Skip to content

L
linux
Commit e67b7985 authored by Stephen Smalley's avatar Stephen Smalley Committed by Paul Moore
Browse files
Options

selinux: stop passing selinux_state pointers and their offspring 

Linus observed that the pervasive passing of selinux_state pointers
introduced by me in commit aa8e712c ("selinux: wrap global selinux
state") adds overhead and complexity without providing any
benefit. The original idea was to pave the way for SELinux namespaces
but those have not yet been implemented and there isn't currently
a concrete plan to do so. Remove the passing of the selinux_state
pointers, reverting to direct use of the single global selinux_state,
and likewise remove passing of child pointers like the selinux_avc.
The selinux_policy pointer remains as it is needed for atomic switching
of policies.
Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Reported-by: default avatarkernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202303101057.mZ3Gv5fK-lkp@intel.com/Signed-off-by: default avatarStephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent f62ca0b6
Show whitespace changes
Inline Side-by-side
Showing with 651 additions and 995 deletions
security/selinux/avc.c
View file @ e67b7985
...@@ -93,7 +93,7 @@ struct selinux_avc { ...@@ -93,7 +93,7 @@ struct selinux_avc {
static struct selinux_avc selinux_avc; static struct selinux_avc selinux_avc;
void selinux_avc_init(struct selinux_avc **avc) void selinux_avc_init(void)
{ {
int i; int i;
...@@ -104,18 +104,16 @@ void selinux_avc_init(struct selinux_avc **avc) ...@@ -104,18 +104,16 @@ void selinux_avc_init(struct selinux_avc **avc)
} }
atomic_set(&selinux_avc.avc_cache.active_nodes, 0); atomic_set(&selinux_avc.avc_cache.active_nodes, 0);
atomic_set(&selinux_avc.avc_cache.lru_hint, 0); atomic_set(&selinux_avc.avc_cache.lru_hint, 0);
*avc = &selinux_avc;
} }
unsigned int avc_get_cache_threshold(struct selinux_avc *avc) unsigned int avc_get_cache_threshold(void)
{ {
return avc->avc_cache_threshold; return selinux_avc.avc_cache_threshold;
} }
void avc_set_cache_threshold(struct selinux_avc *avc, void avc_set_cache_threshold(unsigned int cache_threshold)
unsigned int cache_threshold)
{ {
avc->avc_cache_threshold = cache_threshold; selinux_avc.avc_cache_threshold = cache_threshold;
} }
static struct avc_callback_node *avc_callbacks __ro_after_init; static struct avc_callback_node *avc_callbacks __ro_after_init;
...@@ -150,7 +148,7 @@ void __init avc_init(void) ...@@ -150,7 +148,7 @@ void __init avc_init(void)
0, SLAB_PANIC, NULL); 0, SLAB_PANIC, NULL);
} }
int avc_get_hash_stats(struct selinux_avc *avc, char *page) int avc_get_hash_stats(char *page)
{ {
int i, chain_len, max_chain_len, slots_used; int i, chain_len, max_chain_len, slots_used;
struct avc_node *node; struct avc_node *node;
...@@ -161,7 +159,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page) ...@@ -161,7 +159,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page)
slots_used = 0; slots_used = 0;
max_chain_len = 0; max_chain_len = 0;
for (i = 0; i < AVC_CACHE_SLOTS; i++) { for (i = 0; i < AVC_CACHE_SLOTS; i++) {
head = &avc->avc_cache.slots[i]; head = &selinux_avc.avc_cache.slots[i];
if (!hlist_empty(head)) { if (!hlist_empty(head)) {
slots_used++; slots_used++;
chain_len = 0; chain_len = 0;
...@@ -176,7 +174,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page) ...@@ -176,7 +174,7 @@ int avc_get_hash_stats(struct selinux_avc *avc, char *page)
return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n" return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
"longest chain: %d\n", "longest chain: %d\n",
atomic_read(&avc->avc_cache.active_nodes), atomic_read(&selinux_avc.avc_cache.active_nodes),
slots_used, AVC_CACHE_SLOTS, max_chain_len); slots_used, AVC_CACHE_SLOTS, max_chain_len);
} }
...@@ -414,8 +412,7 @@ static inline u32 avc_xperms_audit_required(u32 requested, ...@@ -414,8 +412,7 @@ static inline u32 avc_xperms_audit_required(u32 requested,
return audited; return audited;
} }
static inline int avc_xperms_audit(struct selinux_state *state, static inline int avc_xperms_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, struct av_decision *avd, u32 requested, struct av_decision *avd,
struct extended_perms_decision *xpd, struct extended_perms_decision *xpd,
u8 perm, int result, u8 perm, int result,
...@@ -427,7 +424,7 @@ static inline int avc_xperms_audit(struct selinux_state *state, ...@@ -427,7 +424,7 @@ static inline int avc_xperms_audit(struct selinux_state *state,
requested, avd, xpd, perm, result, &denied); requested, avd, xpd, perm, result, &denied);
if (likely(!audited)) if (likely(!audited))
return 0; return 0;
return slow_avc_audit(state, ssid, tsid, tclass, requested, return slow_avc_audit(ssid, tsid, tclass, requested,
audited, denied, result, ad); audited, denied, result, ad);
} }
...@@ -439,30 +436,29 @@ static void avc_node_free(struct rcu_head *rhead) ...@@ -439,30 +436,29 @@ static void avc_node_free(struct rcu_head *rhead)
avc_cache_stats_incr(frees); avc_cache_stats_incr(frees);
} }
static void avc_node_delete(struct selinux_avc *avc, struct avc_node *node) static void avc_node_delete(struct avc_node *node)
{ {
hlist_del_rcu(&node->list); hlist_del_rcu(&node->list);
call_rcu(&node->rhead, avc_node_free); call_rcu(&node->rhead, avc_node_free);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static void avc_node_kill(struct selinux_avc *avc, struct avc_node *node) static void avc_node_kill(struct avc_node *node)
{ {
avc_xperms_free(node->ae.xp_node); avc_xperms_free(node->ae.xp_node);
kmem_cache_free(avc_node_cachep, node); kmem_cache_free(avc_node_cachep, node);
avc_cache_stats_incr(frees); avc_cache_stats_incr(frees);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static void avc_node_replace(struct selinux_avc *avc, static void avc_node_replace(struct avc_node *new, struct avc_node *old)
struct avc_node *new, struct avc_node *old)
{ {
hlist_replace_rcu(&old->list, &new->list); hlist_replace_rcu(&old->list, &new->list);
call_rcu(&old->rhead, avc_node_free); call_rcu(&old->rhead, avc_node_free);
atomic_dec(&avc->avc_cache.active_nodes); atomic_dec(&selinux_avc.avc_cache.active_nodes);
} }
static inline int avc_reclaim_node(struct selinux_avc *avc) static inline int avc_reclaim_node(void)
{ {
struct avc_node *node; struct avc_node *node;
int hvalue, try, ecx; int hvalue, try, ecx;
...@@ -471,17 +467,17 @@ static inline int avc_reclaim_node(struct selinux_avc *avc) ...@@ -471,17 +467,17 @@ static inline int avc_reclaim_node(struct selinux_avc *avc)
spinlock_t *lock; spinlock_t *lock;
for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) { for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
hvalue = atomic_inc_return(&avc->avc_cache.lru_hint) & hvalue = atomic_inc_return(&selinux_avc.avc_cache.lru_hint) &
(AVC_CACHE_SLOTS - 1); (AVC_CACHE_SLOTS - 1);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
if (!spin_trylock_irqsave(lock, flags)) if (!spin_trylock_irqsave(lock, flags))
continue; continue;
rcu_read_lock(); rcu_read_lock();
hlist_for_each_entry(node, head, list) { hlist_for_each_entry(node, head, list) {
avc_node_delete(avc, node); avc_node_delete(node);
avc_cache_stats_incr(reclaims); avc_cache_stats_incr(reclaims);
ecx++; ecx++;
if (ecx >= AVC_CACHE_RECLAIM) { if (ecx >= AVC_CACHE_RECLAIM) {
...@@ -497,7 +493,7 @@ static inline int avc_reclaim_node(struct selinux_avc *avc) ...@@ -497,7 +493,7 @@ static inline int avc_reclaim_node(struct selinux_avc *avc)
return ecx; return ecx;
} }
static struct avc_node *avc_alloc_node(struct selinux_avc *avc) static struct avc_node *avc_alloc_node(void)
{ {
struct avc_node *node; struct avc_node *node;
...@@ -508,9 +504,9 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc) ...@@ -508,9 +504,9 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc)
INIT_HLIST_NODE(&node->list); INIT_HLIST_NODE(&node->list);
avc_cache_stats_incr(allocations); avc_cache_stats_incr(allocations);
if (atomic_inc_return(&avc->avc_cache.active_nodes) > if (atomic_inc_return(&selinux_avc.avc_cache.active_nodes) >
avc->avc_cache_threshold) selinux_avc.avc_cache_threshold)
avc_reclaim_node(avc); avc_reclaim_node();
out: out:
return node; return node;
...@@ -524,15 +520,14 @@ static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tcl ...@@ -524,15 +520,14 @@ static void avc_node_populate(struct avc_node *node, u32 ssid, u32 tsid, u16 tcl
memcpy(&node->ae.avd, avd, sizeof(node->ae.avd)); memcpy(&node->ae.avd, avd, sizeof(node->ae.avd));
} }
static inline struct avc_node *avc_search_node(struct selinux_avc *avc, static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
u32 ssid, u32 tsid, u16 tclass)
{ {
struct avc_node *node, *ret = NULL; struct avc_node *node, *ret = NULL;
int hvalue; int hvalue;
struct hlist_head *head; struct hlist_head *head;
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
hlist_for_each_entry_rcu(node, head, list) { hlist_for_each_entry_rcu(node, head, list) {
if (ssid == node->ae.ssid && if (ssid == node->ae.ssid &&
tclass == node->ae.tclass && tclass == node->ae.tclass &&
...@@ -547,7 +542,6 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc, ...@@ -547,7 +542,6 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc,
/** /**
* avc_lookup - Look up an AVC entry. * avc_lookup - Look up an AVC entry.
* @avc: the access vector cache
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -558,13 +552,12 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc, ...@@ -558,13 +552,12 @@ static inline struct avc_node *avc_search_node(struct selinux_avc *avc,
* then this function returns the avc_node. * then this function returns the avc_node.
* Otherwise, this function returns NULL. * Otherwise, this function returns NULL.
*/ */
static struct avc_node *avc_lookup(struct selinux_avc *avc, static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
u32 ssid, u32 tsid, u16 tclass)
{ {
struct avc_node *node; struct avc_node *node;
avc_cache_stats_incr(lookups); avc_cache_stats_incr(lookups);
node = avc_search_node(avc, ssid, tsid, tclass); node = avc_search_node(ssid, tsid, tclass);
if (node) if (node)
return node; return node;
...@@ -573,8 +566,7 @@ static struct avc_node *avc_lookup(struct selinux_avc *avc, ...@@ -573,8 +566,7 @@ static struct avc_node *avc_lookup(struct selinux_avc *avc,
return NULL; return NULL;
} }
static int avc_latest_notif_update(struct selinux_avc *avc, static int avc_latest_notif_update(int seqno, int is_insert)
int seqno, int is_insert)
{ {
int ret = 0; int ret = 0;
static DEFINE_SPINLOCK(notif_lock); static DEFINE_SPINLOCK(notif_lock);
...@@ -582,14 +574,14 @@ static int avc_latest_notif_update(struct selinux_avc *avc, ...@@ -582,14 +574,14 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
spin_lock_irqsave(&notif_lock, flag); spin_lock_irqsave(&notif_lock, flag);
if (is_insert) { if (is_insert) {
if (seqno < avc->avc_cache.latest_notif) { if (seqno < selinux_avc.avc_cache.latest_notif) {
pr_warn("SELinux: avc: seqno %d < latest_notif %d\n", pr_warn("SELinux: avc: seqno %d < latest_notif %d\n",
seqno, avc->avc_cache.latest_notif); seqno, selinux_avc.avc_cache.latest_notif);
ret = -EAGAIN; ret = -EAGAIN;
} }
} else { } else {
if (seqno > avc->avc_cache.latest_notif) if (seqno > selinux_avc.avc_cache.latest_notif)
avc->avc_cache.latest_notif = seqno; selinux_avc.avc_cache.latest_notif = seqno;
} }
spin_unlock_irqrestore(&notif_lock, flag); spin_unlock_irqrestore(&notif_lock, flag);
...@@ -598,7 +590,6 @@ static int avc_latest_notif_update(struct selinux_avc *avc, ...@@ -598,7 +590,6 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
/** /**
* avc_insert - Insert an AVC entry. * avc_insert - Insert an AVC entry.
* @avc: the access vector cache
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -615,8 +606,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc, ...@@ -615,8 +606,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
* the access vectors into a cache entry, returns * the access vectors into a cache entry, returns
* avc_node inserted. Otherwise, this function returns NULL. * avc_node inserted. Otherwise, this function returns NULL.
*/ */
static struct avc_node *avc_insert(struct selinux_avc *avc, static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
struct av_decision *avd, struct av_decision *avd,
struct avc_xperms_node *xp_node) struct avc_xperms_node *xp_node)
{ {
...@@ -626,28 +616,28 @@ static struct avc_node *avc_insert(struct selinux_avc *avc, ...@@ -626,28 +616,28 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
spinlock_t *lock; spinlock_t *lock;
struct hlist_head *head; struct hlist_head *head;
if (avc_latest_notif_update(avc, avd->seqno, 1)) if (avc_latest_notif_update(avd->seqno, 1))
return NULL; return NULL;
node = avc_alloc_node(avc); node = avc_alloc_node();
if (!node) if (!node)
return NULL; return NULL;
avc_node_populate(node, ssid, tsid, tclass, avd); avc_node_populate(node, ssid, tsid, tclass, avd);
if (avc_xperms_populate(node, xp_node)) { if (avc_xperms_populate(node, xp_node)) {
avc_node_kill(avc, node); avc_node_kill(node);
return NULL; return NULL;
} }
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
hlist_for_each_entry(pos, head, list) { hlist_for_each_entry(pos, head, list) {
if (pos->ae.ssid == ssid && if (pos->ae.ssid == ssid &&
pos->ae.tsid == tsid && pos->ae.tsid == tsid &&
pos->ae.tclass == tclass) { pos->ae.tclass == tclass) {
avc_node_replace(avc, node, pos); avc_node_replace(node, pos);
goto found; goto found;
} }
} }
...@@ -715,14 +705,14 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) ...@@ -715,14 +705,14 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
u32 tcontext_len; u32 tcontext_len;
int rc; int rc;
rc = security_sid_to_context(sad->state, sad->ssid, &scontext, rc = security_sid_to_context(sad->ssid, &scontext,
&scontext_len); &scontext_len);
if (rc) if (rc)
audit_log_format(ab, " ssid=%d", sad->ssid); audit_log_format(ab, " ssid=%d", sad->ssid);
else else
audit_log_format(ab, " scontext=%s", scontext); audit_log_format(ab, " scontext=%s", scontext);
rc = security_sid_to_context(sad->state, sad->tsid, &tcontext, rc = security_sid_to_context(sad->tsid, &tcontext,
&tcontext_len); &tcontext_len);
if (rc) if (rc)
audit_log_format(ab, " tsid=%d", sad->tsid); audit_log_format(ab, " tsid=%d", sad->tsid);
...@@ -740,7 +730,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) ...@@ -740,7 +730,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
kfree(scontext); kfree(scontext);
/* in case of invalid context report also the actual context string */ /* in case of invalid context report also the actual context string */
rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext, rc = security_sid_to_context_inval(sad->ssid, &scontext,
&scontext_len); &scontext_len);
if (!rc && scontext) { if (!rc && scontext) {
if (scontext_len && scontext[scontext_len - 1] == '\0') if (scontext_len && scontext[scontext_len - 1] == '\0')
...@@ -750,7 +740,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) ...@@ -750,7 +740,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
kfree(scontext); kfree(scontext);
} }
rc = security_sid_to_context_inval(sad->state, sad->tsid, &scontext, rc = security_sid_to_context_inval(sad->tsid, &scontext,
&scontext_len); &scontext_len);
if (!rc && scontext) { if (!rc && scontext) {
if (scontext_len && scontext[scontext_len - 1] == '\0') if (scontext_len && scontext[scontext_len - 1] == '\0')
...@@ -766,8 +756,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) ...@@ -766,8 +756,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
* Note that it is non-blocking and can be called from under * Note that it is non-blocking and can be called from under
* rcu_read_lock(). * rcu_read_lock().
*/ */
noinline int slow_avc_audit(struct selinux_state *state, noinline int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, u32 audited, u32 denied, int result, u32 requested, u32 audited, u32 denied, int result,
struct common_audit_data *a) struct common_audit_data *a)
{ {
...@@ -789,7 +778,6 @@ noinline int slow_avc_audit(struct selinux_state *state, ...@@ -789,7 +778,6 @@ noinline int slow_avc_audit(struct selinux_state *state,
sad.audited = audited; sad.audited = audited;
sad.denied = denied; sad.denied = denied;
sad.result = result; sad.result = result;
sad.state = state;
a->selinux_audit_data = &sad; a->selinux_audit_data = &sad;
...@@ -827,7 +815,6 @@ int __init avc_add_callback(int (*callback)(u32 event), u32 events) ...@@ -827,7 +815,6 @@ int __init avc_add_callback(int (*callback)(u32 event), u32 events)
/** /**
* avc_update_node - Update an AVC entry * avc_update_node - Update an AVC entry
* @avc: the access vector cache
* @event : Updating event * @event : Updating event
* @perms : Permission mask bits * @perms : Permission mask bits
* @driver: xperm driver information * @driver: xperm driver information
...@@ -844,8 +831,7 @@ int __init avc_add_callback(int (*callback)(u32 event), u32 events) ...@@ -844,8 +831,7 @@ int __init avc_add_callback(int (*callback)(u32 event), u32 events)
* otherwise, this function updates the AVC entry. The original AVC-entry object * otherwise, this function updates the AVC entry. The original AVC-entry object
* will release later by RCU. * will release later by RCU.
*/ */
static int avc_update_node(struct selinux_avc *avc, static int avc_update_node(u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid,
u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid,
u32 tsid, u16 tclass, u32 seqno, u32 tsid, u16 tclass, u32 seqno,
struct extended_perms_decision *xpd, struct extended_perms_decision *xpd,
u32 flags) u32 flags)
...@@ -856,7 +842,7 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -856,7 +842,7 @@ static int avc_update_node(struct selinux_avc *avc,
struct hlist_head *head; struct hlist_head *head;
spinlock_t *lock; spinlock_t *lock;
node = avc_alloc_node(avc); node = avc_alloc_node();
if (!node) { if (!node) {
rc = -ENOMEM; rc = -ENOMEM;
goto out; goto out;
...@@ -865,8 +851,8 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -865,8 +851,8 @@ static int avc_update_node(struct selinux_avc *avc,
/* Lock the target slot */ /* Lock the target slot */
hvalue = avc_hash(ssid, tsid, tclass); hvalue = avc_hash(ssid, tsid, tclass);
head = &avc->avc_cache.slots[hvalue]; head = &selinux_avc.avc_cache.slots[hvalue];
lock = &avc->avc_cache.slots_lock[hvalue]; lock = &selinux_avc.avc_cache.slots_lock[hvalue];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
...@@ -882,7 +868,7 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -882,7 +868,7 @@ static int avc_update_node(struct selinux_avc *avc,
if (!orig) { if (!orig) {
rc = -ENOENT; rc = -ENOENT;
avc_node_kill(avc, node); avc_node_kill(node);
goto out_unlock; goto out_unlock;
} }
...@@ -895,7 +881,7 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -895,7 +881,7 @@ static int avc_update_node(struct selinux_avc *avc,
if (orig->ae.xp_node) { if (orig->ae.xp_node) {
rc = avc_xperms_populate(node, orig->ae.xp_node); rc = avc_xperms_populate(node, orig->ae.xp_node);
if (rc) { if (rc) {
avc_node_kill(avc, node); avc_node_kill(node);
goto out_unlock; goto out_unlock;
} }
} }
...@@ -926,7 +912,7 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -926,7 +912,7 @@ static int avc_update_node(struct selinux_avc *avc,
avc_add_xperms_decision(node, xpd); avc_add_xperms_decision(node, xpd);
break; break;
} }
avc_node_replace(avc, node, orig); avc_node_replace(node, orig);
out_unlock: out_unlock:
spin_unlock_irqrestore(lock, flag); spin_unlock_irqrestore(lock, flag);
out: out:
...@@ -935,9 +921,8 @@ static int avc_update_node(struct selinux_avc *avc, ...@@ -935,9 +921,8 @@ static int avc_update_node(struct selinux_avc *avc,
/** /**
* avc_flush - Flush the cache * avc_flush - Flush the cache
* @avc: the access vector cache
*/ */
static void avc_flush(struct selinux_avc *avc) static void avc_flush(void)
{ {
struct hlist_head *head; struct hlist_head *head;
struct avc_node *node; struct avc_node *node;
...@@ -946,8 +931,8 @@ static void avc_flush(struct selinux_avc *avc) ...@@ -946,8 +931,8 @@ static void avc_flush(struct selinux_avc *avc)
int i; int i;
for (i = 0; i < AVC_CACHE_SLOTS; i++) { for (i = 0; i < AVC_CACHE_SLOTS; i++) {
head = &avc->avc_cache.slots[i]; head = &selinux_avc.avc_cache.slots[i];
lock = &avc->avc_cache.slots_lock[i]; lock = &selinux_avc.avc_cache.slots_lock[i];
spin_lock_irqsave(lock, flag); spin_lock_irqsave(lock, flag);
/* /*
...@@ -956,7 +941,7 @@ static void avc_flush(struct selinux_avc *avc) ...@@ -956,7 +941,7 @@ static void avc_flush(struct selinux_avc *avc)
*/ */
rcu_read_lock(); rcu_read_lock();
hlist_for_each_entry(node, head, list) hlist_for_each_entry(node, head, list)
avc_node_delete(avc, node); avc_node_delete(node);
rcu_read_unlock(); rcu_read_unlock();
spin_unlock_irqrestore(lock, flag); spin_unlock_irqrestore(lock, flag);
} }
...@@ -964,15 +949,14 @@ static void avc_flush(struct selinux_avc *avc) ...@@ -964,15 +949,14 @@ static void avc_flush(struct selinux_avc *avc)
/** /**
* avc_ss_reset - Flush the cache and revalidate migrated permissions. * avc_ss_reset - Flush the cache and revalidate migrated permissions.
* @avc: the access vector cache
* @seqno: policy sequence number * @seqno: policy sequence number
*/ */
int avc_ss_reset(struct selinux_avc *avc, u32 seqno) int avc_ss_reset(u32 seqno)
{ {
struct avc_callback_node *c; struct avc_callback_node *c;
int rc = 0, tmprc; int rc = 0, tmprc;
avc_flush(avc); avc_flush();
for (c = avc_callbacks; c; c = c->next) { for (c = avc_callbacks; c; c = c->next) {
if (c->events & AVC_CALLBACK_RESET) { if (c->events & AVC_CALLBACK_RESET) {
...@@ -984,13 +968,12 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno) ...@@ -984,13 +968,12 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno)
} }
} }
avc_latest_notif_update(avc, seqno, 0); avc_latest_notif_update(seqno, 0);
return rc; return rc;
} }
/** /**
* avc_compute_av - Add an entry to the AVC based on the security policy * avc_compute_av - Add an entry to the AVC based on the security policy
* @state: SELinux state pointer
* @ssid: subject * @ssid: subject
* @tsid: object/target * @tsid: object/target
* @tclass: object class * @tclass: object class
...@@ -1001,18 +984,16 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno) ...@@ -1001,18 +984,16 @@ int avc_ss_reset(struct selinux_avc *avc, u32 seqno)
* fails. Don't inline this, since it's the slow-path and just results in a * fails. Don't inline this, since it's the slow-path and just results in a
* bigger stack frame. * bigger stack frame.
*/ */
static noinline struct avc_node *avc_compute_av(struct selinux_state *state, static noinline struct avc_node *avc_compute_av(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
struct av_decision *avd, struct av_decision *avd,
struct avc_xperms_node *xp_node) struct avc_xperms_node *xp_node)
{ {
INIT_LIST_HEAD(&xp_node->xpd_head); INIT_LIST_HEAD(&xp_node->xpd_head);
security_compute_av(state, ssid, tsid, tclass, avd, &xp_node->xp); security_compute_av(ssid, tsid, tclass, avd, &xp_node->xp);
return avc_insert(state->avc, ssid, tsid, tclass, avd, xp_node); return avc_insert(ssid, tsid, tclass, avd, xp_node);
} }
static noinline int avc_denied(struct selinux_state *state, static noinline int avc_denied(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
u8 driver, u8 xperm, unsigned int flags, u8 driver, u8 xperm, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
...@@ -1020,11 +1001,11 @@ static noinline int avc_denied(struct selinux_state *state, ...@@ -1020,11 +1001,11 @@ static noinline int avc_denied(struct selinux_state *state,
if (flags & AVC_STRICT) if (flags & AVC_STRICT)
return -EACCES; return -EACCES;
if (enforcing_enabled(state) && if (enforcing_enabled() &&
!(avd->flags & AVD_FLAGS_PERMISSIVE)) !(avd->flags & AVD_FLAGS_PERMISSIVE))
return -EACCES; return -EACCES;
avc_update_node(state->avc, AVC_CALLBACK_GRANT, requested, driver, avc_update_node(AVC_CALLBACK_GRANT, requested, driver,
xperm, ssid, tsid, tclass, avd->seqno, NULL, flags); xperm, ssid, tsid, tclass, avd->seqno, NULL, flags);
return 0; return 0;
} }
...@@ -1036,8 +1017,7 @@ static noinline int avc_denied(struct selinux_state *state, ...@@ -1036,8 +1017,7 @@ static noinline int avc_denied(struct selinux_state *state,
* as-is the case with ioctls, then multiple may be chained together and the * as-is the case with ioctls, then multiple may be chained together and the
* driver field is used to specify which set contains the permission. * driver field is used to specify which set contains the permission.
*/ */
int avc_has_extended_perms(struct selinux_state *state, int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
u32 ssid, u32 tsid, u16 tclass, u32 requested,
u8 driver, u8 xperm, struct common_audit_data *ad) u8 driver, u8 xperm, struct common_audit_data *ad)
{ {
struct avc_node *node; struct avc_node *node;
...@@ -1058,9 +1038,9 @@ int avc_has_extended_perms(struct selinux_state *state, ...@@ -1058,9 +1038,9 @@ int avc_has_extended_perms(struct selinux_state *state,
rcu_read_lock(); rcu_read_lock();
node = avc_lookup(state->avc, ssid, tsid, tclass); node = avc_lookup(ssid, tsid, tclass);
if (unlikely(!node)) { if (unlikely(!node)) {
avc_compute_av(state, ssid, tsid, tclass, &avd, xp_node); avc_compute_av(ssid, tsid, tclass, &avd, xp_node);
} else { } else {
memcpy(&avd, &node->ae.avd, sizeof(avd)); memcpy(&avd, &node->ae.avd, sizeof(avd));
xp_node = node->ae.xp_node; xp_node = node->ae.xp_node;
...@@ -1084,10 +1064,10 @@ int avc_has_extended_perms(struct selinux_state *state, ...@@ -1084,10 +1064,10 @@ int avc_has_extended_perms(struct selinux_state *state,
goto decision; goto decision;
} }
rcu_read_unlock(); rcu_read_unlock();
security_compute_xperms_decision(state, ssid, tsid, tclass, security_compute_xperms_decision(ssid, tsid, tclass,
driver, &local_xpd); driver, &local_xpd);
rcu_read_lock(); rcu_read_lock();
avc_update_node(state->avc, AVC_CALLBACK_ADD_XPERMS, requested, avc_update_node(AVC_CALLBACK_ADD_XPERMS, requested,
driver, xperm, ssid, tsid, tclass, avd.seqno, driver, xperm, ssid, tsid, tclass, avd.seqno,
&local_xpd, 0); &local_xpd, 0);
} else { } else {
...@@ -1101,12 +1081,12 @@ int avc_has_extended_perms(struct selinux_state *state, ...@@ -1101,12 +1081,12 @@ int avc_has_extended_perms(struct selinux_state *state,
decision: decision:
denied = requested & ~(avd.allowed); denied = requested & ~(avd.allowed);
if (unlikely(denied)) if (unlikely(denied))
rc = avc_denied(state, ssid, tsid, tclass, requested, rc = avc_denied(ssid, tsid, tclass, requested,
driver, xperm, AVC_EXTENDED_PERMS, &avd); driver, xperm, AVC_EXTENDED_PERMS, &avd);
rcu_read_unlock(); rcu_read_unlock();
rc2 = avc_xperms_audit(state, ssid, tsid, tclass, requested, rc2 = avc_xperms_audit(ssid, tsid, tclass, requested,
&avd, xpd, xperm, rc, ad); &avd, xpd, xperm, rc, ad);
if (rc2) if (rc2)
return rc2; return rc2;
...@@ -1115,7 +1095,6 @@ int avc_has_extended_perms(struct selinux_state *state, ...@@ -1115,7 +1095,6 @@ int avc_has_extended_perms(struct selinux_state *state,
/** /**
* avc_perm_nonode - Add an entry to the AVC * avc_perm_nonode - Add an entry to the AVC
* @state: SELinux state pointer
* @ssid: subject * @ssid: subject
* @tsid: object/target * @tsid: object/target
* @tclass: object class * @tclass: object class
...@@ -1127,25 +1106,23 @@ int avc_has_extended_perms(struct selinux_state *state, ...@@ -1127,25 +1106,23 @@ int avc_has_extended_perms(struct selinux_state *state,
* unlikely and needs extra stack space for the new node that we generate, so * unlikely and needs extra stack space for the new node that we generate, so
* don't inline it. * don't inline it.
