security/selinux/selinuxfs.c

   1 /* Updated: Karl MacMillan <kmacmillan@tresys.com>
   2  *
   3  *      Added conditional policy language extensions
   4  *
   5  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
   6  * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
   7  *      This program is free software; you can redistribute it and/or modify
   8  *      it under the terms of the GNU General Public License as published by
   9  *      the Free Software Foundation, version 2.
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/pagemap.h>
  14 #include <linux/slab.h>
  15 #include <linux/vmalloc.h>
  16 #include <linux/fs.h>
  17 #include <linux/mutex.h>
  18 #include <linux/init.h>
  19 #include <linux/string.h>
  20 #include <linux/security.h>
  21 #include <linux/major.h>
  22 #include <linux/seq_file.h>
  23 #include <linux/percpu.h>
  24 #include <linux/audit.h>
  25 #include <asm/uaccess.h>
  26 #include <asm/semaphore.h>
  27
  28 /* selinuxfs pseudo filesystem for exporting the security policy API.
  29    Based on the proc code and the fs/nfsd/nfsctl.c code. */
  30
  31 #include "flask.h"
  32 #include "avc.h"
  33 #include "avc_ss.h"
  34 #include "security.h"
  35 #include "objsec.h"
  36 #include "conditional.h"
  37
  38 unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
  39
  40 #ifdef CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
  41 #define SELINUX_COMPAT_NET_VALUE 0
  42 #else
  43 #define SELINUX_COMPAT_NET_VALUE 1
  44 #endif
  45
  46 int selinux_compat_net = SELINUX_COMPAT_NET_VALUE;
  47
  48 static int __init checkreqprot_setup(char *str)
  49 {
  50         selinux_checkreqprot = simple_strtoul(str,NULL,0) ? 1 : 0;
  51         return 1;
  52 }
  53 __setup("checkreqprot=", checkreqprot_setup);
  54
  55 static int __init selinux_compat_net_setup(char *str)
  56 {
  57         selinux_compat_net = simple_strtoul(str,NULL,0) ? 1 : 0;
  58         return 1;
  59 }
  60 __setup("selinux_compat_net=", selinux_compat_net_setup);
  61
  62
  63 static DEFINE_MUTEX(sel_mutex);
  64
  65 /* global data for booleans */
  66 static struct dentry *bool_dir = NULL;
  67 static int bool_num = 0;
  68 static int *bool_pending_values = NULL;
  69
  70 extern void selnl_notify_setenforce(int val);
  71
  72 /* Check whether a task is allowed to use a security operation. */
  73 static int task_has_security(struct task_struct *tsk,
  74                              u32 perms)
  75 {
  76         struct task_security_struct *tsec;
  77
  78         tsec = tsk->security;
  79         if (!tsec)
  80                 return -EACCES;
  81
  82         return avc_has_perm(tsec->sid, SECINITSID_SECURITY,
  83                             SECCLASS_SECURITY, perms, NULL);
  84 }
  85
  86 enum sel_inos {
  87         SEL_ROOT_INO = 2,
  88         SEL_LOAD,       /* load policy */
  89         SEL_ENFORCE,    /* get or set enforcing status */
  90         SEL_CONTEXT,    /* validate context */
  91         SEL_ACCESS,     /* compute access decision */
  92         SEL_CREATE,     /* compute create labeling decision */
  93         SEL_RELABEL,    /* compute relabeling decision */
  94         SEL_USER,       /* compute reachable user contexts */
  95         SEL_POLICYVERS, /* return policy version for this kernel */
  96         SEL_COMMIT_BOOLS, /* commit new boolean values */
  97         SEL_MLS,        /* return if MLS policy is enabled */
  98         SEL_DISABLE,    /* disable SELinux until next reboot */
  99         SEL_MEMBER,     /* compute polyinstantiation membership decision */
 100         SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */
 101         SEL_COMPAT_NET, /* whether to use old compat network packet controls */
 102         SEL_INO_NEXT,   /* The next inode number to use */
 103 };
 104
 105 static unsigned long sel_last_ino = SEL_INO_NEXT - 1;
 106
 107 #define SEL_INITCON_INO_OFFSET  0x01000000
 108 #define SEL_INO_MASK            0x00ffffff
 109
 110 #define TMPBUFLEN       12
 111 static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
 112                                 size_t count, loff_t *ppos)
 113 {
 114         char tmpbuf[TMPBUFLEN];
 115         ssize_t length;
 116
 117         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", selinux_enforcing);
 118         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 119 }
 120
 121 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 122 static ssize_t sel_write_enforce(struct file * file, const char __user * buf,
 123                                  size_t count, loff_t *ppos)
 124
 125 {
 126         char *page;
 127         ssize_t length;
 128         int new_value;
 129
 130         if (count >= PAGE_SIZE)
 131                 return -ENOMEM;
 132         if (*ppos != 0) {
 133                 /* No partial writes. */
 134                 return -EINVAL;
 135         }
 136         page = (char*)get_zeroed_page(GFP_KERNEL);
 137         if (!page)
 138                 return -ENOMEM;
 139         length = -EFAULT;
 140         if (copy_from_user(page, buf, count))
 141                 goto out;
 142
 143         length = -EINVAL;
 144         if (sscanf(page, "%d", &new_value) != 1)
 145                 goto out;
 146
 147         if (new_value != selinux_enforcing) {
 148                 length = task_has_security(current, SECURITY__SETENFORCE);
 149                 if (length)
 150                         goto out;
 151                 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
 152                         "enforcing=%d old_enforcing=%d auid=%u", new_value,
 153                         selinux_enforcing,
