security/selinux/selinuxfs.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Updated: Karl MacMillan <kmacmillan@tresys.com>
   3  *
   4  *      Added conditional policy language extensions
   5  *
   6  *  Updated: Hewlett-Packard <paul@paul-moore.com>
   7  *
   8  *      Added support for the policy capability bitmap
   9  *
  10  * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
  11  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  12  * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  */
  14
  15 #include <linux/kernel.h>
  16 #include <linux/pagemap.h>
  17 #include <linux/slab.h>
  18 #include <linux/vmalloc.h>
  19 #include <linux/fs.h>
  20 #include <linux/fs_context.h>
  21 #include <linux/mount.h>
  22 #include <linux/mutex.h>
  23 #include <linux/namei.h>
  24 #include <linux/init.h>
  25 #include <linux/string.h>
  26 #include <linux/security.h>
  27 #include <linux/major.h>
  28 #include <linux/seq_file.h>
  29 #include <linux/percpu.h>
  30 #include <linux/audit.h>
  31 #include <linux/uaccess.h>
  32 #include <linux/kobject.h>
  33 #include <linux/ctype.h>
  34
  35 /* selinuxfs pseudo filesystem for exporting the security policy API.
  36    Based on the proc code and the fs/nfsd/nfsctl.c code. */
  37
  38 #include "flask.h"
  39 #include "avc.h"
  40 #include "avc_ss.h"
  41 #include "security.h"
  42 #include "objsec.h"
  43 #include "conditional.h"
  44
  45 enum sel_inos {
  46         SEL_ROOT_INO = 2,
  47         SEL_LOAD,       /* load policy */
  48         SEL_ENFORCE,    /* get or set enforcing status */
  49         SEL_CONTEXT,    /* validate context */
  50         SEL_ACCESS,     /* compute access decision */
  51         SEL_CREATE,     /* compute create labeling decision */
  52         SEL_RELABEL,    /* compute relabeling decision */
  53         SEL_USER,       /* compute reachable user contexts */
  54         SEL_POLICYVERS, /* return policy version for this kernel */
  55         SEL_COMMIT_BOOLS, /* commit new boolean values */
  56         SEL_MLS,        /* return if MLS policy is enabled */
  57         SEL_DISABLE,    /* disable SELinux until next reboot */
  58         SEL_MEMBER,     /* compute polyinstantiation membership decision */
  59         SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */
  60         SEL_COMPAT_NET, /* whether to use old compat network packet controls */
  61         SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */
  62         SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */
  63         SEL_STATUS,     /* export current status using mmap() */
  64         SEL_POLICY,     /* allow userspace to read the in kernel policy */
  65         SEL_VALIDATE_TRANS, /* compute validatetrans decision */
  66         SEL_INO_NEXT,   /* The next inode number to use */
  67 };
  68
  69 struct selinux_fs_info {
  70         struct dentry *bool_dir;
  71         unsigned int bool_num;
  72         char **bool_pending_names;
  73         unsigned int *bool_pending_values;
  74         struct dentry *class_dir;
  75         unsigned long last_class_ino;
  76         bool policy_opened;
  77         struct dentry *policycap_dir;
  78         unsigned long last_ino;
  79         struct selinux_state *state;
  80         struct super_block *sb;
  81 };
  82
  83 static int selinux_fs_info_create(struct super_block *sb)
  84 {
  85         struct selinux_fs_info *fsi;
  86
  87         fsi = kzalloc(sizeof(*fsi), GFP_KERNEL);
  88         if (!fsi)
  89                 return -ENOMEM;
  90
  91         fsi->last_ino = SEL_INO_NEXT - 1;
  92         fsi->state = &selinux_state;
  93         fsi->sb = sb;
  94         sb->s_fs_info = fsi;
  95         return 0;
  96 }
  97
  98 static void selinux_fs_info_free(struct super_block *sb)
  99 {
 100         struct selinux_fs_info *fsi = sb->s_fs_info;
 101         int i;
 102
 103         if (fsi) {
 104                 for (i = 0; i < fsi->bool_num; i++)
 105                         kfree(fsi->bool_pending_names[i]);
 106                 kfree(fsi->bool_pending_names);
 107                 kfree(fsi->bool_pending_values);
 108         }
 109         kfree(sb->s_fs_info);
 110         sb->s_fs_info = NULL;
 111 }
 112
 113 #define SEL_INITCON_INO_OFFSET          0x01000000
 114 #define SEL_BOOL_INO_OFFSET             0x02000000
 115 #define SEL_CLASS_INO_OFFSET            0x04000000
 116 #define SEL_POLICYCAP_INO_OFFSET        0x08000000
 117 #define SEL_INO_MASK                    0x00ffffff
 118
 119 #define BOOL_DIR_NAME "booleans"
 120 #define CLASS_DIR_NAME "class"
 121 #define POLICYCAP_DIR_NAME "policy_capabilities"
 122
 123 #define TMPBUFLEN       12
 124 static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
 125                                 size_t count, loff_t *ppos)
 126 {
 127         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 128         char tmpbuf[TMPBUFLEN];
 129         ssize_t length;
 130
 131         length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
 132                            enforcing_enabled(fsi->state));
 133         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 134 }
 135
 136 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 137 static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
 138                                  size_t count, loff_t *ppos)
 139
 140 {
 141         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 142         struct selinux_state *state = fsi->state;
 143         char *page = NULL;
 144         ssize_t length;
 145         int old_value, new_value;
 146
 147         if (count >= PAGE_SIZE)
 148                 return -ENOMEM;
 149
 150         /* No partial writes. */
 151         if (*ppos != 0)
 152                 return -EINVAL;
 153
 154         page = memdup_user_nul(buf, count);
 155         if (IS_ERR(page))
 156                 return PTR_ERR(page);
 157
 158         length = -EINVAL;
 159         if (sscanf(page, "%d", &new_value) != 1)
 160                 goto out;
 161
 162         new_value = !!new_value;
 163
 164         old_value = enforcing_enabled(state);
 165         if (new_value != old_value) {
 166                 length = avc_has_perm(&selinux_state,
 167                                       current_sid(), SECINITSID_SECURITY,
 168                                       SECCLASS_SECURITY, SECURITY__SETENFORCE,
 169                                       NULL);
 170                 if (length)
 171                         goto out;
 172                 audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
 173                         "enforcing=%d old_enforcing=%d auid=%u ses=%u"
 174                         " enabled=1 old-enabled=1 lsm=selinux res=1",
 175                         new_value, old_value,
 176                         from_kuid(&init_user_ns, audit_get_loginuid(current)),
 177                         audit_get_sessionid(current));
 178                 enforcing_set(state, new_value);
 179                 if (new_value)
 180                         avc_ss_reset(state->avc, 0);
 181                 selnl_notify_setenforce(new_value);
 182                 selinux_status_update_setenforce(state, new_value);
 183                 if (!new_value)
 184                         call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 185         }
 186         length = count;
 187 out:
 188         kfree(page);
 189         return length;
 190 }
 191 #else
 192 #define sel_write_enforce NULL
 193 #endif
 194
 195 static const struct file_operations sel_enforce_ops = {
 196         .read           = sel_read_enforce,
 197         .write          = sel_write_enforce,
 198         .llseek         = generic_file_llseek,
 199 };
 200
 201 static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
 202                                         size_t count, loff_t *ppos)
 203 {
 204         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 205         struct selinux_state *state = fsi->state;
 206         char tmpbuf[TMPBUFLEN];
 207         ssize_t length;
 208         ino_t ino = file_inode(filp)->i_ino;
 209         int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
 210                 security_get_reject_unknown(state) :
 211                 !security_get_allow_unknown(state);
 212
 213         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
 214         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 215 }
 216
 217 static const struct file_operations sel_handle_unknown_ops = {
 218         .read           = sel_read_handle_unknown,
 219         .llseek         = generic_file_llseek,
 220 };
 221
 222 static int sel_open_handle_status(struct inode *inode, struct file *filp)
 223 {
 224         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 225         struct page    *status = selinux_kernel_status_page(fsi->state);
 226
 227         if (!status)
 228                 return -ENOMEM;
 229
 230         filp->private_data = status;
 231
 232         return 0;
 233 }
 234
 235 static ssize_t sel_read_handle_status(struct file *filp, char __user *buf,
 236                                       size_t count, loff_t *ppos)
 237 {
 238         struct page    *status = filp->private_data;
 239
 240         BUG_ON(!status);
 241
 242         return simple_read_from_buffer(buf, count, ppos,
 243                                        page_address(status),
 244                                        sizeof(struct selinux_kernel_status));
 245 }
 246
 247 static int sel_mmap_handle_status(struct file *filp,
 248                                   struct vm_area_struct *vma)
 249 {
 250         struct page    *status = filp->private_data;
 251         unsigned long   size = vma->vm_end - vma->vm_start;
 252
 253         BUG_ON(!status);
 254
 255         /* only allows one page from the head */
 256         if (vma->vm_pgoff > 0 || size != PAGE_SIZE)
 257                 return -EIO;
 258         /* disallow writable mapping */
 259         if (vma->vm_flags & VM_WRITE)
 260                 return -EPERM;
 261         /* disallow mprotect() turns it into writable */
 262         vma->vm_flags &= ~VM_MAYWRITE;