*/ */
static noinline int avc_perm_nonode(struct selinux_state *state, static noinline int avc_perm_nonode(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, unsigned int flags, u32 requested, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
{ {
u32 denied; u32 denied;
struct avc_xperms_node xp_node; struct avc_xperms_node xp_node;
avc_compute_av(state, ssid, tsid, tclass, avd, &xp_node); avc_compute_av(ssid, tsid, tclass, avd, &xp_node);
denied = requested & ~(avd->allowed); denied = requested & ~(avd->allowed);
if (unlikely(denied)) if (unlikely(denied))
return avc_denied(state, ssid, tsid, tclass, requested, 0, 0, return avc_denied(ssid, tsid, tclass, requested, 0, 0,
flags, avd); flags, avd);
return 0; return 0;
} }
/** /**
* avc_has_perm_noaudit - Check permissions but perform no auditing. * avc_has_perm_noaudit - Check permissions but perform no auditing.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -1164,8 +1141,7 @@ static noinline int avc_perm_nonode(struct selinux_state *state, ...@@ -1164,8 +1141,7 @@ static noinline int avc_perm_nonode(struct selinux_state *state,
* auditing, e.g. in cases where a lock must be held for the check but * auditing, e.g. in cases where a lock must be held for the check but
* should be released for the auditing. * should be released for the auditing.
*/ */
inline int avc_has_perm_noaudit(struct selinux_state *state, inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
unsigned int flags, unsigned int flags,
struct av_decision *avd) struct av_decision *avd)
...@@ -1177,10 +1153,10 @@ inline int avc_has_perm_noaudit(struct selinux_state *state, ...@@ -1177,10 +1153,10 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
return -EACCES; return -EACCES;
rcu_read_lock(); rcu_read_lock();
node = avc_lookup(state->avc, ssid, tsid, tclass); node = avc_lookup(ssid, tsid, tclass);
if (unlikely(!node)) { if (unlikely(!node)) {
rcu_read_unlock(); rcu_read_unlock();
return avc_perm_nonode(state, ssid, tsid, tclass, requested, return avc_perm_nonode(ssid, tsid, tclass, requested,
flags, avd); flags, avd);
} }
denied = requested & ~node->ae.avd.allowed; denied = requested & ~node->ae.avd.allowed;
...@@ -1188,14 +1164,13 @@ inline int avc_has_perm_noaudit(struct selinux_state *state, ...@@ -1188,14 +1164,13 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
rcu_read_unlock(); rcu_read_unlock();
if (unlikely(denied)) if (unlikely(denied))
return avc_denied(state, ssid, tsid, tclass, requested, 0, 0, return avc_denied(ssid, tsid, tclass, requested, 0, 0,
flags, avd); flags, avd);
return 0; return 0;
} }
/** /**
* avc_has_perm - Check permissions and perform any appropriate auditing. * avc_has_perm - Check permissions and perform any appropriate auditing.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -1210,25 +1185,25 @@ inline int avc_has_perm_noaudit(struct selinux_state *state, ...@@ -1210,25 +1185,25 @@ inline int avc_has_perm_noaudit(struct selinux_state *state,
* permissions are granted, -%EACCES if any permissions are denied, or * permissions are granted, -%EACCES if any permissions are denied, or
* another -errno upon other errors. * another -errno upon other errors.
*/ */
int avc_has_perm(struct selinux_state *state, u32 ssid, u32 tsid, u16 tclass, int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
u32 requested, struct common_audit_data *auditdata) u32 requested, struct common_audit_data *auditdata)
{ {
struct av_decision avd; struct av_decision avd;
int rc, rc2; int rc, rc2;
rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested, 0, rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0,
&avd); &avd);
rc2 = avc_audit(state, ssid, tsid, tclass, requested, &avd, rc, rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc,
auditdata); auditdata);
if (rc2) if (rc2)
return rc2; return rc2;
return rc; return rc;
} }
u32 avc_policy_seqno(struct selinux_state *state) u32 avc_policy_seqno(void)
{ {
return state->avc->avc_cache.latest_notif; return selinux_avc.avc_cache.latest_notif;
} }
void avc_disable(void) void avc_disable(void)
...@@ -1245,7 +1220,7 @@ void avc_disable(void) ...@@ -1245,7 +1220,7 @@ void avc_disable(void)
* the cache and get that memory back. * the cache and get that memory back.
*/ */
if (avc_node_cachep) { if (avc_node_cachep) {
avc_flush(selinux_state.avc); avc_flush();
/* kmem_cache_destroy(avc_node_cachep); */ /* kmem_cache_destroy(avc_node_cachep); */
} }
} }
security/selinux/hooks.c
View file @ e67b7985
...@@ -257,7 +257,7 @@ static int __inode_security_revalidate(struct inode *inode, ...@@ -257,7 +257,7 @@ static int __inode_security_revalidate(struct inode *inode,
might_sleep_if(may_sleep); might_sleep_if(may_sleep);
if (selinux_initialized(&selinux_state) && if (selinux_initialized() &&
isec->initialized != LABEL_INITIALIZED) { isec->initialized != LABEL_INITIALIZED) {
if (!may_sleep) if (!may_sleep)
return -ECHILD; return -ECHILD;
...@@ -403,14 +403,12 @@ static int may_context_mount_sb_relabel(u32 sid, ...@@ -403,14 +403,12 @@ static int may_context_mount_sb_relabel(u32 sid,
const struct task_security_struct *tsec = selinux_cred(cred); const struct task_security_struct *tsec = selinux_cred(cred);
int rc; int rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL); FILESYSTEM__RELABELFROM, NULL);
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
tsec->sid, sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELTO, NULL); FILESYSTEM__RELABELTO, NULL);
return rc; return rc;
} }
...@@ -421,14 +419,12 @@ static int may_context_mount_inode_relabel(u32 sid, ...@@ -421,14 +419,12 @@ static int may_context_mount_inode_relabel(u32 sid,
{ {
const struct task_security_struct *tsec = selinux_cred(cred); const struct task_security_struct *tsec = selinux_cred(cred);
int rc; int rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL); FILESYSTEM__RELABELFROM, NULL);
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__ASSOCIATE, NULL); FILESYSTEM__ASSOCIATE, NULL);
return rc; return rc;
} }
...@@ -511,7 +507,7 @@ static int sb_check_xattr_support(struct super_block *sb) ...@@ -511,7 +507,7 @@ static int sb_check_xattr_support(struct super_block *sb)
fallback: fallback:
/* No xattr support - try to fallback to genfs if possible. */ /* No xattr support - try to fallback to genfs if possible. */
rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/", rc = security_genfs_sid(sb->s_type->name, "/",
SECCLASS_DIR, &sid); SECCLASS_DIR, &sid);
if (rc) if (rc)
return -EOPNOTSUPP; return -EOPNOTSUPP;
...@@ -615,7 +611,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -615,7 +611,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
mutex_lock(&sbsec->lock); mutex_lock(&sbsec->lock);
if (!selinux_initialized(&selinux_state)) { if (!selinux_initialized()) {
if (!opts) { if (!opts) {
/* Defer initialization until selinux_complete_init, /* Defer initialization until selinux_complete_init,
after the initial policy is loaded and the security after the initial policy is loaded and the security
...@@ -716,7 +712,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -716,7 +712,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
* Determine the labeling behavior to use for this * Determine the labeling behavior to use for this
* filesystem type. * filesystem type.
*/ */
rc = security_fs_use(&selinux_state, sb); rc = security_fs_use(sb);
if (rc) { if (rc) {
pr_warn("%s: security_fs_use(%s) returned %d\n", pr_warn("%s: security_fs_use(%s) returned %d\n",
__func__, sb->s_type->name, rc); __func__, sb->s_type->name, rc);
...@@ -741,8 +737,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -741,8 +737,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
} }
if (sbsec->behavior == SECURITY_FS_USE_XATTR) { if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
sbsec->behavior = SECURITY_FS_USE_MNTPOINT; sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
rc = security_transition_sid(&selinux_state, rc = security_transition_sid(current_sid(),
current_sid(),
current_sid(), current_sid(),
SECCLASS_FILE, NULL, SECCLASS_FILE, NULL,
&sbsec->mntpoint_sid); &sbsec->mntpoint_sid);
...@@ -881,7 +876,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, ...@@ -881,7 +876,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
* if the parent was able to be mounted it clearly had no special lsm * if the parent was able to be mounted it clearly had no special lsm
* mount options. thus we can safely deal with this superblock later * mount options. thus we can safely deal with this superblock later
*/ */
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized())
return 0; return 0;
/* /*
...@@ -911,7 +906,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, ...@@ -911,7 +906,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
if (newsbsec->behavior == SECURITY_FS_USE_NATIVE && if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
!(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) { !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
rc = security_fs_use(&selinux_state, newsb); rc = security_fs_use(newsb);
if (rc) if (rc)
goto out; goto out;
} }
...@@ -960,7 +955,7 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) ...@@ -960,7 +955,7 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
if (!s) if (!s)
return -EINVAL; return -EINVAL;
if (!selinux_initialized(&selinux_state)) { if (!selinux_initialized()) {
pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n"); pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
return -EINVAL; return -EINVAL;
} }
...@@ -997,7 +992,7 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) ...@@ -997,7 +992,7 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
WARN_ON(1); WARN_ON(1);
return -EINVAL; return -EINVAL;
} }
rc = security_context_str_to_sid(&selinux_state, s, dst_sid, GFP_KERNEL); rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
if (rc) if (rc)
pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n", pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
s, rc); s, rc);
...@@ -1014,8 +1009,7 @@ static int show_sid(struct seq_file *m, u32 sid) ...@@ -1014,8 +1009,7 @@ static int show_sid(struct seq_file *m, u32 sid)
u32 len; u32 len;
int rc; int rc;
rc = security_sid_to_context(&selinux_state, sid, rc = security_sid_to_context(sid, &context, &len);
&context, &len);
if (!rc) { if (!rc) {
bool has_comma = strchr(context, ','); bool has_comma = strchr(context, ',');
...@@ -1038,7 +1032,7 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) ...@@ -1038,7 +1032,7 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
if (!(sbsec->flags & SE_SBINITIALIZED)) if (!(sbsec->flags & SE_SBINITIALIZED))
return 0; return 0;
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized())
return 0; return 0;
if (sbsec->flags & FSCONTEXT_MNT) { if (sbsec->flags & FSCONTEXT_MNT) {
...@@ -1292,7 +1286,7 @@ static int selinux_genfs_get_sid(struct dentry *dentry, ...@@ -1292,7 +1286,7 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
path++; path++;
} }
} }
rc = security_genfs_sid(&selinux_state, sb->s_type->name, rc = security_genfs_sid(sb->s_type->name,
path, tclass, sid); path, tclass, sid);
if (rc == -ENOENT) { if (rc == -ENOENT) {
/* No match in policy, mark as unlabeled. */ /* No match in policy, mark as unlabeled. */
...@@ -1347,7 +1341,7 @@ static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry, ...@@ -1347,7 +1341,7 @@ static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
return 0; return 0;
} }
rc = security_context_to_sid_default(&selinux_state, context, rc, sid, rc = security_context_to_sid_default(context, rc, sid,
def_sid, GFP_NOFS); def_sid, GFP_NOFS);
if (rc) { if (rc) {
char *dev = inode->i_sb->s_id; char *dev = inode->i_sb->s_id;
...@@ -1454,7 +1448,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent ...@@ -1454,7 +1448,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
sid = sbsec->sid; sid = sbsec->sid;
/* Try to obtain a transition SID. */ /* Try to obtain a transition SID. */
rc = security_transition_sid(&selinux_state, task_sid, sid, rc = security_transition_sid(task_sid, sid,
sclass, NULL, &sid); sclass, NULL, &sid);
if (rc) if (rc)
goto out; goto out;
...@@ -1599,11 +1593,9 @@ static int cred_has_capability(const struct cred *cred, ...@@ -1599,11 +1593,9 @@ static int cred_has_capability(const struct cred *cred,
return -EINVAL; return -EINVAL;
} }
rc = avc_has_perm_noaudit(&selinux_state, rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
sid, sid, sclass, av, 0, &avd);
if (!(opts & CAP_OPT_NOAUDIT)) { if (!(opts & CAP_OPT_NOAUDIT)) {
int rc2 = avc_audit(&selinux_state, int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
sid, sid, sclass, av, &avd, rc, &ad);
if (rc2) if (rc2)
return rc2; return rc2;
} }
...@@ -1629,8 +1621,7 @@ static int inode_has_perm(const struct cred *cred, ...@@ -1629,8 +1621,7 @@ static int inode_has_perm(const struct cred *cred,
sid = cred_sid(cred); sid = cred_sid(cred);
isec = selinux_inode(inode); isec = selinux_inode(inode);
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
sid, isec->sid, isec->sclass, perms, adp);
} }
/* Same as inode_has_perm, but pass explicit audit data containing /* Same as inode_has_perm, but pass explicit audit data containing
...@@ -1703,8 +1694,7 @@ static int file_has_perm(const struct cred *cred, ...@@ -1703,8 +1694,7 @@ static int file_has_perm(const struct cred *cred,
ad.u.file = file; ad.u.file = file;
if (sid != fsec->sid) { if (sid != fsec->sid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, fsec->sid,
sid, fsec->sid,
SECCLASS_FD, SECCLASS_FD,
FD__USE, FD__USE,
&ad); &ad);
...@@ -1747,7 +1737,7 @@ selinux_determine_inode_label(const struct task_security_struct *tsec, ...@@ -1747,7 +1737,7 @@ selinux_determine_inode_label(const struct task_security_struct *tsec,
*_new_isid = tsec->create_sid; *_new_isid = tsec->create_sid;
} else { } else {
const struct inode_security_struct *dsec = inode_security(dir); const struct inode_security_struct *dsec = inode_security(dir);
return security_transition_sid(&selinux_state, tsec->sid, return security_transition_sid(tsec->sid,
dsec->sid, tclass, dsec->sid, tclass,
name, _new_isid); name, _new_isid);
} }
...@@ -1775,8 +1765,7 @@ static int may_create(struct inode *dir, ...@@ -1775,8 +1765,7 @@ static int may_create(struct inode *dir,
ad.type = LSM_AUDIT_DATA_DENTRY; ad.type = LSM_AUDIT_DATA_DENTRY;
ad.u.dentry = dentry; ad.u.dentry = dentry;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
sid, dsec->sid, SECCLASS_DIR,
DIR__ADD_NAME | DIR__SEARCH, DIR__ADD_NAME | DIR__SEARCH,
&ad); &ad);
if (rc) if (rc)
...@@ -1787,13 +1776,11 @@ static int may_create(struct inode *dir, ...@@ -1787,13 +1776,11 @@ static int may_create(struct inode *dir,
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
sid, newsid, tclass, FILE__CREATE, &ad);
if (rc) if (rc)
return rc; return rc;
return avc_has_perm(&selinux_state, return avc_has_perm(newsid, sbsec->sid,
newsid, sbsec->sid,
SECCLASS_FILESYSTEM, SECCLASS_FILESYSTEM,
FILESYSTEM__ASSOCIATE, &ad); FILESYSTEM__ASSOCIATE, &ad);
} }
...@@ -1822,8 +1809,7 @@ static int may_link(struct inode *dir, ...@@ -1822,8 +1809,7 @@ static int may_link(struct inode *dir,
av = DIR__SEARCH; av = DIR__SEARCH;
av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME); av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
sid, dsec->sid, SECCLASS_DIR, av, &ad);
if (rc) if (rc)
return rc; return rc;
...@@ -1843,8 +1829,7 @@ static int may_link(struct inode *dir, ...@@ -1843,8 +1829,7 @@ static int may_link(struct inode *dir,
return 0; return 0;
} }
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
sid, isec->sid, isec->sclass, av, &ad);
return rc; return rc;
} }
...@@ -1868,19 +1853,16 @@ static inline int may_rename(struct inode *old_dir, ...@@ -1868,19 +1853,16 @@ static inline int may_rename(struct inode *old_dir,
ad.type = LSM_AUDIT_DATA_DENTRY; ad.type = LSM_AUDIT_DATA_DENTRY;
ad.u.dentry = old_dentry; ad.u.dentry = old_dentry;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
sid, old_dsec->sid, SECCLASS_DIR,
DIR__REMOVE_NAME | DIR__SEARCH, &ad); DIR__REMOVE_NAME | DIR__SEARCH, &ad);
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, old_isec->sid,
sid, old_isec->sid,
old_isec->sclass, FILE__RENAME, &ad); old_isec->sclass, FILE__RENAME, &ad);
if (rc) if (rc)
return rc; return rc;
if (old_is_dir && new_dir != old_dir) { if (old_is_dir && new_dir != old_dir) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, old_isec->sid,
sid, old_isec->sid,
old_isec->sclass, DIR__REPARENT, &ad); old_isec->sclass, DIR__REPARENT, &ad);
if (rc) if (rc)
return rc; return rc;
...@@ -1890,15 +1872,13 @@ static inline int may_rename(struct inode *old_dir, ...@@ -1890,15 +1872,13 @@ static inline int may_rename(struct inode *old_dir,
av = DIR__ADD_NAME | DIR__SEARCH; av = DIR__ADD_NAME | DIR__SEARCH;
if (d_is_positive(new_dentry)) if (d_is_positive(new_dentry))
av |= DIR__REMOVE_NAME; av |= DIR__REMOVE_NAME;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
if (rc) if (rc)
return rc; return rc;
if (d_is_positive(new_dentry)) { if (d_is_positive(new_dentry)) {
new_isec = backing_inode_security(new_dentry); new_isec = backing_inode_security(new_dentry);
new_is_dir = d_is_dir(new_dentry); new_is_dir = d_is_dir(new_dentry);
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, new_isec->sid,
sid, new_isec->sid,
new_isec->sclass, new_isec->sclass,
(new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad); (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
if (rc) if (rc)
...@@ -1918,8 +1898,7 @@ static int superblock_has_perm(const struct cred *cred, ...@@ -1918,8 +1898,7 @@ static int superblock_has_perm(const struct cred *cred,
u32 sid = cred_sid(cred); u32 sid = cred_sid(cred);
sbsec = selinux_superblock(sb); sbsec = selinux_superblock(sb);
return avc_has_perm(&selinux_state, return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
} }
/* Convert a Linux mode and permission mask to an access vector. */ /* Convert a Linux mode and permission mask to an access vector. */
...@@ -1993,8 +1972,7 @@ static inline u32 open_file_to_av(struct file *file) ...@@ -1993,8 +1972,7 @@ static inline u32 open_file_to_av(struct file *file)
static int selinux_binder_set_context_mgr(const struct cred *mgr) static int selinux_binder_set_context_mgr(const struct cred *mgr)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
current_sid(), cred_sid(mgr), SECCLASS_BINDER,
BINDER__SET_CONTEXT_MGR, NULL); BINDER__SET_CONTEXT_MGR, NULL);
} }
...@@ -2007,22 +1985,20 @@ static int selinux_binder_transaction(const struct cred *from, ...@@ -2007,22 +1985,20 @@ static int selinux_binder_transaction(const struct cred *from,
int rc; int rc;
if (mysid != fromsid) { if (mysid != fromsid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
mysid, fromsid, SECCLASS_BINDER,
BINDER__IMPERSONATE, NULL); BINDER__IMPERSONATE, NULL);
if (rc) if (rc)
return rc; return rc;
} }
return avc_has_perm(&selinux_state, fromsid, tosid, return avc_has_perm(fromsid, tosid,
SECCLASS_BINDER, BINDER__CALL, NULL); SECCLASS_BINDER, BINDER__CALL, NULL);
} }
static int selinux_binder_transfer_binder(const struct cred *from, static int selinux_binder_transfer_binder(const struct cred *from,
const struct cred *to) const struct cred *to)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(cred_sid(from), cred_sid(to),
cred_sid(from), cred_sid(to),
SECCLASS_BINDER, BINDER__TRANSFER, SECCLASS_BINDER, BINDER__TRANSFER,
NULL); NULL);
} }
...@@ -2042,8 +2018,7 @@ static int selinux_binder_transfer_file(const struct cred *from, ...@@ -2042,8 +2018,7 @@ static int selinux_binder_transfer_file(const struct cred *from,
ad.u.path = file->f_path; ad.u.path = file->f_path;
if (sid != fsec->sid) { if (sid != fsec->sid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, fsec->sid,
sid, fsec->sid,
SECCLASS_FD, SECCLASS_FD,
FD__USE, FD__USE,
&ad); &ad);
...@@ -2061,8 +2036,7 @@ static int selinux_binder_transfer_file(const struct cred *from, ...@@ -2061,8 +2036,7 @@ static int selinux_binder_transfer_file(const struct cred *from,
return 0; return 0;
isec = backing_inode_security(dentry); isec = backing_inode_security(dentry);
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
sid, isec->sid, isec->sclass, file_to_av(file),
&ad); &ad);
} }
...@@ -2073,26 +2047,24 @@ static int selinux_ptrace_access_check(struct task_struct *child, ...@@ -2073,26 +2047,24 @@ static int selinux_ptrace_access_check(struct task_struct *child,
u32 csid = task_sid_obj(child); u32 csid = task_sid_obj(child);
if (mode & PTRACE_MODE_READ) if (mode & PTRACE_MODE_READ)
return avc_has_perm(&selinux_state, return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
sid, csid, SECCLASS_FILE, FILE__READ, NULL); NULL);
return avc_has_perm(&selinux_state, return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL); NULL);
} }
static int selinux_ptrace_traceme(struct task_struct *parent) static int selinux_ptrace_traceme(struct task_struct *parent)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
task_sid_obj(parent), task_sid_obj(current),
SECCLASS_PROCESS, PROCESS__PTRACE, NULL); SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
} }
static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted) kernel_cap_t *inheritable, kernel_cap_t *permitted)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(target),
current_sid(), task_sid_obj(target), SECCLASS_PROCESS, SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
PROCESS__GETCAP, NULL);
} }
static int selinux_capset(struct cred *new, const struct cred *old, static int selinux_capset(struct cred *new, const struct cred *old,
...@@ -2100,8 +2072,7 @@ static int selinux_capset(struct cred *new, const struct cred *old, ...@@ -2100,8 +2072,7 @@ static int selinux_capset(struct cred *new, const struct cred *old,
const kernel_cap_t *inheritable, const kernel_cap_t *inheritable,
const kernel_cap_t *permitted) const kernel_cap_t *permitted)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
PROCESS__SETCAP, NULL); PROCESS__SETCAP, NULL);
} }
...@@ -2168,21 +2139,18 @@ static int selinux_syslog(int type) ...@@ -2168,21 +2139,18 @@ static int selinux_syslog(int type)
switch (type) { switch (type) {
case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */ case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */ case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL); SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */ case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */ case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
/* Set level of messages printed to console */ /* Set level of messages printed to console */
case SYSLOG_ACTION_CONSOLE_LEVEL: case SYSLOG_ACTION_CONSOLE_LEVEL:
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE, SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
NULL); NULL);
} }
/* All other syslog types */ /* All other syslog types */
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL); SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
} }
...@@ -2249,8 +2217,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm, ...@@ -2249,8 +2217,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
av |= PROCESS2__NNP_TRANSITION; av |= PROCESS2__NNP_TRANSITION;
if (nosuid) if (nosuid)
av |= PROCESS2__NOSUID_TRANSITION; av |= PROCESS2__NOSUID_TRANSITION;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS2, av, NULL); SECCLASS_PROCESS2, av, NULL);
if (!rc) if (!rc)
return 0; return 0;
...@@ -2261,7 +2228,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm, ...@@ -2261,7 +2228,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
* i.e. SIDs that are guaranteed to only be allowed a subset * i.e. SIDs that are guaranteed to only be allowed a subset
* of the permissions of the current SID. * of the permissions of the current SID.
*/ */
rc = security_bounded_transition(&selinux_state, old_tsec->sid, rc = security_bounded_transition(old_tsec->sid,
new_tsec->sid); new_tsec->sid);
if (!rc) if (!rc)
return 0; return 0;
...@@ -2312,7 +2279,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm) ...@@ -2312,7 +2279,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
return rc; return rc;
} else { } else {
/* Check for a default transition on this program. */ /* Check for a default transition on this program. */
rc = security_transition_sid(&selinux_state, old_tsec->sid, rc = security_transition_sid(old_tsec->sid,
isec->sid, SECCLASS_PROCESS, NULL, isec->sid, SECCLASS_PROCESS, NULL,
&new_tsec->sid); &new_tsec->sid);
if (rc) if (rc)
...@@ -2331,29 +2298,25 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm) ...@@ -2331,29 +2298,25 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
ad.u.file = bprm->file; ad.u.file = bprm->file;
if (new_tsec->sid == old_tsec->sid) { if (new_tsec->sid == old_tsec->sid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(old_tsec->sid, isec->sid,
old_tsec->sid, isec->sid,
SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad); SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
if (rc) if (rc)
return rc; return rc;
} else { } else {
/* Check permissions for the transition. */ /* Check permissions for the transition. */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__TRANSITION, &ad); SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(new_tsec->sid, isec->sid,
new_tsec->sid, isec->sid,
SECCLASS_FILE, FILE__ENTRYPOINT, &ad); SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
if (rc) if (rc)
return rc; return rc;
/* Check for shared state */ /* Check for shared state */
if (bprm->unsafe & LSM_UNSAFE_SHARE) { if (bprm->unsafe & LSM_UNSAFE_SHARE) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__SHARE, SECCLASS_PROCESS, PROCESS__SHARE,
NULL); NULL);
if (rc) if (rc)
...@@ -2365,8 +2328,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm) ...@@ -2365,8 +2328,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (bprm->unsafe & LSM_UNSAFE_PTRACE) { if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
u32 ptsid = ptrace_parent_sid(); u32 ptsid = ptrace_parent_sid();
if (ptsid != 0) { if (ptsid != 0) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(ptsid, new_tsec->sid,
ptsid, new_tsec->sid,
SECCLASS_PROCESS, SECCLASS_PROCESS,
PROCESS__PTRACE, NULL); PROCESS__PTRACE, NULL);
if (rc) if (rc)
...@@ -2380,8 +2342,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm) ...@@ -2380,8 +2342,7 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Enable secure mode for SIDs transitions unless /* Enable secure mode for SIDs transitions unless
the noatsecure permission is granted between the noatsecure permission is granted between
the two SIDs, i.e. ahp returns 0. */ the two SIDs, i.e. ahp returns 0. */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__NOATSECURE, SECCLASS_PROCESS, PROCESS__NOATSECURE,
NULL); NULL);
bprm->secureexec |= !!rc; bprm->secureexec |= !!rc;
...@@ -2473,8 +2434,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm) ...@@ -2473,8 +2434,7 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
* higher than the default soft limit for cases where the default is * higher than the default soft limit for cases where the default is
* lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK. * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
*/ */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
PROCESS__RLIMITINH, NULL); PROCESS__RLIMITINH, NULL);
if (rc) { if (rc) {
/* protect against do_prlimit() */ /* protect against do_prlimit() */
...@@ -2513,8 +2473,7 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm) ...@@ -2513,8 +2473,7 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
* This must occur _after_ the task SID has been updated so that any * This must occur _after_ the task SID has been updated so that any
* kill done after the flush will be checked against the new SID. * kill done after the flush will be checked against the new SID.