 154                         audit_get_loginuid(current->audit_context));
 155                 selinux_enforcing = new_value;
 156                 if (selinux_enforcing)
 157                         avc_ss_reset(0);
 158                 selnl_notify_setenforce(selinux_enforcing);
 159         }
 160         length = count;
 161 out:
 162         free_page((unsigned long) page);
 163         return length;
 164 }
 165 #else
 166 #define sel_write_enforce NULL
 167 #endif
 168
 169 static const struct file_operations sel_enforce_ops = {
 170         .read           = sel_read_enforce,
 171         .write          = sel_write_enforce,
 172 };
 173
 174 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 175 static ssize_t sel_write_disable(struct file * file, const char __user * buf,
 176                                  size_t count, loff_t *ppos)
 177
 178 {
 179         char *page;
 180         ssize_t length;
 181         int new_value;
 182         extern int selinux_disable(void);
 183
 184         if (count >= PAGE_SIZE)
 185                 return -ENOMEM;
 186         if (*ppos != 0) {
 187                 /* No partial writes. */
 188                 return -EINVAL;
 189         }
 190         page = (char*)get_zeroed_page(GFP_KERNEL);
 191         if (!page)
 192                 return -ENOMEM;
 193         length = -EFAULT;
 194         if (copy_from_user(page, buf, count))
 195                 goto out;
 196
 197         length = -EINVAL;
 198         if (sscanf(page, "%d", &new_value) != 1)
 199                 goto out;
 200
 201         if (new_value) {
 202                 length = selinux_disable();
 203                 if (length < 0)
 204                         goto out;
 205                 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
 206                         "selinux=0 auid=%u",
 207                         audit_get_loginuid(current->audit_context));
 208         }
 209
 210         length = count;
 211 out:
 212         free_page((unsigned long) page);
 213         return length;
 214 }
 215 #else
 216 #define sel_write_disable NULL
 217 #endif
 218
 219 static const struct file_operations sel_disable_ops = {
 220         .write          = sel_write_disable,
 221 };
 222
 223 static ssize_t sel_read_policyvers(struct file *filp, char __user *buf,
 224                                    size_t count, loff_t *ppos)
 225 {
 226         char tmpbuf[TMPBUFLEN];
 227         ssize_t length;
 228
 229         length = scnprintf(tmpbuf, TMPBUFLEN, "%u", POLICYDB_VERSION_MAX);
 230         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 231 }
 232
 233 static const struct file_operations sel_policyvers_ops = {
 234         .read           = sel_read_policyvers,
 235 };
 236
 237 /* declaration for sel_write_load */
 238 static int sel_make_bools(void);
 239
 240 static ssize_t sel_read_mls(struct file *filp, char __user *buf,
 241                                 size_t count, loff_t *ppos)
 242 {
 243         char tmpbuf[TMPBUFLEN];
 244         ssize_t length;
 245
 246         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", selinux_mls_enabled);
 247         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 248 }
 249
 250 static const struct file_operations sel_mls_ops = {
 251         .read           = sel_read_mls,
 252 };
 253
 254 static ssize_t sel_write_load(struct file * file, const char __user * buf,
 255                               size_t count, loff_t *ppos)
 256
 257 {
 258         int ret;
 259         ssize_t length;
 260         void *data = NULL;
 261
 262         mutex_lock(&sel_mutex);
 263
 264         length = task_has_security(current, SECURITY__LOAD_POLICY);
 265         if (length)
 266                 goto out;
 267
 268         if (*ppos != 0) {
 269                 /* No partial writes. */
 270                 length = -EINVAL;
 271                 goto out;
 272         }
 273
 274         if ((count > 64 * 1024 * 1024)
 275             || (data = vmalloc(count)) == NULL) {
 276                 length = -ENOMEM;
 277                 goto out;
 278         }
 279
 280         length = -EFAULT;
 281         if (copy_from_user(data, buf, count) != 0)
 282                 goto out;
 283
 284         length = security_load_policy(data, count);
 285         if (length)
 286                 goto out;
 287
 288         ret = sel_make_bools();
 289         if (ret)
 290                 length = ret;
 291         else
 292                 length = count;
 293         audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
 294                 "policy loaded auid=%u",
 295                 audit_get_loginuid(current->audit_context));
 296 out:
 297         mutex_unlock(&sel_mutex);
 298         vfree(data);
 299         return length;
 300 }
 301
 302 static const struct file_operations sel_load_ops = {
 303         .write          = sel_write_load,
 304 };
 305
 306 static ssize_t sel_write_context(struct file * file, char *buf, size_t size)
 307 {
 308         char *canon;
 309         u32 sid, len;
 310         ssize_t length;
 311
 312         length = task_has_security(current, SECURITY__CHECK_CONTEXT);
 313         if (length)
 314                 return length;
 315
 316         length = security_context_to_sid(buf, size, &sid);
 317         if (length < 0)
 318                 return length;
 319
 320         length = security_sid_to_context(sid, &canon, &len);
 321         if (length < 0)
 322                 return length;
 323
 324         if (len > SIMPLE_TRANSACTION_LIMIT) {
 325                 printk(KERN_ERR "%s:  context size (%u) exceeds payload "
