security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/tracehook.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched/signal.h>
  30 #include <linux/sched/task.h>
  31 #include <linux/lsm_hooks.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/proc_fs.h>
  40 #include <linux/swap.h>
  41 #include <linux/spinlock.h>
  42 #include <linux/syscalls.h>
  43 #include <linux/dcache.h>
  44 #include <linux/file.h>
  45 #include <linux/fdtable.h>
  46 #include <linux/namei.h>
  47 #include <linux/mount.h>
  48 #include <linux/fs_context.h>
  49 #include <linux/fs_parser.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/sctp.h>
  70 #include <net/sctp/structs.h>
  71 #include <linux/quota.h>
  72 #include <linux/un.h>           /* for Unix socket types */
  73 #include <net/af_unix.h>        /* for Unix socket types */
  74 #include <linux/parser.h>
  75 #include <linux/nfs_mount.h>
  76 #include <net/ipv6.h>
  77 #include <linux/hugetlb.h>
  78 #include <linux/personality.h>
  79 #include <linux/audit.h>
  80 #include <linux/string.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89 #include <linux/kernfs.h>
  90 #include <linux/stringhash.h>   /* for hashlen_string() */
  91 #include <uapi/linux/mount.h>
  92 #include <linux/fsnotify.h>
  93 #include <linux/fanotify.h>
  94
  95 #include "avc.h"
  96 #include "objsec.h"
  97 #include "netif.h"
  98 #include "netnode.h"
  99 #include "netport.h"
 100 #include "ibpkey.h"
 101 #include "xfrm.h"
 102 #include "netlabel.h"
 103 #include "audit.h"
 104 #include "avc_ss.h"
 105
 106 struct selinux_state selinux_state;
 107
 108 /* SECMARK reference count */
 109 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 110
 111 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 112 static int selinux_enforcing_boot;
 113
 114 static int __init enforcing_setup(char *str)
 115 {
 116         unsigned long enforcing;
 117         if (!kstrtoul(str, 0, &enforcing))
 118                 selinux_enforcing_boot = enforcing ? 1 : 0;
 119         return 1;
 120 }
 121 __setup("enforcing=", enforcing_setup);
 122 #else
 123 #define selinux_enforcing_boot 1
 124 #endif
 125
 126 int selinux_enabled __lsm_ro_after_init = 1;
 127 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 128 static int __init selinux_enabled_setup(char *str)
 129 {
 130         unsigned long enabled;
 131         if (!kstrtoul(str, 0, &enabled))
 132                 selinux_enabled = enabled ? 1 : 0;
 133         return 1;
 134 }
 135 __setup("selinux=", selinux_enabled_setup);
 136 #endif
 137
 138 static unsigned int selinux_checkreqprot_boot =
 139         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 140
 141 static int __init checkreqprot_setup(char *str)
 142 {
 143         unsigned long checkreqprot;
 144
 145         if (!kstrtoul(str, 0, &checkreqprot))
 146                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 147         return 1;
 148 }
 149 __setup("checkreqprot=", checkreqprot_setup);
 150
 151 /**
 152  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 153  *
 154  * Description:
 155  * This function checks the SECMARK reference counter to see if any SECMARK
 156  * targets are currently configured, if the reference counter is greater than
 157  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 158  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 159  * policy capability is enabled, SECMARK is always considered enabled.
 160  *
 161  */
 162 static int selinux_secmark_enabled(void)
 163 {
 164         return (selinux_policycap_alwaysnetwork() ||
 165                 atomic_read(&selinux_secmark_refcount));
 166 }
 167
 168 /**
 169  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 170  *
 171  * Description:
 172  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 173  * (1) if any are enabled or false (0) if neither are enabled.  If the
 174  * always_check_network policy capability is enabled, peer labeling
 175  * is always considered enabled.
