Merge mulgrave-w:git/linux-2.6

Conflicts:

	include/linux/blkdev.h

Trivial merge to incorporate tag prototypes.

1 files changed, 174 insertions, 71 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5d1b8c733199..5a66c4c09f7a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -12,6 +12,8 @@
  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  *                          <dgoeddel@trustedcs.com>
+ *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
+ *                     Paul Moore, <paul.moore@hp.com>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License version 2,
@@ -74,6 +76,7 @@
 #include "objsec.h"
 #include "netif.h"
 #include "xfrm.h"
+#include "selinux_netlabel.h"
 
 #define XATTR_SELINUX_SUFFIX "selinux"
 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
@@ -269,17 +272,17 @@ static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 {
         struct sk_security_struct *ssec;
 
-        if (family != PF_UNIX)
-                return 0;
-
         ssec = kzalloc(sizeof(*ssec), priority);
         if (!ssec)
                 return -ENOMEM;
 
         ssec->sk = sk;
         ssec->peer_sid = SECINITSID_UNLABELED;
+        ssec->sid = SECINITSID_UNLABELED;
         sk->sk_security = ssec;
 
+        selinux_netlbl_sk_security_init(ssec, family);
+
         return 0;
 }
 
@@ -287,9 +290,6 @@ static void sk_free_security(struct sock *sk)
 {
         struct sk_security_struct *ssec = sk->sk_security;
 
-        if (sk->sk_family != PF_UNIX)
-                return;
-
         sk->sk_security = NULL;
         kfree(ssec);
 }
@@ -2400,6 +2400,7 @@ static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t
 
 static int selinux_file_permission(struct file *file, int mask)
 {
+        int rc;
         struct inode *inode = file->f_dentry->d_inode;
 
         if (!mask) {
@@ -2411,8 +2412,12 @@ static int selinux_file_permission(struct file *file, int mask)
         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
                 mask |= MAY_APPEND;
 
-        return file_has_perm(current, file,
-                             file_mask_to_av(inode->i_mode, mask));
+        rc = file_has_perm(current, file,
+                           file_mask_to_av(inode->i_mode, mask));
+        if (rc)
+                return rc;
+
+        return selinux_netlbl_inode_permission(inode, mask);
 }
 
 static int selinux_file_alloc_security(struct file *file)
@@ -3063,11 +3068,13 @@ out:
         return err;
 }
 
-static void selinux_socket_post_create(struct socket *sock, int family,
-                                       int type, int protocol, int kern)
+static int selinux_socket_post_create(struct socket *sock, int family,
+                                      int type, int protocol, int kern)
 {
+        int err = 0;
         struct inode_security_struct *isec;
         struct task_security_struct *tsec;
+        struct sk_security_struct *sksec;
         u32 newsid;
 
         isec = SOCK_INODE(sock)->i_security;
@@ -3078,7 +3085,15 @@ static void selinux_socket_post_create(struct socket *sock, int family,
         isec->sid = kern ? SECINITSID_KERNEL : newsid;
         isec->initialized = 1;
 
-        return;
+        if (sock->sk) {
+                sksec = sock->sk->sk_security;
+                sksec->sid = isec->sid;
+                err = selinux_netlbl_socket_post_create(sock,
+                                                        family,
+                                                        isec->sid);
+        }
+
+        return err;
 }
 
 /* Range of port numbers used to automatically bind.
@@ -3259,7 +3274,13 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
                                   int size)
 {
-        return socket_has_perm(current, sock, SOCKET__WRITE);
+        int rc;
+
+        rc = socket_has_perm(current, sock, SOCKET__WRITE);
+        if (rc)
+                return rc;
+
+        return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
 }
 
 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
@@ -3327,8 +3348,9 @@ static int selinux_socket_unix_stream_connect(struct socket *sock,
         /* server child socket */
         ssec = newsk->sk_security;
         ssec->peer_sid = isec->sid;
-        
-        return 0;
+        err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
+
+        return err;
 }
 
 static int selinux_socket_unix_may_send(struct socket *sock,
@@ -3354,11 +3376,29 @@ static int selinux_socket_unix_may_send(struct socket *sock,
 }
 