 263
 264         return remap_pfn_range(vma, vma->vm_start,
 265                                page_to_pfn(status),
 266                                size, vma->vm_page_prot);
 267 }
 268
 269 static const struct file_operations sel_handle_status_ops = {
 270         .open           = sel_open_handle_status,
 271         .read           = sel_read_handle_status,
 272         .mmap           = sel_mmap_handle_status,
 273         .llseek         = generic_file_llseek,
 274 };
 275
 276 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 277 static ssize_t sel_write_disable(struct file *file, const char __user *buf,
 278                                  size_t count, loff_t *ppos)
 279
 280 {
 281         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 282         char *page;
 283         ssize_t length;
 284         int new_value;
 285         int enforcing;
 286
 287         /* NOTE: we are now officially considering runtime disable as
 288          *       deprecated, and using it will become increasingly painful
 289          *       (e.g. sleeping/blocking) as we progress through future
 290          *       kernel releases until eventually it is removed
 291          */
 292         pr_err("SELinux:  Runtime disable is deprecated, use selinux=0 on the kernel cmdline.\n");
 293
 294         if (count >= PAGE_SIZE)
 295                 return -ENOMEM;
 296
 297         /* No partial writes. */
 298         if (*ppos != 0)
 299                 return -EINVAL;
 300
 301         page = memdup_user_nul(buf, count);
 302         if (IS_ERR(page))
 303                 return PTR_ERR(page);
 304
 305         length = -EINVAL;
 306         if (sscanf(page, "%d", &new_value) != 1)
 307                 goto out;
 308
 309         if (new_value) {
 310                 enforcing = enforcing_enabled(fsi->state);
 311                 length = selinux_disable(fsi->state);
 312                 if (length)
 313                         goto out;
 314                 audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
 315                         "enforcing=%d old_enforcing=%d auid=%u ses=%u"
 316                         " enabled=0 old-enabled=1 lsm=selinux res=1",
 317                         enforcing, enforcing,
 318                         from_kuid(&init_user_ns, audit_get_loginuid(current)),
 319                         audit_get_sessionid(current));
 320         }
 321
 322         length = count;
 323 out:
 324         kfree(page);
 325         return length;
 326 }
 327 #else
 328 #define sel_write_disable NULL
 329 #endif
 330
 331 static const struct file_operations sel_disable_ops = {
 332         .write          = sel_write_disable,
 333         .llseek         = generic_file_llseek,
 334 };
 335
 336 static ssize_t sel_read_policyvers(struct file *filp, char __user *buf,
 337                                    size_t count, loff_t *ppos)
 338 {
 339         char tmpbuf[TMPBUFLEN];
 340         ssize_t length;
 341
 342         length = scnprintf(tmpbuf, TMPBUFLEN, "%u", POLICYDB_VERSION_MAX);
 343         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 344 }
 345
 346 static const struct file_operations sel_policyvers_ops = {
 347         .read           = sel_read_policyvers,
 348         .llseek         = generic_file_llseek,
 349 };
 350
 351 /* declaration for sel_write_load */
 352 static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
 353                           unsigned int *bool_num, char ***bool_pending_names,
 354                           unsigned int **bool_pending_values);
 355 static int sel_make_classes(struct selinux_policy *newpolicy,
 356                             struct dentry *class_dir,
 357                             unsigned long *last_class_ino);
 358
 359 /* declaration for sel_make_class_dirs */
 360 static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
 361                         unsigned long *ino);
 362
 363 /* declaration for sel_make_policy_nodes */
 364 static struct dentry *sel_make_disconnected_dir(struct super_block *sb,
 365                                                 unsigned long *ino);
 366
 367 /* declaration for sel_make_policy_nodes */
 368 static void sel_remove_entries(struct dentry *de);
 369
 370 static ssize_t sel_read_mls(struct file *filp, char __user *buf,
 371                                 size_t count, loff_t *ppos)
 372 {
 373         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 374         char tmpbuf[TMPBUFLEN];
 375         ssize_t length;
 376
 377         length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
 378                            security_mls_enabled(fsi->state));
 379         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 380 }
 381
 382 static const struct file_operations sel_mls_ops = {
 383         .read           = sel_read_mls,
 384         .llseek         = generic_file_llseek,
 385 };
 386
 387 struct policy_load_memory {
 388         size_t len;
 389         void *data;
 390 };
 391
 392 static int sel_open_policy(struct inode *inode, struct file *filp)
 393 {
 394         struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
 395         struct selinux_state *state = fsi->state;
 396         struct policy_load_memory *plm = NULL;
 397         int rc;
 398
 399         BUG_ON(filp->private_data);
 400
 401         mutex_lock(&fsi->state->policy_mutex);
 402
 403         rc = avc_has_perm(&selinux_state,
 404                           current_sid(), SECINITSID_SECURITY,
 405                           SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
 406         if (rc)
 407                 goto err;
 408
 409         rc = -EBUSY;
 410         if (fsi->policy_opened)
 411                 goto err;
 412
 413         rc = -ENOMEM;
 414         plm = kzalloc(sizeof(*plm), GFP_KERNEL);
 415         if (!plm)
 416                 goto err;
 417
 418         rc = security_read_policy(state, &plm->data, &plm->len);
 419         if (rc)
 420                 goto err;
 421
 422         if ((size_t)i_size_read(inode) != plm->len) {
 423                 inode_lock(inode);
 424                 i_size_write(inode, plm->len);
 425                 inode_unlock(inode);
 426         }
 427
 428         fsi->policy_opened = 1;
 429
 430         filp->private_data = plm;
 431
 432         mutex_unlock(&fsi->state->policy_mutex);
 433
 434         return 0;
 435 err:
 436         mutex_unlock(&fsi->state->policy_mutex);
 437
 438         if (plm)
 439                 vfree(plm->data);
 440         kfree(plm);
 441         return rc;
 442 }
 443
 444 static int sel_release_policy(struct inode *inode, struct file *filp)
 445 {
 446         struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
 447         struct policy_load_memory *plm = filp->private_data;
 448
 449         BUG_ON(!plm);
 450
 451         fsi->policy_opened = 0;
 452
 453         vfree(plm->data);
 454         kfree(plm);
 455
 456         return 0;
 457 }
 458
 459 static ssize_t sel_read_policy(struct file *filp, char __user *buf,
 460                                size_t count, loff_t *ppos)
 461 {
 462         struct policy_load_memory *plm = filp->private_data;
 463         int ret;
 464
 465         ret = avc_has_perm(&selinux_state,
 466                            current_sid(), SECINITSID_SECURITY,
 467                           SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
 468         if (ret)
 469                 return ret;
 470
 471         return simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
 472 }
 473
 474 static vm_fault_t sel_mmap_policy_fault(struct vm_fault *vmf)
 475 {
 476         struct policy_load_memory *plm = vmf->vma->vm_file->private_data;
 477         unsigned long offset;
 478         struct page *page;
 479
 480         if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
 481                 return VM_FAULT_SIGBUS;
 482
 483         offset = vmf->pgoff << PAGE_SHIFT;
 484         if (offset >= roundup(plm->len, PAGE_SIZE))
 485                 return VM_FAULT_SIGBUS;
 486
 487         page = vmalloc_to_page(plm->data + offset);
 488         get_page(page);
 489
 490         vmf->page = page;
 491
 492         return 0;
 493 }
 494
 495 static const struct vm_operations_struct sel_mmap_policy_ops = {
 496         .fault = sel_mmap_policy_fault,
 497         .page_mkwrite = sel_mmap_policy_fault,
 498 };
 499
 500 static int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma)
 501 {
 502         if (vma->vm_flags & VM_SHARED) {
 503                 /* do not allow mprotect to make mapping writable */
 504                 vma->vm_flags &= ~VM_MAYWRITE;
 505
 506                 if (vma->vm_flags & VM_WRITE)
 507                         return -EACCES;
 508         }
 509
 510         vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
 511         vma->vm_ops = &sel_mmap_policy_ops;
 512
 513         return 0;
 514 }
 515
 516 static const struct file_operations sel_policy_ops = {
 517         .open           = sel_open_policy,
 518         .read           = sel_read_policy,
 519         .mmap           = sel_mmap_policy,
 520         .release        = sel_release_policy,
 521         .llseek         = generic_file_llseek,
 522 };
 523
 524 static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names,
 525                                 unsigned int *bool_values)
 526 {
 527         u32 i;
 528
 529         /* bool_dir cleanup */
 530         for (i = 0; i < bool_num; i++)
 531                 kfree(bool_names[i]);
 532         kfree(bool_names);
 533         kfree(bool_values);
 534 }
 535
 536 static int sel_make_policy_nodes(struct selinux_fs_info *fsi,
 537                                 struct selinux_policy *newpolicy)
 538 {
 539         int ret = 0;
 540         struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir, *old_dentry;
 541         unsigned int tmp_bool_num, old_bool_num;
 542         char **tmp_bool_names, **old_bool_names;
 543         unsigned int *tmp_bool_values, *old_bool_values;
 544         unsigned long tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */
 545