 176  *
 177  */
 178 static int selinux_peerlbl_enabled(void)
 179 {
 180         return (selinux_policycap_alwaysnetwork() ||
 181                 netlbl_enabled() || selinux_xfrm_enabled());
 182 }
 183
 184 static int selinux_netcache_avc_callback(u32 event)
 185 {
 186         if (event == AVC_CALLBACK_RESET) {
 187                 sel_netif_flush();
 188                 sel_netnode_flush();
 189                 sel_netport_flush();
 190                 synchronize_net();
 191         }
 192         return 0;
 193 }
 194
 195 static int selinux_lsm_notifier_avc_callback(u32 event)
 196 {
 197         if (event == AVC_CALLBACK_RESET) {
 198                 sel_ib_pkey_flush();
 199                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 200         }
 201
 202         return 0;
 203 }
 204
 205 /*
 206  * initialise the security for the init task
 207  */
 208 static void cred_init_security(void)
 209 {
 210         struct cred *cred = (struct cred *) current->real_cred;
 211         struct task_security_struct *tsec;
 212
 213         tsec = selinux_cred(cred);
 214         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 215 }
 216
 217 /*
 218  * get the security ID of a set of credentials
 219  */
 220 static inline u32 cred_sid(const struct cred *cred)
 221 {
 222         const struct task_security_struct *tsec;
 223
 224         tsec = selinux_cred(cred);
 225         return tsec->sid;
 226 }
 227
 228 /*
 229  * get the objective security ID of a task
 230  */
 231 static inline u32 task_sid(const struct task_struct *task)
 232 {
 233         u32 sid;
 234
 235         rcu_read_lock();
 236         sid = cred_sid(__task_cred(task));
 237         rcu_read_unlock();
 238         return sid;
 239 }
 240
 241 /* Allocate and free functions for each kind of security blob. */
 242
 243 static int inode_alloc_security(struct inode *inode)
 244 {
 245         struct inode_security_struct *isec = selinux_inode(inode);
 246         u32 sid = current_sid();
 247
 248         spin_lock_init(&isec->lock);
 249         INIT_LIST_HEAD(&isec->list);
 250         isec->inode = inode;
 251         isec->sid = SECINITSID_UNLABELED;
 252         isec->sclass = SECCLASS_FILE;
 253         isec->task_sid = sid;
 254         isec->initialized = LABEL_INVALID;
 255
 256         return 0;
 257 }
 258
 259 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 260
 261 /*
 262  * Try reloading inode security labels that have been marked as invalid.  The
 263  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 264  * allowed; when set to false, returns -ECHILD when the label is
 265  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 266  */
 267 static int __inode_security_revalidate(struct inode *inode,
 268                                        struct dentry *dentry,
 269                                        bool may_sleep)
 270 {
 271         struct inode_security_struct *isec = selinux_inode(inode);
 272
 273         might_sleep_if(may_sleep);
 274
 275         if (selinux_state.initialized &&
 276             isec->initialized != LABEL_INITIALIZED) {
 277                 if (!may_sleep)
 278                         return -ECHILD;
 279
 280                 /*
 281                  * Try reloading the inode security label.  This will fail if
 282                  * @opt_dentry is NULL and no dentry for this inode can be
 283                  * found; in that case, continue using the old label.
 284                  */
 285                 inode_doinit_with_dentry(inode, dentry);
 286         }
 287         return 0;
 288 }
 289
 290 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 291 {
 292         return selinux_inode(inode);
 293 }
 294
 295 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 296 {
 297         int error;
 298
 299         error = __inode_security_revalidate(inode, NULL, !rcu);
 300         if (error)
 301                 return ERR_PTR(error);
 302         return selinux_inode(inode);
 303 }
 304
 305 /*
 306  * Get the security label of an inode.
 307  */
 308 static struct inode_security_struct *inode_security(struct inode *inode)
 309 {
 310         __inode_security_revalidate(inode, NULL, true);
 311         return selinux_inode(inode);
 312 }
 313
 314 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 315 {
 316         struct inode *inode = d_backing_inode(dentry);
 317
 318         return selinux_inode(inode);
 319 }
 320
 321 /*
 322  * Get the security label of a dentry's backing inode.
 323  */
 324 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 325 {
 326         struct inode *inode = d_backing_inode(dentry);
 327
 328         __inode_security_revalidate(inode, dentry, true);
 329         return selinux_inode(inode);
 330 }
 331
 332 static void inode_free_security(struct inode *inode)
 333 {
 334         struct inode_security_struct *isec = selinux_inode(inode);
 335         struct superblock_security_struct *sbsec;
 336
 337         if (!isec)
 338                 return;
 339         sbsec = inode->i_sb->s_security;
 340         /*
 341          * As not all inode security structures are in a list, we check for
 342          * empty list outside of the lock to make sure that we won't waste
 343          * time taking a lock doing nothing.
 344          *
 345          * The list_del_init() function can be safely called more than once.
 346          * It should not be possible for this function to be called with
 347          * concurrent list_add(), but for better safety against future changes
 348          * in the code, we use list_empty_careful() here.