*/ */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
if (rc) { if (rc) {
clear_itimer(); clear_itimer();
...@@ -2841,7 +2800,7 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode, ...@@ -2841,7 +2800,7 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
if (xattr_name) if (xattr_name)
*xattr_name = XATTR_NAME_SELINUX; *xattr_name = XATTR_NAME_SELINUX;
return security_sid_to_context(&selinux_state, newsid, (char **)ctx, return security_sid_to_context(newsid, (char **)ctx,
ctxlen); ctxlen);
} }
...@@ -2895,7 +2854,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, ...@@ -2895,7 +2854,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
isec->initialized = LABEL_INITIALIZED; isec->initialized = LABEL_INITIALIZED;
} }
if (!selinux_initialized(&selinux_state) || if (!selinux_initialized() ||
!(sbsec->flags & SBLABEL_MNT)) !(sbsec->flags & SBLABEL_MNT))
return -EOPNOTSUPP; return -EOPNOTSUPP;
...@@ -2903,7 +2862,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, ...@@ -2903,7 +2862,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
*name = XATTR_SELINUX_SUFFIX; *name = XATTR_SELINUX_SUFFIX;
if (value && len) { if (value && len) {
rc = security_sid_to_context_force(&selinux_state, newsid, rc = security_sid_to_context_force(newsid,
&context, &clen); &context, &clen);
if (rc) if (rc)
return rc; return rc;
...@@ -2923,7 +2882,7 @@ static int selinux_inode_init_security_anon(struct inode *inode, ...@@ -2923,7 +2882,7 @@ static int selinux_inode_init_security_anon(struct inode *inode,
struct inode_security_struct *isec; struct inode_security_struct *isec;
int rc; int rc;
if (unlikely(!selinux_initialized(&selinux_state))) if (unlikely(!selinux_initialized()))
return 0; return 0;
isec = selinux_inode(inode); isec = selinux_inode(inode);
...@@ -2947,7 +2906,7 @@ static int selinux_inode_init_security_anon(struct inode *inode, ...@@ -2947,7 +2906,7 @@ static int selinux_inode_init_security_anon(struct inode *inode,
} else { } else {
isec->sclass = SECCLASS_ANON_INODE; isec->sclass = SECCLASS_ANON_INODE;
rc = security_transition_sid( rc = security_transition_sid(
&selinux_state, tsec->sid, tsec->sid, tsec->sid, tsec->sid,
isec->sclass, name, &isec->sid); isec->sclass, name, &isec->sid);
if (rc) if (rc)
return rc; return rc;
...@@ -2962,8 +2921,7 @@ static int selinux_inode_init_security_anon(struct inode *inode, ...@@ -2962,8 +2921,7 @@ static int selinux_inode_init_security_anon(struct inode *inode,
ad.type = LSM_AUDIT_DATA_ANONINODE; ad.type = LSM_AUDIT_DATA_ANONINODE;
ad.u.anonclass = name ? (const char *)name->name : "?"; ad.u.anonclass = name ? (const char *)name->name : "?";
return avc_has_perm(&selinux_state, return avc_has_perm(tsec->sid,
tsec->sid,
isec->sid, isec->sid,
isec->sclass, isec->sclass,
FILE__CREATE, FILE__CREATE,
...@@ -3035,8 +2993,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode, ...@@ -3035,8 +2993,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
if (IS_ERR(isec)) if (IS_ERR(isec))
return PTR_ERR(isec); return PTR_ERR(isec);
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
sid, isec->sid, isec->sclass, FILE__READ, &ad);
} }
static noinline int audit_inode_permission(struct inode *inode, static noinline int audit_inode_permission(struct inode *inode,
...@@ -3049,8 +3006,7 @@ static noinline int audit_inode_permission(struct inode *inode, ...@@ -3049,8 +3006,7 @@ static noinline int audit_inode_permission(struct inode *inode,
ad.type = LSM_AUDIT_DATA_INODE; ad.type = LSM_AUDIT_DATA_INODE;
ad.u.inode = inode; ad.u.inode = inode;
return slow_avc_audit(&selinux_state, return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
current_sid(), isec->sid, isec->sclass, perms,
audited, denied, result, &ad); audited, denied, result, &ad);
} }
...@@ -3085,8 +3041,7 @@ static int selinux_inode_permission(struct inode *inode, int mask) ...@@ -3085,8 +3041,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
if (IS_ERR(isec)) if (IS_ERR(isec))
return PTR_ERR(isec); return PTR_ERR(isec);
rc = avc_has_perm_noaudit(&selinux_state, rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
sid, isec->sid, isec->sclass, perms, 0,
&avd); &avd);
audited = avc_audit_required(perms, &avd, rc, audited = avc_audit_required(perms, &avd, rc,
from_access ? FILE__AUDIT_ACCESS : 0, from_access ? FILE__AUDIT_ACCESS : 0,
...@@ -3166,7 +3121,7 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap, ...@@ -3166,7 +3121,7 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap,
return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
} }
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized())
return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM); return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
sbsec = selinux_superblock(inode->i_sb); sbsec = selinux_superblock(inode->i_sb);
...@@ -3180,13 +3135,12 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap, ...@@ -3180,13 +3135,12 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap,
ad.u.dentry = dentry; ad.u.dentry = dentry;
isec = backing_inode_security(dentry); isec = backing_inode_security(dentry);
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, isec->sid, isec->sclass,
sid, isec->sid, isec->sclass,
FILE__RELABELFROM, &ad); FILE__RELABELFROM, &ad);
if (rc) if (rc)
return rc; return rc;
rc = security_context_to_sid(&selinux_state, value, size, &newsid, rc = security_context_to_sid(value, size, &newsid,
GFP_KERNEL); GFP_KERNEL);
if (rc == -EINVAL) { if (rc == -EINVAL) {
if (!has_cap_mac_admin(true)) { if (!has_cap_mac_admin(true)) {
...@@ -3215,25 +3169,23 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap, ...@@ -3215,25 +3169,23 @@ static int selinux_inode_setxattr(struct mnt_idmap *idmap,
return rc; return rc;
} }
rc = security_context_to_sid_force(&selinux_state, value, rc = security_context_to_sid_force(value,
size, &newsid); size, &newsid);
} }
if (rc) if (rc)
return rc; return rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, newsid, isec->sclass,
sid, newsid, isec->sclass,
FILE__RELABELTO, &ad); FILE__RELABELTO, &ad);
if (rc) if (rc)
return rc; return rc;
rc = security_validate_transition(&selinux_state, isec->sid, newsid, rc = security_validate_transition(isec->sid, newsid,
sid, isec->sclass); sid, isec->sclass);
if (rc) if (rc)
return rc; return rc;
return avc_has_perm(&selinux_state, return avc_has_perm(newsid,
newsid,
sbsec->sid, sbsec->sid,
SECCLASS_FILESYSTEM, SECCLASS_FILESYSTEM,
FILESYSTEM__ASSOCIATE, FILESYSTEM__ASSOCIATE,
...@@ -3273,7 +3225,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, ...@@ -3273,7 +3225,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
return; return;
} }
if (!selinux_initialized(&selinux_state)) { if (!selinux_initialized()) {
/* If we haven't even been initialized, then we can't validate /* If we haven't even been initialized, then we can't validate
* against a policy, so leave the label as invalid. It may * against a policy, so leave the label as invalid. It may
* resolve to a valid label on the next revalidation try if * resolve to a valid label on the next revalidation try if
...@@ -3282,7 +3234,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, ...@@ -3282,7 +3234,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
return; return;
} }
rc = security_context_to_sid_force(&selinux_state, value, size, rc = security_context_to_sid_force(value, size,
&newsid); &newsid);
if (rc) { if (rc) {
pr_err("SELinux: unable to map context to SID" pr_err("SELinux: unable to map context to SID"
...@@ -3326,7 +3278,7 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap, ...@@ -3326,7 +3278,7 @@ static int selinux_inode_removexattr(struct mnt_idmap *idmap,
return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
} }
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized())
return 0; return 0;
/* No one is allowed to remove a SELinux security label. /* No one is allowed to remove a SELinux security label.
...@@ -3396,7 +3348,7 @@ static int selinux_inode_getsecurity(struct mnt_idmap *idmap, ...@@ -3396,7 +3348,7 @@ static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
* If we're not initialized yet, then we can't validate contexts, so * If we're not initialized yet, then we can't validate contexts, so
* just let vfs_getxattr fall back to using the on-disk xattr. * just let vfs_getxattr fall back to using the on-disk xattr.
*/ */
if (!selinux_initialized(&selinux_state) || if (!selinux_initialized() ||
strcmp(name, XATTR_SELINUX_SUFFIX)) strcmp(name, XATTR_SELINUX_SUFFIX))
return -EOPNOTSUPP; return -EOPNOTSUPP;
...@@ -3411,11 +3363,10 @@ static int selinux_inode_getsecurity(struct mnt_idmap *idmap, ...@@ -3411,11 +3363,10 @@ static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
*/ */
isec = inode_security(inode); isec = inode_security(inode);
if (has_cap_mac_admin(false)) if (has_cap_mac_admin(false))
error = security_sid_to_context_force(&selinux_state, error = security_sid_to_context_force(isec->sid, &context,
isec->sid, &context,
&size); &size);
else else
error = security_sid_to_context(&selinux_state, isec->sid, error = security_sid_to_context(isec->sid,
&context, &size); &context, &size);
if (error) if (error)
return error; return error;
...@@ -3447,7 +3398,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name, ...@@ -3447,7 +3398,7 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
if (!value || !size) if (!value || !size)
return -EACCES; return -EACCES;
rc = security_context_to_sid(&selinux_state, value, size, &newsid, rc = security_context_to_sid(value, size, &newsid,
GFP_KERNEL); GFP_KERNEL);
if (rc) if (rc)
return rc; return rc;
...@@ -3464,7 +3415,7 @@ static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t ...@@ -3464,7 +3415,7 @@ static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t
{ {
const int len = sizeof(XATTR_NAME_SELINUX); const int len = sizeof(XATTR_NAME_SELINUX);
if (!selinux_initialized(&selinux_state)) if (!selinux_initialized())
return 0; return 0;
if (buffer && len <= buffer_size) if (buffer && len <= buffer_size)
...@@ -3540,7 +3491,7 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir, ...@@ -3540,7 +3491,7 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
return rc; return rc;
} }
rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid, rc = security_context_to_sid(context, clen, &parent_sid,
GFP_KERNEL); GFP_KERNEL);
kfree(context); kfree(context);
if (rc) if (rc)
...@@ -3555,14 +3506,14 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir, ...@@ -3555,14 +3506,14 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
q.name = kn->name; q.name = kn->name;
q.hash_len = hashlen_string(kn_dir, kn->name); q.hash_len = hashlen_string(kn_dir, kn->name);
rc = security_transition_sid(&selinux_state, tsec->sid, rc = security_transition_sid(tsec->sid,
parent_sid, secclass, &q, parent_sid, secclass, &q,
&newsid); &newsid);
if (rc) if (rc)
return rc; return rc;
} }
rc = security_sid_to_context_force(&selinux_state, newsid, rc = security_sid_to_context_force(newsid,
&context, &clen); &context, &clen);
if (rc) if (rc)
return rc; return rc;
...@@ -3602,7 +3553,7 @@ static int selinux_file_permission(struct file *file, int mask) ...@@ -3602,7 +3553,7 @@ static int selinux_file_permission(struct file *file, int mask)
isec = inode_security(inode); isec = inode_security(inode);
if (sid == fsec->sid && fsec->isid == isec->sid && if (sid == fsec->sid && fsec->isid == isec->sid &&
fsec->pseqno == avc_policy_seqno(&selinux_state)) fsec->pseqno == avc_policy_seqno())
/* No change since file_open check. */ /* No change since file_open check. */
return 0; return 0;
...@@ -3643,8 +3594,7 @@ static int ioctl_has_perm(const struct cred *cred, struct file *file, ...@@ -3643,8 +3594,7 @@ static int ioctl_has_perm(const struct cred *cred, struct file *file,
ad.u.op->path = file->f_path; ad.u.op->path = file->f_path;
if (ssid != fsec->sid) { if (ssid != fsec->sid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(ssid, fsec->sid,
ssid, fsec->sid,
SECCLASS_FD, SECCLASS_FD,
FD__USE, FD__USE,
&ad); &ad);
...@@ -3656,8 +3606,7 @@ static int ioctl_has_perm(const struct cred *cred, struct file *file, ...@@ -3656,8 +3606,7 @@ static int ioctl_has_perm(const struct cred *cred, struct file *file,
return 0; return 0;
isec = inode_security(inode); isec = inode_security(inode);
rc = avc_has_extended_perms(&selinux_state, rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
ssid, isec->sid, isec->sclass,
requested, driver, xperm, &ad); requested, driver, xperm, &ad);
out: out:
return rc; return rc;
...@@ -3726,8 +3675,7 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared ...@@ -3726,8 +3675,7 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
* private file mapping that will also be writable. * private file mapping that will also be writable.
* This has an additional check. * This has an additional check.
*/ */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
sid, sid, SECCLASS_PROCESS,
PROCESS__EXECMEM, NULL); PROCESS__EXECMEM, NULL);
if (rc) if (rc)
goto error; goto error;
...@@ -3757,8 +3705,7 @@ static int selinux_mmap_addr(unsigned long addr) ...@@ -3757,8 +3705,7 @@ static int selinux_mmap_addr(unsigned long addr)
if (addr < CONFIG_LSM_MMAP_MIN_ADDR) { if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
u32 sid = current_sid(); u32 sid = current_sid();
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
sid, sid, SECCLASS_MEMPROTECT,
MEMPROTECT__MMAP_ZERO, NULL); MEMPROTECT__MMAP_ZERO, NULL);
} }
...@@ -3780,7 +3727,7 @@ static int selinux_mmap_file(struct file *file, unsigned long reqprot, ...@@ -3780,7 +3727,7 @@ static int selinux_mmap_file(struct file *file, unsigned long reqprot,
return rc; return rc;
} }
if (checkreqprot_get(&selinux_state)) if (checkreqprot_get())
prot = reqprot; prot = reqprot;
return file_map_prot_check(file, prot, return file_map_prot_check(file, prot,
...@@ -3794,7 +3741,7 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, ...@@ -3794,7 +3741,7 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
const struct cred *cred = current_cred(); const struct cred *cred = current_cred();
u32 sid = cred_sid(cred); u32 sid = cred_sid(cred);
if (checkreqprot_get(&selinux_state)) if (checkreqprot_get())
prot = reqprot; prot = reqprot;
if (default_noexec && if (default_noexec &&
...@@ -3802,15 +3749,13 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, ...@@ -3802,15 +3749,13 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
int rc = 0; int rc = 0;
if (vma->vm_start >= vma->vm_mm->start_brk && if (vma->vm_start >= vma->vm_mm->start_brk &&
vma->vm_end <= vma->vm_mm->brk) { vma->vm_end <= vma->vm_mm->brk) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
sid, sid, SECCLASS_PROCESS,
PROCESS__EXECHEAP, NULL); PROCESS__EXECHEAP, NULL);
} else if (!vma->vm_file && } else if (!vma->vm_file &&
((vma->vm_start <= vma->vm_mm->start_stack && ((vma->vm_start <= vma->vm_mm->start_stack &&
vma->vm_end >= vma->vm_mm->start_stack) || vma->vm_end >= vma->vm_mm->start_stack) ||
vma_is_stack_for_current(vma))) { vma_is_stack_for_current(vma))) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
sid, sid, SECCLASS_PROCESS,
PROCESS__EXECSTACK, NULL); PROCESS__EXECSTACK, NULL);
} else if (vma->vm_file && vma->anon_vma) { } else if (vma->vm_file && vma->anon_vma) {
/* /*
...@@ -3902,8 +3847,7 @@ static int selinux_file_send_sigiotask(struct task_struct *tsk, ...@@ -3902,8 +3847,7 @@ static int selinux_file_send_sigiotask(struct task_struct *tsk,
else else
perm = signal_to_av(signum); perm = signal_to_av(signum);
return avc_has_perm(&selinux_state, return avc_has_perm(fsec->fown_sid, sid,
fsec->fown_sid, sid,
SECCLASS_PROCESS, perm, NULL); SECCLASS_PROCESS, perm, NULL);
} }
...@@ -3929,7 +3873,7 @@ static int selinux_file_open(struct file *file) ...@@ -3929,7 +3873,7 @@ static int selinux_file_open(struct file *file)
* struct as its SID. * struct as its SID.
*/ */
fsec->isid = isec->sid; fsec->isid = isec->sid;
fsec->pseqno = avc_policy_seqno(&selinux_state); fsec->pseqno = avc_policy_seqno();
/* /*
* Since the inode label or policy seqno may have changed * Since the inode label or policy seqno may have changed
* between the selinux_inode_permission check and the saving * between the selinux_inode_permission check and the saving
...@@ -3948,8 +3892,7 @@ static int selinux_task_alloc(struct task_struct *task, ...@@ -3948,8 +3892,7 @@ static int selinux_task_alloc(struct task_struct *task,
{ {
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(&selinux_state, return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
} }
/* /*
...@@ -3991,8 +3934,7 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid) ...@@ -3991,8 +3934,7 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid)
u32 sid = current_sid(); u32 sid = current_sid();
int ret; int ret;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, secid,
sid, secid,
SECCLASS_KERNEL_SERVICE, SECCLASS_KERNEL_SERVICE,
KERNEL_SERVICE__USE_AS_OVERRIDE, KERNEL_SERVICE__USE_AS_OVERRIDE,
NULL); NULL);
...@@ -4016,8 +3958,7 @@ static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode) ...@@ -4016,8 +3958,7 @@ static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
u32 sid = current_sid(); u32 sid = current_sid();
int ret; int ret;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, isec->sid,
sid, isec->sid,
SECCLASS_KERNEL_SERVICE, SECCLASS_KERNEL_SERVICE,
KERNEL_SERVICE__CREATE_FILES_AS, KERNEL_SERVICE__CREATE_FILES_AS,
NULL); NULL);
...@@ -4034,8 +3975,7 @@ static int selinux_kernel_module_request(char *kmod_name) ...@@ -4034,8 +3975,7 @@ static int selinux_kernel_module_request(char *kmod_name)
ad.type = LSM_AUDIT_DATA_KMOD; ad.type = LSM_AUDIT_DATA_KMOD;
ad.u.kmod_name = kmod_name; ad.u.kmod_name = kmod_name;
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
SYSTEM__MODULE_REQUEST, &ad); SYSTEM__MODULE_REQUEST, &ad);
} }
...@@ -4049,8 +3989,7 @@ static int selinux_kernel_module_from_file(struct file *file) ...@@ -4049,8 +3989,7 @@ static int selinux_kernel_module_from_file(struct file *file)
/* init_module */ /* init_module */
if (file == NULL) if (file == NULL)
return avc_has_perm(&selinux_state, return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
sid, sid, SECCLASS_SYSTEM,
SYSTEM__MODULE_LOAD, NULL); SYSTEM__MODULE_LOAD, NULL);
/* finit_module */ /* finit_module */
...@@ -4060,15 +3999,13 @@ static int selinux_kernel_module_from_file(struct file *file) ...@@ -4060,15 +3999,13 @@ static int selinux_kernel_module_from_file(struct file *file)
fsec = selinux_file(file); fsec = selinux_file(file);
if (sid != fsec->sid) { if (sid != fsec->sid) {
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
if (rc) if (rc)
return rc; return rc;
} }
isec = inode_security(file_inode(file)); isec = inode_security(file_inode(file));
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
sid, isec->sid, SECCLASS_SYSTEM,
SYSTEM__MODULE_LOAD, &ad); SYSTEM__MODULE_LOAD, &ad);
} }
...@@ -4106,22 +4043,19 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents) ...@@ -4106,22 +4043,19 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__SETPGID, NULL); PROCESS__SETPGID, NULL);
} }
static int selinux_task_getpgid(struct task_struct *p) static int selinux_task_getpgid(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__GETPGID, NULL); PROCESS__GETPGID, NULL);
} }
static int selinux_task_getsid(struct task_struct *p) static int selinux_task_getsid(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__GETSESSION, NULL); PROCESS__GETSESSION, NULL);
} }
...@@ -4137,22 +4071,19 @@ static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid) ...@@ -4137,22 +4071,19 @@ static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
static int selinux_task_setnice(struct task_struct *p, int nice) static int selinux_task_setnice(struct task_struct *p, int nice)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__SETSCHED, NULL); PROCESS__SETSCHED, NULL);
} }
static int selinux_task_setioprio(struct task_struct *p, int ioprio) static int selinux_task_setioprio(struct task_struct *p, int ioprio)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__SETSCHED, NULL); PROCESS__SETSCHED, NULL);
} }
static int selinux_task_getioprio(struct task_struct *p) static int selinux_task_getioprio(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__GETSCHED, NULL); PROCESS__GETSCHED, NULL);
} }
...@@ -4167,8 +4098,7 @@ static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcre ...@@ -4167,8 +4098,7 @@ static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcre
av |= PROCESS__SETRLIMIT; av |= PROCESS__SETRLIMIT;
if (flags & LSM_PRLIMIT_READ) if (flags & LSM_PRLIMIT_READ)
av |= PROCESS__GETRLIMIT; av |= PROCESS__GETRLIMIT;
return avc_has_perm(&selinux_state, return avc_has_perm(cred_sid(cred), cred_sid(tcred),
cred_sid(cred), cred_sid(tcred),
SECCLASS_PROCESS, av, NULL); SECCLASS_PROCESS, av, NULL);
} }
...@@ -4182,8 +4112,7 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource, ...@@ -4182,8 +4112,7 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
later be used as a safe reset point for the soft limit later be used as a safe reset point for the soft limit
upon context transitions. See selinux_bprm_committing_creds. */ upon context transitions. See selinux_bprm_committing_creds. */
if (old_rlim->rlim_max != new_rlim->rlim_max) if (old_rlim->rlim_max != new_rlim->rlim_max)
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p),
current_sid(), task_sid_obj(p),
SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL); SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
return 0; return 0;
...@@ -4191,22 +4120,19 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource, ...@@ -4191,22 +4120,19 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
static int selinux_task_setscheduler(struct task_struct *p) static int selinux_task_setscheduler(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__SETSCHED, NULL); PROCESS__SETSCHED, NULL);
} }
static int selinux_task_getscheduler(struct task_struct *p) static int selinux_task_getscheduler(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__GETSCHED, NULL); PROCESS__GETSCHED, NULL);
} }
static int selinux_task_movememory(struct task_struct *p) static int selinux_task_movememory(struct task_struct *p)
{ {
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
PROCESS__SETSCHED, NULL); PROCESS__SETSCHED, NULL);
} }
...@@ -4224,8 +4150,7 @@ static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info, ...@@ -4224,8 +4150,7 @@ static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
secid = current_sid(); secid = current_sid();
else else
secid = cred_sid(cred); secid = cred_sid(cred);
return avc_has_perm(&selinux_state, return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
} }
static void selinux_task_to_inode(struct task_struct *p, static void selinux_task_to_inode(struct task_struct *p,
...@@ -4245,7 +4170,7 @@ static int selinux_userns_create(const struct cred *cred) ...@@ -4245,7 +4170,7 @@ static int selinux_userns_create(const struct cred *cred)
{ {
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(&selinux_state, sid, sid, SECCLASS_USER_NAMESPACE, return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
USER_NAMESPACE__CREATE, NULL); USER_NAMESPACE__CREATE, NULL);
} }
...@@ -4504,7 +4429,7 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) ...@@ -4504,7 +4429,7 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
if (unlikely(err)) if (unlikely(err))
return -EACCES; return -EACCES;
err = security_net_peersid_resolve(&selinux_state, nlbl_sid, err = security_net_peersid_resolve(nlbl_sid,
nlbl_type, xfrm_sid, sid); nlbl_type, xfrm_sid, sid);
if (unlikely(err)) { if (unlikely(err)) {
pr_warn( pr_warn(
...@@ -4533,7 +4458,7 @@ static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid) ...@@ -4533,7 +4458,7 @@ static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
int err = 0; int err = 0;
if (skb_sid != SECSID_NULL) if (skb_sid != SECSID_NULL)
err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid, err = security_sid_mls_copy(sk_sid, skb_sid,
conn_sid); conn_sid);
else else
*conn_sid = sk_sid; *conn_sid = sk_sid;
...@@ -4551,7 +4476,7 @@ static int socket_sockcreate_sid(const struct task_security_struct *tsec, ...@@ -4551,7 +4476,7 @@ static int socket_sockcreate_sid(const struct task_security_struct *tsec,
return 0; return 0;
} }
return security_transition_sid(&selinux_state, tsec->sid, tsec->sid, return security_transition_sid(tsec->sid, tsec->sid,
secclass, NULL, socksid); secclass, NULL, socksid);
} }
...@@ -4568,8 +4493,7 @@ static int sock_has_perm(struct sock *sk, u32 perms) ...@@ -4568,8 +4493,7 @@ static int sock_has_perm(struct sock *sk, u32 perms)
ad.u.net = &net; ad.u.net = &net;
ad.u.net->sk = sk; ad.u.net->sk = sk;
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
current_sid(), sksec->sid, sksec->sclass, perms,
&ad); &ad);
} }
...@@ -4589,8 +4513,7 @@ static int selinux_socket_create(int family, int type, ...@@ -4589,8 +4513,7 @@ static int selinux_socket_create(int family, int type,
if (rc) if (rc)
return rc; return rc;
return avc_has_perm(&selinux_state, return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
} }
static int selinux_socket_post_create(struct socket *sock, int family, static int selinux_socket_post_create(struct socket *sock, int family,
...@@ -4719,8 +4642,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in ...@@ -4719,8 +4642,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
snum, &sid); snum, &sid);
if (err) if (err)
goto out; goto out;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sksec->sid, sid,
sksec->sid, sid,
sksec->sclass, sksec->sclass,
SOCKET__NAME_BIND, &ad); SOCKET__NAME_BIND, &ad);
if (err) if (err)
...@@ -4759,8 +4681,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in ...@@ -4759,8 +4681,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
else else
ad.u.net->v6info.saddr = addr6->sin6_addr; ad.u.net->v6info.saddr = addr6->sin6_addr;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sksec->sid, sid,
sksec->sid, sid,
sksec->sclass, node_perm, &ad); sksec->sclass, node_perm, &ad);
if (err) if (err)
goto out; goto out;
...@@ -4858,8 +4779,7 @@ static int selinux_socket_connect_helper(struct socket *sock, ...@@ -4858,8 +4779,7 @@ static int selinux_socket_connect_helper(struct socket *sock,
ad.u.net = &net; ad.u.net = &net;
ad.u.net->dport = htons(snum); ad.u.net->dport = htons(snum);
ad.u.net->family = address->sa_family; ad.u.net->family = address->sa_family;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
sksec->sid, sid, sksec->sclass, perm, &ad);
if (err) if (err)
return err; return err;
} }
...@@ -4971,8 +4891,7 @@ static int selinux_socket_unix_stream_connect(struct sock *sock, ...@@ -4971,8 +4891,7 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
ad.u.net = &net; ad.u.net = &net;
ad.u.net->sk = other; ad.u.net->sk = other;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
sksec_sock->sid, sksec_other->sid,
sksec_other->sclass, sksec_other->sclass,
UNIX_STREAM_SOCKET__CONNECTTO, &ad); UNIX_STREAM_SOCKET__CONNECTTO, &ad);
if (err) if (err)
...@@ -4980,7 +4899,7 @@ static int selinux_socket_unix_stream_connect(struct sock *sock, ...@@ -4980,7 +4899,7 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
/* server child socket */ /* server child socket */
sksec_new->peer_sid = sksec_sock->sid; sksec_new->peer_sid = sksec_sock->sid;
err = security_sid_mls_copy(&selinux_state, sksec_other->sid, err = security_sid_mls_copy(sksec_other->sid,
sksec_sock->sid, &sksec_new->sid); sksec_sock->sid, &sksec_new->sid);
if (err) if (err)
return err; return err;
...@@ -5003,8 +4922,7 @@ static int selinux_socket_unix_may_send(struct socket *sock, ...@@ -5003,8 +4922,7 @@ static int selinux_socket_unix_may_send(struct socket *sock,
ad.u.net = &net; ad.u.net = &net;
ad.u.net->sk = other->sk; ad.u.net->sk = other->sk;
return avc_has_perm(&selinux_state, return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
&ad); &ad);
} }
...@@ -5019,8 +4937,7 @@ static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex, ...@@ -5019,8 +4937,7 @@ static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
err = sel_netif_sid(ns, ifindex, &if_sid); err = sel_netif_sid(ns, ifindex, &if_sid);
if (err) if (err)
return err; return err;
err = avc_has_perm(&selinux_state, err = avc_has_perm(peer_sid, if_sid,
peer_sid, if_sid,
SECCLASS_NETIF, NETIF__INGRESS, ad); SECCLASS_NETIF, NETIF__INGRESS, ad);
if (err) if (err)
return err; return err;
...@@ -5028,8 +4945,7 @@ static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex, ...@@ -5028,8 +4945,7 @@ static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
err = sel_netnode_sid(addrp, family, &node_sid); err = sel_netnode_sid(addrp, family, &node_sid);
if (err) if (err)
return err; return err;
return avc_has_perm(&selinux_state, return avc_has_perm(peer_sid, node_sid,
peer_sid, node_sid,
SECCLASS_NODE, NODE__RECVFROM, ad); SECCLASS_NODE, NODE__RECVFROM, ad);
} }
...@@ -5052,8 +4968,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, ...@@ -5052,8 +4968,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
return err; return err;
if (selinux_secmark_enabled()) { if (selinux_secmark_enabled()) {
err = avc_has_perm(&selinux_state, err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
sk_sid, skb->secmark, SECCLASS_PACKET,
PACKET__RECV, &ad); PACKET__RECV, &ad);
if (err) if (err)
return err; return err;