 546         tmp_parent = sel_make_disconnected_dir(fsi->sb, &tmp_ino);
 547         if (IS_ERR(tmp_parent))
 548                 return PTR_ERR(tmp_parent);
 549
 550         tmp_ino = fsi->bool_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */
 551         tmp_bool_dir = sel_make_dir(tmp_parent, BOOL_DIR_NAME, &tmp_ino);
 552         if (IS_ERR(tmp_bool_dir)) {
 553                 ret = PTR_ERR(tmp_bool_dir);
 554                 goto out;
 555         }
 556
 557         tmp_ino = fsi->class_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */
 558         tmp_class_dir = sel_make_dir(tmp_parent, CLASS_DIR_NAME, &tmp_ino);
 559         if (IS_ERR(tmp_class_dir)) {
 560                 ret = PTR_ERR(tmp_class_dir);
 561                 goto out;
 562         }
 563
 564         ret = sel_make_bools(newpolicy, tmp_bool_dir, &tmp_bool_num,
 565                              &tmp_bool_names, &tmp_bool_values);
 566         if (ret) {
 567                 pr_err("SELinux: failed to load policy booleans\n");
 568                 goto out;
 569         }
 570
 571         ret = sel_make_classes(newpolicy, tmp_class_dir,
 572                                &fsi->last_class_ino);
 573         if (ret) {
 574                 pr_err("SELinux: failed to load policy classes\n");
 575                 goto out;
 576         }
 577
 578         /* booleans */
 579         old_dentry = fsi->bool_dir;
 580         lock_rename(tmp_bool_dir, old_dentry);
 581         d_exchange(tmp_bool_dir, fsi->bool_dir);
 582
 583         old_bool_num = fsi->bool_num;
 584         old_bool_names = fsi->bool_pending_names;
 585         old_bool_values = fsi->bool_pending_values;
 586
 587         fsi->bool_num = tmp_bool_num;
 588         fsi->bool_pending_names = tmp_bool_names;
 589         fsi->bool_pending_values = tmp_bool_values;
 590
 591         sel_remove_old_bool_data(old_bool_num, old_bool_names, old_bool_values);
 592
 593         fsi->bool_dir = tmp_bool_dir;
 594         unlock_rename(tmp_bool_dir, old_dentry);
 595
 596         /* classes */
 597         old_dentry = fsi->class_dir;
 598         lock_rename(tmp_class_dir, old_dentry);
 599         d_exchange(tmp_class_dir, fsi->class_dir);
 600         fsi->class_dir = tmp_class_dir;
 601         unlock_rename(tmp_class_dir, old_dentry);
 602
 603 out:
 604         /* Since the other temporary dirs are children of tmp_parent
 605          * this will handle all the cleanup in the case of a failure before
 606          * the swapover
 607          */
 608         sel_remove_entries(tmp_parent);
 609         dput(tmp_parent); /* d_genocide() only handles the children */
 610
 611         return ret;
 612 }
 613
 614 static ssize_t sel_write_load(struct file *file, const char __user *buf,
 615                               size_t count, loff_t *ppos)
 616
 617 {
 618         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 619         struct selinux_policy *newpolicy;
 620         ssize_t length;
 621         void *data = NULL;
 622
 623         mutex_lock(&fsi->state->policy_mutex);
 624
 625         length = avc_has_perm(&selinux_state,
 626                               current_sid(), SECINITSID_SECURITY,
 627                               SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
 628         if (length)
 629                 goto out;
 630
 631         /* No partial writes. */
 632         length = -EINVAL;
 633         if (*ppos != 0)
 634                 goto out;
 635
 636         length = -ENOMEM;
 637         data = vmalloc(count);
 638         if (!data)
 639                 goto out;
 640
 641         length = -EFAULT;
 642         if (copy_from_user(data, buf, count) != 0)
 643                 goto out;
 644
 645         length = security_load_policy(fsi->state, data, count, &newpolicy);
 646         if (length) {
 647                 pr_warn_ratelimited("SELinux: failed to load policy\n");
 648                 goto out;
 649         }
 650
 651         length = sel_make_policy_nodes(fsi, newpolicy);
 652         if (length) {
 653                 selinux_policy_cancel(fsi->state, newpolicy);
 654                 goto out1;
 655         }
 656
 657         selinux_policy_commit(fsi->state, newpolicy);
 658
 659         length = count;
 660
 661 out1:
 662         audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
 663                 "auid=%u ses=%u lsm=selinux res=1",
 664                 from_kuid(&init_user_ns, audit_get_loginuid(current)),
 665                 audit_get_sessionid(current));
 666 out:
 667         mutex_unlock(&fsi->state->policy_mutex);
 668         vfree(data);
 669         return length;
 670 }
 671
 672 static const struct file_operations sel_load_ops = {
 673         .write          = sel_write_load,
 674         .llseek         = generic_file_llseek,
 675 };
 676
 677 static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
 678 {
 679         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 680         struct selinux_state *state = fsi->state;
 681         char *canon = NULL;
 682         u32 sid, len;
 683         ssize_t length;
 684
 685         length = avc_has_perm(&selinux_state,
 686                               current_sid(), SECINITSID_SECURITY,
 687                               SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
 688         if (length)
 689                 goto out;
 690
 691         length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL);
 692         if (length)
 693                 goto out;
 694
 695         length = security_sid_to_context(state, sid, &canon, &len);
 696         if (length)
 697                 goto out;
 698
 699         length = -ERANGE;
 700         if (len > SIMPLE_TRANSACTION_LIMIT) {
 701                 pr_err("SELinux: %s:  context size (%u) exceeds "
 702                         "payload max\n", __func__, len);
 703                 goto out;
 704         }
 705
 706         memcpy(buf, canon, len);
 707         length = len;
 708 out:
 709         kfree(canon);
 710         return length;
 711 }
 712
 713 static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
 714                                      size_t count, loff_t *ppos)
 715 {
 716         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
 717         char tmpbuf[TMPBUFLEN];
 718         ssize_t length;
 719
 720         length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
 721                            checkreqprot_get(fsi->state));
 722         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 723 }
 724
 725 static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
 726                                       size_t count, loff_t *ppos)
 727 {
 728         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 729         char *page;
 730         ssize_t length;
 731         unsigned int new_value;
 732
 733         length = avc_has_perm(&selinux_state,
 734                               current_sid(), SECINITSID_SECURITY,
 735                               SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
 736                               NULL);
 737         if (length)
 738                 return length;
 739
 740         if (count >= PAGE_SIZE)
 741                 return -ENOMEM;
 742
 743         /* No partial writes. */
 744         if (*ppos != 0)
 745                 return -EINVAL;
 746
 747         page = memdup_user_nul(buf, count);
 748         if (IS_ERR(page))
 749                 return PTR_ERR(page);
 750
 751         length = -EINVAL;
 752         if (sscanf(page, "%u", &new_value) != 1)
 753                 goto out;
 754
 755         if (new_value) {
 756                 char comm[sizeof(current->comm)];
 757
 758                 memcpy(comm, current->comm, sizeof(comm));
 759                 pr_warn_once("SELinux: %s (%d) set checkreqprot to 1. This is deprecated and will be rejected in a future kernel release.\n",
 760                              comm, current->pid);
 761         }
 762
 763         checkreqprot_set(fsi->state, (new_value ? 1 : 0));
 764         length = count;
 765 out:
 766         kfree(page);
 767         return length;
 768 }
 769 static const struct file_operations sel_checkreqprot_ops = {
 770         .read           = sel_read_checkreqprot,
 771         .write          = sel_write_checkreqprot,
 772         .llseek         = generic_file_llseek,
 773 };
 774
 775 static ssize_t sel_write_validatetrans(struct file *file,
 776                                         const char __user *buf,
 777                                         size_t count, loff_t *ppos)
 778 {
 779         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 780         struct selinux_state *state = fsi->state;
 781         char *oldcon = NULL, *newcon = NULL, *taskcon = NULL;
 782         char *req = NULL;
 783         u32 osid, nsid, tsid;
 784         u16 tclass;
 785         int rc;
 786
 787         rc = avc_has_perm(&selinux_state,
 788                           current_sid(), SECINITSID_SECURITY,
 789                           SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
 790         if (rc)
 791                 goto out;
 792
 793         rc = -ENOMEM;
 794         if (count >= PAGE_SIZE)
 795                 goto out;
 796
 797         /* No partial writes. */
 798         rc = -EINVAL;
 799         if (*ppos != 0)
 800                 goto out;
 801
 802         req = memdup_user_nul(buf, count);
 803         if (IS_ERR(req)) {
 804                 rc = PTR_ERR(req);
 805                 req = NULL;
 806                 goto out;
 807         }
 808
 809         rc = -ENOMEM;
 810         oldcon = kzalloc(count + 1, GFP_KERNEL);
 811         if (!oldcon)
 812                 goto out;
 813
 814         newcon = kzalloc(count + 1, GFP_KERNEL);
 815         if (!newcon)
 816                 goto out;
 817
 818         taskcon = kzalloc(count + 1, GFP_KERNEL);
 819         if (!taskcon)
 820                 goto out;
 821
 822         rc = -EINVAL;
 823         if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
 824                 goto out;
 825
 826         rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL);
