1 files changed, 195 insertions, 0 deletions

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 79a1bb635662..87e0556bae70 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -68,6 +68,8 @@ static int *bool_pending_values;
 static struct dentry *class_dir;
 static unsigned long last_class_ino;
 
+static char policy_opened;
+
 /* global data for policy capabilities */
 static struct dentry *policycap_dir;
 
@@ -110,6 +112,8 @@ enum sel_inos {
         SEL_COMPAT_NET, /* whether to use old compat network packet controls */
         SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */
         SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */
+        SEL_STATUS,     /* export current status using mmap() */
+        SEL_POLICY,     /* allow userspace to read the in kernel policy */
         SEL_INO_NEXT,   /* The next inode number to use */
 };
 
@@ -171,6 +175,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                 if (selinux_enforcing)
                         avc_ss_reset(0);
                 selnl_notify_setenforce(selinux_enforcing);
+                selinux_status_update_setenforce(selinux_enforcing);
         }
         length = count;
 out:
@@ -205,6 +210,59 @@ static const struct file_operations sel_handle_unknown_ops = {
         .llseek         = generic_file_llseek,
 };
 
+static int sel_open_handle_status(struct inode *inode, struct file *filp)
+{
+        struct page    *status = selinux_kernel_status_page();
+
+        if (!status)
+                return -ENOMEM;
+
+        filp->private_data = status;
+
+        return 0;
+}
+
+static ssize_t sel_read_handle_status(struct file *filp, char __user *buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct page    *status = filp->private_data;
+
+        BUG_ON(!status);
+
+        return simple_read_from_buffer(buf, count, ppos,
+                                       page_address(status),
+                                       sizeof(struct selinux_kernel_status));
+}
+
+static int sel_mmap_handle_status(struct file *filp,
+                                  struct vm_area_struct *vma)
+{
+        struct page    *status = filp->private_data;
+        unsigned long   size = vma->vm_end - vma->vm_start;
+
+        BUG_ON(!status);
+
+        /* only allows one page from the head */
+        if (vma->vm_pgoff > 0 || size != PAGE_SIZE)
+                return -EIO;
+        /* disallow writable mapping */
+        if (vma->vm_flags & VM_WRITE)
+                return -EPERM;
+        /* disallow mprotect() turns it into writable */
+        vma->vm_flags &= ~VM_MAYWRITE;
+
+        return remap_pfn_range(vma, vma->vm_start,
+                               page_to_pfn(status),
+                               size, vma->vm_page_prot);
+}
+
+static const struct file_operations sel_handle_status_ops = {
+        .open           = sel_open_handle_status,
+        .read           = sel_read_handle_status,
+        .mmap           = sel_mmap_handle_status,
+        .llseek         = generic_file_llseek,
+};
+
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 static ssize_t sel_write_disable(struct file *file, const char __user *buf,
                                  size_t count, loff_t *ppos)
@@ -296,6 +354,141 @@ static const struct file_operations sel_mls_ops = {
         .llseek         = generic_file_llseek,
 };
 
+struct policy_load_memory {
+        size_t len;
+        void *data;
+};
+
+static int sel_open_policy(struct inode *inode, struct file *filp)
+{
+        struct policy_load_memory *plm = NULL;
+        int rc;
+
+        BUG_ON(filp->private_data);
+
+        mutex_lock(&sel_mutex);
+
+        rc = task_has_security(current, SECURITY__READ_POLICY);
+        if (rc)
+                goto err;
+
+        rc = -EBUSY;
+        if (policy_opened)
+                goto err;
+
+        rc = -ENOMEM;
+        plm = kzalloc(sizeof(*plm), GFP_KERNEL);
+        if (!plm)
+                goto err;
+
+        if (i_size_read(inode) != security_policydb_len()) {
+                mutex_lock(&inode->i_mutex);
+                i_size_write(inode, security_policydb_len());
+                mutex_unlock(&inode->i_mutex);
+        }
+
+        rc = security_read_policy(&plm->data, &plm->len);
+        if (rc)
+                goto err;
+
+        policy_opened = 1;
+
+        filp->private_data = plm;
+
+        mutex_unlock(&sel_mutex);
+
+        return 0;
+err:
+        mutex_unlock(&sel_mutex);
+
+        if (plm)
+                vfree(plm->data);
+        kfree(plm);
+        return rc;
+}
+
+static int sel_release_policy(struct inode *inode, struct file *filp)
+{
+        struct policy_load_memory *plm = filp->private_data;
+
+        BUG_ON(!plm);
+
+        policy_opened = 0;
+
+        vfree(plm->data);
+        kfree(plm);
+
+        return 0;
+}
+
+static ssize_t sel_read_policy(struct file *filp, char __user *buf,
+                               size_t count, loff_t *ppos)
+{
+        struct policy_load_memory *plm = filp->private_data;
+        int ret;
+
+        mutex_lock(&sel_mutex);
+
+        ret = task_has_security(current, SECURITY__READ_POLICY);
+        if (ret)
+                goto out;
+
+        ret = simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
+out:
+        mutex_unlock(&sel_mutex);
+        return ret;
+}
+
+static int sel_mmap_policy_fault(struct vm_area_struct *vma,
+                                 struct vm_fault *vmf)
+{
+        struct policy_load_memory *plm = vma->vm_file->private_data;
+        unsigned long offset;
+        struct page *page;
+
+        if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
+                return VM_FAULT_SIGBUS;
+
+        offset = vmf->pgoff << PAGE_SHIFT;
+        if (offset >= roundup(plm->len, PAGE_SIZE))
+                return VM_FAULT_SIGBUS;
+
+        page = vmalloc_to_page(plm->data + offset);
+        get_page(page);
+
+        vmf->page = page;
+
+        return 0;
+}
+
+static struct vm_operations_struct sel_mmap_policy_ops = {
+        .fault = sel_mmap_policy_fault,
+        .page_mkwrite = sel_mmap_policy_fault,
+};
+
+int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma)
+{
+        if (vma->vm_flags & VM_SHARED) {
+                /* do not allow mprotect to make mapping writable */
+                vma->vm_flags &= ~VM_MAYWRITE;
+
+                if (vma->vm_flags & VM_WRITE)
+                        return -EACCES;
+        }
+
+        vma->vm_flags |= VM_RESERVED;
+        vma->vm_ops = &sel_mmap_policy_ops;
+
+        return 0;
+}
+
+static const struct file_operations sel_policy_ops = {
+        .open           = sel_open_policy,
+        .read           = sel_read_policy,
+        .mmap           = sel_mmap_policy,
+        .release        = sel_release_policy,
+};
+
 static ssize_t sel_write_load(struct file *file, const char __user *buf,
                               size_t count, loff_t *ppos)
 
@@ -1612,6 +1805,8 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
                 [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
                 [SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO},
                 [SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO},
+                [SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO},
+                [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUSR},
                 /* last one */ {""}
         };
         ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);