 349          */
 350         if (!list_empty_careful(&isec->list)) {
 351                 spin_lock(&sbsec->isec_lock);
 352                 list_del_init(&isec->list);
 353                 spin_unlock(&sbsec->isec_lock);
 354         }
 355 }
 356
 357 static int file_alloc_security(struct file *file)
 358 {
 359         struct file_security_struct *fsec = selinux_file(file);
 360         u32 sid = current_sid();
 361
 362         fsec->sid = sid;
 363         fsec->fown_sid = sid;
 364
 365         return 0;
 366 }
 367
 368 static int superblock_alloc_security(struct super_block *sb)
 369 {
 370         struct superblock_security_struct *sbsec;
 371
 372         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 373         if (!sbsec)
 374                 return -ENOMEM;
 375
 376         mutex_init(&sbsec->lock);
 377         INIT_LIST_HEAD(&sbsec->isec_head);
 378         spin_lock_init(&sbsec->isec_lock);
 379         sbsec->sb = sb;
 380         sbsec->sid = SECINITSID_UNLABELED;
 381         sbsec->def_sid = SECINITSID_FILE;
 382         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 383         sb->s_security = sbsec;
 384
 385         return 0;
 386 }
 387
 388 static void superblock_free_security(struct super_block *sb)
 389 {
 390         struct superblock_security_struct *sbsec = sb->s_security;
 391         sb->s_security = NULL;
 392         kfree(sbsec);
 393 }
 394
 395 struct selinux_mnt_opts {
 396         const char *fscontext, *context, *rootcontext, *defcontext;
 397 };
 398
 399 static void selinux_free_mnt_opts(void *mnt_opts)
 400 {
 401         struct selinux_mnt_opts *opts = mnt_opts;
 402         kfree(opts->fscontext);
 403         kfree(opts->context);
 404         kfree(opts->rootcontext);
 405         kfree(opts->defcontext);
 406         kfree(opts);
 407 }
 408
 409 static inline int inode_doinit(struct inode *inode)
 410 {
 411         return inode_doinit_with_dentry(inode, NULL);
 412 }
 413
 414 enum {
 415         Opt_error = -1,
 416         Opt_context = 0,
 417         Opt_defcontext = 1,
 418         Opt_fscontext = 2,
 419         Opt_rootcontext = 3,
 420         Opt_seclabel = 4,
 421 };
 422
 423 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 424 static struct {
 425         const char *name;
 426         int len;
 427         int opt;
 428         bool has_arg;
 429 } tokens[] = {
 430         A(context, true),
 431         A(fscontext, true),
 432         A(defcontext, true),
 433         A(rootcontext, true),
 434         A(seclabel, false),
 435 };
 436 #undef A
 437
 438 static int match_opt_prefix(char *s, int l, char **arg)
 439 {
 440         int i;
 441
 442         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 443                 size_t len = tokens[i].len;
 444                 if (len > l || memcmp(s, tokens[i].name, len))
 445                         continue;
 446                 if (tokens[i].has_arg) {
 447                         if (len == l || s[len] != '=')
 448                                 continue;
 449                         *arg = s + len + 1;
 450                 } else if (len != l)
 451                         continue;
 452                 return tokens[i].opt;
 453         }
 454         return Opt_error;
 455 }
 456
 457 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 458
 459 static int may_context_mount_sb_relabel(u32 sid,
 460                         struct superblock_security_struct *sbsec,
 461                         const struct cred *cred)
 462 {
 463         const struct task_security_struct *tsec = selinux_cred(cred);
 464         int rc;
 465
 466         rc = avc_has_perm(&selinux_state,
 467                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 468                           FILESYSTEM__RELABELFROM, NULL);
 469         if (rc)
 470                 return rc;
 471
 472         rc = avc_has_perm(&selinux_state,
 473                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 474                           FILESYSTEM__RELABELTO, NULL);
 475         return rc;
 476 }
 477
 478 static int may_context_mount_inode_relabel(u32 sid,
 479                         struct superblock_security_struct *sbsec,
 480                         const struct cred *cred)
 481 {
 482         const struct task_security_struct *tsec = selinux_cred(cred);
 483         int rc;
 484         rc = avc_has_perm(&selinux_state,
 485                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 486                           FILESYSTEM__RELABELFROM, NULL);
 487         if (rc)
 488                 return rc;
 489
 490         rc = avc_has_perm(&selinux_state,
 491                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 492                           FILESYSTEM__ASSOCIATE, NULL);
 493         return rc;
 494 }
 495
 496 static int selinux_is_genfs_special_handling(struct super_block *sb)
 497 {
 498         /* Special handling. Genfs but also in-core setxattr handler */
 499         return  !strcmp(sb->s_type->name, "sysfs") ||
 500                 !strcmp(sb->s_type->name, "pstore") ||
 501                 !strcmp(sb->s_type->name, "debugfs") ||
 502                 !strcmp(sb->s_type->name, "tracefs") ||
 503                 !strcmp(sb->s_type->name, "rootfs") ||
 504                 (selinux_policycap_cgroupseclabel() &&
 505                  (!strcmp(sb->s_type->name, "cgroup") ||
 506                   !strcmp(sb->s_type->name, "cgroup2")));
 507 }
 508
 509 static int selinux_is_sblabel_mnt(struct super_block *sb)
 510 {
 511         struct superblock_security_struct *sbsec = sb->s_security;
 512
 513         /*
 514          * IMPORTANT: Double-check logic in this function when adding a new
 515          * SECURITY_FS_USE_* definition!