 326                        "max\n", __FUNCTION__, len);
 327                 length = -ERANGE;
 328                 goto out;
 329         }
 330
 331         memcpy(buf, canon, len);
 332         length = len;
 333 out:
 334         kfree(canon);
 335         return length;
 336 }
 337
 338 static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
 339                                      size_t count, loff_t *ppos)
 340 {
 341         char tmpbuf[TMPBUFLEN];
 342         ssize_t length;
 343
 344         length = scnprintf(tmpbuf, TMPBUFLEN, "%u", selinux_checkreqprot);
 345         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 346 }
 347
 348 static ssize_t sel_write_checkreqprot(struct file * file, const char __user * buf,
 349                                       size_t count, loff_t *ppos)
 350 {
 351         char *page;
 352         ssize_t length;
 353         unsigned int new_value;
 354
 355         length = task_has_security(current, SECURITY__SETCHECKREQPROT);
 356         if (length)
 357                 return length;
 358
 359         if (count >= PAGE_SIZE)
 360                 return -ENOMEM;
 361         if (*ppos != 0) {
 362                 /* No partial writes. */
 363                 return -EINVAL;
 364         }
 365         page = (char*)get_zeroed_page(GFP_KERNEL);
 366         if (!page)
 367                 return -ENOMEM;
 368         length = -EFAULT;
 369         if (copy_from_user(page, buf, count))
 370                 goto out;
 371
 372         length = -EINVAL;
 373         if (sscanf(page, "%u", &new_value) != 1)
 374                 goto out;
 375
 376         selinux_checkreqprot = new_value ? 1 : 0;
 377         length = count;
 378 out:
 379         free_page((unsigned long) page);
 380         return length;
 381 }
 382 static const struct file_operations sel_checkreqprot_ops = {
 383         .read           = sel_read_checkreqprot,
 384         .write          = sel_write_checkreqprot,
 385 };
 386
 387 static ssize_t sel_read_compat_net(struct file *filp, char __user *buf,
 388                                    size_t count, loff_t *ppos)
 389 {
 390         char tmpbuf[TMPBUFLEN];
 391         ssize_t length;
 392
 393         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", selinux_compat_net);
 394         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
 395 }
 396
 397 static ssize_t sel_write_compat_net(struct file * file, const char __user * buf,
 398                                     size_t count, loff_t *ppos)
 399 {
 400         char *page;
 401         ssize_t length;
 402         int new_value;
 403
 404         length = task_has_security(current, SECURITY__LOAD_POLICY);
 405         if (length)
 406                 return length;
 407
 408         if (count >= PAGE_SIZE)
 409                 return -ENOMEM;
 410         if (*ppos != 0) {
 411                 /* No partial writes. */
 412                 return -EINVAL;
 413         }
 414         page = (char*)get_zeroed_page(GFP_KERNEL);
 415         if (!page)
 416                 return -ENOMEM;
 417         length = -EFAULT;
 418         if (copy_from_user(page, buf, count))
 419                 goto out;
 420
 421         length = -EINVAL;
 422         if (sscanf(page, "%d", &new_value) != 1)
 423                 goto out;
 424
 425         selinux_compat_net = new_value ? 1 : 0;
 426         length = count;
 427 out:
 428         free_page((unsigned long) page);
 429         return length;
 430 }
 431 static const struct file_operations sel_compat_net_ops = {
 432         .read           = sel_read_compat_net,
 433         .write          = sel_write_compat_net,
 434 };
 435
 436 /*
 437  * Remaining nodes use transaction based IO methods like nfsd/nfsctl.c
 438  */
 439 static ssize_t sel_write_access(struct file * file, char *buf, size_t size);
 440 static ssize_t sel_write_create(struct file * file, char *buf, size_t size);
 441 static ssize_t sel_write_relabel(struct file * file, char *buf, size_t size);
 442 static ssize_t sel_write_user(struct file * file, char *buf, size_t size);
 443 static ssize_t sel_write_member(struct file * file, char *buf, size_t size);
 444
 445 static ssize_t (*write_op[])(struct file *, char *, size_t) = {
 446         [SEL_ACCESS] = sel_write_access,
 447         [SEL_CREATE] = sel_write_create,
 448         [SEL_RELABEL] = sel_write_relabel,
 449         [SEL_USER] = sel_write_user,
 450         [SEL_MEMBER] = sel_write_member,
 451         [SEL_CONTEXT] = sel_write_context,
 452 };
 453
 454 static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 455 {
 456         ino_t ino =  file->f_path.dentry->d_inode->i_ino;
 457         char *data;
 458         ssize_t rv;
 459
 460         if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
 461                 return -EINVAL;
 462
 463         data = simple_transaction_get(file, buf, size);
 464         if (IS_ERR(data))
 465                 return PTR_ERR(data);
 466
 467         rv =  write_op[ino](file, data, size);
 468         if (rv>0) {
 469                 simple_transaction_set(file, rv);
 470                 rv = size;
 471         }
 472         return rv;
 473 }
 474
 475 static const struct file_operations transaction_ops = {
 476         .write          = selinux_transaction_write,
 477         .read           = simple_transaction_read,
 478         .release        = simple_transaction_release,
 479 };
 480
 481 /*
 482  * payload - write methods
 483  * If the method has a response, the response should be put in buf,
 484  * and the length returned.  Otherwise return 0 or and -error.
