aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--MAINTAINERS4
-rw-r--r--net/ipv4/cipso_ipv4.c41
-rw-r--r--net/netlabel/netlabel_kapi.c3
-rw-r--r--security/selinux/Makefile2
-rw-r--r--security/selinux/avc.c2
-rw-r--r--security/selinux/hooks.c38
-rw-r--r--security/selinux/include/av_perm_to_string.h102
-rw-r--r--security/selinux/include/av_permissions.h179
-rw-r--r--security/selinux/include/class_to_string.h34
-rw-r--r--security/selinux/include/flask.h16
-rw-r--r--security/selinux/include/netlabel.h (renamed from security/selinux/include/selinux_netlabel.h)71
-rw-r--r--security/selinux/include/security.h29
-rw-r--r--security/selinux/netlabel.c363
-rw-r--r--security/selinux/selinuxfs.c85
-rw-r--r--security/selinux/ss/services.c499
15 files changed, 695 insertions, 773 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 2e83c82aa13d..5519d257b556 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2980,8 +2980,10 @@ P: Stephen Smalley
2980M: sds@tycho.nsa.gov 2980M: sds@tycho.nsa.gov
2981P: James Morris 2981P: James Morris
2982M: jmorris@namei.org 2982M: jmorris@namei.org
2983P: Eric Paris
2984M: eparis@parisplace.org
2983L: linux-kernel@vger.kernel.org (kernel issues) 2985L: linux-kernel@vger.kernel.org (kernel issues)
2984L: selinux@tycho.nsa.gov (general discussion) 2986L: selinux@tycho.nsa.gov (subscribers-only, general discussion)
2985W: http://www.nsa.gov/selinux 2987W: http://www.nsa.gov/selinux
2986S: Supported 2988S: Supported
2987 2989
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 11a3404d65af..e1f18489db1d 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -92,6 +92,33 @@ int cipso_v4_rbm_optfmt = 0;
92int cipso_v4_rbm_strictvalid = 1; 92int cipso_v4_rbm_strictvalid = 1;
93 93
94/* 94/*
95 * Protocol Constants
96 */
97
98/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
99 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
100#define CIPSO_V4_OPT_LEN_MAX 40
101
102/* Length of the base CIPSO option, this includes the option type (1 byte), the
103 * option length (1 byte), and the DOI (4 bytes). */
104#define CIPSO_V4_HDR_LEN 6
105
106/* Base length of the restrictive category bitmap tag (tag #1). */
107#define CIPSO_V4_TAG_RBM_BLEN 4
108
109/* Base length of the enumerated category tag (tag #2). */
110#define CIPSO_V4_TAG_ENUM_BLEN 4
111
112/* Base length of the ranged categories bitmap tag (tag #5). */
113#define CIPSO_V4_TAG_RNG_BLEN 4
114/* The maximum number of category ranges permitted in the ranged category tag
115 * (tag #5). You may note that the IETF draft states that the maximum number
116 * of category ranges is 7, but if the low end of the last category range is
117 * zero then it is possibile to fit 8 category ranges because the zero should
118 * be omitted. */
119#define CIPSO_V4_TAG_RNG_CAT_MAX 8
120
121/*
95 * Helper Functions 122 * Helper Functions
96 */ 123 */
97 124
@@ -1109,16 +1136,15 @@ static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1109 unsigned char *net_cat, 1136 unsigned char *net_cat,
1110 u32 net_cat_len) 1137 u32 net_cat_len)
1111{ 1138{
1112 /* The constant '16' is not random, it is the maximum number of
1113 * high/low category range pairs as permitted by the CIPSO draft based
1114 * on a maximum IPv4 header length of 60 bytes - the BUG_ON() assertion
1115 * does a sanity check to make sure we don't overflow the array. */
1116 int iter = -1; 1139 int iter = -1;
1117 u16 array[16]; 1140 u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1118 u32 array_cnt = 0; 1141 u32 array_cnt = 0;
1119 u32 cat_size = 0; 1142 u32 cat_size = 0;
1120 1143
1121 BUG_ON(net_cat_len > 30); 1144 /* make sure we don't overflow the 'array[]' variable */
1145 if (net_cat_len >
1146 (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1147 return -ENOSPC;
1122 1148
1123 for (;;) { 1149 for (;;) {
1124 iter = netlbl_secattr_catmap_walk(secattr->mls_cat, iter + 1); 1150 iter = netlbl_secattr_catmap_walk(secattr->mls_cat, iter + 1);
@@ -1196,9 +1222,6 @@ static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1196 * Protocol Handling Functions 1222 * Protocol Handling Functions
1197 */ 1223 */
1198 1224
1199#define CIPSO_V4_OPT_LEN_MAX 40
1200#define CIPSO_V4_HDR_LEN 6
1201
1202/** 1225/**
1203 * cipso_v4_gentag_hdr - Generate a CIPSO option header 1226 * cipso_v4_gentag_hdr - Generate a CIPSO option header
1204 * @doi_def: the DOI definition 1227 * @doi_def: the DOI definition
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index e03a3282c551..f2535e7f2869 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -263,9 +263,6 @@ int netlbl_socket_setattr(const struct socket *sock,
263 int ret_val = -ENOENT; 263 int ret_val = -ENOENT;
264 struct netlbl_dom_map *dom_entry; 264 struct netlbl_dom_map *dom_entry;
265 265
266 if ((secattr->flags & NETLBL_SECATTR_DOMAIN) == 0)
267 return -ENOENT;
268
269 rcu_read_lock(); 266 rcu_read_lock();
270 dom_entry = netlbl_domhsh_getentry(secattr->domain); 267 dom_entry = netlbl_domhsh_getentry(secattr->domain);
271 if (dom_entry == NULL) 268 if (dom_entry == NULL)
diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index faf2e02e4410..dc3502e30b19 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -8,5 +8,7 @@ selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o exports.o
8 8
9selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o 9selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o
10 10
11selinux-$(CONFIG_NETLABEL) += netlabel.o
12
11EXTRA_CFLAGS += -Isecurity/selinux/include 13EXTRA_CFLAGS += -Isecurity/selinux/include
12 14
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index da8caf10ef97..e4396a89edc6 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -217,6 +217,8 @@ static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tcla
217 audit_log_format(ab, " tcontext=%s", scontext); 217 audit_log_format(ab, " tcontext=%s", scontext);
218 kfree(scontext); 218 kfree(scontext);
219 } 219 }
220
221 BUG_ON(tclass >= ARRAY_SIZE(class_to_string) || !class_to_string[tclass]);
220 audit_log_format(ab, " tclass=%s", class_to_string[tclass]); 222 audit_log_format(ab, " tclass=%s", class_to_string[tclass]);
221} 223}
222 224
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5f02b4be1917..885a9a958b8d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -77,7 +77,7 @@
77#include "objsec.h" 77#include "objsec.h"
78#include "netif.h" 78#include "netif.h"
79#include "xfrm.h" 79#include "xfrm.h"
80#include "selinux_netlabel.h" 80#include "netlabel.h"
81 81
82#define XATTR_SELINUX_SUFFIX "selinux" 82#define XATTR_SELINUX_SUFFIX "selinux"
83#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX 83#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
@@ -3123,6 +3123,34 @@ static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3123 return ret; 3123 return ret;
3124} 3124}
3125 3125
3126/**
3127 * selinux_skb_extlbl_sid - Determine the external label of a packet
3128 * @skb: the packet
3129 * @base_sid: the SELinux SID to use as a context for MLS only external labels
3130 * @sid: the packet's SID
3131 *
3132 * Description:
3133 * Check the various different forms of external packet labeling and determine
3134 * the external SID for the packet.
3135 *
3136 */
3137static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3138 u32 base_sid,
3139 u32 *sid)
3140{
3141 u32 xfrm_sid;
3142 u32 nlbl_sid;
3143
3144 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3145 if (selinux_netlbl_skbuff_getsid(skb,
3146 (xfrm_sid == SECSID_NULL ?
3147 base_sid : xfrm_sid),
3148 &nlbl_sid) != 0)
3149 nlbl_sid = SECSID_NULL;
3150
3151 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3152}
3153
3126/* socket security operations */ 3154/* socket security operations */
3127static int socket_has_perm(struct task_struct *task, struct socket *sock, 3155static int socket_has_perm(struct task_struct *task, struct socket *sock,
3128 u32 perms) 3156 u32 perms)
@@ -3664,9 +3692,7 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *
3664 if (sock && sock->sk->sk_family == PF_UNIX) 3692 if (sock && sock->sk->sk_family == PF_UNIX)
3665 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid); 3693 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3666 else if (skb) 3694 else if (skb)
3667 security_skb_extlbl_sid(skb, 3695 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3668 SECINITSID_UNLABELED,
3669 &peer_secid);
3670 3696
3671 if (peer_secid == SECSID_NULL) 3697 if (peer_secid == SECSID_NULL)
3672 err = -EINVAL; 3698 err = -EINVAL;
@@ -3727,7 +3753,7 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3727 u32 newsid; 3753 u32 newsid;
3728 u32 peersid; 3754 u32 peersid;
3729 3755
3730 security_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid); 3756 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3731 if (peersid == SECSID_NULL) { 3757 if (peersid == SECSID_NULL) {
3732 req->secid = sksec->sid; 3758 req->secid = sksec->sid;
3733 req->peer_secid = SECSID_NULL; 3759 req->peer_secid = SECSID_NULL;
@@ -3765,7 +3791,7 @@ static void selinux_inet_conn_established(struct sock *sk,
3765{ 3791{
3766 struct sk_security_struct *sksec = sk->sk_security; 3792 struct sk_security_struct *sksec = sk->sk_security;
3767 3793
3768 security_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid); 3794 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3769} 3795}
3770 3796
3771static void selinux_req_classify_flow(const struct request_sock *req, 3797static void selinux_req_classify_flow(const struct request_sock *req,
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index ad9fb2d69b50..b83e74012a97 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -128,96 +128,6 @@
128 S_(SECCLASS_CAPABILITY, CAPABILITY__LEASE, "lease") 128 S_(SECCLASS_CAPABILITY, CAPABILITY__LEASE, "lease")
129 S_(SECCLASS_CAPABILITY, CAPABILITY__AUDIT_WRITE, "audit_write") 129 S_(SECCLASS_CAPABILITY, CAPABILITY__AUDIT_WRITE, "audit_write")
130 S_(SECCLASS_CAPABILITY, CAPABILITY__AUDIT_CONTROL, "audit_control") 130 S_(SECCLASS_CAPABILITY, CAPABILITY__AUDIT_CONTROL, "audit_control")
131 S_(SECCLASS_PASSWD, PASSWD__PASSWD, "passwd")
132 S_(SECCLASS_PASSWD, PASSWD__CHFN, "chfn")
133 S_(SECCLASS_PASSWD, PASSWD__CHSH, "chsh")
134 S_(SECCLASS_PASSWD, PASSWD__ROOTOK, "rootok")
135 S_(SECCLASS_PASSWD, PASSWD__CRONTAB, "crontab")
136 S_(SECCLASS_DRAWABLE, DRAWABLE__CREATE, "create")
137 S_(SECCLASS_DRAWABLE, DRAWABLE__DESTROY, "destroy")
138 S_(SECCLASS_DRAWABLE, DRAWABLE__DRAW, "draw")
139 S_(SECCLASS_DRAWABLE, DRAWABLE__COPY, "copy")
140 S_(SECCLASS_DRAWABLE, DRAWABLE__GETATTR, "getattr")
141 S_(SECCLASS_GC, GC__CREATE, "create")
142 S_(SECCLASS_GC, GC__FREE, "free")
143 S_(SECCLASS_GC, GC__GETATTR, "getattr")
144 S_(SECCLASS_GC, GC__SETATTR, "setattr")
145 S_(SECCLASS_WINDOW, WINDOW__ADDCHILD, "addchild")
146 S_(SECCLASS_WINDOW, WINDOW__CREATE, "create")
147 S_(SECCLASS_WINDOW, WINDOW__DESTROY, "destroy")
148 S_(SECCLASS_WINDOW, WINDOW__MAP, "map")
149 S_(SECCLASS_WINDOW, WINDOW__UNMAP, "unmap")
150 S_(SECCLASS_WINDOW, WINDOW__CHSTACK, "chstack")
151 S_(SECCLASS_WINDOW, WINDOW__CHPROPLIST, "chproplist")
152 S_(SECCLASS_WINDOW, WINDOW__CHPROP, "chprop")
153 S_(SECCLASS_WINDOW, WINDOW__LISTPROP, "listprop")
154 S_(SECCLASS_WINDOW, WINDOW__GETATTR, "getattr")
155 S_(SECCLASS_WINDOW, WINDOW__SETATTR, "setattr")
156 S_(SECCLASS_WINDOW, WINDOW__SETFOCUS, "setfocus")
157 S_(SECCLASS_WINDOW, WINDOW__MOVE, "move")
158 S_(SECCLASS_WINDOW, WINDOW__CHSELECTION, "chselection")
159 S_(SECCLASS_WINDOW, WINDOW__CHPARENT, "chparent")
160 S_(SECCLASS_WINDOW, WINDOW__CTRLLIFE, "ctrllife")
161 S_(SECCLASS_WINDOW, WINDOW__ENUMERATE, "enumerate")
162 S_(SECCLASS_WINDOW, WINDOW__TRANSPARENT, "transparent")
163 S_(SECCLASS_WINDOW, WINDOW__MOUSEMOTION, "mousemotion")
164 S_(SECCLASS_WINDOW, WINDOW__CLIENTCOMEVENT, "clientcomevent")
165 S_(SECCLASS_WINDOW, WINDOW__INPUTEVENT, "inputevent")
166 S_(SECCLASS_WINDOW, WINDOW__DRAWEVENT, "drawevent")
167 S_(SECCLASS_WINDOW, WINDOW__WINDOWCHANGEEVENT, "windowchangeevent")
