aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2018-03-01 18:48:02 -0500
committerPaul Moore <paul@paul-moore.com>2018-03-01 18:48:02 -0500
commitaa8e712cee93d520e96a2ca8e3a20f807c937e3f (patch)
tree5e2bdce92022ebb334bfa68b6a731b71ef86974d
parent2572f5b4245abf2b4e5a86cabf65a50efda09aac (diff)
selinux: wrap global selinux state
Define a selinux state structure (struct selinux_state) for global SELinux state and pass it explicitly to all security server functions. The public portion of the structure contains state that is used throughout the SELinux code, such as the enforcing mode. The structure also contains a pointer to a selinux_ss structure whose definition is private to the security server and contains security server specific state such as the policy database and SID table. This change should have no effect on SELinux behavior or APIs (userspace or LSM). It merely wraps SELinux state and passes it explicitly as needed. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: minor fixups needed due to collisions with the SCTP patches] Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat
-rw-r--r--security/selinux/avc.c16
-rw-r--r--security/selinux/hooks.c214
-rw-r--r--security/selinux/ibpkey.c3
-rw-r--r--security/selinux/include/avc.h6
-rw-r--r--security/selinux/include/avc_ss.h6
-rw-r--r--security/selinux/include/conditional.h11
-rw-r--r--security/selinux/include/objsec.h2
-rw-r--r--security/selinux/include/security.h228
-rw-r--r--security/selinux/netif.c2
-rw-r--r--security/selinux/netlabel.c14
-rw-r--r--security/selinux/netnode.c4
-rw-r--r--security/selinux/netport.c2
-rw-r--r--security/selinux/selinuxfs.c145
-rw-r--r--security/selinux/ss/avtab.c9
-rw-r--r--security/selinux/ss/avtab.h3
-rw-r--r--security/selinux/ss/ebitmap.c7
-rw-r--r--security/selinux/ss/ebitmap.h3
-rw-r--r--security/selinux/ss/hashtab.c8
-rw-r--r--security/selinux/ss/hashtab.h4
-rw-r--r--security/selinux/ss/mls.c72
-rw-r--r--security/selinux/ss/mls.h38
-rw-r--r--security/selinux/ss/services.c1078
-rw-r--r--security/selinux/ss/services.h24
-rw-r--r--security/selinux/ss/status.c47
-rw-r--r--security/selinux/xfrm.c6
25 files changed, 1155 insertions, 797 deletions
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 2380b8d72cec..36124f48a5ff 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -149,7 +149,8 @@ static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tcla
149 char *scontext; 149 char *scontext;
150 u32 scontext_len; 150 u32 scontext_len;
151 151
152 rc = security_sid_to_context(ssid, &scontext, &scontext_len); 152 rc = security_sid_to_context(&selinux_state, ssid,
153 &scontext, &scontext_len);
153 if (rc) 154 if (rc)
154 audit_log_format(ab, "ssid=%d", ssid); 155 audit_log_format(ab, "ssid=%d", ssid);
155 else { 156 else {
@@ -157,7 +158,8 @@ static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tcla
157 kfree(scontext); 158 kfree(scontext);
158 } 159 }
159 160
160 rc = security_sid_to_context(tsid, &scontext, &scontext_len); 161 rc = security_sid_to_context(&selinux_state, tsid,
162 &scontext, &scontext_len);
161 if (rc) 163 if (rc)
162 audit_log_format(ab, " tsid=%d", tsid); 164 audit_log_format(ab, " tsid=%d", tsid);
163 else { 165 else {
@@ -969,7 +971,8 @@ static noinline struct avc_node *avc_compute_av(u32 ssid, u32 tsid,
969{ 971{
970 rcu_read_unlock(); 972 rcu_read_unlock();
971 INIT_LIST_HEAD(&xp_node->xpd_head); 973 INIT_LIST_HEAD(&xp_node->xpd_head);
972 security_compute_av(ssid, tsid, tclass, avd, &xp_node->xp); 974 security_compute_av(&selinux_state, ssid, tsid, tclass,
975 avd, &xp_node->xp);
973 rcu_read_lock(); 976 rcu_read_lock();
974 return avc_insert(ssid, tsid, tclass, avd, xp_node); 977 return avc_insert(ssid, tsid, tclass, avd, xp_node);
975} 978}
@@ -982,7 +985,8 @@ static noinline int avc_denied(u32 ssid, u32 tsid,
982 if (flags & AVC_STRICT) 985 if (flags & AVC_STRICT)
983 return -EACCES; 986 return -EACCES;
984 987
985 if (selinux_enforcing && !(avd->flags & AVD_FLAGS_PERMISSIVE)) 988 if (is_enforcing(&selinux_state) &&
989 !(avd->flags & AVD_FLAGS_PERMISSIVE))
986 return -EACCES; 990 return -EACCES;
987 991
988 avc_update_node(AVC_CALLBACK_GRANT, requested, driver, xperm, ssid, 992 avc_update_node(AVC_CALLBACK_GRANT, requested, driver, xperm, ssid,
@@ -1043,8 +1047,8 @@ int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
1043 goto decision; 1047 goto decision;
1044 } 1048 }
1045 rcu_read_unlock(); 1049 rcu_read_unlock();
1046 security_compute_xperms_decision(ssid, tsid, tclass, driver, 1050 security_compute_xperms_decision(&selinux_state, ssid, tsid,
1047 &local_xpd); 1051 tclass, driver, &local_xpd);
1048 rcu_read_lock(); 1052 rcu_read_lock();
1049 avc_update_node(AVC_CALLBACK_ADD_XPERMS, requested, driver, xperm, 1053 avc_update_node(AVC_CALLBACK_ADD_XPERMS, requested, driver, xperm,
1050 ssid, tsid, tclass, avd.seqno, &local_xpd, 0); 1054 ssid, tsid, tclass, avd.seqno, &local_xpd, 0);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 28a5c4ee0705..d78f9e2f6df0 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -100,20 +100,24 @@
100#include "audit.h" 100#include "audit.h"
101#include "avc_ss.h" 101#include "avc_ss.h"
102 102
103struct selinux_state selinux_state;
104
103/* SECMARK reference count */ 105/* SECMARK reference count */
104static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); 106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
105 107
106#ifdef CONFIG_SECURITY_SELINUX_DEVELOP 108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
107int selinux_enforcing; 109static int selinux_enforcing_boot;
108 110
109static int __init enforcing_setup(char *str) 111static int __init enforcing_setup(char *str)
110{ 112{
111 unsigned long enforcing; 113 unsigned long enforcing;
112 if (!kstrtoul(str, 0, &enforcing)) 114 if (!kstrtoul(str, 0, &enforcing))
113 selinux_enforcing = enforcing ? 1 : 0; 115 selinux_enforcing_boot = enforcing ? 1 : 0;
114 return 1; 116 return 1;
115} 117}
116__setup("enforcing=", enforcing_setup); 118__setup("enforcing=", enforcing_setup);
119#else
120#define selinux_enforcing_boot 1
117#endif 121#endif
118 122
119#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM 123#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
@@ -131,6 +135,19 @@ __setup("selinux=", selinux_enabled_setup);
131int selinux_enabled = 1; 135int selinux_enabled = 1;
132#endif 136#endif
133 137
138static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148}
149__setup("checkreqprot=", checkreqprot_setup);
150
134static struct kmem_cache *sel_inode_cache; 151static struct kmem_cache *sel_inode_cache;
135static struct kmem_cache *file_security_cache; 152static struct kmem_cache *file_security_cache;
136 153
@@ -147,7 +164,8 @@ static struct kmem_cache *file_security_cache;
147 */ 164 */
148static int selinux_secmark_enabled(void) 165static int selinux_secmark_enabled(void)
149{ 166{
150 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount)); 167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
151} 169}
152 170
153/** 171/**
@@ -162,7 +180,8 @@ static int selinux_secmark_enabled(void)
162 */ 180 */
163static int selinux_peerlbl_enabled(void) 181static int selinux_peerlbl_enabled(void)
164{ 182{
165 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled()); 183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
166} 185}
167 186
168static int selinux_netcache_avc_callback(u32 event) 187static int selinux_netcache_avc_callback(u32 event)
@@ -266,7 +285,8 @@ static int __inode_security_revalidate(struct inode *inode,
266 285
267 might_sleep_if(may_sleep); 286 might_sleep_if(may_sleep);
268 287
269 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) { 288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
270 if (!may_sleep) 290 if (!may_sleep)
271 return -ECHILD; 291 return -ECHILD;
272 292
@@ -488,7 +508,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
488 !strcmp(sb->s_type->name, "debugfs") || 508 !strcmp(sb->s_type->name, "debugfs") ||
489 !strcmp(sb->s_type->name, "tracefs") || 509 !strcmp(sb->s_type->name, "tracefs") ||
490 !strcmp(sb->s_type->name, "rootfs") || 510 !strcmp(sb->s_type->name, "rootfs") ||
491 (selinux_policycap_cgroupseclabel && 511 (selinux_policycap_cgroupseclabel() &&
492 (!strcmp(sb->s_type->name, "cgroup") || 512 (!strcmp(sb->s_type->name, "cgroup") ||
493 !strcmp(sb->s_type->name, "cgroup2"))); 513 !strcmp(sb->s_type->name, "cgroup2")));
494} 514}
@@ -588,7 +608,7 @@ static int selinux_get_mnt_opts(const struct super_block *sb,
588 if (!(sbsec->flags & SE_SBINITIALIZED)) 608 if (!(sbsec->flags & SE_SBINITIALIZED))
589 return -EINVAL; 609 return -EINVAL;
590 610
591 if (!ss_initialized) 611 if (!selinux_state.initialized)
592 return -EINVAL; 612 return -EINVAL;
593 613
594 /* make sure we always check enough bits to cover the mask */ 614 /* make sure we always check enough bits to cover the mask */
@@ -619,21 +639,25 @@ static int selinux_get_mnt_opts(const struct super_block *sb,
619 639
620 i = 0; 640 i = 0;
621 if (sbsec->flags & FSCONTEXT_MNT) { 641 if (sbsec->flags & FSCONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->sid, &context, &len); 642 rc = security_sid_to_context(&selinux_state, sbsec->sid,
643 &context, &len);
623 if (rc) 644 if (rc)
624 goto out_free; 645 goto out_free;
625 opts->mnt_opts[i] = context; 646 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT; 647 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
627 } 648 }
628 if (sbsec->flags & CONTEXT_MNT) { 649 if (sbsec->flags & CONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len); 650 rc = security_sid_to_context(&selinux_state,
651 sbsec->mntpoint_sid,
652 &context, &len);
630 if (rc) 653 if (rc)
631 goto out_free; 654 goto out_free;
632 opts->mnt_opts[i] = context; 655 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = CONTEXT_MNT; 656 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
634 } 657 }
635 if (sbsec->flags & DEFCONTEXT_MNT) { 658 if (sbsec->flags & DEFCONTEXT_MNT) {
636 rc = security_sid_to_context(sbsec->def_sid, &context, &len); 659 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
660 &context, &len);
637 if (rc) 661 if (rc)
638 goto out_free; 662 goto out_free;
639 opts->mnt_opts[i] = context; 663 opts->mnt_opts[i] = context;
@@ -643,7 +667,8 @@ static int selinux_get_mnt_opts(const struct super_block *sb,
643 struct dentry *root = sbsec->sb->s_root; 667 struct dentry *root = sbsec->sb->s_root;
644 struct inode_security_struct *isec = backing_inode_security(root); 668 struct inode_security_struct *isec = backing_inode_security(root);
645 669
646 rc = security_sid_to_context(isec->sid, &context, &len); 670 rc = security_sid_to_context(&selinux_state, isec->sid,
671 &context, &len);
647 if (rc) 672 if (rc)
648 goto out_free; 673 goto out_free;
649 opts->mnt_opts[i] = context; 674 opts->mnt_opts[i] = context;
@@ -706,7 +731,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
706 731
707 mutex_lock(&sbsec->lock); 732 mutex_lock(&sbsec->lock);
708 733
709 if (!ss_initialized) { 734 if (!selinux_state.initialized) {
710 if (!num_opts) { 735 if (!num_opts) {
711 /* Defer initialization until selinux_complete_init, 736 /* Defer initialization until selinux_complete_init,
712 after the initial policy is loaded and the security 737 after the initial policy is loaded and the security
@@ -752,7 +777,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
752 777
753 if (flags[i] == SBLABEL_MNT) 778 if (flags[i] == SBLABEL_MNT)
754 continue; 779 continue;
755 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 780 rc = security_context_str_to_sid(&selinux_state,
781 mount_options[i], &sid,
782 GFP_KERNEL);
756 if (rc) { 783 if (rc) {
757 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 784 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
758 "(%s) failed for (dev %s, type %s) errno=%d\n", 785 "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -828,7 +855,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
828 * Determine the labeling behavior to use for this 855 * Determine the labeling behavior to use for this
829 * filesystem type. 856 * filesystem type.
830 */ 857 */
831 rc = security_fs_use(sb); 858 rc = security_fs_use(&selinux_state, sb);
832 if (rc) { 859 if (rc) {
833 printk(KERN_WARNING 860 printk(KERN_WARNING
834 "%s: security_fs_use(%s) returned %d\n", 861 "%s: security_fs_use(%s) returned %d\n",
@@ -853,7 +880,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
853 } 880 }
854 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 881 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
855 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 882 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
856 rc = security_transition_sid(current_sid(), current_sid(), 883 rc = security_transition_sid(&selinux_state,
884 current_sid(),
885 current_sid(),
857 SECCLASS_FILE, NULL, 886 SECCLASS_FILE, NULL,
858 &sbsec->mntpoint_sid); 887 &sbsec->mntpoint_sid);
859 if (rc) 888 if (rc)
@@ -989,7 +1018,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
989 * if the parent was able to be mounted it clearly had no special lsm 1018 * if the parent was able to be mounted it clearly had no special lsm
990 * mount options. thus we can safely deal with this superblock later 1019 * mount options. thus we can safely deal with this superblock later
991 */ 1020 */
992 if (!ss_initialized) 1021 if (!selinux_state.initialized)
993 return 0; 1022 return 0;
994 1023
995 /* 1024 /*
@@ -1016,7 +1045,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
1016 1045
1017 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE && 1046 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1018 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) { 1047 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
1019 rc = security_fs_use(newsb); 1048 rc = security_fs_use(&selinux_state, newsb);
1020 if (rc) 1049 if (rc)
1021 goto out; 1050 goto out;
1022 } 1051 }
@@ -1299,7 +1328,7 @@ static inline int default_protocol_dgram(int protocol)
1299 1328
1300static inline u16 socket_type_to_security_class(int family, int type, int protocol) 1329static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1301{ 1330{
1302 int extsockclass = selinux_policycap_extsockclass; 1331 int extsockclass = selinux_policycap_extsockclass();
1303 1332
1304 switch (family) { 1333 switch (family) {
1305 case PF_UNIX: 1334 case PF_UNIX:
@@ -1473,7 +1502,8 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
1473 path++; 1502 path++;
1474 } 1503 }
1475 } 1504 }
1476 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid); 1505 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1506 path, tclass, sid);
1477 } 1507 }
1478 free_page((unsigned long)buffer); 1508 free_page((unsigned long)buffer);
1479 return rc; 1509 return rc;
@@ -1591,7 +1621,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
1591 sid = sbsec->def_sid; 1621 sid = sbsec->def_sid;
1592 rc = 0; 1622 rc = 0;
1593 } else { 1623 } else {
1594 rc = security_context_to_sid_default(context, rc, &sid, 1624 rc = security_context_to_sid_default(&selinux_state,
1625 context, rc, &sid,
1595 sbsec->def_sid, 1626 sbsec->def_sid,
1596 GFP_NOFS); 1627 GFP_NOFS);
1597 if (rc) { 1628 if (rc) {
@@ -1624,7 +1655,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
1624 sid = sbsec->sid; 1655 sid = sbsec->sid;
1625 1656
1626 /* Try to obtain a transition SID. */ 1657 /* Try to obtain a transition SID. */
1627 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid); 1658 rc = security_transition_sid(&selinux_state, task_sid, sid,
1659 sclass, NULL, &sid);
1628 if (rc) 1660 if (rc)
1629 goto out; 1661 goto out;
1630 break; 1662 break;
@@ -1885,7 +1917,8 @@ selinux_determine_inode_label(const struct task_security_struct *tsec,
1885 *_new_isid = tsec->create_sid; 1917 *_new_isid = tsec->create_sid;
1886 } else { 1918 } else {
1887 const struct inode_security_struct *dsec = inode_security(dir); 1919 const struct inode_security_struct *dsec = inode_security(dir);
1888 return security_transition_sid(tsec->sid, dsec->sid, tclass, 1920 return security_transition_sid(&selinux_state, tsec->sid,
1921 dsec->sid, tclass,
1889 name, _new_isid); 1922 name, _new_isid);
1890 } 1923 }
1891 1924
@@ -2108,7 +2141,8 @@ static inline u32 open_file_to_av(struct file *file)
2108 u32 av = file_to_av(file); 2141 u32 av = file_to_av(file);
2109 struct inode *inode = file_inode(file); 2142 struct inode *inode = file_inode(file);
2110 2143
2111 if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC) 2144 if (selinux_policycap_openperm() &&
2145 inode->i_sb->s_magic != SOCKFS_MAGIC)
2112 av |= FILE__OPEN; 2146 av |= FILE__OPEN;
2113 2147
2114 return av; 2148 return av;
@@ -2353,7 +2387,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
2353 * policy allows the corresponding permission between 2387 * policy allows the corresponding permission between
2354 * the old and new contexts. 2388 * the old and new contexts.
2355 */ 2389 */
2356 if (selinux_policycap_nnp_nosuid_transition) { 2390 if (selinux_policycap_nnp_nosuid_transition()) {
2357 av = 0; 2391 av = 0;
2358 if (nnp) 2392 if (nnp)
2359 av |= PROCESS2__NNP_TRANSITION; 2393 av |= PROCESS2__NNP_TRANSITION;
@@ -2370,7 +2404,8 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
2370 * i.e. SIDs that are guaranteed to only be allowed a subset 2404 * i.e. SIDs that are guaranteed to only be allowed a subset
2371 * of the permissions of the current SID. 2405 * of the permissions of the current SID.
2372 */ 2406 */
2373 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid); 2407 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2408 new_tsec->sid);
2374 if (!rc) 2409 if (!rc)
2375 return 0; 2410 return 0;
2376 2411
@@ -2422,8 +2457,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2422 return rc; 2457 return rc;
2423 } else { 2458 } else {
2424 /* Check for a default transition on this program. */ 2459 /* Check for a default transition on this program. */
2425 rc = security_transition_sid(old_tsec->sid, isec->sid, 2460 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2426 SECCLASS_PROCESS, NULL, 2461 isec->sid, SECCLASS_PROCESS, NULL,
2427 &new_tsec->sid); 2462 &new_tsec->sid);
2428 if (rc) 2463 if (rc)
2429 return rc; 2464 return rc;
@@ -2781,7 +2816,9 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
2781 2816
2782 if (flags[i] == SBLABEL_MNT) 2817 if (flags[i] == SBLABEL_MNT)
2783 continue; 2818 continue;
2784 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL); 2819 rc = security_context_str_to_sid(&selinux_state,
2820 mount_options[i], &sid,
2821 GFP_KERNEL);
2785 if (rc) { 2822 if (rc) {
2786 printk(KERN_WARNING "SELinux: security_context_str_to_sid" 2823 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2787 "(%s) failed for (dev %s, type %s) errno=%d\n", 2824 "(%s) failed for (dev %s, type %s) errno=%d\n",
@@ -2906,7 +2943,8 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2906 if (rc) 2943 if (rc)
2907 return rc; 2944 return rc;
2908 2945
2909 return security_sid_to_context(newsid, (char **)ctx, ctxlen); 2946 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2947 ctxlen);
2910} 2948}
2911 2949
2912static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, 2950static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
@@ -2960,14 +2998,15 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2960 isec->initialized = LABEL_INITIALIZED; 2998 isec->initialized = LABEL_INITIALIZED;
2961 } 2999 }
2962 3000
2963 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT)) 3001 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2964 return -EOPNOTSUPP; 3002 return -EOPNOTSUPP;
2965 3003
2966 if (name) 3004 if (name)
2967 *name = XATTR_SELINUX_SUFFIX; 3005 *name = XATTR_SELINUX_SUFFIX;
2968 3006
2969 if (value && len) { 3007 if (value && len) {
2970 rc = security_sid_to_context_force(newsid, &context, &clen); 3008 rc = security_sid_to_context_force(&selinux_state, newsid,
3009 &context, &clen);
2971 if (rc) 3010 if (rc)
2972 return rc; 3011 return rc;
2973 *value = context; 3012 *value = context;
@@ -3128,7 +3167,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3128 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) 3167 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3129 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3168 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3130 3169
3131 if (selinux_policycap_openperm && 3170 if (selinux_policycap_openperm() &&
3132 inode->i_sb->s_magic != SOCKFS_MAGIC && 3171 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3133 (ia_valid & ATTR_SIZE) && 3172 (ia_valid & ATTR_SIZE) &&
3134 !(ia_valid & ATTR_FILE)) 3173 !(ia_valid & ATTR_FILE))
@@ -3190,7 +3229,8 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3190 if (rc) 3229 if (rc)
3191 return rc; 3230 return rc;
3192 3231
3193 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3232 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3233 GFP_KERNEL);
3194 if (rc == -EINVAL) { 3234 if (rc == -EINVAL) {
3195 if (!has_cap_mac_admin(true)) { 3235 if (!has_cap_mac_admin(true)) {
3196 struct audit_buffer *ab; 3236 struct audit_buffer *ab;
@@ -3215,7 +3255,8 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3215 3255
3216 return rc; 3256 return rc;
3217 } 3257 }
3218 rc = security_context_to_sid_force(value, size, &newsid); 3258 rc = security_context_to_sid_force(&selinux_state, value,
3259 size, &newsid);
3219 } 3260 }
3220 if (rc) 3261 if (rc)
3221 return rc; 3262 return rc;
@@ -3225,8 +3266,8 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3225 if (rc) 3266 if (rc)
3226 return rc; 3267 return rc;
3227 3268
3228 rc = security_validate_transition(isec->sid, newsid, sid, 3269 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3229 isec->sclass); 3270 sid, isec->sclass);
3230 if (rc) 3271 if (rc)
3231 return rc; 3272 return rc;
3232 3273
@@ -3251,7 +3292,8 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3251 return; 3292 return;
3252 } 3293 }
3253 3294
3254 rc = security_context_to_sid_force(value, size, &newsid); 3295 rc = security_context_to_sid_force(&selinux_state, value, size,
3296 &newsid);
3255 if (rc) { 3297 if (rc) {
3256 printk(KERN_ERR "SELinux: unable to map context to SID" 3298 printk(KERN_ERR "SELinux: unable to map context to SID"
3257 "for (%s, %lu), rc=%d\n", 3299 "for (%s, %lu), rc=%d\n",
@@ -3326,10 +3368,12 @@ static int selinux_inode_getsecurity(struct inode *inode, const char *name, void
3326 */ 3368 */
3327 isec = inode_security(inode); 3369 isec = inode_security(inode);
3328 if (has_cap_mac_admin(false)) 3370 if (has_cap_mac_admin(false))
3329 error = security_sid_to_context_force(isec->sid, &context, 3371 error = security_sid_to_context_force(&selinux_state,
3372 isec->sid, &context,
3330 &size); 3373 &size);
3331 else 3374 else
3332 error = security_sid_to_context(isec->sid, &context, &size); 3375 error = security_sid_to_context(&selinux_state, isec->sid,
3376 &context, &size);
3333 if (error) 3377 if (error)
3334 return error; 3378 return error;
3335 error = size; 3379 error = size;
@@ -3355,7 +3399,8 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3355 if (!value || !size) 3399 if (!value || !size)
3356 return -EACCES; 3400 return -EACCES;
3357 3401
3358 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL); 3402 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3403 GFP_KERNEL);
3359 if (rc) 3404 if (rc)
3360 return rc; 3405 return rc;
3361 3406
@@ -3617,7 +3662,7 @@ static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3617 return rc; 3662 return rc;
3618 } 3663 }
3619 3664
3620 if (selinux_checkreqprot) 3665 if (selinux_state.checkreqprot)
3621 prot = reqprot; 3666 prot = reqprot;
3622 3667
3623 return file_map_prot_check(file, prot, 3668 return file_map_prot_check(file, prot,
@@ -3631,7 +3676,7 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
3631 const struct cred *cred = current_cred(); 3676 const struct cred *cred = current_cred();
3632 u32 sid = cred_sid(cred); 3677 u32 sid = cred_sid(cred);
3633 3678
3634 if (selinux_checkreqprot) 3679 if (selinux_state.checkreqprot)
3635 prot = reqprot; 3680 prot = reqprot;
3636 3681
3637 if (default_noexec && 3682 if (default_noexec &&
@@ -4319,7 +4364,8 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4319 if (unlikely(err)) 4364 if (unlikely(err))
4320 return -EACCES; 4365 return -EACCES;
4321 4366
4322 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid); 4367 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4368 nlbl_type, xfrm_sid, sid);
4323 if (unlikely(err)) { 4369 if (unlikely(err)) {
4324 printk(KERN_WARNING 4370 printk(KERN_WARNING
4325 "SELinux: failure in selinux_skb_peerlbl_sid()," 4371 "SELinux: failure in selinux_skb_peerlbl_sid(),"
@@ -4347,7 +4393,8 @@ static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4347 int err = 0; 4393 int err = 0;
4348 4394
4349 if (skb_sid != SECSID_NULL) 4395 if (skb_sid != SECSID_NULL)
4350 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid); 4396 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4397 conn_sid);
4351 else 4398 else
4352 *conn_sid = sk_sid; 4399 *conn_sid = sk_sid;
4353 4400
@@ -4364,8 +4411,8 @@ static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4364 return 0; 4411 return 0;
4365 } 4412 }
4366 4413
4367 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL, 4414 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4368 socksid); 4415 secclass, NULL, socksid);
4369} 4416}
4370 4417
4371static int sock_has_perm(struct sock *sk, u32 perms) 4418static int sock_has_perm(struct sock *sk, u32 perms)
@@ -4741,8 +4788,8 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
4741 4788
4742 /* server child socket */ 4789 /* server child socket */
4743 sksec_new->peer_sid = sksec_sock->sid; 4790 sksec_new->peer_sid = sksec_sock->sid;
4744 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid, 4791 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4745 &sksec_new->sid); 4792 sksec_sock->sid, &sksec_new->sid);
4746 if (err) 4793 if (err)
4747 return err; 4794 return err;
4748 4795
@@ -4847,7 +4894,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4847 * to the selinux_sock_rcv_skb_compat() function to deal with the 4894 * to the selinux_sock_rcv_skb_compat() function to deal with the
4848 * special handling. We do this in an attempt to keep this function 4895 * special handling. We do this in an attempt to keep this function
4849 * as fast and as clean as possible. */ 4896 * as fast and as clean as possible. */
4850 if (!selinux_policycap_netpeer) 4897 if (!selinux_policycap_netpeer())
4851 return selinux_sock_rcv_skb_compat(sk, skb, family); 4898 return selinux_sock_rcv_skb_compat(sk, skb, family);
4852 4899
4853 secmark_active = selinux_secmark_enabled(); 4900 secmark_active = selinux_secmark_enabled();
@@ -4909,7 +4956,8 @@ static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *op
4909 if (peer_sid == SECSID_NULL) 4956 if (peer_sid == SECSID_NULL)
4910 return -ENOPROTOOPT; 4957 return -ENOPROTOOPT;
4911 4958
4912 err = security_sid_to_context(peer_sid, &scontext, &scontext_len); 4959 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
4960 &scontext_len);
4913 if (err) 4961 if (err)
4914 return err; 4962 return err;
4915 4963
@@ -5032,7 +5080,7 @@ static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5032 u32 conn_sid; 5080 u32 conn_sid;
5033 int err = 0; 5081 int err = 0;
5034 5082
5035 if (!selinux_policycap_extsockclass) 5083 if (!selinux_policycap_extsockclass())
5036 return 0; 5084 return 0;
5037 5085
5038 peerlbl_active = selinux_peerlbl_enabled(); 5086 peerlbl_active = selinux_peerlbl_enabled();
@@ -5101,7 +5149,7 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5101 struct sockaddr *addr; 5149 struct sockaddr *addr;
5102 struct socket *sock; 5150 struct socket *sock;
5103 5151
5104 if (!selinux_policycap_extsockclass) 5152 if (!selinux_policycap_extsockclass())
5105 return 0; 5153 return 0;
5106 5154
5107 /* Process one or more addresses that may be IPv4 or IPv6 */ 5155 /* Process one or more addresses that may be IPv4 or IPv6 */
@@ -5173,7 +5221,7 @@ static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5173 /* If policy does not support SECCLASS_SCTP_SOCKET then call 5221 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5174 * the non-sctp clone version. 5222 * the non-sctp clone version.