 485  */
 486
 487 static ssize_t sel_write_access(struct file * file, char *buf, size_t size)
 488 {
 489         char *scon, *tcon;
 490         u32 ssid, tsid;
 491         u16 tclass;
 492         u32 req;
 493         struct av_decision avd;
 494         ssize_t length;
 495
 496         length = task_has_security(current, SECURITY__COMPUTE_AV);
 497         if (length)
 498                 return length;
 499
 500         length = -ENOMEM;
 501         scon = kzalloc(size+1, GFP_KERNEL);
 502         if (!scon)
 503                 return length;
 504
 505         tcon = kzalloc(size+1, GFP_KERNEL);
 506         if (!tcon)
 507                 goto out;
 508
 509         length = -EINVAL;
 510         if (sscanf(buf, "%s %s %hu %x", scon, tcon, &tclass, &req) != 4)
 511                 goto out2;
 512
 513         length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
 514         if (length < 0)
 515                 goto out2;
 516         length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
 517         if (length < 0)
 518                 goto out2;
 519
 520         length = security_compute_av(ssid, tsid, tclass, req, &avd);
 521         if (length < 0)
 522                 goto out2;
 523
 524         length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
 525                           "%x %x %x %x %u",
 526                           avd.allowed, avd.decided,
 527                           avd.auditallow, avd.auditdeny,
 528                           avd.seqno);
 529 out2:
 530         kfree(tcon);
 531 out:
 532         kfree(scon);
 533         return length;
 534 }
 535
 536 static ssize_t sel_write_create(struct file * file, char *buf, size_t size)
 537 {
 538         char *scon, *tcon;
 539         u32 ssid, tsid, newsid;
 540         u16 tclass;
 541         ssize_t length;
 542         char *newcon;
 543         u32 len;
 544
 545         length = task_has_security(current, SECURITY__COMPUTE_CREATE);
 546         if (length)
 547                 return length;
 548
 549         length = -ENOMEM;
 550         scon = kzalloc(size+1, GFP_KERNEL);
 551         if (!scon)
 552                 return length;
 553
 554         tcon = kzalloc(size+1, GFP_KERNEL);
 555         if (!tcon)
 556                 goto out;
 557
 558         length = -EINVAL;
 559         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 560                 goto out2;
 561
 562         length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
 563         if (length < 0)
 564                 goto out2;
 565         length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
 566         if (length < 0)
 567                 goto out2;
 568
 569         length = security_transition_sid(ssid, tsid, tclass, &newsid);
 570         if (length < 0)
 571                 goto out2;
 572
 573         length = security_sid_to_context(newsid, &newcon, &len);
 574         if (length < 0)
 575                 goto out2;
 576
 577         if (len > SIMPLE_TRANSACTION_LIMIT) {
 578                 printk(KERN_ERR "%s:  context size (%u) exceeds payload "
 579                        "max\n", __FUNCTION__, len);
 580                 length = -ERANGE;
 581                 goto out3;
 582         }
 583
 584         memcpy(buf, newcon, len);
 585         length = len;
 586 out3:
 587         kfree(newcon);
 588 out2:
 589         kfree(tcon);
 590 out:
 591         kfree(scon);
 592         return length;
 593 }
 594
 595 static ssize_t sel_write_relabel(struct file * file, char *buf, size_t size)
 596 {
 597         char *scon, *tcon;
 598         u32 ssid, tsid, newsid;
 599         u16 tclass;
 600         ssize_t length;
 601         char *newcon;
 602         u32 len;
 603
 604         length = task_has_security(current, SECURITY__COMPUTE_RELABEL);
 605         if (length)
 606                 return length;
 607
 608         length = -ENOMEM;
 609         scon = kzalloc(size+1, GFP_KERNEL);
 610         if (!scon)
 611                 return length;
 612
 613         tcon = kzalloc(size+1, GFP_KERNEL);
 614         if (!tcon)
 615                 goto out;
 616
 617         length = -EINVAL;
 618         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 619                 goto out2;
 620
 621         length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
 622         if (length < 0)
 623                 goto out2;
 624         length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
 625         if (length < 0)
 626                 goto out2;
 627
 628         length = security_change_sid(ssid, tsid, tclass, &newsid);
 629         if (length < 0)
 630                 goto out2;
 631
 632         length = security_sid_to_context(newsid, &newcon, &len);
 633         if (length < 0)
 634                 goto out2;
 635
 636         if (len > SIMPLE_TRANSACTION_LIMIT) {
 637                 length = -ERANGE;
 638                 goto out3;
 639         }
 640
 641         memcpy(buf, newcon, len);
 642         length = len;
 643 out3:
 644         kfree(newcon);
 645 out2:
 646         kfree(tcon);
 647 out:
 648         kfree(scon);
 649         return length;
 650 }
 651
 652 static ssize_t sel_write_user(struct file * file, char *buf, size_t size)
 653 {
 654         char *con, *user, *ptr;
 655         u32 sid, *sids;
 656         ssize_t length;
 657         char *newcon;
 658         int i, rc;
 659         u32 len, nsids;
 660
 661         length = task_has_security(current, SECURITY__COMPUTE_USER);
 662         if (length)
 663                 return length;
 664
 665         length = -ENOMEM;
 666         con = kzalloc(size+1, GFP_KERNEL);
 667         if (!con)
 668                 return length;
 669
 670         user = kzalloc(size+1, GFP_KERNEL);
 671         if (!user)
 672                 goto out;
 673
 674         length = -EINVAL;
 675         if (sscanf(buf, "%s %s", con, user) != 2)
 676                 goto out2;
 677
 678         length = security_context_to_sid(con, strlen(con)+1, &sid);
 679         if (length < 0)
 680                 goto out2;
 681
 682         length = security_get_user_sids(sid, user, &sids, &nsids);
 683         if (length < 0)
 684                 goto out2;
 685
 686         length = sprintf(buf, "%u", nsids) + 1;
 687         ptr = buf + length;
 688         for (i = 0; i < nsids; i++) {
 689                 rc = security_sid_to_context(sids[i], &newcon, &len);