168 S_(SECCLASS_WINDOW, WINDOW__WINDOWCHANGEREQUEST, "windowchangerequest")
169 S_(SECCLASS_WINDOW, WINDOW__SERVERCHANGEEVENT, "serverchangeevent")
170 S_(SECCLASS_WINDOW, WINDOW__EXTENSIONEVENT, "extensionevent")
171 S_(SECCLASS_FONT, FONT__LOAD, "load")
172 S_(SECCLASS_FONT, FONT__FREE, "free")
173 S_(SECCLASS_FONT, FONT__GETATTR, "getattr")
174 S_(SECCLASS_FONT, FONT__USE, "use")
175 S_(SECCLASS_COLORMAP, COLORMAP__CREATE, "create")
176 S_(SECCLASS_COLORMAP, COLORMAP__FREE, "free")
177 S_(SECCLASS_COLORMAP, COLORMAP__INSTALL, "install")
178 S_(SECCLASS_COLORMAP, COLORMAP__UNINSTALL, "uninstall")
179 S_(SECCLASS_COLORMAP, COLORMAP__LIST, "list")
180 S_(SECCLASS_COLORMAP, COLORMAP__READ, "read")
181 S_(SECCLASS_COLORMAP, COLORMAP__STORE, "store")
182 S_(SECCLASS_COLORMAP, COLORMAP__GETATTR, "getattr")
183 S_(SECCLASS_COLORMAP, COLORMAP__SETATTR, "setattr")
184 S_(SECCLASS_PROPERTY, PROPERTY__CREATE, "create")
185 S_(SECCLASS_PROPERTY, PROPERTY__FREE, "free")
186 S_(SECCLASS_PROPERTY, PROPERTY__READ, "read")
187 S_(SECCLASS_PROPERTY, PROPERTY__WRITE, "write")
188 S_(SECCLASS_CURSOR, CURSOR__CREATE, "create")
189 S_(SECCLASS_CURSOR, CURSOR__CREATEGLYPH, "createglyph")
190 S_(SECCLASS_CURSOR, CURSOR__FREE, "free")
191 S_(SECCLASS_CURSOR, CURSOR__ASSIGN, "assign")
192 S_(SECCLASS_CURSOR, CURSOR__SETATTR, "setattr")
193 S_(SECCLASS_XCLIENT, XCLIENT__KILL, "kill")
194 S_(SECCLASS_XINPUT, XINPUT__LOOKUP, "lookup")
195 S_(SECCLASS_XINPUT, XINPUT__GETATTR, "getattr")
196 S_(SECCLASS_XINPUT, XINPUT__SETATTR, "setattr")
197 S_(SECCLASS_XINPUT, XINPUT__SETFOCUS, "setfocus")
198 S_(SECCLASS_XINPUT, XINPUT__WARPPOINTER, "warppointer")
199 S_(SECCLASS_XINPUT, XINPUT__ACTIVEGRAB, "activegrab")
200 S_(SECCLASS_XINPUT, XINPUT__PASSIVEGRAB, "passivegrab")
201 S_(SECCLASS_XINPUT, XINPUT__UNGRAB, "ungrab")
202 S_(SECCLASS_XINPUT, XINPUT__BELL, "bell")
203 S_(SECCLASS_XINPUT, XINPUT__MOUSEMOTION, "mousemotion")
204 S_(SECCLASS_XINPUT, XINPUT__RELABELINPUT, "relabelinput")
205 S_(SECCLASS_XSERVER, XSERVER__SCREENSAVER, "screensaver")
206 S_(SECCLASS_XSERVER, XSERVER__GETHOSTLIST, "gethostlist")
207 S_(SECCLASS_XSERVER, XSERVER__SETHOSTLIST, "sethostlist")
208 S_(SECCLASS_XSERVER, XSERVER__GETFONTPATH, "getfontpath")
209 S_(SECCLASS_XSERVER, XSERVER__SETFONTPATH, "setfontpath")
210 S_(SECCLASS_XSERVER, XSERVER__GETATTR, "getattr")
211 S_(SECCLASS_XSERVER, XSERVER__GRAB, "grab")
212 S_(SECCLASS_XSERVER, XSERVER__UNGRAB, "ungrab")
213 S_(SECCLASS_XEXTENSION, XEXTENSION__QUERY, "query")
214 S_(SECCLASS_XEXTENSION, XEXTENSION__USE, "use")
215 S_(SECCLASS_PAX, PAX__PAGEEXEC, "pageexec")
216 S_(SECCLASS_PAX, PAX__EMUTRAMP, "emutramp")
217 S_(SECCLASS_PAX, PAX__MPROTECT, "mprotect")
218 S_(SECCLASS_PAX, PAX__RANDMMAP, "randmmap")
219 S_(SECCLASS_PAX, PAX__RANDEXEC, "randexec")
220 S_(SECCLASS_PAX, PAX__SEGMEXEC, "segmexec")
221 S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_READ, "nlmsg_read") 131 S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_READ, "nlmsg_read")
222 S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_WRITE, "nlmsg_write") 132 S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_WRITE, "nlmsg_write")
223 S_(SECCLASS_NETLINK_FIREWALL_SOCKET, NETLINK_FIREWALL_SOCKET__NLMSG_READ, "nlmsg_read") 133 S_(SECCLASS_NETLINK_FIREWALL_SOCKET, NETLINK_FIREWALL_SOCKET__NLMSG_READ, "nlmsg_read")
@@ -232,16 +142,6 @@
232 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV, "nlmsg_readpriv") 142 S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV, "nlmsg_readpriv")
233 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read") 143 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read")
234 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write") 144 S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write")
235 S_(SECCLASS_DBUS, DBUS__ACQUIRE_SVC, "acquire_svc")
236 S_(SECCLASS_DBUS, DBUS__SEND_MSG, "send_msg")
237 S_(SECCLASS_NSCD, NSCD__GETPWD, "getpwd")
238 S_(SECCLASS_NSCD, NSCD__GETGRP, "getgrp")
239 S_(SECCLASS_NSCD, NSCD__GETHOST, "gethost")
240 S_(SECCLASS_NSCD, NSCD__GETSTAT, "getstat")
241 S_(SECCLASS_NSCD, NSCD__ADMIN, "admin")
242 S_(SECCLASS_NSCD, NSCD__SHMEMPWD, "shmempwd")
243 S_(SECCLASS_NSCD, NSCD__SHMEMGRP, "shmemgrp")
244 S_(SECCLASS_NSCD, NSCD__SHMEMHOST, "shmemhost")
245 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, "sendto") 145 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, "sendto")
246 S_(SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, "recvfrom") 146 S_(SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, "recvfrom")
247 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, "setcontext") 147 S_(SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, "setcontext")
@@ -256,7 +156,5 @@
256 S_(SECCLASS_KEY, KEY__LINK, "link") 156 S_(SECCLASS_KEY, KEY__LINK, "link")
257 S_(SECCLASS_KEY, KEY__SETATTR, "setattr") 157 S_(SECCLASS_KEY, KEY__SETATTR, "setattr")
258 S_(SECCLASS_KEY, KEY__CREATE, "create") 158 S_(SECCLASS_KEY, KEY__CREATE, "create")
259 S_(SECCLASS_CONTEXT, CONTEXT__TRANSLATE, "translate")
260 S_(SECCLASS_CONTEXT, CONTEXT__CONTAINS, "contains")
261 S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NODE_BIND, "node_bind") 159 S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NODE_BIND, "node_bind")
262 S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect") 160 S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index 2de4b5fe3aa1..5fee1735bffe 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -16,7 +16,6 @@
16#define COMMON_FILE__SWAPON 0x00004000UL 16#define COMMON_FILE__SWAPON 0x00004000UL
17#define COMMON_FILE__QUOTAON 0x00008000UL 17#define COMMON_FILE__QUOTAON 0x00008000UL
18#define COMMON_FILE__MOUNTON 0x00010000UL 18#define COMMON_FILE__MOUNTON 0x00010000UL
19
20#define COMMON_SOCKET__IOCTL 0x00000001UL 19#define COMMON_SOCKET__IOCTL 0x00000001UL
21#define COMMON_SOCKET__READ 0x00000002UL 20#define COMMON_SOCKET__READ 0x00000002UL
22#define COMMON_SOCKET__WRITE 0x00000004UL 21#define COMMON_SOCKET__WRITE 0x00000004UL
@@ -39,7 +38,6 @@
39#define COMMON_SOCKET__RECV_MSG 0x00080000UL 38#define COMMON_SOCKET__RECV_MSG 0x00080000UL
40#define COMMON_SOCKET__SEND_MSG 0x00100000UL 39#define COMMON_SOCKET__SEND_MSG 0x00100000UL
41#define COMMON_SOCKET__NAME_BIND 0x00200000UL 40#define COMMON_SOCKET__NAME_BIND 0x00200000UL
42
43#define COMMON_IPC__CREATE 0x00000001UL 41#define COMMON_IPC__CREATE 0x00000001UL
44#define COMMON_IPC__DESTROY 0x00000002UL 42#define COMMON_IPC__DESTROY 0x00000002UL
45#define COMMON_IPC__GETATTR 0x00000004UL 43#define COMMON_IPC__GETATTR 0x00000004UL
@@ -49,7 +47,6 @@
49#define COMMON_IPC__ASSOCIATE 0x00000040UL 47#define COMMON_IPC__ASSOCIATE 0x00000040UL
50#define COMMON_IPC__UNIX_READ 0x00000080UL 48#define COMMON_IPC__UNIX_READ 0x00000080UL
51#define COMMON_IPC__UNIX_WRITE 0x00000100UL 49#define COMMON_IPC__UNIX_WRITE 0x00000100UL
52
53#define FILESYSTEM__MOUNT 0x00000001UL 50#define FILESYSTEM__MOUNT 0x00000001UL
54#define FILESYSTEM__REMOUNT 0x00000002UL 51#define FILESYSTEM__REMOUNT 0x00000002UL
55#define FILESYSTEM__UNMOUNT 0x00000004UL 52#define FILESYSTEM__UNMOUNT 0x00000004UL
@@ -60,7 +57,6 @@
60#define FILESYSTEM__ASSOCIATE 0x00000080UL 57#define FILESYSTEM__ASSOCIATE 0x00000080UL
61#define FILESYSTEM__QUOTAMOD 0x00000100UL 58#define FILESYSTEM__QUOTAMOD 0x00000100UL
62#define FILESYSTEM__QUOTAGET 0x00000200UL 59#define FILESYSTEM__QUOTAGET 0x00000200UL
63
64#define DIR__IOCTL 0x00000001UL 60#define DIR__IOCTL 0x00000001UL
65#define DIR__READ 0x00000002UL 61#define DIR__READ 0x00000002UL
66#define DIR__WRITE 0x00000004UL 62#define DIR__WRITE 0x00000004UL
@@ -78,13 +74,11 @@
78#define DIR__SWAPON 0x00004000UL 74#define DIR__SWAPON 0x00004000UL
79#define DIR__QUOTAON 0x00008000UL 75#define DIR__QUOTAON 0x00008000UL
80#define DIR__MOUNTON 0x00010000UL 76#define DIR__MOUNTON 0x00010000UL
81
82#define DIR__ADD_NAME 0x00020000UL 77#define DIR__ADD_NAME 0x00020000UL
83#define DIR__REMOVE_NAME 0x00040000UL 78#define DIR__REMOVE_NAME 0x00040000UL
84#define DIR__REPARENT 0x00080000UL 79#define DIR__REPARENT 0x00080000UL
85#define DIR__SEARCH 0x00100000UL 80#define DIR__SEARCH 0x00100000UL
86#define DIR__RMDIR 0x00200000UL 81#define DIR__RMDIR 0x00200000UL
87
88#define FILE__IOCTL 0x00000001UL 82#define FILE__IOCTL 0x00000001UL
89#define FILE__READ 0x00000002UL 83#define FILE__READ 0x00000002UL
90#define FILE__WRITE 0x00000004UL 84#define FILE__WRITE 0x00000004UL
@@ -102,11 +96,9 @@
102#define FILE__SWAPON 0x00004000UL 96#define FILE__SWAPON 0x00004000UL
103#define FILE__QUOTAON 0x00008000UL 97#define FILE__QUOTAON 0x00008000UL
104#define FILE__MOUNTON 0x00010000UL 98#define FILE__MOUNTON 0x00010000UL
105
106#define FILE__EXECUTE_NO_TRANS 0x00020000UL 99#define FILE__EXECUTE_NO_TRANS 0x00020000UL
107#define FILE__ENTRYPOINT 0x00040000UL 100#define FILE__ENTRYPOINT 0x00040000UL
108#define FILE__EXECMOD 0x00080000UL 101#define FILE__EXECMOD 0x00080000UL
109
110#define LNK_FILE__IOCTL 0x00000001UL 102#define LNK_FILE__IOCTL 0x00000001UL
111#define LNK_FILE__READ 0x00000002UL 103#define LNK_FILE__READ 0x00000002UL
112#define LNK_FILE__WRITE 0x00000004UL 104#define LNK_FILE__WRITE 0x00000004UL
@@ -124,7 +116,6 @@
124#define LNK_FILE__SWAPON 0x00004000UL 116#define LNK_FILE__SWAPON 0x00004000UL
125#define LNK_FILE__QUOTAON 0x00008000UL 117#define LNK_FILE__QUOTAON 0x00008000UL
126#define LNK_FILE__MOUNTON 0x00010000UL 118#define LNK_FILE__MOUNTON 0x00010000UL
127
128#define CHR_FILE__IOCTL 0x00000001UL 119#define CHR_FILE__IOCTL 0x00000001UL
129#define CHR_FILE__READ 0x00000002UL 120#define CHR_FILE__READ 0x00000002UL
130#define CHR_FILE__WRITE 0x00000004UL 121#define CHR_FILE__WRITE 0x00000004UL
@@ -142,11 +133,9 @@
142#define CHR_FILE__SWAPON 0x00004000UL 133#define CHR_FILE__SWAPON 0x00004000UL
143#define CHR_FILE__QUOTAON 0x00008000UL 134#define CHR_FILE__QUOTAON 0x00008000UL
144#define CHR_FILE__MOUNTON 0x00010000UL 135#define CHR_FILE__MOUNTON 0x00010000UL
145
146#define CHR_FILE__EXECUTE_NO_TRANS 0x00020000UL 136#define CHR_FILE__EXECUTE_NO_TRANS 0x00020000UL
147#define CHR_FILE__ENTRYPOINT 0x00040000UL 137#define CHR_FILE__ENTRYPOINT 0x00040000UL
148#define CHR_FILE__EXECMOD 0x00080000UL 138#define CHR_FILE__EXECMOD 0x00080000UL
149
150#define BLK_FILE__IOCTL 0x00000001UL 139#define BLK_FILE__IOCTL 0x00000001UL
151#define BLK_FILE__READ 0x00000002UL 140#define BLK_FILE__READ 0x00000002UL
152#define BLK_FILE__WRITE 0x00000004UL 141#define BLK_FILE__WRITE 0x00000004UL
@@ -164,7 +153,6 @@
164#define BLK_FILE__SWAPON 0x00004000UL 153#define BLK_FILE__SWAPON 0x00004000UL
165#define BLK_FILE__QUOTAON 0x00008000UL 154#define BLK_FILE__QUOTAON 0x00008000UL
166#define BLK_FILE__MOUNTON 0x00010000UL 155#define BLK_FILE__MOUNTON 0x00010000UL
167
168#define SOCK_FILE__IOCTL 0x00000001UL 156#define SOCK_FILE__IOCTL 0x00000001UL
169#define SOCK_FILE__READ 0x00000002UL 157#define SOCK_FILE__READ 0x00000002UL
170#define SOCK_FILE__WRITE 0x00000004UL 158#define SOCK_FILE__WRITE 0x00000004UL
@@ -182,7 +170,6 @@
182#define SOCK_FILE__SWAPON 0x00004000UL 170#define SOCK_FILE__SWAPON 0x00004000UL
183#define SOCK_FILE__QUOTAON 0x00008000UL 171#define SOCK_FILE__QUOTAON 0x00008000UL
184#define SOCK_FILE__MOUNTON 0x00010000UL 172#define SOCK_FILE__MOUNTON 0x00010000UL
185
186#define FIFO_FILE__IOCTL 0x00000001UL 173#define FIFO_FILE__IOCTL 0x00000001UL
187#define FIFO_FILE__READ 0x00000002UL 174#define FIFO_FILE__READ 0x00000002UL
188#define FIFO_FILE__WRITE 0x00000004UL 175#define FIFO_FILE__WRITE 0x00000004UL
@@ -200,9 +187,7 @@
200#define FIFO_FILE__SWAPON 0x00004000UL 187#define FIFO_FILE__SWAPON 0x00004000UL
201#define FIFO_FILE__QUOTAON 0x00008000UL 188#define FIFO_FILE__QUOTAON 0x00008000UL
202#define FIFO_FILE__MOUNTON 0x00010000UL 189#define FIFO_FILE__MOUNTON 0x00010000UL
203
204#define FD__USE 0x00000001UL 190#define FD__USE 0x00000001UL
205
206#define SOCKET__IOCTL 0x00000001UL 191#define SOCKET__IOCTL 0x00000001UL
207#define SOCKET__READ 0x00000002UL 192#define SOCKET__READ 0x00000002UL