...@@ -5118,8 +5033,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) ...@@ -5118,8 +5033,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
selinux_netlbl_err(skb, family, err, 0); selinux_netlbl_err(skb, family, err, 0);
return err; return err;
} }
err = avc_has_perm(&selinux_state, err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
sk_sid, peer_sid, SECCLASS_PEER,
PEER__RECV, &ad); PEER__RECV, &ad);
if (err) { if (err) {
selinux_netlbl_err(skb, family, err, 0); selinux_netlbl_err(skb, family, err, 0);
...@@ -5128,8 +5042,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) ...@@ -5128,8 +5042,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
} }
if (secmark_active) { if (secmark_active) {
err = avc_has_perm(&selinux_state, err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
sk_sid, skb->secmark, SECCLASS_PACKET,
PACKET__RECV, &ad); PACKET__RECV, &ad);
if (err) if (err)
return err; return err;
...@@ -5155,7 +5068,7 @@ static int selinux_socket_getpeersec_stream(struct socket *sock, ...@@ -5155,7 +5068,7 @@ static int selinux_socket_getpeersec_stream(struct socket *sock,
if (peer_sid == SECSID_NULL) if (peer_sid == SECSID_NULL)
return -ENOPROTOOPT; return -ENOPROTOOPT;
err = security_sid_to_context(&selinux_state, peer_sid, &scontext, err = security_sid_to_context(peer_sid, &scontext,
&scontext_len); &scontext_len);
if (err) if (err)
return err; return err;
...@@ -5312,8 +5225,7 @@ static int selinux_sctp_process_new_assoc(struct sctp_association *asoc, ...@@ -5312,8 +5225,7 @@ static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
ad.type = LSM_AUDIT_DATA_NET; ad.type = LSM_AUDIT_DATA_NET;
ad.u.net = &net; ad.u.net = &net;
ad.u.net->sk = asoc->base.sk; ad.u.net->sk = asoc->base.sk;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
sksec->peer_sid, asoc->peer_secid,
sksec->sclass, SCTP_SOCKET__ASSOCIATION, sksec->sclass, SCTP_SOCKET__ASSOCIATION,
&ad); &ad);
if (err) if (err)
...@@ -5534,8 +5446,7 @@ static int selinux_secmark_relabel_packet(u32 sid) ...@@ -5534,8 +5446,7 @@ static int selinux_secmark_relabel_packet(u32 sid)
__tsec = selinux_cred(current_cred()); __tsec = selinux_cred(current_cred());
tsid = __tsec->sid; tsid = __tsec->sid;
return avc_has_perm(&selinux_state, return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
NULL); NULL);
} }
...@@ -5584,8 +5495,7 @@ static int selinux_tun_dev_create(void) ...@@ -5584,8 +5495,7 @@ static int selinux_tun_dev_create(void)
* connections unlike traditional sockets - check the TUN driver to * connections unlike traditional sockets - check the TUN driver to
* get a better understanding of why this socket is special */ * get a better understanding of why this socket is special */
return avc_has_perm(&selinux_state, return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
NULL); NULL);
} }
...@@ -5593,8 +5503,7 @@ static int selinux_tun_dev_attach_queue(void *security) ...@@ -5593,8 +5503,7 @@ static int selinux_tun_dev_attach_queue(void *security)
{ {
struct tun_security_struct *tunsec = security; struct tun_security_struct *tunsec = security;
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
TUN_SOCKET__ATTACH_QUEUE, NULL); TUN_SOCKET__ATTACH_QUEUE, NULL);
} }
...@@ -5622,13 +5531,11 @@ static int selinux_tun_dev_open(void *security) ...@@ -5622,13 +5531,11 @@ static int selinux_tun_dev_open(void *security)
u32 sid = current_sid(); u32 sid = current_sid();
int err; int err;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
sid, tunsec->sid, SECCLASS_TUN_SOCKET,
TUN_SOCKET__RELABELFROM, NULL); TUN_SOCKET__RELABELFROM, NULL);
if (err) if (err)
return err; return err;
err = avc_has_perm(&selinux_state, err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
sid, sid, SECCLASS_TUN_SOCKET,
TUN_SOCKET__RELABELTO, NULL); TUN_SOCKET__RELABELTO, NULL);
if (err) if (err)
return err; return err;
...@@ -5682,8 +5589,7 @@ static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb, ...@@ -5682,8 +5589,7 @@ static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
} }
if (secmark_active) if (secmark_active)
if (avc_has_perm(&selinux_state, if (avc_has_perm(peer_sid, skb->secmark,
peer_sid, skb->secmark,
SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
return NF_DROP; return NF_DROP;
...@@ -5763,8 +5669,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, ...@@ -5763,8 +5669,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
return NF_DROP; return NF_DROP;
if (selinux_secmark_enabled()) if (selinux_secmark_enabled())
if (avc_has_perm(&selinux_state, if (avc_has_perm(sksec->sid, skb->secmark,
sksec->sid, skb->secmark,
SECCLASS_PACKET, PACKET__SEND, &ad)) SECCLASS_PACKET, PACKET__SEND, &ad))
return NF_DROP_ERR(-ECONNREFUSED); return NF_DROP_ERR(-ECONNREFUSED);
...@@ -5889,8 +5794,7 @@ static unsigned int selinux_ip_postroute(void *priv, ...@@ -5889,8 +5794,7 @@ static unsigned int selinux_ip_postroute(void *priv,
return NF_DROP; return NF_DROP;
if (secmark_active) if (secmark_active)
if (avc_has_perm(&selinux_state, if (avc_has_perm(peer_sid, skb->secmark,
peer_sid, skb->secmark,
SECCLASS_PACKET, secmark_perm, &ad)) SECCLASS_PACKET, secmark_perm, &ad))
return NF_DROP_ERR(-ECONNREFUSED); return NF_DROP_ERR(-ECONNREFUSED);
...@@ -5900,15 +5804,13 @@ static unsigned int selinux_ip_postroute(void *priv, ...@@ -5900,15 +5804,13 @@ static unsigned int selinux_ip_postroute(void *priv,
if (sel_netif_sid(state->net, ifindex, &if_sid)) if (sel_netif_sid(state->net, ifindex, &if_sid))
return NF_DROP; return NF_DROP;
if (avc_has_perm(&selinux_state, if (avc_has_perm(peer_sid, if_sid,
peer_sid, if_sid,
SECCLASS_NETIF, NETIF__EGRESS, &ad)) SECCLASS_NETIF, NETIF__EGRESS, &ad))
return NF_DROP_ERR(-ECONNREFUSED); return NF_DROP_ERR(-ECONNREFUSED);
if (sel_netnode_sid(addrp, family, &node_sid)) if (sel_netnode_sid(addrp, family, &node_sid))
return NF_DROP; return NF_DROP;
if (avc_has_perm(&selinux_state, if (avc_has_perm(peer_sid, node_sid,
peer_sid, node_sid,
SECCLASS_NODE, NODE__SENDTO, &ad)) SECCLASS_NODE, NODE__SENDTO, &ad))
return NF_DROP_ERR(-ECONNREFUSED); return NF_DROP_ERR(-ECONNREFUSED);
} }
...@@ -5953,8 +5855,8 @@ static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb) ...@@ -5953,8 +5855,8 @@ static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
sk->sk_protocol, nlh->nlmsg_type, sk->sk_protocol, nlh->nlmsg_type,
secclass_map[sclass - 1].name, secclass_map[sclass - 1].name,
task_pid_nr(current), current->comm); task_pid_nr(current), current->comm);
if (enforcing_enabled(&selinux_state) && if (enforcing_enabled() &&
!security_get_allow_unknown(&selinux_state)) !security_get_allow_unknown())
return rc; return rc;
rc = 0; rc = 0;
} else if (rc == -ENOENT) { } else if (rc == -ENOENT) {
...@@ -5993,8 +5895,7 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms, ...@@ -5993,8 +5895,7 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = ipc_perms->key; ad.u.ipc_id = ipc_perms->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
sid, isec->sid, isec->sclass, perms, &ad);
} }
static int selinux_msg_msg_alloc_security(struct msg_msg *msg) static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
...@@ -6020,8 +5921,7 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) ...@@ -6020,8 +5921,7 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = msq->key; ad.u.ipc_id = msq->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
sid, isec->sid, SECCLASS_MSGQ,
MSGQ__CREATE, &ad); MSGQ__CREATE, &ad);
} }
...@@ -6036,8 +5936,7 @@ static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg) ...@@ -6036,8 +5936,7 @@ static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = msq->key; ad.u.ipc_id = msq->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
sid, isec->sid, SECCLASS_MSGQ,
MSGQ__ASSOCIATE, &ad); MSGQ__ASSOCIATE, &ad);
} }
...@@ -6050,8 +5949,7 @@ static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd) ...@@ -6050,8 +5949,7 @@ static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
case IPC_INFO: case IPC_INFO:
case MSG_INFO: case MSG_INFO:
/* No specific object, just general system-wide information. */ /* No specific object, just general system-wide information. */
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
case IPC_STAT: case IPC_STAT:
case MSG_STAT: case MSG_STAT:
...@@ -6091,7 +5989,7 @@ static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *m ...@@ -6091,7 +5989,7 @@ static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *m
* Compute new sid based on current process and * Compute new sid based on current process and
* message queue this message will be stored in * message queue this message will be stored in
*/ */
rc = security_transition_sid(&selinux_state, sid, isec->sid, rc = security_transition_sid(sid, isec->sid,
SECCLASS_MSG, NULL, &msec->sid); SECCLASS_MSG, NULL, &msec->sid);
if (rc) if (rc)
return rc; return rc;
...@@ -6101,18 +5999,15 @@ static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *m ...@@ -6101,18 +5999,15 @@ static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *m
ad.u.ipc_id = msq->key; ad.u.ipc_id = msq->key;
/* Can this process write to the queue? */ /* Can this process write to the queue? */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
sid, isec->sid, SECCLASS_MSGQ,
MSGQ__WRITE, &ad); MSGQ__WRITE, &ad);
if (!rc) if (!rc)
/* Can this process send the message */ /* Can this process send the message */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
sid, msec->sid, SECCLASS_MSG,
MSG__SEND, &ad); MSG__SEND, &ad);
if (!rc) if (!rc)
/* Can the message be put in the queue? */ /* Can the message be put in the queue? */
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
msec->sid, isec->sid, SECCLASS_MSGQ,
MSGQ__ENQUEUE, &ad); MSGQ__ENQUEUE, &ad);
return rc; return rc;
...@@ -6134,12 +6029,10 @@ static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *m ...@@ -6134,12 +6029,10 @@ static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *m
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = msq->key; ad.u.ipc_id = msq->key;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, isec->sid,
sid, isec->sid,
SECCLASS_MSGQ, MSGQ__READ, &ad); SECCLASS_MSGQ, MSGQ__READ, &ad);
if (!rc) if (!rc)
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sid, msec->sid,
sid, msec->sid,
SECCLASS_MSG, MSG__RECEIVE, &ad); SECCLASS_MSG, MSG__RECEIVE, &ad);
return rc; return rc;
} }
...@@ -6157,8 +6050,7 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) ...@@ -6157,8 +6050,7 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = shp->key; ad.u.ipc_id = shp->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
sid, isec->sid, SECCLASS_SHM,
SHM__CREATE, &ad); SHM__CREATE, &ad);
} }
...@@ -6173,8 +6065,7 @@ static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg) ...@@ -6173,8 +6065,7 @@ static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = shp->key; ad.u.ipc_id = shp->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
sid, isec->sid, SECCLASS_SHM,
SHM__ASSOCIATE, &ad); SHM__ASSOCIATE, &ad);
} }
...@@ -6188,8 +6079,7 @@ static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd) ...@@ -6188,8 +6079,7 @@ static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
case IPC_INFO: case IPC_INFO:
case SHM_INFO: case SHM_INFO:
/* No specific object, just general system-wide information. */ /* No specific object, just general system-wide information. */
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
case IPC_STAT: case IPC_STAT:
case SHM_STAT: case SHM_STAT:
...@@ -6240,8 +6130,7 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) ...@@ -6240,8 +6130,7 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = sma->key; ad.u.ipc_id = sma->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
sid, isec->sid, SECCLASS_SEM,
SEM__CREATE, &ad); SEM__CREATE, &ad);
} }
...@@ -6256,8 +6145,7 @@ static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg) ...@@ -6256,8 +6145,7 @@ static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
ad.type = LSM_AUDIT_DATA_IPC; ad.type = LSM_AUDIT_DATA_IPC;
ad.u.ipc_id = sma->key; ad.u.ipc_id = sma->key;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
sid, isec->sid, SECCLASS_SEM,
SEM__ASSOCIATE, &ad); SEM__ASSOCIATE, &ad);
} }
...@@ -6271,8 +6159,7 @@ static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd) ...@@ -6271,8 +6159,7 @@ static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
case IPC_INFO: case IPC_INFO:
case SEM_INFO: case SEM_INFO:
/* No specific object, just general system-wide information. */ /* No specific object, just general system-wide information. */
return avc_has_perm(&selinux_state, return avc_has_perm(current_sid(), SECINITSID_KERNEL,
current_sid(), SECINITSID_KERNEL,
SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
case GETPID: case GETPID:
case GETNCNT: case GETNCNT:
...@@ -6359,8 +6246,7 @@ static int selinux_getprocattr(struct task_struct *p, ...@@ -6359,8 +6246,7 @@ static int selinux_getprocattr(struct task_struct *p,
__tsec = selinux_cred(__task_cred(p)); __tsec = selinux_cred(__task_cred(p));
if (current != p) { if (current != p) {
error = avc_has_perm(&selinux_state, error = avc_has_perm(current_sid(), __tsec->sid,
current_sid(), __tsec->sid,
SECCLASS_PROCESS, PROCESS__GETATTR, NULL); SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
if (error) if (error)
goto bad; goto bad;
...@@ -6387,7 +6273,7 @@ static int selinux_getprocattr(struct task_struct *p, ...@@ -6387,7 +6273,7 @@ static int selinux_getprocattr(struct task_struct *p,
if (!sid) if (!sid)
return 0; return 0;
error = security_sid_to_context(&selinux_state, sid, value, &len); error = security_sid_to_context(sid, value, &len);
if (error) if (error)
return error; return error;
return len; return len;
...@@ -6409,24 +6295,19 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6409,24 +6295,19 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
* Basic control over ability to set these attributes at all. * Basic control over ability to set these attributes at all.
*/ */
if (!strcmp(name, "exec")) if (!strcmp(name, "exec"))
error = avc_has_perm(&selinux_state, error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
mysid, mysid, SECCLASS_PROCESS,
PROCESS__SETEXEC, NULL); PROCESS__SETEXEC, NULL);
else if (!strcmp(name, "fscreate")) else if (!strcmp(name, "fscreate"))
error = avc_has_perm(&selinux_state, error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
mysid, mysid, SECCLASS_PROCESS,
PROCESS__SETFSCREATE, NULL); PROCESS__SETFSCREATE, NULL);
else if (!strcmp(name, "keycreate")) else if (!strcmp(name, "keycreate"))
error = avc_has_perm(&selinux_state, error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
mysid, mysid, SECCLASS_PROCESS,
PROCESS__SETKEYCREATE, NULL); PROCESS__SETKEYCREATE, NULL);
else if (!strcmp(name, "sockcreate")) else if (!strcmp(name, "sockcreate"))
error = avc_has_perm(&selinux_state, error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
mysid, mysid, SECCLASS_PROCESS,
PROCESS__SETSOCKCREATE, NULL); PROCESS__SETSOCKCREATE, NULL);
else if (!strcmp(name, "current")) else if (!strcmp(name, "current"))
error = avc_has_perm(&selinux_state, error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
mysid, mysid, SECCLASS_PROCESS,
PROCESS__SETCURRENT, NULL); PROCESS__SETCURRENT, NULL);
else else
error = -EINVAL; error = -EINVAL;
...@@ -6439,7 +6320,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6439,7 +6320,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
str[size-1] = 0; str[size-1] = 0;
size--; size--;
} }
error = security_context_to_sid(&selinux_state, value, size, error = security_context_to_sid(value, size,
&sid, GFP_KERNEL); &sid, GFP_KERNEL);
if (error == -EINVAL && !strcmp(name, "fscreate")) { if (error == -EINVAL && !strcmp(name, "fscreate")) {
if (!has_cap_mac_admin(true)) { if (!has_cap_mac_admin(true)) {
...@@ -6463,9 +6344,8 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6463,9 +6344,8 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
return error; return error;
} }
error = security_context_to_sid_force( error = security_context_to_sid_force(value, size,
&selinux_state, &sid);
value, size, &sid);
} }
if (error) if (error)
return error; return error;
...@@ -6488,7 +6368,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6488,7 +6368,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
tsec->create_sid = sid; tsec->create_sid = sid;
} else if (!strcmp(name, "keycreate")) { } else if (!strcmp(name, "keycreate")) {
if (sid) { if (sid) {
error = avc_has_perm(&selinux_state, mysid, sid, error = avc_has_perm(mysid, sid,
SECCLASS_KEY, KEY__CREATE, NULL); SECCLASS_KEY, KEY__CREATE, NULL);
if (error) if (error)
goto abort_change; goto abort_change;
...@@ -6503,15 +6383,13 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6503,15 +6383,13 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
/* Only allow single threaded processes to change context */ /* Only allow single threaded processes to change context */
if (!current_is_single_threaded()) { if (!current_is_single_threaded()) {
error = security_bounded_transition(&selinux_state, error = security_bounded_transition(tsec->sid, sid);
tsec->sid, sid);
if (error) if (error)
goto abort_change; goto abort_change;
} }
/* Check permissions for the transition. */ /* Check permissions for the transition. */
error = avc_has_perm(&selinux_state, error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
tsec->sid, sid, SECCLASS_PROCESS,
PROCESS__DYNTRANSITION, NULL); PROCESS__DYNTRANSITION, NULL);
if (error) if (error)
goto abort_change; goto abort_change;
...@@ -6520,8 +6398,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) ...@@ -6520,8 +6398,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
Otherwise, leave SID unchanged and fail. */ Otherwise, leave SID unchanged and fail. */
ptsid = ptrace_parent_sid(); ptsid = ptrace_parent_sid();
if (ptsid != 0) { if (ptsid != 0) {
error = avc_has_perm(&selinux_state, error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
ptsid, sid, SECCLASS_PROCESS,
PROCESS__PTRACE, NULL); PROCESS__PTRACE, NULL);
if (error) if (error)
goto abort_change; goto abort_change;
...@@ -6548,13 +6425,13 @@ static int selinux_ismaclabel(const char *name) ...@@ -6548,13 +6425,13 @@ static int selinux_ismaclabel(const char *name)
static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{ {
return security_sid_to_context(&selinux_state, secid, return security_sid_to_context(secid,
secdata, seclen); secdata, seclen);
} }
static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
{ {
return security_context_to_sid(&selinux_state, secdata, seclen, return security_context_to_sid(secdata, seclen,
secid, GFP_KERNEL); secid, GFP_KERNEL);
} }
...@@ -6674,8 +6551,7 @@ static int selinux_key_permission(key_ref_t key_ref, ...@@ -6674,8 +6551,7 @@ static int selinux_key_permission(key_ref_t key_ref,
key = key_ref_to_ptr(key_ref); key = key_ref_to_ptr(key_ref);
ksec = key->security; ksec = key->security;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
sid, ksec->sid, SECCLASS_KEY, perm, NULL);
} }
static int selinux_key_getsecurity(struct key *key, char **_buffer) static int selinux_key_getsecurity(struct key *key, char **_buffer)
...@@ -6685,7 +6561,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) ...@@ -6685,7 +6561,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
unsigned len; unsigned len;
int rc; int rc;
rc = security_sid_to_context(&selinux_state, ksec->sid, rc = security_sid_to_context(ksec->sid,
&context, &len); &context, &len);
if (!rc) if (!rc)
rc = len; rc = len;
...@@ -6699,8 +6575,7 @@ static int selinux_watch_key(struct key *key) ...@@ -6699,8 +6575,7 @@ static int selinux_watch_key(struct key *key)
struct key_security_struct *ksec = key->security; struct key_security_struct *ksec = key->security;
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(&selinux_state, return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
} }
#endif #endif
#endif #endif
...@@ -6722,8 +6597,7 @@ static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val) ...@@ -6722,8 +6597,7 @@ static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
ibpkey.subnet_prefix = subnet_prefix; ibpkey.subnet_prefix = subnet_prefix;
ibpkey.pkey = pkey_val; ibpkey.pkey = pkey_val;
ad.u.ibpkey = &ibpkey; ad.u.ibpkey = &ibpkey;
return avc_has_perm(&selinux_state, return avc_has_perm(sec->sid, sid,
sec->sid, sid,
SECCLASS_INFINIBAND_PKEY, SECCLASS_INFINIBAND_PKEY,
INFINIBAND_PKEY__ACCESS, &ad); INFINIBAND_PKEY__ACCESS, &ad);
} }
...@@ -6737,7 +6611,7 @@ static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name, ...@@ -6737,7 +6611,7 @@ static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
struct ib_security_struct *sec = ib_sec; struct ib_security_struct *sec = ib_sec;
struct lsm_ibendport_audit ibendport; struct lsm_ibendport_audit ibendport;
err = security_ib_endport_sid(&selinux_state, dev_name, port_num, err = security_ib_endport_sid(dev_name, port_num,
&sid); &sid);
if (err) if (err)
...@@ -6747,8 +6621,7 @@ static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name, ...@@ -6747,8 +6621,7 @@ static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
ibendport.dev_name = dev_name; ibendport.dev_name = dev_name;
ibendport.port = port_num; ibendport.port = port_num;
ad.u.ibendport = &ibendport; ad.u.ibendport = &ibendport;
return avc_has_perm(&selinux_state, return avc_has_perm(sec->sid, sid,
sec->sid, sid,
SECCLASS_INFINIBAND_ENDPORT, SECCLASS_INFINIBAND_ENDPORT,
INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad); INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
} }
...@@ -6781,13 +6654,11 @@ static int selinux_bpf(int cmd, union bpf_attr *attr, ...@@ -6781,13 +6654,11 @@ static int selinux_bpf(int cmd, union bpf_attr *attr,
switch (cmd) { switch (cmd) {
case BPF_MAP_CREATE: case BPF_MAP_CREATE:
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
NULL); NULL);
break; break;
case BPF_PROG_LOAD: case BPF_PROG_LOAD:
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
NULL); NULL);
break; break;
default: default:
...@@ -6827,16 +6698,14 @@ static int bpf_fd_pass(struct file *file, u32 sid) ...@@ -6827,16 +6698,14 @@ static int bpf_fd_pass(struct file *file, u32 sid)
if (file->f_op == &bpf_map_fops) { if (file->f_op == &bpf_map_fops) {
map = file->private_data; map = file->private_data;
bpfsec = map->security; bpfsec = map->security;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
sid, bpfsec->sid, SECCLASS_BPF,
bpf_map_fmode_to_av(file->f_mode), NULL); bpf_map_fmode_to_av(file->f_mode), NULL);
if (ret) if (ret)
return ret; return ret;
} else if (file->f_op == &bpf_prog_fops) { } else if (file->f_op == &bpf_prog_fops) {
prog = file->private_data; prog = file->private_data;
bpfsec = prog->aux->security; bpfsec = prog->aux->security;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
sid, bpfsec->sid, SECCLASS_BPF,
BPF__PROG_RUN, NULL); BPF__PROG_RUN, NULL);
if (ret) if (ret)
return ret; return ret;
...@@ -6850,8 +6719,7 @@ static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode) ...@@ -6850,8 +6719,7 @@ static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
struct bpf_security_struct *bpfsec; struct bpf_security_struct *bpfsec;
bpfsec = map->security; bpfsec = map->security;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
sid, bpfsec->sid, SECCLASS_BPF,
bpf_map_fmode_to_av(fmode), NULL); bpf_map_fmode_to_av(fmode), NULL);
} }
...@@ -6861,8 +6729,7 @@ static int selinux_bpf_prog(struct bpf_prog *prog) ...@@ -6861,8 +6729,7 @@ static int selinux_bpf_prog(struct bpf_prog *prog)
struct bpf_security_struct *bpfsec; struct bpf_security_struct *bpfsec;
bpfsec = prog->aux->security; bpfsec = prog->aux->security;
return avc_has_perm(&selinux_state, return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
sid, bpfsec->sid, SECCLASS_BPF,
BPF__PROG_RUN, NULL); BPF__PROG_RUN, NULL);
} }
...@@ -6936,7 +6803,7 @@ static int selinux_perf_event_open(struct perf_event_attr *attr, int type) ...@@ -6936,7 +6803,7 @@ static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
else else
return -EINVAL; return -EINVAL;
return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT, return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
requested, NULL); requested, NULL);
} }
...@@ -6967,7 +6834,7 @@ static int selinux_perf_event_read(struct perf_event *event) ...@@ -6967,7 +6834,7 @@ static int selinux_perf_event_read(struct perf_event *event)
struct perf_event_security_struct *perfsec = event->security; struct perf_event_security_struct *perfsec = event->security;
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(&selinux_state, sid, perfsec->sid, return avc_has_perm(sid, perfsec->sid,
SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL); SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
} }
...@@ -6976,7 +6843,7 @@ static int selinux_perf_event_write(struct perf_event *event) ...@@ -6976,7 +6843,7 @@ static int selinux_perf_event_write(struct perf_event *event)
struct perf_event_security_struct *perfsec = event->security; struct perf_event_security_struct *perfsec = event->security;
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(&selinux_state, sid, perfsec->sid, return avc_has_perm(sid, perfsec->sid,
SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL); SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
} }
#endif #endif
...@@ -6991,7 +6858,7 @@ static int selinux_perf_event_write(struct perf_event *event) ...@@ -6991,7 +6858,7 @@ static int selinux_perf_event_write(struct perf_event *event)
*/ */
static int selinux_uring_override_creds(const struct cred *new) static int selinux_uring_override_creds(const struct cred *new)
{ {
return avc_has_perm(&selinux_state, current_sid(), cred_sid(new), return avc_has_perm(current_sid(), cred_sid(new),
SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL); SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
} }
...@@ -7005,7 +6872,7 @@ static int selinux_uring_sqpoll(void) ...@@ -7005,7 +6872,7 @@ static int selinux_uring_sqpoll(void)
{ {
int sid = current_sid(); int sid = current_sid();
return avc_has_perm(&selinux_state, sid, sid, return avc_has_perm(sid, sid,
SECCLASS_IO_URING, IO_URING__SQPOLL, NULL); SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
} }
...@@ -7027,7 +6894,7 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd) ...@@ -7027,7 +6894,7 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
ad.type = LSM_AUDIT_DATA_FILE; ad.type = LSM_AUDIT_DATA_FILE;
ad.u.file = file; ad.u.file = file;
return avc_has_perm(&selinux_state, current_sid(), isec->sid, return avc_has_perm(current_sid(), isec->sid,
SECCLASS_IO_URING, IO_URING__CMD, &ad); SECCLASS_IO_URING, IO_URING__CMD, &ad);
} }
#endif /* CONFIG_IO_URING */ #endif /* CONFIG_IO_URING */
...@@ -7334,11 +7201,11 @@ static __init int selinux_init(void) ...@@ -7334,11 +7201,11 @@ static __init int selinux_init(void)
pr_info("SELinux: Initializing.\n"); pr_info("SELinux: Initializing.\n");
memset(&selinux_state, 0, sizeof(selinux_state)); memset(&selinux_state, 0, sizeof(selinux_state));
enforcing_set(&selinux_state, selinux_enforcing_boot); enforcing_set(selinux_enforcing_boot);
if (CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE) if (CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE)
pr_err("SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero. This is deprecated and will be rejected in a future kernel release.\n"); pr_err("SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero. This is deprecated and will be rejected in a future kernel release.\n");
checkreqprot_set(&selinux_state, selinux_checkreqprot_boot); checkreqprot_set(selinux_checkreqprot_boot);
selinux_avc_init(&selinux_state.avc); selinux_avc_init();
mutex_init(&selinux_state.status_lock); mutex_init(&selinux_state.status_lock);
mutex_init(&selinux_state.policy_mutex); mutex_init(&selinux_state.policy_mutex);
...@@ -7492,19 +7359,19 @@ static void selinux_nf_ip_exit(void) ...@@ -7492,19 +7359,19 @@ static void selinux_nf_ip_exit(void)
#endif /* CONFIG_NETFILTER */ #endif /* CONFIG_NETFILTER */
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
int selinux_disable(struct selinux_state *state) int selinux_disable(void)
{ {
if (selinux_initialized(state)) { if (selinux_initialized()) {
/* Not permitted after initial policy load. */ /* Not permitted after initial policy load. */
return -EINVAL; return -EINVAL;
} }
if (selinux_disabled(state)) { if (selinux_disabled()) {
/* Only do this once. */ /* Only do this once. */
return -EINVAL; return -EINVAL;
} }
selinux_mark_disabled(state); selinux_mark_disabled();
pr_info("SELinux: Disabled at runtime.\n"); pr_info("SELinux: Disabled at runtime.\n");
......
security/selinux/ibpkey.c
View file @ e67b7985
...@@ -141,7 +141,7 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid) ...@@ -141,7 +141,7 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
return 0; return 0;
} }
ret = security_ib_pkey_sid(&selinux_state, subnet_prefix, pkey_num, ret = security_ib_pkey_sid(subnet_prefix, pkey_num,
sid); sid);
if (ret) if (ret)
goto out; goto out;
......
security/selinux/ima.c
View file @ e67b7985
...@@ -15,12 +15,10 @@ ...@@ -15,12 +15,10 @@
/* /*
* selinux_ima_collect_state - Read selinux configuration settings * selinux_ima_collect_state - Read selinux configuration settings
* *
* @state: selinux_state
*
* On success returns the configuration settings string. * On success returns the configuration settings string.