 827         if (rc)
 828                 goto out;
 829
 830         rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL);
 831         if (rc)
 832                 goto out;
 833
 834         rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL);
 835         if (rc)
 836                 goto out;
 837
 838         rc = security_validate_transition_user(state, osid, nsid, tsid, tclass);
 839         if (!rc)
 840                 rc = count;
 841 out:
 842         kfree(req);
 843         kfree(oldcon);
 844         kfree(newcon);
 845         kfree(taskcon);
 846         return rc;
 847 }
 848
 849 static const struct file_operations sel_transition_ops = {
 850         .write          = sel_write_validatetrans,
 851         .llseek         = generic_file_llseek,
 852 };
 853
 854 /*
 855  * Remaining nodes use transaction based IO methods like nfsd/nfsctl.c
 856  */
 857 static ssize_t sel_write_access(struct file *file, char *buf, size_t size);
 858 static ssize_t sel_write_create(struct file *file, char *buf, size_t size);
 859 static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size);
 860 static ssize_t sel_write_user(struct file *file, char *buf, size_t size);
 861 static ssize_t sel_write_member(struct file *file, char *buf, size_t size);
 862
 863 static ssize_t (*const write_op[])(struct file *, char *, size_t) = {
 864         [SEL_ACCESS] = sel_write_access,
 865         [SEL_CREATE] = sel_write_create,
 866         [SEL_RELABEL] = sel_write_relabel,
 867         [SEL_USER] = sel_write_user,
 868         [SEL_MEMBER] = sel_write_member,
 869         [SEL_CONTEXT] = sel_write_context,
 870 };
 871
 872 static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 873 {
 874         ino_t ino = file_inode(file)->i_ino;
 875         char *data;
 876         ssize_t rv;
 877
 878         if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
 879                 return -EINVAL;
 880
 881         data = simple_transaction_get(file, buf, size);
 882         if (IS_ERR(data))
 883                 return PTR_ERR(data);
 884
 885         rv = write_op[ino](file, data, size);
 886         if (rv > 0) {
 887                 simple_transaction_set(file, rv);
 888                 rv = size;
 889         }
 890         return rv;
 891 }
 892
 893 static const struct file_operations transaction_ops = {
 894         .write          = selinux_transaction_write,
 895         .read           = simple_transaction_read,
 896         .release        = simple_transaction_release,
 897         .llseek         = generic_file_llseek,
 898 };
 899
 900 /*
 901  * payload - write methods
 902  * If the method has a response, the response should be put in buf,
 903  * and the length returned.  Otherwise return 0 or and -error.
 904  */
 905
 906 static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
 907 {
 908         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 909         struct selinux_state *state = fsi->state;
 910         char *scon = NULL, *tcon = NULL;
 911         u32 ssid, tsid;
 912         u16 tclass;
 913         struct av_decision avd;
 914         ssize_t length;
 915
 916         length = avc_has_perm(&selinux_state,
 917                               current_sid(), SECINITSID_SECURITY,
 918                               SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
 919         if (length)
 920                 goto out;
 921
 922         length = -ENOMEM;
 923         scon = kzalloc(size + 1, GFP_KERNEL);
 924         if (!scon)
 925                 goto out;
 926
 927         length = -ENOMEM;
 928         tcon = kzalloc(size + 1, GFP_KERNEL);
 929         if (!tcon)
 930                 goto out;
 931
 932         length = -EINVAL;
 933         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 934                 goto out;
 935
 936         length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
 937         if (length)
 938                 goto out;
 939
 940         length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
 941         if (length)
 942                 goto out;
 943
 944         security_compute_av_user(state, ssid, tsid, tclass, &avd);
 945
 946         length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
 947                           "%x %x %x %x %u %x",
 948                           avd.allowed, 0xffffffff,
 949                           avd.auditallow, avd.auditdeny,
 950                           avd.seqno, avd.flags);
 951 out:
 952         kfree(tcon);
 953         kfree(scon);
 954         return length;
 955 }
 956
 957 static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
 958 {
 959         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
 960         struct selinux_state *state = fsi->state;
 961         char *scon = NULL, *tcon = NULL;
 962         char *namebuf = NULL, *objname = NULL;
 963         u32 ssid, tsid, newsid;
 964         u16 tclass;
 965         ssize_t length;
 966         char *newcon = NULL;
 967         u32 len;
 968         int nargs;
 969
 970         length = avc_has_perm(&selinux_state,
 971                               current_sid(), SECINITSID_SECURITY,
 972                               SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
 973                               NULL);
 974         if (length)
 975                 goto out;
 976
 977         length = -ENOMEM;
 978         scon = kzalloc(size + 1, GFP_KERNEL);
 979         if (!scon)
 980                 goto out;
 981
 982         length = -ENOMEM;
 983         tcon = kzalloc(size + 1, GFP_KERNEL);
 984         if (!tcon)
 985                 goto out;
 986
 987         length = -ENOMEM;
 988         namebuf = kzalloc(size + 1, GFP_KERNEL);
 989         if (!namebuf)
 990                 goto out;
 991
 992         length = -EINVAL;
 993         nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf);
 994         if (nargs < 3 || nargs > 4)
 995                 goto out;
 996         if (nargs == 4) {
 997                 /*
 998                  * If and when the name of new object to be queried contains
 999                  * either whitespace or multibyte characters, they shall be
1000                  * encoded based on the percentage-encoding rule.
1001                  * If not encoded, the sscanf logic picks up only left-half
1002                  * of the supplied name; splitted by a whitespace unexpectedly.
1003                  */
1004                 char   *r, *w;
1005                 int     c1, c2;
1006
1007                 r = w = namebuf;
1008                 do {
1009                         c1 = *r++;
1010                         if (c1 == '+')
1011                                 c1 = ' ';
1012                         else if (c1 == '%') {
1013                                 c1 = hex_to_bin(*r++);
1014                                 if (c1 < 0)
1015                                         goto out;
1016                                 c2 = hex_to_bin(*r++);
1017                                 if (c2 < 0)
1018                                         goto out;
1019                                 c1 = (c1 << 4) | c2;
1020                         }
1021                         *w++ = c1;
1022                 } while (c1 != '\0');
1023
1024                 objname = namebuf;
1025         }
1026
1027         length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
1028         if (length)
1029                 goto out;
1030
1031         length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
1032         if (length)
1033                 goto out;
1034
1035         length = security_transition_sid_user(state, ssid, tsid, tclass,
1036                                               objname, &newsid);
1037         if (length)
1038                 goto out;
1039
1040         length = security_sid_to_context(state, newsid, &newcon, &len);
1041         if (length)
1042                 goto out;
1043
1044         length = -ERANGE;
1045         if (len > SIMPLE_TRANSACTION_LIMIT) {
1046                 pr_err("SELinux: %s:  context size (%u) exceeds "
1047                         "payload max\n", __func__, len);
1048                 goto out;
1049         }
1050
1051         memcpy(buf, newcon, len);
1052         length = len;
1053 out:
1054         kfree(newcon);
1055         kfree(namebuf);
1056         kfree(tcon);
1057         kfree(scon);
1058         return length;
1059 }
1060
1061 static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
1062 {
1063         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1064         struct selinux_state *state = fsi->state;
1065         char *scon = NULL, *tcon = NULL;
1066         u32 ssid, tsid, newsid;
1067         u16 tclass;
1068         ssize_t length;
1069         char *newcon = NULL;
1070         u32 len;
1071
1072         length = avc_has_perm(&selinux_state,
1073                               current_sid(), SECINITSID_SECURITY,
1074                               SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
1075                               NULL);
1076         if (length)
1077                 goto out;
1078
1079         length = -ENOMEM;
1080         scon = kzalloc(size + 1, GFP_KERNEL);
1081         if (!scon)
1082                 goto out;
1083
1084         length = -ENOMEM;
1085         tcon = kzalloc(size + 1, GFP_KERNEL);
1086         if (!tcon)
1087                 goto out;
1088
1089         length = -EINVAL;
1090         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
1091                 goto out;
1092
1093         length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
1094         if (length)
1095                 goto out;
1096
1097         length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
1098         if (length)
1099                 goto out;
1100
1101         length = security_change_sid(state, ssid, tsid, tclass, &newsid);
1102         if (length)
1103                 goto out;
1104
1105         length = security_sid_to_context(state, newsid, &newcon, &len);
1106         if (length)
1107                 goto out;
1108
1109         length = -ERANGE;