5175 */ 5223 */
5176 if (!selinux_policycap_extsockclass) 5224 if (!selinux_policycap_extsockclass())
5177 return selinux_sk_clone_security(sk, newsk); 5225 return selinux_sk_clone_security(sk, newsk);
5178 5226
5179 newsksec->sid = ep->secid; 5227 newsksec->sid = ep->secid;
@@ -5359,7 +5407,8 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5359 sk->sk_protocol, nlh->nlmsg_type, 5407 sk->sk_protocol, nlh->nlmsg_type,
5360 secclass_map[sksec->sclass - 1].name, 5408 secclass_map[sksec->sclass - 1].name,
5361 task_pid_nr(current), current->comm); 5409 task_pid_nr(current), current->comm);
5362 if (!selinux_enforcing || security_get_allow_unknown()) 5410 if (!is_enforcing(&selinux_state) ||
5411 security_get_allow_unknown(&selinux_state))
5363 err = 0; 5412 err = 0;
5364 } 5413 }
5365 5414
@@ -5389,7 +5438,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb,
5389 u8 netlbl_active; 5438 u8 netlbl_active;
5390 u8 peerlbl_active; 5439 u8 peerlbl_active;
5391 5440
5392 if (!selinux_policycap_netpeer) 5441 if (!selinux_policycap_netpeer())
5393 return NF_ACCEPT; 5442 return NF_ACCEPT;
5394 5443
5395 secmark_active = selinux_secmark_enabled(); 5444 secmark_active = selinux_secmark_enabled();
@@ -5558,7 +5607,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5558 * to the selinux_ip_postroute_compat() function to deal with the 5607 * to the selinux_ip_postroute_compat() function to deal with the
5559 * special handling. We do this in an attempt to keep this function 5608 * special handling. We do this in an attempt to keep this function
5560 * as fast and as clean as possible. */ 5609 * as fast and as clean as possible. */
5561 if (!selinux_policycap_netpeer) 5610 if (!selinux_policycap_netpeer())
5562 return selinux_ip_postroute_compat(skb, ifindex, family); 5611 return selinux_ip_postroute_compat(skb, ifindex, family);
5563 5612
5564 secmark_active = selinux_secmark_enabled(); 5613 secmark_active = selinux_secmark_enabled();
@@ -5864,8 +5913,8 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
5864 * Compute new sid based on current process and 5913 * Compute new sid based on current process and
5865 * message queue this message will be stored in 5914 * message queue this message will be stored in
5866 */ 5915 */
5867 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG, 5916 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5868 NULL, &msec->sid); 5917 SECCLASS_MSG, NULL, &msec->sid);
5869 if (rc) 5918 if (rc)
5870 return rc; 5919 return rc;
5871 } 5920 }
@@ -6174,7 +6223,7 @@ static int selinux_getprocattr(struct task_struct *p,
6174 if (!sid) 6223 if (!sid)
6175 return 0; 6224 return 0;
6176 6225
6177 error = security_sid_to_context(sid, value, &len); 6226 error = security_sid_to_context(&selinux_state, sid, value, &len);
6178 if (error) 6227 if (error)
6179 return error; 6228 return error;
6180 return len; 6229 return len;
@@ -6221,7 +6270,8 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
6221 str[size-1] = 0; 6270 str[size-1] = 0;
6222 size--; 6271 size--;
6223 } 6272 }
6224 error = security_context_to_sid(value, size, &sid, GFP_KERNEL); 6273 error = security_context_to_sid(&selinux_state, value, size,
6274 &sid, GFP_KERNEL);
6225 if (error == -EINVAL && !strcmp(name, "fscreate")) { 6275 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6226 if (!has_cap_mac_admin(true)) { 6276 if (!has_cap_mac_admin(true)) {
6227 struct audit_buffer *ab; 6277 struct audit_buffer *ab;
@@ -6240,8 +6290,9 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
6240 6290
6241 return error; 6291 return error;
6242 } 6292 }
6243 error = security_context_to_sid_force(value, size, 6293 error = security_context_to_sid_force(
6244 &sid); 6294 &selinux_state,
6295 value, size, &sid);
6245 } 6296 }
6246 if (error) 6297 if (error)
6247 return error; 6298 return error;
@@ -6278,7 +6329,8 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
6278 /* Only allow single threaded processes to change context */ 6329 /* Only allow single threaded processes to change context */
6279 error = -EPERM; 6330 error = -EPERM;
6280 if (!current_is_single_threaded()) { 6331 if (!current_is_single_threaded()) {
6281 error = security_bounded_transition(tsec->sid, sid); 6332 error = security_bounded_transition(&selinux_state,
6333 tsec->sid, sid);
6282 if (error) 6334 if (error)
6283 goto abort_change; 6335 goto abort_change;
6284 } 6336 }
@@ -6320,12 +6372,14 @@ static int selinux_ismaclabel(const char *name)
6320 6372
6321static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 6373static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6322{ 6374{
6323 return security_sid_to_context(secid, secdata, seclen); 6375 return security_sid_to_context(&selinux_state, secid,
6376 secdata, seclen);
6324} 6377}
6325 6378
6326static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 6379static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6327{ 6380{
6328 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL); 6381 return security_context_to_sid(&selinux_state, secdata, seclen,
6382 secid, GFP_KERNEL);
6329} 6383}
6330 6384
6331static void selinux_release_secctx(char *secdata, u32 seclen) 6385static void selinux_release_secctx(char *secdata, u32 seclen)
@@ -6427,7 +6481,8 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
6427 unsigned len; 6481 unsigned len;
6428 int rc; 6482 int rc;
6429 6483
6430 rc = security_sid_to_context(ksec->sid, &context, &len); 6484 rc = security_sid_to_context(&selinux_state, ksec->sid,
6485 &context, &len);
6431 if (!rc) 6486 if (!rc)
6432 rc = len; 6487 rc = len;
6433 *_buffer = context; 6488 *_buffer = context;
@@ -6466,7 +6521,8 @@ static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6466 struct ib_security_struct *sec = ib_sec; 6521 struct ib_security_struct *sec = ib_sec;
6467 struct lsm_ibendport_audit ibendport; 6522 struct lsm_ibendport_audit ibendport;
6468 6523
6469 err = security_ib_endport_sid(dev_name, port_num, &sid); 6524 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6525 &sid);
6470 6526
6471 if (err) 6527 if (err)
6472 return err; 6528 return err;
@@ -6880,6 +6936,11 @@ static __init int selinux_init(void)
6880 6936
6881 printk(KERN_INFO "SELinux: Initializing.\n"); 6937 printk(KERN_INFO "SELinux: Initializing.\n");
6882 6938
6939 memset(&selinux_state, 0, sizeof(selinux_state));
6940 set_enforcing(&selinux_state, selinux_enforcing_boot);
6941 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6942 selinux_ss_init(&selinux_state.ss);
6943
6883 /* Set the security state for the initial task. */ 6944 /* Set the security state for the initial task. */
6884 cred_init_security(); 6945 cred_init_security();
6885 6946
@@ -6893,6 +6954,12 @@ static __init int selinux_init(void)
6893 0, SLAB_PANIC, NULL); 6954 0, SLAB_PANIC, NULL);
6894 avc_init(); 6955 avc_init();
6895 6956
6957 avtab_cache_init();
6958
6959 ebitmap_cache_init();
6960
6961 hashtab_cache_init();
6962
6896 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux"); 6963 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6897 6964
6898 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) 6965 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
@@ -6901,7 +6968,7 @@ static __init int selinux_init(void)
6901 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET)) 6968 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6902 panic("SELinux: Unable to register AVC LSM notifier callback\n"); 6969 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6903 6970
6904 if (selinux_enforcing) 6971 if (selinux_enforcing_boot)
6905 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); 6972 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6906 else 6973 else
6907 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n"); 6974 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
@@ -7022,23 +7089,22 @@ static void selinux_nf_ip_exit(void)
7022#endif /* CONFIG_NETFILTER */ 7089#endif /* CONFIG_NETFILTER */
7023 7090
7024#ifdef CONFIG_SECURITY_SELINUX_DISABLE 7091#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7025static int selinux_disabled; 7092int selinux_disable(struct selinux_state *state)
7026
7027int selinux_disable(void)
7028{ 7093{
7029 if (ss_initialized) { 7094 if (state->initialized) {
7030 /* Not permitted after initial policy load. */ 7095 /* Not permitted after initial policy load. */
7031 return -EINVAL; 7096 return -EINVAL;
7032 } 7097 }
7033 7098
7034 if (selinux_disabled) { 7099 if (state->disabled) {
7035 /* Only do this once. */ 7100 /* Only do this once. */
7036 return -EINVAL; 7101 return -EINVAL;
7037 } 7102 }
7038 7103
7104 state->disabled = 1;
7105
7039 printk(KERN_INFO "SELinux: Disabled at runtime.\n"); 7106 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
7040 7107
7041 selinux_disabled = 1;
7042 selinux_enabled = 0; 7108 selinux_enabled = 0;
7043 7109
7044 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); 7110 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index e3614ee5f1c0..0a4b89d48297 100644
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -152,7 +152,8 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
152 return 0; 152 return 0;
153 } 153 }
154 154
155 ret = security_ib_pkey_sid(subnet_prefix, pkey_num, sid); 155 ret = security_ib_pkey_sid(&selinux_state, subnet_prefix, pkey_num,
156 sid);
156 if (ret) 157 if (ret)
157 goto out; 158 goto out;
158 159
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 57d61cf36500..de33dc9034b8 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -20,12 +20,6 @@
20#include "av_permissions.h" 20#include "av_permissions.h"
21#include "security.h" 21#include "security.h"
22 22
23#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
24extern int selinux_enforcing;
25#else
26#define selinux_enforcing 1
27#endif
28
29/* 23/*
30 * An entry in the AVC. 24 * An entry in the AVC.
31 */ 25 */
diff --git a/security/selinux/include/avc_ss.h b/security/selinux/include/avc_ss.h
index 3bcc72769b87..4e2a44d0ae66 100644
--- a/security/selinux/include/avc_ss.h
+++ b/security/selinux/include/avc_ss.h
@@ -19,11 +19,5 @@ struct security_class_mapping {
19 19
20extern struct security_class_mapping secclass_map[]; 20extern struct security_class_mapping secclass_map[];
21 21
22/*
23 * The security server must be initialized before
24 * any labeling or access decisions can be provided.
25 */
26extern int ss_initialized;
27
28#endif /* _SELINUX_AVC_SS_H_ */ 22#endif /* _SELINUX_AVC_SS_H_ */
29 23
diff --git a/security/selinux/include/conditional.h b/security/selinux/include/conditional.h
index ff4fddca9050..0e30eca02c48 100644
--- a/security/selinux/include/conditional.h
+++ b/security/selinux/include/conditional.h
@@ -13,10 +13,15 @@
13#ifndef _SELINUX_CONDITIONAL_H_ 13#ifndef _SELINUX_CONDITIONAL_H_
14#define _SELINUX_CONDITIONAL_H_ 14#define _SELINUX_CONDITIONAL_H_
15 15
16int security_get_bools(int *len, char ***names, int **values); 16#include "security.h"
17 17
18int security_set_bools(int len, int *values); 18int security_get_bools(struct selinux_state *state,
19 int *len, char ***names, int **values);
19 20
20int security_get_bool_value(int index); 21int security_set_bools(struct selinux_state *state,
22 int len, int *values);
23
24int security_get_bool_value(struct selinux_state *state,
25 int index);
21 26
22#endif 27#endif
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index dabf02888a95..cc5e26b0161b 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -158,6 +158,4 @@ struct bpf_security_struct {
158 u32 sid; /*SID of bpf obj creater*/ 158 u32 sid; /*SID of bpf obj creater*/
159}; 159};
160 160
161extern unsigned int selinux_checkreqprot;
162
163#endif /* _SELINUX_OBJSEC_H_ */ 161#endif /* _SELINUX_OBJSEC_H_ */
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 02f0412d42f2..c3a1ef10e710 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -13,6 +13,8 @@
13#include <linux/dcache.h> 13#include <linux/dcache.h>
14#include <linux/magic.h> 14#include <linux/magic.h>
15#include <linux/types.h> 15#include <linux/types.h>
16#include <linux/refcount.h>
17#include <linux/workqueue.h>
16#include "flask.h" 18#include "flask.h"
17 19
18#define SECSID_NULL 0x00000000 /* unspecified SID */ 20#define SECSID_NULL 0x00000000 /* unspecified SID */
@@ -81,13 +83,6 @@ enum {
81 83
82extern char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX]; 84extern char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX];
83 85
84extern int selinux_policycap_netpeer;
85extern int selinux_policycap_openperm;
86extern int selinux_policycap_extsockclass;
87extern int selinux_policycap_alwaysnetwork;
88extern int selinux_policycap_cgroupseclabel;
89extern int selinux_policycap_nnp_nosuid_transition;
90
91/* 86/*
92 * type_datum properties 87 * type_datum properties
93 * available at the kernel policy version >= POLICYDB_VERSION_BOUNDARY 88 * available at the kernel policy version >= POLICYDB_VERSION_BOUNDARY
@@ -98,13 +93,95 @@ extern int selinux_policycap_nnp_nosuid_transition;
98/* limitation of boundary depth */ 93/* limitation of boundary depth */
99#define POLICYDB_BOUNDS_MAXDEPTH 4 94#define POLICYDB_BOUNDS_MAXDEPTH 4
100 95
101int security_mls_enabled(void); 96struct selinux_ss;
97
98struct selinux_state {
99 bool disabled;
100#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 bool enforcing;
102#endif
103 bool checkreqprot;
104 bool initialized;
105 bool policycap[__POLICYDB_CAPABILITY_MAX];
106 struct selinux_ss *ss;
107};
108
109void selinux_ss_init(struct selinux_ss **ss);
110
111extern struct selinux_state selinux_state;
112
113#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
114static inline bool is_enforcing(struct selinux_state *state)
115{
116 return state->enforcing;
117}
118
119static inline void set_enforcing(struct selinux_state *state, bool value)
120{
121 state->enforcing = value;
122}
123#else
124static inline bool is_enforcing(struct selinux_state *state)
125{
126 return true;
127}
128
129static inline void set_enforcing(struct selinux_state *state, bool value)
130{
131}
132#endif
133
134static inline bool selinux_policycap_netpeer(void)
135{
136 struct selinux_state *state = &selinux_state;
137
138 return state->policycap[POLICYDB_CAPABILITY_NETPEER];
139}
140
141static inline bool selinux_policycap_openperm(void)
142{
143 struct selinux_state *state = &selinux_state;
144
145 return state->policycap[POLICYDB_CAPABILITY_OPENPERM];
146}
102 147
103int security_load_policy(void *data, size_t len); 148static inline bool selinux_policycap_extsockclass(void)
104int security_read_policy(void **data, size_t *len); 149{
105size_t security_policydb_len(void); 150 struct selinux_state *state = &selinux_state;
151
152 return state->policycap[POLICYDB_CAPABILITY_EXTSOCKCLASS];
153}
106 154
107int security_policycap_supported(unsigned int req_cap); 155static inline bool selinux_policycap_alwaysnetwork(void)
156{
157 struct selinux_state *state = &selinux_state;
158
159 return state->policycap[POLICYDB_CAPABILITY_ALWAYSNETWORK];
160}
161
162static inline bool selinux_policycap_cgroupseclabel(void)
163{
164 struct selinux_state *state = &selinux_state;
165
166 return state->policycap[POLICYDB_CAPABILITY_CGROUPSECLABEL];
167}
168
169static inline bool selinux_policycap_nnp_nosuid_transition(void)
170{
171 struct selinux_state *state = &selinux_state;
172
173 return state->policycap[POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION];
174}
175
176int security_mls_enabled(struct selinux_state *state);
177int security_load_policy(struct selinux_state *state,
178 void *data, size_t len);
179int security_read_policy(struct selinux_state *state,
180 void **data, size_t *len);
181size_t security_policydb_len(struct selinux_state *state);
182
183int security_policycap_supported(struct selinux_state *state,
184 unsigned int req_cap);
108 185
109#define SEL_VEC_MAX 32 186#define SEL_VEC_MAX 32
110struct av_decision { 187struct av_decision {
@@ -141,76 +218,100 @@ struct extended_perms {
141/* definitions of av_decision.flags */ 218/* definitions of av_decision.flags */
142#define AVD_FLAGS_PERMISSIVE 0x0001 219#define AVD_FLAGS_PERMISSIVE 0x0001
143 220
144void security_compute_av(u32 ssid, u32 tsid, 221void security_compute_av(struct selinux_state *state,
222 u32 ssid, u32 tsid,
145 u16 tclass, struct av_decision *avd, 223 u16 tclass, struct av_decision *avd,
146 struct extended_perms *xperms); 224 struct extended_perms *xperms);
147 225
148void security_compute_xperms_decision(u32 ssid, u32 tsid, u16 tclass, 226void security_compute_xperms_decision(struct selinux_state *state,
149 u8 driver, struct extended_perms_decision *xpermd); 227 u32 ssid, u32 tsid, u16 tclass,
228 u8 driver,
229 struct extended_perms_decision *xpermd);
150 230
151void security_compute_av_user(u32 ssid, u32 tsid, 231void security_compute_av_user(struct selinux_state *state,
152 u16 tclass, struct av_decision *avd); 232 u32 ssid, u32 tsid,
233 u16 tclass, struct av_decision *avd);
153 234
154int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, 235int security_transition_sid(struct selinux_state *state,
236 u32 ssid, u32 tsid, u16 tclass,
155 const struct qstr *qstr, u32 *out_sid); 237 const struct qstr *qstr, u32 *out_sid);
156 238
157int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, 239int security_transition_sid_user(struct selinux_state *state,
240 u32 ssid, u32 tsid, u16 tclass,
158 const char *objname, u32 *out_sid); 241 const char *objname, u32 *out_sid);
159 242
160int security_member_sid(u32 ssid, u32 tsid, 243int security_member_sid(struct selinux_state *state, u32 ssid, u32 tsid,
161 u16 tclass, u32 *out_sid); 244 u16 tclass, u32 *out_sid);
162 245
163int security_change_sid(u32 ssid, u32 tsid, 246int security_change_sid(struct selinux_state *state, u32 ssid, u32 tsid,
164 u16 tclass, u32 *out_sid); 247 u16 tclass, u32 *out_sid);
165 248
166int security_sid_to_context(u32 sid, char **scontext, 249int security_sid_to_context(struct selinux_state *state, u32 sid,
167 u32 *scontext_len); 250 char **scontext, u32 *scontext_len);
168 251
169int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len); 252int security_sid_to_context_force(struct selinux_state *state,
253 u32 sid, char **scontext, u32 *scontext_len);
170 254
171int security_context_to_sid(const char *scontext, u32 scontext_len, 255int security_context_to_sid(struct selinux_state *state,
256 const char *scontext, u32 scontext_len,
172 u32 *out_sid, gfp_t gfp); 257 u32 *out_sid, gfp_t gfp);
173 258
174int security_context_str_to_sid(const char *scontext, u32 *out_sid, gfp_t gfp); 259int security_context_str_to_sid(struct selinux_state *state,
260 const char *scontext, u32 *out_sid, gfp_t gfp);
175 261
176int security_context_to_sid_default(const char *scontext, u32 scontext_len, 262int security_context_to_sid_default(struct selinux_state *state,
263 const char *scontext, u32 scontext_len,
177 u32 *out_sid, u32 def_sid, gfp_t gfp_flags); 264 u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
178 265
179int security_context_to_sid_force(const char *scontext, u32 scontext_len, 266int security_context_to_sid_force(struct selinux_state *state,
267 const char *scontext, u32 scontext_len,
180 u32 *sid); 268 u32 *sid);
181 269
182int security_get_user_sids(u32 callsid, char *username, 270int security_get_user_sids(struct selinux_state *state,
271 u32 callsid, char *username,
183 u32 **sids, u32 *nel); 272 u32 **sids, u32 *nel);
184 273
185int security_port_sid(u8 protocol, u16 port, u32 *out_sid); 274int security_port_sid(struct selinux_state *state,
275 u8 protocol, u16 port, u32 *out_sid);
186 276
187int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid); 277int security_ib_pkey_sid(struct selinux_state *state,
278 u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
188 279
189int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid); 280int security_ib_endport_sid(struct selinux_state *state,
281 const char *dev_name, u8 port_num, u32 *out_sid);
190 282
191int security_netif_sid(char *name, u32 *if_sid); 283int security_netif_sid(struct selinux_state *state,
284 char *name, u32 *if_sid);
192 285
193int security_node_sid(u16 domain, void *addr, u32 addrlen, 286int security_node_sid(struct selinux_state *state,
194 u32 *out_sid); 287 u16 domain, void *addr, u32 addrlen,
288 u32 *out_sid);
195 289
196int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 290int security_validate_transition(struct selinux_state *state,
291 u32 oldsid, u32 newsid, u32 tasksid,
197 u16 tclass); 292 u16 tclass);
198 293
199int security_validate_transition_user(u32 oldsid, u32 newsid, u32 tasksid, 294int security_validate_transition_user(struct selinux_state *state,
295 u32 oldsid, u32 newsid, u32 tasksid,
200 u16 tclass); 296 u16 tclass);
201 297
202int security_bounded_transition(u32 oldsid, u32 newsid); 298int security_bounded_transition(struct selinux_state *state,
299 u32 oldsid, u32 newsid);
203 300
204int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid); 301int security_sid_mls_copy(struct selinux_state *state,
302 u32 sid, u32 mls_sid, u32 *new_sid);
205 303
206int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 304int security_net_peersid_resolve(struct selinux_state *state,
305 u32 nlbl_sid, u32 nlbl_type,
207 u32 xfrm_sid, 306 u32 xfrm_sid,
208 u32 *peer_sid); 307 u32 *peer_sid);
209 308
210int security_get_classes(char ***classes, int *nclasses); 309int security_get_classes(struct selinux_state *state,
211int security_get_permissions(char *class, char ***perms, int *nperms); 310 char ***classes, int *nclasses);
212int security_get_reject_unknown(void); 311int security_get_permissions(struct selinux_state *state,
213int security_get_allow_unknown(void); 312 char *class, char ***perms, int *nperms);
313int security_get_reject_unknown(struct selinux_state *state);
314int security_get_allow_unknown(struct selinux_state *state);
214 315
215#define SECURITY_FS_USE_XATTR 1 /* use xattr */ 316#define SECURITY_FS_USE_XATTR 1 /* use xattr */
216#define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */ 317#define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */
@@ -221,27 +322,31 @@ int security_get_allow_unknown(void);
221#define SECURITY_FS_USE_NATIVE 7 /* use native label support */ 322#define SECURITY_FS_USE_NATIVE 7 /* use native label support */
222#define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */ 323#define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */
223 324
224int security_fs_use(struct super_block *sb); 325int security_fs_use(struct selinux_state *state, struct super_block *sb);
225 326
226int security_genfs_sid(const char *fstype, char *name, u16 sclass, 327int security_genfs_sid(struct selinux_state *state,
227 u32 *sid); 328 const char *fstype, char *name, u16 sclass,
329 u32 *sid);
228 330
229#ifdef CONFIG_NETLABEL 331#ifdef CONFIG_NETLABEL
230int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 332int security_netlbl_secattr_to_sid(struct selinux_state *state,
333 struct netlbl_lsm_secattr *secattr,
231 u32 *sid); 334 u32 *sid);
232 335
233int security_netlbl_sid_to_secattr(u32 sid, 336int security_netlbl_sid_to_secattr(struct selinux_state *state,
337 u32 sid,
234 struct netlbl_lsm_secattr *secattr); 338 struct netlbl_lsm_secattr *secattr);
235#else 339#else
236static inline int security_netlbl_secattr_to_sid( 340static inline int security_netlbl_secattr_to_sid(struct selinux_state *state,
237 struct netlbl_lsm_secattr *secattr, 341 struct netlbl_lsm_secattr *secattr,
238 u32 *sid) 342 u32 *sid)
239{ 343{
240 return -EIDRM; 344 return -EIDRM;
241} 345}
242 346
243static inline int security_netlbl_sid_to_secattr(u32 sid, 347static inline int security_netlbl_sid_to_secattr(struct selinux_state *state,
244 struct netlbl_lsm_secattr *secattr) 348 u32 sid,
349 struct netlbl_lsm_secattr *secattr)
245{ 350{
246 return -ENOENT; 351 return -ENOENT;
247} 352}
@@ -252,7 +357,7 @@ const char *security_get_initial_sid_context(u32 sid);
252/* 357/*
253 * status notifier using mmap interface 358 * status notifier using mmap interface
254 */ 359 */
255extern struct page *selinux_kernel_status_page(void); 360extern struct page *selinux_kernel_status_page(struct selinux_state *state);
256 361
257#define SELINUX_KERNEL_STATUS_VERSION 1 362#define SELINUX_KERNEL_STATUS_VERSION 1
258struct selinux_kernel_status { 363struct selinux_kernel_status {
@@ -266,10 +371,12 @@ struct selinux_kernel_status {
266 */ 371 */
267} __packed; 372} __packed;
268 373
269extern void selinux_status_update_setenforce(int enforcing); 374extern void selinux_status_update_setenforce(struct selinux_state *state,
270extern void selinux_status_update_policyload(int seqno); 375 int enforcing);
376extern void selinux_status_update_policyload(struct selinux_state *state,
377 int seqno);
271extern void selinux_complete_init(void); 378extern void selinux_complete_init(void);
272extern int selinux_disable(void); 379extern int selinux_disable(struct selinux_state *state);
273extern void exit_sel_fs(void); 380extern void exit_sel_fs(void);
274extern struct path selinux_null; 381extern struct path selinux_null;
275extern struct vfsmount *selinuxfs_mount; 382extern struct vfsmount *selinuxfs_mount;
@@ -277,5 +384,8 @@ extern void selnl_notify_setenforce(int val);
277extern void selnl_notify_policyload(u32 seqno); 384extern void selnl_notify_policyload(u32 seqno);
278extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm); 385extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
279 386
280#endif /* _SELINUX_SECURITY_H_ */ 387extern void avtab_cache_init(void);
388extern void ebitmap_cache_init(void);
389extern void hashtab_cache_init(void);
281 390
391#endif /* _SELINUX_SECURITY_H_ */
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index e607b4473ef6..ac65f7417413 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -163,7 +163,7 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
163 ret = -ENOMEM; 163 ret = -ENOMEM;
164 goto out; 164 goto out;
165 } 165 }
166 ret = security_netif_sid(dev->name, &new->nsec.sid); 166 ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid);
167 if (ret != 0) 167 if (ret != 0)
168 goto out; 168 goto out;
169 new->nsec.ns = ns; 169 new->nsec.ns = ns;
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 8730be427390..28010f741cfe 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -59,7 +59,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
59{ 59{
60 int rc; 60 int rc;
61 61
62 rc = security_netlbl_secattr_to_sid(secattr, sid); 62 rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid);
63 if (rc == 0 && 63 if (rc == 0 &&
64 (secattr->flags & NETLBL_SECATTR_CACHEABLE) && 64 (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
65 (secattr->flags & NETLBL_SECATTR_CACHE)) 65 (secattr->flags & NETLBL_SECATTR_CACHE))
@@ -90,7 +90,8 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
90 secattr = netlbl_secattr_alloc(GFP_ATOMIC); 90 secattr = netlbl_secattr_alloc(GFP_ATOMIC);
91 if (secattr == NULL) 91 if (secattr == NULL)
92 return NULL; 92 return NULL;
93 rc = security_netlbl_sid_to_secattr(sksec->sid, secattr); 93 rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid,
94 secattr);
94 if (rc != 0) { 95 if (rc != 0) {
95 netlbl_secattr_free(secattr); 96 netlbl_secattr_free(secattr);
96 return NULL; 97 return NULL;
@@ -257,7 +258,8 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
257 if (secattr == NULL) { 258 if (secattr == NULL) {
258 secattr = &secattr_storage; 259 secattr = &secattr_storage;
259 netlbl_secattr_init(secattr); 260 netlbl_secattr_init(secattr);
260 rc = security_netlbl_sid_to_secattr(sid, secattr); 261 rc = security_netlbl_sid_to_secattr(&selinux_state, sid,
262 secattr);
261 if (rc != 0) 263 if (rc != 0)
262 goto skbuff_setsid_return; 264 goto skbuff_setsid_return;
263 } 265 }
@@ -297,7 +299,8 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
297 return 0; 299 return 0;
298 300
299 netlbl_secattr_init(&secattr); 301 netlbl_secattr_init(&secattr);
300 rc = security_netlbl_sid_to_secattr(ep->secid, &secattr); 302 rc = security_netlbl_sid_to_secattr(&selinux_state,
303 ep->secid, &secattr);
301 if (rc != 0) 304 if (rc != 0)
302 goto assoc_request_return; 305 goto assoc_request_return;
303 306
@@ -345,7 +348,8 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
345 return 0; 348 return 0;
346 349
347 netlbl_secattr_init(&secattr); 350 netlbl_secattr_init(&secattr);
348 rc = security_netlbl_sid_to_secattr(req->secid, &secattr); 351 rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid,
352 &secattr);
349 if (rc != 0) 353 if (rc != 0)
350 goto inet_conn_request_return; 354 goto inet_conn_request_return;
351 rc = netlbl_req_setattr(req, &secattr); 355 rc = netlbl_req_setattr(req, &secattr);
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index da923f89d2a9..6dd89b89bc1f 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -215,12 +215,12 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
215 goto out; 215 goto out;
216 switch (family) { 216 switch (family) {
217 case PF_INET: 217 case PF_INET:
218 ret = security_node_sid(PF_INET, 218 ret = security_node_sid(&selinux_state, PF_INET,
219 addr, sizeof(struct in_addr), sid); 219 addr, sizeof(struct in_addr), sid);
220 new->nsec.addr.ipv4 = *(__be32 *)addr; 220 new->nsec.addr.ipv4 = *(__be32 *)addr;
221 break; 221 break;
222 case PF_INET6: 222 case PF_INET6:
223 ret = security_node_sid(PF_INET6, 223 ret = security_node_sid(&selinux_state, PF_INET6,
224 addr, sizeof(struct in6_addr), sid); 224 addr, sizeof(struct in6_addr), sid);
225 new->nsec.addr.ipv6 = *(struct in6_addr *)addr; 225 new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
226 break; 226 break;
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 3311cc393cb4..9ed4c5064a5e 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -161,7 +161,7 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
161 new = kzalloc(sizeof(*new), GFP_ATOMIC); 161 new = kzalloc(sizeof(*new), GFP_ATOMIC);
162 if (new == NULL) 162 if (new == NULL)
163 goto out; 163 goto out;
164 ret = security_port_sid(protocol, pnum, sid); 164 ret = security_port_sid(&selinux_state, protocol, pnum, sid);
165 if (ret != 0) 165 if (ret != 0)
166 goto out; 166 goto out;
167 167
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 00eed842c491..98492755adbf 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -41,17 +41,6 @@
41#include "objsec.h" 41#include "objsec.h"
42#include "conditional.h" 42#include "conditional.h"
43 43
44unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
45
46static int __init checkreqprot_setup(char *str)
47{
48 unsigned long checkreqprot;
49 if (!kstrtoul(str, 0, &checkreqprot))
50 selinux_checkreqprot = checkreqprot ? 1 : 0;
51 return 1;
52}
53__setup("checkreqprot=", checkreqprot_setup);