* On error, returns NULL. * On error, returns NULL.
*/ */
static char *selinux_ima_collect_state(struct selinux_state *state) static char *selinux_ima_collect_state(void)
{ {
const char *on = "=1;", *off = "=0;"; const char *on = "=1;", *off = "=0;";
char *buf; char *buf;
...@@ -39,26 +37,27 @@ static char *selinux_ima_collect_state(struct selinux_state *state) ...@@ -39,26 +37,27 @@ static char *selinux_ima_collect_state(struct selinux_state *state)
rc = strscpy(buf, "initialized", buf_len); rc = strscpy(buf, "initialized", buf_len);
WARN_ON(rc < 0); WARN_ON(rc < 0);
rc = strlcat(buf, selinux_initialized(state) ? on : off, buf_len); rc = strlcat(buf, selinux_initialized() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, "enforcing", buf_len); rc = strlcat(buf, "enforcing", buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, enforcing_enabled(state) ? on : off, buf_len); rc = strlcat(buf, enforcing_enabled() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, "checkreqprot", buf_len); rc = strlcat(buf, "checkreqprot", buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, checkreqprot_get(state) ? on : off, buf_len); rc = strlcat(buf, checkreqprot_get() ? on : off, buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
for (i = 0; i < __POLICYDB_CAP_MAX; i++) { for (i = 0; i < __POLICYDB_CAP_MAX; i++) {
rc = strlcat(buf, selinux_policycap_names[i], buf_len); rc = strlcat(buf, selinux_policycap_names[i], buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
rc = strlcat(buf, state->policycap[i] ? on : off, buf_len); rc = strlcat(buf, selinux_state.policycap[i] ? on : off,
buf_len);
WARN_ON(rc >= buf_len); WARN_ON(rc >= buf_len);
} }
...@@ -67,19 +66,17 @@ static char *selinux_ima_collect_state(struct selinux_state *state) ...@@ -67,19 +66,17 @@ static char *selinux_ima_collect_state(struct selinux_state *state)
/* /*
* selinux_ima_measure_state_locked - Measure SELinux state and hash of policy * selinux_ima_measure_state_locked - Measure SELinux state and hash of policy
*
* @state: selinux state struct
*/ */
void selinux_ima_measure_state_locked(struct selinux_state *state) void selinux_ima_measure_state_locked(void)
{ {
char *state_str = NULL; char *state_str = NULL;
void *policy = NULL; void *policy = NULL;
size_t policy_len; size_t policy_len;
int rc = 0; int rc = 0;
lockdep_assert_held(&state->policy_mutex); lockdep_assert_held(&selinux_state.policy_mutex);
state_str = selinux_ima_collect_state(state); state_str = selinux_ima_collect_state();
if (!state_str) { if (!state_str) {
pr_err("SELinux: %s: failed to read state.\n", __func__); pr_err("SELinux: %s: failed to read state.\n", __func__);
return; return;
...@@ -94,10 +91,10 @@ void selinux_ima_measure_state_locked(struct selinux_state *state) ...@@ -94,10 +91,10 @@ void selinux_ima_measure_state_locked(struct selinux_state *state)
/* /*
* Measure SELinux policy only after initialization is completed. * Measure SELinux policy only after initialization is completed.
*/ */
if (!selinux_initialized(state)) if (!selinux_initialized())
return; return;
rc = security_read_state_kernel(state, &policy, &policy_len); rc = security_read_state_kernel(&policy, &policy_len);
if (rc) { if (rc) {
pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc); pr_err("SELinux: %s: failed to read policy %d.\n", __func__, rc);
return; return;
...@@ -112,14 +109,12 @@ void selinux_ima_measure_state_locked(struct selinux_state *state) ...@@ -112,14 +109,12 @@ void selinux_ima_measure_state_locked(struct selinux_state *state)
/* /*
* selinux_ima_measure_state - Measure SELinux state and hash of policy * selinux_ima_measure_state - Measure SELinux state and hash of policy
*
* @state: selinux state struct
*/ */
void selinux_ima_measure_state(struct selinux_state *state) void selinux_ima_measure_state(void)
{ {
lockdep_assert_not_held(&state->policy_mutex); lockdep_assert_not_held(&selinux_state.policy_mutex);
mutex_lock(&state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
selinux_ima_measure_state_locked(state); selinux_ima_measure_state_locked();
mutex_unlock(&state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
} }
security/selinux/include/avc.h
View file @ e67b7985
...@@ -52,7 +52,6 @@ struct selinux_audit_data { ...@@ -52,7 +52,6 @@ struct selinux_audit_data {
u32 audited; u32 audited;
u32 denied; u32 denied;
int result; int result;
struct selinux_state *state;
} __randomize_layout; } __randomize_layout;
/* /*
...@@ -97,14 +96,12 @@ static inline u32 avc_audit_required(u32 requested, ...@@ -97,14 +96,12 @@ static inline u32 avc_audit_required(u32 requested,
return audited; return audited;
} }
int slow_avc_audit(struct selinux_state *state, int slow_avc_audit(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u32 requested, u32 audited, u32 denied, int result, u32 requested, u32 audited, u32 denied, int result,
struct common_audit_data *a); struct common_audit_data *a);
/** /**
* avc_audit - Audit the granting or denial of permissions. * avc_audit - Audit the granting or denial of permissions.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -122,8 +119,7 @@ int slow_avc_audit(struct selinux_state *state, ...@@ -122,8 +119,7 @@ int slow_avc_audit(struct selinux_state *state,
* be performed under a lock, to allow the lock to be released * be performed under a lock, to allow the lock to be released
* before calling the auditing code. * before calling the auditing code.
*/ */
static inline int avc_audit(struct selinux_state *state, static inline int avc_audit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
struct av_decision *avd, struct av_decision *avd,
int result, int result,
...@@ -133,30 +129,27 @@ static inline int avc_audit(struct selinux_state *state, ...@@ -133,30 +129,27 @@ static inline int avc_audit(struct selinux_state *state,
audited = avc_audit_required(requested, avd, result, 0, &denied); audited = avc_audit_required(requested, avd, result, 0, &denied);
if (likely(!audited)) if (likely(!audited))
return 0; return 0;
return slow_avc_audit(state, ssid, tsid, tclass, return slow_avc_audit(ssid, tsid, tclass,
requested, audited, denied, result, requested, audited, denied, result,
a); a);
} }
#define AVC_STRICT 1 /* Ignore permissive mode. */ #define AVC_STRICT 1 /* Ignore permissive mode. */
#define AVC_EXTENDED_PERMS 2 /* update extended permissions */ #define AVC_EXTENDED_PERMS 2 /* update extended permissions */
int avc_has_perm_noaudit(struct selinux_state *state, int avc_has_perm_noaudit(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
unsigned flags, unsigned flags,
struct av_decision *avd); struct av_decision *avd);
int avc_has_perm(struct selinux_state *state, int avc_has_perm(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, u32 requested, u16 tclass, u32 requested,
struct common_audit_data *auditdata); struct common_audit_data *auditdata);
int avc_has_extended_perms(struct selinux_state *state, int avc_has_extended_perms(u32 ssid, u32 tsid, u16 tclass, u32 requested,
u32 ssid, u32 tsid, u16 tclass, u32 requested,
u8 driver, u8 perm, struct common_audit_data *ad); u8 driver, u8 perm, struct common_audit_data *ad);
u32 avc_policy_seqno(struct selinux_state *state); u32 avc_policy_seqno(void);
#define AVC_CALLBACK_GRANT 1 #define AVC_CALLBACK_GRANT 1
#define AVC_CALLBACK_TRY_REVOKE 2 #define AVC_CALLBACK_TRY_REVOKE 2
...@@ -171,11 +164,9 @@ u32 avc_policy_seqno(struct selinux_state *state); ...@@ -171,11 +164,9 @@ u32 avc_policy_seqno(struct selinux_state *state);
int avc_add_callback(int (*callback)(u32 event), u32 events); int avc_add_callback(int (*callback)(u32 event), u32 events);
/* Exported to selinuxfs */ /* Exported to selinuxfs */
struct selinux_avc; int avc_get_hash_stats(char *page);
int avc_get_hash_stats(struct selinux_avc *avc, char *page); unsigned int avc_get_cache_threshold(void);
unsigned int avc_get_cache_threshold(struct selinux_avc *avc); void avc_set_cache_threshold(unsigned int cache_threshold);
void avc_set_cache_threshold(struct selinux_avc *avc,
unsigned int cache_threshold);
/* Attempt to free avc node cache */ /* Attempt to free avc node cache */
void avc_disable(void); void avc_disable(void);
......
security/selinux/include/avc_ss.h
View file @ e67b7985
...@@ -9,8 +9,7 @@ ...@@ -9,8 +9,7 @@
#include <linux/types.h> #include <linux/types.h>
struct selinux_avc; int avc_ss_reset(u32 seqno);
int avc_ss_reset(struct selinux_avc *avc, u32 seqno);
/* Class/perm mapping support */ /* Class/perm mapping support */
struct security_class_mapping { struct security_class_mapping {
......
security/selinux/include/conditional.h
View file @ e67b7985
...@@ -16,8 +16,8 @@ ...@@ -16,8 +16,8 @@
int security_get_bools(struct selinux_policy *policy, int security_get_bools(struct selinux_policy *policy,
u32 *len, char ***names, int **values); u32 *len, char ***names, int **values);
int security_set_bools(struct selinux_state *state, u32 len, int *values); int security_set_bools(u32 len, int *values);
int security_get_bool_value(struct selinux_state *state, u32 index); int security_get_bool_value(u32 index);
#endif #endif
security/selinux/include/ima.h
View file @ e67b7985
...@@ -14,15 +14,13 @@ ...@@ -14,15 +14,13 @@
#include "security.h" #include "security.h"
#ifdef CONFIG_IMA #ifdef CONFIG_IMA
extern void selinux_ima_measure_state(struct selinux_state *selinux_state); extern void selinux_ima_measure_state(void);
extern void selinux_ima_measure_state_locked( extern void selinux_ima_measure_state_locked(void);
struct selinux_state *selinux_state);
#else #else
static inline void selinux_ima_measure_state(struct selinux_state *selinux_state) static inline void selinux_ima_measure_state(void)
{ {
} }
static inline void selinux_ima_measure_state_locked( static inline void selinux_ima_measure_state_locked(void)
struct selinux_state *selinux_state)
{ {
} }
#endif #endif
......
security/selinux/include/security.h
View file @ e67b7985
...@@ -86,7 +86,6 @@ extern int selinux_enabled_boot; ...@@ -86,7 +86,6 @@ extern int selinux_enabled_boot;
/* limitation of boundary depth */ /* limitation of boundary depth */
#define POLICYDB_BOUNDS_MAXDEPTH 4 #define POLICYDB_BOUNDS_MAXDEPTH 4
struct selinux_avc;
struct selinux_policy; struct selinux_policy;
struct selinux_state { struct selinux_state {
...@@ -103,72 +102,71 @@ struct selinux_state { ...@@ -103,72 +102,71 @@ struct selinux_state {
struct page *status_page; struct page *status_page;
struct mutex status_lock; struct mutex status_lock;
struct selinux_avc *avc;
struct selinux_policy __rcu *policy; struct selinux_policy __rcu *policy;
struct mutex policy_mutex; struct mutex policy_mutex;
} __randomize_layout; } __randomize_layout;
void selinux_avc_init(struct selinux_avc **avc); void selinux_avc_init(void);
extern struct selinux_state selinux_state; extern struct selinux_state selinux_state;
static inline bool selinux_initialized(const struct selinux_state *state) static inline bool selinux_initialized(void)
{ {
/* do a synchronized load to avoid race conditions */ /* do a synchronized load to avoid race conditions */
return smp_load_acquire(&state->initialized); return smp_load_acquire(&selinux_state.initialized);
} }
static inline void selinux_mark_initialized(struct selinux_state *state) static inline void selinux_mark_initialized(void)
{ {
/* do a synchronized write to avoid race conditions */ /* do a synchronized write to avoid race conditions */
smp_store_release(&state->initialized, true); smp_store_release(&selinux_state.initialized, true);
} }
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
static inline bool enforcing_enabled(struct selinux_state *state) static inline bool enforcing_enabled(void)
{ {
return READ_ONCE(state->enforcing); return READ_ONCE(selinux_state.enforcing);
} }
static inline void enforcing_set(struct selinux_state *state, bool value) static inline void enforcing_set(bool value)
{ {
WRITE_ONCE(state->enforcing, value); WRITE_ONCE(selinux_state.enforcing, value);
} }
#else #else
static inline bool enforcing_enabled(struct selinux_state *state) static inline bool enforcing_enabled(void)
{ {
return true; return true;
} }
static inline void enforcing_set(struct selinux_state *state, bool value) static inline void enforcing_set(bool value)
{ {
} }
#endif #endif
static inline bool checkreqprot_get(const struct selinux_state *state) static inline bool checkreqprot_get(void)
{ {
return READ_ONCE(state->checkreqprot); return READ_ONCE(selinux_state.checkreqprot);
} }
static inline void checkreqprot_set(struct selinux_state *state, bool value) static inline void checkreqprot_set(bool value)
{ {
if (value) if (value)
pr_err("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot\n"); pr_err("SELinux: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot\n");
WRITE_ONCE(state->checkreqprot, value); WRITE_ONCE(selinux_state.checkreqprot, value);
} }
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
static inline bool selinux_disabled(struct selinux_state *state) static inline bool selinux_disabled(void)
{ {
return READ_ONCE(state->disabled); return READ_ONCE(selinux_state.disabled);
} }
static inline void selinux_mark_disabled(struct selinux_state *state) static inline void selinux_mark_disabled(void)
{ {
WRITE_ONCE(state->disabled, true); WRITE_ONCE(selinux_state.disabled, true);
} }
#else #else
static inline bool selinux_disabled(struct selinux_state *state) static inline bool selinux_disabled(void)
{ {
return false; return false;
} }
...@@ -237,20 +235,14 @@ struct selinux_load_state { ...@@ -237,20 +235,14 @@ struct selinux_load_state {
struct selinux_policy_convert_data *convert_data; struct selinux_policy_convert_data *convert_data;
}; };
int security_mls_enabled(struct selinux_state *state); int security_mls_enabled(void);
int security_load_policy(struct selinux_state *state, int security_load_policy(void *data, size_t len,
void *data, size_t len,
struct selinux_load_state *load_state); struct selinux_load_state *load_state);
void selinux_policy_commit(struct selinux_state *state, void selinux_policy_commit(struct selinux_load_state *load_state);
struct selinux_load_state *load_state); void selinux_policy_cancel(struct selinux_load_state *load_state);
void selinux_policy_cancel(struct selinux_state *state, int security_read_policy(void **data, size_t *len);
struct selinux_load_state *load_state); int security_read_state_kernel(void **data, size_t *len);
int security_read_policy(struct selinux_state *state, int security_policycap_supported(unsigned int req_cap);
void **data, size_t *len);
int security_read_state_kernel(struct selinux_state *state,
void **data, size_t *len);
int security_policycap_supported(struct selinux_state *state,
unsigned int req_cap);
#define SEL_VEC_MAX 32 #define SEL_VEC_MAX 32
struct av_decision { struct av_decision {
...@@ -287,94 +279,68 @@ struct extended_perms { ...@@ -287,94 +279,68 @@ struct extended_perms {
/* definitions of av_decision.flags */ /* definitions of av_decision.flags */
#define AVD_FLAGS_PERMISSIVE 0x0001 #define AVD_FLAGS_PERMISSIVE 0x0001
void security_compute_av(struct selinux_state *state, void security_compute_av(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, struct av_decision *avd, u16 tclass, struct av_decision *avd,
struct extended_perms *xperms); struct extended_perms *xperms);
void security_compute_xperms_decision(struct selinux_state *state, void security_compute_xperms_decision(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
u8 driver, u8 driver,
struct extended_perms_decision *xpermd); struct extended_perms_decision *xpermd);
void security_compute_av_user(struct selinux_state *state, void security_compute_av_user(u32 ssid, u32 tsid,
u32 ssid, u32 tsid,
u16 tclass, struct av_decision *avd); u16 tclass, struct av_decision *avd);
int security_transition_sid(struct selinux_state *state, int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const struct qstr *qstr, u32 *out_sid); const struct qstr *qstr, u32 *out_sid);
int security_transition_sid_user(struct selinux_state *state, int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const char *objname, u32 *out_sid); const char *objname, u32 *out_sid);
int security_member_sid(struct selinux_state *state, u32 ssid, u32 tsid, int security_member_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid);
u16 tclass, u32 *out_sid);
int security_change_sid(struct selinux_state *state, u32 ssid, u32 tsid, int security_change_sid(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid);
u16 tclass, u32 *out_sid);
int security_sid_to_context(struct selinux_state *state, u32 sid, int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len);
char **scontext, u32 *scontext_len);
int security_sid_to_context_force(struct selinux_state *state, int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len);
u32 sid, char **scontext, u32 *scontext_len);
int security_sid_to_context_inval(struct selinux_state *state, int security_sid_to_context_inval(u32 sid, char **scontext, u32 *scontext_len);
u32 sid, char **scontext, u32 *scontext_len);
int security_context_to_sid(struct selinux_state *state, int security_context_to_sid(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *out_sid, gfp_t gfp); u32 *out_sid, gfp_t gfp);
int security_context_str_to_sid(struct selinux_state *state, int security_context_str_to_sid(const char *scontext, u32 *out_sid, gfp_t gfp);
const char *scontext, u32 *out_sid, gfp_t gfp);
int security_context_to_sid_default(struct selinux_state *state, int security_context_to_sid_default(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *out_sid, u32 def_sid, gfp_t gfp_flags); u32 *out_sid, u32 def_sid, gfp_t gfp_flags);
int security_context_to_sid_force(struct selinux_state *state, int security_context_to_sid_force(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *sid); u32 *sid);
int security_get_user_sids(struct selinux_state *state, int security_get_user_sids(u32 callsid, char *username, u32 **sids, u32 *nel);
u32 callsid, char *username,
u32 **sids, u32 *nel);
int security_port_sid(struct selinux_state *state, int security_port_sid(u8 protocol, u16 port, u32 *out_sid);
u8 protocol, u16 port, u32 *out_sid);
int security_ib_pkey_sid(struct selinux_state *state, int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
u64 subnet_prefix, u16 pkey_num, u32 *out_sid);
int security_ib_endport_sid(struct selinux_state *state, int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid);
const char *dev_name, u8 port_num, u32 *out_sid);
int security_netif_sid(struct selinux_state *state, int security_netif_sid(char *name, u32 *if_sid);
char *name, u32 *if_sid);
int security_node_sid(struct selinux_state *state, int security_node_sid(u16 domain, void *addr, u32 addrlen,
u16 domain, void *addr, u32 addrlen,
u32 *out_sid); u32 *out_sid);
int security_validate_transition(struct selinux_state *state, int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 tclass); u16 tclass);
int security_validate_transition_user(struct selinux_state *state, int security_validate_transition_user(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 tclass); u16 tclass);
int security_bounded_transition(struct selinux_state *state, int security_bounded_transition(u32 oldsid, u32 newsid);
u32 oldsid, u32 newsid);
int security_sid_mls_copy(struct selinux_state *state, int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid);
u32 sid, u32 mls_sid, u32 *new_sid);
int security_net_peersid_resolve(struct selinux_state *state, int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
u32 nlbl_sid, u32 nlbl_type,
u32 xfrm_sid, u32 xfrm_sid,
u32 *peer_sid); u32 *peer_sid);
...@@ -382,8 +348,8 @@ int security_get_classes(struct selinux_policy *policy, ...@@ -382,8 +348,8 @@ int security_get_classes(struct selinux_policy *policy,
char ***classes, int *nclasses); char ***classes, int *nclasses);
int security_get_permissions(struct selinux_policy *policy, int security_get_permissions(struct selinux_policy *policy,
char *class, char ***perms, int *nperms); char *class, char ***perms, int *nperms);
int security_get_reject_unknown(struct selinux_state *state); int security_get_reject_unknown(void);
int security_get_allow_unknown(struct selinux_state *state); int security_get_allow_unknown(void);
#define SECURITY_FS_USE_XATTR 1 /* use xattr */ #define SECURITY_FS_USE_XATTR 1 /* use xattr */
#define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */ #define SECURITY_FS_USE_TRANS 2 /* use transition SIDs, e.g. devpts/tmpfs */
...@@ -394,10 +360,9 @@ int security_get_allow_unknown(struct selinux_state *state); ...@@ -394,10 +360,9 @@ int security_get_allow_unknown(struct selinux_state *state);
#define SECURITY_FS_USE_NATIVE 7 /* use native label support */ #define SECURITY_FS_USE_NATIVE 7 /* use native label support */
#define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */ #define SECURITY_FS_USE_MAX 7 /* Highest SECURITY_FS_USE_XXX */
int security_fs_use(struct selinux_state *state, struct super_block *sb); int security_fs_use(struct super_block *sb);
int security_genfs_sid(struct selinux_state *state, int security_genfs_sid(const char *fstype, const char *path, u16 sclass,
const char *fstype, const char *path, u16 sclass,
u32 *sid); u32 *sid);
int selinux_policy_genfs_sid(struct selinux_policy *policy, int selinux_policy_genfs_sid(struct selinux_policy *policy,
...@@ -405,23 +370,19 @@ int selinux_policy_genfs_sid(struct selinux_policy *policy, ...@@ -405,23 +370,19 @@ int selinux_policy_genfs_sid(struct selinux_policy *policy,
u32 *sid); u32 *sid);
#ifdef CONFIG_NETLABEL #ifdef CONFIG_NETLABEL
int security_netlbl_secattr_to_sid(struct selinux_state *state, int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
struct netlbl_lsm_secattr *secattr,
u32 *sid); u32 *sid);
int security_netlbl_sid_to_secattr(struct selinux_state *state, int security_netlbl_sid_to_secattr(u32 sid,
u32 sid,
struct netlbl_lsm_secattr *secattr); struct netlbl_lsm_secattr *secattr);
#else #else
static inline int security_netlbl_secattr_to_sid(struct selinux_state *state, static inline int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
struct netlbl_lsm_secattr *secattr,
u32 *sid) u32 *sid)
{ {
return -EIDRM; return -EIDRM;
} }
static inline int security_netlbl_sid_to_secattr(struct selinux_state *state, static inline int security_netlbl_sid_to_secattr(u32 sid,
u32 sid,
struct netlbl_lsm_secattr *secattr) struct netlbl_lsm_secattr *secattr)
{ {
return -ENOENT; return -ENOENT;
...@@ -433,7 +394,7 @@ const char *security_get_initial_sid_context(u32 sid); ...@@ -433,7 +394,7 @@ const char *security_get_initial_sid_context(u32 sid);
/* /*
* status notifier using mmap interface * status notifier using mmap interface
*/ */
extern struct page *selinux_kernel_status_page(struct selinux_state *state); extern struct page *selinux_kernel_status_page(void);
#define SELINUX_KERNEL_STATUS_VERSION 1 #define SELINUX_KERNEL_STATUS_VERSION 1
struct selinux_kernel_status { struct selinux_kernel_status {
...@@ -447,12 +408,10 @@ struct selinux_kernel_status { ...@@ -447,12 +408,10 @@ struct selinux_kernel_status {
*/ */
} __packed; } __packed;
extern void selinux_status_update_setenforce(struct selinux_state *state, extern void selinux_status_update_setenforce(int enforcing);
int enforcing); extern void selinux_status_update_policyload(int seqno);
extern void selinux_status_update_policyload(struct selinux_state *state,
int seqno);
extern void selinux_complete_init(void); extern void selinux_complete_init(void);
extern int selinux_disable(struct selinux_state *state); extern int selinux_disable(void);
extern void exit_sel_fs(void); extern void exit_sel_fs(void);
extern struct path selinux_null; extern struct path selinux_null;
extern void selnl_notify_setenforce(int val); extern void selnl_notify_setenforce(int val);
...@@ -462,6 +421,6 @@ extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm); ...@@ -462,6 +421,6 @@ extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
extern void avtab_cache_init(void); extern void avtab_cache_init(void);
extern void ebitmap_cache_init(void); extern void ebitmap_cache_init(void);
extern void hashtab_cache_init(void); extern void hashtab_cache_init(void);
extern int security_sidtab_hash_stats(struct selinux_state *state, char *page); extern int security_sidtab_hash_stats(char *page);
#endif /* _SELINUX_SECURITY_H_ */ #endif /* _SELINUX_SECURITY_H_ */
security/selinux/netif.c
View file @ e67b7985
...@@ -153,7 +153,7 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) ...@@ -153,7 +153,7 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
goto out; goto out;
} }
ret = security_netif_sid(&selinux_state, dev->name, sid); ret = security_netif_sid(dev->name, sid);
if (ret != 0) if (ret != 0)
goto out; goto out;
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);
......