1110         if (len > SIMPLE_TRANSACTION_LIMIT)
1111                 goto out;
1112
1113         memcpy(buf, newcon, len);
1114         length = len;
1115 out:
1116         kfree(newcon);
1117         kfree(tcon);
1118         kfree(scon);
1119         return length;
1120 }
1121
1122 static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
1123 {
1124         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1125         struct selinux_state *state = fsi->state;
1126         char *con = NULL, *user = NULL, *ptr;
1127         u32 sid, *sids = NULL;
1128         ssize_t length;
1129         char *newcon;
1130         int i, rc;
1131         u32 len, nsids;
1132
1133         length = avc_has_perm(&selinux_state,
1134                               current_sid(), SECINITSID_SECURITY,
1135                               SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
1136                               NULL);
1137         if (length)
1138                 goto out;
1139
1140         length = -ENOMEM;
1141         con = kzalloc(size + 1, GFP_KERNEL);
1142         if (!con)
1143                 goto out;
1144
1145         length = -ENOMEM;
1146         user = kzalloc(size + 1, GFP_KERNEL);
1147         if (!user)
1148                 goto out;
1149
1150         length = -EINVAL;
1151         if (sscanf(buf, "%s %s", con, user) != 2)
1152                 goto out;
1153
1154         length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL);
1155         if (length)
1156                 goto out;
1157
1158         length = security_get_user_sids(state, sid, user, &sids, &nsids);
1159         if (length)
1160                 goto out;
1161
1162         length = sprintf(buf, "%u", nsids) + 1;
1163         ptr = buf + length;
1164         for (i = 0; i < nsids; i++) {
1165                 rc = security_sid_to_context(state, sids[i], &newcon, &len);
1166                 if (rc) {
1167                         length = rc;
1168                         goto out;
1169                 }
1170                 if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {
1171                         kfree(newcon);
1172                         length = -ERANGE;
1173                         goto out;
1174                 }
1175                 memcpy(ptr, newcon, len);
1176                 kfree(newcon);
1177                 ptr += len;
1178                 length += len;
1179         }
1180 out:
1181         kfree(sids);
1182         kfree(user);
1183         kfree(con);
1184         return length;
1185 }
1186
1187 static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
1188 {
1189         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1190         struct selinux_state *state = fsi->state;
1191         char *scon = NULL, *tcon = NULL;
1192         u32 ssid, tsid, newsid;
1193         u16 tclass;
1194         ssize_t length;
1195         char *newcon = NULL;
1196         u32 len;
1197
1198         length = avc_has_perm(&selinux_state,
1199                               current_sid(), SECINITSID_SECURITY,
1200                               SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
1201                               NULL);
1202         if (length)
1203                 goto out;
1204
1205         length = -ENOMEM;
1206         scon = kzalloc(size + 1, GFP_KERNEL);
1207         if (!scon)
1208                 goto out;
1209
1210         length = -ENOMEM;
1211         tcon = kzalloc(size + 1, GFP_KERNEL);
1212         if (!tcon)
1213                 goto out;
1214
1215         length = -EINVAL;
1216         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
1217                 goto out;
1218
1219         length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
1220         if (length)
1221                 goto out;
1222
1223         length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
1224         if (length)
1225                 goto out;
1226
1227         length = security_member_sid(state, ssid, tsid, tclass, &newsid);
1228         if (length)
1229                 goto out;
1230
1231         length = security_sid_to_context(state, newsid, &newcon, &len);
1232         if (length)
1233                 goto out;
1234
1235         length = -ERANGE;
1236         if (len > SIMPLE_TRANSACTION_LIMIT) {
1237                 pr_err("SELinux: %s:  context size (%u) exceeds "
1238                         "payload max\n", __func__, len);
1239                 goto out;
1240         }
1241
1242         memcpy(buf, newcon, len);
1243         length = len;
1244 out:
1245         kfree(newcon);
1246         kfree(tcon);
1247         kfree(scon);
1248         return length;
1249 }
1250
1251 static struct inode *sel_make_inode(struct super_block *sb, int mode)
1252 {
1253         struct inode *ret = new_inode(sb);
1254
1255         if (ret) {
1256                 ret->i_mode = mode;
1257                 ret->i_atime = ret->i_mtime = ret->i_ctime = current_time(ret);
1258         }
1259         return ret;
1260 }
1261
1262 static ssize_t sel_read_bool(struct file *filep, char __user *buf,
1263                              size_t count, loff_t *ppos)
1264 {
1265         struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1266         char *page = NULL;
1267         ssize_t length;
1268         ssize_t ret;
1269         int cur_enforcing;
1270         unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
1271         const char *name = filep->f_path.dentry->d_name.name;
1272
1273         mutex_lock(&fsi->state->policy_mutex);
1274
1275         ret = -EINVAL;
1276         if (index >= fsi->bool_num || strcmp(name,
1277                                              fsi->bool_pending_names[index]))
1278                 goto out_unlock;
1279
1280         ret = -ENOMEM;
1281         page = (char *)get_zeroed_page(GFP_KERNEL);
1282         if (!page)
1283                 goto out_unlock;
1284
1285         cur_enforcing = security_get_bool_value(fsi->state, index);
1286         if (cur_enforcing < 0) {
1287                 ret = cur_enforcing;
1288                 goto out_unlock;
1289         }
1290         length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
1291                           fsi->bool_pending_values[index]);
1292         mutex_unlock(&fsi->state->policy_mutex);
1293         ret = simple_read_from_buffer(buf, count, ppos, page, length);
1294 out_free:
1295         free_page((unsigned long)page);
1296         return ret;
1297
1298 out_unlock:
1299         mutex_unlock(&fsi->state->policy_mutex);
1300         goto out_free;
1301 }
1302
1303 static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
1304                               size_t count, loff_t *ppos)
1305 {
1306         struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1307         char *page = NULL;
1308         ssize_t length;
1309         int new_value;
1310         unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
1311         const char *name = filep->f_path.dentry->d_name.name;
1312
1313         if (count >= PAGE_SIZE)
1314                 return -ENOMEM;
1315
1316         /* No partial writes. */
1317         if (*ppos != 0)
1318                 return -EINVAL;
1319
1320         page = memdup_user_nul(buf, count);
1321         if (IS_ERR(page))
1322                 return PTR_ERR(page);
1323
1324         mutex_lock(&fsi->state->policy_mutex);
1325
1326         length = avc_has_perm(&selinux_state,
1327                               current_sid(), SECINITSID_SECURITY,
1328                               SECCLASS_SECURITY, SECURITY__SETBOOL,
1329                               NULL);
1330         if (length)
1331                 goto out;
1332
1333         length = -EINVAL;
1334         if (index >= fsi->bool_num || strcmp(name,
1335                                              fsi->bool_pending_names[index]))
1336                 goto out;
1337
1338         length = -EINVAL;
1339         if (sscanf(page, "%d", &new_value) != 1)
1340                 goto out;
1341
1342         if (new_value)
1343                 new_value = 1;
1344
1345         fsi->bool_pending_values[index] = new_value;
1346         length = count;
1347
1348 out:
1349         mutex_unlock(&fsi->state->policy_mutex);
1350         kfree(page);
1351         return length;
1352 }
1353
1354 static const struct file_operations sel_bool_ops = {
1355         .read           = sel_read_bool,
1356         .write          = sel_write_bool,
1357         .llseek         = generic_file_llseek,
1358 };
1359
1360 static ssize_t sel_commit_bools_write(struct file *filep,
1361                                       const char __user *buf,
1362                                       size_t count, loff_t *ppos)
1363 {
1364         struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
1365         char *page = NULL;
1366         ssize_t length;
1367         int new_value;
1368
1369         if (count >= PAGE_SIZE)
1370                 return -ENOMEM;
1371
1372         /* No partial writes. */
1373         if (*ppos != 0)
1374                 return -EINVAL;
1375
1376         page = memdup_user_nul(buf, count);
1377         if (IS_ERR(page))
1378                 return PTR_ERR(page);
1379
1380         mutex_lock(&fsi->state->policy_mutex);
1381
1382         length = avc_has_perm(&selinux_state,
1383                               current_sid(), SECINITSID_SECURITY,
1384                               SECCLASS_SECURITY, SECURITY__SETBOOL,
1385                               NULL);
1386         if (length)
1387                 goto out;
1388
1389         length = -EINVAL;
1390         if (sscanf(page, "%d", &new_value) != 1)
1391                 goto out;
1392
1393         length = 0;
1394         if (new_value && fsi->bool_pending_values)
1395                 length = security_set_bools(fsi->state, fsi->bool_num,
1396                                             fsi->bool_pending_values);
1397
1398         if (!length)
1399                 length = count;
1400
1401 out:
1402         mutex_unlock(&fsi->state->policy_mutex);
1403         kfree(page);
1404         return length;
1405 }
1406
1407 static const struct file_operations sel_commit_bools_ops = {