 516          */
 517         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 518
 519         switch (sbsec->behavior) {
 520         case SECURITY_FS_USE_XATTR:
 521         case SECURITY_FS_USE_TRANS:
 522         case SECURITY_FS_USE_TASK:
 523         case SECURITY_FS_USE_NATIVE:
 524                 return 1;
 525
 526         case SECURITY_FS_USE_GENFS:
 527                 return selinux_is_genfs_special_handling(sb);
 528
 529         /* Never allow relabeling on context mounts */
 530         case SECURITY_FS_USE_MNTPOINT:
 531         case SECURITY_FS_USE_NONE:
 532         default:
 533                 return 0;
 534         }
 535 }
 536
 537 static int sb_finish_set_opts(struct super_block *sb)
 538 {
 539         struct superblock_security_struct *sbsec = sb->s_security;
 540         struct dentry *root = sb->s_root;
 541         struct inode *root_inode = d_backing_inode(root);
 542         int rc = 0;
 543
 544         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 545                 /* Make sure that the xattr handler exists and that no
 546                    error other than -ENODATA is returned by getxattr on
 547                    the root directory.  -ENODATA is ok, as this may be
 548                    the first boot of the SELinux kernel before we have
 549                    assigned xattr values to the filesystem. */
 550                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 551                         pr_warn("SELinux: (dev %s, type %s) has no "
 552                                "xattr support\n", sb->s_id, sb->s_type->name);
 553                         rc = -EOPNOTSUPP;
 554                         goto out;
 555                 }
 556
 557                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 558                 if (rc < 0 && rc != -ENODATA) {
 559                         if (rc == -EOPNOTSUPP)
 560                                 pr_warn("SELinux: (dev %s, type "
 561                                        "%s) has no security xattr handler\n",
 562                                        sb->s_id, sb->s_type->name);
 563                         else
 564                                 pr_warn("SELinux: (dev %s, type "
 565                                        "%s) getxattr errno %d\n", sb->s_id,
 566                                        sb->s_type->name, -rc);
 567                         goto out;
 568                 }
 569         }
 570
 571         sbsec->flags |= SE_SBINITIALIZED;
 572
 573         /*
 574          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 575          * leave the flag untouched because sb_clone_mnt_opts might be handing
 576          * us a superblock that needs the flag to be cleared.
 577          */
 578         if (selinux_is_sblabel_mnt(sb))
 579                 sbsec->flags |= SBLABEL_MNT;
 580         else
 581                 sbsec->flags &= ~SBLABEL_MNT;
 582
 583         /* Initialize the root inode. */
 584         rc = inode_doinit_with_dentry(root_inode, root);
 585
 586         /* Initialize any other inodes associated with the superblock, e.g.
 587            inodes created prior to initial policy load or inodes created
 588            during get_sb by a pseudo filesystem that directly
 589            populates itself. */
 590         spin_lock(&sbsec->isec_lock);
 591         while (!list_empty(&sbsec->isec_head)) {
 592                 struct inode_security_struct *isec =
 593                                 list_first_entry(&sbsec->isec_head,
 594                                            struct inode_security_struct, list);
 595                 struct inode *inode = isec->inode;
 596                 list_del_init(&isec->list);
 597                 spin_unlock(&sbsec->isec_lock);
 598                 inode = igrab(inode);
 599                 if (inode) {
 600                         if (!IS_PRIVATE(inode))
 601                                 inode_doinit(inode);
 602                         iput(inode);
 603                 }
 604                 spin_lock(&sbsec->isec_lock);
 605         }
 606         spin_unlock(&sbsec->isec_lock);
 607 out:
 608         return rc;
 609 }
 610
 611 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 612                       u32 old_sid, u32 new_sid)
 613 {
 614         char mnt_flags = sbsec->flags & SE_MNTMASK;
 615
 616         /* check if the old mount command had the same options */
 617         if (sbsec->flags & SE_SBINITIALIZED)
 618                 if (!(sbsec->flags & flag) ||
 619                     (old_sid != new_sid))
 620                         return 1;
 621
 622         /* check if we were passed the same options twice,
 623          * aka someone passed context=a,context=b
 624          */
 625         if (!(sbsec->flags & SE_SBINITIALIZED))
 626                 if (mnt_flags & flag)
 627                         return 1;
 628         return 0;
 629 }
 630
 631 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 632 {
 633         int rc = security_context_str_to_sid(&selinux_state, s,
 634                                              sid, GFP_KERNEL);
 635         if (rc)
 636                 pr_warn("SELinux: security_context_str_to_sid"
 637                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 638                        s, sb->s_id, sb->s_type->name, rc);
 639         return rc;
 640 }
 641
 642 /*
 643  * Allow filesystems with binary mount data to explicitly set mount point
 644  * labeling information.