security/selinux/netlabel.c
View file @ e67b7985
...@@ -46,7 +46,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb, ...@@ -46,7 +46,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
{ {
int rc; int rc;
rc = security_netlbl_secattr_to_sid(&selinux_state, secattr, sid); rc = security_netlbl_secattr_to_sid(secattr, sid);
if (rc == 0 && if (rc == 0 &&
(secattr->flags & NETLBL_SECATTR_CACHEABLE) && (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
(secattr->flags & NETLBL_SECATTR_CACHE)) (secattr->flags & NETLBL_SECATTR_CACHE))
...@@ -77,8 +77,7 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk) ...@@ -77,8 +77,7 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk)
secattr = netlbl_secattr_alloc(GFP_ATOMIC); secattr = netlbl_secattr_alloc(GFP_ATOMIC);
if (secattr == NULL) if (secattr == NULL)
return NULL; return NULL;
rc = security_netlbl_sid_to_secattr(&selinux_state, sksec->sid, rc = security_netlbl_sid_to_secattr(sksec->sid, secattr);
secattr);
if (rc != 0) { if (rc != 0) {
netlbl_secattr_free(secattr); netlbl_secattr_free(secattr);
return NULL; return NULL;
...@@ -245,8 +244,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, ...@@ -245,8 +244,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,
if (secattr == NULL) { if (secattr == NULL) {
secattr = &secattr_storage; secattr = &secattr_storage;
netlbl_secattr_init(secattr); netlbl_secattr_init(secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, sid, rc = security_netlbl_sid_to_secattr(sid, secattr);
secattr);
if (rc != 0) if (rc != 0)
goto skbuff_setsid_return; goto skbuff_setsid_return;
} }
...@@ -283,8 +281,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc, ...@@ -283,8 +281,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_association *asoc,
return 0; return 0;
netlbl_secattr_init(&secattr); netlbl_secattr_init(&secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, rc = security_netlbl_sid_to_secattr(asoc->secid, &secattr);
asoc->secid, &secattr);
if (rc != 0) if (rc != 0)
goto assoc_request_return; goto assoc_request_return;
...@@ -332,8 +329,7 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family) ...@@ -332,8 +329,7 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family)
return 0; return 0;
netlbl_secattr_init(&secattr); netlbl_secattr_init(&secattr);
rc = security_netlbl_sid_to_secattr(&selinux_state, req->secid, rc = security_netlbl_sid_to_secattr(req->secid, &secattr);
&secattr);
if (rc != 0) if (rc != 0)
goto inet_conn_request_return; goto inet_conn_request_return;
rc = netlbl_req_setattr(req, &secattr); rc = netlbl_req_setattr(req, &secattr);
...@@ -463,8 +459,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, ...@@ -463,8 +459,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
perm = RAWIP_SOCKET__RECVFROM; perm = RAWIP_SOCKET__RECVFROM;
} }
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
if (rc == 0) if (rc == 0)
return 0; return 0;
......
security/selinux/netnode.c
View file @ e67b7985
...@@ -204,13 +204,13 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid) ...@@ -204,13 +204,13 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);
switch (family) { switch (family) {
case PF_INET: case PF_INET:
ret = security_node_sid(&selinux_state, PF_INET, ret = security_node_sid(PF_INET,
addr, sizeof(struct in_addr), sid); addr, sizeof(struct in_addr), sid);
if (new) if (new)
new->nsec.addr.ipv4 = *(__be32 *)addr; new->nsec.addr.ipv4 = *(__be32 *)addr;
break; break;
case PF_INET6: case PF_INET6:
ret = security_node_sid(&selinux_state, PF_INET6, ret = security_node_sid(PF_INET6,
addr, sizeof(struct in6_addr), sid); addr, sizeof(struct in6_addr), sid);
if (new) if (new)
new->nsec.addr.ipv6 = *(struct in6_addr *)addr; new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
......
security/selinux/netport.c
View file @ e67b7985
...@@ -148,7 +148,7 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid) ...@@ -148,7 +148,7 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
return 0; return 0;
} }
ret = security_port_sid(&selinux_state, protocol, pnum, sid); ret = security_port_sid(protocol, pnum, sid);
if (ret != 0) if (ret != 0)
goto out; goto out;
new = kzalloc(sizeof(*new), GFP_ATOMIC); new = kzalloc(sizeof(*new), GFP_ATOMIC);
......
security/selinux/selinuxfs.c
View file @ e67b7985
...@@ -77,7 +77,6 @@ struct selinux_fs_info { ...@@ -77,7 +77,6 @@ struct selinux_fs_info {
bool policy_opened; bool policy_opened;
struct dentry *policycap_dir; struct dentry *policycap_dir;
unsigned long last_ino; unsigned long last_ino;
struct selinux_state *state;
struct super_block *sb; struct super_block *sb;
}; };
...@@ -90,7 +89,6 @@ static int selinux_fs_info_create(struct super_block *sb) ...@@ -90,7 +89,6 @@ static int selinux_fs_info_create(struct super_block *sb)
return -ENOMEM; return -ENOMEM;
fsi->last_ino = SEL_INO_NEXT - 1; fsi->last_ino = SEL_INO_NEXT - 1;
fsi->state = &selinux_state;
fsi->sb = sb; fsi->sb = sb;
sb->s_fs_info = fsi; sb->s_fs_info = fsi;
return 0; return 0;
...@@ -125,12 +123,11 @@ static void selinux_fs_info_free(struct super_block *sb) ...@@ -125,12 +123,11 @@ static void selinux_fs_info_free(struct super_block *sb)
static ssize_t sel_read_enforce(struct file *filp, char __user *buf, static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
enforcing_enabled(fsi->state)); enforcing_enabled());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
...@@ -139,8 +136,6 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, ...@@ -139,8 +136,6 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page = NULL; char *page = NULL;
ssize_t length; ssize_t length;
int old_value, new_value; int old_value, new_value;
...@@ -162,10 +157,9 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, ...@@ -162,10 +157,9 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
new_value = !!new_value; new_value = !!new_value;
old_value = enforcing_enabled(state); old_value = enforcing_enabled();
if (new_value != old_value) { if (new_value != old_value) {
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETENFORCE, SECCLASS_SECURITY, SECURITY__SETENFORCE,
NULL); NULL);
if (length) if (length)
...@@ -176,15 +170,15 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, ...@@ -176,15 +170,15 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
new_value, old_value, new_value, old_value,
from_kuid(&init_user_ns, audit_get_loginuid(current)), from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current)); audit_get_sessionid(current));
enforcing_set(state, new_value); enforcing_set(new_value);
if (new_value) if (new_value)
avc_ss_reset(state->avc, 0); avc_ss_reset(0);
selnl_notify_setenforce(new_value); selnl_notify_setenforce(new_value);
selinux_status_update_setenforce(state, new_value); selinux_status_update_setenforce(new_value);
if (!new_value) if (!new_value)
call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL); call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
selinux_ima_measure_state(state); selinux_ima_measure_state();
} }
length = count; length = count;
out: out:
...@@ -204,14 +198,12 @@ static const struct file_operations sel_enforce_ops = { ...@@ -204,14 +198,12 @@ static const struct file_operations sel_enforce_ops = {
static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf, static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
ino_t ino = file_inode(filp)->i_ino; ino_t ino = file_inode(filp)->i_ino;
int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ? int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
security_get_reject_unknown(state) : security_get_reject_unknown() :
!security_get_allow_unknown(state); !security_get_allow_unknown();
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
...@@ -224,8 +216,7 @@ static const struct file_operations sel_handle_unknown_ops = { ...@@ -224,8 +216,7 @@ static const struct file_operations sel_handle_unknown_ops = {
static int sel_open_handle_status(struct inode *inode, struct file *filp) static int sel_open_handle_status(struct inode *inode, struct file *filp)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; struct page *status = selinux_kernel_status_page();
struct page *status = selinux_kernel_status_page(fsi->state);
if (!status) if (!status)
return -ENOMEM; return -ENOMEM;
...@@ -281,7 +272,6 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf, ...@@ -281,7 +272,6 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *page; char *page;
ssize_t length; ssize_t length;
int new_value; int new_value;
...@@ -312,8 +302,8 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf, ...@@ -312,8 +302,8 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
goto out; goto out;
if (new_value) { if (new_value) {
enforcing = enforcing_enabled(fsi->state); enforcing = enforcing_enabled();
length = selinux_disable(fsi->state); length = selinux_disable();
if (length) if (length)
goto out; goto out;
audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
...@@ -375,12 +365,11 @@ static void sel_remove_entries(struct dentry *de); ...@@ -375,12 +365,11 @@ static void sel_remove_entries(struct dentry *de);
static ssize_t sel_read_mls(struct file *filp, char __user *buf, static ssize_t sel_read_mls(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
security_mls_enabled(fsi->state)); security_mls_enabled());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
...@@ -397,16 +386,14 @@ struct policy_load_memory { ...@@ -397,16 +386,14 @@ struct policy_load_memory {
static int sel_open_policy(struct inode *inode, struct file *filp) static int sel_open_policy(struct inode *inode, struct file *filp)
{ {
struct selinux_fs_info *fsi = inode->i_sb->s_fs_info; struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
struct policy_load_memory *plm = NULL; struct policy_load_memory *plm = NULL;
int rc; int rc;
BUG_ON(filp->private_data); BUG_ON(filp->private_data);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
if (rc) if (rc)
goto err; goto err;
...@@ -420,7 +407,7 @@ static int sel_open_policy(struct inode *inode, struct file *filp) ...@@ -420,7 +407,7 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
if (!plm) if (!plm)
goto err; goto err;
rc = security_read_policy(state, &plm->data, &plm->len); rc = security_read_policy(&plm->data, &plm->len);
if (rc) if (rc)
goto err; goto err;
...@@ -434,11 +421,11 @@ static int sel_open_policy(struct inode *inode, struct file *filp) ...@@ -434,11 +421,11 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
filp->private_data = plm; filp->private_data = plm;
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
return 0; return 0;
err: err:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
if (plm) if (plm)
vfree(plm->data); vfree(plm->data);
...@@ -467,8 +454,7 @@ static ssize_t sel_read_policy(struct file *filp, char __user *buf, ...@@ -467,8 +454,7 @@ static ssize_t sel_read_policy(struct file *filp, char __user *buf,
struct policy_load_memory *plm = filp->private_data; struct policy_load_memory *plm = filp->private_data;
int ret; int ret;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
if (ret) if (ret)
return ret; return ret;
...@@ -621,10 +607,9 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, ...@@ -621,10 +607,9 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
ssize_t length; ssize_t length;
void *data = NULL; void *data = NULL;
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL); SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
if (length) if (length)
goto out; goto out;
...@@ -643,7 +628,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, ...@@ -643,7 +628,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
if (copy_from_user(data, buf, count) != 0) if (copy_from_user(data, buf, count) != 0)
goto out; goto out;
length = security_load_policy(fsi->state, data, count, &load_state); length = security_load_policy(data, count, &load_state);
if (length) { if (length) {
pr_warn_ratelimited("SELinux: failed to load policy\n"); pr_warn_ratelimited("SELinux: failed to load policy\n");
goto out; goto out;
...@@ -652,11 +637,11 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, ...@@ -652,11 +637,11 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
length = sel_make_policy_nodes(fsi, load_state.policy); length = sel_make_policy_nodes(fsi, load_state.policy);
if (length) { if (length) {
pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n"); pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n");
selinux_policy_cancel(fsi->state, &load_state); selinux_policy_cancel(&load_state);
goto out; goto out;
} }
selinux_policy_commit(fsi->state, &load_state); selinux_policy_commit(&load_state);
length = count; length = count;
...@@ -665,7 +650,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, ...@@ -665,7 +650,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
from_kuid(&init_user_ns, audit_get_loginuid(current)), from_kuid(&init_user_ns, audit_get_loginuid(current)),
audit_get_sessionid(current)); audit_get_sessionid(current));
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
vfree(data); vfree(data);
return length; return length;
} }
...@@ -677,23 +662,20 @@ static const struct file_operations sel_load_ops = { ...@@ -677,23 +662,20 @@ static const struct file_operations sel_load_ops = {
static ssize_t sel_write_context(struct file *file, char *buf, size_t size) static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *canon = NULL; char *canon = NULL;
u32 sid, len; u32 sid, len;
ssize_t length; ssize_t length;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL); SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
if (length) if (length)
goto out; goto out;
length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL); length = security_context_to_sid(buf, size, &sid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, sid, &canon, &len); length = security_sid_to_context(sid, &canon, &len);
if (length) if (length)
goto out; goto out;
...@@ -714,25 +696,22 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size) ...@@ -714,25 +696,22 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf, static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%u", length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
checkreqprot_get(fsi->state)); checkreqprot_get());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *page; char *page;
ssize_t length; ssize_t length;
unsigned int new_value; unsigned int new_value;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT, SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
NULL); NULL);
if (length) if (length)
...@@ -761,12 +740,12 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, ...@@ -761,12 +740,12 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
comm, current->pid); comm, current->pid);
} }
checkreqprot_set(fsi->state, (new_value ? 1 : 0)); checkreqprot_set((new_value ? 1 : 0));
if (new_value) if (new_value)
ssleep(15); ssleep(15);
length = count; length = count;
selinux_ima_measure_state(fsi->state); selinux_ima_measure_state();
out: out:
kfree(page); kfree(page);
...@@ -782,16 +761,13 @@ static ssize_t sel_write_validatetrans(struct file *file, ...@@ -782,16 +761,13 @@ static ssize_t sel_write_validatetrans(struct file *file,
const char __user *buf, const char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *oldcon = NULL, *newcon = NULL, *taskcon = NULL; char *oldcon = NULL, *newcon = NULL, *taskcon = NULL;
char *req = NULL; char *req = NULL;
u32 osid, nsid, tsid; u32 osid, nsid, tsid;
u16 tclass; u16 tclass;
int rc; int rc;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL); SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
if (rc) if (rc)
goto out; goto out;
...@@ -829,19 +805,19 @@ static ssize_t sel_write_validatetrans(struct file *file, ...@@ -829,19 +805,19 @@ static ssize_t sel_write_validatetrans(struct file *file,
if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4) if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
goto out; goto out;
rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL); rc = security_context_str_to_sid(oldcon, &osid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL); rc = security_context_str_to_sid(newcon, &nsid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL); rc = security_context_str_to_sid(taskcon, &tsid, GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
rc = security_validate_transition_user(state, osid, nsid, tsid, tclass); rc = security_validate_transition_user(osid, nsid, tsid, tclass);
if (!rc) if (!rc)
rc = count; rc = count;
out: out:
...@@ -911,16 +887,13 @@ static const struct file_operations transaction_ops = { ...@@ -911,16 +887,13 @@ static const struct file_operations transaction_ops = {
static ssize_t sel_write_access(struct file *file, char *buf, size_t size) static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid; u32 ssid, tsid;
u16 tclass; u16 tclass;
struct av_decision avd; struct av_decision avd;
ssize_t length; ssize_t length;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL); SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
if (length) if (length)
goto out; goto out;
...@@ -939,15 +912,15 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size) ...@@ -939,15 +912,15 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
security_compute_av_user(state, ssid, tsid, tclass, &avd); security_compute_av_user(ssid, tsid, tclass, &avd);
length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
"%x %x %x %x %u %x", "%x %x %x %x %u %x",
...@@ -962,8 +935,6 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size) ...@@ -962,8 +935,6 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
static ssize_t sel_write_create(struct file *file, char *buf, size_t size) static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
char *namebuf = NULL, *objname = NULL; char *namebuf = NULL, *objname = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
...@@ -973,8 +944,7 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) ...@@ -973,8 +944,7 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
u32 len; u32 len;
int nargs; int nargs;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE, SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
NULL); NULL);
if (length) if (length)
...@@ -1030,20 +1000,20 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) ...@@ -1030,20 +1000,20 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
objname = namebuf; objname = namebuf;
} }
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_transition_sid_user(state, ssid, tsid, tclass, length = security_transition_sid_user(ssid, tsid, tclass,
objname, &newsid); objname, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
...@@ -1066,8 +1036,6 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) ...@@ -1066,8 +1036,6 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
u16 tclass; u16 tclass;
...@@ -1075,8 +1043,7 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) ...@@ -1075,8 +1043,7 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
char *newcon = NULL; char *newcon = NULL;
u32 len; u32 len;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL, SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
NULL); NULL);
if (length) if (length)
...@@ -1096,19 +1063,19 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) ...@@ -1096,19 +1063,19 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_change_sid(state, ssid, tsid, tclass, &newsid); length = security_change_sid(ssid, tsid, tclass, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
...@@ -1127,8 +1094,6 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) ...@@ -1127,8 +1094,6 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
static ssize_t sel_write_user(struct file *file, char *buf, size_t size) static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *con = NULL, *user = NULL, *ptr; char *con = NULL, *user = NULL, *ptr;
u32 sid, *sids = NULL; u32 sid, *sids = NULL;
ssize_t length; ssize_t length;
...@@ -1136,8 +1101,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) ...@@ -1136,8 +1101,7 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
int i, rc; int i, rc;
u32 len, nsids; u32 len, nsids;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_USER, SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
NULL); NULL);
if (length) if (length)
...@@ -1157,18 +1121,18 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) ...@@ -1157,18 +1121,18 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s", con, user) != 2) if (sscanf(buf, "%s %s", con, user) != 2)
goto out; goto out;
length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL); length = security_context_str_to_sid(con, &sid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_get_user_sids(state, sid, user, &sids, &nsids); length = security_get_user_sids(sid, user, &sids, &nsids);
if (length) if (length)
goto out; goto out;
length = sprintf(buf, "%u", nsids) + 1; length = sprintf(buf, "%u", nsids) + 1;
ptr = buf + length; ptr = buf + length;
for (i = 0; i < nsids; i++) { for (i = 0; i < nsids; i++) {
rc = security_sid_to_context(state, sids[i], &newcon, &len); rc = security_sid_to_context(sids[i], &newcon, &len);
if (rc) { if (rc) {
length = rc; length = rc;
goto out; goto out;
...@@ -1192,8 +1156,6 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) ...@@ -1192,8 +1156,6 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
static ssize_t sel_write_member(struct file *file, char *buf, size_t size) static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *scon = NULL, *tcon = NULL; char *scon = NULL, *tcon = NULL;
u32 ssid, tsid, newsid; u32 ssid, tsid, newsid;
u16 tclass; u16 tclass;
...@@ -1201,8 +1163,7 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size) ...@@ -1201,8 +1163,7 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
char *newcon = NULL; char *newcon = NULL;
u32 len; u32 len;
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER, SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
NULL); NULL);
if (length) if (length)
...@@ -1222,19 +1183,19 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size) ...@@ -1222,19 +1183,19 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
goto out; goto out;
length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL);
if (length) if (length)
goto out; goto out;
length = security_member_sid(state, ssid, tsid, tclass, &newsid); length = security_member_sid(ssid, tsid, tclass, &newsid);
if (length) if (length)
goto out; goto out;
length = security_sid_to_context(state, newsid, &newcon, &len); length = security_sid_to_context(newsid, &newcon, &len);
if (length) if (length)
goto out; goto out;
...@@ -1276,7 +1237,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, ...@@ -1276,7 +1237,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
const char *name = filep->f_path.dentry->d_name.name; const char *name = filep->f_path.dentry->d_name.name;
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
ret = -EINVAL; ret = -EINVAL;
if (index >= fsi->bool_num || strcmp(name, if (index >= fsi->bool_num || strcmp(name,
...@@ -1288,21 +1249,21 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, ...@@ -1288,21 +1249,21 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
if (!page) if (!page)
goto out_unlock; goto out_unlock;
cur_enforcing = security_get_bool_value(fsi->state, index); cur_enforcing = security_get_bool_value(index);
if (cur_enforcing < 0) { if (cur_enforcing < 0) {
ret = cur_enforcing; ret = cur_enforcing;
goto out_unlock; goto out_unlock;
} }
length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing, length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
fsi->bool_pending_values[index]); fsi->bool_pending_values[index]);
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
ret = simple_read_from_buffer(buf, count, ppos, page, length); ret = simple_read_from_buffer(buf, count, ppos, page, length);
out_free: out_free:
free_page((unsigned long)page); free_page((unsigned long)page);
return ret; return ret;
out_unlock: out_unlock:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
goto out_free; goto out_free;
} }
...@@ -1327,10 +1288,9 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf, ...@@ -1327,10 +1288,9 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
if (IS_ERR(page)) if (IS_ERR(page))
return PTR_ERR(page); return PTR_ERR(page);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL, SECCLASS_SECURITY, SECURITY__SETBOOL,
NULL); NULL);
if (length) if (length)
...@@ -1352,7 +1312,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf, ...@@ -1352,7 +1312,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
length = count; length = count;
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
kfree(page); kfree(page);
return length; return length;
} }
...@@ -1383,10 +1343,9 @@ static ssize_t sel_commit_bools_write(struct file *filep, ...@@ -1383,10 +1343,9 @@ static ssize_t sel_commit_bools_write(struct file *filep,
if (IS_ERR(page)) if (IS_ERR(page))
return PTR_ERR(page); return PTR_ERR(page);
mutex_lock(&fsi->state->policy_mutex); mutex_lock(&selinux_state.policy_mutex);
length = avc_has_perm(&selinux_state, length = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL, SECCLASS_SECURITY, SECURITY__SETBOOL,
NULL); NULL);
if (length) if (length)
...@@ -1398,14 +1357,14 @@ static ssize_t sel_commit_bools_write(struct file *filep, ...@@ -1398,14 +1357,14 @@ static ssize_t sel_commit_bools_write(struct file *filep,
length = 0; length = 0;
if (new_value && fsi->bool_pending_values) if (new_value && fsi->bool_pending_values)
length = security_set_bools(fsi->state, fsi->bool_num, length = security_set_bools(fsi->bool_num,
fsi->bool_pending_values); fsi->bool_pending_values);
if (!length) if (!length)
length = count; length = count;
out: out:
mutex_unlock(&fsi->state->policy_mutex); mutex_unlock(&selinux_state.policy_mutex);
kfree(page); kfree(page);
return length; return length;
} }
...@@ -1503,13 +1462,11 @@ static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_ ...@@ -1503,13 +1462,11 @@ static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_
static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf, static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
length = scnprintf(tmpbuf, TMPBUFLEN, "%u", length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
avc_get_cache_threshold(state->avc)); avc_get_cache_threshold());
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
} }
...@@ -1518,14 +1475,11 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file, ...@@ -1518,14 +1475,11 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t ret; ssize_t ret;
unsigned int new_value; unsigned int new_value;
ret = avc_has_perm(&selinux_state, ret = avc_has_perm(current_sid(), SECINITSID_SECURITY,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETSECPARAM, SECCLASS_SECURITY, SECURITY__SETSECPARAM,
NULL); NULL);
if (ret) if (ret)
...@@ -1546,7 +1500,7 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file, ...@@ -1546,7 +1500,7 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
if (sscanf(page, "%u", &new_value) != 1) if (sscanf(page, "%u", &new_value) != 1)
goto out; goto out;
avc_set_cache_threshold(state->avc, new_value); avc_set_cache_threshold(new_value);
ret = count; ret = count;
out: out:
...@@ -1557,8 +1511,6 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file, ...@@ -1557,8 +1511,6 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf, static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t length; ssize_t length;
...@@ -1566,7 +1518,7 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf, ...@@ -1566,7 +1518,7 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
if (!page) if (!page)
return -ENOMEM; return -ENOMEM;
length = avc_get_hash_stats(state->avc, page); length = avc_get_hash_stats(page);
if (length >= 0) if (length >= 0)
length = simple_read_from_buffer(buf, count, ppos, page, length); length = simple_read_from_buffer(buf, count, ppos, page, length);
free_page((unsigned long)page); free_page((unsigned long)page);
...@@ -1577,8 +1529,6 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf, ...@@ -1577,8 +1529,6 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf, static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
struct selinux_state *state = fsi->state;
char *page; char *page;
ssize_t length; ssize_t length;
...@@ -1586,7 +1536,7 @@ static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf, ...@@ -1586,7 +1536,7 @@ static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
if (!page) if (!page)
return -ENOMEM; return -ENOMEM;
length = security_sidtab_hash_stats(state, page); length = security_sidtab_hash_stats(page);
if (length >= 0) if (length >= 0)
length = simple_read_from_buffer(buf, count, ppos, page, length = simple_read_from_buffer(buf, count, ppos, page,
length); length);
...@@ -1752,13 +1702,12 @@ static int sel_make_ss_files(struct dentry *dir) ...@@ -1752,13 +1702,12 @@ static int sel_make_ss_files(struct dentry *dir)
static ssize_t sel_read_initcon(struct file *file, char __user *buf, static ssize_t sel_read_initcon(struct file *file, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
char *con; char *con;
u32 sid, len; u32 sid, len;
ssize_t ret; ssize_t ret;
sid = file_inode(file)->i_ino&SEL_INO_MASK; sid = file_inode(file)->i_ino&SEL_INO_MASK;
ret = security_sid_to_context(fsi->state, sid, &con, &len); ret = security_sid_to_context(sid, &con, &len);
if (ret) if (ret)
return ret; return ret;
...@@ -1852,13 +1801,12 @@ static const struct file_operations sel_perm_ops = { ...@@ -1852,13 +1801,12 @@ static const struct file_operations sel_perm_ops = {
static ssize_t sel_read_policycap(struct file *file, char __user *buf, static ssize_t sel_read_policycap(struct file *file, char __user *buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
{ {
struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
int value; int value;
char tmpbuf[TMPBUFLEN]; char tmpbuf[TMPBUFLEN];
ssize_t length; ssize_t length;
unsigned long i_ino = file_inode(file)->i_ino; unsigned long i_ino = file_inode(file)->i_ino;
value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK); value = security_policycap_supported(i_ino & SEL_INO_MASK);
length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
......
security/selinux/ss/services.c
View file @ e67b7985
...@@ -235,16 +235,16 @@ static void map_decision(struct selinux_map *map, ...@@ -235,16 +235,16 @@ static void map_decision(struct selinux_map *map,
} }
} }
int security_mls_enabled(struct selinux_state *state) int security_mls_enabled(void)
{ {
int mls_enabled; int mls_enabled;
struct selinux_policy *policy; struct selinux_policy *policy;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
mls_enabled = policy->policydb.mls_enabled; mls_enabled = policy->policydb.mls_enabled;
rcu_read_unlock(); rcu_read_unlock();
return mls_enabled; return mls_enabled;
...@@ -713,8 +713,7 @@ static void context_struct_compute_av(struct policydb *policydb, ...@@ -713,8 +713,7 @@ static void context_struct_compute_av(struct policydb *policydb,
tclass, avd); tclass, avd);
} }
static int security_validtrans_handle_fail(struct selinux_state *state, static int security_validtrans_handle_fail(struct selinux_policy *policy,
struct selinux_policy *policy,
struct sidtab_entry *oentry, struct sidtab_entry *oentry,
struct sidtab_entry *nentry, struct sidtab_entry *nentry,
struct sidtab_entry *tentry, struct sidtab_entry *tentry,
...@@ -740,13 +739,12 @@ static int security_validtrans_handle_fail(struct selinux_state *state, ...@@ -740,13 +739,12 @@ static int security_validtrans_handle_fail(struct selinux_state *state,
kfree(n); kfree(n);
kfree(t); kfree(t);
if (!enforcing_enabled(state)) if (!enforcing_enabled())
return 0; return 0;
return -EPERM; return -EPERM;
} }
static int security_compute_validatetrans(struct selinux_state *state, static int security_compute_validatetrans(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 orig_tclass, bool user) u16 orig_tclass, bool user)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
...@@ -761,12 +759,12 @@ static int security_compute_validatetrans(struct selinux_state *state, ...@@ -761,12 +759,12 @@ static int security_compute_validatetrans(struct selinux_state *state,
int rc = 0; int rc = 0;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -813,8 +811,7 @@ static int security_compute_validatetrans(struct selinux_state *state, ...@@ -813,8 +811,7 @@ static int security_compute_validatetrans(struct selinux_state *state,
if (user) if (user)
rc = -EPERM; rc = -EPERM;
else else
rc = security_validtrans_handle_fail(state, rc = security_validtrans_handle_fail(policy,
policy,
oentry, oentry,
nentry, nentry,
tentry, tentry,
...@@ -829,19 +826,17 @@ static int security_compute_validatetrans(struct selinux_state *state, ...@@ -829,19 +826,17 @@ static int security_compute_validatetrans(struct selinux_state *state,
return rc; return rc;
} }
int security_validate_transition_user(struct selinux_state *state, int security_validate_transition_user(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 tclass) u16 tclass)
{ {
return security_compute_validatetrans(state, oldsid, newsid, tasksid, return security_compute_validatetrans(oldsid, newsid, tasksid,
tclass, true); tclass, true);
} }
int security_validate_transition(struct selinux_state *state, int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
u32 oldsid, u32 newsid, u32 tasksid,
u16 orig_tclass) u16 orig_tclass)
{ {
return security_compute_validatetrans(state, oldsid, newsid, tasksid, return security_compute_validatetrans(oldsid, newsid, tasksid,
orig_tclass, false); orig_tclass, false);
} }
...@@ -851,12 +846,10 @@ int security_validate_transition(struct selinux_state *state, ...@@ -851,12 +846,10 @@ int security_validate_transition(struct selinux_state *state,
* It returns 0, if @newsid is bounded by @oldsid. * It returns 0, if @newsid is bounded by @oldsid.