1408         .write          = sel_commit_bools_write,
1409         .llseek         = generic_file_llseek,
1410 };
1411
1412 static void sel_remove_entries(struct dentry *de)
1413 {
1414         d_genocide(de);
1415         shrink_dcache_parent(de);
1416 }
1417
1418 static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
1419                           unsigned int *bool_num, char ***bool_pending_names,
1420                           unsigned int **bool_pending_values)
1421 {
1422         int ret;
1423         ssize_t len;
1424         struct dentry *dentry = NULL;
1425         struct inode *inode = NULL;
1426         struct inode_security_struct *isec;
1427         char **names = NULL, *page;
1428         u32 i, num;
1429         int *values = NULL;
1430         u32 sid;
1431
1432         ret = -ENOMEM;
1433         page = (char *)get_zeroed_page(GFP_KERNEL);
1434         if (!page)
1435                 goto out;
1436
1437         ret = security_get_bools(newpolicy, &num, &names, &values);
1438         if (ret)
1439                 goto out;
1440
1441         for (i = 0; i < num; i++) {
1442                 ret = -ENOMEM;
1443                 dentry = d_alloc_name(bool_dir, names[i]);
1444                 if (!dentry)
1445                         goto out;
1446
1447                 ret = -ENOMEM;
1448                 inode = sel_make_inode(bool_dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
1449                 if (!inode) {
1450                         dput(dentry);
1451                         goto out;
1452                 }
1453
1454                 ret = -ENAMETOOLONG;
1455                 len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
1456                 if (len >= PAGE_SIZE) {
1457                         dput(dentry);
1458                         iput(inode);
1459                         goto out;
1460                 }
1461
1462                 isec = selinux_inode(inode);
1463                 ret = selinux_policy_genfs_sid(newpolicy, "selinuxfs", page,
1464                                          SECCLASS_FILE, &sid);
1465                 if (ret) {
1466                         pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
1467                                            page);
1468                         sid = SECINITSID_SECURITY;
1469                 }
1470
1471                 isec->sid = sid;
1472                 isec->initialized = LABEL_INITIALIZED;
1473                 inode->i_fop = &sel_bool_ops;
1474                 inode->i_ino = i|SEL_BOOL_INO_OFFSET;
1475                 d_add(dentry, inode);
1476         }
1477         *bool_num = num;
1478         *bool_pending_names = names;
1479         *bool_pending_values = values;
1480
1481         free_page((unsigned long)page);
1482         return 0;
1483 out:
1484         free_page((unsigned long)page);
1485
1486         if (names) {
1487                 for (i = 0; i < num; i++)
1488                         kfree(names[i]);
1489                 kfree(names);
1490         }
1491         kfree(values);
1492         sel_remove_entries(bool_dir);
1493
1494         return ret;
1495 }
1496
1497 static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
1498                                             size_t count, loff_t *ppos)
1499 {
1500         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
1501         struct selinux_state *state = fsi->state;
1502         char tmpbuf[TMPBUFLEN];
1503         ssize_t length;
1504
1505         length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
1506                            avc_get_cache_threshold(state->avc));
1507         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1508 }
1509
1510 static ssize_t sel_write_avc_cache_threshold(struct file *file,
1511                                              const char __user *buf,
1512                                              size_t count, loff_t *ppos)
1513
1514 {
1515         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1516         struct selinux_state *state = fsi->state;
1517         char *page;
1518         ssize_t ret;
1519         unsigned int new_value;
1520
1521         ret = avc_has_perm(&selinux_state,
1522                            current_sid(), SECINITSID_SECURITY,
1523                            SECCLASS_SECURITY, SECURITY__SETSECPARAM,
1524                            NULL);
1525         if (ret)
1526                 return ret;
1527
1528         if (count >= PAGE_SIZE)
1529                 return -ENOMEM;
1530
1531         /* No partial writes. */
1532         if (*ppos != 0)
1533                 return -EINVAL;
1534
1535         page = memdup_user_nul(buf, count);
1536         if (IS_ERR(page))
1537                 return PTR_ERR(page);
1538
1539         ret = -EINVAL;
1540         if (sscanf(page, "%u", &new_value) != 1)
1541                 goto out;
1542
1543         avc_set_cache_threshold(state->avc, new_value);
1544
1545         ret = count;
1546 out:
1547         kfree(page);
1548         return ret;
1549 }
1550
1551 static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
1552                                        size_t count, loff_t *ppos)
1553 {
1554         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
1555         struct selinux_state *state = fsi->state;
1556         char *page;
1557         ssize_t length;
1558
1559         page = (char *)__get_free_page(GFP_KERNEL);
1560         if (!page)
1561                 return -ENOMEM;
1562
1563         length = avc_get_hash_stats(state->avc, page);
1564         if (length >= 0)
1565                 length = simple_read_from_buffer(buf, count, ppos, page, length);
1566         free_page((unsigned long)page);
1567
1568         return length;
1569 }
1570
1571 static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
1572                                         size_t count, loff_t *ppos)
1573 {
1574         struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
1575         struct selinux_state *state = fsi->state;
1576         char *page;
1577         ssize_t length;
1578
1579         page = (char *)__get_free_page(GFP_KERNEL);
1580         if (!page)
1581                 return -ENOMEM;
1582
1583         length = security_sidtab_hash_stats(state, page);
1584         if (length >= 0)
1585                 length = simple_read_from_buffer(buf, count, ppos, page,
1586                                                 length);
1587         free_page((unsigned long)page);
1588
1589         return length;
1590 }
1591
1592 static const struct file_operations sel_sidtab_hash_stats_ops = {
1593         .read           = sel_read_sidtab_hash_stats,
1594         .llseek         = generic_file_llseek,
1595 };
1596
1597 static const struct file_operations sel_avc_cache_threshold_ops = {
1598         .read           = sel_read_avc_cache_threshold,
1599         .write          = sel_write_avc_cache_threshold,
1600         .llseek         = generic_file_llseek,
1601 };
1602
1603 static const struct file_operations sel_avc_hash_stats_ops = {
1604         .read           = sel_read_avc_hash_stats,
1605         .llseek         = generic_file_llseek,
1606 };
1607
1608 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1609 static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
1610 {
1611         int cpu;
1612
1613         for (cpu = *idx; cpu < nr_cpu_ids; ++cpu) {
1614                 if (!cpu_possible(cpu))
1615                         continue;
1616                 *idx = cpu + 1;
1617                 return &per_cpu(avc_cache_stats, cpu);
1618         }
1619         (*idx)++;
1620         return NULL;
1621 }
1622
1623 static void *sel_avc_stats_seq_start(struct seq_file *seq, loff_t *pos)
1624 {
1625         loff_t n = *pos - 1;
1626
1627         if (*pos == 0)
1628                 return SEQ_START_TOKEN;
1629
1630         return sel_avc_get_stat_idx(&n);
1631 }
1632
1633 static void *sel_avc_stats_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1634 {
1635         return sel_avc_get_stat_idx(pos);
1636 }
1637
1638 static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
1639 {
1640         struct avc_cache_stats *st = v;
1641
1642         if (v == SEQ_START_TOKEN) {
1643                 seq_puts(seq,
1644                          "lookups hits misses allocations reclaims frees\n");
1645         } else {
1646                 unsigned int lookups = st->lookups;
1647                 unsigned int misses = st->misses;
1648                 unsigned int hits = lookups - misses;
1649                 seq_printf(seq, "%u %u %u %u %u %u\n", lookups,
1650                            hits, misses, st->allocations,
1651                            st->reclaims, st->frees);
1652         }
1653         return 0;
1654 }
1655
1656 static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v)
1657 { }
1658
1659 static const struct seq_operations sel_avc_cache_stats_seq_ops = {
1660         .start          = sel_avc_stats_seq_start,
1661         .next           = sel_avc_stats_seq_next,
1662         .show           = sel_avc_stats_seq_show,
1663         .stop           = sel_avc_stats_seq_stop,
1664 };
1665
1666 static int sel_open_avc_cache_stats(struct inode *inode, struct file *file)
1667 {
1668         return seq_open(file, &sel_avc_cache_stats_seq_ops);
1669 }
1670
1671 static const struct file_operations sel_avc_cache_stats_ops = {
1672         .open           = sel_open_avc_cache_stats,
1673         .read           = seq_read,
1674         .llseek         = seq_lseek,
1675         .release        = seq_release,
1676 };
1677 #endif
1678
1679 static int sel_make_avc_files(struct dentry *dir)
1680 {
1681         struct super_block *sb = dir->d_sb;
1682         struct selinux_fs_info *fsi = sb->s_fs_info;
1683         int i;
1684         static const struct tree_descr files[] = {
1685                 { "cache_threshold",
1686                   &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR },
1687                 { "hash_stats", &sel_avc_hash_stats_ops, S_IRUGO },
1688 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1689                 { "cache_stats", &sel_avc_cache_stats_ops, S_IRUGO },