 645  */
 646 static int selinux_set_mnt_opts(struct super_block *sb,
 647                                 void *mnt_opts,
 648                                 unsigned long kern_flags,
 649                                 unsigned long *set_kern_flags)
 650 {
 651         const struct cred *cred = current_cred();
 652         struct superblock_security_struct *sbsec = sb->s_security;
 653         struct dentry *root = sbsec->sb->s_root;
 654         struct selinux_mnt_opts *opts = mnt_opts;
 655         struct inode_security_struct *root_isec;
 656         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 657         u32 defcontext_sid = 0;
 658         int rc = 0;
 659
 660         mutex_lock(&sbsec->lock);
 661
 662         if (!selinux_state.initialized) {
 663                 if (!opts) {
 664                         /* Defer initialization until selinux_complete_init,
 665                            after the initial policy is loaded and the security
 666                            server is ready to handle calls. */
 667                         goto out;
 668                 }
 669                 rc = -EINVAL;
 670                 pr_warn("SELinux: Unable to set superblock options "
 671                         "before the security server is initialized\n");
 672                 goto out;
 673         }
 674         if (kern_flags && !set_kern_flags) {
 675                 /* Specifying internal flags without providing a place to
 676                  * place the results is not allowed */
 677                 rc = -EINVAL;
 678                 goto out;
 679         }
 680
 681         /*
 682          * Binary mount data FS will come through this function twice.  Once
 683          * from an explicit call and once from the generic calls from the vfs.
 684          * Since the generic VFS calls will not contain any security mount data
 685          * we need to skip the double mount verification.
 686          *
 687          * This does open a hole in which we will not notice if the first
 688          * mount using this sb set explict options and a second mount using
 689          * this sb does not set any security options.  (The first options
 690          * will be used for both mounts)
 691          */
 692         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 693             && !opts)
 694                 goto out;
 695
 696         root_isec = backing_inode_security_novalidate(root);
 697
 698         /*
 699          * parse the mount options, check if they are valid sids.
 700          * also check if someone is trying to mount the same sb more
 701          * than once with different security options.
 702          */
 703         if (opts) {
 704                 if (opts->fscontext) {
 705                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 706                         if (rc)
 707                                 goto out;
 708                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 709                                         fscontext_sid))
 710                                 goto out_double_mount;
 711                         sbsec->flags |= FSCONTEXT_MNT;
 712                 }
 713                 if (opts->context) {
 714                         rc = parse_sid(sb, opts->context, &context_sid);
 715                         if (rc)
 716                                 goto out;
 717                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 718                                         context_sid))
 719                                 goto out_double_mount;
 720                         sbsec->flags |= CONTEXT_MNT;
 721                 }
 722                 if (opts->rootcontext) {
 723                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 724                         if (rc)
 725                                 goto out;
 726                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 727                                         rootcontext_sid))
 728                                 goto out_double_mount;
 729                         sbsec->flags |= ROOTCONTEXT_MNT;
 730                 }
 731                 if (opts->defcontext) {
 732                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 733                         if (rc)
 734                                 goto out;
 735                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 736                                         defcontext_sid))
 737                                 goto out_double_mount;
 738                         sbsec->flags |= DEFCONTEXT_MNT;
 739                 }
 740         }
 741
 742         if (sbsec->flags & SE_SBINITIALIZED) {
 743                 /* previously mounted with options, but not on this attempt? */
 744                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 745                         goto out_double_mount;
 746                 rc = 0;
 747                 goto out;
 748         }
 749
 750         if (strcmp(sb->s_type->name, "proc") == 0)
 751                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 752
 753         if (!strcmp(sb->s_type->name, "debugfs") ||
 754             !strcmp(sb->s_type->name, "tracefs") ||
 755             !strcmp(sb->s_type->name, "pstore"))
 756                 sbsec->flags |= SE_SBGENFS;
 757
 758         if (!strcmp(sb->s_type->name, "sysfs") ||
 759             !strcmp(sb->s_type->name, "cgroup") ||
 760             !strcmp(sb->s_type->name, "cgroup2"))
 761                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 762
 763         if (!sbsec->behavior) {
 764                 /*
 765                  * Determine the labeling behavior to use for this
 766                  * filesystem type.
 767                  */
 768                 rc = security_fs_use(&selinux_state, sb);
 769                 if (rc) {
 770                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 771                                         __func__, sb->s_type->name, rc);
 772                         goto out;
 773                 }
 774         }
 775
 776         /*
 777          * If this is a user namespace mount and the filesystem type is not
 778          * explicitly whitelisted, then no contexts are allowed on the command
 779          * line and security labels must be ignored.
 780          */
 781         if (sb->s_user_ns != &init_user_ns &&
 782             strcmp(sb->s_type->name, "tmpfs") &&
 783             strcmp(sb->s_type->name, "ramfs") &&
 784             strcmp(sb->s_type->name, "devpts")) {
 785                 if (context_sid || fscontext_sid || rootcontext_sid ||
 786                     defcontext_sid) {
 787                         rc = -EACCES;
 788                         goto out;
 789                 }
 790                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 791                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 792                         rc = security_transition_sid(&selinux_state,
 793                                                      current_sid(),
 794                                                      current_sid(),
 795                                                      SECCLASS_FILE, NULL,
 796                                                      &sbsec->mntpoint_sid);
 797                         if (rc)
 798                                 goto out;
 799                 }
 800                 goto out_set_opts;
 801         }
 802
 803         /* sets the context of the superblock for the fs being mounted. */
 804         if (fscontext_sid) {
 805                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 806                 if (rc)
 807                         goto out;
 808
 809                 sbsec->sid = fscontext_sid;
 810         }
 811
 812         /*
 813          * Switch to using mount point labeling behavior.