54
55static DEFINE_MUTEX(sel_mutex); 44static DEFINE_MUTEX(sel_mutex);
56 45
57/* global data for booleans */ 46/* global data for booleans */
@@ -108,7 +97,8 @@ static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
108 char tmpbuf[TMPBUFLEN]; 97 char tmpbuf[TMPBUFLEN];
109 ssize_t length; 98 ssize_t length;
110 99
111 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", selinux_enforcing); 100 length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
101 is_enforcing(&selinux_state));
112 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 102 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
113} 103}
114 104
@@ -119,7 +109,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
119{ 109{
120 char *page = NULL; 110 char *page = NULL;
121 ssize_t length; 111 ssize_t length;
122 int new_value; 112 int old_value, new_value;
123 113
124 if (count >= PAGE_SIZE) 114 if (count >= PAGE_SIZE)
125 return -ENOMEM; 115 return -ENOMEM;
@@ -138,7 +128,9 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
138 128
139 new_value = !!new_value; 129 new_value = !!new_value;
140 130
141 if (new_value != selinux_enforcing) { 131 old_value = is_enforcing(&selinux_state);
132
133 if (new_value != old_value) {
142 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 134 length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
143 SECCLASS_SECURITY, SECURITY__SETENFORCE, 135 SECCLASS_SECURITY, SECURITY__SETENFORCE,
144 NULL); 136 NULL);
@@ -146,15 +138,16 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
146 goto out; 138 goto out;
147 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS, 139 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
148 "enforcing=%d old_enforcing=%d auid=%u ses=%u", 140 "enforcing=%d old_enforcing=%d auid=%u ses=%u",
149 new_value, selinux_enforcing, 141 new_value, old_value,
150 from_kuid(&init_user_ns, audit_get_loginuid(current)), 142 from_kuid(&init_user_ns, audit_get_loginuid(current)),
151 audit_get_sessionid(current)); 143 audit_get_sessionid(current));
152 selinux_enforcing = new_value; 144 set_enforcing(&selinux_state, new_value);
153 if (selinux_enforcing) 145 if (new_value)
154 avc_ss_reset(0); 146 avc_ss_reset(0);
155 selnl_notify_setenforce(selinux_enforcing); 147 selnl_notify_setenforce(new_value);
156 selinux_status_update_setenforce(selinux_enforcing); 148 selinux_status_update_setenforce(&selinux_state,
157 if (!selinux_enforcing) 149 new_value);
150 if (!new_value)
158 call_lsm_notifier(LSM_POLICY_CHANGE, NULL); 151 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
159 } 152 }
160 length = count; 153 length = count;
@@ -179,7 +172,8 @@ static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
179 ssize_t length; 172 ssize_t length;
180 ino_t ino = file_inode(filp)->i_ino; 173 ino_t ino = file_inode(filp)->i_ino;
181 int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ? 174 int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
182 security_get_reject_unknown() : !security_get_allow_unknown(); 175 security_get_reject_unknown(&selinux_state) :
176 !security_get_allow_unknown(&selinux_state);
183 177
184 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown); 178 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
185 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 179 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
@@ -192,7 +186,7 @@ static const struct file_operations sel_handle_unknown_ops = {
192 186
193static int sel_open_handle_status(struct inode *inode, struct file *filp) 187static int sel_open_handle_status(struct inode *inode, struct file *filp)
194{ 188{
195 struct page *status = selinux_kernel_status_page(); 189 struct page *status = selinux_kernel_status_page(&selinux_state);
196 190
197 if (!status) 191 if (!status)
198 return -ENOMEM; 192 return -ENOMEM;
@@ -268,7 +262,7 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
268 goto out; 262 goto out;
269 263
270 if (new_value) { 264 if (new_value) {
271 length = selinux_disable(); 265 length = selinux_disable(&selinux_state);
272 if (length) 266 if (length)
273 goto out; 267 goto out;
274 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS, 268 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
@@ -322,7 +316,7 @@ static ssize_t sel_read_mls(struct file *filp, char __user *buf,
322 ssize_t length; 316 ssize_t length;
323 317
324 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", 318 length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
325 security_mls_enabled()); 319 security_mls_enabled(&selinux_state));
326 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 320 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
327} 321}
328 322
@@ -359,13 +353,13 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
359 if (!plm) 353 if (!plm)
360 goto err; 354 goto err;
361 355
362 if (i_size_read(inode) != security_policydb_len()) { 356 if (i_size_read(inode) != security_policydb_len(&selinux_state)) {
363 inode_lock(inode); 357 inode_lock(inode);
364 i_size_write(inode, security_policydb_len()); 358 i_size_write(inode, security_policydb_len(&selinux_state));
365 inode_unlock(inode); 359 inode_unlock(inode);
366 } 360 }
367 361
368 rc = security_read_policy(&plm->data, &plm->len); 362 rc = security_read_policy(&selinux_state, &plm->data, &plm->len);
369 if (rc) 363 if (rc)
370 goto err; 364 goto err;
371 365
@@ -500,7 +494,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
500 if (copy_from_user(data, buf, count) != 0) 494 if (copy_from_user(data, buf, count) != 0)
501 goto out; 495 goto out;
502 496
503 length = security_load_policy(data, count); 497 length = security_load_policy(&selinux_state, data, count);
504 if (length) { 498 if (length) {
505 pr_warn_ratelimited("SELinux: failed to load policy\n"); 499 pr_warn_ratelimited("SELinux: failed to load policy\n");
506 goto out; 500 goto out;
@@ -553,11 +547,12 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
553 if (length) 547 if (length)
554 goto out; 548 goto out;
555 549
556 length = security_context_to_sid(buf, size, &sid, GFP_KERNEL); 550 length = security_context_to_sid(&selinux_state, buf, size,
551 &sid, GFP_KERNEL);
557 if (length) 552 if (length)
558 goto out; 553 goto out;
559 554
560 length = security_sid_to_context(sid, &canon, &len); 555 length = security_sid_to_context(&selinux_state, sid, &canon, &len);
561 if (length) 556 if (length)
562 goto out; 557 goto out;
563 558
@@ -581,7 +576,7 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
581 char tmpbuf[TMPBUFLEN]; 576 char tmpbuf[TMPBUFLEN];
582 ssize_t length; 577 ssize_t length;
583 578
584 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", selinux_checkreqprot); 579 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", selinux_state.checkreqprot);
585 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 580 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
586} 581}
587 582
@@ -613,7 +608,7 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
613 if (sscanf(page, "%u", &new_value) != 1) 608 if (sscanf(page, "%u", &new_value) != 1)
614 goto out; 609 goto out;
615 610
616 selinux_checkreqprot = new_value ? 1 : 0; 611 selinux_state.checkreqprot = new_value ? 1 : 0;
617 length = count; 612 length = count;
618out: 613out:
619 kfree(page); 614 kfree(page);
@@ -673,19 +668,23 @@ static ssize_t sel_write_validatetrans(struct file *file,
673 if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4) 668 if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
674 goto out; 669 goto out;
675 670
676 rc = security_context_str_to_sid(oldcon, &osid, GFP_KERNEL); 671 rc = security_context_str_to_sid(&selinux_state, oldcon, &osid,
672 GFP_KERNEL);
677 if (rc) 673 if (rc)
678 goto out; 674 goto out;
679 675
680 rc = security_context_str_to_sid(newcon, &nsid, GFP_KERNEL); 676 rc = security_context_str_to_sid(&selinux_state, newcon, &nsid,
677 GFP_KERNEL);
681 if (rc) 678 if (rc)
682 goto out; 679 goto out;
683 680
684 rc = security_context_str_to_sid(taskcon, &tsid, GFP_KERNEL); 681 rc = security_context_str_to_sid(&selinux_state, taskcon, &tsid,
682 GFP_KERNEL);
685 if (rc) 683 if (rc)
686 goto out; 684 goto out;
687 685
688 rc = security_validate_transition_user(osid, nsid, tsid, tclass); 686 rc = security_validate_transition_user(&selinux_state, osid, nsid,
687 tsid, tclass);
689 if (!rc) 688 if (!rc)
690 rc = count; 689 rc = count;
691out: 690out:
@@ -780,15 +779,17 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
780 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 779 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
781 goto out; 780 goto out;
782 781
783 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 782 length = security_context_str_to_sid(&selinux_state, scon, &ssid,
783 GFP_KERNEL);
784 if (length) 784 if (length)
785 goto out; 785 goto out;
786 786
787 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 787 length = security_context_str_to_sid(&selinux_state, tcon, &tsid,
788 GFP_KERNEL);
788 if (length) 789 if (length)
789 goto out; 790 goto out;
790 791
791 security_compute_av_user(ssid, tsid, tclass, &avd); 792 security_compute_av_user(&selinux_state, ssid, tsid, tclass, &avd);
792 793
793 length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, 794 length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
794 "%x %x %x %x %u %x", 795 "%x %x %x %x %u %x",
@@ -868,20 +869,23 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
868 objname = namebuf; 869 objname = namebuf;
869 } 870 }
870 871
871 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 872 length = security_context_str_to_sid(&selinux_state, scon, &ssid,
873 GFP_KERNEL);
872 if (length) 874 if (length)
873 goto out; 875 goto out;
874 876
875 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 877 length = security_context_str_to_sid(&selinux_state, tcon, &tsid,
878 GFP_KERNEL);
876 if (length) 879 if (length)
877 goto out; 880 goto out;
878 881
879 length = security_transition_sid_user(ssid, tsid, tclass, 882 length = security_transition_sid_user(&selinux_state, ssid, tsid,
880 objname, &newsid); 883 tclass, objname, &newsid);
881 if (length) 884 if (length)
882 goto out; 885 goto out;
883 886
884 length = security_sid_to_context(newsid, &newcon, &len); 887 length = security_sid_to_context(&selinux_state, newsid, &newcon,
888 &len);
885 if (length) 889 if (length)
886 goto out; 890 goto out;
887 891
@@ -931,19 +935,23 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
931 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 935 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
932 goto out; 936 goto out;
933 937
934 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 938 length = security_context_str_to_sid(&selinux_state, scon, &ssid,
939 GFP_KERNEL);
935 if (length) 940 if (length)
936 goto out; 941 goto out;
937 942
938 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 943 length = security_context_str_to_sid(&selinux_state, tcon, &tsid,
944 GFP_KERNEL);
939 if (length) 945 if (length)
940 goto out; 946 goto out;
941 947
942 length = security_change_sid(ssid, tsid, tclass, &newsid); 948 length = security_change_sid(&selinux_state, ssid, tsid, tclass,
949 &newsid);
943 if (length) 950 if (length)
944 goto out; 951 goto out;
945 952
946 length = security_sid_to_context(newsid, &newcon, &len); 953 length = security_sid_to_context(&selinux_state, newsid, &newcon,
954 &len);
947 if (length) 955 if (length)
948 goto out; 956 goto out;
949 957
@@ -989,18 +997,21 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
989 if (sscanf(buf, "%s %s", con, user) != 2) 997 if (sscanf(buf, "%s %s", con, user) != 2)
990 goto out; 998 goto out;
991 999
992 length = security_context_str_to_sid(con, &sid, GFP_KERNEL); 1000 length = security_context_str_to_sid(&selinux_state, con, &sid,
1001 GFP_KERNEL);
993 if (length) 1002 if (length)
994 goto out; 1003 goto out;
995 1004
996 length = security_get_user_sids(sid, user, &sids, &nsids); 1005 length = security_get_user_sids(&selinux_state, sid, user, &sids,
1006 &nsids);
997 if (length) 1007 if (length)
998 goto out; 1008 goto out;
999 1009
1000 length = sprintf(buf, "%u", nsids) + 1; 1010 length = sprintf(buf, "%u", nsids) + 1;
1001 ptr = buf + length; 1011 ptr = buf + length;
1002 for (i = 0; i < nsids; i++) { 1012 for (i = 0; i < nsids; i++) {
1003 rc = security_sid_to_context(sids[i], &newcon, &len); 1013 rc = security_sid_to_context(&selinux_state, sids[i],
1014 &newcon, &len);
1004 if (rc) { 1015 if (rc) {
1005 length = rc; 1016 length = rc;
1006 goto out; 1017 goto out;
@@ -1051,19 +1062,23 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
1051 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 1062 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
1052 goto out; 1063 goto out;
1053 1064
1054 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 1065 length = security_context_str_to_sid(&selinux_state, scon, &ssid,
1066 GFP_KERNEL);
1055 if (length) 1067 if (length)
1056 goto out; 1068 goto out;
1057 1069
1058 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 1070 length = security_context_str_to_sid(&selinux_state, tcon, &tsid,
1071 GFP_KERNEL);
1059 if (length) 1072 if (length)
1060 goto out; 1073 goto out;
1061 1074
1062 length = security_member_sid(ssid, tsid, tclass, &newsid); 1075 length = security_member_sid(&selinux_state, ssid, tsid, tclass,
1076 &newsid);
1063 if (length) 1077 if (length)
1064 goto out; 1078 goto out;
1065 1079
1066 length = security_sid_to_context(newsid, &newcon, &len); 1080 length = security_sid_to_context(&selinux_state, newsid, &newcon,
1081 &len);
1067 if (length) 1082 if (length)
1068 goto out; 1083 goto out;
1069 1084
@@ -1115,7 +1130,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
1115 if (!page) 1130 if (!page)
1116 goto out; 1131 goto out;
1117 1132
1118 cur_enforcing = security_get_bool_value(index); 1133 cur_enforcing = security_get_bool_value(&selinux_state, index);
1119 if (cur_enforcing < 0) { 1134 if (cur_enforcing < 0) {
1120 ret = cur_enforcing; 1135 ret = cur_enforcing;
1121 goto out; 1136 goto out;
@@ -1226,7 +1241,8 @@ static ssize_t sel_commit_bools_write(struct file *filep,
1226 1241
1227 length = 0; 1242 length = 0;
1228 if (new_value && bool_pending_values) 1243 if (new_value && bool_pending_values)
1229 length = security_set_bools(bool_num, bool_pending_values); 1244 length = security_set_bools(&selinux_state, bool_num,
1245 bool_pending_values);
1230 1246
1231 if (!length) 1247 if (!length)
1232 length = count; 1248 length = count;
@@ -1279,7 +1295,7 @@ static int sel_make_bools(void)
1279 if (!page) 1295 if (!page)
1280 goto out; 1296 goto out;
1281 1297
1282 ret = security_get_bools(&num, &names, &values); 1298 ret = security_get_bools(&selinux_state, &num, &names, &values);
1283 if (ret) 1299 if (ret)
1284 goto out; 1300 goto out;
1285 1301
@@ -1300,7 +1316,8 @@ static int sel_make_bools(void)
1300 goto out; 1316 goto out;
1301 1317
1302 isec = (struct inode_security_struct *)inode->i_security; 1318 isec = (struct inode_security_struct *)inode->i_security;
1303 ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid); 1319 ret = security_genfs_sid(&selinux_state, "selinuxfs", page,
1320 SECCLASS_FILE, &sid);
1304 if (ret) { 1321 if (ret) {
1305 pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n", 1322 pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
1306 page); 1323 page);
@@ -1524,7 +1541,7 @@ static ssize_t sel_read_initcon(struct file *file, char __user *buf,
1524 ssize_t ret; 1541 ssize_t ret;
1525 1542
1526 sid = file_inode(file)->i_ino&SEL_INO_MASK; 1543 sid = file_inode(file)->i_ino&SEL_INO_MASK;
1527 ret = security_sid_to_context(sid, &con, &len); 1544 ret = security_sid_to_context(&selinux_state, sid, &con, &len);
1528 if (ret) 1545 if (ret)
1529 return ret; 1546 return ret;
1530 1547
@@ -1617,7 +1634,8 @@ static ssize_t sel_read_policycap(struct file *file, char __user *buf,
1617 ssize_t length; 1634 ssize_t length;
1618 unsigned long i_ino = file_inode(file)->i_ino; 1635 unsigned long i_ino = file_inode(file)->i_ino;
1619 1636
1620 value = security_policycap_supported(i_ino & SEL_INO_MASK); 1637 value = security_policycap_supported(&selinux_state,
1638 i_ino & SEL_INO_MASK);
1621 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value); 1639 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
1622 1640
1623 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 1641 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
@@ -1634,7 +1652,8 @@ static int sel_make_perm_files(char *objclass, int classvalue,
1634 int i, rc, nperms; 1652 int i, rc, nperms;
1635 char **perms; 1653 char **perms;
1636 1654
1637 rc = security_get_permissions(objclass, &perms, &nperms); 1655 rc = security_get_permissions(&selinux_state, objclass, &perms,
1656 &nperms);
1638 if (rc) 1657 if (rc)
1639 return rc; 1658 return rc;
1640 1659
@@ -1701,7 +1720,7 @@ static int sel_make_classes(void)
1701 /* delete any existing entries */ 1720 /* delete any existing entries */
1702 sel_remove_entries(class_dir); 1721 sel_remove_entries(class_dir);
1703 1722
1704 rc = security_get_classes(&classes, &nclasses); 1723 rc = security_get_classes(&selinux_state, &classes, &nclasses);
1705 if (rc) 1724 if (rc)
1706 return rc; 1725 return rc;
1707 1726
diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index 2c3c7d010d8a..a2c9148b0662 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -655,7 +655,8 @@ int avtab_write(struct policydb *p, struct avtab *a, void *fp)
655 655
656 return rc; 656 return rc;
657} 657}
658void avtab_cache_init(void) 658
659void __init avtab_cache_init(void)
659{ 660{
660 avtab_node_cachep = kmem_cache_create("avtab_node", 661 avtab_node_cachep = kmem_cache_create("avtab_node",
661 sizeof(struct avtab_node), 662 sizeof(struct avtab_node),
@@ -664,9 +665,3 @@ void avtab_cache_init(void)
664 sizeof(struct avtab_extended_perms), 665 sizeof(struct avtab_extended_perms),
665 0, SLAB_PANIC, NULL); 666 0, SLAB_PANIC, NULL);
666} 667}
667
668void avtab_cache_destroy(void)
669{
670 kmem_cache_destroy(avtab_node_cachep);
671 kmem_cache_destroy(avtab_xperms_cachep);
672}
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index 725853cadc42..0d652fad5319 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -114,9 +114,6 @@ struct avtab_node *avtab_search_node(struct avtab *h, struct avtab_key *key);
114 114
115struct avtab_node *avtab_search_node_next(struct avtab_node *node, int specified); 115struct avtab_node *avtab_search_node_next(struct avtab_node *node, int specified);
116 116
117void avtab_cache_init(void);
118void avtab_cache_destroy(void);
119
120#define MAX_AVTAB_HASH_BITS 16 117#define MAX_AVTAB_HASH_BITS 16
121#define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS) 118#define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
122 119
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index b6a78b09235c..5ae8c61b75bf 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -523,14 +523,9 @@ int ebitmap_write(struct ebitmap *e, void *fp)
523 return 0; 523 return 0;
524} 524}
525 525
526void ebitmap_cache_init(void) 526void __init ebitmap_cache_init(void)
527{ 527{
528 ebitmap_node_cachep = kmem_cache_create("ebitmap_node", 528 ebitmap_node_cachep = kmem_cache_create("ebitmap_node",
529 sizeof(struct ebitmap_node), 529 sizeof(struct ebitmap_node),
530 0, SLAB_PANIC, NULL); 530 0, SLAB_PANIC, NULL);
531} 531}
532
533void ebitmap_cache_destroy(void)
534{
535 kmem_cache_destroy(ebitmap_node_cachep);
536}
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index edf4fa39c60a..6aa7cf6a2197 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -131,9 +131,6 @@ void ebitmap_destroy(struct ebitmap *e);
131int ebitmap_read(struct ebitmap *e, void *fp); 131int ebitmap_read(struct ebitmap *e, void *fp);
132int ebitmap_write(struct ebitmap *e, void *fp); 132int ebitmap_write(struct ebitmap *e, void *fp);
133 133
134void ebitmap_cache_init(void);
135void ebitmap_cache_destroy(void);
136
137#ifdef CONFIG_NETLABEL 134#ifdef CONFIG_NETLABEL
138int ebitmap_netlbl_export(struct ebitmap *ebmap, 135int ebitmap_netlbl_export(struct ebitmap *ebmap,
139 struct netlbl_lsm_catmap **catmap); 136 struct netlbl_lsm_catmap **catmap);
diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c
index fe25b3fb2154..ebfdaa31ee32 100644
--- a/security/selinux/ss/hashtab.c
+++ b/security/selinux/ss/hashtab.c
@@ -169,14 +169,10 @@ void hashtab_stat(struct hashtab *h, struct hashtab_info *info)
169 info->slots_used = slots_used; 169 info->slots_used = slots_used;
170 info->max_chain_len = max_chain_len; 170 info->max_chain_len = max_chain_len;
171} 171}
172void hashtab_cache_init(void) 172
173void __init hashtab_cache_init(void)
173{ 174{
174 hashtab_node_cachep = kmem_cache_create("hashtab_node", 175 hashtab_node_cachep = kmem_cache_create("hashtab_node",
175 sizeof(struct hashtab_node), 176 sizeof(struct hashtab_node),
176 0, SLAB_PANIC, NULL); 177 0, SLAB_PANIC, NULL);
177} 178}
178
179void hashtab_cache_destroy(void)
180{
181 kmem_cache_destroy(hashtab_node_cachep);
182}
diff --git a/security/selinux/ss/hashtab.h b/security/selinux/ss/hashtab.h
index 6183ee2a2e7a..3e3e42bfd150 100644
--- a/security/selinux/ss/hashtab.h
+++ b/security/selinux/ss/hashtab.h
@@ -85,8 +85,4 @@ int hashtab_map(struct hashtab *h,
85/* Fill info with some hash table statistics */ 85/* Fill info with some hash table statistics */
86void hashtab_stat(struct hashtab *h, struct hashtab_info *info); 86void hashtab_stat(struct hashtab *h, struct hashtab_info *info);
87 87
88/* Use kmem_cache for hashtab_node */
89void hashtab_cache_init(void);
90void hashtab_cache_destroy(void);
91
92#endif /* _SS_HASHTAB_H */ 88#endif /* _SS_HASHTAB_H */
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index ad982ce8bfa4..39475fb455bc 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -33,20 +33,20 @@
33 * Return the length in bytes for the MLS fields of the 33 * Return the length in bytes for the MLS fields of the
34 * security context string representation of `context'. 34 * security context string representation of `context'.
35 */ 35 */
36int mls_compute_context_len(struct context *context) 36int mls_compute_context_len(struct policydb *p, struct context *context)
37{ 37{
38 int i, l, len, head, prev; 38 int i, l, len, head, prev;
39 char *nm; 39 char *nm;
40 struct ebitmap *e; 40 struct ebitmap *e;
41 struct ebitmap_node *node; 41 struct ebitmap_node *node;
42 42
43 if (!policydb.mls_enabled) 43 if (!p->mls_enabled)
44 return 0; 44 return 0;
45 45
46 len = 1; /* for the beginning ":" */ 46 len = 1; /* for the beginning ":" */
47 for (l = 0; l < 2; l++) { 47 for (l = 0; l < 2; l++) {
48 int index_sens = context->range.level[l].sens; 48 int index_sens = context->range.level[l].sens;
49 len += strlen(sym_name(&policydb, SYM_LEVELS, index_sens - 1)); 49 len += strlen(sym_name(p, SYM_LEVELS, index_sens - 1));
50 50
51 /* categories */ 51 /* categories */
52 head = -2; 52 head = -2;
@@ -56,17 +56,17 @@ int mls_compute_context_len(struct context *context)
56 if (i - prev > 1) { 56 if (i - prev > 1) {
57 /* one or more negative bits are skipped */ 57 /* one or more negative bits are skipped */
58 if (head != prev) { 58 if (head != prev) {
59 nm = sym_name(&policydb, SYM_CATS, prev); 59 nm = sym_name(p, SYM_CATS, prev);
60 len += strlen(nm) + 1; 60 len += strlen(nm) + 1;
61 } 61 }
62 nm = sym_name(&policydb, SYM_CATS, i); 62 nm = sym_name(p, SYM_CATS, i);
63 len += strlen(nm) + 1; 63 len += strlen(nm) + 1;
64 head = i; 64 head = i;
65 } 65 }
66 prev = i; 66 prev = i;
67 } 67 }
68 if (prev != head) { 68 if (prev != head) {
69 nm = sym_name(&policydb, SYM_CATS, prev); 69 nm = sym_name(p, SYM_CATS, prev);
70 len += strlen(nm) + 1; 70 len += strlen(nm) + 1;
71 } 71 }
72 if (l == 0) { 72 if (l == 0) {
@@ -86,7 +86,8 @@ int mls_compute_context_len(struct context *context)
86 * the MLS fields of `context' into the string `*scontext'. 86 * the MLS fields of `context' into the string `*scontext'.
87 * Update `*scontext' to point to the end of the MLS fields. 87 * Update `*scontext' to point to the end of the MLS fields.
88 */ 88 */
89void mls_sid_to_context(struct context *context, 89void mls_sid_to_context(struct policydb *p,
90 struct context *context,
90 char **scontext) 91 char **scontext)
91{ 92{
92 char *scontextp, *nm; 93 char *scontextp, *nm;
@@ -94,7 +95,7 @@ void mls_sid_to_context(struct context *context,
94 struct ebitmap *e; 95 struct ebitmap *e;
95 struct ebitmap_node *node; 96 struct ebitmap_node *node;
96 97
97 if (!policydb.mls_enabled) 98 if (!p->mls_enabled)
98 return; 99 return;
99 100
100 scontextp = *scontext; 101 scontextp = *scontext;
@@ -103,7 +104,7 @@ void mls_sid_to_context(struct context *context,
103 scontextp++; 104 scontextp++;
104 105
105 for (l = 0; l < 2; l++) { 106 for (l = 0; l < 2; l++) {
106 strcpy(scontextp, sym_name(&policydb, SYM_LEVELS, 107 strcpy(scontextp, sym_name(p, SYM_LEVELS,
107 context->range.level[l].sens - 1)); 108 context->range.level[l].sens - 1));
108 scontextp += strlen(scontextp); 109 scontextp += strlen(scontextp);
109 110
@@ -119,7 +120,7 @@ void mls_sid_to_context(struct context *context,
119 *scontextp++ = '.'; 120 *scontextp++ = '.';
120 else 121 else
121 *scontextp++ = ','; 122 *scontextp++ = ',';
122 nm = sym_name(&policydb, SYM_CATS, prev); 123 nm = sym_name(p, SYM_CATS, prev);
123 strcpy(scontextp, nm); 124 strcpy(scontextp, nm);
124 scontextp += strlen(nm); 125 scontextp += strlen(nm);
125 } 126 }
@@ -127,7 +128,7 @@ void mls_sid_to_context(struct context *context,
127 *scontextp++ = ':'; 128 *scontextp++ = ':';
128 else 129 else
129 *scontextp++ = ','; 130 *scontextp++ = ',';
130 nm = sym_name(&policydb, SYM_CATS, i); 131 nm = sym_name(p, SYM_CATS, i);
131 strcpy(scontextp, nm); 132 strcpy(scontextp, nm);
132 scontextp += strlen(nm); 133 scontextp += strlen(nm);
133 head = i; 134 head = i;
@@ -140,7 +141,7 @@ void mls_sid_to_context(struct context *context,
140 *scontextp++ = '.'; 141 *scontextp++ = '.';
141 else 142 else
142 *scontextp++ = ','; 143 *scontextp++ = ',';
143 nm = sym_name(&policydb, SYM_CATS, prev); 144 nm = sym_name(p, SYM_CATS, prev);
144 strcpy(scontextp, nm); 145 strcpy(scontextp, nm);
145 scontextp += strlen(nm); 146 scontextp += strlen(nm);
146 } 147 }
@@ -375,12 +376,13 @@ out:
375 * the string `str'. This function will allocate temporary memory with the 376 * the string `str'. This function will allocate temporary memory with the
376 * given constraints of gfp_mask. 377 * given constraints of gfp_mask.
377 */ 378 */
378int mls_from_string(char *str, struct context *context, gfp_t gfp_mask) 379int mls_from_string(struct policydb *p, char *str, struct context *context,
380 gfp_t gfp_mask)
379{ 381{
380 char *tmpstr, *freestr; 382 char *tmpstr, *freestr;
381 int rc; 383 int rc;
382 384
383 if (!policydb.mls_enabled) 385 if (!p->mls_enabled)
384 return -EINVAL; 386 return -EINVAL;
385 387
386 /* we need freestr because mls_context_to_sid will change 388 /* we need freestr because mls_context_to_sid will change
@@ -389,7 +391,7 @@ int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
389 if (!tmpstr) { 391 if (!tmpstr) {
390 rc = -ENOMEM; 392 rc = -ENOMEM;
391 } else { 393 } else {
392 rc = mls_context_to_sid(&policydb, ':', &tmpstr, context, 394 rc = mls_context_to_sid(p, ':', &tmpstr, context,
393 NULL, SECSID_NULL); 395 NULL, SECSID_NULL);
394 kfree(freestr); 396 kfree(freestr);
395 } 397 }
@@ -417,10 +419,11 @@ int mls_range_set(struct context *context,
417 return rc; 419 return rc;
418} 420}
419 421
420int mls_setup_user_range(struct context *fromcon, struct user_datum *user, 422int mls_setup_user_range(struct policydb *p,
423 struct context *fromcon, struct user_datum *user,
421 struct context *usercon) 424 struct context *usercon)
422{ 425{
423 if (policydb.mls_enabled) { 426 if (p->mls_enabled) {
424 struct mls_level *fromcon_sen = &(fromcon->range.level[0]); 427 struct mls_level *fromcon_sen = &(fromcon->range.level[0]);
425 struct mls_level *fromcon_clr = &(fromcon->range.level[1]); 428 struct mls_level *fromcon_clr = &(fromcon->range.level[1]);
426 struct mls_level *user_low = &(user->range.level[0]); 429 struct mls_level *user_low = &(user->range.level[0]);
@@ -470,7 +473,7 @@ int mls_convert_context(struct policydb *oldp,
470 struct ebitmap_node *node; 473 struct ebitmap_node *node;
471 int l, i; 474 int l, i;
472 475
473 if (!policydb.mls_enabled) 476 if (!oldp->mls_enabled || !newp->mls_enabled)
474 return 0; 477 return 0;
475 478
476 for (l = 0; l < 2; l++) { 479 for (l = 0; l < 2; l++) {
@@ -503,7 +506,8 @@ int mls_convert_context(struct policydb *oldp,
503 return 0; 506 return 0;
504} 507}
505 508
506int mls_compute_sid(struct context *scontext, 509int mls_compute_sid(struct policydb *p,
510 struct context *scontext,
507 struct context *tcontext, 511 struct context *tcontext,
508 u16 tclass, 512 u16 tclass,
509 u32 specified, 513 u32 specified,
@@ -515,7 +519,7 @@ int mls_compute_sid(struct context *scontext,
515 struct class_datum *cladatum; 519 struct class_datum *cladatum;
516 int default_range = 0; 520 int default_range = 0;
517 521
518 if (!policydb.mls_enabled) 522 if (!p->mls_enabled)
519 return 0; 523 return 0;
520 524
521 switch (specified) { 525 switch (specified) {
@@ -524,12 +528,12 @@ int mls_compute_sid(struct context *scontext,
524 rtr.source_type = scontext->type; 528 rtr.source_type = scontext->type;
525 rtr.target_type = tcontext->type; 529 rtr.target_type = tcontext->type;
526 rtr.target_class = tclass; 530 rtr.target_class = tclass;
527 r = hashtab_search(policydb.range_tr, &rtr); 531 r = hashtab_search(p->range_tr, &rtr);
528 if (r) 532 if (r)
529 return mls_range_set(newcontext, r); 533 return mls_range_set(newcontext, r);
530 534
531 if (tclass && tclass <= policydb.p_classes.nprim) { 535 if (tclass && tclass <= p->p_classes.nprim) {
532 cladatum = policydb.class_val_to_struct[tclass - 1]; 536 cladatum = p->class_val_to_struct[tclass - 1];
533 if (cladatum) 537 if (cladatum)
534 default_range = cladatum->default_range; 538 default_range = cladatum->default_range;
535 } 539 }
@@ -551,7 +555,7 @@ int mls_compute_sid(struct context *scontext,
551 555
552 /* Fallthrough */ 556 /* Fallthrough */
553 case AVTAB_CHANGE: 557 case AVTAB_CHANGE:
554 if ((tclass == policydb.process_class) || (sock == true)) 558 if ((tclass == p->process_class) || (sock == true))
555 /* Use the process MLS attributes. */ 559 /* Use the process MLS attributes. */
556 return mls_context_cpy(newcontext, scontext); 560 return mls_context_cpy(newcontext, scontext);
557 else 561 else
@@ -577,10 +581,11 @@ int mls_compute_sid(struct context *scontext,
577 * NetLabel MLS sensitivity level field. 581 * NetLabel MLS sensitivity level field.