 690                 if (rc) {
 691                         length = rc;
 692                         goto out3;
 693                 }
 694                 if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {
 695                         kfree(newcon);
 696                         length = -ERANGE;
 697                         goto out3;
 698                 }
 699                 memcpy(ptr, newcon, len);
 700                 kfree(newcon);
 701                 ptr += len;
 702                 length += len;
 703         }
 704 out3:
 705         kfree(sids);
 706 out2:
 707         kfree(user);
 708 out:
 709         kfree(con);
 710         return length;
 711 }
 712
 713 static ssize_t sel_write_member(struct file * file, char *buf, size_t size)
 714 {
 715         char *scon, *tcon;
 716         u32 ssid, tsid, newsid;
 717         u16 tclass;
 718         ssize_t length;
 719         char *newcon;
 720         u32 len;
 721
 722         length = task_has_security(current, SECURITY__COMPUTE_MEMBER);
 723         if (length)
 724                 return length;
 725
 726         length = -ENOMEM;
 727         scon = kzalloc(size+1, GFP_KERNEL);
 728         if (!scon)
 729                 return length;
 730
 731         tcon = kzalloc(size+1, GFP_KERNEL);
 732         if (!tcon)
 733                 goto out;
 734
 735         length = -EINVAL;
 736         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
 737                 goto out2;
 738
 739         length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
 740         if (length < 0)
 741                 goto out2;
 742         length = security_context_to_sid(tcon, strlen(tcon)+1, &tsid);
 743         if (length < 0)
 744                 goto out2;
 745
 746         length = security_member_sid(ssid, tsid, tclass, &newsid);
 747         if (length < 0)
 748                 goto out2;
 749
 750         length = security_sid_to_context(newsid, &newcon, &len);
 751         if (length < 0)
 752                 goto out2;
 753
 754         if (len > SIMPLE_TRANSACTION_LIMIT) {
 755                 printk(KERN_ERR "%s:  context size (%u) exceeds payload "
 756                        "max\n", __FUNCTION__, len);
 757                 length = -ERANGE;
 758                 goto out3;
 759         }
 760
 761         memcpy(buf, newcon, len);
 762         length = len;
 763 out3:
 764         kfree(newcon);
 765 out2:
 766         kfree(tcon);
 767 out:
 768         kfree(scon);
 769         return length;
 770 }
 771
 772 static struct inode *sel_make_inode(struct super_block *sb, int mode)
 773 {
 774         struct inode *ret = new_inode(sb);
 775
 776         if (ret) {
 777                 ret->i_mode = mode;
 778                 ret->i_uid = ret->i_gid = 0;
 779                 ret->i_blocks = 0;
 780                 ret->i_atime = ret->i_mtime = ret->i_ctime = CURRENT_TIME;
 781         }
 782         return ret;
 783 }
 784
 785 #define BOOL_INO_OFFSET 30
 786
 787 static ssize_t sel_read_bool(struct file *filep, char __user *buf,
 788                              size_t count, loff_t *ppos)
 789 {
 790         char *page = NULL;
 791         ssize_t length;
 792         ssize_t ret;
 793         int cur_enforcing;
 794         struct inode *inode;
 795
 796         mutex_lock(&sel_mutex);
 797
 798         ret = -EFAULT;
 799
 800         /* check to see if this file has been deleted */
 801         if (!filep->f_op)
 802                 goto out;
 803
 804         if (count > PAGE_SIZE) {
 805                 ret = -EINVAL;
 806                 goto out;
 807         }
 808         if (!(page = (char*)get_zeroed_page(GFP_KERNEL))) {
 809                 ret = -ENOMEM;
 810                 goto out;
 811         }
 812
 813         inode = filep->f_path.dentry->d_inode;
 814         cur_enforcing = security_get_bool_value(inode->i_ino - BOOL_INO_OFFSET);
 815         if (cur_enforcing < 0) {
 816                 ret = cur_enforcing;
 817                 goto out;
 818         }
 819
 820         length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
 821                           bool_pending_values[inode->i_ino - BOOL_INO_OFFSET]);
 822         ret = simple_read_from_buffer(buf, count, ppos, page, length);
 823 out:
 824         mutex_unlock(&sel_mutex);
 825         if (page)
 826                 free_page((unsigned long)page);
 827         return ret;
 828 }
 829
 830 static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
 831                               size_t count, loff_t *ppos)
 832 {
 833         char *page = NULL;
 834         ssize_t length = -EFAULT;
 835         int new_value;
 836         struct inode *inode;
 837
 838         mutex_lock(&sel_mutex);
 839
 840         length = task_has_security(current, SECURITY__SETBOOL);
 841         if (length)
 842                 goto out;
 843
 844         /* check to see if this file has been deleted */
 845         if (!filep->f_op)
 846                 goto out;
 847
 848         if (count >= PAGE_SIZE) {
 849                 length = -ENOMEM;
 850                 goto out;
 851         }
 852         if (*ppos != 0) {
 853                 /* No partial writes. */
 854                 goto out;
 855         }
 856         page = (char*)get_zeroed_page(GFP_KERNEL);
 857         if (!page) {
 858                 length = -ENOMEM;
 859                 goto out;
 860         }
 861
 862         if (copy_from_user(page, buf, count))
 863                 goto out;
 864
 865         length = -EINVAL;
 866         if (sscanf(page, "%d", &new_value) != 1)
 867                 goto out;
 868
 869         if (new_value)
 870                 new_value = 1;
 871
 872         inode = filep->f_path.dentry->d_inode;
 873         bool_pending_values[inode->i_ino - BOOL_INO_OFFSET] = new_value;
 874         length = count;
 875
 876 out:
 877         mutex_unlock(&sel_mutex);
 878         if (page)
 879                 free_page((unsigned long) page);
 880         return length;
 881 }
 882
 883 static const struct file_operations sel_bool_ops = {
 884         .read           = sel_read_bool,
 885         .write          = sel_write_bool,
 886 };
 887
 888 static ssize_t sel_commit_bools_write(struct file *filep,
 889                                       const char __user *buf,
 890                                       size_t count, loff_t *ppos)
 891 {
 892         char *page = NULL;