 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
-                struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
-                u16 family, char *addrp, int len)
+                struct avc_audit_data *ad, u16 family, char *addrp, int len)
 {
         int err = 0;
         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
+        struct socket *sock;
+        u16 sock_class = 0;
+        u32 sock_sid = 0;
+
+        read_lock_bh(&sk->sk_callback_lock);
+        sock = sk->sk_socket;
+        if (sock) {
+                struct inode *inode;
+                inode = SOCK_INODE(sock);
+                if (inode) {
+                        struct inode_security_struct *isec;
+                        isec = inode->i_security;
+                        sock_sid = isec->sid;
+                        sock_class = isec->sclass;
+                }
+        }
+        read_unlock_bh(&sk->sk_callback_lock);
+        if (!sock_sid)
+                goto out;
 
         if (!skb->dev)
                 goto out;
@@ -3418,12 +3458,10 @@ out:
 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         u16 family;
-        u16 sock_class = 0;
         char *addrp;
         int len, err = 0;
-        u32 sock_sid = 0;
-        struct socket *sock;
         struct avc_audit_data ad;
+        struct sk_security_struct *sksec = sk->sk_security;
 
         family = sk->sk_family;
         if (family != PF_INET && family != PF_INET6)
@@ -3433,22 +3471,6 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
                 family = PF_INET;
 
-        read_lock_bh(&sk->sk_callback_lock);
-        sock = sk->sk_socket;
-        if (sock) {
-                struct inode *inode;
-                inode = SOCK_INODE(sock);
-                if (inode) {
-                        struct inode_security_struct *isec;
-                        isec = inode->i_security;
-                        sock_sid = isec->sid;
-                        sock_class = isec->sclass;
-                }
-        }
-        read_unlock_bh(&sk->sk_callback_lock);
-        if (!sock_sid)
-                goto out;
-
         AVC_AUDIT_DATA_INIT(&ad, NET);
         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
         ad.u.net.family = family;
@@ -3458,16 +3480,19 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 goto out;
 
         if (selinux_compat_net)
-                err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
-                                                  sock_class, family,
+                err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
                                                   addrp, len);
         else
-                err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
+                err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
                                    PACKET__RECV, &ad);
         if (err)
                 goto out;
 
-        err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
+        err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
+        if (err)
+                goto out;
+
+        err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
 out:    
         return err;
 }
@@ -3490,8 +3515,9 @@ static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *op
                 peer_sid = ssec->peer_sid;
         }
         else if (isec->sclass == SECCLASS_TCP_SOCKET) {
-                peer_sid = selinux_socket_getpeer_stream(sock->sk);
-
+                peer_sid = selinux_netlbl_socket_getpeersec_stream(sock);
+                if (peer_sid == SECSID_NULL)
+                        peer_sid = selinux_socket_getpeer_stream(sock->sk);
                 if (peer_sid == SECSID_NULL) {
                         err = -ENOPROTOOPT;
                         goto out;
@@ -3531,8 +3557,11 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *
 
         if (sock && (sock->sk->sk_family == PF_UNIX))
                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
-        else if (skb)
-                peer_secid = selinux_socket_getpeer_dgram(skb);
+        else if (skb) {
+                peer_secid = selinux_netlbl_socket_getpeersec_dgram(skb);
+                if (peer_secid == SECSID_NULL)
+                        peer_secid = selinux_socket_getpeer_dgram(skb);
+        }
 
         if (peer_secid == SECSID_NULL)
                 err = -EINVAL;
@@ -3551,22 +3580,86 @@ static void selinux_sk_free_security(struct sock *sk)
         sk_free_security(sk);
 }
 
-static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
+static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
 {
-        struct inode_security_struct *isec;
-        u32 sock_sid = SECINITSID_ANY_SOCKET;
+        struct sk_security_struct *ssec = sk->sk_security;
+        struct sk_security_struct *newssec = newsk->sk_security;
+
+        newssec->sid = ssec->sid;
+        newssec->peer_sid = ssec->peer_sid;
 
+        selinux_netlbl_sk_clone_security(ssec, newssec);
+}
+
+static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
+{
         if (!sk)
-                return selinux_no_sk_sid(fl);
+                *secid = SECINITSID_ANY_SOCKET;
+        else {
+                struct sk_security_struct *sksec = sk->sk_security;
+
+                *secid = sksec->sid;
+        }
+}
+
+static void selinux_sock_graft(struct sock* sk, struct socket *parent)
+{
+        struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
+        struct sk_security_struct *sksec = sk->sk_security;
+
+        isec->sid = sksec->sid;
+
+        selinux_netlbl_sock_graft(sk, parent);
+}
+
+static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
+                                     struct request_sock *req)
+{
+        struct sk_security_struct *sksec = sk->sk_security;
+        int err;
+        u32 newsid;
+        u32 peersid;
+
+        newsid = selinux_netlbl_inet_conn_request(skb, sksec->sid);
+        if (newsid != SECSID_NULL) {
+                req->secid = newsid;
+                return 0;
+        }
+
+        err = selinux_xfrm_decode_session(skb, &peersid, 0);
+        BUG_ON(err);
+
+        if (peersid == SECSID_NULL) {
+                req->secid = sksec->sid;
+                return 0;
+        }
+
+        err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
+        if (err)
+                return err;
+
+        req->secid = newsid;
+        return 0;
+}
+
+static void selinux_inet_csk_clone(struct sock *newsk,
+                                   const struct request_sock *req)
+{
+        struct sk_security_struct *newsksec = newsk->sk_security;
 