578 * 582 *
579 */ 583 */
580void mls_export_netlbl_lvl(struct context *context, 584void mls_export_netlbl_lvl(struct policydb *p,
585 struct context *context,
581 struct netlbl_lsm_secattr *secattr) 586 struct netlbl_lsm_secattr *secattr)
582{ 587{
583 if (!policydb.mls_enabled) 588 if (!p->mls_enabled)
584 return; 589 return;
585 590
586 secattr->attr.mls.lvl = context->range.level[0].sens - 1; 591 secattr->attr.mls.lvl = context->range.level[0].sens - 1;
@@ -597,10 +602,11 @@ void mls_export_netlbl_lvl(struct context *context,
597 * NetLabel MLS sensitivity level into the context. 602 * NetLabel MLS sensitivity level into the context.
598 * 603 *
599 */ 604 */
600void mls_import_netlbl_lvl(struct context *context, 605void mls_import_netlbl_lvl(struct policydb *p,
606 struct context *context,
601 struct netlbl_lsm_secattr *secattr) 607 struct netlbl_lsm_secattr *secattr)
602{ 608{
603 if (!policydb.mls_enabled) 609 if (!p->mls_enabled)
604 return; 610 return;
605 611
606 context->range.level[0].sens = secattr->attr.mls.lvl + 1; 612 context->range.level[0].sens = secattr->attr.mls.lvl + 1;
@@ -617,12 +623,13 @@ void mls_import_netlbl_lvl(struct context *context,
617 * MLS category field. Returns zero on success, negative values on failure. 623 * MLS category field. Returns zero on success, negative values on failure.
618 * 624 *
619 */ 625 */
620int mls_export_netlbl_cat(struct context *context, 626int mls_export_netlbl_cat(struct policydb *p,
627 struct context *context,
621 struct netlbl_lsm_secattr *secattr) 628 struct netlbl_lsm_secattr *secattr)
622{ 629{
623 int rc; 630 int rc;
624 631
625 if (!policydb.mls_enabled) 632 if (!p->mls_enabled)
626 return 0; 633 return 0;
627 634
628 rc = ebitmap_netlbl_export(&context->range.level[0].cat, 635 rc = ebitmap_netlbl_export(&context->range.level[0].cat,
@@ -645,12 +652,13 @@ int mls_export_netlbl_cat(struct context *context,
645 * negative values on failure. 652 * negative values on failure.
646 * 653 *
647 */ 654 */
648int mls_import_netlbl_cat(struct context *context, 655int mls_import_netlbl_cat(struct policydb *p,
656 struct context *context,
649 struct netlbl_lsm_secattr *secattr) 657 struct netlbl_lsm_secattr *secattr)
650{ 658{
651 int rc; 659 int rc;
652 660
653 if (!policydb.mls_enabled) 661 if (!p->mls_enabled)
654 return 0; 662 return 0;
655 663
656 rc = ebitmap_netlbl_import(&context->range.level[0].cat, 664 rc = ebitmap_netlbl_import(&context->range.level[0].cat,
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index 131d76266ea5..9a3ff7af70ad 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -25,8 +25,9 @@
25#include "context.h" 25#include "context.h"
26#include "policydb.h" 26#include "policydb.h"
27 27
28int mls_compute_context_len(struct context *context); 28int mls_compute_context_len(struct policydb *p, struct context *context);
29void mls_sid_to_context(struct context *context, char **scontext); 29void mls_sid_to_context(struct policydb *p, struct context *context,
30 char **scontext);
30int mls_context_isvalid(struct policydb *p, struct context *c); 31int mls_context_isvalid(struct policydb *p, struct context *c);
31int mls_range_isvalid(struct policydb *p, struct mls_range *r); 32int mls_range_isvalid(struct policydb *p, struct mls_range *r);
32int mls_level_isvalid(struct policydb *p, struct mls_level *l); 33int mls_level_isvalid(struct policydb *p, struct mls_level *l);
@@ -38,7 +39,8 @@ int mls_context_to_sid(struct policydb *p,
38 struct sidtab *s, 39 struct sidtab *s,
39 u32 def_sid); 40 u32 def_sid);
40 41
41int mls_from_string(char *str, struct context *context, gfp_t gfp_mask); 42int mls_from_string(struct policydb *p, char *str, struct context *context,
43 gfp_t gfp_mask);
42 44
43int mls_range_set(struct context *context, struct mls_range *range); 45int mls_range_set(struct context *context, struct mls_range *range);
44 46
@@ -46,42 +48,52 @@ int mls_convert_context(struct policydb *oldp,
46 struct policydb *newp, 48 struct policydb *newp,
47 struct context *context); 49 struct context *context);
48 50
49int mls_compute_sid(struct context *scontext, 51int mls_compute_sid(struct policydb *p,
52 struct context *scontext,
50 struct context *tcontext, 53 struct context *tcontext,
51 u16 tclass, 54 u16 tclass,
52 u32 specified, 55 u32 specified,
53 struct context *newcontext, 56 struct context *newcontext,
54 bool sock); 57 bool sock);
55 58
56int mls_setup_user_range(struct context *fromcon, struct user_datum *user, 59int mls_setup_user_range(struct policydb *p,
60 struct context *fromcon, struct user_datum *user,
57 struct context *usercon); 61 struct context *usercon);
58 62
59#ifdef CONFIG_NETLABEL 63#ifdef CONFIG_NETLABEL
60void mls_export_netlbl_lvl(struct context *context, 64void mls_export_netlbl_lvl(struct policydb *p,
65 struct context *context,
61 struct netlbl_lsm_secattr *secattr); 66 struct netlbl_lsm_secattr *secattr);
62void mls_import_netlbl_lvl(struct context *context, 67void mls_import_netlbl_lvl(struct policydb *p,
68 struct context *context,
63 struct netlbl_lsm_secattr *secattr); 69 struct netlbl_lsm_secattr *secattr);
64int mls_export_netlbl_cat(struct context *context, 70int mls_export_netlbl_cat(struct policydb *p,
71 struct context *context,
65 struct netlbl_lsm_secattr *secattr); 72 struct netlbl_lsm_secattr *secattr);
66int mls_import_netlbl_cat(struct context *context, 73int mls_import_netlbl_cat(struct policydb *p,
74 struct context *context,
67 struct netlbl_lsm_secattr *secattr); 75 struct netlbl_lsm_secattr *secattr);
68#else 76#else
69static inline void mls_export_netlbl_lvl(struct context *context, 77static inline void mls_export_netlbl_lvl(struct policydb *p,
78 struct context *context,
70 struct netlbl_lsm_secattr *secattr) 79 struct netlbl_lsm_secattr *secattr)
71{ 80{
72 return; 81 return;
73} 82}
74static inline void mls_import_netlbl_lvl(struct context *context, 83static inline void mls_import_netlbl_lvl(struct policydb *p,
84 struct context *context,
75 struct netlbl_lsm_secattr *secattr) 85 struct netlbl_lsm_secattr *secattr)
76{ 86{
77 return; 87 return;
78} 88}
79static inline int mls_export_netlbl_cat(struct context *context, 89static inline int mls_export_netlbl_cat(struct policydb *p,
90 struct context *context,
80 struct netlbl_lsm_secattr *secattr) 91 struct netlbl_lsm_secattr *secattr)
81{ 92{
82 return -ENOMEM; 93 return -ENOMEM;
83} 94}
84static inline int mls_import_netlbl_cat(struct context *context, 95static inline int mls_import_netlbl_cat(struct policydb *p,
96 struct context *context,
85 struct netlbl_lsm_secattr *secattr) 97 struct netlbl_lsm_secattr *secattr)
86{ 98{
87 return -ENOMEM; 99 return -ENOMEM;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 8900ea5cbabf..3698352213d7 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -80,53 +80,32 @@ char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
80 "nnp_nosuid_transition" 80 "nnp_nosuid_transition"
81}; 81};
82 82
83int selinux_policycap_netpeer; 83static struct selinux_ss selinux_ss;
84int selinux_policycap_openperm;
85int selinux_policycap_extsockclass;
86int selinux_policycap_alwaysnetwork;
87int selinux_policycap_cgroupseclabel;
88int selinux_policycap_nnp_nosuid_transition;
89 84
90static DEFINE_RWLOCK(policy_rwlock); 85void selinux_ss_init(struct selinux_ss **ss)
91 86{
92static struct sidtab sidtab; 87 rwlock_init(&selinux_ss.policy_rwlock);
93struct policydb policydb; 88 mutex_init(&selinux_ss.status_lock);
94int ss_initialized; 89 *ss = &selinux_ss;
95 90}
96/*
97 * The largest sequence number that has been used when
98 * providing an access decision to the access vector cache.
99 * The sequence number only changes when a policy change
100 * occurs.
101 */
102static u32 latest_granting;
103 91
104/* Forward declaration. */ 92/* Forward declaration. */
105static int context_struct_to_string(struct context *context, char **scontext, 93static int context_struct_to_string(struct policydb *policydb,
94 struct context *context,
95 char **scontext,
106 u32 *scontext_len); 96 u32 *scontext_len);
107 97
108static void context_struct_compute_av(struct context *scontext, 98static void context_struct_compute_av(struct policydb *policydb,
109 struct context *tcontext, 99 struct context *scontext,
110 u16 tclass, 100 struct context *tcontext,
111 struct av_decision *avd, 101 u16 tclass,
112 struct extended_perms *xperms); 102 struct av_decision *avd,
113 103 struct extended_perms *xperms);
114struct selinux_mapping {
115 u16 value; /* policy value */
116 unsigned num_perms;
117 u32 perms[sizeof(u32) * 8];
118};
119
120static struct selinux_mapping *current_mapping;
121static u16 current_mapping_size;
122 104
123static int selinux_set_mapping(struct policydb *pol, 105static int selinux_set_mapping(struct policydb *pol,
124 struct security_class_mapping *map, 106 struct security_class_mapping *map,
125 struct selinux_mapping **out_map_p, 107 struct selinux_map *out_map)
126 u16 *out_map_size)
127{ 108{
128 struct selinux_mapping *out_map = NULL;
129 size_t size = sizeof(struct selinux_mapping);
130 u16 i, j; 109 u16 i, j;
131 unsigned k; 110 unsigned k;
132 bool print_unknown_handle = false; 111 bool print_unknown_handle = false;
@@ -139,15 +118,15 @@ static int selinux_set_mapping(struct policydb *pol,
139 i++; 118 i++;
140 119
141 /* Allocate space for the class records, plus one for class zero */ 120 /* Allocate space for the class records, plus one for class zero */
142 out_map = kcalloc(++i, size, GFP_ATOMIC); 121 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC);
143 if (!out_map) 122 if (!out_map->mapping)
144 return -ENOMEM; 123 return -ENOMEM;
145 124
146 /* Store the raw class and permission values */ 125 /* Store the raw class and permission values */
147 j = 0; 126 j = 0;
148 while (map[j].name) { 127 while (map[j].name) {
149 struct security_class_mapping *p_in = map + (j++); 128 struct security_class_mapping *p_in = map + (j++);
150 struct selinux_mapping *p_out = out_map + j; 129 struct selinux_mapping *p_out = out_map->mapping + j;
151 130
152 /* An empty class string skips ahead */ 131 /* An empty class string skips ahead */
153 if (!strcmp(p_in->name, "")) { 132 if (!strcmp(p_in->name, "")) {
@@ -194,11 +173,11 @@ static int selinux_set_mapping(struct policydb *pol,
194 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n", 173 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",
195 pol->allow_unknown ? "allowed" : "denied"); 174 pol->allow_unknown ? "allowed" : "denied");
196 175
197 *out_map_p = out_map; 176 out_map->size = i;
198 *out_map_size = i;
199 return 0; 177 return 0;
200err: 178err:
201 kfree(out_map); 179 kfree(out_map->mapping);
180 out_map->mapping = NULL;
202 return -EINVAL; 181 return -EINVAL;
203} 182}
204 183
@@ -206,10 +185,10 @@ err:
206 * Get real, policy values from mapped values 185 * Get real, policy values from mapped values
207 */ 186 */
208 187
209static u16 unmap_class(u16 tclass) 188static u16 unmap_class(struct selinux_map *map, u16 tclass)
210{ 189{
211 if (tclass < current_mapping_size) 190 if (tclass < map->size)
212 return current_mapping[tclass].value; 191 return map->mapping[tclass].value;
213 192
214 return tclass; 193 return tclass;
215} 194}
@@ -217,42 +196,44 @@ static u16 unmap_class(u16 tclass)
217/* 196/*
218 * Get kernel value for class from its policy value 197 * Get kernel value for class from its policy value
219 */ 198 */
220static u16 map_class(u16 pol_value) 199static u16 map_class(struct selinux_map *map, u16 pol_value)
221{ 200{
222 u16 i; 201 u16 i;
223 202
224 for (i = 1; i < current_mapping_size; i++) { 203 for (i = 1; i < map->size; i++) {
225 if (current_mapping[i].value == pol_value) 204 if (map->mapping[i].value == pol_value)
226 return i; 205 return i;
227 } 206 }
228 207
229 return SECCLASS_NULL; 208 return SECCLASS_NULL;
230} 209}
231 210
232static void map_decision(u16 tclass, struct av_decision *avd, 211static void map_decision(struct selinux_map *map,
212 u16 tclass, struct av_decision *avd,
233 int allow_unknown) 213 int allow_unknown)
234{ 214{
235 if (tclass < current_mapping_size) { 215 if (tclass < map->size) {
236 unsigned i, n = current_mapping[tclass].num_perms; 216 struct selinux_mapping *mapping = &map->mapping[tclass];
217 unsigned int i, n = mapping->num_perms;
237 u32 result; 218 u32 result;
238 219
239 for (i = 0, result = 0; i < n; i++) { 220 for (i = 0, result = 0; i < n; i++) {
240 if (avd->allowed & current_mapping[tclass].perms[i]) 221 if (avd->allowed & mapping->perms[i])
241 result |= 1<<i; 222 result |= 1<<i;
242 if (allow_unknown && !current_mapping[tclass].perms[i]) 223 if (allow_unknown && !mapping->perms[i])
243 result |= 1<<i; 224 result |= 1<<i;
244 } 225 }
245 avd->allowed = result; 226 avd->allowed = result;
246 227
247 for (i = 0, result = 0; i < n; i++) 228 for (i = 0, result = 0; i < n; i++)
248 if (avd->auditallow & current_mapping[tclass].perms[i]) 229 if (avd->auditallow & mapping->perms[i])
249 result |= 1<<i; 230 result |= 1<<i;
250 avd->auditallow = result; 231 avd->auditallow = result;
251 232
252 for (i = 0, result = 0; i < n; i++) { 233 for (i = 0, result = 0; i < n; i++) {
253 if (avd->auditdeny & current_mapping[tclass].perms[i]) 234 if (avd->auditdeny & mapping->perms[i])
254 result |= 1<<i; 235 result |= 1<<i;
255 if (!allow_unknown && !current_mapping[tclass].perms[i]) 236 if (!allow_unknown && !mapping->perms[i])
256 result |= 1<<i; 237 result |= 1<<i;
257 } 238 }
258 /* 239 /*
@@ -266,9 +247,11 @@ static void map_decision(u16 tclass, struct av_decision *avd,
266 } 247 }
267} 248}
268 249
269int security_mls_enabled(void) 250int security_mls_enabled(struct selinux_state *state)
270{ 251{
271 return policydb.mls_enabled; 252 struct policydb *p = &state->ss->policydb;
253
254 return p->mls_enabled;
272} 255}
273 256
274/* 257/*
@@ -282,7 +265,8 @@ int security_mls_enabled(void)
282 * of the process performing the transition. All other callers of 265 * of the process performing the transition. All other callers of
283 * constraint_expr_eval should pass in NULL for xcontext. 266 * constraint_expr_eval should pass in NULL for xcontext.
284 */ 267 */
285static int constraint_expr_eval(struct context *scontext, 268static int constraint_expr_eval(struct policydb *policydb,
269 struct context *scontext,
286 struct context *tcontext, 270 struct context *tcontext,
287 struct context *xcontext, 271 struct context *xcontext,
288 struct constraint_expr *cexpr) 272 struct constraint_expr *cexpr)
@@ -326,8 +310,8 @@ static int constraint_expr_eval(struct context *scontext,
326 case CEXPR_ROLE: 310 case CEXPR_ROLE:
327 val1 = scontext->role; 311 val1 = scontext->role;
328 val2 = tcontext->role; 312 val2 = tcontext->role;
329 r1 = policydb.role_val_to_struct[val1 - 1]; 313 r1 = policydb->role_val_to_struct[val1 - 1];
330 r2 = policydb.role_val_to_struct[val2 - 1]; 314 r2 = policydb->role_val_to_struct[val2 - 1];
331 switch (e->op) { 315 switch (e->op) {
332 case CEXPR_DOM: 316 case CEXPR_DOM:
333 s[++sp] = ebitmap_get_bit(&r1->dominates, 317 s[++sp] = ebitmap_get_bit(&r1->dominates,
@@ -472,7 +456,8 @@ static int dump_masked_av_helper(void *k, void *d, void *args)
472 return 0; 456 return 0;
473} 457}
474 458
475static void security_dump_masked_av(struct context *scontext, 459static void security_dump_masked_av(struct policydb *policydb,
460 struct context *scontext,
476 struct context *tcontext, 461 struct context *tcontext,
477 u16 tclass, 462 u16 tclass,
478 u32 permissions, 463 u32 permissions,
@@ -492,8 +477,8 @@ static void security_dump_masked_av(struct context *scontext,
492 if (!permissions) 477 if (!permissions)
493 return; 478 return;
494 479
495 tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1); 480 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1);
496 tclass_dat = policydb.class_val_to_struct[tclass - 1]; 481 tclass_dat = policydb->class_val_to_struct[tclass - 1];
497 common_dat = tclass_dat->comdatum; 482 common_dat = tclass_dat->comdatum;
498 483
499 /* init permission_names */ 484 /* init permission_names */
@@ -507,11 +492,11 @@ static void security_dump_masked_av(struct context *scontext,
507 goto out; 492 goto out;
508 493
509 /* get scontext/tcontext in text form */ 494 /* get scontext/tcontext in text form */
510 if (context_struct_to_string(scontext, 495 if (context_struct_to_string(policydb, scontext,
511 &scontext_name, &length) < 0) 496 &scontext_name, &length) < 0)
512 goto out; 497 goto out;
513 498
514 if (context_struct_to_string(tcontext, 499 if (context_struct_to_string(policydb, tcontext,
515 &tcontext_name, &length) < 0) 500 &tcontext_name, &length) < 0)
516 goto out; 501 goto out;
517 502
@@ -550,7 +535,8 @@ out:
550 * security_boundary_permission - drops violated permissions 535 * security_boundary_permission - drops violated permissions
551 * on boundary constraint. 536 * on boundary constraint.
552 */ 537 */
553static void type_attribute_bounds_av(struct context *scontext, 538static void type_attribute_bounds_av(struct policydb *policydb,
539 struct context *scontext,
554 struct context *tcontext, 540 struct context *tcontext,
555 u16 tclass, 541 u16 tclass,
556 struct av_decision *avd) 542 struct av_decision *avd)
@@ -562,14 +548,14 @@ static void type_attribute_bounds_av(struct context *scontext,
562 struct type_datum *target; 548 struct type_datum *target;
563 u32 masked = 0; 549 u32 masked = 0;
564 550
565 source = flex_array_get_ptr(policydb.type_val_to_struct_array, 551 source = flex_array_get_ptr(policydb->type_val_to_struct_array,
566 scontext->type - 1); 552 scontext->type - 1);
567 BUG_ON(!source); 553 BUG_ON(!source);
568 554
569 if (!source->bounds) 555 if (!source->bounds)
570 return; 556 return;
571 557
572 target = flex_array_get_ptr(policydb.type_val_to_struct_array, 558 target = flex_array_get_ptr(policydb->type_val_to_struct_array,
573 tcontext->type - 1); 559 tcontext->type - 1);
574 BUG_ON(!target); 560 BUG_ON(!target);
575 561
@@ -584,7 +570,7 @@ static void type_attribute_bounds_av(struct context *scontext,
584 tcontextp = &lo_tcontext; 570 tcontextp = &lo_tcontext;
585 } 571 }
586 572
587 context_struct_compute_av(&lo_scontext, 573 context_struct_compute_av(policydb, &lo_scontext,
588 tcontextp, 574 tcontextp,
589 tclass, 575 tclass,
590 &lo_avd, 576 &lo_avd,
@@ -599,7 +585,7 @@ static void type_attribute_bounds_av(struct context *scontext,
599 avd->allowed &= ~masked; 585 avd->allowed &= ~masked;
600 586
601 /* audit masked permissions */ 587 /* audit masked permissions */
602 security_dump_masked_av(scontext, tcontext, 588 security_dump_masked_av(policydb, scontext, tcontext,
603 tclass, masked, "bounds"); 589 tclass, masked, "bounds");
604} 590}
605 591
@@ -632,11 +618,12 @@ void services_compute_xperms_drivers(
632 * Compute access vectors and extended permissions based on a context 618 * Compute access vectors and extended permissions based on a context
633 * structure pair for the permissions in a particular class. 619 * structure pair for the permissions in a particular class.
634 */ 620 */
635static void context_struct_compute_av(struct context *scontext, 621static void context_struct_compute_av(struct policydb *policydb,
636 struct context *tcontext, 622 struct context *scontext,
637 u16 tclass, 623 struct context *tcontext,
638 struct av_decision *avd, 624 u16 tclass,
639 struct extended_perms *xperms) 625 struct av_decision *avd,
626 struct extended_perms *xperms)
640{ 627{
641 struct constraint_node *constraint; 628 struct constraint_node *constraint;
642 struct role_allow *ra; 629 struct role_allow *ra;
@@ -655,13 +642,13 @@ static void context_struct_compute_av(struct context *scontext,
655 xperms->len = 0; 642 xperms->len = 0;
656 } 643 }
657 644
658 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 645 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) {
659 if (printk_ratelimit()) 646 if (printk_ratelimit())
660 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass); 647 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass);
661 return; 648 return;
662 } 649 }
663 650
664 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 651 tclass_datum = policydb->class_val_to_struct[tclass - 1];
665 652
666 /* 653 /*
667 * If a specific type enforcement rule was defined for 654 * If a specific type enforcement rule was defined for
@@ -669,15 +656,18 @@ static void context_struct_compute_av(struct context *scontext,
669 */ 656 */
670 avkey.target_class = tclass; 657 avkey.target_class = tclass;
671 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 658 avkey.specified = AVTAB_AV | AVTAB_XPERMS;
672 sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1); 659 sattr = flex_array_get(policydb->type_attr_map_array,
660 scontext->type - 1);
673 BUG_ON(!sattr); 661 BUG_ON(!sattr);
674 tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1); 662 tattr = flex_array_get(policydb->type_attr_map_array,
663 tcontext->type - 1);
675 BUG_ON(!tattr); 664 BUG_ON(!tattr);
676 ebitmap_for_each_positive_bit(sattr, snode, i) { 665 ebitmap_for_each_positive_bit(sattr, snode, i) {
677 ebitmap_for_each_positive_bit(tattr, tnode, j) { 666 ebitmap_for_each_positive_bit(tattr, tnode, j) {
678 avkey.source_type = i + 1; 667 avkey.source_type = i + 1;
679 avkey.target_type = j + 1; 668 avkey.target_type = j + 1;
680 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 669 for (node = avtab_search_node(&policydb->te_avtab,
670 &avkey);
681 node; 671 node;
682 node = avtab_search_node_next(node, avkey.specified)) { 672 node = avtab_search_node_next(node, avkey.specified)) {
683 if (node->key.specified == AVTAB_ALLOWED) 673 if (node->key.specified == AVTAB_ALLOWED)
@@ -691,7 +681,7 @@ static void context_struct_compute_av(struct context *scontext,
691 } 681 }
692 682
693 /* Check conditional av table for additional permissions */ 683 /* Check conditional av table for additional permissions */
694 cond_compute_av(&policydb.te_cond_avtab, &avkey, 684 cond_compute_av(&policydb->te_cond_avtab, &avkey,
695 avd, xperms); 685 avd, xperms);
696 686
697 } 687 }
@@ -704,7 +694,7 @@ static void context_struct_compute_av(struct context *scontext,
704 constraint = tclass_datum->constraints; 694 constraint = tclass_datum->constraints;
705 while (constraint) { 695 while (constraint) {
706 if ((constraint->permissions & (avd->allowed)) && 696 if ((constraint->permissions & (avd->allowed)) &&
707 !constraint_expr_eval(scontext, tcontext, NULL, 697 !constraint_expr_eval(policydb, scontext, tcontext, NULL,
708 constraint->expr)) { 698 constraint->expr)) {
709 avd->allowed &= ~(constraint->permissions); 699 avd->allowed &= ~(constraint->permissions);
710 } 700 }
@@ -716,16 +706,16 @@ static void context_struct_compute_av(struct context *scontext,
716 * role is changing, then check the (current_role, new_role) 706 * role is changing, then check the (current_role, new_role)
717 * pair. 707 * pair.
718 */ 708 */
719 if (tclass == policydb.process_class && 709 if (tclass == policydb->process_class &&
720 (avd->allowed & policydb.process_trans_perms) && 710 (avd->allowed & policydb->process_trans_perms) &&
721 scontext->role != tcontext->role) { 711 scontext->role != tcontext->role) {
722 for (ra = policydb.role_allow; ra; ra = ra->next) { 712 for (ra = policydb->role_allow; ra; ra = ra->next) {
723 if (scontext->role == ra->role && 713 if (scontext->role == ra->role &&
724 tcontext->role == ra->new_role) 714 tcontext->role == ra->new_role)
725 break; 715 break;
726 } 716 }
727 if (!ra) 717 if (!ra)
728 avd->allowed &= ~policydb.process_trans_perms; 718 avd->allowed &= ~policydb->process_trans_perms;
729 } 719 }
730 720
731 /* 721 /*
@@ -733,41 +723,46 @@ static void context_struct_compute_av(struct context *scontext,
733 * constraint, lazy checks have to mask any violated 723 * constraint, lazy checks have to mask any violated
734 * permission and notice it to userspace via audit. 724 * permission and notice it to userspace via audit.