208#define SOCKET__WRITE 0x00000004UL 193#define SOCKET__WRITE 0x00000004UL
@@ -225,7 +210,6 @@
225#define SOCKET__RECV_MSG 0x00080000UL 210#define SOCKET__RECV_MSG 0x00080000UL
226#define SOCKET__SEND_MSG 0x00100000UL 211#define SOCKET__SEND_MSG 0x00100000UL
227#define SOCKET__NAME_BIND 0x00200000UL 212#define SOCKET__NAME_BIND 0x00200000UL
228
229#define TCP_SOCKET__IOCTL 0x00000001UL 213#define TCP_SOCKET__IOCTL 0x00000001UL
230#define TCP_SOCKET__READ 0x00000002UL 214#define TCP_SOCKET__READ 0x00000002UL
231#define TCP_SOCKET__WRITE 0x00000004UL 215#define TCP_SOCKET__WRITE 0x00000004UL
@@ -248,13 +232,11 @@
248#define TCP_SOCKET__RECV_MSG 0x00080000UL 232#define TCP_SOCKET__RECV_MSG 0x00080000UL
249#define TCP_SOCKET__SEND_MSG 0x00100000UL 233#define TCP_SOCKET__SEND_MSG 0x00100000UL
250#define TCP_SOCKET__NAME_BIND 0x00200000UL 234#define TCP_SOCKET__NAME_BIND 0x00200000UL
251
252#define TCP_SOCKET__CONNECTTO 0x00400000UL 235#define TCP_SOCKET__CONNECTTO 0x00400000UL
253#define TCP_SOCKET__NEWCONN 0x00800000UL 236#define TCP_SOCKET__NEWCONN 0x00800000UL
254#define TCP_SOCKET__ACCEPTFROM 0x01000000UL 237#define TCP_SOCKET__ACCEPTFROM 0x01000000UL
255#define TCP_SOCKET__NODE_BIND 0x02000000UL 238#define TCP_SOCKET__NODE_BIND 0x02000000UL
256#define TCP_SOCKET__NAME_CONNECT 0x04000000UL 239#define TCP_SOCKET__NAME_CONNECT 0x04000000UL
257
258#define UDP_SOCKET__IOCTL 0x00000001UL 240#define UDP_SOCKET__IOCTL 0x00000001UL
259#define UDP_SOCKET__READ 0x00000002UL 241#define UDP_SOCKET__READ 0x00000002UL
260#define UDP_SOCKET__WRITE 0x00000004UL 242#define UDP_SOCKET__WRITE 0x00000004UL
@@ -277,9 +259,7 @@
277#define UDP_SOCKET__RECV_MSG 0x00080000UL 259#define UDP_SOCKET__RECV_MSG 0x00080000UL
278#define UDP_SOCKET__SEND_MSG 0x00100000UL 260#define UDP_SOCKET__SEND_MSG 0x00100000UL
279#define UDP_SOCKET__NAME_BIND 0x00200000UL 261#define UDP_SOCKET__NAME_BIND 0x00200000UL
280
281#define UDP_SOCKET__NODE_BIND 0x00400000UL 262#define UDP_SOCKET__NODE_BIND 0x00400000UL
282
283#define RAWIP_SOCKET__IOCTL 0x00000001UL 263#define RAWIP_SOCKET__IOCTL 0x00000001UL
284#define RAWIP_SOCKET__READ 0x00000002UL 264#define RAWIP_SOCKET__READ 0x00000002UL
285#define RAWIP_SOCKET__WRITE 0x00000004UL 265#define RAWIP_SOCKET__WRITE 0x00000004UL
@@ -302,9 +282,7 @@
302#define RAWIP_SOCKET__RECV_MSG 0x00080000UL 282#define RAWIP_SOCKET__RECV_MSG 0x00080000UL
303#define RAWIP_SOCKET__SEND_MSG 0x00100000UL 283#define RAWIP_SOCKET__SEND_MSG 0x00100000UL
304#define RAWIP_SOCKET__NAME_BIND 0x00200000UL 284#define RAWIP_SOCKET__NAME_BIND 0x00200000UL
305
306#define RAWIP_SOCKET__NODE_BIND 0x00400000UL 285#define RAWIP_SOCKET__NODE_BIND 0x00400000UL
307
308#define NODE__TCP_RECV 0x00000001UL 286#define NODE__TCP_RECV 0x00000001UL
309#define NODE__TCP_SEND 0x00000002UL 287#define NODE__TCP_SEND 0x00000002UL
310#define NODE__UDP_RECV 0x00000004UL 288#define NODE__UDP_RECV 0x00000004UL
@@ -314,7 +292,6 @@
314#define NODE__ENFORCE_DEST 0x00000040UL 292#define NODE__ENFORCE_DEST 0x00000040UL
315#define NODE__DCCP_RECV 0x00000080UL 293#define NODE__DCCP_RECV 0x00000080UL
316#define NODE__DCCP_SEND 0x00000100UL 294#define NODE__DCCP_SEND 0x00000100UL
317
318#define NETIF__TCP_RECV 0x00000001UL 295#define NETIF__TCP_RECV 0x00000001UL
319#define NETIF__TCP_SEND 0x00000002UL 296#define NETIF__TCP_SEND 0x00000002UL
320#define NETIF__UDP_RECV 0x00000004UL 297#define NETIF__UDP_RECV 0x00000004UL
@@ -323,7 +300,6 @@
323#define NETIF__RAWIP_SEND 0x00000020UL 300#define NETIF__RAWIP_SEND 0x00000020UL
324#define NETIF__DCCP_RECV 0x00000040UL 301#define NETIF__DCCP_RECV 0x00000040UL
325#define NETIF__DCCP_SEND 0x00000080UL 302#define NETIF__DCCP_SEND 0x00000080UL
326
327#define NETLINK_SOCKET__IOCTL 0x00000001UL 303#define NETLINK_SOCKET__IOCTL 0x00000001UL
328#define NETLINK_SOCKET__READ 0x00000002UL 304#define NETLINK_SOCKET__READ 0x00000002UL
329#define NETLINK_SOCKET__WRITE 0x00000004UL 305#define NETLINK_SOCKET__WRITE 0x00000004UL
@@ -346,7 +322,6 @@
346#define NETLINK_SOCKET__RECV_MSG 0x00080000UL 322#define NETLINK_SOCKET__RECV_MSG 0x00080000UL
347#define NETLINK_SOCKET__SEND_MSG 0x00100000UL 323#define NETLINK_SOCKET__SEND_MSG 0x00100000UL
348#define NETLINK_SOCKET__NAME_BIND 0x00200000UL 324#define NETLINK_SOCKET__NAME_BIND 0x00200000UL
349
350#define PACKET_SOCKET__IOCTL 0x00000001UL 325#define PACKET_SOCKET__IOCTL 0x00000001UL
351#define PACKET_SOCKET__READ 0x00000002UL 326#define PACKET_SOCKET__READ 0x00000002UL
352#define PACKET_SOCKET__WRITE 0x00000004UL 327#define PACKET_SOCKET__WRITE 0x00000004UL
@@ -369,7 +344,6 @@
369#define PACKET_SOCKET__RECV_MSG 0x00080000UL 344#define PACKET_SOCKET__RECV_MSG 0x00080000UL
370#define PACKET_SOCKET__SEND_MSG 0x00100000UL 345#define PACKET_SOCKET__SEND_MSG 0x00100000UL
371#define PACKET_SOCKET__NAME_BIND 0x00200000UL 346#define PACKET_SOCKET__NAME_BIND 0x00200000UL
372
373#define KEY_SOCKET__IOCTL 0x00000001UL 347#define KEY_SOCKET__IOCTL 0x00000001UL
374#define KEY_SOCKET__READ 0x00000002UL 348#define KEY_SOCKET__READ 0x00000002UL
375#define KEY_SOCKET__WRITE 0x00000004UL 349#define KEY_SOCKET__WRITE 0x00000004UL
@@ -392,7 +366,6 @@
392#define KEY_SOCKET__RECV_MSG 0x00080000UL 366#define KEY_SOCKET__RECV_MSG 0x00080000UL
393#define KEY_SOCKET__SEND_MSG 0x00100000UL 367#define KEY_SOCKET__SEND_MSG 0x00100000UL
394#define KEY_SOCKET__NAME_BIND 0x00200000UL 368#define KEY_SOCKET__NAME_BIND 0x00200000UL
395
396#define UNIX_STREAM_SOCKET__IOCTL 0x00000001UL 369#define UNIX_STREAM_SOCKET__IOCTL 0x00000001UL
397#define UNIX_STREAM_SOCKET__READ 0x00000002UL 370#define UNIX_STREAM_SOCKET__READ 0x00000002UL
398#define UNIX_STREAM_SOCKET__WRITE 0x00000004UL 371#define UNIX_STREAM_SOCKET__WRITE 0x00000004UL
@@ -415,11 +388,9 @@
415#define UNIX_STREAM_SOCKET__RECV_MSG 0x00080000UL 388#define UNIX_STREAM_SOCKET__RECV_MSG 0x00080000UL
416#define UNIX_STREAM_SOCKET__SEND_MSG 0x00100000UL 389#define UNIX_STREAM_SOCKET__SEND_MSG 0x00100000UL
417#define UNIX_STREAM_SOCKET__NAME_BIND 0x00200000UL 390#define UNIX_STREAM_SOCKET__NAME_BIND 0x00200000UL
418
419#define UNIX_STREAM_SOCKET__CONNECTTO 0x00400000UL 391#define UNIX_STREAM_SOCKET__CONNECTTO 0x00400000UL
420#define UNIX_STREAM_SOCKET__NEWCONN 0x00800000UL 392#define UNIX_STREAM_SOCKET__NEWCONN 0x00800000UL
421#define UNIX_STREAM_SOCKET__ACCEPTFROM 0x01000000UL 393#define UNIX_STREAM_SOCKET__ACCEPTFROM 0x01000000UL
422
423#define UNIX_DGRAM_SOCKET__IOCTL 0x00000001UL 394#define UNIX_DGRAM_SOCKET__IOCTL 0x00000001UL
424#define UNIX_DGRAM_SOCKET__READ 0x00000002UL 395#define UNIX_DGRAM_SOCKET__READ 0x00000002UL
425#define UNIX_DGRAM_SOCKET__WRITE 0x00000004UL 396#define UNIX_DGRAM_SOCKET__WRITE 0x00000004UL
@@ -442,7 +413,6 @@
442#define UNIX_DGRAM_SOCKET__RECV_MSG 0x00080000UL 413#define UNIX_DGRAM_SOCKET__RECV_MSG 0x00080000UL
443#define UNIX_DGRAM_SOCKET__SEND_MSG 0x00100000UL 414#define UNIX_DGRAM_SOCKET__SEND_MSG 0x00100000UL
444#define UNIX_DGRAM_SOCKET__NAME_BIND 0x00200000UL 415#define UNIX_DGRAM_SOCKET__NAME_BIND 0x00200000UL
445
446#define PROCESS__FORK 0x00000001UL 416#define PROCESS__FORK 0x00000001UL
447#define PROCESS__TRANSITION 0x00000002UL 417#define PROCESS__TRANSITION 0x00000002UL
448#define PROCESS__SIGCHLD 0x00000004UL 418#define PROCESS__SIGCHLD 0x00000004UL
@@ -473,7 +443,6 @@
473#define PROCESS__EXECHEAP 0x08000000UL 443#define PROCESS__EXECHEAP 0x08000000UL
474#define PROCESS__SETKEYCREATE 0x10000000UL 444#define PROCESS__SETKEYCREATE 0x10000000UL
475#define PROCESS__SETSOCKCREATE 0x20000000UL 445#define PROCESS__SETSOCKCREATE 0x20000000UL
476
477#define IPC__CREATE 0x00000001UL 446#define IPC__CREATE 0x00000001UL
478#define IPC__DESTROY 0x00000002UL 447#define IPC__DESTROY 0x00000002UL
479#define IPC__GETATTR 0x00000004UL 448#define IPC__GETATTR 0x00000004UL
@@ -483,7 +452,6 @@
483#define IPC__ASSOCIATE 0x00000040UL 452#define IPC__ASSOCIATE 0x00000040UL
484#define IPC__UNIX_READ 0x00000080UL 453#define IPC__UNIX_READ 0x00000080UL
485#define IPC__UNIX_WRITE 0x00000100UL 454#define IPC__UNIX_WRITE 0x00000100UL
486
487#define SEM__CREATE 0x00000001UL 455#define SEM__CREATE 0x00000001UL
488#define SEM__DESTROY 0x00000002UL 456#define SEM__DESTROY 0x00000002UL
489#define SEM__GETATTR 0x00000004UL 457#define SEM__GETATTR 0x00000004UL
@@ -493,7 +461,6 @@
493#define SEM__ASSOCIATE 0x00000040UL 461#define SEM__ASSOCIATE 0x00000040UL
494#define SEM__UNIX_READ 0x00000080UL 462#define SEM__UNIX_READ 0x00000080UL
495#define SEM__UNIX_WRITE 0x00000100UL 463#define SEM__UNIX_WRITE 0x00000100UL
496
497#define MSGQ__CREATE 0x00000001UL 464#define MSGQ__CREATE 0x00000001UL
498#define MSGQ__DESTROY 0x00000002UL 465#define MSGQ__DESTROY 0x00000002UL
499#define MSGQ__GETATTR 0x00000004UL 466#define MSGQ__GETATTR 0x00000004UL
@@ -503,12 +470,9 @@
503#define MSGQ__ASSOCIATE 0x00000040UL 470#define MSGQ__ASSOCIATE 0x00000040UL
504#define MSGQ__UNIX_READ 0x00000080UL 471#define MSGQ__UNIX_READ 0x00000080UL
505#define MSGQ__UNIX_WRITE 0x00000100UL 472#define MSGQ__UNIX_WRITE 0x00000100UL
506
507#define MSGQ__ENQUEUE 0x00000200UL 473#define MSGQ__ENQUEUE 0x00000200UL
508
509#define MSG__SEND 0x00000001UL 474#define MSG__SEND 0x00000001UL
510#define MSG__RECEIVE 0x00000002UL 475#define MSG__RECEIVE 0x00000002UL
511
512#define SHM__CREATE 0x00000001UL 476#define SHM__CREATE 0x00000001UL
513#define SHM__DESTROY 0x00000002UL 477#define SHM__DESTROY 0x00000002UL
514#define SHM__GETATTR 0x00000004UL 478#define SHM__GETATTR 0x00000004UL
@@ -518,9 +482,7 @@
518#define SHM__ASSOCIATE 0x00000040UL 482#define SHM__ASSOCIATE 0x00000040UL
519#define SHM__UNIX_READ 0x00000080UL 483#define SHM__UNIX_READ 0x00000080UL
520#define SHM__UNIX_WRITE 0x00000100UL 484#define SHM__UNIX_WRITE 0x00000100UL
521
522#define SHM__LOCK 0x00000200UL 485#define SHM__LOCK 0x00000200UL
523
524#define SECURITY__COMPUTE_AV 0x00000001UL 486#define SECURITY__COMPUTE_AV 0x00000001UL
525#define SECURITY__COMPUTE_CREATE 0x00000002UL 487#define SECURITY__COMPUTE_CREATE 0x00000002UL
526#define SECURITY__COMPUTE_MEMBER 0x00000004UL 488#define SECURITY__COMPUTE_MEMBER 0x00000004UL
@@ -532,12 +494,10 @@
532#define SECURITY__SETBOOL 0x00000100UL 494#define SECURITY__SETBOOL 0x00000100UL
533#define SECURITY__SETSECPARAM 0x00000200UL 495#define SECURITY__SETSECPARAM 0x00000200UL
534#define SECURITY__SETCHECKREQPROT 0x00000400UL 496#define SECURITY__SETCHECKREQPROT 0x00000400UL
535
536#define SYSTEM__IPC_INFO 0x00000001UL 497#define SYSTEM__IPC_INFO 0x00000001UL
537#define SYSTEM__SYSLOG_READ 0x00000002UL 498#define SYSTEM__SYSLOG_READ 0x00000002UL
538#define SYSTEM__SYSLOG_MOD 0x00000004UL 499#define SYSTEM__SYSLOG_MOD 0x00000004UL
539#define SYSTEM__SYSLOG_CONSOLE 0x00000008UL 500#define SYSTEM__SYSLOG_CONSOLE 0x00000008UL
540
541#define CAPABILITY__CHOWN 0x00000001UL 501#define CAPABILITY__CHOWN 0x00000001UL
542#define CAPABILITY__DAC_OVERRIDE 0x00000002UL 502#define CAPABILITY__DAC_OVERRIDE 0x00000002UL
543#define CAPABILITY__DAC_READ_SEARCH 0x00000004UL 503#define CAPABILITY__DAC_READ_SEARCH 0x00000004UL
@@ -569,110 +529,6 @@
569#define CAPABILITY__LEASE 0x10000000UL 529#define CAPABILITY__LEASE 0x10000000UL
570#define CAPABILITY__AUDIT_WRITE 0x20000000UL 530#define CAPABILITY__AUDIT_WRITE 0x20000000UL
571#define CAPABILITY__AUDIT_CONTROL 0x40000000UL 531#define CAPABILITY__AUDIT_CONTROL 0x40000000UL
572
573#define PASSWD__PASSWD 0x00000001UL
574#define PASSWD__CHFN 0x00000002UL
575#define PASSWD__CHSH 0x00000004UL
576#define PASSWD__ROOTOK 0x00000008UL
577#define PASSWD__CRONTAB 0x00000010UL
578
579#define DRAWABLE__CREATE 0x00000001UL
580#define DRAWABLE__DESTROY 0x00000002UL
581#define DRAWABLE__DRAW 0x00000004UL
582#define DRAWABLE__COPY 0x00000008UL
583#define DRAWABLE__GETATTR 0x00000010UL
584
585#define GC__CREATE 0x00000001UL
586#define GC__FREE 0x00000002UL
587#define GC__GETATTR 0x00000004UL
588#define GC__SETATTR 0x00000008UL
589
590#define WINDOW__ADDCHILD 0x00000001UL
591#define WINDOW__CREATE 0x00000002UL