 814          * sets the label used on all file below the mountpoint, and will set
 815          * the superblock context if not already set.
 816          */
 817         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 818                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 819                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 820         }
 821
 822         if (context_sid) {
 823                 if (!fscontext_sid) {
 824                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 825                                                           cred);
 826                         if (rc)
 827                                 goto out;
 828                         sbsec->sid = context_sid;
 829                 } else {
 830                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 831                                                              cred);
 832                         if (rc)
 833                                 goto out;
 834                 }
 835                 if (!rootcontext_sid)
 836                         rootcontext_sid = context_sid;
 837
 838                 sbsec->mntpoint_sid = context_sid;
 839                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 840         }
 841
 842         if (rootcontext_sid) {
 843                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 844                                                      cred);
 845                 if (rc)
 846                         goto out;
 847
 848                 root_isec->sid = rootcontext_sid;
 849                 root_isec->initialized = LABEL_INITIALIZED;
 850         }
 851
 852         if (defcontext_sid) {
 853                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 854                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 855                         rc = -EINVAL;
 856                         pr_warn("SELinux: defcontext option is "
 857                                "invalid for this filesystem type\n");
 858                         goto out;
 859                 }
 860
 861                 if (defcontext_sid != sbsec->def_sid) {
 862                         rc = may_context_mount_inode_relabel(defcontext_sid,
 863                                                              sbsec, cred);
 864                         if (rc)
 865                                 goto out;
 866                 }
 867
 868                 sbsec->def_sid = defcontext_sid;
 869         }
 870
 871 out_set_opts:
 872         rc = sb_finish_set_opts(sb);
 873 out:
 874         mutex_unlock(&sbsec->lock);
 875         return rc;
 876 out_double_mount:
 877         rc = -EINVAL;
 878         pr_warn("SELinux: mount invalid.  Same superblock, different "
 879                "security settings for (dev %s, type %s)\n", sb->s_id,
 880                sb->s_type->name);
 881         goto out;
 882 }
 883
 884 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 885                                     const struct super_block *newsb)
 886 {
 887         struct superblock_security_struct *old = oldsb->s_security;
 888         struct superblock_security_struct *new = newsb->s_security;
 889         char oldflags = old->flags & SE_MNTMASK;
 890         char newflags = new->flags & SE_MNTMASK;
 891
 892         if (oldflags != newflags)
 893                 goto mismatch;
 894         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 895                 goto mismatch;
 896         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 897                 goto mismatch;
 898         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 899                 goto mismatch;
 900         if (oldflags & ROOTCONTEXT_MNT) {
 901                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 902                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 903                 if (oldroot->sid != newroot->sid)
 904                         goto mismatch;
 905         }
 906         return 0;
 907 mismatch:
 908         pr_warn("SELinux: mount invalid.  Same superblock, "
 909                             "different security settings for (dev %s, "
 910                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 911         return -EBUSY;
 912 }
 913
 914 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 915                                         struct super_block *newsb,
 916                                         unsigned long kern_flags,
 917                                         unsigned long *set_kern_flags)
 918 {
 919         int rc = 0;
 920         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 921         struct superblock_security_struct *newsbsec = newsb->s_security;
 922
 923         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 924         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 925         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 926
 927         /*
 928          * if the parent was able to be mounted it clearly had no special lsm
 929          * mount options.  thus we can safely deal with this superblock later
 930          */
 931         if (!selinux_state.initialized)
 932                 return 0;
 933
 934         /*
 935          * Specifying internal flags without providing a place to
 936          * place the results is not allowed.