1690 #endif
1691         };
1692
1693         for (i = 0; i < ARRAY_SIZE(files); i++) {
1694                 struct inode *inode;
1695                 struct dentry *dentry;
1696
1697                 dentry = d_alloc_name(dir, files[i].name);
1698                 if (!dentry)
1699                         return -ENOMEM;
1700
1701                 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
1702                 if (!inode) {
1703                         dput(dentry);
1704                         return -ENOMEM;
1705                 }
1706
1707                 inode->i_fop = files[i].ops;
1708                 inode->i_ino = ++fsi->last_ino;
1709                 d_add(dentry, inode);
1710         }
1711
1712         return 0;
1713 }
1714
1715 static int sel_make_ss_files(struct dentry *dir)
1716 {
1717         struct super_block *sb = dir->d_sb;
1718         struct selinux_fs_info *fsi = sb->s_fs_info;
1719         int i;
1720         static struct tree_descr files[] = {
1721                 { "sidtab_hash_stats", &sel_sidtab_hash_stats_ops, S_IRUGO },
1722         };
1723
1724         for (i = 0; i < ARRAY_SIZE(files); i++) {
1725                 struct inode *inode;
1726                 struct dentry *dentry;
1727
1728                 dentry = d_alloc_name(dir, files[i].name);
1729                 if (!dentry)
1730                         return -ENOMEM;
1731
1732                 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
1733                 if (!inode) {
1734                         dput(dentry);
1735                         return -ENOMEM;
1736                 }
1737
1738                 inode->i_fop = files[i].ops;
1739                 inode->i_ino = ++fsi->last_ino;
1740                 d_add(dentry, inode);
1741         }
1742
1743         return 0;
1744 }
1745
1746 static ssize_t sel_read_initcon(struct file *file, char __user *buf,
1747                                 size_t count, loff_t *ppos)
1748 {
1749         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1750         char *con;
1751         u32 sid, len;
1752         ssize_t ret;
1753
1754         sid = file_inode(file)->i_ino&SEL_INO_MASK;
1755         ret = security_sid_to_context(fsi->state, sid, &con, &len);
1756         if (ret)
1757                 return ret;
1758
1759         ret = simple_read_from_buffer(buf, count, ppos, con, len);
1760         kfree(con);
1761         return ret;
1762 }
1763
1764 static const struct file_operations sel_initcon_ops = {
1765         .read           = sel_read_initcon,
1766         .llseek         = generic_file_llseek,
1767 };
1768
1769 static int sel_make_initcon_files(struct dentry *dir)
1770 {
1771         int i;
1772
1773         for (i = 1; i <= SECINITSID_NUM; i++) {
1774                 struct inode *inode;
1775                 struct dentry *dentry;
1776                 const char *s = security_get_initial_sid_context(i);
1777
1778                 if (!s)
1779                         continue;
1780                 dentry = d_alloc_name(dir, s);
1781                 if (!dentry)
1782                         return -ENOMEM;
1783
1784                 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1785                 if (!inode) {
1786                         dput(dentry);
1787                         return -ENOMEM;
1788                 }
1789
1790                 inode->i_fop = &sel_initcon_ops;
1791                 inode->i_ino = i|SEL_INITCON_INO_OFFSET;
1792                 d_add(dentry, inode);
1793         }
1794
1795         return 0;
1796 }
1797
1798 static inline unsigned long sel_class_to_ino(u16 class)
1799 {
1800         return (class * (SEL_VEC_MAX + 1)) | SEL_CLASS_INO_OFFSET;
1801 }
1802
1803 static inline u16 sel_ino_to_class(unsigned long ino)
1804 {
1805         return (ino & SEL_INO_MASK) / (SEL_VEC_MAX + 1);
1806 }
1807
1808 static inline unsigned long sel_perm_to_ino(u16 class, u32 perm)
1809 {
1810         return (class * (SEL_VEC_MAX + 1) + perm) | SEL_CLASS_INO_OFFSET;
1811 }
1812
1813 static inline u32 sel_ino_to_perm(unsigned long ino)
1814 {
1815         return (ino & SEL_INO_MASK) % (SEL_VEC_MAX + 1);
1816 }
1817
1818 static ssize_t sel_read_class(struct file *file, char __user *buf,
1819                                 size_t count, loff_t *ppos)
1820 {
1821         unsigned long ino = file_inode(file)->i_ino;
1822         char res[TMPBUFLEN];
1823         ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_class(ino));
1824         return simple_read_from_buffer(buf, count, ppos, res, len);
1825 }
1826
1827 static const struct file_operations sel_class_ops = {
1828         .read           = sel_read_class,
1829         .llseek         = generic_file_llseek,
1830 };
1831
1832 static ssize_t sel_read_perm(struct file *file, char __user *buf,
1833                                 size_t count, loff_t *ppos)
1834 {
1835         unsigned long ino = file_inode(file)->i_ino;
1836         char res[TMPBUFLEN];
1837         ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_perm(ino));
1838         return simple_read_from_buffer(buf, count, ppos, res, len);
1839 }
1840
1841 static const struct file_operations sel_perm_ops = {
1842         .read           = sel_read_perm,
1843         .llseek         = generic_file_llseek,
1844 };
1845
1846 static ssize_t sel_read_policycap(struct file *file, char __user *buf,
1847                                   size_t count, loff_t *ppos)
1848 {
1849         struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
1850         int value;
1851         char tmpbuf[TMPBUFLEN];
1852         ssize_t length;
1853         unsigned long i_ino = file_inode(file)->i_ino;
1854
1855         value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK);
1856         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
1857
1858         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1859 }
1860
1861 static const struct file_operations sel_policycap_ops = {
1862         .read           = sel_read_policycap,
1863         .llseek         = generic_file_llseek,
1864 };
1865
1866 static int sel_make_perm_files(struct selinux_policy *newpolicy,
1867                         char *objclass, int classvalue,
1868                         struct dentry *dir)
1869 {
1870         int i, rc, nperms;
1871         char **perms;
1872
1873         rc = security_get_permissions(newpolicy, objclass, &perms, &nperms);
1874         if (rc)
1875                 return rc;
1876
1877         for (i = 0; i < nperms; i++) {
1878                 struct inode *inode;
1879                 struct dentry *dentry;
1880
1881                 rc = -ENOMEM;
1882                 dentry = d_alloc_name(dir, perms[i]);
1883                 if (!dentry)
1884                         goto out;
1885
1886                 rc = -ENOMEM;
1887                 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1888                 if (!inode) {
1889                         dput(dentry);
1890                         goto out;
1891                 }
1892
1893                 inode->i_fop = &sel_perm_ops;
1894                 /* i+1 since perm values are 1-indexed */
1895                 inode->i_ino = sel_perm_to_ino(classvalue, i + 1);
1896                 d_add(dentry, inode);
1897         }
1898         rc = 0;
1899 out:
1900         for (i = 0; i < nperms; i++)
1901                 kfree(perms[i]);
1902         kfree(perms);
1903         return rc;
1904 }
1905
1906 static int sel_make_class_dir_entries(struct selinux_policy *newpolicy,
1907                                 char *classname, int index,
1908                                 struct dentry *dir)
1909 {
1910         struct super_block *sb = dir->d_sb;
1911         struct selinux_fs_info *fsi = sb->s_fs_info;
1912         struct dentry *dentry = NULL;
1913         struct inode *inode = NULL;
1914         int rc;
1915
1916         dentry = d_alloc_name(dir, "index");
1917         if (!dentry)
1918                 return -ENOMEM;
1919
1920         inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1921         if (!inode) {
1922                 dput(dentry);
1923                 return -ENOMEM;
1924         }
1925
1926         inode->i_fop = &sel_class_ops;
1927         inode->i_ino = sel_class_to_ino(index);
1928         d_add(dentry, inode);
1929
1930         dentry = sel_make_dir(dir, "perms", &fsi->last_class_ino);
1931         if (IS_ERR(dentry))
1932                 return PTR_ERR(dentry);
1933
1934         rc = sel_make_perm_files(newpolicy, classname, index, dentry);
1935
1936         return rc;
1937 }
1938
1939 static int sel_make_classes(struct selinux_policy *newpolicy,
1940                             struct dentry *class_dir,
1941                             unsigned long *last_class_ino)
1942 {
1943
1944         int rc, nclasses, i;
1945         char **classes;
1946
1947         rc = security_get_classes(newpolicy, &classes, &nclasses);
1948         if (rc)
1949                 return rc;
1950
1951         /* +2 since classes are 1-indexed */
1952         *last_class_ino = sel_class_to_ino(nclasses + 2);
1953
1954         for (i = 0; i < nclasses; i++) {
1955                 struct dentry *class_name_dir;
1956
1957                 class_name_dir = sel_make_dir(class_dir, classes[i],
1958                                               last_class_ino);
1959                 if (IS_ERR(class_name_dir)) {
1960                         rc = PTR_ERR(class_name_dir);
1961                         goto out;
1962                 }
1963
1964                 /* i+1 since class values are 1-indexed */
1965                 rc = sel_make_class_dir_entries(newpolicy, classes[i], i + 1,
1966                                 class_name_dir);
1967                 if (rc)
1968                         goto out;
1969         }
1970         rc = 0;
1971 out:
1972         for (i = 0; i < nclasses; i++)
1973                 kfree(classes[i]);
1974         kfree(classes);
1975         return rc;
1976 }
1977
1978 static int sel_make_policycap(struct selinux_fs_info *fsi)
1979 {
1980         unsigned int iter;
1981         struct dentry *dentry = NULL;
1982         struct inode *inode = NULL;