592#define WINDOW__DESTROY 0x00000004UL
593#define WINDOW__MAP 0x00000008UL
594#define WINDOW__UNMAP 0x00000010UL
595#define WINDOW__CHSTACK 0x00000020UL
596#define WINDOW__CHPROPLIST 0x00000040UL
597#define WINDOW__CHPROP 0x00000080UL
598#define WINDOW__LISTPROP 0x00000100UL
599#define WINDOW__GETATTR 0x00000200UL
600#define WINDOW__SETATTR 0x00000400UL
601#define WINDOW__SETFOCUS 0x00000800UL
602#define WINDOW__MOVE 0x00001000UL
603#define WINDOW__CHSELECTION 0x00002000UL
604#define WINDOW__CHPARENT 0x00004000UL
605#define WINDOW__CTRLLIFE 0x00008000UL
606#define WINDOW__ENUMERATE 0x00010000UL
607#define WINDOW__TRANSPARENT 0x00020000UL
608#define WINDOW__MOUSEMOTION 0x00040000UL
609#define WINDOW__CLIENTCOMEVENT 0x00080000UL
610#define WINDOW__INPUTEVENT 0x00100000UL
611#define WINDOW__DRAWEVENT 0x00200000UL
612#define WINDOW__WINDOWCHANGEEVENT 0x00400000UL
613#define WINDOW__WINDOWCHANGEREQUEST 0x00800000UL
614#define WINDOW__SERVERCHANGEEVENT 0x01000000UL
615#define WINDOW__EXTENSIONEVENT 0x02000000UL
616
617#define FONT__LOAD 0x00000001UL
618#define FONT__FREE 0x00000002UL
619#define FONT__GETATTR 0x00000004UL
620#define FONT__USE 0x00000008UL
621
622#define COLORMAP__CREATE 0x00000001UL
623#define COLORMAP__FREE 0x00000002UL
624#define COLORMAP__INSTALL 0x00000004UL
625#define COLORMAP__UNINSTALL 0x00000008UL
626#define COLORMAP__LIST 0x00000010UL
627#define COLORMAP__READ 0x00000020UL
628#define COLORMAP__STORE 0x00000040UL
629#define COLORMAP__GETATTR 0x00000080UL
630#define COLORMAP__SETATTR 0x00000100UL
631
632#define PROPERTY__CREATE 0x00000001UL
633#define PROPERTY__FREE 0x00000002UL
634#define PROPERTY__READ 0x00000004UL
635#define PROPERTY__WRITE 0x00000008UL
636
637#define CURSOR__CREATE 0x00000001UL
638#define CURSOR__CREATEGLYPH 0x00000002UL
639#define CURSOR__FREE 0x00000004UL
640#define CURSOR__ASSIGN 0x00000008UL
641#define CURSOR__SETATTR 0x00000010UL
642
643#define XCLIENT__KILL 0x00000001UL
644
645#define XINPUT__LOOKUP 0x00000001UL
646#define XINPUT__GETATTR 0x00000002UL
647#define XINPUT__SETATTR 0x00000004UL
648#define XINPUT__SETFOCUS 0x00000008UL
649#define XINPUT__WARPPOINTER 0x00000010UL
650#define XINPUT__ACTIVEGRAB 0x00000020UL
651#define XINPUT__PASSIVEGRAB 0x00000040UL
652#define XINPUT__UNGRAB 0x00000080UL
653#define XINPUT__BELL 0x00000100UL
654#define XINPUT__MOUSEMOTION 0x00000200UL
655#define XINPUT__RELABELINPUT 0x00000400UL
656
657#define XSERVER__SCREENSAVER 0x00000001UL
658#define XSERVER__GETHOSTLIST 0x00000002UL
659#define XSERVER__SETHOSTLIST 0x00000004UL
660#define XSERVER__GETFONTPATH 0x00000008UL
661#define XSERVER__SETFONTPATH 0x00000010UL
662#define XSERVER__GETATTR 0x00000020UL
663#define XSERVER__GRAB 0x00000040UL
664#define XSERVER__UNGRAB 0x00000080UL
665
666#define XEXTENSION__QUERY 0x00000001UL
667#define XEXTENSION__USE 0x00000002UL
668
669#define PAX__PAGEEXEC 0x00000001UL
670#define PAX__EMUTRAMP 0x00000002UL
671#define PAX__MPROTECT 0x00000004UL
672#define PAX__RANDMMAP 0x00000008UL
673#define PAX__RANDEXEC 0x00000010UL
674#define PAX__SEGMEXEC 0x00000020UL
675
676#define NETLINK_ROUTE_SOCKET__IOCTL 0x00000001UL 532#define NETLINK_ROUTE_SOCKET__IOCTL 0x00000001UL
677#define NETLINK_ROUTE_SOCKET__READ 0x00000002UL 533#define NETLINK_ROUTE_SOCKET__READ 0x00000002UL
678#define NETLINK_ROUTE_SOCKET__WRITE 0x00000004UL 534#define NETLINK_ROUTE_SOCKET__WRITE 0x00000004UL
@@ -695,10 +551,8 @@
695#define NETLINK_ROUTE_SOCKET__RECV_MSG 0x00080000UL 551#define NETLINK_ROUTE_SOCKET__RECV_MSG 0x00080000UL
696#define NETLINK_ROUTE_SOCKET__SEND_MSG 0x00100000UL 552#define NETLINK_ROUTE_SOCKET__SEND_MSG 0x00100000UL
697#define NETLINK_ROUTE_SOCKET__NAME_BIND 0x00200000UL 553#define NETLINK_ROUTE_SOCKET__NAME_BIND 0x00200000UL
698
699#define NETLINK_ROUTE_SOCKET__NLMSG_READ 0x00400000UL 554#define NETLINK_ROUTE_SOCKET__NLMSG_READ 0x00400000UL
700#define NETLINK_ROUTE_SOCKET__NLMSG_WRITE 0x00800000UL 555#define NETLINK_ROUTE_SOCKET__NLMSG_WRITE 0x00800000UL
701
702#define NETLINK_FIREWALL_SOCKET__IOCTL 0x00000001UL 556#define NETLINK_FIREWALL_SOCKET__IOCTL 0x00000001UL
703#define NETLINK_FIREWALL_SOCKET__READ 0x00000002UL 557#define NETLINK_FIREWALL_SOCKET__READ 0x00000002UL
704#define NETLINK_FIREWALL_SOCKET__WRITE 0x00000004UL 558#define NETLINK_FIREWALL_SOCKET__WRITE 0x00000004UL
@@ -721,10 +575,8 @@
721#define NETLINK_FIREWALL_SOCKET__RECV_MSG 0x00080000UL 575#define NETLINK_FIREWALL_SOCKET__RECV_MSG 0x00080000UL
722#define NETLINK_FIREWALL_SOCKET__SEND_MSG 0x00100000UL 576#define NETLINK_FIREWALL_SOCKET__SEND_MSG 0x00100000UL
723#define NETLINK_FIREWALL_SOCKET__NAME_BIND 0x00200000UL 577#define NETLINK_FIREWALL_SOCKET__NAME_BIND 0x00200000UL
724
725#define NETLINK_FIREWALL_SOCKET__NLMSG_READ 0x00400000UL 578#define NETLINK_FIREWALL_SOCKET__NLMSG_READ 0x00400000UL
726#define NETLINK_FIREWALL_SOCKET__NLMSG_WRITE 0x00800000UL 579#define NETLINK_FIREWALL_SOCKET__NLMSG_WRITE 0x00800000UL
727
728#define NETLINK_TCPDIAG_SOCKET__IOCTL 0x00000001UL 580#define NETLINK_TCPDIAG_SOCKET__IOCTL 0x00000001UL
729#define NETLINK_TCPDIAG_SOCKET__READ 0x00000002UL 581#define NETLINK_TCPDIAG_SOCKET__READ 0x00000002UL
730#define NETLINK_TCPDIAG_SOCKET__WRITE 0x00000004UL 582#define NETLINK_TCPDIAG_SOCKET__WRITE 0x00000004UL
@@ -747,10 +599,8 @@
747#define NETLINK_TCPDIAG_SOCKET__RECV_MSG 0x00080000UL 599#define NETLINK_TCPDIAG_SOCKET__RECV_MSG 0x00080000UL
748#define NETLINK_TCPDIAG_SOCKET__SEND_MSG 0x00100000UL 600#define NETLINK_TCPDIAG_SOCKET__SEND_MSG 0x00100000UL
749#define NETLINK_TCPDIAG_SOCKET__NAME_BIND 0x00200000UL 601#define NETLINK_TCPDIAG_SOCKET__NAME_BIND 0x00200000UL
750
751#define NETLINK_TCPDIAG_SOCKET__NLMSG_READ 0x00400000UL 602#define NETLINK_TCPDIAG_SOCKET__NLMSG_READ 0x00400000UL
752#define NETLINK_TCPDIAG_SOCKET__NLMSG_WRITE 0x00800000UL 603#define NETLINK_TCPDIAG_SOCKET__NLMSG_WRITE 0x00800000UL
753
754#define NETLINK_NFLOG_SOCKET__IOCTL 0x00000001UL 604#define NETLINK_NFLOG_SOCKET__IOCTL 0x00000001UL
755#define NETLINK_NFLOG_SOCKET__READ 0x00000002UL 605#define NETLINK_NFLOG_SOCKET__READ 0x00000002UL
756#define NETLINK_NFLOG_SOCKET__WRITE 0x00000004UL 606#define NETLINK_NFLOG_SOCKET__WRITE 0x00000004UL
@@ -773,7 +623,6 @@
773#define NETLINK_NFLOG_SOCKET__RECV_MSG 0x00080000UL 623#define NETLINK_NFLOG_SOCKET__RECV_MSG 0x00080000UL
774#define NETLINK_NFLOG_SOCKET__SEND_MSG 0x00100000UL 624#define NETLINK_NFLOG_SOCKET__SEND_MSG 0x00100000UL
775#define NETLINK_NFLOG_SOCKET__NAME_BIND 0x00200000UL 625#define NETLINK_NFLOG_SOCKET__NAME_BIND 0x00200000UL
776
777#define NETLINK_XFRM_SOCKET__IOCTL 0x00000001UL 626#define NETLINK_XFRM_SOCKET__IOCTL 0x00000001UL
778#define NETLINK_XFRM_SOCKET__READ 0x00000002UL 627#define NETLINK_XFRM_SOCKET__READ 0x00000002UL
779#define NETLINK_XFRM_SOCKET__WRITE 0x00000004UL 628#define NETLINK_XFRM_SOCKET__WRITE 0x00000004UL
@@ -796,10 +645,8 @@
796#define NETLINK_XFRM_SOCKET__RECV_MSG 0x00080000UL 645#define NETLINK_XFRM_SOCKET__RECV_MSG 0x00080000UL
797#define NETLINK_XFRM_SOCKET__SEND_MSG 0x00100000UL 646#define NETLINK_XFRM_SOCKET__SEND_MSG 0x00100000UL
798#define NETLINK_XFRM_SOCKET__NAME_BIND 0x00200000UL 647#define NETLINK_XFRM_SOCKET__NAME_BIND 0x00200000UL
799
800#define NETLINK_XFRM_SOCKET__NLMSG_READ 0x00400000UL 648#define NETLINK_XFRM_SOCKET__NLMSG_READ 0x00400000UL
801#define NETLINK_XFRM_SOCKET__NLMSG_WRITE 0x00800000UL 649#define NETLINK_XFRM_SOCKET__NLMSG_WRITE 0x00800000UL
802
803#define NETLINK_SELINUX_SOCKET__IOCTL 0x00000001UL 650#define NETLINK_SELINUX_SOCKET__IOCTL 0x00000001UL
804#define NETLINK_SELINUX_SOCKET__READ 0x00000002UL 651#define NETLINK_SELINUX_SOCKET__READ 0x00000002UL
805#define NETLINK_SELINUX_SOCKET__WRITE 0x00000004UL 652#define NETLINK_SELINUX_SOCKET__WRITE 0x00000004UL
@@ -822,7 +669,6 @@
822#define NETLINK_SELINUX_SOCKET__RECV_MSG 0x00080000UL 669#define NETLINK_SELINUX_SOCKET__RECV_MSG 0x00080000UL
823#define NETLINK_SELINUX_SOCKET__SEND_MSG 0x00100000UL 670#define NETLINK_SELINUX_SOCKET__SEND_MSG 0x00100000UL
824#define NETLINK_SELINUX_SOCKET__NAME_BIND 0x00200000UL 671#define NETLINK_SELINUX_SOCKET__NAME_BIND 0x00200000UL
825
826#define NETLINK_AUDIT_SOCKET__IOCTL 0x00000001UL 672#define NETLINK_AUDIT_SOCKET__IOCTL 0x00000001UL
827#define NETLINK_AUDIT_SOCKET__READ 0x00000002UL 673#define NETLINK_AUDIT_SOCKET__READ 0x00000002UL
828#define NETLINK_AUDIT_SOCKET__WRITE 0x00000004UL 674#define NETLINK_AUDIT_SOCKET__WRITE 0x00000004UL
@@ -845,12 +691,10 @@
845#define NETLINK_AUDIT_SOCKET__RECV_MSG 0x00080000UL 691#define NETLINK_AUDIT_SOCKET__RECV_MSG 0x00080000UL
846#define NETLINK_AUDIT_SOCKET__SEND_MSG 0x00100000UL 692#define NETLINK_AUDIT_SOCKET__SEND_MSG 0x00100000UL
847#define NETLINK_AUDIT_SOCKET__NAME_BIND 0x00200000UL 693#define NETLINK_AUDIT_SOCKET__NAME_BIND 0x00200000UL
848
849#define NETLINK_AUDIT_SOCKET__NLMSG_READ 0x00400000UL 694#define NETLINK_AUDIT_SOCKET__NLMSG_READ 0x00400000UL
850#define NETLINK_AUDIT_SOCKET__NLMSG_WRITE 0x00800000UL 695#define NETLINK_AUDIT_SOCKET__NLMSG_WRITE 0x00800000UL
851#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY 0x01000000UL 696#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY 0x01000000UL
852#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV 0x02000000UL 697#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV 0x02000000UL
853
854#define NETLINK_IP6FW_SOCKET__IOCTL 0x00000001UL 698#define NETLINK_IP6FW_SOCKET__IOCTL 0x00000001UL
855#define NETLINK_IP6FW_SOCKET__READ 0x00000002UL 699#define NETLINK_IP6FW_SOCKET__READ 0x00000002UL
856#define NETLINK_IP6FW_SOCKET__WRITE 0x00000004UL 700#define NETLINK_IP6FW_SOCKET__WRITE 0x00000004UL
@@ -873,10 +717,8 @@
873#define NETLINK_IP6FW_SOCKET__RECV_MSG 0x00080000UL 717#define NETLINK_IP6FW_SOCKET__RECV_MSG 0x00080000UL
874#define NETLINK_IP6FW_SOCKET__SEND_MSG 0x00100000UL 718#define NETLINK_IP6FW_SOCKET__SEND_MSG 0x00100000UL
875#define NETLINK_IP6FW_SOCKET__NAME_BIND 0x00200000UL 719#define NETLINK_IP6FW_SOCKET__NAME_BIND 0x00200000UL
876
877#define NETLINK_IP6FW_SOCKET__NLMSG_READ 0x00400000UL 720#define NETLINK_IP6FW_SOCKET__NLMSG_READ 0x00400000UL
878#define NETLINK_IP6FW_SOCKET__NLMSG_WRITE 0x00800000UL 721#define NETLINK_IP6FW_SOCKET__NLMSG_WRITE 0x00800000UL
879
880#define NETLINK_DNRT_SOCKET__IOCTL 0x00000001UL 722#define NETLINK_DNRT_SOCKET__IOCTL 0x00000001UL
881#define NETLINK_DNRT_SOCKET__READ 0x00000002UL 723#define NETLINK_DNRT_SOCKET__READ 0x00000002UL
882#define NETLINK_DNRT_SOCKET__WRITE 0x00000004UL 724#define NETLINK_DNRT_SOCKET__WRITE 0x00000004UL
@@ -899,24 +741,10 @@
899#define NETLINK_DNRT_SOCKET__RECV_MSG 0x00080000UL 741#define NETLINK_DNRT_SOCKET__RECV_MSG 0x00080000UL
900#define NETLINK_DNRT_SOCKET__SEND_MSG 0x00100000UL 742#define NETLINK_DNRT_SOCKET__SEND_MSG 0x00100000UL
901#define NETLINK_DNRT_SOCKET__NAME_BIND 0x00200000UL 743#define NETLINK_DNRT_SOCKET__NAME_BIND 0x00200000UL
902
903#define DBUS__ACQUIRE_SVC 0x00000001UL
904#define DBUS__SEND_MSG 0x00000002UL
905
906#define NSCD__GETPWD 0x00000001UL
907#define NSCD__GETGRP 0x00000002UL
908#define NSCD__GETHOST 0x00000004UL
909#define NSCD__GETSTAT 0x00000008UL
910#define NSCD__ADMIN 0x00000010UL
911#define NSCD__SHMEMPWD 0x00000020UL
912#define NSCD__SHMEMGRP 0x00000040UL
913#define NSCD__SHMEMHOST 0x00000080UL
914
915#define ASSOCIATION__SENDTO 0x00000001UL 744#define ASSOCIATION__SENDTO 0x00000001UL
916#define ASSOCIATION__RECVFROM 0x00000002UL 745#define ASSOCIATION__RECVFROM 0x00000002UL
917#define ASSOCIATION__SETCONTEXT 0x00000004UL 746#define ASSOCIATION__SETCONTEXT 0x00000004UL
918#define ASSOCIATION__POLMATCH 0x00000008UL 747#define ASSOCIATION__POLMATCH 0x00000008UL
919
920#define NETLINK_KOBJECT_UEVENT_SOCKET__IOCTL 0x00000001UL 748#define NETLINK_KOBJECT_UEVENT_SOCKET__IOCTL 0x00000001UL
921#define NETLINK_KOBJECT_UEVENT_SOCKET__READ 0x00000002UL 749#define NETLINK_KOBJECT_UEVENT_SOCKET__READ 0x00000002UL
922#define NETLINK_KOBJECT_UEVENT_SOCKET__WRITE 0x00000004UL 750#define NETLINK_KOBJECT_UEVENT_SOCKET__WRITE 0x00000004UL
@@ -939,7 +767,6 @@