-        read_lock_bh(&sk->sk_callback_lock);
-        isec = get_sock_isec(sk);
+        newsksec->sid = req->secid;
+        /* NOTE: Ideally, we should also get the isec->sid for the
+           new socket in sync, but we don't have the isec available yet.
+           So we will wait until sock_graft to do it, by which
+           time it will have been created and available. */
 
-        if (isec)
-                sock_sid = isec->sid;
+        selinux_netlbl_sk_security_init(newsksec, req->rsk_ops->family);
+}
 
-        read_unlock_bh(&sk->sk_callback_lock);
-        return sock_sid;
+static void selinux_req_classify_flow(const struct request_sock *req,
+                                      struct flowi *fl)
+{
+        fl->secid = req->secid;
 }
 
 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
@@ -3608,12 +3701,24 @@ out:
 #ifdef CONFIG_NETFILTER
 
 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
-                                            struct inode_security_struct *isec,
                                             struct avc_audit_data *ad,
                                             u16 family, char *addrp, int len)
 {
-        int err;
+        int err = 0;
         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
+        struct socket *sock;
+        struct inode *inode;
+        struct inode_security_struct *isec;
+
+        sock = sk->sk_socket;
+        if (!sock)
+                goto out;
+
+        inode = SOCK_INODE(sock);
+        if (!inode)
+                goto out;
+
+        isec = inode->i_security;
         
         err = sel_netif_sids(dev, &if_sid, NULL);
         if (err)
@@ -3678,26 +3783,16 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
         char *addrp;
         int len, err = 0;
         struct sock *sk;
-        struct socket *sock;
-        struct inode *inode;
         struct sk_buff *skb = *pskb;
-        struct inode_security_struct *isec;
         struct avc_audit_data ad;
         struct net_device *dev = (struct net_device *)out;
+        struct sk_security_struct *sksec;
 
         sk = skb->sk;
         if (!sk)
                 goto out;
 
-        sock = sk->sk_socket;
-        if (!sock)
-                goto out;
-
-        inode = SOCK_INODE(sock);
-        if (!inode)
-                goto out;
-
-        isec = inode->i_security;
+        sksec = sk->sk_security;
 
         AVC_AUDIT_DATA_INIT(&ad, NET);
         ad.u.net.netif = dev->name;
@@ -3708,16 +3803,16 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
                 goto out;
 
         if (selinux_compat_net)
-                err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
+                err = selinux_ip_postroute_last_compat(sk, dev, &ad,
                                                        family, addrp, len);
         else
-                err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
+                err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
                                    PACKET__SEND, &ad);
 
         if (err)
                 goto out;
 
-        err = selinux_xfrm_postroute_last(isec->sid, skb);
+        err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad);
 out:
         return err ? NF_DROP : NF_ACCEPT;
 }
@@ -4618,7 +4713,12 @@ static struct security_operations selinux_ops = {
         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
         .sk_alloc_security =            selinux_sk_alloc_security,
         .sk_free_security =             selinux_sk_free_security,
-        .sk_getsid =                    selinux_sk_getsid_security,
+        .sk_clone_security =            selinux_sk_clone_security,
+        .sk_getsecid =                  selinux_sk_getsecid,
+        .sock_graft =                   selinux_sock_graft,
+        .inet_conn_request =            selinux_inet_conn_request,
+        .inet_csk_clone =               selinux_inet_csk_clone,
+        .req_classify_flow =            selinux_req_classify_flow,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
@@ -4629,6 +4729,9 @@ static struct security_operations selinux_ops = {
         .xfrm_state_free_security =     selinux_xfrm_state_free,
         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
+        .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
+        .xfrm_flow_state_match =        selinux_xfrm_flow_state_match,
+        .xfrm_decode_session =          selinux_xfrm_decode_session,
 #endif
 
 #ifdef CONFIG_KEYS