735 */ 725 */
736 type_attribute_bounds_av(scontext, tcontext, 726 type_attribute_bounds_av(policydb, scontext, tcontext,
737 tclass, avd); 727 tclass, avd);
738} 728}
739 729
740static int security_validtrans_handle_fail(struct context *ocontext, 730static int security_validtrans_handle_fail(struct selinux_state *state,
731 struct context *ocontext,
741 struct context *ncontext, 732 struct context *ncontext,
742 struct context *tcontext, 733 struct context *tcontext,
743 u16 tclass) 734 u16 tclass)
744{ 735{
736 struct policydb *p = &state->ss->policydb;
745 char *o = NULL, *n = NULL, *t = NULL; 737 char *o = NULL, *n = NULL, *t = NULL;
746 u32 olen, nlen, tlen; 738 u32 olen, nlen, tlen;
747 739
748 if (context_struct_to_string(ocontext, &o, &olen)) 740 if (context_struct_to_string(p, ocontext, &o, &olen))
749 goto out; 741 goto out;
750 if (context_struct_to_string(ncontext, &n, &nlen)) 742 if (context_struct_to_string(p, ncontext, &n, &nlen))
751 goto out; 743 goto out;
752 if (context_struct_to_string(tcontext, &t, &tlen)) 744 if (context_struct_to_string(p, tcontext, &t, &tlen))
753 goto out; 745 goto out;
754 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 746 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
755 "op=security_validate_transition seresult=denied" 747 "op=security_validate_transition seresult=denied"
756 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 748 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
757 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 749 o, n, t, sym_name(p, SYM_CLASSES, tclass-1));
758out: 750out:
759 kfree(o); 751 kfree(o);
760 kfree(n); 752 kfree(n);
761 kfree(t); 753 kfree(t);
762 754
763 if (!selinux_enforcing) 755 if (!is_enforcing(state))
764 return 0; 756 return 0;
765 return -EPERM; 757 return -EPERM;
766} 758}
767 759
768static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid, 760static int security_compute_validatetrans(struct selinux_state *state,
761 u32 oldsid, u32 newsid, u32 tasksid,
769 u16 orig_tclass, bool user) 762 u16 orig_tclass, bool user)
770{ 763{
764 struct policydb *policydb;
765 struct sidtab *sidtab;
771 struct context *ocontext; 766 struct context *ocontext;
772 struct context *ncontext; 767 struct context *ncontext;
773 struct context *tcontext; 768 struct context *tcontext;
@@ -776,23 +771,27 @@ static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
776 u16 tclass; 771 u16 tclass;
777 int rc = 0; 772 int rc = 0;
778 773
779 if (!ss_initialized) 774
775 if (!state->initialized)
780 return 0; 776 return 0;
781 777
782 read_lock(&policy_rwlock); 778 read_lock(&state->ss->policy_rwlock);
779
780 policydb = &state->ss->policydb;
781 sidtab = &state->ss->sidtab;
783 782
784 if (!user) 783 if (!user)
785 tclass = unmap_class(orig_tclass); 784 tclass = unmap_class(&state->ss->map, orig_tclass);
786 else 785 else
787 tclass = orig_tclass; 786 tclass = orig_tclass;
788 787
789 if (!tclass || tclass > policydb.p_classes.nprim) { 788 if (!tclass || tclass > policydb->p_classes.nprim) {
790 rc = -EINVAL; 789 rc = -EINVAL;
791 goto out; 790 goto out;
792 } 791 }
793 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 792 tclass_datum = policydb->class_val_to_struct[tclass - 1];
794 793
795 ocontext = sidtab_search(&sidtab, oldsid); 794 ocontext = sidtab_search(sidtab, oldsid);
796 if (!ocontext) { 795 if (!ocontext) {
797 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 796 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
798 __func__, oldsid); 797 __func__, oldsid);
@@ -800,7 +799,7 @@ static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
800 goto out; 799 goto out;
801 } 800 }
802 801
803 ncontext = sidtab_search(&sidtab, newsid); 802 ncontext = sidtab_search(sidtab, newsid);
804 if (!ncontext) { 803 if (!ncontext) {
805 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 804 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
806 __func__, newsid); 805 __func__, newsid);
@@ -808,7 +807,7 @@ static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
808 goto out; 807 goto out;
809 } 808 }
810 809
811 tcontext = sidtab_search(&sidtab, tasksid); 810 tcontext = sidtab_search(sidtab, tasksid);
812 if (!tcontext) { 811 if (!tcontext) {
813 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 812 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
814 __func__, tasksid); 813 __func__, tasksid);
@@ -818,12 +817,13 @@ static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
818 817
819 constraint = tclass_datum->validatetrans; 818 constraint = tclass_datum->validatetrans;
820 while (constraint) { 819 while (constraint) {
821 if (!constraint_expr_eval(ocontext, ncontext, tcontext, 820 if (!constraint_expr_eval(policydb, ocontext, ncontext,
822 constraint->expr)) { 821 tcontext, constraint->expr)) {
823 if (user) 822 if (user)
824 rc = -EPERM; 823 rc = -EPERM;
825 else 824 else
826 rc = security_validtrans_handle_fail(ocontext, 825 rc = security_validtrans_handle_fail(state,
826 ocontext,
827 ncontext, 827 ncontext,
828 tcontext, 828 tcontext,
829 tclass); 829 tclass);
@@ -833,22 +833,24 @@ static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
833 } 833 }
834 834
835out: 835out:
836 read_unlock(&policy_rwlock); 836 read_unlock(&state->ss->policy_rwlock);
837 return rc; 837 return rc;
838} 838}
839 839
840int security_validate_transition_user(u32 oldsid, u32 newsid, u32 tasksid, 840int security_validate_transition_user(struct selinux_state *state,
841 u16 tclass) 841 u32 oldsid, u32 newsid, u32 tasksid,
842 u16 tclass)
842{ 843{
843 return security_compute_validatetrans(oldsid, newsid, tasksid, 844 return security_compute_validatetrans(state, oldsid, newsid, tasksid,
844 tclass, true); 845 tclass, true);
845} 846}
846 847
847int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 848int security_validate_transition(struct selinux_state *state,
849 u32 oldsid, u32 newsid, u32 tasksid,
848 u16 orig_tclass) 850 u16 orig_tclass)
849{ 851{
850 return security_compute_validatetrans(oldsid, newsid, tasksid, 852 return security_compute_validatetrans(state, oldsid, newsid, tasksid,
851 orig_tclass, false); 853 orig_tclass, false);
852} 854}
853 855
854/* 856/*
@@ -860,20 +862,26 @@ int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
860 * @oldsid : current security identifier 862 * @oldsid : current security identifier
861 * @newsid : destinated security identifier 863 * @newsid : destinated security identifier
862 */ 864 */
863int security_bounded_transition(u32 old_sid, u32 new_sid) 865int security_bounded_transition(struct selinux_state *state,
866 u32 old_sid, u32 new_sid)
864{ 867{
868 struct policydb *policydb;
869 struct sidtab *sidtab;
865 struct context *old_context, *new_context; 870 struct context *old_context, *new_context;
866 struct type_datum *type; 871 struct type_datum *type;
867 int index; 872 int index;
868 int rc; 873 int rc;
869 874
870 if (!ss_initialized) 875 if (!state->initialized)
871 return 0; 876 return 0;
872 877
873 read_lock(&policy_rwlock); 878 read_lock(&state->ss->policy_rwlock);
879
880 policydb = &state->ss->policydb;
881 sidtab = &state->ss->sidtab;
874 882
875 rc = -EINVAL; 883 rc = -EINVAL;
876 old_context = sidtab_search(&sidtab, old_sid); 884 old_context = sidtab_search(sidtab, old_sid);
877 if (!old_context) { 885 if (!old_context) {
878 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 886 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
879 __func__, old_sid); 887 __func__, old_sid);
@@ -881,7 +889,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
881 } 889 }
882 890
883 rc = -EINVAL; 891 rc = -EINVAL;
884 new_context = sidtab_search(&sidtab, new_sid); 892 new_context = sidtab_search(sidtab, new_sid);
885 if (!new_context) { 893 if (!new_context) {
886 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 894 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
887 __func__, new_sid); 895 __func__, new_sid);
@@ -895,7 +903,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
895 903
896 index = new_context->type; 904 index = new_context->type;
897 while (true) { 905 while (true) {
898 type = flex_array_get_ptr(policydb.type_val_to_struct_array, 906 type = flex_array_get_ptr(policydb->type_val_to_struct_array,
899 index - 1); 907 index - 1);
900 BUG_ON(!type); 908 BUG_ON(!type);
901 909
@@ -917,9 +925,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
917 char *new_name = NULL; 925 char *new_name = NULL;
918 u32 length; 926 u32 length;
919 927
920 if (!context_struct_to_string(old_context, 928 if (!context_struct_to_string(policydb, old_context,
921 &old_name, &length) && 929 &old_name, &length) &&
922 !context_struct_to_string(new_context, 930 !context_struct_to_string(policydb, new_context,
923 &new_name, &length)) { 931 &new_name, &length)) {
924 audit_log(current->audit_context, 932 audit_log(current->audit_context,
925 GFP_ATOMIC, AUDIT_SELINUX_ERR, 933 GFP_ATOMIC, AUDIT_SELINUX_ERR,
@@ -932,17 +940,17 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
932 kfree(old_name); 940 kfree(old_name);
933 } 941 }
934out: 942out:
935 read_unlock(&policy_rwlock); 943 read_unlock(&state->ss->policy_rwlock);
936 944
937 return rc; 945 return rc;
938} 946}
939 947
940static void avd_init(struct av_decision *avd) 948static void avd_init(struct selinux_state *state, struct av_decision *avd)
941{ 949{
942 avd->allowed = 0; 950 avd->allowed = 0;
943 avd->auditallow = 0; 951 avd->auditallow = 0;
944 avd->auditdeny = 0xffffffff; 952 avd->auditdeny = 0xffffffff;
945 avd->seqno = latest_granting; 953 avd->seqno = state->ss->latest_granting;
946 avd->flags = 0; 954 avd->flags = 0;
947} 955}
948 956
@@ -1000,12 +1008,15 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
1000 } 1008 }
1001} 1009}
1002 1010
1003void security_compute_xperms_decision(u32 ssid, 1011void security_compute_xperms_decision(struct selinux_state *state,
1004 u32 tsid, 1012 u32 ssid,
1005 u16 orig_tclass, 1013 u32 tsid,
1006 u8 driver, 1014 u16 orig_tclass,
1007 struct extended_perms_decision *xpermd) 1015 u8 driver,
1016 struct extended_perms_decision *xpermd)
1008{ 1017{
1018 struct policydb *policydb;
1019 struct sidtab *sidtab;
1009 u16 tclass; 1020 u16 tclass;
1010 struct context *scontext, *tcontext; 1021 struct context *scontext, *tcontext;
1011 struct avtab_key avkey; 1022 struct avtab_key avkey;
@@ -1020,60 +1031,64 @@ void security_compute_xperms_decision(u32 ssid,
1020 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1031 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p));
1021 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1032 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p));
1022 1033
1023 read_lock(&policy_rwlock); 1034 read_lock(&state->ss->policy_rwlock);
1024 if (!ss_initialized) 1035 if (!state->initialized)
1025 goto allow; 1036 goto allow;
1026 1037
1027 scontext = sidtab_search(&sidtab, ssid); 1038 policydb = &state->ss->policydb;
1039 sidtab = &state->ss->sidtab;
1040
1041 scontext = sidtab_search(sidtab, ssid);
1028 if (!scontext) { 1042 if (!scontext) {
1029 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1043 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1030 __func__, ssid); 1044 __func__, ssid);
1031 goto out; 1045 goto out;
1032 } 1046 }
1033 1047
1034 tcontext = sidtab_search(&sidtab, tsid); 1048 tcontext = sidtab_search(sidtab, tsid);
1035 if (!tcontext) { 1049 if (!tcontext) {
1036 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1050 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1037 __func__, tsid); 1051 __func__, tsid);
1038 goto out; 1052 goto out;
1039 } 1053 }
1040 1054
1041 tclass = unmap_class(orig_tclass); 1055 tclass = unmap_class(&state->ss->map, orig_tclass);
1042 if (unlikely(orig_tclass && !tclass)) { 1056 if (unlikely(orig_tclass && !tclass)) {
1043 if (policydb.allow_unknown) 1057 if (policydb->allow_unknown)
1044 goto allow; 1058 goto allow;
1045 goto out; 1059 goto out;
1046 } 1060 }
1047 1061
1048 1062
1049 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 1063 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) {
1050 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1064 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass);
1051 goto out; 1065 goto out;
1052 } 1066 }
1053 1067
1054 avkey.target_class = tclass; 1068 avkey.target_class = tclass;
1055 avkey.specified = AVTAB_XPERMS; 1069 avkey.specified = AVTAB_XPERMS;
1056 sattr = flex_array_get(policydb.type_attr_map_array, 1070 sattr = flex_array_get(policydb->type_attr_map_array,
1057 scontext->type - 1); 1071 scontext->type - 1);
1058 BUG_ON(!sattr); 1072 BUG_ON(!sattr);
1059 tattr = flex_array_get(policydb.type_attr_map_array, 1073 tattr = flex_array_get(policydb->type_attr_map_array,
1060 tcontext->type - 1); 1074 tcontext->type - 1);
1061 BUG_ON(!tattr); 1075 BUG_ON(!tattr);
1062 ebitmap_for_each_positive_bit(sattr, snode, i) { 1076 ebitmap_for_each_positive_bit(sattr, snode, i) {
1063 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1077 ebitmap_for_each_positive_bit(tattr, tnode, j) {
1064 avkey.source_type = i + 1; 1078 avkey.source_type = i + 1;
1065 avkey.target_type = j + 1; 1079 avkey.target_type = j + 1;
1066 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 1080 for (node = avtab_search_node(&policydb->te_avtab,
1081 &avkey);
1067 node; 1082 node;
1068 node = avtab_search_node_next(node, avkey.specified)) 1083 node = avtab_search_node_next(node, avkey.specified))
1069 services_compute_xperms_decision(xpermd, node); 1084 services_compute_xperms_decision(xpermd, node);
1070 1085
1071 cond_compute_xperms(&policydb.te_cond_avtab, 1086 cond_compute_xperms(&policydb->te_cond_avtab,
1072 &avkey, xpermd); 1087 &avkey, xpermd);
1073 } 1088 }
1074 } 1089 }
1075out: 1090out:
1076 read_unlock(&policy_rwlock); 1091 read_unlock(&state->ss->policy_rwlock);
1077 return; 1092 return;
1078allow: 1093allow:
1079 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1094 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p));
@@ -1091,22 +1106,28 @@ allow:
1091 * Compute a set of access vector decisions based on the 1106 * Compute a set of access vector decisions based on the
1092 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1107 * SID pair (@ssid, @tsid) for the permissions in @tclass.
1093 */ 1108 */
1094void security_compute_av(u32 ssid, 1109void security_compute_av(struct selinux_state *state,
1110 u32 ssid,
1095 u32 tsid, 1111 u32 tsid,
1096 u16 orig_tclass, 1112 u16 orig_tclass,
1097 struct av_decision *avd, 1113 struct av_decision *avd,
1098 struct extended_perms *xperms) 1114 struct extended_perms *xperms)
1099{ 1115{
1116 struct policydb *policydb;
1117 struct sidtab *sidtab;
1100 u16 tclass; 1118 u16 tclass;
1101 struct context *scontext = NULL, *tcontext = NULL; 1119 struct context *scontext = NULL, *tcontext = NULL;
1102 1120
1103 read_lock(&policy_rwlock); 1121 read_lock(&state->ss->policy_rwlock);
1104 avd_init(avd); 1122 avd_init(state, avd);
1105 xperms->len = 0; 1123 xperms->len = 0;
1106 if (!ss_initialized) 1124 if (!state->initialized)
1107 goto allow; 1125 goto allow;
1108 1126
1109 scontext = sidtab_search(&sidtab, ssid); 1127 policydb = &state->ss->policydb;
1128 sidtab = &state->ss->sidtab;
1129
1130 scontext = sidtab_search(sidtab, ssid);
1110 if (!scontext) { 1131 if (!scontext) {
1111 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1132 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1112 __func__, ssid); 1133 __func__, ssid);
@@ -1114,45 +1135,53 @@ void security_compute_av(u32 ssid,
1114 } 1135 }
1115 1136
1116 /* permissive domain? */ 1137 /* permissive domain? */
1117 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1138 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type))
1118 avd->flags |= AVD_FLAGS_PERMISSIVE; 1139 avd->flags |= AVD_FLAGS_PERMISSIVE;
1119 1140
1120 tcontext = sidtab_search(&sidtab, tsid); 1141 tcontext = sidtab_search(sidtab, tsid);
1121 if (!tcontext) { 1142 if (!tcontext) {
1122 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1143 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1123 __func__, tsid); 1144 __func__, tsid);
1124 goto out; 1145 goto out;
1125 } 1146 }
1126 1147
1127 tclass = unmap_class(orig_tclass); 1148 tclass = unmap_class(&state->ss->map, orig_tclass);
1128 if (unlikely(orig_tclass && !tclass)) { 1149 if (unlikely(orig_tclass && !tclass)) {
1129 if (policydb.allow_unknown) 1150 if (policydb->allow_unknown)
1130 goto allow; 1151 goto allow;
1131 goto out; 1152 goto out;
1132 } 1153 }
1133 context_struct_compute_av(scontext, tcontext, tclass, avd, xperms); 1154 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd,
1134 map_decision(orig_tclass, avd, policydb.allow_unknown); 1155 xperms);
1156 map_decision(&state->ss->map, orig_tclass, avd,
1157 policydb->allow_unknown);
1135out: 1158out:
1136 read_unlock(&policy_rwlock); 1159 read_unlock(&state->ss->policy_rwlock);
1137 return; 1160 return;
1138allow: 1161allow:
1139 avd->allowed = 0xffffffff; 1162 avd->allowed = 0xffffffff;
1140 goto out; 1163 goto out;
1141} 1164}
1142 1165
1143void security_compute_av_user(u32 ssid, 1166void security_compute_av_user(struct selinux_state *state,
1167 u32 ssid,
1144 u32 tsid, 1168 u32 tsid,
1145 u16 tclass, 1169 u16 tclass,
1146 struct av_decision *avd) 1170 struct av_decision *avd)
1147{ 1171{
1172 struct policydb *policydb;
1173 struct sidtab *sidtab;
1148 struct context *scontext = NULL, *tcontext = NULL; 1174 struct context *scontext = NULL, *tcontext = NULL;
1149 1175
1150 read_lock(&policy_rwlock); 1176 read_lock(&state->ss->policy_rwlock);
1151 avd_init(avd); 1177 avd_init(state, avd);
1152 if (!ss_initialized) 1178 if (!state->initialized)
1153 goto allow; 1179 goto allow;
1154 1180
1155 scontext = sidtab_search(&sidtab, ssid); 1181 policydb = &state->ss->policydb;
1182 sidtab = &state->ss->sidtab;
1183
1184 scontext = sidtab_search(sidtab, ssid);
1156 if (!scontext) { 1185 if (!scontext) {
1157 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1186 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1158 __func__, ssid); 1187 __func__, ssid);
@@ -1160,10 +1189,10 @@ void security_compute_av_user(u32 ssid,
1160 } 1189 }
1161 1190
1162 /* permissive domain? */ 1191 /* permissive domain? */
1163 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1192 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type))
1164 avd->flags |= AVD_FLAGS_PERMISSIVE; 1193 avd->flags |= AVD_FLAGS_PERMISSIVE;
1165 1194
1166 tcontext = sidtab_search(&sidtab, tsid); 1195 tcontext = sidtab_search(sidtab, tsid);
1167 if (!tcontext) { 1196 if (!tcontext) {
1168 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1197 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1169 __func__, tsid); 1198 __func__, tsid);
@@ -1171,14 +1200,15 @@ void security_compute_av_user(u32 ssid,
1171 } 1200 }
1172 1201
1173 if (unlikely(!tclass)) { 1202 if (unlikely(!tclass)) {
1174 if (policydb.allow_unknown) 1203 if (policydb->allow_unknown)
1175 goto allow; 1204 goto allow;
1176 goto out; 1205 goto out;
1177 } 1206 }
1178 1207
1179 context_struct_compute_av(scontext, tcontext, tclass, avd, NULL); 1208 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd,
1209 NULL);
1180 out: 1210 out:
1181 read_unlock(&policy_rwlock); 1211 read_unlock(&state->ss->policy_rwlock);
1182 return; 1212 return;
1183allow: 1213allow:
1184 avd->allowed = 0xffffffff; 1214 avd->allowed = 0xffffffff;
@@ -1192,7 +1222,9 @@ allow:
1192 * to point to this string and set `*scontext_len' to 1222 * to point to this string and set `*scontext_len' to
1193 * the length of the string. 1223 * the length of the string.
1194 */ 1224 */
1195static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len) 1225static int context_struct_to_string(struct policydb *p,
1226 struct context *context,
1227 char **scontext, u32 *scontext_len)
1196{ 1228{
1197 char *scontextp; 1229 char *scontextp;
1198 1230
@@ -1211,10 +1243,10 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
1211 } 1243 }
1212 1244
1213 /* Compute the size of the context. */ 1245 /* Compute the size of the context. */
1214 *scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1; 1246 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1;
1215 *scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1; 1247 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1;
1216 *scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1; 1248 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1;
1217 *scontext_len += mls_compute_context_len(context); 1249 *scontext_len += mls_compute_context_len(p, context);
1218 1250
1219 if (!scontext) 1251 if (!scontext)
1220 return 0; 1252 return 0;
@@ -1229,11 +1261,11 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
1229 * Copy the user name, role name and type name into the context. 1261 * Copy the user name, role name and type name into the context.
1230 */ 1262 */
1231 scontextp += sprintf(scontextp, "%s:%s:%s", 1263 scontextp += sprintf(scontextp, "%s:%s:%s",
1232 sym_name(&policydb, SYM_USERS, context->user - 1), 1264 sym_name(p, SYM_USERS, context->user - 1),
1233 sym_name(&policydb, SYM_ROLES, context->role - 1), 1265 sym_name(p, SYM_ROLES, context->role - 1),
1234 sym_name(&policydb, SYM_TYPES, context->type - 1)); 1266 sym_name(p, SYM_TYPES, context->type - 1));
1235 1267
1236 mls_sid_to_context(context, &scontextp); 1268 mls_sid_to_context(p, context, &scontextp);
1237 1269
1238 *scontextp = 0; 1270 *scontextp = 0;
1239 1271
@@ -1249,9 +1281,12 @@ const char *security_get_initial_sid_context(u32 sid)
1249 return initial_sid_to_string[sid]; 1281 return initial_sid_to_string[sid];
1250} 1282}
1251 1283
1252static int security_sid_to_context_core(u32 sid, char **scontext, 1284static int security_sid_to_context_core(struct selinux_state *state,
1285 u32 sid, char **scontext,
1253 u32 *scontext_len, int force) 1286 u32 *scontext_len, int force)
1254{ 1287{
1288 struct policydb *policydb;
1289 struct sidtab *sidtab;
1255 struct context *context; 1290 struct context *context;
1256 int rc = 0; 1291 int rc = 0;
1257 1292
@@ -1259,7 +1294,7 @@ static int security_sid_to_context_core(u32 sid, char **scontext,
1259 *scontext = NULL; 1294 *scontext = NULL;
1260 *scontext_len = 0; 1295 *scontext_len = 0;
1261 1296
1262 if (!ss_initialized) { 1297 if (!state->initialized) {
1263 if (sid <= SECINITSID_NUM) { 1298 if (sid <= SECINITSID_NUM) {
1264 char *scontextp; 1299 char *scontextp;
1265 1300
@@ -1280,20 +1315,23 @@ static int security_sid_to_context_core(u32 sid, char **scontext,
1280 rc = -EINVAL; 1315 rc = -EINVAL;
1281 goto out; 1316 goto out;
1282 } 1317 }
1283 read_lock(&policy_rwlock); 1318 read_lock(&state->ss->policy_rwlock);
1319 policydb = &state->ss->policydb;
1320 sidtab = &state->ss->sidtab;
1284 if (force) 1321 if (force)
1285 context = sidtab_search_force(&sidtab, sid); 1322 context = sidtab_search_force(sidtab, sid);
1286 else 1323 else
1287 context = sidtab_search(&sidtab, sid); 1324 context = sidtab_search(sidtab, sid);
1288 if (!context) { 1325 if (!context) {
1289 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1326 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1290 __func__, sid); 1327 __func__, sid);
1291 rc = -EINVAL; 1328 rc = -EINVAL;
1292 goto out_unlock; 1329 goto out_unlock;
1293 } 1330 }
1294 rc = context_struct_to_string(context, scontext, scontext_len); 1331 rc = context_struct_to_string(policydb, context, scontext,
1332 scontext_len);
1295out_unlock: 1333out_unlock:
1296 read_unlock(&policy_rwlock); 1334 read_unlock(&state->ss->policy_rwlock);
1297out: 1335out:
1298 return rc; 1336 return rc;
1299 1337
@@ -1309,14 +1347,18 @@ out:
1309 * into a dynamically allocated string of the correct size. Set @scontext 1347 * into a dynamically allocated string of the correct size. Set @scontext
1310 * to point to this string and set @scontext_len to the length of the string. 1348 * to point to this string and set @scontext_len to the length of the string.
1311 */ 1349 */
1312int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len) 1350int security_sid_to_context(struct selinux_state *state,
1351 u32 sid, char **scontext, u32 *scontext_len)
1313{ 1352{
1314 return security_sid_to_context_core(sid, scontext, scontext_len, 0); 1353 return security_sid_to_context_core(state, sid, scontext,
1354 scontext_len, 0);
1315} 1355}
1316 1356
1317int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len) 1357int security_sid_to_context_force(struct selinux_state *state, u32 sid,
1358 char **scontext, u32 *scontext_len)
1318{ 1359{
1319 return security_sid_to_context_core(sid, scontext, scontext_len, 1); 1360 return security_sid_to_context_core(state, sid, scontext,
1361 scontext_len, 1);
1320} 1362}
1321 1363
1322/* 1364/*
@@ -1404,10 +1446,13 @@ out:
1404 return rc; 1446 return rc;
1405} 1447}
1406 1448
1407static int security_context_to_sid_core(const char *scontext, u32 scontext_len, 1449static int security_context_to_sid_core(struct selinux_state *state,
1450 const char *scontext, u32 scontext_len,
1408 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1451 u32 *sid, u32 def_sid, gfp_t gfp_flags,
1409 int force) 1452 int force)
1410{ 1453{
1454 struct policydb *policydb;
1455 struct sidtab *sidtab;
1411 char *scontext2, *str = NULL; 1456 char *scontext2, *str = NULL;
1412 struct context context; 1457 struct context context;
1413 int rc = 0; 1458 int rc = 0;
@@ -1421,7 +1466,7 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
1421 if (!scontext2) 1466 if (!scontext2)
1422 return -ENOMEM; 1467 return -ENOMEM;
1423 1468
1424 if (!ss_initialized) { 1469 if (!state->initialized) {
1425 int i; 1470 int i;
1426 1471
1427 for (i = 1; i < SECINITSID_NUM; i++) { 1472 for (i = 1; i < SECINITSID_NUM; i++) {
@@ -1442,9 +1487,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
1442 if (!str) 1487 if (!str)
1443 goto out; 1488 goto out;
1444 } 1489 }
1445 1490 read_lock(&state->ss->policy_rwlock);
1446 read_lock(&policy_rwlock); 1491 policydb = &state->ss->policydb;
1447 rc = string_to_context_struct(&policydb, &sidtab, scontext2, 1492 sidtab = &state->ss->sidtab;
1493 rc = string_to_context_struct(policydb, sidtab, scontext2,
1448 scontext_len, &context, def_sid); 1494 scontext_len, &context, def_sid);
1449 if (rc == -EINVAL && force) { 1495 if (rc == -EINVAL && force) {
1450 context.str = str; 1496 context.str = str;
@@ -1452,10 +1498,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
1452 str = NULL; 1498 str = NULL;
1453 } else if (rc) 1499 } else if (rc)
1454 goto out_unlock; 1500 goto out_unlock;
1455 rc = sidtab_context_to_sid(&sidtab, &context, sid); 1501 rc = sidtab_context_to_sid(sidtab, &context, sid);
1456 context_destroy(&context); 1502 context_destroy(&context);
1457out_unlock: 1503out_unlock:
1458 read_unlock(&policy_rwlock); 1504 read_unlock(&state->ss->policy_rwlock);
1459out: 1505out:
1460 kfree(scontext2); 1506 kfree(scontext2);
1461 kfree(str); 1507 kfree(str);
@@ -1474,16 +1520,19 @@ out:
1474 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1520 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1475 * memory is available, or 0 on success. 1521 * memory is available, or 0 on success.
1476 */ 1522 */
1477int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid, 1523int security_context_to_sid(struct selinux_state *state,
1524 const char *scontext, u32 scontext_len, u32 *sid,
1478 gfp_t gfp) 1525 gfp_t gfp)
1479{ 1526{
1480 return security_context_to_sid_core(scontext, scontext_len, 1527 return security_context_to_sid_core(state, scontext, scontext_len,
1481 sid, SECSID_NULL, gfp, 0); 1528 sid, SECSID_NULL, gfp, 0);
1482} 1529}
1483 1530
1484int security_context_str_to_sid(const char *scontext, u32 *sid, gfp_t gfp) 1531int security_context_str_to_sid(struct selinux_state *state,
1532 const char *scontext, u32 *sid, gfp_t gfp)
1485{ 1533{
1486 return security_context_to_sid(scontext, strlen(scontext), sid, gfp); 1534 return security_context_to_sid(state, scontext, strlen(scontext),
1535 sid, gfp);
1487} 1536}
1488 1537
1489/** 1538/**
@@ -1504,51 +1553,56 @@ int security_context_str_to_sid(const char *scontext, u32 *sid, gfp_t gfp)
1504 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1553 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1505 * memory is available, or 0 on success. 1554 * memory is available, or 0 on success.
1506 */ 1555 */
1507int security_context_to_sid_default(const char *scontext, u32 scontext_len, 1556int security_context_to_sid_default(struct selinux_state *state,
1557 const char *scontext, u32 scontext_len,
1508 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1558 u32 *sid, u32 def_sid, gfp_t gfp_flags)
1509{ 1559{
1510 return security_context_to_sid_core(scontext, scontext_len, 1560 return security_context_to_sid_core(state, scontext, scontext_len,
1511 sid, def_sid, gfp_flags, 1); 1561 sid, def_sid, gfp_flags, 1);
1512} 1562}
1513 1563
1514int security_context_to_sid_force(const char *scontext, u32 scontext_len, 1564int security_context_to_sid_force(struct selinux_state *state,
1565 const char *scontext, u32 scontext_len,
1515 u32 *sid) 1566 u32 *sid)
1516{ 1567{
1517 return security_context_to_sid_core(scontext, scontext_len, 1568 return security_context_to_sid_core(state, scontext, scontext_len,
1518 sid, SECSID_NULL, GFP_KERNEL, 1); 1569 sid, SECSID_NULL, GFP_KERNEL, 1);
1519} 1570}
1520 1571
1521static int compute_sid_handle_invalid_context( 1572static int compute_sid_handle_invalid_context(
1573 struct selinux_state *state,
1522 struct context *scontext, 1574 struct context *scontext,
1523 struct context *tcontext, 1575 struct context *tcontext,
1524 u16 tclass, 1576 u16 tclass,
1525 struct context *newcontext) 1577 struct context *newcontext)
1526{ 1578{
1579 struct policydb *policydb = &state->ss->policydb;
1527 char *s = NULL, *t = NULL, *n = NULL; 1580 char *s = NULL, *t = NULL, *n = NULL;
1528 u32 slen, tlen, nlen; 1581 u32 slen, tlen, nlen;
1529 1582
1530 if (context_struct_to_string(scontext, &s, &slen)) 1583 if (context_struct_to_string(policydb, scontext, &s, &slen))
1531 goto out; 1584 goto out;
1532 if (context_struct_to_string(tcontext, &t, &tlen)) 1585 if (context_struct_to_string(policydb, tcontext, &t, &tlen))
1533 goto out; 1586 goto out;
1534 if (context_struct_to_string(newcontext, &n, &nlen)) 1587 if (context_struct_to_string(policydb, newcontext, &n, &nlen))
1535 goto out; 1588 goto out;
1536 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1589 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
1537 "op=security_compute_sid invalid_context=%s" 1590 "op=security_compute_sid invalid_context=%s"
1538 " scontext=%s" 1591 " scontext=%s"
1539 " tcontext=%s" 1592 " tcontext=%s"
1540 " tclass=%s", 1593 " tclass=%s",
1541 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 1594 n, s, t, sym_name(policydb, SYM_CLASSES, tclass-1));
1542out: 1595out:
1543 kfree(s); 1596 kfree(s);
1544 kfree(t); 1597 kfree(t);
1545 kfree(n); 1598 kfree(n);
1546 if (!selinux_enforcing) 1599 if (!is_enforcing(state))
1547 return 0; 1600 return 0;
1548 return -EACCES; 1601 return -EACCES;
1549} 1602}
1550 1603
1551static void filename_compute_type(struct policydb *p, struct context *newcontext, 1604static void filename_compute_type(struct policydb *policydb,
1605 struct context *newcontext,
1552 u32 stype, u32 ttype, u16 tclass, 1606 u32 stype, u32 ttype, u16 tclass,
1553 const char *objname) 1607 const char *objname)
1554{ 1608{
@@ -1560,7 +1614,7 @@ static void filename_compute_type(struct policydb *p, struct context *newcontext
1560 * like /dev or /var/run. This bitmap will quickly skip rule searches 1614 * like /dev or /var/run. This bitmap will quickly skip rule searches
1561 * if the ttype does not contain any rules. 1615 * if the ttype does not contain any rules.