939#define NETLINK_KOBJECT_UEVENT_SOCKET__RECV_MSG 0x00080000UL 767#define NETLINK_KOBJECT_UEVENT_SOCKET__RECV_MSG 0x00080000UL
940#define NETLINK_KOBJECT_UEVENT_SOCKET__SEND_MSG 0x00100000UL 768#define NETLINK_KOBJECT_UEVENT_SOCKET__SEND_MSG 0x00100000UL
941#define NETLINK_KOBJECT_UEVENT_SOCKET__NAME_BIND 0x00200000UL 769#define NETLINK_KOBJECT_UEVENT_SOCKET__NAME_BIND 0x00200000UL
942
943#define APPLETALK_SOCKET__IOCTL 0x00000001UL 770#define APPLETALK_SOCKET__IOCTL 0x00000001UL
944#define APPLETALK_SOCKET__READ 0x00000002UL 771#define APPLETALK_SOCKET__READ 0x00000002UL
945#define APPLETALK_SOCKET__WRITE 0x00000004UL 772#define APPLETALK_SOCKET__WRITE 0x00000004UL
@@ -962,11 +789,9 @@
962#define APPLETALK_SOCKET__RECV_MSG 0x00080000UL 789#define APPLETALK_SOCKET__RECV_MSG 0x00080000UL
963#define APPLETALK_SOCKET__SEND_MSG 0x00100000UL 790#define APPLETALK_SOCKET__SEND_MSG 0x00100000UL
964#define APPLETALK_SOCKET__NAME_BIND 0x00200000UL 791#define APPLETALK_SOCKET__NAME_BIND 0x00200000UL
965
966#define PACKET__SEND 0x00000001UL 792#define PACKET__SEND 0x00000001UL
967#define PACKET__RECV 0x00000002UL 793#define PACKET__RECV 0x00000002UL
968#define PACKET__RELABELTO 0x00000004UL 794#define PACKET__RELABELTO 0x00000004UL
969
970#define KEY__VIEW 0x00000001UL 795#define KEY__VIEW 0x00000001UL
971#define KEY__READ 0x00000002UL 796#define KEY__READ 0x00000002UL
972#define KEY__WRITE 0x00000004UL 797#define KEY__WRITE 0x00000004UL
@@ -974,10 +799,6 @@
974#define KEY__LINK 0x00000010UL 799#define KEY__LINK 0x00000010UL
975#define KEY__SETATTR 0x00000020UL 800#define KEY__SETATTR 0x00000020UL
976#define KEY__CREATE 0x00000040UL 801#define KEY__CREATE 0x00000040UL
977
978#define CONTEXT__TRANSLATE 0x00000001UL
979#define CONTEXT__CONTAINS 0x00000002UL
980
981#define DCCP_SOCKET__IOCTL 0x00000001UL 802#define DCCP_SOCKET__IOCTL 0x00000001UL
982#define DCCP_SOCKET__READ 0x00000002UL 803#define DCCP_SOCKET__READ 0x00000002UL
983#define DCCP_SOCKET__WRITE 0x00000004UL 804#define DCCP_SOCKET__WRITE 0x00000004UL
diff --git a/security/selinux/include/class_to_string.h b/security/selinux/include/class_to_string.h
index 9f3ebb1bfae6..378799068441 100644
--- a/security/selinux/include/class_to_string.h
+++ b/security/selinux/include/class_to_string.h
@@ -2,7 +2,7 @@
2/* 2/*
3 * Security object class definitions 3 * Security object class definitions
4 */ 4 */
5 S_("null") 5 S_(NULL)
6 S_("security") 6 S_("security")
7 S_("process") 7 S_("process")
8 S_("system") 8 S_("system")
@@ -32,19 +32,19 @@
32 S_("msgq") 32 S_("msgq")
33 S_("shm") 33 S_("shm")
34 S_("ipc") 34 S_("ipc")
35 S_("passwd") 35 S_(NULL)
36 S_("drawable") 36 S_(NULL)
37 S_("window") 37 S_(NULL)
38 S_("gc") 38 S_(NULL)
39 S_("font") 39 S_(NULL)
40 S_("colormap") 40 S_(NULL)
41 S_("property") 41 S_(NULL)
42 S_("cursor") 42 S_(NULL)
43 S_("xclient") 43 S_(NULL)
44 S_("xinput") 44 S_(NULL)
45 S_("xserver") 45 S_(NULL)
46 S_("xextension") 46 S_(NULL)
47 S_("pax") 47 S_(NULL)
48 S_("netlink_route_socket") 48 S_("netlink_route_socket")
49 S_("netlink_firewall_socket") 49 S_("netlink_firewall_socket")
50 S_("netlink_tcpdiag_socket") 50 S_("netlink_tcpdiag_socket")
@@ -54,12 +54,12 @@
54 S_("netlink_audit_socket") 54 S_("netlink_audit_socket")
55 S_("netlink_ip6fw_socket") 55 S_("netlink_ip6fw_socket")
56 S_("netlink_dnrt_socket") 56 S_("netlink_dnrt_socket")
57 S_("dbus") 57 S_(NULL)
58 S_("nscd") 58 S_(NULL)
59 S_("association") 59 S_("association")
60 S_("netlink_kobject_uevent_socket") 60 S_("netlink_kobject_uevent_socket")
61 S_("appletalk_socket") 61 S_("appletalk_socket")
62 S_("packet") 62 S_("packet")
63 S_("key") 63 S_("key")
64 S_("context") 64 S_(NULL)
65 S_("dccp_socket") 65 S_("dccp_socket")
diff --git a/security/selinux/include/flask.h b/security/selinux/include/flask.h
index 67cef371ee00..35f309f47873 100644
--- a/security/selinux/include/flask.h
+++ b/security/selinux/include/flask.h
@@ -34,19 +34,6 @@
34#define SECCLASS_MSGQ 27 34#define SECCLASS_MSGQ 27
35#define SECCLASS_SHM 28 35#define SECCLASS_SHM 28
36#define SECCLASS_IPC 29 36#define SECCLASS_IPC 29
37#define SECCLASS_PASSWD 30
38#define SECCLASS_DRAWABLE 31
39#define SECCLASS_WINDOW 32
40#define SECCLASS_GC 33
41#define SECCLASS_FONT 34
42#define SECCLASS_COLORMAP 35
43#define SECCLASS_PROPERTY 36
44#define SECCLASS_CURSOR 37
45#define SECCLASS_XCLIENT 38
46#define SECCLASS_XINPUT 39
47#define SECCLASS_XSERVER 40
48#define SECCLASS_XEXTENSION 41
49#define SECCLASS_PAX 42
50#define SECCLASS_NETLINK_ROUTE_SOCKET 43 37#define SECCLASS_NETLINK_ROUTE_SOCKET 43
51#define SECCLASS_NETLINK_FIREWALL_SOCKET 44 38#define SECCLASS_NETLINK_FIREWALL_SOCKET 44
52#define SECCLASS_NETLINK_TCPDIAG_SOCKET 45 39#define SECCLASS_NETLINK_TCPDIAG_SOCKET 45
@@ -56,14 +43,11 @@
56#define SECCLASS_NETLINK_AUDIT_SOCKET 49 43#define SECCLASS_NETLINK_AUDIT_SOCKET 49
57#define SECCLASS_NETLINK_IP6FW_SOCKET 50 44#define SECCLASS_NETLINK_IP6FW_SOCKET 50
58#define SECCLASS_NETLINK_DNRT_SOCKET 51 45#define SECCLASS_NETLINK_DNRT_SOCKET 51
59#define SECCLASS_DBUS 52
60#define SECCLASS_NSCD 53
61#define SECCLASS_ASSOCIATION 54 46#define SECCLASS_ASSOCIATION 54
62#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55 47#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
63#define SECCLASS_APPLETALK_SOCKET 56 48#define SECCLASS_APPLETALK_SOCKET 56
64#define SECCLASS_PACKET 57 49#define SECCLASS_PACKET 57
65#define SECCLASS_KEY 58 50#define SECCLASS_KEY 58
66#define SECCLASS_CONTEXT 59
67#define SECCLASS_DCCP_SOCKET 60 51#define SECCLASS_DCCP_SOCKET 60
68 52
69/* 53/*
diff --git a/security/selinux/include/selinux_netlabel.h b/security/selinux/include/netlabel.h
index 2a732c9033e3..218e3f77c350 100644
--- a/security/selinux/include/selinux_netlabel.h
+++ b/security/selinux/include/netlabel.h
@@ -38,19 +38,22 @@
38 38
39#ifdef CONFIG_NETLABEL 39#ifdef CONFIG_NETLABEL
40void selinux_netlbl_cache_invalidate(void); 40void selinux_netlbl_cache_invalidate(void);
41int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid); 41
42int selinux_netlbl_socket_post_create(struct socket *sock);
43void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock);
44int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
45 struct sk_buff *skb,
46 struct avc_audit_data *ad);
47void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec, 42void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
48 int family); 43 int family);
49void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec, 44void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
50 int family); 45 int family);
51void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec, 46void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
52 struct sk_security_struct *newssec); 47 struct sk_security_struct *newssec);
48
49int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid);
50
51void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock);
52int selinux_netlbl_socket_post_create(struct socket *sock);
53int selinux_netlbl_inode_permission(struct inode *inode, int mask); 53int selinux_netlbl_inode_permission(struct inode *inode, int mask);
54int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
55 struct sk_buff *skb,
56 struct avc_audit_data *ad);
54int selinux_netlbl_socket_setsockopt(struct socket *sock, 57int selinux_netlbl_socket_setsockopt(struct socket *sock,
55 int level, 58 int level,
56 int optname); 59 int optname);
@@ -60,59 +63,53 @@ static inline void selinux_netlbl_cache_invalidate(void)
60 return; 63 return;
61} 64}
62 65
63static inline int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, 66static inline void selinux_netlbl_sk_security_reset(
64 u32 base_sid, 67 struct sk_security_struct *ssec,
65 u32 *sid) 68 int family)
66{ 69{
67 *sid = SECSID_NULL; 70 return;
68 return 0;
69} 71}
70 72static inline void selinux_netlbl_sk_security_init(
71static inline int selinux_netlbl_socket_post_create(struct socket *sock) 73 struct sk_security_struct *ssec,
74 int family)
72{ 75{
73 return 0; 76 return;
74} 77}
75 78static inline void selinux_netlbl_sk_security_clone(
76static inline void selinux_netlbl_sock_graft(struct sock *sk, 79 struct sk_security_struct *ssec,
77 struct socket *sock) 80 struct sk_security_struct *newssec)
78{ 81{
79 return; 82 return;
80} 83}
81 84
82static inline int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, 85static inline int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
83 struct sk_buff *skb, 86 u32 base_sid,
84 struct avc_audit_data *ad) 87 u32 *sid)
85{ 88{
89 *sid = SECSID_NULL;
86 return 0; 90 return 0;
87} 91}
88 92
89static inline void selinux_netlbl_sk_security_reset( 93static inline void selinux_netlbl_sock_graft(struct sock *sk,
90 struct sk_security_struct *ssec, 94 struct socket *sock)
91 int family)
92{
93 return;
94}
95
96static inline void selinux_netlbl_sk_security_init(
97 struct sk_security_struct *ssec,
98 int family)
99{ 95{
100 return; 96 return;
101} 97}
102 98static inline int selinux_netlbl_socket_post_create(struct socket *sock)
103static inline void selinux_netlbl_sk_security_clone(
104 struct sk_security_struct *ssec,
105 struct sk_security_struct *newssec)
106{ 99{
107 return; 100 return 0;
108} 101}
109
110static inline int selinux_netlbl_inode_permission(struct inode *inode, 102static inline int selinux_netlbl_inode_permission(struct inode *inode,
111 int mask) 103 int mask)
112{ 104{
113 return 0; 105 return 0;
114} 106}
115 107static inline int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
108 struct sk_buff *skb,
109 struct avc_audit_data *ad)
110{
111 return 0;
112}
116static inline int selinux_netlbl_socket_setsockopt(struct socket *sock, 113static inline int selinux_netlbl_socket_setsockopt(struct socket *sock,
117 int level, 114 int level,
118 int optname) 115 int optname)
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 210eec77e7ff..b94378afea25 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -34,7 +34,7 @@
34#define POLICYDB_VERSION_MAX POLICYDB_VERSION_RANGETRANS 34#define POLICYDB_VERSION_MAX POLICYDB_VERSION_RANGETRANS
35#endif 35#endif
36 36
37struct sk_buff; 37struct netlbl_lsm_secattr;
38 38
39extern int selinux_enabled; 39extern int selinux_enabled;
40extern int selinux_mls_enabled; 40extern int selinux_mls_enabled;
@@ -82,8 +82,6 @@ int security_netif_sid(char *name, u32 *if_sid,
82int security_node_sid(u16 domain, void *addr, u32 addrlen, 82int security_node_sid(u16 domain, void *addr, u32 addrlen,
83 u32 *out_sid); 83 u32 *out_sid);
84 84
85void security_skb_extlbl_sid(struct sk_buff *skb, u32 base_sid, u32 *sid);
86
87int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 85int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
88 u16 tclass); 86 u16 tclass);
89 87
@@ -102,5 +100,30 @@ int security_fs_use(const char *fstype, unsigned int *behavior,
102int security_genfs_sid(const char *fstype, char *name, u16 sclass, 100int security_genfs_sid(const char *fstype, char *name, u16 sclass,
103 u32 *sid); 101 u32 *sid);
104 102
103#ifdef CONFIG_NETLABEL
104int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
105 u32 base_sid,
106 u32 *sid);
107
108int security_netlbl_sid_to_secattr(u32 sid,
109 struct netlbl_lsm_secattr *secattr);
110#else
111static inline int security_netlbl_secattr_to_sid(
112 struct netlbl_lsm_secattr *secattr,
113 u32 base_sid,
114 u32 *sid)
115{
116 return -EIDRM;
117}
118
119static inline int security_netlbl_sid_to_secattr(u32 sid,
120 struct netlbl_lsm_secattr *secattr)
121{
122 return -ENOENT;
123}
124#endif /* CONFIG_NETLABEL */
125
126const char *security_get_initial_sid_context(u32 sid);
127
105#endif /* _SELINUX_SECURITY_H_ */ 128#endif /* _SELINUX_SECURITY_H_ */
106 129
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
new file mode 100644
index 000000000000..bf8750791dd1
--- /dev/null
+++ b/security/selinux/netlabel.c
@@ -0,0 +1,363 @@
1/*
2 * SELinux NetLabel Support
3 *
4 * This file provides the necessary glue to tie NetLabel into the SELinux
5 * subsystem.