 893         ssize_t length = -EFAULT;
 894         int new_value;
 895
 896         mutex_lock(&sel_mutex);
 897
 898         length = task_has_security(current, SECURITY__SETBOOL);
 899         if (length)
 900                 goto out;
 901
 902         /* check to see if this file has been deleted */
 903         if (!filep->f_op)
 904                 goto out;
 905
 906         if (count >= PAGE_SIZE) {
 907                 length = -ENOMEM;
 908                 goto out;
 909         }
 910         if (*ppos != 0) {
 911                 /* No partial writes. */
 912                 goto out;
 913         }
 914         page = (char*)get_zeroed_page(GFP_KERNEL);
 915         if (!page) {
 916                 length = -ENOMEM;
 917                 goto out;
 918         }
 919
 920         if (copy_from_user(page, buf, count))
 921                 goto out;
 922
 923         length = -EINVAL;
 924         if (sscanf(page, "%d", &new_value) != 1)
 925                 goto out;
 926
 927         if (new_value && bool_pending_values) {
 928                 security_set_bools(bool_num, bool_pending_values);
 929         }
 930
 931         length = count;
 932
 933 out:
 934         mutex_unlock(&sel_mutex);
 935         if (page)
 936                 free_page((unsigned long) page);
 937         return length;
 938 }
 939
 940 static const struct file_operations sel_commit_bools_ops = {
 941         .write          = sel_commit_bools_write,
 942 };
 943
 944 /* delete booleans - partial revoke() from
 945  * fs/proc/generic.c proc_kill_inodes */
 946 static void sel_remove_bools(struct dentry *de)
 947 {
 948         struct list_head *p, *node;
 949         struct super_block *sb = de->d_sb;
 950
 951         spin_lock(&dcache_lock);
 952         node = de->d_subdirs.next;
 953         while (node != &de->d_subdirs) {
 954                 struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
 955                 list_del_init(node);
 956
 957                 if (d->d_inode) {
 958                         d = dget_locked(d);
 959                         spin_unlock(&dcache_lock);
 960                         d_delete(d);
 961                         simple_unlink(de->d_inode, d);
 962                         dput(d);
 963                         spin_lock(&dcache_lock);
 964                 }
 965                 node = de->d_subdirs.next;
 966         }
 967
 968         spin_unlock(&dcache_lock);
 969
 970         file_list_lock();
 971         list_for_each(p, &sb->s_files) {
 972                 struct file * filp = list_entry(p, struct file, f_u.fu_list);
 973                 struct dentry * dentry = filp->f_path.dentry;
 974
 975                 if (dentry->d_parent != de) {
 976                         continue;
 977                 }
 978                 filp->f_op = NULL;
 979         }
 980         file_list_unlock();
 981 }
 982
 983 #define BOOL_DIR_NAME "booleans"
 984
 985 static int sel_make_bools(void)
 986 {
 987         int i, ret = 0;
 988         ssize_t len;
 989         struct dentry *dentry = NULL;
 990         struct dentry *dir = bool_dir;
 991         struct inode *inode = NULL;
 992         struct inode_security_struct *isec;
 993         char **names = NULL, *page;
 994         int num;
 995         int *values = NULL;
 996         u32 sid;
 997
 998         /* remove any existing files */
 999         kfree(bool_pending_values);
1000         bool_pending_values = NULL;
1001
1002         sel_remove_bools(dir);
1003
1004         if (!(page = (char*)get_zeroed_page(GFP_KERNEL)))
1005                 return -ENOMEM;
1006
1007         ret = security_get_bools(&num, &names, &values);
1008         if (ret != 0)
1009                 goto out;
1010
1011         for (i = 0; i < num; i++) {
1012                 dentry = d_alloc_name(dir, names[i]);
1013                 if (!dentry) {
1014                         ret = -ENOMEM;
1015                         goto err;
1016                 }
1017                 inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
1018                 if (!inode) {
1019                         ret = -ENOMEM;
1020                         goto err;
1021                 }
1022
1023                 len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
1024                 if (len < 0) {
1025                         ret = -EINVAL;
1026                         goto err;
1027                 } else if (len >= PAGE_SIZE) {
1028                         ret = -ENAMETOOLONG;
1029                         goto err;
1030                 }
1031                 isec = (struct inode_security_struct*)inode->i_security;
1032                 if ((ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid)))
1033                         goto err;
1034                 isec->sid = sid;
1035                 isec->initialized = 1;
1036                 inode->i_fop = &sel_bool_ops;
1037                 inode->i_ino = i + BOOL_INO_OFFSET;
1038                 d_add(dentry, inode);
1039         }
1040         bool_num = num;
1041         bool_pending_values = values;
1042 out:
1043         free_page((unsigned long)page);
1044         if (names) {
1045                 for (i = 0; i < num; i++)
1046                         kfree(names[i]);
1047                 kfree(names);
1048         }
1049         return ret;
1050 err:
1051         kfree(values);
1052         sel_remove_bools(dir);
1053         ret = -ENOMEM;
1054         goto out;
1055 }
1056
1057 #define NULL_FILE_NAME "null"
1058
1059 struct dentry *selinux_null = NULL;
1060
1061 static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
1062                                             size_t count, loff_t *ppos)
1063 {
1064         char tmpbuf[TMPBUFLEN];
1065         ssize_t length;
1066
1067         length = scnprintf(tmpbuf, TMPBUFLEN, "%u", avc_cache_threshold);
1068         return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
1069 }
1070
1071 static ssize_t sel_write_avc_cache_threshold(struct file * file,
1072                                              const char __user * buf,
1073                                              size_t count, loff_t *ppos)
1074
1075 {
1076         char *page;
1077         ssize_t ret;
1078         int new_value;
1079
1080         if (count >= PAGE_SIZE) {
1081                 ret = -ENOMEM;
1082                 goto out;
1083         }
1084
1085         if (*ppos != 0) {
1086                 /* No partial writes. */