 937          */
 938         if (kern_flags && !set_kern_flags)
 939                 return -EINVAL;
 940
 941         /* how can we clone if the old one wasn't set up?? */
 942         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 943
 944         /* if fs is reusing a sb, make sure that the contexts match */
 945         if (newsbsec->flags & SE_SBINITIALIZED) {
 946                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 947                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 948                 return selinux_cmp_sb_context(oldsb, newsb);
 949         }
 950
 951         mutex_lock(&newsbsec->lock);
 952
 953         newsbsec->flags = oldsbsec->flags;
 954
 955         newsbsec->sid = oldsbsec->sid;
 956         newsbsec->def_sid = oldsbsec->def_sid;
 957         newsbsec->behavior = oldsbsec->behavior;
 958
 959         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 960                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 961                 rc = security_fs_use(&selinux_state, newsb);
 962                 if (rc)
 963                         goto out;
 964         }
 965
 966         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 967                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 968                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 969         }
 970
 971         if (set_context) {
 972                 u32 sid = oldsbsec->mntpoint_sid;
 973
 974                 if (!set_fscontext)
 975                         newsbsec->sid = sid;
 976                 if (!set_rootcontext) {
 977                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 978                         newisec->sid = sid;
 979                 }
 980                 newsbsec->mntpoint_sid = sid;
 981         }
 982         if (set_rootcontext) {
 983                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 984                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 985
 986                 newisec->sid = oldisec->sid;
 987         }
 988
 989         sb_finish_set_opts(newsb);
 990 out:
 991         mutex_unlock(&newsbsec->lock);
 992         return rc;
 993 }
 994
 995 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 996 {
 997         struct selinux_mnt_opts *opts = *mnt_opts;
 998
 999         if (token == Opt_seclabel)      /* eaten and completely ignored */
1000                 return 0;
1001
1002         if (!opts) {
1003                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1004                 if (!opts)
1005                         return -ENOMEM;
1006                 *mnt_opts = opts;
1007         }
1008         if (!s)
1009                 return -ENOMEM;
1010         switch (token) {
1011         case Opt_context:
1012                 if (opts->context || opts->defcontext)
1013                         goto Einval;
1014                 opts->context = s;
1015                 break;
1016         case Opt_fscontext:
1017                 if (opts->fscontext)
1018                         goto Einval;
1019                 opts->fscontext = s;
1020                 break;
1021         case Opt_rootcontext:
1022                 if (opts->rootcontext)
1023                         goto Einval;
1024                 opts->rootcontext = s;
1025                 break;
1026         case Opt_defcontext:
1027                 if (opts->context || opts->defcontext)
1028                         goto Einval;
1029                 opts->defcontext = s;
1030                 break;
1031         }
1032         return 0;
1033 Einval:
1034         pr_warn(SEL_MOUNT_FAIL_MSG);
1035         return -EINVAL;
1036 }
1037
1038 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1039                                void **mnt_opts)
1040 {
1041         int token = Opt_error;
1042         int rc, i;
1043
1044         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1045                 if (strcmp(option, tokens[i].name) == 0) {
1046                         token = tokens[i].opt;
1047                         break;
1048                 }
1049         }
1050
1051         if (token == Opt_error)
1052                 return -EINVAL;
1053
1054         if (token != Opt_seclabel) {
1055                 val = kmemdup_nul(val, len, GFP_KERNEL);
1056                 if (!val) {
1057                         rc = -ENOMEM;
1058                         goto free_opt;
1059                 }
1060         }
1061         rc = selinux_add_opt(token, val, mnt_opts);
1062         if (unlikely(rc)) {
1063                 kfree(val);
1064                 goto free_opt;
1065         }
1066         return rc;
1067
1068 free_opt:
1069         if (*mnt_opts) {
1070                 selinux_free_mnt_opts(*mnt_opts);
1071                 *mnt_opts = NULL;
1072         }
1073         return rc;
1074 }
1075
1076 static int show_sid(struct seq_file *m, u32 sid)
1077 {
1078         char *context = NULL;
1079         u32 len;
1080         int rc;
1081
1082         rc = security_sid_to_context(&selinux_state, sid,
1083                                              &context, &len);
1084         if (!rc) {
1085                 bool has_comma = context && strchr(context, ',');
1086
1087                 seq_putc(m, '=');
1088                 if (has_comma)
1089                         seq_putc(m, '\"');
1090                 seq_escape(m, context, "\"\n\\");
1091                 if (has_comma)
1092                         seq_putc(m, '\"');
1093         }
1094         kfree(context);
1095         return rc;
1096 }
1097
1098 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1099 {
1100         struct superblock_security_struct *sbsec = sb->s_security;
1101         int rc;
1102
1103         if (!(sbsec->flags & SE_SBINITIALIZED))
1104                 return 0;
1105
1106         if (!selinux_state.initialized)
1107                 return 0;
1108
1109         if (sbsec->flags & FSCONTEXT_MNT) {
1110                 seq_putc(m, ',');
1111                 seq_puts(m, FSCONTEXT_STR);
1112                 rc = show_sid(m, sbsec->sid);
1113                 if (rc)
1114                         return rc;
1115         }
1116         if (sbsec->flags & CONTEXT_MNT) {
