5823                                   unsigned perm)
5824 {
5825         struct key *key;
5826         struct key_security_struct *ksec;
5827         u32 sid;
5828 
5829         /* if no specific permissions are requested, we skip the
5830            permission check. No serious, additional covert channels
5831            appear to be created. */
5832         if (perm == 0)
5833                 return 0;
5834 
5835         sid = cred_sid(cred);
5836 
5837         key = key_ref_to_ptr(key_ref);
5838         ksec = key->security;
5839 
5840         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5841 }
5842 
5843 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5844 {
5845         struct key_security_struct *ksec = key->security;
5846         char *context = NULL;
5847         unsigned len;
5848         int rc;
5849 
5850         rc = security_sid_to_context(ksec->sid, &context, &len);
5851         if (!rc)
5852                 rc = len;
5853         *_buffer = context;
5854         return rc;
5855 }
5856 
5857 #endif
5858 
5859 static struct security_hook_list selinux_hooks[] = {
5860         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5861         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5862         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5863         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5864 
5865         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5866         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5867         LSM_HOOK_INIT(capget, selinux_capget),
5868         LSM_HOOK_INIT(capset, selinux_capset),
5869         LSM_HOOK_INIT(capable, selinux_capable),
5870         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5871         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5872         LSM_HOOK_INIT(syslog, selinux_syslog),
5873         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5874 
5875         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5876 
5877         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5878         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5879         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5880         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5881 
5882         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5883         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5884         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5885         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5886         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5887         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5888         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5889         LSM_HOOK_INIT(sb_mount, selinux_mount),
5890         LSM_HOOK_INIT(sb_umount, selinux_umount),
5891         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5892         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5893         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5894 
5895         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5896 
5897         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5898         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5899         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5900         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5901         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5902         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5903         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5904         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5905         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5906         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5907         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5908         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5909         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5910         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5911         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5912         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5913         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5914         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5915         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5916         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5917         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5918         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5919         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5920         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5921         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5922 
5923         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5924         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5925         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5926         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5927         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5928         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5929         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5930         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5931         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5932         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5933         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5934         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5935 
5936         LSM_HOOK_INIT(file_open, selinux_file_open),
5937 
5938         LSM_HOOK_INIT(task_create, selinux_task_create),
5939         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5940         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5941         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5942         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5943         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5944         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5945         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5946         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5947         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5948         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5949         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5950         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5951         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5952         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5953         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5954         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5955         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5956         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5957         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5958         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5959         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5960 
5961         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5962         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5963 
5964         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5965         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5966 
5967         LSM_HOOK_INIT(msg_queue_alloc_security,
5968