1087                 ret = -EINVAL;
1088                 goto out;
1089         }
1090
1091         page = (char*)get_zeroed_page(GFP_KERNEL);
1092         if (!page) {
1093                 ret = -ENOMEM;
1094                 goto out;
1095         }
1096
1097         if (copy_from_user(page, buf, count)) {
1098                 ret = -EFAULT;
1099                 goto out_free;
1100         }
1101
1102         if (sscanf(page, "%u", &new_value) != 1) {
1103                 ret = -EINVAL;
1104                 goto out;
1105         }
1106
1107         if (new_value != avc_cache_threshold) {
1108                 ret = task_has_security(current, SECURITY__SETSECPARAM);
1109                 if (ret)
1110                         goto out_free;
1111                 avc_cache_threshold = new_value;
1112         }
1113         ret = count;
1114 out_free:
1115         free_page((unsigned long)page);
1116 out:
1117         return ret;
1118 }
1119
1120 static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
1121                                        size_t count, loff_t *ppos)
1122 {
1123         char *page;
1124         ssize_t ret = 0;
1125
1126         page = (char *)__get_free_page(GFP_KERNEL);
1127         if (!page) {
1128                 ret = -ENOMEM;
1129                 goto out;
1130         }
1131         ret = avc_get_hash_stats(page);
1132         if (ret >= 0)
1133                 ret = simple_read_from_buffer(buf, count, ppos, page, ret);
1134         free_page((unsigned long)page);
1135 out:
1136         return ret;
1137 }
1138
1139 static const struct file_operations sel_avc_cache_threshold_ops = {
1140         .read           = sel_read_avc_cache_threshold,
1141         .write          = sel_write_avc_cache_threshold,
1142 };
1143
1144 static const struct file_operations sel_avc_hash_stats_ops = {
1145         .read           = sel_read_avc_hash_stats,
1146 };
1147
1148 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1149 static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
1150 {
1151         int cpu;
1152
1153         for (cpu = *idx; cpu < NR_CPUS; ++cpu) {
1154                 if (!cpu_possible(cpu))
1155                         continue;
1156                 *idx = cpu + 1;
1157                 return &per_cpu(avc_cache_stats, cpu);
1158         }
1159         return NULL;
1160 }
1161
1162 static void *sel_avc_stats_seq_start(struct seq_file *seq, loff_t *pos)
1163 {
1164         loff_t n = *pos - 1;
1165
1166         if (*pos == 0)
1167                 return SEQ_START_TOKEN;
1168
1169         return sel_avc_get_stat_idx(&n);
1170 }
1171
1172 static void *sel_avc_stats_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1173 {
1174         return sel_avc_get_stat_idx(pos);
1175 }
1176
1177 static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
1178 {
1179         struct avc_cache_stats *st = v;
1180
1181         if (v == SEQ_START_TOKEN)
1182                 seq_printf(seq, "lookups hits misses allocations reclaims "
1183                            "frees\n");
1184         else
1185                 seq_printf(seq, "%u %u %u %u %u %u\n", st->lookups,
1186                            st->hits, st->misses, st->allocations,
1187                            st->reclaims, st->frees);
1188         return 0;
1189 }
1190
1191 static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v)
1192 { }
1193
1194 static struct seq_operations sel_avc_cache_stats_seq_ops = {
1195         .start          = sel_avc_stats_seq_start,
1196         .next           = sel_avc_stats_seq_next,
1197         .show           = sel_avc_stats_seq_show,
1198         .stop           = sel_avc_stats_seq_stop,
1199 };
1200
1201 static int sel_open_avc_cache_stats(struct inode *inode, struct file *file)
1202 {
1203         return seq_open(file, &sel_avc_cache_stats_seq_ops);
1204 }
1205
1206 static const struct file_operations sel_avc_cache_stats_ops = {
1207         .open           = sel_open_avc_cache_stats,
1208         .read           = seq_read,
1209         .llseek         = seq_lseek,
1210         .release        = seq_release,
1211 };
1212 #endif
1213
1214 static int sel_make_avc_files(struct dentry *dir)
1215 {
1216         int i, ret = 0;
1217         static struct tree_descr files[] = {
1218                 { "cache_threshold",
1219                   &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR },
1220                 { "hash_stats", &sel_avc_hash_stats_ops, S_IRUGO },
1221 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
1222                 { "cache_stats", &sel_avc_cache_stats_ops, S_IRUGO },
1223 #endif
1224         };
1225
1226         for (i = 0; i < ARRAY_SIZE(files); i++) {
1227                 struct inode *inode;
1228                 struct dentry *dentry;
1229
1230                 dentry = d_alloc_name(dir, files[i].name);
1231                 if (!dentry) {
1232                         ret = -ENOMEM;
1233                         goto out;
1234                 }
1235
1236                 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
1237                 if (!inode) {
1238                         ret = -ENOMEM;
1239                         goto out;
1240                 }
1241                 inode->i_fop = files[i].ops;
1242                 inode->i_ino = ++sel_last_ino;
1243                 d_add(dentry, inode);
1244         }
1245 out:
1246         return ret;
1247 }
1248
1249 static ssize_t sel_read_initcon(struct file * file, char __user *buf,
1250                                 size_t count, loff_t *ppos)
1251 {
1252         struct inode *inode;
1253         char *con;
1254         u32 sid, len;
1255         ssize_t ret;
1256
1257         inode = file->f_path.dentry->d_inode;
1258         sid = inode->i_ino&SEL_INO_MASK;
1259         ret = security_sid_to_context(sid, &con, &len);
1260         if (ret < 0)
1261                 return ret;
1262
1263         ret = simple_read_from_buffer(buf, count, ppos, con, len);
1264         kfree(con);
1265         return ret;
1266 }
1267
1268 static const struct file_operations sel_initcon_ops = {
1269         .read           = sel_read_initcon,
1270 };
1271
1272 static int sel_make_initcon_files(struct dentry *dir)
1273 {
1274         int i, ret = 0;
1275
1276         for (i = 1; i <= SECINITSID_NUM; i++) {
1277                 struct inode *inode;
1278                 struct dentry *dentry;