1562 */ 1616 */
1563 if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype)) 1617 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype))
1564 return; 1618 return;
1565 1619
1566 ft.stype = stype; 1620 ft.stype = stype;
@@ -1568,12 +1622,13 @@ static void filename_compute_type(struct policydb *p, struct context *newcontext
1568 ft.tclass = tclass; 1622 ft.tclass = tclass;
1569 ft.name = objname; 1623 ft.name = objname;
1570 1624
1571 otype = hashtab_search(p->filename_trans, &ft); 1625 otype = hashtab_search(policydb->filename_trans, &ft);
1572 if (otype) 1626 if (otype)
1573 newcontext->type = otype->otype; 1627 newcontext->type = otype->otype;
1574} 1628}
1575 1629
1576static int security_compute_sid(u32 ssid, 1630static int security_compute_sid(struct selinux_state *state,
1631 u32 ssid,
1577 u32 tsid, 1632 u32 tsid,
1578 u16 orig_tclass, 1633 u16 orig_tclass,
1579 u32 specified, 1634 u32 specified,
@@ -1581,6 +1636,8 @@ static int security_compute_sid(u32 ssid,
1581 u32 *out_sid, 1636 u32 *out_sid,
1582 bool kern) 1637 bool kern)
1583{ 1638{
1639 struct policydb *policydb;
1640 struct sidtab *sidtab;
1584 struct class_datum *cladatum = NULL; 1641 struct class_datum *cladatum = NULL;
1585 struct context *scontext = NULL, *tcontext = NULL, newcontext; 1642 struct context *scontext = NULL, *tcontext = NULL, newcontext;
1586 struct role_trans *roletr = NULL; 1643 struct role_trans *roletr = NULL;
@@ -1591,7 +1648,7 @@ static int security_compute_sid(u32 ssid,
1591 int rc = 0; 1648 int rc = 0;
1592 bool sock; 1649 bool sock;
1593 1650
1594 if (!ss_initialized) { 1651 if (!state->initialized) {
1595 switch (orig_tclass) { 1652 switch (orig_tclass) {
1596 case SECCLASS_PROCESS: /* kernel value */ 1653 case SECCLASS_PROCESS: /* kernel value */
1597 *out_sid = ssid; 1654 *out_sid = ssid;
@@ -1605,24 +1662,28 @@ static int security_compute_sid(u32 ssid,
1605 1662
1606 context_init(&newcontext); 1663 context_init(&newcontext);
1607 1664
1608 read_lock(&policy_rwlock); 1665 read_lock(&state->ss->policy_rwlock);
1609 1666
1610 if (kern) { 1667 if (kern) {
1611 tclass = unmap_class(orig_tclass); 1668 tclass = unmap_class(&state->ss->map, orig_tclass);
1612 sock = security_is_socket_class(orig_tclass); 1669 sock = security_is_socket_class(orig_tclass);
1613 } else { 1670 } else {
1614 tclass = orig_tclass; 1671 tclass = orig_tclass;
1615 sock = security_is_socket_class(map_class(tclass)); 1672 sock = security_is_socket_class(map_class(&state->ss->map,
1673 tclass));
1616 } 1674 }
1617 1675
1618 scontext = sidtab_search(&sidtab, ssid); 1676 policydb = &state->ss->policydb;
1677 sidtab = &state->ss->sidtab;
1678
1679 scontext = sidtab_search(sidtab, ssid);
1619 if (!scontext) { 1680 if (!scontext) {
1620 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1681 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1621 __func__, ssid); 1682 __func__, ssid);
1622 rc = -EINVAL; 1683 rc = -EINVAL;
1623 goto out_unlock; 1684 goto out_unlock;
1624 } 1685 }
1625 tcontext = sidtab_search(&sidtab, tsid); 1686 tcontext = sidtab_search(sidtab, tsid);
1626 if (!tcontext) { 1687 if (!tcontext) {
1627 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1688 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
1628 __func__, tsid); 1689 __func__, tsid);
@@ -1630,8 +1691,8 @@ static int security_compute_sid(u32 ssid,
1630 goto out_unlock; 1691 goto out_unlock;
1631 } 1692 }
1632 1693
1633 if (tclass && tclass <= policydb.p_classes.nprim) 1694 if (tclass && tclass <= policydb->p_classes.nprim)
1634 cladatum = policydb.class_val_to_struct[tclass - 1]; 1695 cladatum = policydb->class_val_to_struct[tclass - 1];
1635 1696
1636 /* Set the user identity. */ 1697 /* Set the user identity. */
1637 switch (specified) { 1698 switch (specified) {
@@ -1657,7 +1718,7 @@ static int security_compute_sid(u32 ssid,
1657 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1718 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {
1658 newcontext.role = tcontext->role; 1719 newcontext.role = tcontext->role;
1659 } else { 1720 } else {
1660 if ((tclass == policydb.process_class) || (sock == true)) 1721 if ((tclass == policydb->process_class) || (sock == true))
1661 newcontext.role = scontext->role; 1722 newcontext.role = scontext->role;
1662 else 1723 else
1663 newcontext.role = OBJECT_R_VAL; 1724 newcontext.role = OBJECT_R_VAL;
@@ -1669,7 +1730,7 @@ static int security_compute_sid(u32 ssid,
1669 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1730 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) {
1670 newcontext.type = tcontext->type; 1731 newcontext.type = tcontext->type;
1671 } else { 1732 } else {
1672 if ((tclass == policydb.process_class) || (sock == true)) { 1733 if ((tclass == policydb->process_class) || (sock == true)) {
1673 /* Use the type of process. */ 1734 /* Use the type of process. */
1674 newcontext.type = scontext->type; 1735 newcontext.type = scontext->type;
1675 } else { 1736 } else {
@@ -1683,11 +1744,11 @@ static int security_compute_sid(u32 ssid,
1683 avkey.target_type = tcontext->type; 1744 avkey.target_type = tcontext->type;
1684 avkey.target_class = tclass; 1745 avkey.target_class = tclass;
1685 avkey.specified = specified; 1746 avkey.specified = specified;
1686 avdatum = avtab_search(&policydb.te_avtab, &avkey); 1747 avdatum = avtab_search(&policydb->te_avtab, &avkey);
1687 1748
1688 /* If no permanent rule, also check for enabled conditional rules */ 1749 /* If no permanent rule, also check for enabled conditional rules */
1689 if (!avdatum) { 1750 if (!avdatum) {
1690 node = avtab_search_node(&policydb.te_cond_avtab, &avkey); 1751 node = avtab_search_node(&policydb->te_cond_avtab, &avkey);
1691 for (; node; node = avtab_search_node_next(node, specified)) { 1752 for (; node; node = avtab_search_node_next(node, specified)) {
1692 if (node->key.specified & AVTAB_ENABLED) { 1753 if (node->key.specified & AVTAB_ENABLED) {
1693 avdatum = &node->datum; 1754 avdatum = &node->datum;
@@ -1703,13 +1764,14 @@ static int security_compute_sid(u32 ssid,
1703 1764
1704 /* if we have a objname this is a file trans check so check those rules */ 1765 /* if we have a objname this is a file trans check so check those rules */
1705 if (objname) 1766 if (objname)
1706 filename_compute_type(&policydb, &newcontext, scontext->type, 1767 filename_compute_type(policydb, &newcontext, scontext->type,
1707 tcontext->type, tclass, objname); 1768 tcontext->type, tclass, objname);
1708 1769
1709 /* Check for class-specific changes. */ 1770 /* Check for class-specific changes. */
1710 if (specified & AVTAB_TRANSITION) { 1771 if (specified & AVTAB_TRANSITION) {
1711 /* Look for a role transition rule. */ 1772 /* Look for a role transition rule. */
1712 for (roletr = policydb.role_tr; roletr; roletr = roletr->next) { 1773 for (roletr = policydb->role_tr; roletr;
1774 roletr = roletr->next) {
1713 if ((roletr->role == scontext->role) && 1775 if ((roletr->role == scontext->role) &&
1714 (roletr->type == tcontext->type) && 1776 (roletr->type == tcontext->type) &&
1715 (roletr->tclass == tclass)) { 1777 (roletr->tclass == tclass)) {
@@ -1722,14 +1784,14 @@ static int security_compute_sid(u32 ssid,
1722 1784
1723 /* Set the MLS attributes. 1785 /* Set the MLS attributes.
1724 This is done last because it may allocate memory. */ 1786 This is done last because it may allocate memory. */
1725 rc = mls_compute_sid(scontext, tcontext, tclass, specified, 1787 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified,
1726 &newcontext, sock); 1788 &newcontext, sock);
1727 if (rc) 1789 if (rc)
1728 goto out_unlock; 1790 goto out_unlock;
1729 1791
1730 /* Check the validity of the context. */ 1792 /* Check the validity of the context. */
1731 if (!policydb_context_isvalid(&policydb, &newcontext)) { 1793 if (!policydb_context_isvalid(policydb, &newcontext)) {
1732 rc = compute_sid_handle_invalid_context(scontext, 1794 rc = compute_sid_handle_invalid_context(state, scontext,
1733 tcontext, 1795 tcontext,
1734 tclass, 1796 tclass,
1735 &newcontext); 1797 &newcontext);
@@ -1737,9 +1799,9 @@ static int security_compute_sid(u32 ssid,
1737 goto out_unlock; 1799 goto out_unlock;
1738 } 1800 }
1739 /* Obtain the sid for the context. */ 1801 /* Obtain the sid for the context. */
1740 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid); 1802 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid);
1741out_unlock: 1803out_unlock:
1742 read_unlock(&policy_rwlock); 1804 read_unlock(&state->ss->policy_rwlock);
1743 context_destroy(&newcontext); 1805 context_destroy(&newcontext);
1744out: 1806out:
1745 return rc; 1807 return rc;
@@ -1758,17 +1820,21 @@ out:
1758 * if insufficient memory is available, or %0 if the new SID was 1820 * if insufficient memory is available, or %0 if the new SID was
1759 * computed successfully. 1821 * computed successfully.
1760 */ 1822 */
1761int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, 1823int security_transition_sid(struct selinux_state *state,
1824 u32 ssid, u32 tsid, u16 tclass,
1762 const struct qstr *qstr, u32 *out_sid) 1825 const struct qstr *qstr, u32 *out_sid)
1763{ 1826{
1764 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1827 return security_compute_sid(state, ssid, tsid, tclass,
1828 AVTAB_TRANSITION,
1765 qstr ? qstr->name : NULL, out_sid, true); 1829 qstr ? qstr->name : NULL, out_sid, true);
1766} 1830}
1767 1831
1768int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, 1832int security_transition_sid_user(struct selinux_state *state,
1833 u32 ssid, u32 tsid, u16 tclass,
1769 const char *objname, u32 *out_sid) 1834 const char *objname, u32 *out_sid)
1770{ 1835{
1771 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1836 return security_compute_sid(state, ssid, tsid, tclass,
1837 AVTAB_TRANSITION,
1772 objname, out_sid, false); 1838 objname, out_sid, false);
1773} 1839}
1774 1840
@@ -1785,12 +1851,14 @@ int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
1785 * if insufficient memory is available, or %0 if the SID was 1851 * if insufficient memory is available, or %0 if the SID was
1786 * computed successfully. 1852 * computed successfully.
1787 */ 1853 */
1788int security_member_sid(u32 ssid, 1854int security_member_sid(struct selinux_state *state,
1855 u32 ssid,
1789 u32 tsid, 1856 u32 tsid,
1790 u16 tclass, 1857 u16 tclass,
1791 u32 *out_sid) 1858 u32 *out_sid)
1792{ 1859{
1793 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL, 1860 return security_compute_sid(state, ssid, tsid, tclass,
1861 AVTAB_MEMBER, NULL,
1794 out_sid, false); 1862 out_sid, false);
1795} 1863}
1796 1864
@@ -1807,12 +1875,14 @@ int security_member_sid(u32 ssid,
1807 * if insufficient memory is available, or %0 if the SID was 1875 * if insufficient memory is available, or %0 if the SID was
1808 * computed successfully. 1876 * computed successfully.
1809 */ 1877 */
1810int security_change_sid(u32 ssid, 1878int security_change_sid(struct selinux_state *state,
1879 u32 ssid,
1811 u32 tsid, 1880 u32 tsid,
1812 u16 tclass, 1881 u16 tclass,
1813 u32 *out_sid) 1882 u32 *out_sid)
1814{ 1883{
1815 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1884 return security_compute_sid(state,
1885 ssid, tsid, tclass, AVTAB_CHANGE, NULL,
1816 out_sid, false); 1886 out_sid, false);
1817} 1887}
1818 1888
@@ -1829,15 +1899,18 @@ static int clone_sid(u32 sid,
1829 return 0; 1899 return 0;
1830} 1900}
1831 1901
1832static inline int convert_context_handle_invalid_context(struct context *context) 1902static inline int convert_context_handle_invalid_context(
1903 struct selinux_state *state,
1904 struct context *context)
1833{ 1905{
1906 struct policydb *policydb = &state->ss->policydb;
1834 char *s; 1907 char *s;
1835 u32 len; 1908 u32 len;
1836 1909
1837 if (selinux_enforcing) 1910 if (is_enforcing(state))
1838 return -EINVAL; 1911 return -EINVAL;
1839 1912
1840 if (!context_struct_to_string(context, &s, &len)) { 1913 if (!context_struct_to_string(policydb, context, &s, &len)) {
1841 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s); 1914 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s);
1842 kfree(s); 1915 kfree(s);
1843 } 1916 }
@@ -1845,6 +1918,7 @@ static inline int convert_context_handle_invalid_context(struct context *context
1845} 1918}
1846 1919
1847struct convert_context_args { 1920struct convert_context_args {
1921 struct selinux_state *state;
1848 struct policydb *oldp; 1922 struct policydb *oldp;
1849 struct policydb *newp; 1923 struct policydb *newp;
1850}; 1924};
@@ -1971,7 +2045,8 @@ static int convert_context(u32 key,
1971 2045
1972 /* Check the validity of the new context. */ 2046 /* Check the validity of the new context. */
1973 if (!policydb_context_isvalid(args->newp, c)) { 2047 if (!policydb_context_isvalid(args->newp, c)) {
1974 rc = convert_context_handle_invalid_context(&oldc); 2048 rc = convert_context_handle_invalid_context(args->state,
2049 &oldc);
1975 if (rc) 2050 if (rc)
1976 goto bad; 2051 goto bad;
1977 } 2052 }
@@ -1983,7 +2058,7 @@ out:
1983 return rc; 2058 return rc;
1984bad: 2059bad:
1985 /* Map old representation to string and save it. */ 2060 /* Map old representation to string and save it. */
1986 rc = context_struct_to_string(&oldc, &s, &len); 2061 rc = context_struct_to_string(args->oldp, &oldc, &s, &len);
1987 if (rc) 2062 if (rc)
1988 return rc; 2063 return rc;
1989 context_destroy(&oldc); 2064 context_destroy(&oldc);
@@ -1996,39 +2071,29 @@ bad:
1996 goto out; 2071 goto out;
1997} 2072}
1998 2073
1999static void security_load_policycaps(void) 2074static void security_load_policycaps(struct selinux_state *state)
2000{ 2075{
2076 struct policydb *p = &state->ss->policydb;
2001 unsigned int i; 2077 unsigned int i;
2002 struct ebitmap_node *node; 2078 struct ebitmap_node *node;
2003 2079
2004 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, 2080 for (i = 0; i < ARRAY_SIZE(state->policycap); i++)
2005 POLICYDB_CAPABILITY_NETPEER); 2081 state->policycap[i] = ebitmap_get_bit(&p->policycaps, i);
2006 selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
2007 POLICYDB_CAPABILITY_OPENPERM);
2008 selinux_policycap_extsockclass = ebitmap_get_bit(&policydb.policycaps,
2009 POLICYDB_CAPABILITY_EXTSOCKCLASS);
2010 selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,
2011 POLICYDB_CAPABILITY_ALWAYSNETWORK);
2012 selinux_policycap_cgroupseclabel =
2013 ebitmap_get_bit(&policydb.policycaps,
2014 POLICYDB_CAPABILITY_CGROUPSECLABEL);
2015 selinux_policycap_nnp_nosuid_transition =
2016 ebitmap_get_bit(&policydb.policycaps,
2017 POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION);
2018 2082
2019 for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) 2083 for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++)
2020 pr_info("SELinux: policy capability %s=%d\n", 2084 pr_info("SELinux: policy capability %s=%d\n",
2021 selinux_policycap_names[i], 2085 selinux_policycap_names[i],
2022 ebitmap_get_bit(&policydb.policycaps, i)); 2086 ebitmap_get_bit(&p->policycaps, i));
2023 2087
2024 ebitmap_for_each_positive_bit(&policydb.policycaps, node, i) { 2088 ebitmap_for_each_positive_bit(&p->policycaps, node, i) {
2025 if (i >= ARRAY_SIZE(selinux_policycap_names)) 2089 if (i >= ARRAY_SIZE(selinux_policycap_names))
2026 pr_info("SELinux: unknown policy capability %u\n", 2090 pr_info("SELinux: unknown policy capability %u\n",
2027 i); 2091 i);
2028 } 2092 }
2029} 2093}
2030 2094
2031static int security_preserve_bools(struct policydb *p); 2095static int security_preserve_bools(struct selinux_state *state,
2096 struct policydb *newpolicydb);
2032 2097
2033/** 2098/**
2034 * security_load_policy - Load a security policy configuration. 2099 * security_load_policy - Load a security policy configuration.
@@ -2040,14 +2105,16 @@ static int security_preserve_bools(struct policydb *p);
2040 * This function will flush the access vector cache after 2105 * This function will flush the access vector cache after
2041 * loading the new policy. 2106 * loading the new policy.
2042 */ 2107 */
2043int security_load_policy(void *data, size_t len) 2108int security_load_policy(struct selinux_state *state, void *data, size_t len)
2044{ 2109{
2110 struct policydb *policydb;
2111 struct sidtab *sidtab;
2045 struct policydb *oldpolicydb, *newpolicydb; 2112 struct policydb *oldpolicydb, *newpolicydb;
2046 struct sidtab oldsidtab, newsidtab; 2113 struct sidtab oldsidtab, newsidtab;
2047 struct selinux_mapping *oldmap, *map = NULL; 2114 struct selinux_mapping *oldmapping;
2115 struct selinux_map newmap;
2048 struct convert_context_args args; 2116 struct convert_context_args args;
2049 u32 seqno; 2117 u32 seqno;
2050 u16 map_size;
2051 int rc = 0; 2118 int rc = 0;
2052 struct policy_file file = { data, len }, *fp = &file; 2119 struct policy_file file = { data, len }, *fp = &file;
2053 2120
@@ -2058,53 +2125,42 @@ int security_load_policy(void *data, size_t len)
2058 } 2125 }
2059 newpolicydb = oldpolicydb + 1; 2126 newpolicydb = oldpolicydb + 1;
2060 2127
2061 if (!ss_initialized) { 2128 policydb = &state->ss->policydb;
2062 avtab_cache_init(); 2129 sidtab = &state->ss->sidtab;
2063 ebitmap_cache_init(); 2130
2064 hashtab_cache_init(); 2131 if (!state->initialized) {
2065 rc = policydb_read(&policydb, fp); 2132 rc = policydb_read(policydb, fp);
2066 if (rc) { 2133 if (rc)
2067 avtab_cache_destroy();
2068 ebitmap_cache_destroy();
2069 hashtab_cache_destroy();
2070 goto out; 2134 goto out;
2071 }
2072 2135
2073 policydb.len = len; 2136 policydb->len = len;
2074 rc = selinux_set_mapping(&policydb, secclass_map, 2137 rc = selinux_set_mapping(policydb, secclass_map,
2075 &current_mapping, 2138 &state->ss->map);
2076 &current_mapping_size);
2077 if (rc) { 2139 if (rc) {
2078 policydb_destroy(&policydb); 2140 policydb_destroy(policydb);
2079 avtab_cache_destroy();
2080 ebitmap_cache_destroy();
2081 hashtab_cache_destroy();
2082 goto out; 2141 goto out;
2083 } 2142 }
2084 2143
2085 rc = policydb_load_isids(&policydb, &sidtab); 2144 rc = policydb_load_isids(policydb, sidtab);
2086 if (rc) { 2145 if (rc) {
2087 policydb_destroy(&policydb); 2146 policydb_destroy(policydb);
2088 avtab_cache_destroy();
2089 ebitmap_cache_destroy();
2090 hashtab_cache_destroy();
2091 goto out; 2147 goto out;
2092 } 2148 }
2093 2149
2094 security_load_policycaps(); 2150 security_load_policycaps(state);
2095 ss_initialized = 1; 2151 state->initialized = 1;
2096 seqno = ++latest_granting; 2152 seqno = ++state->ss->latest_granting;
2097 selinux_complete_init(); 2153 selinux_complete_init();
2098 avc_ss_reset(seqno); 2154 avc_ss_reset(seqno);
2099 selnl_notify_policyload(seqno); 2155 selnl_notify_policyload(seqno);
2100 selinux_status_update_policyload(seqno); 2156 selinux_status_update_policyload(state, seqno);
2101 selinux_netlbl_cache_invalidate(); 2157 selinux_netlbl_cache_invalidate();
2102 selinux_xfrm_notify_policyload(); 2158 selinux_xfrm_notify_policyload();
2103 goto out; 2159 goto out;
2104 } 2160 }
2105 2161
2106#if 0 2162#if 0
2107 sidtab_hash_eval(&sidtab, "sids"); 2163 sidtab_hash_eval(sidtab, "sids");
2108#endif 2164#endif
2109 2165
2110 rc = policydb_read(newpolicydb, fp); 2166 rc = policydb_read(newpolicydb, fp);
@@ -2113,9 +2169,9 @@ int security_load_policy(void *data, size_t len)
2113 2169
2114 newpolicydb->len = len; 2170 newpolicydb->len = len;
2115 /* If switching between different policy types, log MLS status */ 2171 /* If switching between different policy types, log MLS status */
2116 if (policydb.mls_enabled && !newpolicydb->mls_enabled) 2172 if (policydb->mls_enabled && !newpolicydb->mls_enabled)
2117 printk(KERN_INFO "SELinux: Disabling MLS support...\n"); 2173 printk(KERN_INFO "SELinux: Disabling MLS support...\n");
2118 else if (!policydb.mls_enabled && newpolicydb->mls_enabled) 2174 else if (!policydb->mls_enabled && newpolicydb->mls_enabled)
2119 printk(KERN_INFO "SELinux: Enabling MLS support...\n"); 2175 printk(KERN_INFO "SELinux: Enabling MLS support...\n");
2120 2176
2121 rc = policydb_load_isids(newpolicydb, &newsidtab); 2177 rc = policydb_load_isids(newpolicydb, &newsidtab);
@@ -2125,20 +2181,20 @@ int security_load_policy(void *data, size_t len)
2125 goto out; 2181 goto out;
2126 } 2182 }
2127 2183
2128 rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size); 2184 rc = selinux_set_mapping(newpolicydb, secclass_map, &newmap);
2129 if (rc) 2185 if (rc)
2130 goto err; 2186 goto err;
2131 2187
2132 rc = security_preserve_bools(newpolicydb); 2188 rc = security_preserve_bools(state, newpolicydb);
2133 if (rc) { 2189 if (rc) {
2134 printk(KERN_ERR "SELinux: unable to preserve booleans\n"); 2190 printk(KERN_ERR "SELinux: unable to preserve booleans\n");
2135 goto err; 2191 goto err;
2136 } 2192 }
2137 2193
2138 /* Clone the SID table. */ 2194 /* Clone the SID table. */
2139 sidtab_shutdown(&sidtab); 2195 sidtab_shutdown(sidtab);
2140 2196
2141 rc = sidtab_map(&sidtab, clone_sid, &newsidtab); 2197 rc = sidtab_map(sidtab, clone_sid, &newsidtab);
2142 if (rc) 2198 if (rc)
2143 goto err; 2199 goto err;
2144 2200
@@ -2146,7 +2202,8 @@ int security_load_policy(void *data, size_t len)
2146 * Convert the internal representations of contexts 2202 * Convert the internal representations of contexts
2147 * in the new SID table. 2203 * in the new SID table.