* Otherwise, it returns error code. * Otherwise, it returns error code.
* *
* @state: SELinux state
* @oldsid : current security identifier * @oldsid : current security identifier
* @newsid : destinated security identifier * @newsid : destinated security identifier
*/ */
int security_bounded_transition(struct selinux_state *state, int security_bounded_transition(u32 old_sid, u32 new_sid)
u32 old_sid, u32 new_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -866,11 +859,11 @@ int security_bounded_transition(struct selinux_state *state, ...@@ -866,11 +859,11 @@ int security_bounded_transition(struct selinux_state *state,
int index; int index;
int rc; int rc;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -1004,8 +997,7 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, ...@@ -1004,8 +997,7 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
} }
} }
void security_compute_xperms_decision(struct selinux_state *state, void security_compute_xperms_decision(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 orig_tclass, u16 orig_tclass,
u8 driver, u8 driver,
...@@ -1029,10 +1021,10 @@ void security_compute_xperms_decision(struct selinux_state *state, ...@@ -1029,10 +1021,10 @@ void security_compute_xperms_decision(struct selinux_state *state,
memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p));
rcu_read_lock(); rcu_read_lock();
if (!selinux_initialized(state)) if (!selinux_initialized())
goto allow; goto allow;
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -1091,7 +1083,6 @@ void security_compute_xperms_decision(struct selinux_state *state, ...@@ -1091,7 +1083,6 @@ void security_compute_xperms_decision(struct selinux_state *state,
/** /**
* security_compute_av - Compute access vector decisions. * security_compute_av - Compute access vector decisions.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @orig_tclass: target security class * @orig_tclass: target security class
...@@ -1101,8 +1092,7 @@ void security_compute_xperms_decision(struct selinux_state *state, ...@@ -1101,8 +1092,7 @@ void security_compute_xperms_decision(struct selinux_state *state,
* Compute a set of access vector decisions based on the * Compute a set of access vector decisions based on the
* SID pair (@ssid, @tsid) for the permissions in @tclass. * SID pair (@ssid, @tsid) for the permissions in @tclass.
*/ */
void security_compute_av(struct selinux_state *state, void security_compute_av(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 orig_tclass, u16 orig_tclass,
struct av_decision *avd, struct av_decision *avd,
...@@ -1115,10 +1105,10 @@ void security_compute_av(struct selinux_state *state, ...@@ -1115,10 +1105,10 @@ void security_compute_av(struct selinux_state *state,
struct context *scontext = NULL, *tcontext = NULL; struct context *scontext = NULL, *tcontext = NULL;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
avd_init(policy, avd); avd_init(policy, avd);
xperms->len = 0; xperms->len = 0;
if (!selinux_initialized(state)) if (!selinux_initialized())
goto allow; goto allow;
policydb = &policy->policydb; policydb = &policy->policydb;
...@@ -1160,8 +1150,7 @@ void security_compute_av(struct selinux_state *state, ...@@ -1160,8 +1150,7 @@ void security_compute_av(struct selinux_state *state,
goto out; goto out;
} }
void security_compute_av_user(struct selinux_state *state, void security_compute_av_user(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 tclass, u16 tclass,
struct av_decision *avd) struct av_decision *avd)
...@@ -1172,9 +1161,9 @@ void security_compute_av_user(struct selinux_state *state, ...@@ -1172,9 +1161,9 @@ void security_compute_av_user(struct selinux_state *state,
struct context *scontext = NULL, *tcontext = NULL; struct context *scontext = NULL, *tcontext = NULL;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
avd_init(policy, avd); avd_init(policy, avd);
if (!selinux_initialized(state)) if (!selinux_initialized())
goto allow; goto allow;
policydb = &policy->policydb; policydb = &policy->policydb;
...@@ -1290,19 +1279,19 @@ static int sidtab_entry_to_string(struct policydb *p, ...@@ -1290,19 +1279,19 @@ static int sidtab_entry_to_string(struct policydb *p,
#include "initial_sid_to_string.h" #include "initial_sid_to_string.h"
int security_sidtab_hash_stats(struct selinux_state *state, char *page) int security_sidtab_hash_stats(char *page)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
int rc; int rc;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
pr_err("SELinux: %s: called before initial load_policy\n", pr_err("SELinux: %s: called before initial load_policy\n",
__func__); __func__);
return -EINVAL; return -EINVAL;
} }
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
rc = sidtab_hash_stats(policy->sidtab, page); rc = sidtab_hash_stats(policy->sidtab, page);
rcu_read_unlock(); rcu_read_unlock();
...@@ -1316,8 +1305,7 @@ const char *security_get_initial_sid_context(u32 sid) ...@@ -1316,8 +1305,7 @@ const char *security_get_initial_sid_context(u32 sid)
return initial_sid_to_string[sid]; return initial_sid_to_string[sid];
} }
static int security_sid_to_context_core(struct selinux_state *state, static int security_sid_to_context_core(u32 sid, char **scontext,
u32 sid, char **scontext,
u32 *scontext_len, int force, u32 *scontext_len, int force,
int only_invalid) int only_invalid)
{ {
...@@ -1331,7 +1319,7 @@ static int security_sid_to_context_core(struct selinux_state *state, ...@@ -1331,7 +1319,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
*scontext = NULL; *scontext = NULL;
*scontext_len = 0; *scontext_len = 0;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
if (sid <= SECINITSID_NUM) { if (sid <= SECINITSID_NUM) {
char *scontextp; char *scontextp;
const char *s = initial_sid_to_string[sid]; const char *s = initial_sid_to_string[sid];
...@@ -1352,7 +1340,7 @@ static int security_sid_to_context_core(struct selinux_state *state, ...@@ -1352,7 +1340,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
return -EINVAL; return -EINVAL;
} }
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -1380,7 +1368,6 @@ static int security_sid_to_context_core(struct selinux_state *state, ...@@ -1380,7 +1368,6 @@ static int security_sid_to_context_core(struct selinux_state *state,
/** /**
* security_sid_to_context - Obtain a context for a given SID. * security_sid_to_context - Obtain a context for a given SID.
* @state: SELinux state
* @sid: security identifier, SID * @sid: security identifier, SID
* @scontext: security context * @scontext: security context
* @scontext_len: length in bytes * @scontext_len: length in bytes
...@@ -1389,24 +1376,22 @@ static int security_sid_to_context_core(struct selinux_state *state, ...@@ -1389,24 +1376,22 @@ static int security_sid_to_context_core(struct selinux_state *state,
* into a dynamically allocated string of the correct size. Set @scontext * into a dynamically allocated string of the correct size. Set @scontext
* to point to this string and set @scontext_len to the length of the string. * to point to this string and set @scontext_len to the length of the string.
*/ */
int security_sid_to_context(struct selinux_state *state, int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)
u32 sid, char **scontext, u32 *scontext_len)
{ {
return security_sid_to_context_core(state, sid, scontext, return security_sid_to_context_core(sid, scontext,
scontext_len, 0, 0); scontext_len, 0, 0);
} }
int security_sid_to_context_force(struct selinux_state *state, u32 sid, int security_sid_to_context_force(u32 sid,
char **scontext, u32 *scontext_len) char **scontext, u32 *scontext_len)
{ {
return security_sid_to_context_core(state, sid, scontext, return security_sid_to_context_core(sid, scontext,
scontext_len, 1, 0); scontext_len, 1, 0);
} }
/** /**
* security_sid_to_context_inval - Obtain a context for a given SID if it * security_sid_to_context_inval - Obtain a context for a given SID if it
* is invalid. * is invalid.
* @state: SELinux state
* @sid: security identifier, SID * @sid: security identifier, SID
* @scontext: security context * @scontext: security context
* @scontext_len: length in bytes * @scontext_len: length in bytes
...@@ -1417,10 +1402,10 @@ int security_sid_to_context_force(struct selinux_state *state, u32 sid, ...@@ -1417,10 +1402,10 @@ int security_sid_to_context_force(struct selinux_state *state, u32 sid,
* this string (or NULL if the context is valid) and set @scontext_len to * this string (or NULL if the context is valid) and set @scontext_len to
* the length of the string (or 0 if the context is valid). * the length of the string (or 0 if the context is valid).
*/ */
int security_sid_to_context_inval(struct selinux_state *state, u32 sid, int security_sid_to_context_inval(u32 sid,
char **scontext, u32 *scontext_len) char **scontext, u32 *scontext_len)
{ {
return security_sid_to_context_core(state, sid, scontext, return security_sid_to_context_core(sid, scontext,
scontext_len, 1, 1); scontext_len, 1, 1);
} }
...@@ -1505,8 +1490,7 @@ static int string_to_context_struct(struct policydb *pol, ...@@ -1505,8 +1490,7 @@ static int string_to_context_struct(struct policydb *pol,
return rc; return rc;
} }
static int security_context_to_sid_core(struct selinux_state *state, static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *sid, u32 def_sid, gfp_t gfp_flags, u32 *sid, u32 def_sid, gfp_t gfp_flags,
int force) int force)
{ {
...@@ -1526,7 +1510,7 @@ static int security_context_to_sid_core(struct selinux_state *state, ...@@ -1526,7 +1510,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
if (!scontext2) if (!scontext2)
return -ENOMEM; return -ENOMEM;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
int i; int i;
for (i = 1; i < SECINITSID_NUM; i++) { for (i = 1; i < SECINITSID_NUM; i++) {
...@@ -1551,7 +1535,7 @@ static int security_context_to_sid_core(struct selinux_state *state, ...@@ -1551,7 +1535,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
} }
retry: retry:
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
rc = string_to_context_struct(policydb, sidtab, scontext2, rc = string_to_context_struct(policydb, sidtab, scontext2,
...@@ -1583,7 +1567,6 @@ static int security_context_to_sid_core(struct selinux_state *state, ...@@ -1583,7 +1567,6 @@ static int security_context_to_sid_core(struct selinux_state *state,
/** /**
* security_context_to_sid - Obtain a SID for a given security context. * security_context_to_sid - Obtain a SID for a given security context.
* @state: SELinux state
* @scontext: security context * @scontext: security context
* @scontext_len: length in bytes * @scontext_len: length in bytes
* @sid: security identifier, SID * @sid: security identifier, SID
...@@ -1594,18 +1577,16 @@ static int security_context_to_sid_core(struct selinux_state *state, ...@@ -1594,18 +1577,16 @@ static int security_context_to_sid_core(struct selinux_state *state,
* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
* memory is available, or 0 on success. * memory is available, or 0 on success.
*/ */
int security_context_to_sid(struct selinux_state *state, int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
const char *scontext, u32 scontext_len, u32 *sid,
gfp_t gfp) gfp_t gfp)
{ {
return security_context_to_sid_core(state, scontext, scontext_len, return security_context_to_sid_core(scontext, scontext_len,
sid, SECSID_NULL, gfp, 0); sid, SECSID_NULL, gfp, 0);
} }
int security_context_str_to_sid(struct selinux_state *state, int security_context_str_to_sid(const char *scontext, u32 *sid, gfp_t gfp)
const char *scontext, u32 *sid, gfp_t gfp)
{ {
return security_context_to_sid(state, scontext, strlen(scontext), return security_context_to_sid(scontext, strlen(scontext),
sid, gfp); sid, gfp);
} }
...@@ -1613,7 +1594,6 @@ int security_context_str_to_sid(struct selinux_state *state, ...@@ -1613,7 +1594,6 @@ int security_context_str_to_sid(struct selinux_state *state,
* security_context_to_sid_default - Obtain a SID for a given security context, * security_context_to_sid_default - Obtain a SID for a given security context,
* falling back to specified default if needed. * falling back to specified default if needed.
* *
* @state: SELinux state
* @scontext: security context * @scontext: security context
* @scontext_len: length in bytes * @scontext_len: length in bytes
* @sid: security identifier, SID * @sid: security identifier, SID
...@@ -1629,24 +1609,21 @@ int security_context_str_to_sid(struct selinux_state *state, ...@@ -1629,24 +1609,21 @@ int security_context_str_to_sid(struct selinux_state *state,
* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
* memory is available, or 0 on success. * memory is available, or 0 on success.
*/ */
int security_context_to_sid_default(struct selinux_state *state, int security_context_to_sid_default(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *sid, u32 def_sid, gfp_t gfp_flags) u32 *sid, u32 def_sid, gfp_t gfp_flags)
{ {
return security_context_to_sid_core(state, scontext, scontext_len, return security_context_to_sid_core(scontext, scontext_len,
sid, def_sid, gfp_flags, 1); sid, def_sid, gfp_flags, 1);
} }
int security_context_to_sid_force(struct selinux_state *state, int security_context_to_sid_force(const char *scontext, u32 scontext_len,
const char *scontext, u32 scontext_len,
u32 *sid) u32 *sid)
{ {
return security_context_to_sid_core(state, scontext, scontext_len, return security_context_to_sid_core(scontext, scontext_len,
sid, SECSID_NULL, GFP_KERNEL, 1); sid, SECSID_NULL, GFP_KERNEL, 1);
} }
static int compute_sid_handle_invalid_context( static int compute_sid_handle_invalid_context(
struct selinux_state *state,
struct selinux_policy *policy, struct selinux_policy *policy,
struct sidtab_entry *sentry, struct sidtab_entry *sentry,
struct sidtab_entry *tentry, struct sidtab_entry *tentry,
...@@ -1679,7 +1656,7 @@ static int compute_sid_handle_invalid_context( ...@@ -1679,7 +1656,7 @@ static int compute_sid_handle_invalid_context(
kfree(s); kfree(s);
kfree(t); kfree(t);
kfree(n); kfree(n);
if (!enforcing_enabled(state)) if (!enforcing_enabled())
return 0; return 0;
return -EACCES; return -EACCES;
} }
...@@ -1714,8 +1691,7 @@ static void filename_compute_type(struct policydb *policydb, ...@@ -1714,8 +1691,7 @@ static void filename_compute_type(struct policydb *policydb,
} }
} }
static int security_compute_sid(struct selinux_state *state, static int security_compute_sid(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 orig_tclass, u16 orig_tclass,
u32 specified, u32 specified,
...@@ -1736,7 +1712,7 @@ static int security_compute_sid(struct selinux_state *state, ...@@ -1736,7 +1712,7 @@ static int security_compute_sid(struct selinux_state *state,
int rc = 0; int rc = 0;
bool sock; bool sock;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
switch (orig_tclass) { switch (orig_tclass) {
case SECCLASS_PROCESS: /* kernel value */ case SECCLASS_PROCESS: /* kernel value */
*out_sid = ssid; *out_sid = ssid;
...@@ -1754,7 +1730,7 @@ static int security_compute_sid(struct selinux_state *state, ...@@ -1754,7 +1730,7 @@ static int security_compute_sid(struct selinux_state *state,
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
if (kern) { if (kern) {
tclass = unmap_class(&policy->map, orig_tclass); tclass = unmap_class(&policy->map, orig_tclass);
...@@ -1886,7 +1862,7 @@ static int security_compute_sid(struct selinux_state *state, ...@@ -1886,7 +1862,7 @@ static int security_compute_sid(struct selinux_state *state,
/* Check the validity of the context. */ /* Check the validity of the context. */
if (!policydb_context_isvalid(policydb, &newcontext)) { if (!policydb_context_isvalid(policydb, &newcontext)) {
rc = compute_sid_handle_invalid_context(state, policy, sentry, rc = compute_sid_handle_invalid_context(policy, sentry,
tentry, tclass, tentry, tclass,
&newcontext); &newcontext);
if (rc) if (rc)
...@@ -1908,7 +1884,6 @@ static int security_compute_sid(struct selinux_state *state, ...@@ -1908,7 +1884,6 @@ static int security_compute_sid(struct selinux_state *state,
/** /**
* security_transition_sid - Compute the SID for a new subject/object. * security_transition_sid - Compute the SID for a new subject/object.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -1921,27 +1896,24 @@ static int security_compute_sid(struct selinux_state *state, ...@@ -1921,27 +1896,24 @@ static int security_compute_sid(struct selinux_state *state,
* if insufficient memory is available, or %0 if the new SID was * if insufficient memory is available, or %0 if the new SID was
* computed successfully. * computed successfully.
*/ */
int security_transition_sid(struct selinux_state *state, int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const struct qstr *qstr, u32 *out_sid) const struct qstr *qstr, u32 *out_sid)
{ {
return security_compute_sid(state, ssid, tsid, tclass, return security_compute_sid(ssid, tsid, tclass,
AVTAB_TRANSITION, AVTAB_TRANSITION,
qstr ? qstr->name : NULL, out_sid, true); qstr ? qstr->name : NULL, out_sid, true);
} }
int security_transition_sid_user(struct selinux_state *state, int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
u32 ssid, u32 tsid, u16 tclass,
const char *objname, u32 *out_sid) const char *objname, u32 *out_sid)
{ {
return security_compute_sid(state, ssid, tsid, tclass, return security_compute_sid(ssid, tsid, tclass,
AVTAB_TRANSITION, AVTAB_TRANSITION,
objname, out_sid, false); objname, out_sid, false);
} }
/** /**
* security_member_sid - Compute the SID for member selection. * security_member_sid - Compute the SID for member selection.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -1953,20 +1925,18 @@ int security_transition_sid_user(struct selinux_state *state, ...@@ -1953,20 +1925,18 @@ int security_transition_sid_user(struct selinux_state *state,
* if insufficient memory is available, or %0 if the SID was * if insufficient memory is available, or %0 if the SID was
* computed successfully. * computed successfully.
*/ */
int security_member_sid(struct selinux_state *state, int security_member_sid(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 tclass, u16 tclass,
u32 *out_sid) u32 *out_sid)
{ {
return security_compute_sid(state, ssid, tsid, tclass, return security_compute_sid(ssid, tsid, tclass,
AVTAB_MEMBER, NULL, AVTAB_MEMBER, NULL,
out_sid, false); out_sid, false);
} }
/** /**
* security_change_sid - Compute the SID for object relabeling. * security_change_sid - Compute the SID for object relabeling.
* @state: SELinux state
* @ssid: source security identifier * @ssid: source security identifier
* @tsid: target security identifier * @tsid: target security identifier
* @tclass: target security class * @tclass: target security class
...@@ -1978,26 +1948,23 @@ int security_member_sid(struct selinux_state *state, ...@@ -1978,26 +1948,23 @@ int security_member_sid(struct selinux_state *state,
* if insufficient memory is available, or %0 if the SID was * if insufficient memory is available, or %0 if the SID was
* computed successfully. * computed successfully.
*/ */
int security_change_sid(struct selinux_state *state, int security_change_sid(u32 ssid,
u32 ssid,
u32 tsid, u32 tsid,
u16 tclass, u16 tclass,
u32 *out_sid) u32 *out_sid)
{ {
return security_compute_sid(state, return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
ssid, tsid, tclass, AVTAB_CHANGE, NULL,
out_sid, false); out_sid, false);
} }
static inline int convert_context_handle_invalid_context( static inline int convert_context_handle_invalid_context(
struct selinux_state *state,
struct policydb *policydb, struct policydb *policydb,
struct context *context) struct context *context)
{ {
char *s; char *s;
u32 len; u32 len;
if (enforcing_enabled(state)) if (enforcing_enabled())
return -EINVAL; return -EINVAL;
if (!context_struct_to_string(policydb, context, &s, &len)) { if (!context_struct_to_string(policydb, context, &s, &len)) {
...@@ -2115,8 +2082,7 @@ int services_convert_context(struct convert_context_args *args, ...@@ -2115,8 +2082,7 @@ int services_convert_context(struct convert_context_args *args,
/* Check the validity of the new context. */ /* Check the validity of the new context. */
if (!policydb_context_isvalid(args->newp, newc)) { if (!policydb_context_isvalid(args->newp, newc)) {
rc = convert_context_handle_invalid_context(args->state, rc = convert_context_handle_invalid_context(args->oldp, oldc);
args->oldp, oldc);
if (rc) if (rc)
goto bad; goto bad;
} }
...@@ -2135,8 +2101,7 @@ int services_convert_context(struct convert_context_args *args, ...@@ -2135,8 +2101,7 @@ int services_convert_context(struct convert_context_args *args,
return 0; return 0;
} }
static void security_load_policycaps(struct selinux_state *state, static void security_load_policycaps(struct selinux_policy *policy)
struct selinux_policy *policy)
{ {
struct policydb *p; struct policydb *p;
unsigned int i; unsigned int i;
...@@ -2144,8 +2109,8 @@ static void security_load_policycaps(struct selinux_state *state, ...@@ -2144,8 +2109,8 @@ static void security_load_policycaps(struct selinux_state *state,
p = &policy->policydb; p = &policy->policydb;
for (i = 0; i < ARRAY_SIZE(state->policycap); i++) for (i = 0; i < ARRAY_SIZE(selinux_state.policycap); i++)
WRITE_ONCE(state->policycap[i], WRITE_ONCE(selinux_state.policycap[i],
ebitmap_get_bit(&p->policycaps, i)); ebitmap_get_bit(&p->policycaps, i));
for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++)
...@@ -2181,9 +2146,9 @@ static void selinux_policy_cond_free(struct selinux_policy *policy) ...@@ -2181,9 +2146,9 @@ static void selinux_policy_cond_free(struct selinux_policy *policy)
kfree(policy); kfree(policy);
} }
void selinux_policy_cancel(struct selinux_state *state, void selinux_policy_cancel(struct selinux_load_state *load_state)
struct selinux_load_state *load_state)
{ {
struct selinux_state *state = &selinux_state;
struct selinux_policy *oldpolicy; struct selinux_policy *oldpolicy;
oldpolicy = rcu_dereference_protected(state->policy, oldpolicy = rcu_dereference_protected(state->policy,
...@@ -2194,21 +2159,20 @@ void selinux_policy_cancel(struct selinux_state *state, ...@@ -2194,21 +2159,20 @@ void selinux_policy_cancel(struct selinux_state *state,
kfree(load_state->convert_data); kfree(load_state->convert_data);
} }
static void selinux_notify_policy_change(struct selinux_state *state, static void selinux_notify_policy_change(u32 seqno)
u32 seqno)
{ {
/* Flush external caches and notify userspace of policy load */ /* Flush external caches and notify userspace of policy load */
avc_ss_reset(state->avc, seqno); avc_ss_reset(seqno);
selnl_notify_policyload(seqno); selnl_notify_policyload(seqno);
selinux_status_update_policyload(state, seqno); selinux_status_update_policyload(seqno);
selinux_netlbl_cache_invalidate(); selinux_netlbl_cache_invalidate();
selinux_xfrm_notify_policyload(); selinux_xfrm_notify_policyload();
selinux_ima_measure_state_locked(state); selinux_ima_measure_state_locked();
} }
void selinux_policy_commit(struct selinux_state *state, void selinux_policy_commit(struct selinux_load_state *load_state)
struct selinux_load_state *load_state)
{ {
struct selinux_state *state = &selinux_state;
struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; struct selinux_policy *oldpolicy, *newpolicy = load_state->policy;
unsigned long flags; unsigned long flags;
u32 seqno; u32 seqno;
...@@ -2241,15 +2205,15 @@ void selinux_policy_commit(struct selinux_state *state, ...@@ -2241,15 +2205,15 @@ void selinux_policy_commit(struct selinux_state *state,
} }
/* Load the policycaps from the new policy */ /* Load the policycaps from the new policy */
security_load_policycaps(state, newpolicy); security_load_policycaps(newpolicy);
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
/* /*
* After first policy load, the security server is * After first policy load, the security server is
* marked as initialized and ready to handle requests and * marked as initialized and ready to handle requests and
* any objects created prior to policy load are then labeled. * any objects created prior to policy load are then labeled.
*/ */
selinux_mark_initialized(state); selinux_mark_initialized();
selinux_complete_init(); selinux_complete_init();
} }
...@@ -2259,12 +2223,11 @@ void selinux_policy_commit(struct selinux_state *state, ...@@ -2259,12 +2223,11 @@ void selinux_policy_commit(struct selinux_state *state,
kfree(load_state->convert_data); kfree(load_state->convert_data);
/* Notify others of the policy change */ /* Notify others of the policy change */
selinux_notify_policy_change(state, seqno); selinux_notify_policy_change(seqno);
} }
/** /**
* security_load_policy - Load a security policy configuration. * security_load_policy - Load a security policy configuration.
* @state: SELinux state
* @data: binary policy data * @data: binary policy data
* @len: length of data in bytes * @len: length of data in bytes
* @load_state: policy load state * @load_state: policy load state
...@@ -2274,9 +2237,10 @@ void selinux_policy_commit(struct selinux_state *state, ...@@ -2274,9 +2237,10 @@ void selinux_policy_commit(struct selinux_state *state,
* This function will flush the access vector cache after * This function will flush the access vector cache after
* loading the new policy. * loading the new policy.
*/ */
int security_load_policy(struct selinux_state *state, void *data, size_t len, int security_load_policy(void *data, size_t len,
struct selinux_load_state *load_state) struct selinux_load_state *load_state)
{ {
struct selinux_state *state = &selinux_state;
struct selinux_policy *newpolicy, *oldpolicy; struct selinux_policy *newpolicy, *oldpolicy;
struct selinux_policy_convert_data *convert_data; struct selinux_policy_convert_data *convert_data;
int rc = 0; int rc = 0;
...@@ -2308,7 +2272,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, ...@@ -2308,7 +2272,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len,
goto err_mapping; goto err_mapping;
} }
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
/* First policy load, so no need to preserve state from old policy */ /* First policy load, so no need to preserve state from old policy */
load_state->policy = newpolicy; load_state->policy = newpolicy;
load_state->convert_data = NULL; load_state->convert_data = NULL;
...@@ -2336,7 +2300,6 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len, ...@@ -2336,7 +2300,6 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len,
goto err_free_isids; goto err_free_isids;
} }
convert_data->args.state = state;
convert_data->args.oldp = &oldpolicy->policydb; convert_data->args.oldp = &oldpolicy->policydb;
convert_data->args.newp = &newpolicy->policydb; convert_data->args.newp = &newpolicy->policydb;
...@@ -2410,13 +2373,11 @@ static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c, ...@@ -2410,13 +2373,11 @@ static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c,
/** /**
* security_port_sid - Obtain the SID for a port. * security_port_sid - Obtain the SID for a port.
* @state: SELinux state
* @protocol: protocol number * @protocol: protocol number
* @port: port number * @port: port number
* @out_sid: security identifier * @out_sid: security identifier
*/ */
int security_port_sid(struct selinux_state *state, int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
u8 protocol, u16 port, u32 *out_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -2424,7 +2385,7 @@ int security_port_sid(struct selinux_state *state, ...@@ -2424,7 +2385,7 @@ int security_port_sid(struct selinux_state *state,
struct ocontext *c; struct ocontext *c;
int rc; int rc;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*out_sid = SECINITSID_PORT; *out_sid = SECINITSID_PORT;
return 0; return 0;
} }
...@@ -2432,7 +2393,7 @@ int security_port_sid(struct selinux_state *state, ...@@ -2432,7 +2393,7 @@ int security_port_sid(struct selinux_state *state,
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2464,13 +2425,11 @@ int security_port_sid(struct selinux_state *state, ...@@ -2464,13 +2425,11 @@ int security_port_sid(struct selinux_state *state,
/** /**
* security_ib_pkey_sid - Obtain the SID for a pkey. * security_ib_pkey_sid - Obtain the SID for a pkey.