1279                 dentry = d_alloc_name(dir, security_get_initial_sid_context(i));
1280                 if (!dentry) {
1281                         ret = -ENOMEM;
1282                         goto out;
1283                 }
1284
1285                 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
1286                 if (!inode) {
1287                         ret = -ENOMEM;
1288                         goto out;
1289                 }
1290                 inode->i_fop = &sel_initcon_ops;
1291                 inode->i_ino = i|SEL_INITCON_INO_OFFSET;
1292                 d_add(dentry, inode);
1293         }
1294 out:
1295         return ret;
1296 }
1297
1298 static int sel_make_dir(struct inode *dir, struct dentry *dentry)
1299 {
1300         int ret = 0;
1301         struct inode *inode;
1302
1303         inode = sel_make_inode(dir->i_sb, S_IFDIR | S_IRUGO | S_IXUGO);
1304         if (!inode) {
1305                 ret = -ENOMEM;
1306                 goto out;
1307         }
1308         inode->i_op = &simple_dir_inode_operations;
1309         inode->i_fop = &simple_dir_operations;
1310         inode->i_ino = ++sel_last_ino;
1311         /* directory inodes start off with i_nlink == 2 (for "." entry) */
1312         inc_nlink(inode);
1313         d_add(dentry, inode);
1314         /* bump link count on parent directory, too */
1315         inc_nlink(dir);
1316 out:
1317         return ret;
1318 }
1319
1320 static int sel_fill_super(struct super_block * sb, void * data, int silent)
1321 {
1322         int ret;
1323         struct dentry *dentry;
1324         struct inode *inode, *root_inode;
1325         struct inode_security_struct *isec;
1326
1327         static struct tree_descr selinux_files[] = {
1328                 [SEL_LOAD] = {"load", &sel_load_ops, S_IRUSR|S_IWUSR},
1329                 [SEL_ENFORCE] = {"enforce", &sel_enforce_ops, S_IRUGO|S_IWUSR},
1330                 [SEL_CONTEXT] = {"context", &transaction_ops, S_IRUGO|S_IWUGO},
1331                 [SEL_ACCESS] = {"access", &transaction_ops, S_IRUGO|S_IWUGO},
1332                 [SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO},
1333                 [SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO},
1334                 [SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO},
1335                 [SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO},
1336                 [SEL_COMMIT_BOOLS] = {"commit_pending_bools", &sel_commit_bools_ops, S_IWUSR},
1337                 [SEL_MLS] = {"mls", &sel_mls_ops, S_IRUGO},
1338                 [SEL_DISABLE] = {"disable", &sel_disable_ops, S_IWUSR},
1339                 [SEL_MEMBER] = {"member", &transaction_ops, S_IRUGO|S_IWUGO},
1340                 [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
1341                 [SEL_COMPAT_NET] = {"compat_net", &sel_compat_net_ops, S_IRUGO|S_IWUSR},
1342                 /* last one */ {""}
1343         };
1344         ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
1345         if (ret)
1346                 goto err;
1347
1348         root_inode = sb->s_root->d_inode;
1349
1350         dentry = d_alloc_name(sb->s_root, BOOL_DIR_NAME);
1351         if (!dentry) {
1352                 ret = -ENOMEM;
1353                 goto err;
1354         }
1355
1356         ret = sel_make_dir(root_inode, dentry);
1357         if (ret)
1358                 goto err;
1359
1360         bool_dir = dentry;
1361
1362         dentry = d_alloc_name(sb->s_root, NULL_FILE_NAME);
1363         if (!dentry) {
1364                 ret = -ENOMEM;
1365                 goto err;
1366         }
1367
1368         inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
1369         if (!inode) {
1370                 ret = -ENOMEM;
1371                 goto err;
1372         }
1373         inode->i_ino = ++sel_last_ino;
1374         isec = (struct inode_security_struct*)inode->i_security;
1375         isec->sid = SECINITSID_DEVNULL;
1376         isec->sclass = SECCLASS_CHR_FILE;
1377         isec->initialized = 1;
1378
1379         init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3));
1380         d_add(dentry, inode);
1381         selinux_null = dentry;
1382
1383         dentry = d_alloc_name(sb->s_root, "avc");
1384         if (!dentry) {
1385                 ret = -ENOMEM;
1386                 goto err;
1387         }
1388
1389         ret = sel_make_dir(root_inode, dentry);
1390         if (ret)
1391                 goto err;
1392
1393         ret = sel_make_avc_files(dentry);
1394         if (ret)
1395                 goto err;
1396
1397         dentry = d_alloc_name(sb->s_root, "initial_contexts");
1398         if (!dentry) {
1399                 ret = -ENOMEM;
1400                 goto err;
1401         }
1402
1403         ret = sel_make_dir(root_inode, dentry);
1404         if (ret)
1405                 goto err;
1406
1407         ret = sel_make_initcon_files(dentry);
1408         if (ret)
1409                 goto err;
1410
1411 out:
1412         return ret;
1413 err:
1414         printk(KERN_ERR "%s:  failed while creating inodes\n", __FUNCTION__);
1415         goto out;
1416 }
1417
1418 static int sel_get_sb(struct file_system_type *fs_type,
1419                       int flags, const char *dev_name, void *data,
1420                       struct vfsmount *mnt)
1421 {
1422         return get_sb_single(fs_type, flags, data, sel_fill_super, mnt);
1423 }
1424
1425 static struct file_system_type sel_fs_type = {
1426         .name           = "selinuxfs",
1427         .get_sb         = sel_get_sb,
1428         .kill_sb        = kill_litter_super,
1429 };
1430
1431 struct vfsmount *selinuxfs_mount;
1432
1433 static int __init init_sel_fs(void)
1434 {
1435         int err;
1436
1437         if (!selinux_enabled)
1438                 return 0;
1439         err = register_filesystem(&sel_fs_type);
1440         if (!err) {
1441                 selinuxfs_mount = kern_mount(&sel_fs_type);
1442                 if (IS_ERR(selinuxfs_mount)) {
1443                         printk(KERN_ERR "selinuxfs:  could not mount!\n");
1444                         err = PTR_ERR(selinuxfs_mount);
1445                         selinuxfs_mount = NULL;
1446                 }
1447         }
1448         return err;
1449 }
1450
1451 __initcall(init_sel_fs);
1452
1453 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
1454 void exit_sel_fs(void)
1455 {
1456         unregister_filesystem(&sel_fs_type);
1457 }
1458 #endif