2148 */ 2204 */
2149 args.oldp = &policydb; 2205 args.state = state;
2206 args.oldp = policydb;
2150 args.newp = newpolicydb; 2207 args.newp = newpolicydb;
2151 rc = sidtab_map(&newsidtab, convert_context, &args); 2208 rc = sidtab_map(&newsidtab, convert_context, &args);
2152 if (rc) { 2209 if (rc) {
@@ -2157,28 +2214,28 @@ int security_load_policy(void *data, size_t len)
2157 } 2214 }
2158 2215
2159 /* Save the old policydb and SID table to free later. */ 2216 /* Save the old policydb and SID table to free later. */
2160 memcpy(oldpolicydb, &policydb, sizeof(policydb)); 2217 memcpy(oldpolicydb, policydb, sizeof(*policydb));
2161 sidtab_set(&oldsidtab, &sidtab); 2218 sidtab_set(&oldsidtab, sidtab);
2162 2219
2163 /* Install the new policydb and SID table. */ 2220 /* Install the new policydb and SID table. */
2164 write_lock_irq(&policy_rwlock); 2221 write_lock_irq(&state->ss->policy_rwlock);
2165 memcpy(&policydb, newpolicydb, sizeof(policydb)); 2222 memcpy(policydb, newpolicydb, sizeof(*policydb));
2166 sidtab_set(&sidtab, &newsidtab); 2223 sidtab_set(sidtab, &newsidtab);
2167 security_load_policycaps(); 2224 security_load_policycaps(state);
2168 oldmap = current_mapping; 2225 oldmapping = state->ss->map.mapping;
2169 current_mapping = map; 2226 state->ss->map.mapping = newmap.mapping;
2170 current_mapping_size = map_size; 2227 state->ss->map.size = newmap.size;
2171 seqno = ++latest_granting; 2228 seqno = ++state->ss->latest_granting;
2172 write_unlock_irq(&policy_rwlock); 2229 write_unlock_irq(&state->ss->policy_rwlock);
2173 2230
2174 /* Free the old policydb and SID table. */ 2231 /* Free the old policydb and SID table. */
2175 policydb_destroy(oldpolicydb); 2232 policydb_destroy(oldpolicydb);
2176 sidtab_destroy(&oldsidtab); 2233 sidtab_destroy(&oldsidtab);
2177 kfree(oldmap); 2234 kfree(oldmapping);
2178 2235
2179 avc_ss_reset(seqno); 2236 avc_ss_reset(seqno);
2180 selnl_notify_policyload(seqno); 2237 selnl_notify_policyload(seqno);
2181 selinux_status_update_policyload(seqno); 2238 selinux_status_update_policyload(state, seqno);
2182 selinux_netlbl_cache_invalidate(); 2239 selinux_netlbl_cache_invalidate();
2183 selinux_xfrm_notify_policyload(); 2240 selinux_xfrm_notify_policyload();
2184 2241
@@ -2186,7 +2243,7 @@ int security_load_policy(void *data, size_t len)
2186 goto out; 2243 goto out;
2187 2244
2188err: 2245err:
2189 kfree(map); 2246 kfree(newmap.mapping);
2190 sidtab_destroy(&newsidtab); 2247 sidtab_destroy(&newsidtab);
2191 policydb_destroy(newpolicydb); 2248 policydb_destroy(newpolicydb);
2192 2249
@@ -2195,13 +2252,14 @@ out:
2195 return rc; 2252 return rc;
2196} 2253}
2197 2254
2198size_t security_policydb_len(void) 2255size_t security_policydb_len(struct selinux_state *state)
2199{ 2256{
2257 struct policydb *p = &state->ss->policydb;
2200 size_t len; 2258 size_t len;
2201 2259
2202 read_lock(&policy_rwlock); 2260 read_lock(&state->ss->policy_rwlock);
2203 len = policydb.len; 2261 len = p->len;
2204 read_unlock(&policy_rwlock); 2262 read_unlock(&state->ss->policy_rwlock);
2205 2263
2206 return len; 2264 return len;
2207} 2265}
@@ -2212,14 +2270,20 @@ size_t security_policydb_len(void)
2212 * @port: port number 2270 * @port: port number
2213 * @out_sid: security identifier 2271 * @out_sid: security identifier
2214 */ 2272 */
2215int security_port_sid(u8 protocol, u16 port, u32 *out_sid) 2273int security_port_sid(struct selinux_state *state,
2274 u8 protocol, u16 port, u32 *out_sid)
2216{ 2275{
2276 struct policydb *policydb;
2277 struct sidtab *sidtab;
2217 struct ocontext *c; 2278 struct ocontext *c;
2218 int rc = 0; 2279 int rc = 0;
2219 2280
2220 read_lock(&policy_rwlock); 2281 read_lock(&state->ss->policy_rwlock);
2282
2283 policydb = &state->ss->policydb;
2284 sidtab = &state->ss->sidtab;
2221 2285
2222 c = policydb.ocontexts[OCON_PORT]; 2286 c = policydb->ocontexts[OCON_PORT];
2223 while (c) { 2287 while (c) {
2224 if (c->u.port.protocol == protocol && 2288 if (c->u.port.protocol == protocol &&
2225 c->u.port.low_port <= port && 2289 c->u.port.low_port <= port &&
@@ -2230,7 +2294,7 @@ int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
2230 2294
2231 if (c) { 2295 if (c) {
2232 if (!c->sid[0]) { 2296 if (!c->sid[0]) {
2233 rc = sidtab_context_to_sid(&sidtab, 2297 rc = sidtab_context_to_sid(sidtab,
2234 &c->context[0], 2298 &c->context[0],
2235 &c->sid[0]); 2299 &c->sid[0]);
2236 if (rc) 2300 if (rc)
@@ -2242,7 +2306,7 @@ int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
2242 } 2306 }
2243 2307
2244out: 2308out:
2245 read_unlock(&policy_rwlock); 2309 read_unlock(&state->ss->policy_rwlock);
2246 return rc; 2310 return rc;
2247} 2311}
2248 2312
@@ -2252,14 +2316,20 @@ out:
2252 * @pkey_num: pkey number 2316 * @pkey_num: pkey number
2253 * @out_sid: security identifier 2317 * @out_sid: security identifier
2254 */ 2318 */
2255int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid) 2319int security_ib_pkey_sid(struct selinux_state *state,
2320 u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
2256{ 2321{
2322 struct policydb *policydb;
2323 struct sidtab *sidtab;
2257 struct ocontext *c; 2324 struct ocontext *c;
2258 int rc = 0; 2325 int rc = 0;
2259 2326
2260 read_lock(&policy_rwlock); 2327 read_lock(&state->ss->policy_rwlock);
2328
2329 policydb = &state->ss->policydb;
2330 sidtab = &state->ss->sidtab;
2261 2331
2262 c = policydb.ocontexts[OCON_IBPKEY]; 2332 c = policydb->ocontexts[OCON_IBPKEY];
2263 while (c) { 2333 while (c) {
2264 if (c->u.ibpkey.low_pkey <= pkey_num && 2334 if (c->u.ibpkey.low_pkey <= pkey_num &&
2265 c->u.ibpkey.high_pkey >= pkey_num && 2335 c->u.ibpkey.high_pkey >= pkey_num &&
@@ -2271,7 +2341,7 @@ int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
2271 2341
2272 if (c) { 2342 if (c) {
2273 if (!c->sid[0]) { 2343 if (!c->sid[0]) {
2274 rc = sidtab_context_to_sid(&sidtab, 2344 rc = sidtab_context_to_sid(sidtab,
2275 &c->context[0], 2345 &c->context[0],
2276 &c->sid[0]); 2346 &c->sid[0]);
2277 if (rc) 2347 if (rc)
@@ -2282,7 +2352,7 @@ int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
2282 *out_sid = SECINITSID_UNLABELED; 2352 *out_sid = SECINITSID_UNLABELED;
2283 2353
2284out: 2354out:
2285 read_unlock(&policy_rwlock); 2355 read_unlock(&state->ss->policy_rwlock);
2286 return rc; 2356 return rc;
2287} 2357}
2288 2358
@@ -2292,14 +2362,20 @@ out:
2292 * @port: port number 2362 * @port: port number
2293 * @out_sid: security identifier 2363 * @out_sid: security identifier
2294 */ 2364 */
2295int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid) 2365int security_ib_endport_sid(struct selinux_state *state,
2366 const char *dev_name, u8 port_num, u32 *out_sid)
2296{ 2367{
2368 struct policydb *policydb;
2369 struct sidtab *sidtab;
2297 struct ocontext *c; 2370 struct ocontext *c;
2298 int rc = 0; 2371 int rc = 0;
2299 2372
2300 read_lock(&policy_rwlock); 2373 read_lock(&state->ss->policy_rwlock);
2301 2374
2302 c = policydb.ocontexts[OCON_IBENDPORT]; 2375 policydb = &state->ss->policydb;
2376 sidtab = &state->ss->sidtab;
2377
2378 c = policydb->ocontexts[OCON_IBENDPORT];
2303 while (c) { 2379 while (c) {
2304 if (c->u.ibendport.port == port_num && 2380 if (c->u.ibendport.port == port_num &&
2305 !strncmp(c->u.ibendport.dev_name, 2381 !strncmp(c->u.ibendport.dev_name,
@@ -2312,7 +2388,7 @@ int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid)
2312 2388
2313 if (c) { 2389 if (c) {
2314 if (!c->sid[0]) { 2390 if (!c->sid[0]) {
2315 rc = sidtab_context_to_sid(&sidtab, 2391 rc = sidtab_context_to_sid(sidtab,
2316 &c->context[0], 2392 &c->context[0],
2317 &c->sid[0]); 2393 &c->sid[0]);
2318 if (rc) 2394 if (rc)
@@ -2323,7 +2399,7 @@ int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid)
2323 *out_sid = SECINITSID_UNLABELED; 2399 *out_sid = SECINITSID_UNLABELED;
2324 2400
2325out: 2401out:
2326 read_unlock(&policy_rwlock); 2402 read_unlock(&state->ss->policy_rwlock);
2327 return rc; 2403 return rc;
2328} 2404}
2329 2405
@@ -2332,14 +2408,20 @@ out:
2332 * @name: interface name 2408 * @name: interface name
2333 * @if_sid: interface SID 2409 * @if_sid: interface SID
2334 */ 2410 */
2335int security_netif_sid(char *name, u32 *if_sid) 2411int security_netif_sid(struct selinux_state *state,
2412 char *name, u32 *if_sid)
2336{ 2413{
2414 struct policydb *policydb;
2415 struct sidtab *sidtab;
2337 int rc = 0; 2416 int rc = 0;
2338 struct ocontext *c; 2417 struct ocontext *c;
2339 2418
2340 read_lock(&policy_rwlock); 2419 read_lock(&state->ss->policy_rwlock);
2420
2421 policydb = &state->ss->policydb;
2422 sidtab = &state->ss->sidtab;
2341 2423
2342 c = policydb.ocontexts[OCON_NETIF]; 2424 c = policydb->ocontexts[OCON_NETIF];
2343 while (c) { 2425 while (c) {
2344 if (strcmp(name, c->u.name) == 0) 2426 if (strcmp(name, c->u.name) == 0)
2345 break; 2427 break;
@@ -2348,12 +2430,12 @@ int security_netif_sid(char *name, u32 *if_sid)
2348 2430
2349 if (c) { 2431 if (c) {
2350 if (!c->sid[0] || !c->sid[1]) { 2432 if (!c->sid[0] || !c->sid[1]) {
2351 rc = sidtab_context_to_sid(&sidtab, 2433 rc = sidtab_context_to_sid(sidtab,
2352 &c->context[0], 2434 &c->context[0],
2353 &c->sid[0]); 2435 &c->sid[0]);
2354 if (rc) 2436 if (rc)
2355 goto out; 2437 goto out;
2356 rc = sidtab_context_to_sid(&sidtab, 2438 rc = sidtab_context_to_sid(sidtab,
2357 &c->context[1], 2439 &c->context[1],
2358 &c->sid[1]); 2440 &c->sid[1]);
2359 if (rc) 2441 if (rc)
@@ -2364,7 +2446,7 @@ int security_netif_sid(char *name, u32 *if_sid)
2364 *if_sid = SECINITSID_NETIF; 2446 *if_sid = SECINITSID_NETIF;
2365 2447
2366out: 2448out:
2367 read_unlock(&policy_rwlock); 2449 read_unlock(&state->ss->policy_rwlock);
2368 return rc; 2450 return rc;
2369} 2451}
2370 2452
@@ -2388,15 +2470,21 @@ static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)
2388 * @addrlen: address length in bytes 2470 * @addrlen: address length in bytes
2389 * @out_sid: security identifier 2471 * @out_sid: security identifier
2390 */ 2472 */
2391int security_node_sid(u16 domain, 2473int security_node_sid(struct selinux_state *state,
2474 u16 domain,
2392 void *addrp, 2475 void *addrp,
2393 u32 addrlen, 2476 u32 addrlen,
2394 u32 *out_sid) 2477 u32 *out_sid)
2395{ 2478{
2479 struct policydb *policydb;
2480 struct sidtab *sidtab;
2396 int rc; 2481 int rc;
2397 struct ocontext *c; 2482 struct ocontext *c;
2398 2483
2399 read_lock(&policy_rwlock); 2484 read_lock(&state->ss->policy_rwlock);
2485
2486 policydb = &state->ss->policydb;
2487 sidtab = &state->ss->sidtab;
2400 2488
2401 switch (domain) { 2489 switch (domain) {
2402 case AF_INET: { 2490 case AF_INET: {
@@ -2408,7 +2496,7 @@ int security_node_sid(u16 domain,
2408 2496
2409 addr = *((u32 *)addrp); 2497 addr = *((u32 *)addrp);
2410 2498
2411 c = policydb.ocontexts[OCON_NODE]; 2499 c = policydb->ocontexts[OCON_NODE];
2412 while (c) { 2500 while (c) {
2413 if (c->u.node.addr == (addr & c->u.node.mask)) 2501 if (c->u.node.addr == (addr & c->u.node.mask))
2414 break; 2502 break;
@@ -2421,7 +2509,7 @@ int security_node_sid(u16 domain,
2421 rc = -EINVAL; 2509 rc = -EINVAL;
2422 if (addrlen != sizeof(u64) * 2) 2510 if (addrlen != sizeof(u64) * 2)
2423 goto out; 2511 goto out;
2424 c = policydb.ocontexts[OCON_NODE6]; 2512 c = policydb->ocontexts[OCON_NODE6];
2425 while (c) { 2513 while (c) {
2426 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2514 if (match_ipv6_addrmask(addrp, c->u.node6.addr,
2427 c->u.node6.mask)) 2515 c->u.node6.mask))
@@ -2438,7 +2526,7 @@ int security_node_sid(u16 domain,
2438 2526
2439 if (c) { 2527 if (c) {
2440 if (!c->sid[0]) { 2528 if (!c->sid[0]) {
2441 rc = sidtab_context_to_sid(&sidtab, 2529 rc = sidtab_context_to_sid(sidtab,
2442 &c->context[0], 2530 &c->context[0],
2443 &c->sid[0]); 2531 &c->sid[0]);
2444 if (rc) 2532 if (rc)
@@ -2451,7 +2539,7 @@ int security_node_sid(u16 domain,
2451 2539
2452 rc = 0; 2540 rc = 0;
2453out: 2541out:
2454 read_unlock(&policy_rwlock); 2542 read_unlock(&state->ss->policy_rwlock);
2455 return rc; 2543 return rc;
2456} 2544}
2457 2545
@@ -2471,11 +2559,14 @@ out:
2471 * number of elements in the array. 2559 * number of elements in the array.
2472 */ 2560 */
2473 2561
2474int security_get_user_sids(u32 fromsid, 2562int security_get_user_sids(struct selinux_state *state,
2563 u32 fromsid,
2475 char *username, 2564 char *username,
2476 u32 **sids, 2565 u32 **sids,
2477 u32 *nel) 2566 u32 *nel)
2478{ 2567{
2568 struct policydb *policydb;
2569 struct sidtab *sidtab;
2479 struct context *fromcon, usercon; 2570 struct context *fromcon, usercon;
2480 u32 *mysids = NULL, *mysids2, sid; 2571 u32 *mysids = NULL, *mysids2, sid;
2481 u32 mynel = 0, maxnel = SIDS_NEL; 2572 u32 mynel = 0, maxnel = SIDS_NEL;
@@ -2487,20 +2578,23 @@ int security_get_user_sids(u32 fromsid,
2487 *sids = NULL; 2578 *sids = NULL;
2488 *nel = 0; 2579 *nel = 0;
2489 2580
2490 if (!ss_initialized) 2581 if (!state->initialized)
2491 goto out; 2582 goto out;
2492 2583
2493 read_lock(&policy_rwlock); 2584 read_lock(&state->ss->policy_rwlock);
2585
2586 policydb = &state->ss->policydb;
2587 sidtab = &state->ss->sidtab;
2494 2588
2495 context_init(&usercon); 2589 context_init(&usercon);
2496 2590
2497 rc = -EINVAL; 2591 rc = -EINVAL;
2498 fromcon = sidtab_search(&sidtab, fromsid); 2592 fromcon = sidtab_search(sidtab, fromsid);
2499 if (!fromcon) 2593 if (!fromcon)
2500 goto out_unlock; 2594 goto out_unlock;
2501 2595
2502 rc = -EINVAL; 2596 rc = -EINVAL;
2503 user = hashtab_search(policydb.p_users.table, username); 2597 user = hashtab_search(policydb->p_users.table, username);
2504 if (!user) 2598 if (!user)
2505 goto out_unlock; 2599 goto out_unlock;
2506 2600
@@ -2512,15 +2606,16 @@ int security_get_user_sids(u32 fromsid,
2512 goto out_unlock; 2606 goto out_unlock;
2513 2607
2514 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2608 ebitmap_for_each_positive_bit(&user->roles, rnode, i) {
2515 role = policydb.role_val_to_struct[i]; 2609 role = policydb->role_val_to_struct[i];
2516 usercon.role = i + 1; 2610 usercon.role = i + 1;
2517 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2611 ebitmap_for_each_positive_bit(&role->types, tnode, j) {
2518 usercon.type = j + 1; 2612 usercon.type = j + 1;
2519 2613
2520 if (mls_setup_user_range(fromcon, user, &usercon)) 2614 if (mls_setup_user_range(policydb, fromcon, user,
2615 &usercon))
2521 continue; 2616 continue;
2522 2617
2523 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid); 2618 rc = sidtab_context_to_sid(sidtab, &usercon, &sid);
2524 if (rc) 2619 if (rc)
2525 goto out_unlock; 2620 goto out_unlock;
2526 if (mynel < maxnel) { 2621 if (mynel < maxnel) {
@@ -2540,7 +2635,7 @@ int security_get_user_sids(u32 fromsid,
2540 } 2635 }
2541 rc = 0; 2636 rc = 0;
2542out_unlock: 2637out_unlock:
2543 read_unlock(&policy_rwlock); 2638 read_unlock(&state->ss->policy_rwlock);
2544 if (rc || !mynel) { 2639 if (rc || !mynel) {
2545 kfree(mysids); 2640 kfree(mysids);
2546 goto out; 2641 goto out;
@@ -2583,11 +2678,14 @@ out:
2583 * 2678 *
2584 * The caller must acquire the policy_rwlock before calling this function. 2679 * The caller must acquire the policy_rwlock before calling this function.
2585 */ 2680 */
2586static inline int __security_genfs_sid(const char *fstype, 2681static inline int __security_genfs_sid(struct selinux_state *state,
2682 const char *fstype,
2587 char *path, 2683 char *path,
2588 u16 orig_sclass, 2684 u16 orig_sclass,
2589 u32 *sid) 2685 u32 *sid)
2590{ 2686{
2687 struct policydb *policydb = &state->ss->policydb;
2688 struct sidtab *sidtab = &state->ss->sidtab;
2591 int len; 2689 int len;
2592 u16 sclass; 2690 u16 sclass;
2593 struct genfs *genfs; 2691 struct genfs *genfs;
@@ -2597,10 +2695,10 @@ static inline int __security_genfs_sid(const char *fstype,
2597 while (path[0] == '/' && path[1] == '/') 2695 while (path[0] == '/' && path[1] == '/')
2598 path++; 2696 path++;
2599 2697
2600 sclass = unmap_class(orig_sclass); 2698 sclass = unmap_class(&state->ss->map, orig_sclass);
2601 *sid = SECINITSID_UNLABELED; 2699 *sid = SECINITSID_UNLABELED;
2602 2700
2603 for (genfs = policydb.genfs; genfs; genfs = genfs->next) { 2701 for (genfs = policydb->genfs; genfs; genfs = genfs->next) {
2604 cmp = strcmp(fstype, genfs->fstype); 2702 cmp = strcmp(fstype, genfs->fstype);
2605 if (cmp <= 0) 2703 if (cmp <= 0)
2606 break; 2704 break;
@@ -2622,7 +2720,7 @@ static inline int __security_genfs_sid(const char *fstype,
2622 goto out; 2720 goto out;
2623 2721
2624 if (!c->sid[0]) { 2722 if (!c->sid[0]) {
2625 rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]); 2723 rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]);
2626 if (rc) 2724 if (rc)
2627 goto out; 2725 goto out;
2628 } 2726 }
@@ -2643,16 +2741,17 @@ out:
2643 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2741 * Acquire policy_rwlock before calling __security_genfs_sid() and release
2644 * it afterward. 2742 * it afterward.
2645 */ 2743 */
2646int security_genfs_sid(const char *fstype, 2744int security_genfs_sid(struct selinux_state *state,
2745 const char *fstype,
2647 char *path, 2746 char *path,
2648 u16 orig_sclass, 2747 u16 orig_sclass,
2649 u32 *sid) 2748 u32 *sid)
2650{ 2749{
2651 int retval; 2750 int retval;
2652 2751
2653 read_lock(&policy_rwlock); 2752 read_lock(&state->ss->policy_rwlock);
2654 retval = __security_genfs_sid(fstype, path, orig_sclass, sid); 2753 retval = __security_genfs_sid(state, fstype, path, orig_sclass, sid);
2655 read_unlock(&policy_rwlock); 2754 read_unlock(&state->ss->policy_rwlock);
2656 return retval; 2755 return retval;
2657} 2756}
2658 2757
@@ -2660,16 +2759,21 @@ int security_genfs_sid(const char *fstype,
2660 * security_fs_use - Determine how to handle labeling for a filesystem. 2759 * security_fs_use - Determine how to handle labeling for a filesystem.
2661 * @sb: superblock in question 2760 * @sb: superblock in question
2662 */ 2761 */
2663int security_fs_use(struct super_block *sb) 2762int security_fs_use(struct selinux_state *state, struct super_block *sb)
2664{ 2763{
2764 struct policydb *policydb;
2765 struct sidtab *sidtab;
2665 int rc = 0; 2766 int rc = 0;
2666 struct ocontext *c; 2767 struct ocontext *c;
2667 struct superblock_security_struct *sbsec = sb->s_security; 2768 struct superblock_security_struct *sbsec = sb->s_security;
2668 const char *fstype = sb->s_type->name; 2769 const char *fstype = sb->s_type->name;
2669 2770
2670 read_lock(&policy_rwlock); 2771 read_lock(&state->ss->policy_rwlock);
2772
2773 policydb = &state->ss->policydb;
2774 sidtab = &state->ss->sidtab;
2671 2775
2672 c = policydb.ocontexts[OCON_FSUSE]; 2776 c = policydb->ocontexts[OCON_FSUSE];
2673 while (c) { 2777 while (c) {
2674 if (strcmp(fstype, c->u.name) == 0) 2778 if (strcmp(fstype, c->u.name) == 0)
2675 break; 2779 break;
@@ -2679,14 +2783,14 @@ int security_fs_use(struct super_block *sb)
2679 if (c) { 2783 if (c) {
2680 sbsec->behavior = c->v.behavior; 2784 sbsec->behavior = c->v.behavior;
2681 if (!c->sid[0]) { 2785 if (!c->sid[0]) {
2682 rc = sidtab_context_to_sid(&sidtab, &c->context[0], 2786 rc = sidtab_context_to_sid(sidtab, &c->context[0],
2683 &c->sid[0]); 2787 &c->sid[0]);
2684 if (rc) 2788 if (rc)
2685 goto out; 2789 goto out;
2686 } 2790 }
2687 sbsec->sid = c->sid[0]; 2791 sbsec->sid = c->sid[0];
2688 } else { 2792 } else {
2689 rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR, 2793 rc = __security_genfs_sid(state, fstype, "/", SECCLASS_DIR,
2690 &sbsec->sid); 2794 &sbsec->sid);
2691 if (rc) { 2795 if (rc) {
2692 sbsec->behavior = SECURITY_FS_USE_NONE; 2796 sbsec->behavior = SECURITY_FS_USE_NONE;
@@ -2697,20 +2801,25 @@ int security_fs_use(struct super_block *sb)
2697 } 2801 }
2698 2802
2699out: 2803out:
2700 read_unlock(&policy_rwlock); 2804 read_unlock(&state->ss->policy_rwlock);
2701 return rc; 2805 return rc;
2702} 2806}
2703 2807
2704int security_get_bools(int *len, char ***names, int **values) 2808int security_get_bools(struct selinux_state *state,
2809 int *len, char ***names, int **values)
2705{ 2810{
2811 struct policydb *policydb;
2706 int i, rc; 2812 int i, rc;
2707 2813
2708 read_lock(&policy_rwlock); 2814 read_lock(&state->ss->policy_rwlock);
2815
2816 policydb = &state->ss->policydb;
2817
2709 *names = NULL; 2818 *names = NULL;
2710 *values = NULL; 2819 *values = NULL;
2711 2820
2712 rc = 0; 2821 rc = 0;
2713 *len = policydb.p_bools.nprim; 2822 *len = policydb->p_bools.nprim;
2714 if (!*len) 2823 if (!*len)
2715 goto out; 2824 goto out;
2716 2825
@@ -2725,16 +2834,17 @@ int security_get_bools(int *len, char ***names, int **values)
2725 goto err; 2834 goto err;
2726 2835
2727 for (i = 0; i < *len; i++) { 2836 for (i = 0; i < *len; i++) {
2728 (*values)[i] = policydb.bool_val_to_struct[i]->state; 2837 (*values)[i] = policydb->bool_val_to_struct[i]->state;
2729 2838
2730 rc = -ENOMEM; 2839 rc = -ENOMEM;
2731 (*names)[i] = kstrdup(sym_name(&policydb, SYM_BOOLS, i), GFP_ATOMIC); 2840 (*names)[i] = kstrdup(sym_name(policydb, SYM_BOOLS, i),
2841 GFP_ATOMIC);
2732 if (!(*names)[i]) 2842 if (!(*names)[i])
2733 goto err; 2843 goto err;
2734 } 2844 }
2735 rc = 0; 2845 rc = 0;
2736out: 2846out:
2737 read_unlock(&policy_rwlock); 2847 read_unlock(&state->ss->policy_rwlock);
2738 return rc; 2848 return rc;
2739err: 2849err:
2740 if (*names) { 2850 if (*names) {
@@ -2746,90 +2856,98 @@ err:
2746} 2856}
2747 2857
2748 2858
2749int security_set_bools(int len, int *values) 2859int security_set_bools(struct selinux_state *state, int len, int *values)
2750{ 2860{
2861 struct policydb *policydb;
2751 int i, rc; 2862 int i, rc;
2752 int lenp, seqno = 0; 2863 int lenp, seqno = 0;
2753 struct cond_node *cur; 2864 struct cond_node *cur;
2754 2865
2755 write_lock_irq(&policy_rwlock); 2866 write_lock_irq(&state->ss->policy_rwlock);
2867
2868 policydb = &state->ss->policydb;
2756 2869
2757 rc = -EFAULT; 2870 rc = -EFAULT;
2758 lenp = policydb.p_bools.nprim; 2871 lenp = policydb->p_bools.nprim;
2759 if (len != lenp) 2872 if (len != lenp)
2760 goto out; 2873 goto out;
2761 2874
2762 for (i = 0; i < len; i++) { 2875 for (i = 0; i < len; i++) {
2763 if (!!values[i] != policydb.bool_val_to_struct[i]->state) { 2876 if (!!values[i] != policydb->bool_val_to_struct[i]->state) {
2764 audit_log(current->audit_context, GFP_ATOMIC, 2877 audit_log(current->audit_context, GFP_ATOMIC,
2765 AUDIT_MAC_CONFIG_CHANGE, 2878 AUDIT_MAC_CONFIG_CHANGE,
2766 "bool=%s val=%d old_val=%d auid=%u ses=%u", 2879 "bool=%s val=%d old_val=%d auid=%u ses=%u",
2767 sym_name(&policydb, SYM_BOOLS, i), 2880 sym_name(policydb, SYM_BOOLS, i),
2768 !!values[i], 2881 !!values[i],
2769 policydb.bool_val_to_struct[i]->state, 2882 policydb->bool_val_to_struct[i]->state,
2770 from_kuid(&init_user_ns, audit_get_loginuid(current)), 2883 from_kuid(&init_user_ns, audit_get_loginuid(current)),
2771 audit_get_sessionid(current)); 2884 audit_get_sessionid(current));
2772 } 2885 }
2773 if (values[i]) 2886 if (values[i])
2774 policydb.bool_val_to_struct[i]->state = 1; 2887 policydb->bool_val_to_struct[i]->state = 1;
2775 else 2888 else
2776 policydb.bool_val_to_struct[i]->state = 0; 2889 policydb->bool_val_to_struct[i]->state = 0;
2777 } 2890 }
2778 2891
2779 for (cur = policydb.cond_list; cur; cur = cur->next) { 2892 for (cur = policydb->cond_list; cur; cur = cur->next) {
2780 rc = evaluate_cond_node(&policydb, cur); 2893 rc = evaluate_cond_node(policydb, cur);
2781 if (rc) 2894 if (rc)
2782 goto out; 2895 goto out;
2783 } 2896 }
2784 2897
2785 seqno = ++latest_granting; 2898 seqno = ++state->ss->latest_granting;
2786 rc = 0; 2899 rc = 0;
2787out: 2900out:
2788 write_unlock_irq(&policy_rwlock); 2901 write_unlock_irq(&state->ss->policy_rwlock);
2789 if (!rc) { 2902 if (!rc) {
2790 avc_ss_reset(seqno); 2903 avc_ss_reset(seqno);
2791 selnl_notify_policyload(seqno); 2904 selnl_notify_policyload(seqno);
2792 selinux_status_update_policyload(seqno); 2905 selinux_status_update_policyload(state, seqno);
2793 selinux_xfrm_notify_policyload(); 2906 selinux_xfrm_notify_policyload();
2794 } 2907 }
2795 return rc; 2908 return rc;
2796} 2909}
2797 2910
2798int security_get_bool_value(int index) 2911int security_get_bool_value(struct selinux_state *state,
2912 int index)
2799{ 2913{
2914 struct policydb *policydb;
2800 int rc; 2915 int rc;
2801 int len; 2916 int len;
2802 2917
2803 read_lock(&policy_rwlock); 2918 read_lock(&state->ss->policy_rwlock);
2919
2920 policydb = &state->ss->policydb;
2804 2921
2805 rc = -EFAULT; 2922 rc = -EFAULT;
2806 len = policydb.p_bools.nprim; 2923 len = policydb->p_bools.nprim;
2807 if (index >= len) 2924 if (index >= len)
2808 goto out; 2925 goto out;
2809 2926
2810 rc = policydb.bool_val_to_struct[index]->state; 2927 rc = policydb->bool_val_to_struct[index]->state;
2811out: 2928out:
2812 read_unlock(&policy_rwlock); 2929 read_unlock(&state->ss->policy_rwlock);
2813 return rc; 2930 return rc;
2814} 2931}
2815 2932
2816static int security_preserve_bools(struct policydb *p) 2933static int security_preserve_bools(struct selinux_state *state,
2934 struct policydb *policydb)
2817{ 2935{
2818 int rc, nbools = 0, *bvalues = NULL, i; 2936 int rc, nbools = 0, *bvalues = NULL, i;
2819 char **bnames = NULL; 2937 char **bnames = NULL;
2820 struct cond_bool_datum *booldatum; 2938 struct cond_bool_datum *booldatum;
2821 struct cond_node *cur; 2939 struct cond_node *cur;
2822 2940
2823 rc = security_get_bools(&nbools, &bnames, &bvalues); 2941 rc = security_get_bools(state, &nbools, &bnames, &bvalues);
2824 if (rc) 2942 if (rc)
2825 goto out; 2943 goto out;
2826 for (i = 0; i < nbools; i++) { 2944 for (i = 0; i < nbools; i++) {
2827 booldatum = hashtab_search(p->p_bools.table, bnames[i]); 2945 booldatum = hashtab_search(policydb->p_bools.table, bnames[i]);
2828 if (booldatum) 2946 if (booldatum)
2829 booldatum->state = bvalues[i]; 2947 booldatum->state = bvalues[i];
2830 } 2948 }
2831 for (cur = p->cond_list; cur; cur = cur->next) { 2949 for (cur = policydb->cond_list; cur; cur = cur->next) {
2832 rc = evaluate_cond_node(p, cur); 2950 rc = evaluate_cond_node(policydb, cur);
2833 if (rc) 2951 if (rc)
2834 goto out; 2952 goto out;
2835 } 2953 }
@@ -2848,8 +2966,11 @@ out:
2848 * security_sid_mls_copy() - computes a new sid based on the given 2966 * security_sid_mls_copy() - computes a new sid based on the given
2849 * sid and the mls portion of mls_sid. 2967 * sid and the mls portion of mls_sid.
