3 files changed, 82 insertions, 53 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 87a915656eab..4d1a54190388 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1799,7 +1799,7 @@ static inline int may_rename(struct inode *old_dir,
 
         old_dsec = old_dir->i_security;
         old_isec = old_dentry->d_inode->i_security;
-        old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
+        old_is_dir = d_is_dir(old_dentry);
         new_dsec = new_dir->i_security;
 
         ad.type = LSM_AUDIT_DATA_DENTRY;
@@ -1822,14 +1822,14 @@ static inline int may_rename(struct inode *old_dir,
 
         ad.u.dentry = new_dentry;
         av = DIR__ADD_NAME | DIR__SEARCH;
-        if (new_dentry->d_inode)
+        if (d_is_positive(new_dentry))
                 av |= DIR__REMOVE_NAME;
         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
         if (rc)
                 return rc;
-        if (new_dentry->d_inode) {
+        if (d_is_positive(new_dentry)) {
                 new_isec = new_dentry->d_inode->i_security;
-                new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
+                new_is_dir = d_is_dir(new_dentry);
                 rc = avc_has_perm(sid, new_isec->sid,
                                   new_isec->sclass,
                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
@@ -1920,6 +1920,74 @@ static inline u32 open_file_to_av(struct file *file)
 
 /* Hook functions begin here. */
 
+static int selinux_binder_set_context_mgr(struct task_struct *mgr)
+{
+        u32 mysid = current_sid();
+        u32 mgrsid = task_sid(mgr);
+
+        return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
+                            BINDER__SET_CONTEXT_MGR, NULL);
+}
+
+static int selinux_binder_transaction(struct task_struct *from,
+                                      struct task_struct *to)
+{
+        u32 mysid = current_sid();
+        u32 fromsid = task_sid(from);
+        u32 tosid = task_sid(to);
+        int rc;
+
+        if (mysid != fromsid) {
+                rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
+                                  BINDER__IMPERSONATE, NULL);
+                if (rc)
+                        return rc;
+        }
+
+        return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
+                            NULL);
+}
+
+static int selinux_binder_transfer_binder(struct task_struct *from,
+                                          struct task_struct *to)
+{
+        u32 fromsid = task_sid(from);
+        u32 tosid = task_sid(to);
+
+        return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
+                            NULL);
+}
+
+static int selinux_binder_transfer_file(struct task_struct *from,
+                                        struct task_struct *to,
+                                        struct file *file)
+{
+        u32 sid = task_sid(to);
+        struct file_security_struct *fsec = file->f_security;
+        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode_security_struct *isec = inode->i_security;
+        struct common_audit_data ad;
+        int rc;
+
+        ad.type = LSM_AUDIT_DATA_PATH;
+        ad.u.path = file->f_path;
+
+        if (sid != fsec->sid) {
+                rc = avc_has_perm(sid, fsec->sid,
+                                  SECCLASS_FD,
+                                  FD__USE,
+                                  &ad);
+                if (rc)
+                        return rc;
+        }
+
+        if (unlikely(IS_PRIVATE(inode)))
+                return 0;
+
+        return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
+                            &ad);
+}
+
 static int selinux_ptrace_access_check(struct task_struct *child,
                                      unsigned int mode)
 {
@@ -5797,6 +5865,11 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
 static struct security_operations selinux_ops = {
         .name =                         "selinux",
 
+        .binder_set_context_mgr =       selinux_binder_set_context_mgr,
+        .binder_transaction =           selinux_binder_transaction,
+        .binder_transfer_binder =       selinux_binder_transfer_binder,
+        .binder_transfer_file =         selinux_binder_transfer_file,
+
         .ptrace_access_check =          selinux_ptrace_access_check,
         .ptrace_traceme =               selinux_ptrace_traceme,
         .capget =                       selinux_capget,
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index be491a74c1ed..eccd61b3de8a 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -151,5 +151,7 @@ struct security_class_mapping secclass_map[] = {
         { "kernel_service", { "use_as_override", "create_files_as", NULL } },
         { "tun_socket",
           { COMMON_SOCK_PERMS, "attach_queue", NULL } },
+        { "binder", { "impersonate", "call", "set_context_mgr", "transfer",
+                      NULL } },
         { NULL }
   };
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 138949a31eab..5fde34326dcf 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1195,30 +1195,8 @@ static const struct file_operations sel_commit_bools_ops = {
 
 static void sel_remove_entries(struct dentry *de)
 {
-        struct list_head *node;
-
-        spin_lock(&de->d_lock);
-        node = de->d_subdirs.next;
-        while (node != &de->d_subdirs) {
-                struct dentry *d = list_entry(node, struct dentry, d_child);
-
-                spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
-                list_del_init(node);
-
-                if (d->d_inode) {
-                        dget_dlock(d);
-                        spin_unlock(&de->d_lock);
-                        spin_unlock(&d->d_lock);
-                        d_delete(d);
-                        simple_unlink(de->d_inode, d);
-                        dput(d);
-                        spin_lock(&de->d_lock);
-                } else
-                        spin_unlock(&d->d_lock);
-                node = de->d_subdirs.next;
-        }
-
-        spin_unlock(&de->d_lock);
+        d_genocide(de);
+        shrink_dcache_parent(de);
 }
 
 #define BOOL_DIR_NAME "booleans"
@@ -1668,37 +1646,13 @@ static int sel_make_class_dir_entries(char *classname, int index,
         return rc;
 }
 
-static void sel_remove_classes(void)
-{
-        struct list_head *class_node;
-
-        list_for_each(class_node, &class_dir->d_subdirs) {
-                struct dentry *class_subdir = list_entry(class_node,
-                                        struct dentry, d_child);
-                struct list_head *class_subdir_node;
-
-                list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
-                        struct dentry *d = list_entry(class_subdir_node,
-                                                struct dentry, d_child);
-
-                        if (d->d_inode)
-                                if (d->d_inode->i_mode & S_IFDIR)
-                                        sel_remove_entries(d);
-                }
-
-                sel_remove_entries(class_subdir);
-        }
-
-        sel_remove_entries(class_dir);
-}
-
 static int sel_make_classes(void)
 {
         int rc, nclasses, i;
         char **classes;
 
         /* delete any existing entries */
-        sel_remove_classes();
+        sel_remove_entries(class_dir);
 
         rc = security_get_classes(&classes, &nclasses);
         if (rc)