6 *
7 * Author: Paul Moore <paul.moore@hp.com>
8 *
9 */
10
11/*
12 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
22 * the GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 *
28 */
29
30#include <linux/spinlock.h>
31#include <linux/rcupdate.h>
32#include <net/sock.h>
33#include <net/netlabel.h>
34
35#include "objsec.h"
36#include "security.h"
37
38/**
39 * selinux_netlbl_socket_setsid - Label a socket using the NetLabel mechanism
40 * @sock: the socket to label
41 * @sid: the SID to use
42 *
43 * Description:
44 * Attempt to label a socket using the NetLabel mechanism using the given
45 * SID. Returns zero values on success, negative values on failure. The
46 * caller is responsibile for calling rcu_read_lock() before calling this
47 * this function and rcu_read_unlock() after this function returns.
48 *
49 */
50static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid)
51{
52 int rc;
53 struct sk_security_struct *sksec = sock->sk->sk_security;
54 struct netlbl_lsm_secattr secattr;
55
56 rc = security_netlbl_sid_to_secattr(sid, &secattr);
57 if (rc != 0)
58 return rc;
59
60 rc = netlbl_socket_setattr(sock, &secattr);
61 if (rc == 0) {
62 spin_lock_bh(&sksec->nlbl_lock);
63 sksec->nlbl_state = NLBL_LABELED;
64 spin_unlock_bh(&sksec->nlbl_lock);
65 }
66
67 return rc;
68}
69
70/**
71 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache
72 *
73 * Description:
74 * Invalidate the NetLabel security attribute mapping cache.
75 *
76 */
77void selinux_netlbl_cache_invalidate(void)
78{
79 netlbl_cache_invalidate();
80}
81
82/**
83 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
84 * @ssec: the sk_security_struct
85 * @family: the socket family
86 *
87 * Description:
88 * Called when the NetLabel state of a sk_security_struct needs to be reset.
89 * The caller is responsibile for all the NetLabel sk_security_struct locking.
90 *
91 */
92void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
93 int family)
94{
95 if (family == PF_INET)
96 ssec->nlbl_state = NLBL_REQUIRE;
97 else
98 ssec->nlbl_state = NLBL_UNSET;
99}
100
101/**
102 * selinux_netlbl_sk_security_init - Setup the NetLabel fields
103 * @ssec: the sk_security_struct
104 * @family: the socket family
105 *
106 * Description:
107 * Called when a new sk_security_struct is allocated to initialize the NetLabel
108 * fields.
109 *
110 */
111void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
112 int family)
113{
114 /* No locking needed, we are the only one who has access to ssec */
115 selinux_netlbl_sk_security_reset(ssec, family);
116 spin_lock_init(&ssec->nlbl_lock);
117}
118
119/**
120 * selinux_netlbl_sk_security_clone - Copy the NetLabel fields
121 * @ssec: the original sk_security_struct
122 * @newssec: the cloned sk_security_struct
123 *
124 * Description:
125 * Clone the NetLabel specific sk_security_struct fields from @ssec to
126 * @newssec.
127 *
128 */
129void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
130 struct sk_security_struct *newssec)
131{
132 /* We don't need to take newssec->nlbl_lock because we are the only
133 * thread with access to newssec, but we do need to take the RCU read
134 * lock as other threads could have access to ssec */
135 rcu_read_lock();
136 selinux_netlbl_sk_security_reset(newssec, ssec->sk->sk_family);
137 newssec->sclass = ssec->sclass;
138 rcu_read_unlock();
139}
140
141/**
142 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
143 * @skb: the packet
144 * @base_sid: the SELinux SID to use as a context for MLS only attributes
145 * @sid: the SID
146 *
147 * Description:
148 * Call the NetLabel mechanism to get the security attributes of the given
149 * packet and use those attributes to determine the correct context/SID to
150 * assign to the packet. Returns zero on success, negative values on failure.
151 *
152 */
153int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
154{
155 int rc;
156 struct netlbl_lsm_secattr secattr;
157
158 netlbl_secattr_init(&secattr);
159 rc = netlbl_skbuff_getattr(skb, &secattr);
160 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
161 rc = security_netlbl_secattr_to_sid(&secattr,
162 base_sid,
163 sid);
164 else
165 *sid = SECSID_NULL;
166 netlbl_secattr_destroy(&secattr);
167
168 return rc;
169}
170
171/**
172 * selinux_netlbl_sock_graft - Netlabel the new socket
173 * @sk: the new connection
174 * @sock: the new socket
175 *
176 * Description:
177 * The connection represented by @sk is being grafted onto @sock so set the
178 * socket's NetLabel to match the SID of @sk.
179 *
180 */
181void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
182{
183 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
184 struct sk_security_struct *sksec = sk->sk_security;
185 struct netlbl_lsm_secattr secattr;
186 u32 nlbl_peer_sid;
187
188 sksec->sclass = isec->sclass;
189
190 rcu_read_lock();
191
192 if (sksec->nlbl_state != NLBL_REQUIRE) {
193 rcu_read_unlock();
194 return;
195 }
196
197 netlbl_secattr_init(&secattr);
198 if (netlbl_sock_getattr(sk, &secattr) == 0 &&
199 secattr.flags != NETLBL_SECATTR_NONE &&
200 security_netlbl_secattr_to_sid(&secattr,
201 SECINITSID_UNLABELED,
202 &nlbl_peer_sid) == 0)
203 sksec->peer_sid = nlbl_peer_sid;
204 netlbl_secattr_destroy(&secattr);
205
206 /* Try to set the NetLabel on the socket to save time later, if we fail
207 * here we will pick up the pieces in later calls to
208 * selinux_netlbl_inode_permission(). */
209 selinux_netlbl_socket_setsid(sock, sksec->sid);
210
211 rcu_read_unlock();
212}
213
214/**
215 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
216 * @sock: the socket to label
217 *
218 * Description:
219 * Attempt to label a socket using the NetLabel mechanism using the given
220 * SID. Returns zero values on success, negative values on failure.
221 *
222 */
223int selinux_netlbl_socket_post_create(struct socket *sock)
224{
225 int rc = 0;
226 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
227 struct sk_security_struct *sksec = sock->sk->sk_security;
228
229 sksec->sclass = isec->sclass;
230
231 rcu_read_lock();
232 if (sksec->nlbl_state == NLBL_REQUIRE)
233 rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
234 rcu_read_unlock();
235
236 return rc;
237}
238
239/**
240 * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
241 * @inode: the file descriptor's inode
242 * @mask: the permission mask
243 *
244 * Description:
245 * Looks at a file's inode and if it is marked as a socket protected by
246 * NetLabel then verify that the socket has been labeled, if not try to label
247 * the socket now with the inode's SID. Returns zero on success, negative
248 * values on failure.
249 *
250 */
251int selinux_netlbl_inode_permission(struct inode *inode, int mask)
252{
253 int rc;
254 struct sk_security_struct *sksec;
255 struct socket *sock;
256
257 if (!S_ISSOCK(inode->i_mode) ||
258 ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
259 return 0;
260 sock = SOCKET_I(inode);
261 sksec = sock->sk->sk_security;
262
263 rcu_read_lock();
264 if (sksec->nlbl_state != NLBL_REQUIRE) {
265 rcu_read_unlock();
266 return 0;
267 }
268 local_bh_disable();
269 bh_lock_sock_nested(sock->sk);
270 rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
271 bh_unlock_sock(sock->sk);
272 local_bh_enable();
273 rcu_read_unlock();
274
275 return rc;
276}
277
278/**
279 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
280 * @sksec: the sock's sk_security_struct
281 * @skb: the packet
282 * @ad: the audit data
283 *
284 * Description:
285 * Fetch the NetLabel security attributes from @skb and perform an access check
286 * against the receiving socket. Returns zero on success, negative values on
287 * error.
288 *
289 */
290int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
291 struct sk_buff *skb,
292 struct avc_audit_data *ad)
293{
294 int rc;
295 u32 netlbl_sid;
296 u32 recv_perm;
297
298 rc = selinux_netlbl_skbuff_getsid(skb,
299 SECINITSID_UNLABELED,
300 &netlbl_sid);
301 if (rc != 0)
302 return rc;
303
304 if (netlbl_sid == SECSID_NULL)
305 return 0;
306
307 switch (sksec->sclass) {
308 case SECCLASS_UDP_SOCKET:
309 recv_perm = UDP_SOCKET__RECVFROM;
310 break;
311 case SECCLASS_TCP_SOCKET:
312 recv_perm = TCP_SOCKET__RECVFROM;
313 break;
314 default:
315 recv_perm = RAWIP_SOCKET__RECVFROM;
316 }
317
318 rc = avc_has_perm(sksec->sid,
319 netlbl_sid,
320 sksec->sclass,
321 recv_perm,
322 ad);
323 if (rc == 0)
324 return 0;
325
326 netlbl_skbuff_err(skb, rc);
327 return rc;
328}
329
330/**
331 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
332 * @sock: the socket
333 * @level: the socket level or protocol
334 * @optname: the socket option name
335 *
336 * Description:
337 * Check the setsockopt() call and if the user is trying to replace the IP
338 * options on a socket and a NetLabel is in place for the socket deny the
339 * access; otherwise allow the access. Returns zero when the access is
340 * allowed, -EACCES when denied, and other negative values on error.