2850 */ 2968 */
2851int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid) 2969int security_sid_mls_copy(struct selinux_state *state,
2970 u32 sid, u32 mls_sid, u32 *new_sid)
2852{ 2971{
2972 struct policydb *policydb = &state->ss->policydb;
2973 struct sidtab *sidtab = &state->ss->sidtab;
2853 struct context *context1; 2974 struct context *context1;
2854 struct context *context2; 2975 struct context *context2;
2855 struct context newcon; 2976 struct context newcon;
@@ -2858,17 +2979,17 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2858 int rc; 2979 int rc;
2859 2980
2860 rc = 0; 2981 rc = 0;
2861 if (!ss_initialized || !policydb.mls_enabled) { 2982 if (!state->initialized || !policydb->mls_enabled) {
2862 *new_sid = sid; 2983 *new_sid = sid;
2863 goto out; 2984 goto out;
2864 } 2985 }
2865 2986
2866 context_init(&newcon); 2987 context_init(&newcon);
2867 2988
2868 read_lock(&policy_rwlock); 2989 read_lock(&state->ss->policy_rwlock);
2869 2990
2870 rc = -EINVAL; 2991 rc = -EINVAL;
2871 context1 = sidtab_search(&sidtab, sid); 2992 context1 = sidtab_search(sidtab, sid);
2872 if (!context1) { 2993 if (!context1) {
2873 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2994 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
2874 __func__, sid); 2995 __func__, sid);
@@ -2876,7 +2997,7 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2876 } 2997 }
2877 2998
2878 rc = -EINVAL; 2999 rc = -EINVAL;
2879 context2 = sidtab_search(&sidtab, mls_sid); 3000 context2 = sidtab_search(sidtab, mls_sid);
2880 if (!context2) { 3001 if (!context2) {
2881 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 3002 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
2882 __func__, mls_sid); 3003 __func__, mls_sid);
@@ -2891,10 +3012,11 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2891 goto out_unlock; 3012 goto out_unlock;
2892 3013
2893 /* Check the validity of the new context. */ 3014 /* Check the validity of the new context. */
2894 if (!policydb_context_isvalid(&policydb, &newcon)) { 3015 if (!policydb_context_isvalid(policydb, &newcon)) {
2895 rc = convert_context_handle_invalid_context(&newcon); 3016 rc = convert_context_handle_invalid_context(state, &newcon);
2896 if (rc) { 3017 if (rc) {
2897 if (!context_struct_to_string(&newcon, &s, &len)) { 3018 if (!context_struct_to_string(policydb, &newcon, &s,
3019 &len)) {
2898 audit_log(current->audit_context, 3020 audit_log(current->audit_context,
2899 GFP_ATOMIC, AUDIT_SELINUX_ERR, 3021 GFP_ATOMIC, AUDIT_SELINUX_ERR,
2900 "op=security_sid_mls_copy " 3022 "op=security_sid_mls_copy "
@@ -2905,9 +3027,9 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2905 } 3027 }
2906 } 3028 }
2907 3029
2908 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid); 3030 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid);
2909out_unlock: 3031out_unlock:
2910 read_unlock(&policy_rwlock); 3032 read_unlock(&state->ss->policy_rwlock);
2911 context_destroy(&newcon); 3033 context_destroy(&newcon);
2912out: 3034out:
2913 return rc; 3035 return rc;
@@ -2933,10 +3055,13 @@ out:
2933 * multiple, inconsistent labels | -<errno> | SECSID_NULL 3055 * multiple, inconsistent labels | -<errno> | SECSID_NULL
2934 * 3056 *
2935 */ 3057 */
2936int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 3058int security_net_peersid_resolve(struct selinux_state *state,
3059 u32 nlbl_sid, u32 nlbl_type,
2937 u32 xfrm_sid, 3060 u32 xfrm_sid,
2938 u32 *peer_sid) 3061 u32 *peer_sid)
2939{ 3062{
3063 struct policydb *policydb = &state->ss->policydb;
3064 struct sidtab *sidtab = &state->ss->sidtab;
2940 int rc; 3065 int rc;
2941 struct context *nlbl_ctx; 3066 struct context *nlbl_ctx;
2942 struct context *xfrm_ctx; 3067 struct context *xfrm_ctx;
@@ -2958,23 +3083,25 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
2958 return 0; 3083 return 0;
2959 } 3084 }
2960 3085
2961 /* we don't need to check ss_initialized here since the only way both 3086 /*
3087 * We don't need to check initialized here since the only way both
2962 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 3088 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
2963 * security server was initialized and ss_initialized was true */ 3089 * security server was initialized and state->initialized was true.
2964 if (!policydb.mls_enabled) 3090 */
3091 if (!policydb->mls_enabled)
2965 return 0; 3092 return 0;
2966 3093
2967 read_lock(&policy_rwlock); 3094 read_lock(&state->ss->policy_rwlock);
2968 3095
2969 rc = -EINVAL; 3096 rc = -EINVAL;
2970 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid); 3097 nlbl_ctx = sidtab_search(sidtab, nlbl_sid);
2971 if (!nlbl_ctx) { 3098 if (!nlbl_ctx) {
2972 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 3099 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
2973 __func__, nlbl_sid); 3100 __func__, nlbl_sid);
2974 goto out; 3101 goto out;
2975 } 3102 }
2976 rc = -EINVAL; 3103 rc = -EINVAL;
2977 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid); 3104 xfrm_ctx = sidtab_search(sidtab, xfrm_sid);
2978 if (!xfrm_ctx) { 3105 if (!xfrm_ctx) {
2979 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 3106 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
2980 __func__, xfrm_sid); 3107 __func__, xfrm_sid);
@@ -2991,7 +3118,7 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
2991 * expressive */ 3118 * expressive */
2992 *peer_sid = xfrm_sid; 3119 *peer_sid = xfrm_sid;
2993out: 3120out:
2994 read_unlock(&policy_rwlock); 3121 read_unlock(&state->ss->policy_rwlock);
2995 return rc; 3122 return rc;
2996} 3123}
2997 3124
@@ -3008,19 +3135,21 @@ static int get_classes_callback(void *k, void *d, void *args)
3008 return 0; 3135 return 0;
3009} 3136}
3010 3137
3011int security_get_classes(char ***classes, int *nclasses) 3138int security_get_classes(struct selinux_state *state,
3139 char ***classes, int *nclasses)
3012{ 3140{
3141 struct policydb *policydb = &state->ss->policydb;
3013 int rc; 3142 int rc;
3014 3143
3015 read_lock(&policy_rwlock); 3144 read_lock(&state->ss->policy_rwlock);
3016 3145
3017 rc = -ENOMEM; 3146 rc = -ENOMEM;
3018 *nclasses = policydb.p_classes.nprim; 3147 *nclasses = policydb->p_classes.nprim;
3019 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 3148 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);
3020 if (!*classes) 3149 if (!*classes)
3021 goto out; 3150 goto out;
3022 3151
3023 rc = hashtab_map(policydb.p_classes.table, get_classes_callback, 3152 rc = hashtab_map(policydb->p_classes.table, get_classes_callback,
3024 *classes); 3153 *classes);
3025 if (rc) { 3154 if (rc) {
3026 int i; 3155 int i;
@@ -3030,7 +3159,7 @@ int security_get_classes(char ***classes, int *nclasses)
3030 } 3159 }
3031 3160
3032out: 3161out:
3033 read_unlock(&policy_rwlock); 3162 read_unlock(&state->ss->policy_rwlock);
3034 return rc; 3163 return rc;
3035} 3164}
3036 3165
@@ -3047,15 +3176,17 @@ static int get_permissions_callback(void *k, void *d, void *args)
3047 return 0; 3176 return 0;
3048} 3177}
3049 3178
3050int security_get_permissions(char *class, char ***perms, int *nperms) 3179int security_get_permissions(struct selinux_state *state,
3180 char *class, char ***perms, int *nperms)
3051{ 3181{
3182 struct policydb *policydb = &state->ss->policydb;
3052 int rc, i; 3183 int rc, i;
3053 struct class_datum *match; 3184 struct class_datum *match;
3054 3185
3055 read_lock(&policy_rwlock); 3186 read_lock(&state->ss->policy_rwlock);
3056 3187
3057 rc = -EINVAL; 3188 rc = -EINVAL;
3058 match = hashtab_search(policydb.p_classes.table, class); 3189 match = hashtab_search(policydb->p_classes.table, class);
3059 if (!match) { 3190 if (!match) {
3060 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n", 3191 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n",
3061 __func__, class); 3192 __func__, class);
@@ -3081,25 +3212,25 @@ int security_get_permissions(char *class, char ***perms, int *nperms)
3081 goto err; 3212 goto err;
3082 3213
3083out: 3214out:
3084 read_unlock(&policy_rwlock); 3215 read_unlock(&state->ss->policy_rwlock);
3085 return rc; 3216 return rc;
3086 3217
3087err: 3218err:
3088 read_unlock(&policy_rwlock); 3219 read_unlock(&state->ss->policy_rwlock);
3089 for (i = 0; i < *nperms; i++) 3220 for (i = 0; i < *nperms; i++)
3090 kfree((*perms)[i]); 3221 kfree((*perms)[i]);
3091 kfree(*perms); 3222 kfree(*perms);
3092 return rc; 3223 return rc;
3093} 3224}
3094 3225
3095int security_get_reject_unknown(void) 3226int security_get_reject_unknown(struct selinux_state *state)
3096{ 3227{
3097 return policydb.reject_unknown; 3228 return state->ss->policydb.reject_unknown;
3098} 3229}
3099 3230
3100int security_get_allow_unknown(void) 3231int security_get_allow_unknown(struct selinux_state *state)
3101{ 3232{
3102 return policydb.allow_unknown; 3233 return state->ss->policydb.allow_unknown;
3103} 3234}
3104 3235
3105/** 3236/**
@@ -3112,13 +3243,15 @@ int security_get_allow_unknown(void)
3112 * supported, false (0) if it isn't supported. 3243 * supported, false (0) if it isn't supported.
3113 * 3244 *
3114 */ 3245 */
3115int security_policycap_supported(unsigned int req_cap) 3246int security_policycap_supported(struct selinux_state *state,
3247 unsigned int req_cap)
3116{ 3248{
3249 struct policydb *policydb = &state->ss->policydb;
3117 int rc; 3250 int rc;
3118 3251
3119 read_lock(&policy_rwlock); 3252 read_lock(&state->ss->policy_rwlock);
3120 rc = ebitmap_get_bit(&policydb.policycaps, req_cap); 3253 rc = ebitmap_get_bit(&policydb->policycaps, req_cap);
3121 read_unlock(&policy_rwlock); 3254 read_unlock(&state->ss->policy_rwlock);
3122 3255
3123 return rc; 3256 return rc;
3124} 3257}
@@ -3140,6 +3273,8 @@ void selinux_audit_rule_free(void *vrule)
3140 3273
3141int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3274int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3142{ 3275{
3276 struct selinux_state *state = &selinux_state;
3277 struct policydb *policydb = &state->ss->policydb;
3143 struct selinux_audit_rule *tmprule; 3278 struct selinux_audit_rule *tmprule;
3144 struct role_datum *roledatum; 3279 struct role_datum *roledatum;
3145 struct type_datum *typedatum; 3280 struct type_datum *typedatum;
@@ -3149,7 +3284,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3149 3284
3150 *rule = NULL; 3285 *rule = NULL;
3151 3286
3152 if (!ss_initialized) 3287 if (!state->initialized)
3153 return -EOPNOTSUPP; 3288 return -EOPNOTSUPP;
3154 3289
3155 switch (field) { 3290 switch (field) {
@@ -3182,15 +3317,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3182 3317
3183 context_init(&tmprule->au_ctxt); 3318 context_init(&tmprule->au_ctxt);
3184 3319
3185 read_lock(&policy_rwlock); 3320 read_lock(&state->ss->policy_rwlock);
3186 3321
3187 tmprule->au_seqno = latest_granting; 3322 tmprule->au_seqno = state->ss->latest_granting;
3188 3323
3189 switch (field) { 3324 switch (field) {
3190 case AUDIT_SUBJ_USER: 3325 case AUDIT_SUBJ_USER:
3191 case AUDIT_OBJ_USER: 3326 case AUDIT_OBJ_USER:
3192 rc = -EINVAL; 3327 rc = -EINVAL;
3193 userdatum = hashtab_search(policydb.p_users.table, rulestr); 3328 userdatum = hashtab_search(policydb->p_users.table, rulestr);
3194 if (!userdatum) 3329 if (!userdatum)
3195 goto out; 3330 goto out;
3196 tmprule->au_ctxt.user = userdatum->value; 3331 tmprule->au_ctxt.user = userdatum->value;
@@ -3198,7 +3333,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3198 case AUDIT_SUBJ_ROLE: 3333 case AUDIT_SUBJ_ROLE:
3199 case AUDIT_OBJ_ROLE: 3334 case AUDIT_OBJ_ROLE:
3200 rc = -EINVAL; 3335 rc = -EINVAL;
3201 roledatum = hashtab_search(policydb.p_roles.table, rulestr); 3336 roledatum = hashtab_search(policydb->p_roles.table, rulestr);
3202 if (!roledatum) 3337 if (!roledatum)
3203 goto out; 3338 goto out;
3204 tmprule->au_ctxt.role = roledatum->value; 3339 tmprule->au_ctxt.role = roledatum->value;
@@ -3206,7 +3341,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3206 case AUDIT_SUBJ_TYPE: 3341 case AUDIT_SUBJ_TYPE:
3207 case AUDIT_OBJ_TYPE: 3342 case AUDIT_OBJ_TYPE:
3208 rc = -EINVAL; 3343 rc = -EINVAL;
3209 typedatum = hashtab_search(policydb.p_types.table, rulestr); 3344 typedatum = hashtab_search(policydb->p_types.table, rulestr);
3210 if (!typedatum) 3345 if (!typedatum)
3211 goto out; 3346 goto out;
3212 tmprule->au_ctxt.type = typedatum->value; 3347 tmprule->au_ctxt.type = typedatum->value;
@@ -3215,14 +3350,15 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3215 case AUDIT_SUBJ_CLR: 3350 case AUDIT_SUBJ_CLR:
3216 case AUDIT_OBJ_LEV_LOW: 3351 case AUDIT_OBJ_LEV_LOW:
3217 case AUDIT_OBJ_LEV_HIGH: 3352 case AUDIT_OBJ_LEV_HIGH:
3218 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); 3353 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt,
3354 GFP_ATOMIC);
3219 if (rc) 3355 if (rc)
3220 goto out; 3356 goto out;
3221 break; 3357 break;
3222 } 3358 }
3223 rc = 0; 3359 rc = 0;
3224out: 3360out:
3225 read_unlock(&policy_rwlock); 3361 read_unlock(&state->ss->policy_rwlock);
3226 3362
3227 if (rc) { 3363 if (rc) {
3228 selinux_audit_rule_free(tmprule); 3364 selinux_audit_rule_free(tmprule);
@@ -3262,6 +3398,7 @@ int selinux_audit_rule_known(struct audit_krule *rule)
3262int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 3398int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
3263 struct audit_context *actx) 3399 struct audit_context *actx)
3264{ 3400{
3401 struct selinux_state *state = &selinux_state;
3265 struct context *ctxt; 3402 struct context *ctxt;
3266 struct mls_level *level; 3403 struct mls_level *level;
3267 struct selinux_audit_rule *rule = vrule; 3404 struct selinux_audit_rule *rule = vrule;
@@ -3272,14 +3409,14 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
3272 return -ENOENT; 3409 return -ENOENT;
3273 } 3410 }
3274 3411
3275 read_lock(&policy_rwlock); 3412 read_lock(&state->ss->policy_rwlock);
3276 3413
3277 if (rule->au_seqno < latest_granting) { 3414 if (rule->au_seqno < state->ss->latest_granting) {
3278 match = -ESTALE; 3415 match = -ESTALE;
3279 goto out; 3416 goto out;
3280 } 3417 }
3281 3418
3282 ctxt = sidtab_search(&sidtab, sid); 3419 ctxt = sidtab_search(&state->ss->sidtab, sid);
3283 if (unlikely(!ctxt)) { 3420 if (unlikely(!ctxt)) {
3284 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3421 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
3285 sid); 3422 sid);
@@ -3363,7 +3500,7 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
3363 } 3500 }
3364 3501
3365out: 3502out:
3366 read_unlock(&policy_rwlock); 3503 read_unlock(&state->ss->policy_rwlock);
3367 return match; 3504 return match;
3368} 3505}
3369 3506
@@ -3437,19 +3574,22 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
3437 * failure. 3574 * failure.
3438 * 3575 *
3439 */ 3576 */
3440int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 3577int security_netlbl_secattr_to_sid(struct selinux_state *state,
3578 struct netlbl_lsm_secattr *secattr,
3441 u32 *sid) 3579 u32 *sid)
3442{ 3580{
3581 struct policydb *policydb = &state->ss->policydb;
3582 struct sidtab *sidtab = &state->ss->sidtab;
3443 int rc; 3583 int rc;
3444 struct context *ctx; 3584 struct context *ctx;
3445 struct context ctx_new; 3585 struct context ctx_new;
3446 3586
3447 if (!ss_initialized) { 3587 if (!state->initialized) {
3448 *sid = SECSID_NULL; 3588 *sid = SECSID_NULL;
3449 return 0; 3589 return 0;
3450 } 3590 }
3451 3591
3452 read_lock(&policy_rwlock); 3592 read_lock(&state->ss->policy_rwlock);
3453 3593
3454 if (secattr->flags & NETLBL_SECATTR_CACHE) 3594 if (secattr->flags & NETLBL_SECATTR_CACHE)
3455 *sid = *(u32 *)secattr->cache->data; 3595 *sid = *(u32 *)secattr->cache->data;
@@ -3457,7 +3597,7 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
3457 *sid = secattr->attr.secid; 3597 *sid = secattr->attr.secid;
3458 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3598 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
3459 rc = -EIDRM; 3599 rc = -EIDRM;
3460 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG); 3600 ctx = sidtab_search(sidtab, SECINITSID_NETMSG);
3461 if (ctx == NULL) 3601 if (ctx == NULL)
3462 goto out; 3602 goto out;
3463 3603
@@ -3465,17 +3605,17 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
3465 ctx_new.user = ctx->user; 3605 ctx_new.user = ctx->user;
3466 ctx_new.role = ctx->role; 3606 ctx_new.role = ctx->role;
3467 ctx_new.type = ctx->type; 3607 ctx_new.type = ctx->type;
3468 mls_import_netlbl_lvl(&ctx_new, secattr); 3608 mls_import_netlbl_lvl(policydb, &ctx_new, secattr);
3469 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3609 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
3470 rc = mls_import_netlbl_cat(&ctx_new, secattr); 3610 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr);
3471 if (rc) 3611 if (rc)
3472 goto out; 3612 goto out;
3473 } 3613 }
3474 rc = -EIDRM; 3614 rc = -EIDRM;
3475 if (!mls_context_isvalid(&policydb, &ctx_new)) 3615 if (!mls_context_isvalid(policydb, &ctx_new))
3476 goto out_free; 3616 goto out_free;
3477 3617
3478 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid); 3618 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid);
3479 if (rc) 3619 if (rc)
3480 goto out_free; 3620 goto out_free;
3481 3621
@@ -3485,12 +3625,12 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
3485 } else 3625 } else
3486 *sid = SECSID_NULL; 3626 *sid = SECSID_NULL;
3487 3627
3488 read_unlock(&policy_rwlock); 3628 read_unlock(&state->ss->policy_rwlock);
3489 return 0; 3629 return 0;
3490out_free: 3630out_free:
3491 ebitmap_destroy(&ctx_new.range.level[0].cat); 3631 ebitmap_destroy(&ctx_new.range.level[0].cat);
3492out: 3632out:
3493 read_unlock(&policy_rwlock); 3633 read_unlock(&state->ss->policy_rwlock);
3494 return rc; 3634 return rc;
3495} 3635}
3496 3636
@@ -3504,33 +3644,35 @@ out:
3504 * Returns zero on success, negative values on failure. 3644 * Returns zero on success, negative values on failure.
3505 * 3645 *
3506 */ 3646 */
3507int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) 3647int security_netlbl_sid_to_secattr(struct selinux_state *state,
3648 u32 sid, struct netlbl_lsm_secattr *secattr)
3508{ 3649{
3650 struct policydb *policydb = &state->ss->policydb;
3509 int rc; 3651 int rc;
3510 struct context *ctx; 3652 struct context *ctx;
3511 3653
3512 if (!ss_initialized) 3654 if (!state->initialized)
3513 return 0; 3655 return 0;
3514 3656
3515 read_lock(&policy_rwlock); 3657 read_lock(&state->ss->policy_rwlock);
3516 3658
3517 rc = -ENOENT; 3659 rc = -ENOENT;
3518 ctx = sidtab_search(&sidtab, sid); 3660 ctx = sidtab_search(&state->ss->sidtab, sid);
3519 if (ctx == NULL) 3661 if (ctx == NULL)
3520 goto out; 3662 goto out;
3521 3663
3522 rc = -ENOMEM; 3664 rc = -ENOMEM;
3523 secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1), 3665 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1),
3524 GFP_ATOMIC); 3666 GFP_ATOMIC);
3525 if (secattr->domain == NULL) 3667 if (secattr->domain == NULL)
3526 goto out; 3668 goto out;
3527 3669
3528 secattr->attr.secid = sid; 3670 secattr->attr.secid = sid;
3529 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3671 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;
3530 mls_export_netlbl_lvl(ctx, secattr); 3672 mls_export_netlbl_lvl(policydb, ctx, secattr);
3531 rc = mls_export_netlbl_cat(ctx, secattr); 3673 rc = mls_export_netlbl_cat(policydb, ctx, secattr);
3532out: 3674out:
3533 read_unlock(&policy_rwlock); 3675 read_unlock(&state->ss->policy_rwlock);
3534 return rc; 3676 return rc;
3535} 3677}
3536#endif /* CONFIG_NETLABEL */ 3678#endif /* CONFIG_NETLABEL */
@@ -3541,15 +3683,17 @@ out:
3541 * @len: length of data in bytes 3683 * @len: length of data in bytes
3542 * 3684 *
3543 */ 3685 */
3544int security_read_policy(void **data, size_t *len) 3686int security_read_policy(struct selinux_state *state,
3687 void **data, size_t *len)
3545{ 3688{
3689 struct policydb *policydb = &state->ss->policydb;
3546 int rc; 3690 int rc;
3547 struct policy_file fp; 3691 struct policy_file fp;
3548 3692
3549 if (!ss_initialized) 3693 if (!state->initialized)
3550 return -EINVAL; 3694 return -EINVAL;
3551 3695
3552 *len = security_policydb_len(); 3696 *len = security_policydb_len(state);
3553 3697
3554 *data = vmalloc_user(*len); 3698 *data = vmalloc_user(*len);
3555 if (!*data) 3699 if (!*data)
@@ -3558,9 +3702,9 @@ int security_read_policy(void **data, size_t *len)
3558 fp.data = *data; 3702 fp.data = *data;
3559 fp.len = *len; 3703 fp.len = *len;
3560 3704
3561 read_lock(&policy_rwlock); 3705 read_lock(&state->ss->policy_rwlock);
3562 rc = policydb_write(&policydb, &fp); 3706 rc = policydb_write(policydb, &fp);
3563 read_unlock(&policy_rwlock); 3707 read_unlock(&state->ss->policy_rwlock);
3564 3708
3565 if (rc) 3709 if (rc)
3566 return rc; 3710 return rc;
diff --git a/security/selinux/ss/services.h b/security/selinux/ss/services.h
index 356bdd36cf6d..24c7bdcc8075 100644
--- a/security/selinux/ss/services.h
+++ b/security/selinux/ss/services.h
@@ -10,7 +10,28 @@
10#include "policydb.h" 10#include "policydb.h"
11#include "sidtab.h" 11#include "sidtab.h"
12 12
13extern struct policydb policydb; 13/* Mapping for a single class */
14struct selinux_mapping {
15 u16 value; /* policy value for class */
16 unsigned int num_perms; /* number of permissions in class */
17 u32 perms[sizeof(u32) * 8]; /* policy values for permissions */
18};
19
20/* Map for all of the classes, with array size */
21struct selinux_map {
22 struct selinux_mapping *mapping; /* indexed by class */
23 u16 size; /* array size of mapping */
24};
25
26struct selinux_ss {
27 struct sidtab sidtab;
28 struct policydb policydb;
29 rwlock_t policy_rwlock;
30 u32 latest_granting;
31 struct selinux_map map;
32 struct page *status_page;
33 struct mutex status_lock;
34};
14 35
15void services_compute_xperms_drivers(struct extended_perms *xperms, 36void services_compute_xperms_drivers(struct extended_perms *xperms,
16 struct avtab_node *node); 37 struct avtab_node *node);
@@ -19,4 +40,3 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
19 struct avtab_node *node); 40 struct avtab_node *node);
20 41
21#endif /* _SS_SERVICES_H_ */ 42#endif /* _SS_SERVICES_H_ */
22
diff --git a/security/selinux/ss/status.c b/security/selinux/ss/status.c
index d982365f9d1a..043efc59f8e4 100644
--- a/security/selinux/ss/status.c
+++ b/security/selinux/ss/status.c
@@ -35,8 +35,6 @@
35 * In most cases, application shall confirm the kernel status is not 35 * In most cases, application shall confirm the kernel status is not
36 * changed without any system call invocations. 36 * changed without any system call invocations.
37 */ 37 */
38static struct page *selinux_status_page;
39static DEFINE_MUTEX(selinux_status_lock);
40 38
41/* 39/*
42 * selinux_kernel_status_page 40 * selinux_kernel_status_page
@@ -44,21 +42,21 @@ static DEFINE_MUTEX(selinux_status_lock);
44 * It returns a reference to selinux_status_page. If the status page is 42 * It returns a reference to selinux_status_page. If the status page is
45 * not allocated yet, it also tries to allocate it at the first time. 43 * not allocated yet, it also tries to allocate it at the first time.
46 */ 44 */
47struct page *selinux_kernel_status_page(void) 45struct page *selinux_kernel_status_page(struct selinux_state *state)
48{ 46{
49 struct selinux_kernel_status *status; 47 struct selinux_kernel_status *status;
50 struct page *result = NULL; 48 struct page *result = NULL;
51 49
52 mutex_lock(&selinux_status_lock); 50 mutex_lock(&state->ss->status_lock);
53 if (!selinux_status_page) { 51 if (!state->ss->status_page) {
54 selinux_status_page = alloc_page(GFP_KERNEL|__GFP_ZERO); 52 state->ss->status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
55 53
56 if (selinux_status_page) { 54 if (state->ss->status_page) {
57 status = page_address(selinux_status_page); 55 status = page_address(state->ss->status_page);
58 56
59 status->version = SELINUX_KERNEL_STATUS_VERSION; 57 status->version = SELINUX_KERNEL_STATUS_VERSION;
60 status->sequence = 0; 58 status->sequence = 0;
61 status->enforcing = selinux_enforcing; 59 status->enforcing = is_enforcing(state);
62 /* 60 /*
63 * NOTE: the next policyload event shall set 61 * NOTE: the next policyload event shall set
64 * a positive value on the status->policyload, 62 * a positive value on the status->policyload,
@@ -66,11 +64,12 @@ struct page *selinux_kernel_status_page(void)
66 * So, application can know it was updated. 64 * So, application can know it was updated.
67 */ 65 */
68 status->policyload = 0; 66 status->policyload = 0;
69 status->deny_unknown = !security_get_allow_unknown(); 67 status->deny_unknown =
68 !security_get_allow_unknown(state);
70 } 69 }
71 } 70 }
72 result = selinux_status_page; 71 result = state->ss->status_page;
73 mutex_unlock(&selinux_status_lock); 72 mutex_unlock(&state->ss->status_lock);
74 73
75 return result; 74 return result;
76} 75}
@@ -80,13 +79,14 @@ struct page *selinux_kernel_status_page(void)
80 * 79 *
81 * It updates status of the current enforcing/permissive mode. 80 * It updates status of the current enforcing/permissive mode.
82 */ 81 */
83void selinux_status_update_setenforce(int enforcing) 82void selinux_status_update_setenforce(struct selinux_state *state,
83 int enforcing)
84{ 84{
85 struct selinux_kernel_status *status; 85 struct selinux_kernel_status *status;
86 86
87 mutex_lock(&selinux_status_lock); 87 mutex_lock(&state->ss->status_lock);
88 if (selinux_status_page) { 88 if (state->ss->status_page) {
89 status = page_address(selinux_status_page); 89 status = page_address(state->ss->status_page);
90 90
91 status->sequence++; 91 status->sequence++;
92 smp_wmb(); 92 smp_wmb();
@@ -96,7 +96,7 @@ void selinux_status_update_setenforce(int enforcing)
96 smp_wmb(); 96 smp_wmb();
97 status->sequence++; 97 status->sequence++;
98 } 98 }
99 mutex_unlock(&selinux_status_lock); 99 mutex_unlock(&state->ss->status_lock);
100} 100}
101 101
102/* 102/*
@@ -105,22 +105,23 @@ void selinux_status_update_setenforce(int enforcing)
105 * It updates status of the times of policy reloaded, and current 105 * It updates status of the times of policy reloaded, and current
106 * setting of deny_unknown. 106 * setting of deny_unknown.
107 */ 107 */
108void selinux_status_update_policyload(int seqno) 108void selinux_status_update_policyload(struct selinux_state *state,
109 int seqno)
109{ 110{
110 struct selinux_kernel_status *status; 111 struct selinux_kernel_status *status;
111 112
112 mutex_lock(&selinux_status_lock); 113 mutex_lock(&state->ss->status_lock);
113 if (selinux_status_page) { 114 if (state->ss->status_page) {
114 status = page_address(selinux_status_page); 115 status = page_address(state->ss->status_page);
115 116
116 status->sequence++; 117 status->sequence++;
117 smp_wmb(); 118 smp_wmb();
118 119
119 status->policyload = seqno; 120 status->policyload = seqno;
120 status->deny_unknown = !security_get_allow_unknown(); 121 status->deny_unknown = !security_get_allow_unknown(state);
121 122
122 smp_wmb(); 123 smp_wmb();
123 status->sequence++; 124 status->sequence++;
124 } 125 }
125 mutex_unlock(&selinux_status_lock); 126 mutex_unlock(&state->ss->status_lock);
126} 127}
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 928188902901..a5ac27de571f 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -101,7 +101,8 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
101 ctx->ctx_len = str_len; 101 ctx->ctx_len = str_len;
102 memcpy(ctx->ctx_str, &uctx[1], str_len); 102 memcpy(ctx->ctx_str, &uctx[1], str_len);
103 ctx->ctx_str[str_len] = '\0'; 103 ctx->ctx_str[str_len] = '\0';
104 rc = security_context_to_sid(ctx->ctx_str, str_len, &ctx->ctx_sid, gfp); 104 rc = security_context_to_sid(&selinux_state, ctx->ctx_str, str_len,
105 &ctx->ctx_sid, gfp);
105 if (rc) 106 if (rc)
106 goto err; 107 goto err;
107 108
@@ -352,7 +353,8 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
352 if (secid == 0) 353 if (secid == 0)
353 return -EINVAL; 354 return -EINVAL;
354 355
355 rc = security_sid_to_context(secid, &ctx_str, &str_len); 356 rc = security_sid_to_context(&selinux_state, secid, &ctx_str,
357 &str_len);
356 if (rc) 358 if (rc)
357 return rc; 359 return rc;
358 360
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-22 01:14:28 -0400