1983
1984         for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) {
1985                 if (iter < ARRAY_SIZE(selinux_policycap_names))
1986                         dentry = d_alloc_name(fsi->policycap_dir,
1987                                               selinux_policycap_names[iter]);
1988                 else
1989                         dentry = d_alloc_name(fsi->policycap_dir, "unknown");
1990
1991                 if (dentry == NULL)
1992                         return -ENOMEM;
1993
1994                 inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
1995                 if (inode == NULL) {
1996                         dput(dentry);
1997                         return -ENOMEM;
1998                 }
1999
2000                 inode->i_fop = &sel_policycap_ops;
2001                 inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET;
2002                 d_add(dentry, inode);
2003         }
2004
2005         return 0;
2006 }
2007
2008 static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
2009                         unsigned long *ino)
2010 {
2011         struct dentry *dentry = d_alloc_name(dir, name);
2012         struct inode *inode;
2013
2014         if (!dentry)
2015                 return ERR_PTR(-ENOMEM);
2016
2017         inode = sel_make_inode(dir->d_sb, S_IFDIR | S_IRUGO | S_IXUGO);
2018         if (!inode) {
2019                 dput(dentry);
2020                 return ERR_PTR(-ENOMEM);
2021         }
2022
2023         inode->i_op = &simple_dir_inode_operations;
2024         inode->i_fop = &simple_dir_operations;
2025         inode->i_ino = ++(*ino);
2026         /* directory inodes start off with i_nlink == 2 (for "." entry) */
2027         inc_nlink(inode);
2028         d_add(dentry, inode);
2029         /* bump link count on parent directory, too */
2030         inc_nlink(d_inode(dir));
2031
2032         return dentry;
2033 }
2034
2035 static struct dentry *sel_make_disconnected_dir(struct super_block *sb,
2036                                                 unsigned long *ino)
2037 {
2038         struct inode *inode = sel_make_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
2039
2040         if (!inode)
2041                 return ERR_PTR(-ENOMEM);
2042
2043         inode->i_op = &simple_dir_inode_operations;
2044         inode->i_fop = &simple_dir_operations;
2045         inode->i_ino = ++(*ino);
2046         /* directory inodes start off with i_nlink == 2 (for "." entry) */
2047         inc_nlink(inode);
2048         return d_obtain_alias(inode);
2049 }
2050
2051 #define NULL_FILE_NAME "null"
2052
2053 static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
2054 {
2055         struct selinux_fs_info *fsi;
2056         int ret;
2057         struct dentry *dentry;
2058         struct inode *inode;
2059         struct inode_security_struct *isec;
2060
2061         static const struct tree_descr selinux_files[] = {
2062                 [SEL_LOAD] = {"load", &sel_load_ops, S_IRUSR|S_IWUSR},
2063                 [SEL_ENFORCE] = {"enforce", &sel_enforce_ops, S_IRUGO|S_IWUSR},
2064                 [SEL_CONTEXT] = {"context", &transaction_ops, S_IRUGO|S_IWUGO},
2065                 [SEL_ACCESS] = {"access", &transaction_ops, S_IRUGO|S_IWUGO},
2066                 [SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO},
2067                 [SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO},
2068                 [SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO},
2069                 [SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO},
2070                 [SEL_COMMIT_BOOLS] = {"commit_pending_bools", &sel_commit_bools_ops, S_IWUSR},
2071                 [SEL_MLS] = {"mls", &sel_mls_ops, S_IRUGO},
2072                 [SEL_DISABLE] = {"disable", &sel_disable_ops, S_IWUSR},
2073                 [SEL_MEMBER] = {"member", &transaction_ops, S_IRUGO|S_IWUGO},
2074                 [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
2075                 [SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO},
2076                 [SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO},
2077                 [SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO},
2078                 [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO},
2079                 [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops,
2080                                         S_IWUGO},
2081                 /* last one */ {""}
2082         };
2083
2084         ret = selinux_fs_info_create(sb);
2085         if (ret)
2086                 goto err;
2087
2088         ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
2089         if (ret)
2090                 goto err;
2091
2092         fsi = sb->s_fs_info;
2093         fsi->bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &fsi->last_ino);
2094         if (IS_ERR(fsi->bool_dir)) {
2095                 ret = PTR_ERR(fsi->bool_dir);
2096                 fsi->bool_dir = NULL;
2097                 goto err;
2098         }
2099
2100         ret = -ENOMEM;
2101         dentry = d_alloc_name(sb->s_root, NULL_FILE_NAME);
2102         if (!dentry)
2103                 goto err;
2104
2105         ret = -ENOMEM;
2106         inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
2107         if (!inode) {
2108                 dput(dentry);
2109                 goto err;
2110         }
2111
2112         inode->i_ino = ++fsi->last_ino;
2113         isec = selinux_inode(inode);
2114         isec->sid = SECINITSID_DEVNULL;
2115         isec->sclass = SECCLASS_CHR_FILE;
2116         isec->initialized = LABEL_INITIALIZED;
2117
2118         init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3));
2119         d_add(dentry, inode);
2120
2121         dentry = sel_make_dir(sb->s_root, "avc", &fsi->last_ino);
2122         if (IS_ERR(dentry)) {
2123                 ret = PTR_ERR(dentry);
2124                 goto err;
2125         }
2126
2127         ret = sel_make_avc_files(dentry);
2128
2129         dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino);
2130         if (IS_ERR(dentry)) {
2131                 ret = PTR_ERR(dentry);
2132                 goto err;
2133         }
2134
2135         ret = sel_make_ss_files(dentry);
2136         if (ret)
2137                 goto err;
2138
2139         dentry = sel_make_dir(sb->s_root, "initial_contexts", &fsi->last_ino);
2140         if (IS_ERR(dentry)) {
2141                 ret = PTR_ERR(dentry);
2142                 goto err;
2143         }
2144
2145         ret = sel_make_initcon_files(dentry);
2146         if (ret)
2147                 goto err;
2148
2149         fsi->class_dir = sel_make_dir(sb->s_root, CLASS_DIR_NAME, &fsi->last_ino);
2150         if (IS_ERR(fsi->class_dir)) {
2151                 ret = PTR_ERR(fsi->class_dir);
2152                 fsi->class_dir = NULL;
2153                 goto err;
2154         }
2155
2156         fsi->policycap_dir = sel_make_dir(sb->s_root, POLICYCAP_DIR_NAME,
2157                                           &fsi->last_ino);
2158         if (IS_ERR(fsi->policycap_dir)) {
2159                 ret = PTR_ERR(fsi->policycap_dir);
2160                 fsi->policycap_dir = NULL;
2161                 goto err;
2162         }
2163
2164         ret = sel_make_policycap(fsi);
2165         if (ret) {
2166                 pr_err("SELinux: failed to load policy capabilities\n");
2167                 goto err;
2168         }
2169
2170         return 0;
2171 err:
2172         pr_err("SELinux: %s:  failed while creating inodes\n",
2173                 __func__);
2174
2175         selinux_fs_info_free(sb);
2176
2177         return ret;
2178 }
2179
2180 static int sel_get_tree(struct fs_context *fc)
2181 {
2182         return get_tree_single(fc, sel_fill_super);
2183 }
2184
2185 static const struct fs_context_operations sel_context_ops = {
2186         .get_tree       = sel_get_tree,
2187 };
2188
2189 static int sel_init_fs_context(struct fs_context *fc)
2190 {
2191         fc->ops = &sel_context_ops;
2192         return 0;
2193 }
2194
2195 static void sel_kill_sb(struct super_block *sb)
2196 {
2197         selinux_fs_info_free(sb);
2198         kill_litter_super(sb);
2199 }
2200
2201 static struct file_system_type sel_fs_type = {
2202         .name           = "selinuxfs",
2203         .init_fs_context = sel_init_fs_context,
2204         .kill_sb        = sel_kill_sb,
2205 };
2206
2207 struct vfsmount *selinuxfs_mount;
2208 struct path selinux_null;
2209
2210 static int __init init_sel_fs(void)
2211 {
2212         struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
2213                                           sizeof(NULL_FILE_NAME)-1);
2214         int err;
2215
2216         if (!selinux_enabled_boot)
2217                 return 0;
2218
2219         err = sysfs_create_mount_point(fs_kobj, "selinux");
2220         if (err)
2221                 return err;
2222
2223         err = register_filesystem(&sel_fs_type);
2224         if (err) {
2225                 sysfs_remove_mount_point(fs_kobj, "selinux");
2226                 return err;
2227         }
2228
2229         selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);
2230         if (IS_ERR(selinuxfs_mount)) {
2231                 pr_err("selinuxfs:  could not mount!\n");
2232                 err = PTR_ERR(selinuxfs_mount);
2233                 selinuxfs_mount = NULL;
2234         }
2235         selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root,
2236                                                 &null_name);
2237         if (IS_ERR(selinux_null.dentry)) {
2238                 pr_err("selinuxfs:  could not lookup null!\n");
2239                 err = PTR_ERR(selinux_null.dentry);
2240                 selinux_null.dentry = NULL;
2241         }
2242
2243         return err;
2244 }
2245
2246 __initcall(init_sel_fs);
2247
2248 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
2249 void exit_sel_fs(void)
2250 {
2251         sysfs_remove_mount_point(fs_kobj, "selinux");
2252         dput(selinux_null.dentry);
2253         kern_unmount(selinuxfs_mount);
2254         unregister_filesystem(&sel_fs_type);
2255 }
2256 #endif