341 *
342 */
343int selinux_netlbl_socket_setsockopt(struct socket *sock,
344 int level,
345 int optname)
346{
347 int rc = 0;
348 struct sk_security_struct *sksec = sock->sk->sk_security;
349 struct netlbl_lsm_secattr secattr;
350
351 rcu_read_lock();
352 if (level == IPPROTO_IP && optname == IP_OPTIONS &&
353 sksec->nlbl_state == NLBL_LABELED) {
354 netlbl_secattr_init(&secattr);
355 rc = netlbl_socket_getattr(sock, &secattr);
356 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
357 rc = -EACCES;
358 netlbl_secattr_destroy(&secattr);
359 }
360 rcu_read_unlock();
361
362 return rc;
363}
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 93b3177c7585..aca099aa2ed3 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -96,12 +96,18 @@ enum sel_inos {
96 SEL_COMMIT_BOOLS, /* commit new boolean values */ 96 SEL_COMMIT_BOOLS, /* commit new boolean values */
97 SEL_MLS, /* return if MLS policy is enabled */ 97 SEL_MLS, /* return if MLS policy is enabled */
98 SEL_DISABLE, /* disable SELinux until next reboot */ 98 SEL_DISABLE, /* disable SELinux until next reboot */
99 SEL_AVC, /* AVC management directory */
100 SEL_MEMBER, /* compute polyinstantiation membership decision */ 99 SEL_MEMBER, /* compute polyinstantiation membership decision */
101 SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */ 100 SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */
102 SEL_COMPAT_NET, /* whether to use old compat network packet controls */ 101 SEL_COMPAT_NET, /* whether to use old compat network packet controls */
102 SEL_INO_NEXT, /* The next inode number to use */
103}; 103};
104 104
105static unsigned long sel_last_ino = SEL_INO_NEXT - 1;
106
107#define SEL_INITCON_INO_OFFSET 0x01000000
108#define SEL_BOOL_INO_OFFSET 0x02000000
109#define SEL_INO_MASK 0x00ffffff
110
105#define TMPBUFLEN 12 111#define TMPBUFLEN 12
106static ssize_t sel_read_enforce(struct file *filp, char __user *buf, 112static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
107 size_t count, loff_t *ppos) 113 size_t count, loff_t *ppos)
@@ -777,8 +783,6 @@ static struct inode *sel_make_inode(struct super_block *sb, int mode)
777 return ret; 783 return ret;
778} 784}
779 785
780#define BOOL_INO_OFFSET 30
781
782static ssize_t sel_read_bool(struct file *filep, char __user *buf, 786static ssize_t sel_read_bool(struct file *filep, char __user *buf,
783 size_t count, loff_t *ppos) 787 size_t count, loff_t *ppos)
784{ 788{
@@ -806,14 +810,14 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
806 } 810 }
807 811
808 inode = filep->f_path.dentry->d_inode; 812 inode = filep->f_path.dentry->d_inode;
809 cur_enforcing = security_get_bool_value(inode->i_ino - BOOL_INO_OFFSET); 813 cur_enforcing = security_get_bool_value(inode->i_ino&SEL_INO_MASK);
810 if (cur_enforcing < 0) { 814 if (cur_enforcing < 0) {
811 ret = cur_enforcing; 815 ret = cur_enforcing;
812 goto out; 816 goto out;
813 } 817 }
814 818
815 length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing, 819 length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
816 bool_pending_values[inode->i_ino - BOOL_INO_OFFSET]); 820 bool_pending_values[inode->i_ino&SEL_INO_MASK]);
817 ret = simple_read_from_buffer(buf, count, ppos, page, length); 821 ret = simple_read_from_buffer(buf, count, ppos, page, length);
818out: 822out:
819 mutex_unlock(&sel_mutex); 823 mutex_unlock(&sel_mutex);
@@ -865,7 +869,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
865 new_value = 1; 869 new_value = 1;
866 870
867 inode = filep->f_path.dentry->d_inode; 871 inode = filep->f_path.dentry->d_inode;
868 bool_pending_values[inode->i_ino - BOOL_INO_OFFSET] = new_value; 872 bool_pending_values[inode->i_ino&SEL_INO_MASK] = new_value;
869 length = count; 873 length = count;
870 874
871out: 875out:
@@ -1029,7 +1033,7 @@ static int sel_make_bools(void)
1029 isec->sid = sid; 1033 isec->sid = sid;
1030 isec->initialized = 1; 1034 isec->initialized = 1;
1031 inode->i_fop = &sel_bool_ops; 1035 inode->i_fop = &sel_bool_ops;
1032 inode->i_ino = i + BOOL_INO_OFFSET; 1036 inode->i_ino = i|SEL_BOOL_INO_OFFSET;
1033 d_add(dentry, inode); 1037 d_add(dentry, inode);
1034 } 1038 }
1035 bool_num = num; 1039 bool_num = num;
@@ -1234,6 +1238,56 @@ static int sel_make_avc_files(struct dentry *dir)
1234 goto out; 1238 goto out;
1235 } 1239 }
1236 inode->i_fop = files[i].ops; 1240 inode->i_fop = files[i].ops;
1241 inode->i_ino = ++sel_last_ino;
1242 d_add(dentry, inode);
1243 }
1244out:
1245 return ret;
1246}
1247
1248static ssize_t sel_read_initcon(struct file * file, char __user *buf,
1249 size_t count, loff_t *ppos)
1250{
1251 struct inode *inode;
1252 char *con;
1253 u32 sid, len;
1254 ssize_t ret;
1255
1256 inode = file->f_path.dentry->d_inode;
1257 sid = inode->i_ino&SEL_INO_MASK;
1258 ret = security_sid_to_context(sid, &con, &len);
1259 if (ret < 0)
1260 return ret;
1261
1262 ret = simple_read_from_buffer(buf, count, ppos, con, len);
1263 kfree(con);
1264 return ret;
1265}
1266
1267static const struct file_operations sel_initcon_ops = {
1268 .read = sel_read_initcon,
1269};
1270
1271static int sel_make_initcon_files(struct dentry *dir)
1272{
1273 int i, ret = 0;
1274
1275 for (i = 1; i <= SECINITSID_NUM; i++) {
1276 struct inode *inode;
1277 struct dentry *dentry;
1278 dentry = d_alloc_name(dir, security_get_initial_sid_context(i));
1279 if (!dentry) {
1280 ret = -ENOMEM;
1281 goto out;
1282 }
1283
1284 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1285 if (!inode) {
1286 ret = -ENOMEM;
1287 goto out;
1288 }
1289 inode->i_fop = &sel_initcon_ops;
1290 inode->i_ino = i|SEL_INITCON_INO_OFFSET;
1237 d_add(dentry, inode); 1291 d_add(dentry, inode);
1238 } 1292 }
1239out: 1293out:
@@ -1252,6 +1306,7 @@ static int sel_make_dir(struct inode *dir, struct dentry *dentry)
1252 } 1306 }
1253 inode->i_op = &simple_dir_inode_operations; 1307 inode->i_op = &simple_dir_inode_operations;
1254 inode->i_fop = &simple_dir_operations; 1308 inode->i_fop = &simple_dir_operations;
1309 inode->i_ino = ++sel_last_ino;
1255 /* directory inodes start off with i_nlink == 2 (for "." entry) */ 1310 /* directory inodes start off with i_nlink == 2 (for "." entry) */
1256 inc_nlink(inode); 1311 inc_nlink(inode);
1257 d_add(dentry, inode); 1312 d_add(dentry, inode);
@@ -1314,6 +1369,7 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent)
1314 ret = -ENOMEM; 1369 ret = -ENOMEM;
1315 goto err; 1370 goto err;
1316 } 1371 }
1372 inode->i_ino = ++sel_last_ino;
1317 isec = (struct inode_security_struct*)inode->i_security; 1373 isec = (struct inode_security_struct*)inode->i_security;
1318 isec->sid = SECINITSID_DEVNULL; 1374 isec->sid = SECINITSID_DEVNULL;
1319 isec->sclass = SECCLASS_CHR_FILE; 1375 isec->sclass = SECCLASS_CHR_FILE;
@@ -1336,6 +1392,21 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent)
1336 ret = sel_make_avc_files(dentry); 1392 ret = sel_make_avc_files(dentry);
1337 if (ret) 1393 if (ret)
1338 goto err; 1394 goto err;
1395
1396 dentry = d_alloc_name(sb->s_root, "initial_contexts");
1397 if (!dentry) {
1398 ret = -ENOMEM;
1399 goto err;
1400 }
1401
1402 ret = sel_make_dir(root_inode, dentry);
1403 if (ret)
1404 goto err;
1405
1406 ret = sel_make_initcon_files(dentry);
1407 if (ret)
1408 goto err;
1409
1339out: 1410out:
1340 return ret; 1411 return ret;
1341err: 1412err:
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 1e52356664d6..40660ffd49b6 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -39,7 +39,6 @@
39#include <linux/sched.h> 39#include <linux/sched.h>
40#include <linux/audit.h> 40#include <linux/audit.h>
41#include <linux/mutex.h> 41#include <linux/mutex.h>
42#include <net/sock.h>
43#include <net/netlabel.h> 42#include <net/netlabel.h>
44 43
45#include "flask.h" 44#include "flask.h"
@@ -53,7 +52,7 @@
53#include "conditional.h" 52#include "conditional.h"
54#include "mls.h" 53#include "mls.h"
55#include "objsec.h" 54#include "objsec.h"
56#include "selinux_netlabel.h" 55#include "netlabel.h"
57#include "xfrm.h" 56#include "xfrm.h"
58#include "ebitmap.h" 57#include "ebitmap.h"
59 58
@@ -594,6 +593,13 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
594 593
595#include "initial_sid_to_string.h" 594#include "initial_sid_to_string.h"
596 595
596const char *security_get_initial_sid_context(u32 sid)
597{
598 if (unlikely(sid > SECINITSID_NUM))
599 return NULL;
600 return initial_sid_to_string[sid];
601}
602
597/** 603/**
598 * security_sid_to_context - Obtain a context for a given SID. 604 * security_sid_to_context - Obtain a context for a given SID.
599 * @sid: security identifier, SID 605 * @sid: security identifier, SID
@@ -1050,6 +1056,8 @@ static int validate_classes(struct policydb *p)
1050 1056
1051 for (i = 1; i < kdefs->cts_len; i++) { 1057 for (i = 1; i < kdefs->cts_len; i++) {
1052 def_class = kdefs->class_to_string[i]; 1058 def_class = kdefs->class_to_string[i];
1059 if (!def_class)
1060 continue;
1053 if (i > p->p_classes.nprim) { 1061 if (i > p->p_classes.nprim) {
1054 printk(KERN_INFO 1062 printk(KERN_INFO
1055 "security: class %s not defined in policy\n", 1063 "security: class %s not defined in policy\n",
@@ -1249,6 +1257,7 @@ bad:
1249} 1257}
1250 1258
1251extern void selinux_complete_init(void); 1259extern void selinux_complete_init(void);
1260static int security_preserve_bools(struct policydb *p);
1252 1261
1253/** 1262/**
1254 * security_load_policy - Load a security policy configuration. 1263 * security_load_policy - Load a security policy configuration.
@@ -1325,6 +1334,12 @@ int security_load_policy(void *data, size_t len)
1325 goto err; 1334 goto err;
1326 } 1335 }
1327 1336
1337 rc = security_preserve_bools(&newpolicydb);
1338 if (rc) {
1339 printk(KERN_ERR "security: unable to preserve booleans\n");
1340 goto err;
1341 }
1342
1328 /* Clone the SID table. */ 1343 /* Clone the SID table. */
1329 sidtab_shutdown(&sidtab); 1344 sidtab_shutdown(&sidtab);
1330 if (sidtab_map(&sidtab, clone_sid, &newsidtab)) { 1345 if (sidtab_map(&sidtab, clone_sid, &newsidtab)) {
@@ -1882,6 +1897,37 @@ out:
1882 return rc; 1897 return rc;
1883} 1898}
1884 1899
1900static int security_preserve_bools(struct policydb *p)
1901{
1902 int rc, nbools = 0, *bvalues = NULL, i;
1903 char **bnames = NULL;
1904 struct cond_bool_datum *booldatum;
1905 struct cond_node *cur;
1906
1907 rc = security_get_bools(&nbools, &bnames, &bvalues);
1908 if (rc)
1909 goto out;
1910 for (i = 0; i < nbools; i++) {
1911 booldatum = hashtab_search(p->p_bools.table, bnames[i]);
1912 if (booldatum)
1913 booldatum->state = bvalues[i];
1914 }
1915 for (cur = p->cond_list; cur != NULL; cur = cur->next) {
1916 rc = evaluate_cond_node(p, cur);
1917 if (rc)
1918 goto out;
1919 }
1920
1921out:
1922 if (bnames) {
1923 for (i = 0; i < nbools; i++)
1924 kfree(bnames[i]);
1925 }
1926 kfree(bnames);
1927 kfree(bvalues);
1928 return rc;
1929}
1930
1885/* 1931/*
1886 * security_sid_mls_copy() - computes a new sid based on the given 1932 * security_sid_mls_copy() - computes a new sid based on the given
1887 * sid and the mls portion of mls_sid. 1933 * sid and the mls portion of mls_sid.
@@ -2198,41 +2244,15 @@ void selinux_audit_set_callback(int (*callback)(void))
2198 aurule_callback = callback; 2244 aurule_callback = callback;
2199} 2245}
2200 2246
2201/**
2202 * security_skb_extlbl_sid - Determine the external label of a packet
2203 * @skb: the packet
2204 * @base_sid: the SELinux SID to use as a context for MLS only external labels
2205 * @sid: the packet's SID
2206 *
2207 * Description:
2208 * Check the various different forms of external packet labeling and determine
2209 * the external SID for the packet.
2210 *
2211 */
2212void security_skb_extlbl_sid(struct sk_buff *skb, u32 base_sid, u32 *sid)
2213{
2214 u32 xfrm_sid;
2215 u32 nlbl_sid;
2216
2217 selinux_skb_xfrm_sid(skb, &xfrm_sid);
2218 if (selinux_netlbl_skbuff_getsid(skb,
2219 (xfrm_sid == SECSID_NULL ?
2220 base_sid : xfrm_sid),
2221 &nlbl_sid) != 0)
2222 nlbl_sid = SECSID_NULL;
2223
2224 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
2225}
2226
2227#ifdef CONFIG_NETLABEL 2247#ifdef CONFIG_NETLABEL
2228/* 2248/*
2229 * This is the structure we store inside the NetLabel cache block. 2249 * NetLabel cache structure
2230 */ 2250 */
2231#define NETLBL_CACHE(x) ((struct netlbl_cache *)(x)) 2251#define NETLBL_CACHE(x) ((struct selinux_netlbl_cache *)(x))
2232#define NETLBL_CACHE_T_NONE 0 2252#define NETLBL_CACHE_T_NONE 0
2233#define NETLBL_CACHE_T_SID 1 2253#define NETLBL_CACHE_T_SID 1
2234#define NETLBL_CACHE_T_MLS 2 2254#define NETLBL_CACHE_T_MLS 2
2235struct netlbl_cache { 2255struct selinux_netlbl_cache {
2236 u32 type; 2256 u32 type;
2237 union { 2257 union {
2238 u32 sid; 2258 u32 sid;
@@ -2241,7 +2261,7 @@ struct netlbl_cache {
2241}; 2261};
2242 2262
2243/** 2263/**
2244 * selinux_netlbl_cache_free - Free the NetLabel cached data 2264 * security_netlbl_cache_free - Free the NetLabel cached data
2245 * @data: the data to free 2265 * @data: the data to free
2246 * 2266 *
2247 * Description: 2267 * Description:
@@ -2249,9 +2269,9 @@ struct netlbl_cache {
2249 * netlbl_lsm_cache structure. 2269 * netlbl_lsm_cache structure.
2250 * 2270 *
2251 */ 2271 */
2252static void selinux_netlbl_cache_free(const void *data) 2272static void security_netlbl_cache_free(const void *data)
2253{ 2273{
2254 struct netlbl_cache *cache; 2274 struct selinux_netlbl_cache *cache;
2255 2275
2256 if (data == NULL) 2276 if (data == NULL)
2257 return; 2277 return;
@@ -2266,33 +2286,33 @@ static void selinux_netlbl_cache_free(const void *data)
2266} 2286}
2267 2287
2268/** 2288/**
2269 * selinux_netlbl_cache_add - Add an entry to the NetLabel cache 2289 * security_netlbl_cache_add - Add an entry to the NetLabel cache
2270 * @skb: the packet 2290 * @secattr: the NetLabel packet security attributes
2271 * @ctx: the SELinux context 2291 * @ctx: the SELinux context
2272 * 2292 *
2273 * Description: 2293 * Description:
2274 * Attempt to cache the context in @ctx, which was derived from the packet in 2294 * Attempt to cache the context in @ctx, which was derived from the packet in
2275 * @skb, in the NetLabel subsystem cache. 2295 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has
2296 * already been initialized.
2276 * 2297 *
2277 */ 2298 */
2278static void selinux_netlbl_cache_add(struct sk_buff *skb, struct context *ctx) 2299static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
2300 struct context *ctx)
2279{ 2301{
2280 struct netlbl_cache *cache = NULL; 2302 struct selinux_netlbl_cache *cache = NULL;
2281 struct netlbl_lsm_secattr secattr;
2282 2303
2283 netlbl_secattr_init(&secattr); 2304 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
2284 secattr.cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 2305 if (secattr->cache == NULL)
2285 if (secattr.cache == NULL) 2306 return;
2286 goto netlbl_cache_add_return;
2287 2307
2288 cache = kzalloc(sizeof(*cache), GFP_ATOMIC); 2308 cache = kzalloc(sizeof(*cache), GFP_ATOMIC);
2289 if (cache == NULL) 2309 if (cache == NULL)
2290 goto netlbl_cache_add_return; 2310 return;
2291 2311
2292 cache->type = NETLBL_CACHE_T_MLS; 2312 cache->type = NETLBL_CACHE_T_MLS;
2293 if (ebitmap_cpy(&cache->data.mls_label.level[0].cat, 2313 if (ebitmap_cpy(&cache->data.mls_label.level[0].cat,
2294 &ctx->range.level[0].cat) != 0) 2314 &ctx->range.level[0].cat) != 0)
2295 goto netlbl_cache_add_return; 2315 return;
2296 cache->data.mls_label.level[1].cat.highbit = 2316 cache->data.mls_label.level[1].cat.highbit =
2297 cache->data.mls_label.level[0].cat.highbit; 2317 cache->data.mls_label.level[0].cat.highbit;
2298 cache->data.mls_label.level[1].cat.node = 2318 cache->data.mls_label.level[1].cat.node =
@@ -2300,52 +2320,40 @@ static void selinux_netlbl_cache_add(struct sk_buff *skb, struct context *ctx)
2300 cache->data.mls_label.level[0].sens = ctx->range.level[0].sens; 2320 cache->data.mls_label.level[0].sens = ctx->range.level[0].sens;
2301 cache->data.mls_label.level[1].sens = ctx->range.level[0].sens; 2321 cache->data.mls_label.level[1].sens = ctx->range.level[0].sens;
2302 2322
2303 secattr.cache->free = selinux_netlbl_cache_free; 2323 secattr->cache->free = security_netlbl_cache_free;
2304 secattr.cache->data = (void *)cache; 2324 secattr->cache->data = (void *)cache;
2305 secattr.flags = NETLBL_SECATTR_CACHE; 2325 secattr->flags |= NETLBL_SECATTR_CACHE;
2306
2307 netlbl_cache_add(skb, &secattr);
2308
2309netlbl_cache_add_return:
2310 netlbl_secattr_destroy(&secattr);
2311} 2326}
2312 2327
2313/** 2328/**
2314 * selinux_netlbl_cache_invalidate - Invalidate the NetLabel cache 2329 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
2315 *
2316 * Description:
2317 * Invalidate the NetLabel security attribute mapping cache.