* @state: SELinux state
* @subnet_prefix: Subnet Prefix * @subnet_prefix: Subnet Prefix
* @pkey_num: pkey number * @pkey_num: pkey number
* @out_sid: security identifier * @out_sid: security identifier
*/ */
int security_ib_pkey_sid(struct selinux_state *state, int security_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -2478,7 +2437,7 @@ int security_ib_pkey_sid(struct selinux_state *state, ...@@ -2478,7 +2437,7 @@ int security_ib_pkey_sid(struct selinux_state *state,
struct ocontext *c; struct ocontext *c;
int rc; int rc;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*out_sid = SECINITSID_UNLABELED; *out_sid = SECINITSID_UNLABELED;
return 0; return 0;
} }
...@@ -2486,7 +2445,7 @@ int security_ib_pkey_sid(struct selinux_state *state, ...@@ -2486,7 +2445,7 @@ int security_ib_pkey_sid(struct selinux_state *state,
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2518,13 +2477,11 @@ int security_ib_pkey_sid(struct selinux_state *state, ...@@ -2518,13 +2477,11 @@ int security_ib_pkey_sid(struct selinux_state *state,
/** /**
* security_ib_endport_sid - Obtain the SID for a subnet management interface. * security_ib_endport_sid - Obtain the SID for a subnet management interface.
* @state: SELinux state
* @dev_name: device name * @dev_name: device name
* @port_num: port number * @port_num: port number
* @out_sid: security identifier * @out_sid: security identifier
*/ */
int security_ib_endport_sid(struct selinux_state *state, int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid)
const char *dev_name, u8 port_num, u32 *out_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -2532,7 +2489,7 @@ int security_ib_endport_sid(struct selinux_state *state, ...@@ -2532,7 +2489,7 @@ int security_ib_endport_sid(struct selinux_state *state,
struct ocontext *c; struct ocontext *c;
int rc; int rc;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*out_sid = SECINITSID_UNLABELED; *out_sid = SECINITSID_UNLABELED;
return 0; return 0;
} }
...@@ -2540,7 +2497,7 @@ int security_ib_endport_sid(struct selinux_state *state, ...@@ -2540,7 +2497,7 @@ int security_ib_endport_sid(struct selinux_state *state,
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2573,12 +2530,10 @@ int security_ib_endport_sid(struct selinux_state *state, ...@@ -2573,12 +2530,10 @@ int security_ib_endport_sid(struct selinux_state *state,
/** /**
* security_netif_sid - Obtain the SID for a network interface. * security_netif_sid - Obtain the SID for a network interface.
* @state: SELinux state
* @name: interface name * @name: interface name
* @if_sid: interface SID * @if_sid: interface SID
*/ */
int security_netif_sid(struct selinux_state *state, int security_netif_sid(char *name, u32 *if_sid)
char *name, u32 *if_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -2586,7 +2541,7 @@ int security_netif_sid(struct selinux_state *state, ...@@ -2586,7 +2541,7 @@ int security_netif_sid(struct selinux_state *state,
int rc; int rc;
struct ocontext *c; struct ocontext *c;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*if_sid = SECINITSID_NETIF; *if_sid = SECINITSID_NETIF;
return 0; return 0;
} }
...@@ -2594,7 +2549,7 @@ int security_netif_sid(struct selinux_state *state, ...@@ -2594,7 +2549,7 @@ int security_netif_sid(struct selinux_state *state,
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2636,14 +2591,12 @@ static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) ...@@ -2636,14 +2591,12 @@ static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)
/** /**
* security_node_sid - Obtain the SID for a node (host). * security_node_sid - Obtain the SID for a node (host).
* @state: SELinux state
* @domain: communication domain aka address family * @domain: communication domain aka address family
* @addrp: address * @addrp: address
* @addrlen: address length in bytes * @addrlen: address length in bytes
* @out_sid: security identifier * @out_sid: security identifier
*/ */
int security_node_sid(struct selinux_state *state, int security_node_sid(u16 domain,
u16 domain,
void *addrp, void *addrp,
u32 addrlen, u32 addrlen,
u32 *out_sid) u32 *out_sid)
...@@ -2654,14 +2607,14 @@ int security_node_sid(struct selinux_state *state, ...@@ -2654,14 +2607,14 @@ int security_node_sid(struct selinux_state *state,
int rc; int rc;
struct ocontext *c; struct ocontext *c;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*out_sid = SECINITSID_NODE; *out_sid = SECINITSID_NODE;
return 0; return 0;
} }
retry: retry:
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2725,7 +2678,6 @@ int security_node_sid(struct selinux_state *state, ...@@ -2725,7 +2678,6 @@ int security_node_sid(struct selinux_state *state,
/** /**
* security_get_user_sids - Obtain reachable SIDs for a user. * security_get_user_sids - Obtain reachable SIDs for a user.
* @state: SELinux state
* @fromsid: starting SID * @fromsid: starting SID
* @username: username * @username: username
* @sids: array of reachable SIDs for user * @sids: array of reachable SIDs for user
...@@ -2738,8 +2690,7 @@ int security_node_sid(struct selinux_state *state, ...@@ -2738,8 +2690,7 @@ int security_node_sid(struct selinux_state *state,
* number of elements in the array. * number of elements in the array.
*/ */
int security_get_user_sids(struct selinux_state *state, int security_get_user_sids(u32 fromsid,
u32 fromsid,
char *username, char *username,
u32 **sids, u32 **sids,
u32 *nel) u32 *nel)
...@@ -2758,7 +2709,7 @@ int security_get_user_sids(struct selinux_state *state, ...@@ -2758,7 +2709,7 @@ int security_get_user_sids(struct selinux_state *state,
*sids = NULL; *sids = NULL;
*nel = 0; *nel = 0;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
mysids = kcalloc(maxnel, sizeof(*mysids), GFP_KERNEL); mysids = kcalloc(maxnel, sizeof(*mysids), GFP_KERNEL);
...@@ -2768,7 +2719,7 @@ int security_get_user_sids(struct selinux_state *state, ...@@ -2768,7 +2719,7 @@ int security_get_user_sids(struct selinux_state *state,
retry: retry:
mynel = 0; mynel = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -2834,8 +2785,7 @@ int security_get_user_sids(struct selinux_state *state, ...@@ -2834,8 +2785,7 @@ int security_get_user_sids(struct selinux_state *state,
} }
for (i = 0, j = 0; i < mynel; i++) { for (i = 0, j = 0; i < mynel; i++) {
struct av_decision dummy_avd; struct av_decision dummy_avd;
rc = avc_has_perm_noaudit(state, rc = avc_has_perm_noaudit(fromsid, mysids[i],
fromsid, mysids[i],
SECCLASS_PROCESS, /* kernel value */ SECCLASS_PROCESS, /* kernel value */
PROCESS__TRANSITION, AVC_STRICT, PROCESS__TRANSITION, AVC_STRICT,
&dummy_avd); &dummy_avd);
...@@ -2908,7 +2858,6 @@ static inline int __security_genfs_sid(struct selinux_policy *policy, ...@@ -2908,7 +2858,6 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
/** /**
* security_genfs_sid - Obtain a SID for a file in a filesystem * security_genfs_sid - Obtain a SID for a file in a filesystem
* @state: SELinux state
* @fstype: filesystem type * @fstype: filesystem type
* @path: path from root of mount * @path: path from root of mount
* @orig_sclass: file security class * @orig_sclass: file security class
...@@ -2917,8 +2866,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy, ...@@ -2917,8 +2866,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
* Acquire policy_rwlock before calling __security_genfs_sid() and release * Acquire policy_rwlock before calling __security_genfs_sid() and release
* it afterward. * it afterward.
*/ */
int security_genfs_sid(struct selinux_state *state, int security_genfs_sid(const char *fstype,
const char *fstype,
const char *path, const char *path,
u16 orig_sclass, u16 orig_sclass,
u32 *sid) u32 *sid)
...@@ -2926,14 +2874,14 @@ int security_genfs_sid(struct selinux_state *state, ...@@ -2926,14 +2874,14 @@ int security_genfs_sid(struct selinux_state *state,
struct selinux_policy *policy; struct selinux_policy *policy;
int retval; int retval;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*sid = SECINITSID_UNLABELED; *sid = SECINITSID_UNLABELED;
return 0; return 0;
} }
do { do {
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
retval = __security_genfs_sid(policy, fstype, path, retval = __security_genfs_sid(policy, fstype, path,
orig_sclass, sid); orig_sclass, sid);
rcu_read_unlock(); rcu_read_unlock();
...@@ -2953,10 +2901,9 @@ int selinux_policy_genfs_sid(struct selinux_policy *policy, ...@@ -2953,10 +2901,9 @@ int selinux_policy_genfs_sid(struct selinux_policy *policy,
/** /**
* security_fs_use - Determine how to handle labeling for a filesystem. * security_fs_use - Determine how to handle labeling for a filesystem.
* @state: SELinux state
* @sb: superblock in question * @sb: superblock in question
*/ */
int security_fs_use(struct selinux_state *state, struct super_block *sb) int security_fs_use(struct super_block *sb)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -2966,7 +2913,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb) ...@@ -2966,7 +2913,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
struct superblock_security_struct *sbsec = selinux_superblock(sb); struct superblock_security_struct *sbsec = selinux_superblock(sb);
const char *fstype = sb->s_type->name; const char *fstype = sb->s_type->name;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
sbsec->behavior = SECURITY_FS_USE_NONE; sbsec->behavior = SECURITY_FS_USE_NONE;
sbsec->sid = SECINITSID_UNLABELED; sbsec->sid = SECINITSID_UNLABELED;
return 0; return 0;
...@@ -2974,7 +2921,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb) ...@@ -2974,7 +2921,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
retry: retry:
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -3067,13 +3014,14 @@ int security_get_bools(struct selinux_policy *policy, ...@@ -3067,13 +3014,14 @@ int security_get_bools(struct selinux_policy *policy,
} }
int security_set_bools(struct selinux_state *state, u32 len, int *values) int security_set_bools(u32 len, int *values)
{ {
struct selinux_state *state = &selinux_state;
struct selinux_policy *newpolicy, *oldpolicy; struct selinux_policy *newpolicy, *oldpolicy;
int rc; int rc;
u32 i, seqno = 0; u32 i, seqno = 0;
if (!selinux_initialized(state)) if (!selinux_initialized())
return -EINVAL; return -EINVAL;
oldpolicy = rcu_dereference_protected(state->policy, oldpolicy = rcu_dereference_protected(state->policy,
...@@ -3134,23 +3082,22 @@ int security_set_bools(struct selinux_state *state, u32 len, int *values) ...@@ -3134,23 +3082,22 @@ int security_set_bools(struct selinux_state *state, u32 len, int *values)
selinux_policy_cond_free(oldpolicy); selinux_policy_cond_free(oldpolicy);
/* Notify others of the policy change */ /* Notify others of the policy change */
selinux_notify_policy_change(state, seqno); selinux_notify_policy_change(seqno);
return 0; return 0;
} }
int security_get_bool_value(struct selinux_state *state, int security_get_bool_value(u32 index)
u32 index)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
int rc; int rc;
u32 len; u32 len;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
rc = -EFAULT; rc = -EFAULT;
...@@ -3197,8 +3144,7 @@ static int security_preserve_bools(struct selinux_policy *oldpolicy, ...@@ -3197,8 +3144,7 @@ static int security_preserve_bools(struct selinux_policy *oldpolicy,
* security_sid_mls_copy() - computes a new sid based on the given * security_sid_mls_copy() - computes a new sid based on the given
* sid and the mls portion of mls_sid. * sid and the mls portion of mls_sid.
*/ */
int security_sid_mls_copy(struct selinux_state *state, int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
u32 sid, u32 mls_sid, u32 *new_sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
...@@ -3210,7 +3156,7 @@ int security_sid_mls_copy(struct selinux_state *state, ...@@ -3210,7 +3156,7 @@ int security_sid_mls_copy(struct selinux_state *state,
u32 len; u32 len;
int rc; int rc;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*new_sid = sid; *new_sid = sid;
return 0; return 0;
} }
...@@ -3220,7 +3166,7 @@ int security_sid_mls_copy(struct selinux_state *state, ...@@ -3220,7 +3166,7 @@ int security_sid_mls_copy(struct selinux_state *state,
context_init(&newcon); context_init(&newcon);
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -3254,7 +3200,7 @@ int security_sid_mls_copy(struct selinux_state *state, ...@@ -3254,7 +3200,7 @@ int security_sid_mls_copy(struct selinux_state *state,
/* Check the validity of the new context. */ /* Check the validity of the new context. */
if (!policydb_context_isvalid(policydb, &newcon)) { if (!policydb_context_isvalid(policydb, &newcon)) {
rc = convert_context_handle_invalid_context(state, policydb, rc = convert_context_handle_invalid_context(policydb,
&newcon); &newcon);
if (rc) { if (rc) {
if (!context_struct_to_string(policydb, &newcon, &s, if (!context_struct_to_string(policydb, &newcon, &s,
...@@ -3288,7 +3234,6 @@ int security_sid_mls_copy(struct selinux_state *state, ...@@ -3288,7 +3234,6 @@ int security_sid_mls_copy(struct selinux_state *state,
/** /**
* security_net_peersid_resolve - Compare and resolve two network peer SIDs * security_net_peersid_resolve - Compare and resolve two network peer SIDs
* @state: SELinux state
* @nlbl_sid: NetLabel SID * @nlbl_sid: NetLabel SID
* @nlbl_type: NetLabel labeling protocol type * @nlbl_type: NetLabel labeling protocol type
* @xfrm_sid: XFRM SID * @xfrm_sid: XFRM SID
...@@ -3308,8 +3253,7 @@ int security_sid_mls_copy(struct selinux_state *state, ...@@ -3308,8 +3253,7 @@ int security_sid_mls_copy(struct selinux_state *state,
* multiple, inconsistent labels | -<errno> | SECSID_NULL * multiple, inconsistent labels | -<errno> | SECSID_NULL
* *
*/ */
int security_net_peersid_resolve(struct selinux_state *state, int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
u32 nlbl_sid, u32 nlbl_type,
u32 xfrm_sid, u32 xfrm_sid,
u32 *peer_sid) u32 *peer_sid)
{ {
...@@ -3337,11 +3281,11 @@ int security_net_peersid_resolve(struct selinux_state *state, ...@@ -3337,11 +3281,11 @@ int security_net_peersid_resolve(struct selinux_state *state,
return 0; return 0;
} }
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -3482,31 +3426,31 @@ int security_get_permissions(struct selinux_policy *policy, ...@@ -3482,31 +3426,31 @@ int security_get_permissions(struct selinux_policy *policy,
return rc; return rc;
} }
int security_get_reject_unknown(struct selinux_state *state) int security_get_reject_unknown(void)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
int value; int value;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
value = policy->policydb.reject_unknown; value = policy->policydb.reject_unknown;
rcu_read_unlock(); rcu_read_unlock();
return value; return value;
} }
int security_get_allow_unknown(struct selinux_state *state) int security_get_allow_unknown(void)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
int value; int value;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
value = policy->policydb.allow_unknown; value = policy->policydb.allow_unknown;
rcu_read_unlock(); rcu_read_unlock();
return value; return value;
...@@ -3514,7 +3458,6 @@ int security_get_allow_unknown(struct selinux_state *state) ...@@ -3514,7 +3458,6 @@ int security_get_allow_unknown(struct selinux_state *state)
/** /**
* security_policycap_supported - Check for a specific policy capability * security_policycap_supported - Check for a specific policy capability
* @state: SELinux state
* @req_cap: capability * @req_cap: capability
* *
* Description: * Description:
...@@ -3523,17 +3466,16 @@ int security_get_allow_unknown(struct selinux_state *state) ...@@ -3523,17 +3466,16 @@ int security_get_allow_unknown(struct selinux_state *state)
* supported, false (0) if it isn't supported. * supported, false (0) if it isn't supported.
* *
*/ */
int security_policycap_supported(struct selinux_state *state, int security_policycap_supported(unsigned int req_cap)
unsigned int req_cap)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
int rc; int rc;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap);
rcu_read_unlock(); rcu_read_unlock();
...@@ -3569,7 +3511,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) ...@@ -3569,7 +3511,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
*rule = NULL; *rule = NULL;
if (!selinux_initialized(state)) if (!selinux_initialized())
return -EOPNOTSUPP; return -EOPNOTSUPP;
switch (field) { switch (field) {
...@@ -3696,7 +3638,7 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule) ...@@ -3696,7 +3638,7 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
return -ENOENT; return -ENOENT;
} }
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
...@@ -3849,7 +3791,6 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, ...@@ -3849,7 +3791,6 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
/** /**
* security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
* @state: SELinux state
* @secattr: the NetLabel packet security attributes * @secattr: the NetLabel packet security attributes
* @sid: the SELinux SID * @sid: the SELinux SID
* *
...@@ -3863,8 +3804,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, ...@@ -3863,8 +3804,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
* failure. * failure.
* *
*/ */
int security_netlbl_secattr_to_sid(struct selinux_state *state, int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
struct netlbl_lsm_secattr *secattr,
u32 *sid) u32 *sid)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
...@@ -3874,7 +3814,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state, ...@@ -3874,7 +3814,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
struct context *ctx; struct context *ctx;
struct context ctx_new; struct context ctx_new;
if (!selinux_initialized(state)) { if (!selinux_initialized()) {
*sid = SECSID_NULL; *sid = SECSID_NULL;
return 0; return 0;
} }
...@@ -3882,7 +3822,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state, ...@@ -3882,7 +3822,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
retry: retry:
rc = 0; rc = 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
sidtab = policy->sidtab; sidtab = policy->sidtab;
...@@ -3932,7 +3872,6 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state, ...@@ -3932,7 +3872,6 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
/** /**
* security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
* @state: SELinux state
* @sid: the SELinux SID * @sid: the SELinux SID
* @secattr: the NetLabel packet security attributes * @secattr: the NetLabel packet security attributes
* *
...@@ -3941,19 +3880,18 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state, ...@@ -3941,19 +3880,18 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
* Returns zero on success, negative values on failure. * Returns zero on success, negative values on failure.
* *
*/ */
int security_netlbl_sid_to_secattr(struct selinux_state *state, int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
u32 sid, struct netlbl_lsm_secattr *secattr)
{ {
struct selinux_policy *policy; struct selinux_policy *policy;
struct policydb *policydb; struct policydb *policydb;
int rc; int rc;
struct context *ctx; struct context *ctx;
if (!selinux_initialized(state)) if (!selinux_initialized())
return 0; return 0;
rcu_read_lock(); rcu_read_lock();
policy = rcu_dereference(state->policy); policy = rcu_dereference(selinux_state.policy);
policydb = &policy->policydb; policydb = &policy->policydb;
rc = -ENOENT; rc = -ENOENT;
...@@ -4003,14 +3941,13 @@ static int __security_read_policy(struct selinux_policy *policy, ...@@ -4003,14 +3941,13 @@ static int __security_read_policy(struct selinux_policy *policy,
/** /**
* security_read_policy - read the policy. * security_read_policy - read the policy.
* @state: selinux_state
* @data: binary policy data * @data: binary policy data
* @len: length of data in bytes * @len: length of data in bytes
* *
*/ */
int security_read_policy(struct selinux_state *state, int security_read_policy(void **data, size_t *len)
void **data, size_t *len)
{ {
struct selinux_state *state = &selinux_state;
struct selinux_policy *policy; struct selinux_policy *policy;
policy = rcu_dereference_protected( policy = rcu_dereference_protected(
...@@ -4028,7 +3965,6 @@ int security_read_policy(struct selinux_state *state, ...@@ -4028,7 +3965,6 @@ int security_read_policy(struct selinux_state *state,
/** /**
* security_read_state_kernel - read the policy. * security_read_state_kernel - read the policy.
* @state: selinux_state
* @data: binary policy data * @data: binary policy data
* @len: length of data in bytes * @len: length of data in bytes
* *
...@@ -4038,10 +3974,10 @@ int security_read_policy(struct selinux_state *state, ...@@ -4038,10 +3974,10 @@ int security_read_policy(struct selinux_state *state,
* *
* This function must be called with policy_mutex held. * This function must be called with policy_mutex held.
*/ */
int security_read_state_kernel(struct selinux_state *state, int security_read_state_kernel(void **data, size_t *len)
void **data, size_t *len)
{ {
int err; int err;
struct selinux_state *state = &selinux_state;
struct selinux_policy *policy; struct selinux_policy *policy;
policy = rcu_dereference_protected( policy = rcu_dereference_protected(
......
security/selinux/ss/services.h
View file @ e67b7985
...@@ -30,7 +30,6 @@ struct selinux_policy { ...@@ -30,7 +30,6 @@ struct selinux_policy {
} __randomize_layout; } __randomize_layout;
struct convert_context_args { struct convert_context_args {
struct selinux_state *state;
struct policydb *oldp; struct policydb *oldp;
struct policydb *newp; struct policydb *newp;
}; };
......
security/selinux/status.c
View file @ e67b7985
...@@ -39,21 +39,21 @@ ...@@ -39,21 +39,21 @@
* It returns a reference to selinux_status_page. If the status page is * It returns a reference to selinux_status_page. If the status page is
* not allocated yet, it also tries to allocate it at the first time. * not allocated yet, it also tries to allocate it at the first time.
*/ */
struct page *selinux_kernel_status_page(struct selinux_state *state) struct page *selinux_kernel_status_page(void)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
struct page *result = NULL; struct page *result = NULL;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (!state->status_page) { if (!selinux_state.status_page) {
state->status_page = alloc_page(GFP_KERNEL|__GFP_ZERO); selinux_state.status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->version = SELINUX_KERNEL_STATUS_VERSION; status->version = SELINUX_KERNEL_STATUS_VERSION;
status->sequence = 0; status->sequence = 0;
status->enforcing = enforcing_enabled(state); status->enforcing = enforcing_enabled();
/* /*
* NOTE: the next policyload event shall set * NOTE: the next policyload event shall set
* a positive value on the status->policyload, * a positive value on the status->policyload,
...@@ -62,11 +62,11 @@ struct page *selinux_kernel_status_page(struct selinux_state *state) ...@@ -62,11 +62,11 @@ struct page *selinux_kernel_status_page(struct selinux_state *state)
*/ */
status->policyload = 0; status->policyload = 0;
status->deny_unknown = status->deny_unknown =
!security_get_allow_unknown(state); !security_get_allow_unknown();
} }
} }
result = state->status_page; result = selinux_state.status_page;
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
return result; return result;
} }
...@@ -76,14 +76,13 @@ struct page *selinux_kernel_status_page(struct selinux_state *state) ...@@ -76,14 +76,13 @@ struct page *selinux_kernel_status_page(struct selinux_state *state)
* *
* It updates status of the current enforcing/permissive mode. * It updates status of the current enforcing/permissive mode.
*/ */
void selinux_status_update_setenforce(struct selinux_state *state, void selinux_status_update_setenforce(int enforcing)
int enforcing)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->sequence++; status->sequence++;
smp_wmb(); smp_wmb();
...@@ -93,7 +92,7 @@ void selinux_status_update_setenforce(struct selinux_state *state, ...@@ -93,7 +92,7 @@ void selinux_status_update_setenforce(struct selinux_state *state,
smp_wmb(); smp_wmb();
status->sequence++; status->sequence++;
} }
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
} }
/* /*
...@@ -102,23 +101,22 @@ void selinux_status_update_setenforce(struct selinux_state *state, ...@@ -102,23 +101,22 @@ void selinux_status_update_setenforce(struct selinux_state *state,
* It updates status of the times of policy reloaded, and current * It updates status of the times of policy reloaded, and current
* setting of deny_unknown. * setting of deny_unknown.
*/ */
void selinux_status_update_policyload(struct selinux_state *state, void selinux_status_update_policyload(int seqno)
int seqno)
{ {
struct selinux_kernel_status *status; struct selinux_kernel_status *status;
mutex_lock(&state->status_lock); mutex_lock(&selinux_state.status_lock);
if (state->status_page) { if (selinux_state.status_page) {
status = page_address(state->status_page); status = page_address(selinux_state.status_page);
status->sequence++; status->sequence++;
smp_wmb(); smp_wmb();
status->policyload = seqno; status->policyload = seqno;
status->deny_unknown = !security_get_allow_unknown(state); status->deny_unknown = !security_get_allow_unknown();
smp_wmb(); smp_wmb();
status->sequence++; status->sequence++;
} }
mutex_unlock(&state->status_lock); mutex_unlock(&selinux_state.status_lock);
} }
security/selinux/xfrm.c
View file @ e67b7985
...@@ -98,13 +98,12 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, ...@@ -98,13 +98,12 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp,
ctx->ctx_len = str_len; ctx->ctx_len = str_len;
memcpy(ctx->ctx_str, &uctx[1], str_len); memcpy(ctx->ctx_str, &uctx[1], str_len);
ctx->ctx_str[str_len] = '\0'; ctx->ctx_str[str_len] = '\0';
rc = security_context_to_sid(&selinux_state, ctx->ctx_str, str_len, rc = security_context_to_sid(ctx->ctx_str, str_len,
&ctx->ctx_sid, gfp); &ctx->ctx_sid, gfp);
if (rc) if (rc)
goto err; goto err;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
tsec->sid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL); SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, NULL);
if (rc) if (rc)
goto err; goto err;
...@@ -140,8 +139,7 @@ static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx) ...@@ -140,8 +139,7 @@ static int selinux_xfrm_delete(struct xfrm_sec_ctx *ctx)
if (!ctx) if (!ctx)
return 0; return 0;
return avc_has_perm(&selinux_state, return avc_has_perm(tsec->sid, ctx->ctx_sid,
tsec->sid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT, SECCLASS_ASSOCIATION, ASSOCIATION__SETCONTEXT,
NULL); NULL);
} }
...@@ -163,8 +161,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid) ...@@ -163,8 +161,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
if (!selinux_authorizable_ctx(ctx)) if (!selinux_authorizable_ctx(ctx))
return -EINVAL; return -EINVAL;
rc = avc_has_perm(&selinux_state, rc = avc_has_perm(fl_secid, ctx->ctx_sid,
fl_secid, ctx->ctx_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL); SECCLASS_ASSOCIATION, ASSOCIATION__POLMATCH, NULL);
return (rc == -EACCES ? -ESRCH : rc); return (rc == -EACCES ? -ESRCH : rc);
} }
...@@ -205,7 +202,7 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, ...@@ -205,7 +202,7 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
/* We don't need a separate SA Vs. policy polmatch check since the SA /* We don't need a separate SA Vs. policy polmatch check since the SA
* is now of the same label as the flow and a flow Vs. policy polmatch * is now of the same label as the flow and a flow Vs. policy polmatch
* check had already happened in selinux_xfrm_policy_lookup() above. */ * check had already happened in selinux_xfrm_policy_lookup() above. */
return (avc_has_perm(&selinux_state, flic_sid, state_sid, return (avc_has_perm(flic_sid, state_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO,
NULL) ? 0 : 1); NULL) ? 0 : 1);
} }
...@@ -355,7 +352,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, ...@@ -355,7 +352,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
if (secid == 0) if (secid == 0)
return -EINVAL; return -EINVAL;
rc = security_sid_to_context(&selinux_state, secid, &ctx_str, rc = security_sid_to_context(secid, &ctx_str,
&str_len); &str_len);
if (rc) if (rc)
return rc; return rc;
...@@ -424,8 +421,7 @@ int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb, ...@@ -424,8 +421,7 @@ int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
/* This check even when there's no association involved is intended, /* This check even when there's no association involved is intended,
* according to Trent Jaeger, to make sure a process can't engage in * according to Trent Jaeger, to make sure a process can't engage in
* non-IPsec communication unless explicitly allowed by policy. */ * non-IPsec communication unless explicitly allowed by policy. */
return avc_has_perm(&selinux_state, return avc_has_perm(sk_sid, peer_sid,
sk_sid, peer_sid,
SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad); SECCLASS_ASSOCIATION, ASSOCIATION__RECVFROM, ad);
} }
...@@ -468,6 +464,6 @@ int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb, ...@@ -468,6 +464,6 @@ int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
/* This check even when there's no association involved is intended, /* This check even when there's no association involved is intended,
* according to Trent Jaeger, to make sure a process can't engage in * according to Trent Jaeger, to make sure a process can't engage in
* non-IPsec communication unless explicitly allowed by policy. */ * non-IPsec communication unless explicitly allowed by policy. */
return avc_has_perm(&selinux_state, sk_sid, SECINITSID_UNLABELED, return avc_has_perm(sk_sid, SECINITSID_UNLABELED,
SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad); SECCLASS_ASSOCIATION, ASSOCIATION__SENDTO, ad);
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7