2318 *
2319 */
2320void selinux_netlbl_cache_invalidate(void)
2321{
2322 netlbl_cache_invalidate();
2323}
2324
2325/**
2326 * selinux_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
2327 * @skb: the network packet
2328 * @secattr: the NetLabel packet security attributes 2330 * @secattr: the NetLabel packet security attributes
2329 * @base_sid: the SELinux SID to use as a context for MLS only attributes 2331 * @base_sid: the SELinux SID to use as a context for MLS only attributes
2330 * @sid: the SELinux SID 2332 * @sid: the SELinux SID
2331 * 2333 *
2332 * Description: 2334 * Description:
2333 * Convert the given NetLabel packet security attributes in @secattr into a 2335 * Convert the given NetLabel security attributes in @secattr into a
2334 * SELinux SID. If the @secattr field does not contain a full SELinux 2336 * SELinux SID. If the @secattr field does not contain a full SELinux
2335 * SID/context then use the context in @base_sid as the foundation. If @skb 2337 * SID/context then use the context in @base_sid as the foundation. If
2336 * is not NULL attempt to cache as much data as possibile. Returns zero on 2338 * possibile the 'cache' field of @secattr is set and the CACHE flag is set;
2337 * success, negative values on failure. 2339 * this is to allow the @secattr to be used by NetLabel to cache the secattr to
2340 * SID conversion for future lookups. Returns zero on success, negative
2341 * values on failure.
2338 * 2342 *
2339 */ 2343 */
2340static int selinux_netlbl_secattr_to_sid(struct sk_buff *skb, 2344int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
2341 struct netlbl_lsm_secattr *secattr, 2345 u32 base_sid,
2342 u32 base_sid, 2346 u32 *sid)
2343 u32 *sid)
2344{ 2347{
2345 int rc = -EIDRM; 2348 int rc = -EIDRM;
2346 struct context *ctx; 2349 struct context *ctx;
2347 struct context ctx_new; 2350 struct context ctx_new;
2348 struct netlbl_cache *cache; 2351 struct selinux_netlbl_cache *cache;
2352
2353 if (!ss_initialized) {
2354 *sid = SECSID_NULL;
2355 return 0;
2356 }
2349 2357
2350 POLICY_RDLOCK; 2358 POLICY_RDLOCK;
2351 2359
@@ -2410,8 +2418,8 @@ static int selinux_netlbl_secattr_to_sid(struct sk_buff *skb,
2410 if (rc != 0) 2418 if (rc != 0)
2411 goto netlbl_secattr_to_sid_return_cleanup; 2419 goto netlbl_secattr_to_sid_return_cleanup;
2412 2420
2413 if (skb != NULL) 2421 security_netlbl_cache_add(secattr, &ctx_new);
2414 selinux_netlbl_cache_add(skb, &ctx_new); 2422
2415 ebitmap_destroy(&ctx_new.range.level[0].cat); 2423 ebitmap_destroy(&ctx_new.range.level[0].cat);
2416 } else { 2424 } else {
2417 *sid = SECSID_NULL; 2425 *sid = SECSID_NULL;
@@ -2427,338 +2435,43 @@ netlbl_secattr_to_sid_return_cleanup:
2427} 2435}
2428 2436
2429/** 2437/**
2430 * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel 2438 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
2431 * @skb: the packet 2439 * @sid: the SELinux SID
2432 * @base_sid: the SELinux SID to use as a context for MLS only attributes 2440 * @secattr: the NetLabel packet security attributes
2433 * @sid: the SID
2434 *
2435 * Description:
2436 * Call the NetLabel mechanism to get the security attributes of the given
2437 * packet and use those attributes to determine the correct context/SID to
2438 * assign to the packet. Returns zero on success, negative values on failure.
2439 *
2440 */
2441int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
2442{
2443 int rc;
2444 struct netlbl_lsm_secattr secattr;
2445
2446 netlbl_secattr_init(&secattr);
2447 rc = netlbl_skbuff_getattr(skb, &secattr);
2448 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
2449 rc = selinux_netlbl_secattr_to_sid(skb,
2450 &secattr,
2451 base_sid,
2452 sid);
2453 else
2454 *sid = SECSID_NULL;
2455 netlbl_secattr_destroy(&secattr);
2456
2457 return rc;
2458}
2459
2460/**
2461 * selinux_netlbl_socket_setsid - Label a socket using the NetLabel mechanism
2462 * @sock: the socket to label
2463 * @sid: the SID to use
2464 * 2441 *
2465 * Description: 2442 * Description:
2466 * Attempt to label a socket using the NetLabel mechanism using the given 2443 * Convert the given SELinux SID in @sid into a NetLabel security attribute.
2467 * SID. Returns zero values on success, negative values on failure. The 2444 * Returns zero on success, negative values on failure.
2468 * caller is responsibile for calling rcu_read_lock() before calling this
2469 * this function and rcu_read_unlock() after this function returns.
2470 * 2445 *
2471 */ 2446 */
2472static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid) 2447int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
2473{ 2448{
2474 int rc = -ENOENT; 2449 int rc = -ENOENT;
2475 struct sk_security_struct *sksec = sock->sk->sk_security;
2476 struct netlbl_lsm_secattr secattr;
2477 struct context *ctx; 2450 struct context *ctx;
2478 2451
2452 netlbl_secattr_init(secattr);
2453
2479 if (!ss_initialized) 2454 if (!ss_initialized)
2480 return 0; 2455 return 0;
2481 2456
2482 netlbl_secattr_init(&secattr);
2483
2484 POLICY_RDLOCK; 2457 POLICY_RDLOCK;
2485
2486 ctx = sidtab_search(&sidtab, sid); 2458 ctx = sidtab_search(&sidtab, sid);
2487 if (ctx == NULL) 2459 if (ctx == NULL)
2488 goto netlbl_socket_setsid_return; 2460 goto netlbl_sid_to_secattr_failure;
2489 2461 secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
2490 secattr.domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1], 2462 GFP_ATOMIC);
2491 GFP_ATOMIC); 2463 secattr->flags |= NETLBL_SECATTR_DOMAIN;
2492 secattr.flags |= NETLBL_SECATTR_DOMAIN; 2464 mls_export_netlbl_lvl(ctx, secattr);
2493 mls_export_netlbl_lvl(ctx, &secattr); 2465 rc = mls_export_netlbl_cat(ctx, secattr);
2494 rc = mls_export_netlbl_cat(ctx, &secattr);
2495 if (rc != 0) 2466 if (rc != 0)
2496 goto netlbl_socket_setsid_return; 2467 goto netlbl_sid_to_secattr_failure;
2497
2498 rc = netlbl_socket_setattr(sock, &secattr);
2499 if (rc == 0) {
2500 spin_lock_bh(&sksec->nlbl_lock);
2501 sksec->nlbl_state = NLBL_LABELED;
2502 spin_unlock_bh(&sksec->nlbl_lock);
2503 }
2504
2505netlbl_socket_setsid_return:
2506 POLICY_RDUNLOCK; 2468 POLICY_RDUNLOCK;
2507 netlbl_secattr_destroy(&secattr);
2508 return rc;
2509}
2510
2511/**
2512 * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
2513 * @ssec: the sk_security_struct
2514 * @family: the socket family
2515 *
2516 * Description:
2517 * Called when the NetLabel state of a sk_security_struct needs to be reset.
2518 * The caller is responsibile for all the NetLabel sk_security_struct locking.
2519 *
2520 */
2521void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
2522 int family)
2523{
2524 if (family == PF_INET)
2525 ssec->nlbl_state = NLBL_REQUIRE;
2526 else
2527 ssec->nlbl_state = NLBL_UNSET;
2528}
2529 2469
2530/** 2470 return 0;
2531 * selinux_netlbl_sk_security_init - Setup the NetLabel fields
2532 * @ssec: the sk_security_struct
2533 * @family: the socket family
2534 *
2535 * Description:
2536 * Called when a new sk_security_struct is allocated to initialize the NetLabel
2537 * fields.
2538 *
2539 */
2540void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
2541 int family)
2542{
2543 /* No locking needed, we are the only one who has access to ssec */
2544 selinux_netlbl_sk_security_reset(ssec, family);
2545 spin_lock_init(&ssec->nlbl_lock);
2546}
2547
2548/**
2549 * selinux_netlbl_sk_security_clone - Copy the NetLabel fields
2550 * @ssec: the original sk_security_struct
2551 * @newssec: the cloned sk_security_struct
2552 *
2553 * Description:
2554 * Clone the NetLabel specific sk_security_struct fields from @ssec to
2555 * @newssec.
2556 *
2557 */
2558void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
2559 struct sk_security_struct *newssec)
2560{
2561 /* We don't need to take newssec->nlbl_lock because we are the only
2562 * thread with access to newssec, but we do need to take the RCU read
2563 * lock as other threads could have access to ssec */
2564 rcu_read_lock();
2565 selinux_netlbl_sk_security_reset(newssec, ssec->sk->sk_family);
2566 newssec->sclass = ssec->sclass;
2567 rcu_read_unlock();
2568}
2569
2570/**
2571 * selinux_netlbl_socket_post_create - Label a socket using NetLabel
2572 * @sock: the socket to label
2573 *
2574 * Description:
2575 * Attempt to label a socket using the NetLabel mechanism using the given
2576 * SID. Returns zero values on success, negative values on failure.
2577 *
2578 */
2579int selinux_netlbl_socket_post_create(struct socket *sock)
2580{
2581 int rc = 0;
2582 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
2583 struct sk_security_struct *sksec = sock->sk->sk_security;
2584
2585 sksec->sclass = isec->sclass;
2586
2587 rcu_read_lock();
2588 if (sksec->nlbl_state == NLBL_REQUIRE)
2589 rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
2590 rcu_read_unlock();
2591
2592 return rc;
2593}
2594
2595/**
2596 * selinux_netlbl_sock_graft - Netlabel the new socket
2597 * @sk: the new connection
2598 * @sock: the new socket
2599 *
2600 * Description:
2601 * The connection represented by @sk is being grafted onto @sock so set the
2602 * socket's NetLabel to match the SID of @sk.
2603 *
2604 */
2605void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
2606{
2607 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
2608 struct sk_security_struct *sksec = sk->sk_security;
2609 struct netlbl_lsm_secattr secattr;
2610 u32 nlbl_peer_sid;
2611
2612 sksec->sclass = isec->sclass;
2613
2614 rcu_read_lock();
2615
2616 if (sksec->nlbl_state != NLBL_REQUIRE) {
2617 rcu_read_unlock();
2618 return;
2619 }
2620
2621 netlbl_secattr_init(&secattr);
2622 if (netlbl_sock_getattr(sk, &secattr) == 0 &&
2623 secattr.flags != NETLBL_SECATTR_NONE &&
2624 selinux_netlbl_secattr_to_sid(NULL,
2625 &secattr,
2626 SECINITSID_UNLABELED,
2627 &nlbl_peer_sid) == 0)
2628 sksec->peer_sid = nlbl_peer_sid;
2629 netlbl_secattr_destroy(&secattr);
2630
2631 /* Try to set the NetLabel on the socket to save time later, if we fail
2632 * here we will pick up the pieces in later calls to
2633 * selinux_netlbl_inode_permission(). */
2634 selinux_netlbl_socket_setsid(sock, sksec->sid);
2635
2636 rcu_read_unlock();
2637}
2638
2639/**
2640 * selinux_netlbl_inode_permission - Verify the socket is NetLabel labeled
2641 * @inode: the file descriptor's inode
2642 * @mask: the permission mask
2643 *
2644 * Description:
2645 * Looks at a file's inode and if it is marked as a socket protected by
2646 * NetLabel then verify that the socket has been labeled, if not try to label
2647 * the socket now with the inode's SID. Returns zero on success, negative
2648 * values on failure.
2649 *
2650 */
2651int selinux_netlbl_inode_permission(struct inode *inode, int mask)
2652{
2653 int rc;
2654 struct sk_security_struct *sksec;
2655 struct socket *sock;
2656
2657 if (!S_ISSOCK(inode->i_mode) ||
2658 ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
2659 return 0;
2660 sock = SOCKET_I(inode);
2661 sksec = sock->sk->sk_security;
2662
2663 rcu_read_lock();
2664 if (sksec->nlbl_state != NLBL_REQUIRE) {
2665 rcu_read_unlock();
2666 return 0;
2667 }
2668 local_bh_disable();
2669 bh_lock_sock_nested(sock->sk);
2670 rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
2671 bh_unlock_sock(sock->sk);
2672 local_bh_enable();
2673 rcu_read_unlock();
2674
2675 return rc;
2676}
2677
2678/**
2679 * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
2680 * @sksec: the sock's sk_security_struct
2681 * @skb: the packet
2682 * @ad: the audit data
2683 *
2684 * Description:
2685 * Fetch the NetLabel security attributes from @skb and perform an access check
2686 * against the receiving socket. Returns zero on success, negative values on
2687 * error.
2688 *
2689 */
2690int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
2691 struct sk_buff *skb,
2692 struct avc_audit_data *ad)
2693{
2694 int rc;
2695 u32 netlbl_sid;
2696 u32 recv_perm;
2697
2698 rc = selinux_netlbl_skbuff_getsid(skb,
2699 SECINITSID_UNLABELED,
2700 &netlbl_sid);
2701 if (rc != 0)
2702 return rc;
2703
2704 if (netlbl_sid == SECSID_NULL)
2705 return 0;
2706
2707 switch (sksec->sclass) {
2708 case SECCLASS_UDP_SOCKET:
2709 recv_perm = UDP_SOCKET__RECVFROM;
2710 break;
2711 case SECCLASS_TCP_SOCKET:
2712 recv_perm = TCP_SOCKET__RECVFROM;
2713 break;
2714 default:
2715 recv_perm = RAWIP_SOCKET__RECVFROM;
2716 }
2717
2718 rc = avc_has_perm(sksec->sid,
2719 netlbl_sid,
2720 sksec->sclass,
2721 recv_perm,
2722 ad);
2723 if (rc == 0)
2724 return 0;
2725
2726 netlbl_skbuff_err(skb, rc);
2727 return rc;
2728}
2729
2730/**
2731 * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
2732 * @sock: the socket
2733 * @level: the socket level or protocol
2734 * @optname: the socket option name
2735 *
2736 * Description:
2737 * Check the setsockopt() call and if the user is trying to replace the IP
2738 * options on a socket and a NetLabel is in place for the socket deny the
2739 * access; otherwise allow the access. Returns zero when the access is
2740 * allowed, -EACCES when denied, and other negative values on error.
2741 *
2742 */
2743int selinux_netlbl_socket_setsockopt(struct socket *sock,
2744 int level,
2745 int optname)
2746{
2747 int rc = 0;
2748 struct sk_security_struct *sksec = sock->sk->sk_security;
2749 struct netlbl_lsm_secattr secattr;
2750
2751 rcu_read_lock();
2752 if (level == IPPROTO_IP && optname == IP_OPTIONS &&
2753 sksec->nlbl_state == NLBL_LABELED) {
2754 netlbl_secattr_init(&secattr);
2755 rc = netlbl_socket_getattr(sock, &secattr);
2756 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
2757 rc = -EACCES;
2758 netlbl_secattr_destroy(&secattr);
2759 }
2760 rcu_read_unlock();
2761 2471
2472netlbl_sid_to_secattr_failure:
2473 POLICY_RDUNLOCK;
2474 netlbl_secattr_destroy(secattr);
2762 return rc; 2475 return rc;
2763} 2476}
2764#endif /* CONFIG_NETLABEL */ 2477#endif /* CONFIG_NETLABEL */
generated by cgit v1.2.2 (git 2.25.0) at 2025-11-12 06:12:49 -0500