1117                 seq_putc(m, ',');
1118                 seq_puts(m, CONTEXT_STR);
1119                 rc = show_sid(m, sbsec->mntpoint_sid);
1120                 if (rc)
1121                         return rc;
1122         }
1123         if (sbsec->flags & DEFCONTEXT_MNT) {
1124                 seq_putc(m, ',');
1125                 seq_puts(m, DEFCONTEXT_STR);
1126                 rc = show_sid(m, sbsec->def_sid);
1127                 if (rc)
1128                         return rc;
1129         }
1130         if (sbsec->flags & ROOTCONTEXT_MNT) {
1131                 struct dentry *root = sbsec->sb->s_root;
1132                 struct inode_security_struct *isec = backing_inode_security(root);
1133                 seq_putc(m, ',');
1134                 seq_puts(m, ROOTCONTEXT_STR);
1135                 rc = show_sid(m, isec->sid);
1136                 if (rc)
1137                         return rc;
1138         }
1139         if (sbsec->flags & SBLABEL_MNT) {
1140                 seq_putc(m, ',');
1141                 seq_puts(m, SECLABEL_STR);
1142         }
1143         return 0;
1144 }
1145
1146 static inline u16 inode_mode_to_security_class(umode_t mode)
1147 {
1148         switch (mode & S_IFMT) {
1149         case S_IFSOCK:
1150                 return SECCLASS_SOCK_FILE;
1151         case S_IFLNK:
1152                 return SECCLASS_LNK_FILE;
1153         case S_IFREG:
1154                 return SECCLASS_FILE;
1155         case S_IFBLK:
1156                 return SECCLASS_BLK_FILE;
1157         case S_IFDIR:
1158                 return SECCLASS_DIR;
1159         case S_IFCHR:
1160                 return SECCLASS_CHR_FILE;
1161         case S_IFIFO:
1162                 return SECCLASS_FIFO_FILE;
1163
1164         }
1165
1166         return SECCLASS_FILE;
1167 }
1168
1169 static inline int default_protocol_stream(int protocol)
1170 {
1171         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1172 }
1173
1174 static inline int default_protocol_dgram(int protocol)
1175 {
1176         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1177 }
1178
1179 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1180 {
1181         int extsockclass = selinux_policycap_extsockclass();
1182
1183         switch (family) {
1184         case PF_UNIX:
1185                 switch (type) {
1186                 case SOCK_STREAM:
1187                 case SOCK_SEQPACKET:
1188                         return SECCLASS_UNIX_STREAM_SOCKET;
1189                 case SOCK_DGRAM:
1190                 case SOCK_RAW:
1191                         return SECCLASS_UNIX_DGRAM_SOCKET;
1192                 }
1193                 break;
1194         case PF_INET:
1195         case PF_INET6:
1196                 switch (type) {
1197                 case SOCK_STREAM:
1198                 case SOCK_SEQPACKET:
1199                         if (default_protocol_stream(protocol))
1200                                 return SECCLASS_TCP_SOCKET;
1201                         else if (extsockclass && protocol == IPPROTO_SCTP)
1202                                 return SECCLASS_SCTP_SOCKET;
1203                         else
1204                                 return SECCLASS_RAWIP_SOCKET;
1205                 case SOCK_DGRAM:
1206                         if (default_protocol_dgram(protocol))
1207                                 return SECCLASS_UDP_SOCKET;
1208                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1209                                                   protocol == IPPROTO_ICMPV6))
1210                                 return SECCLASS_ICMP_SOCKET;
1211                         else
1212                                 return SECCLASS_RAWIP_SOCKET;
1213                 case SOCK_DCCP:
1214                         return SECCLASS_DCCP_SOCKET;
1215                 default:
1216                         return SECCLASS_RAWIP_SOCKET;
1217                 }
1218                 break;
1219         case PF_NETLINK:
1220                 switch (protocol) {
1221                 case NETLINK_ROUTE:
1222                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1223                 case NETLINK_SOCK_DIAG:
1224                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1225                 case NETLINK_NFLOG:
1226                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1227                 case NETLINK_XFRM:
1228                         return SECCLASS_NETLINK_XFRM_SOCKET;
1229                 case NETLINK_SELINUX:
1230                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1231                 case NETLINK_ISCSI:
1232                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1233                 case NETLINK_AUDIT:
1234                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1235                 case NETLINK_FIB_LOOKUP:
1236                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1237                 case NETLINK_CONNECTOR:
1238                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1239                 case NETLINK_NETFILTER:
1240                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1241                 case NETLINK_DNRTMSG:
1242                         return SECCLASS_NETLINK_DNRT_SOCKET;
1243                 case NETLINK_KOBJECT_UEVENT:
1244                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1245                 case NETLINK_GENERIC:
1246                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1247                 case NETLINK_SCSITRANSPORT:
1248                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1249                 case NETLINK_RDMA:
1250                         return SECCLASS_NETLINK_RDMA_SOCKET;
1251                 case NETLINK_CRYPTO:
1252                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1253                 default:
1254                         return SECCLASS_NETLINK_SOCKET;
1255                 }
1256         case PF_PACKET:
1257                 return SECCLASS_PACKET_SOCKET;
1258         case PF_KEY:
1259                 return SECCLASS_KEY_SOCKET;
1260         case PF_APPLETALK:
1261                 return SECCLASS_APPLETALK_SOCKET;
1262         }
1263
1264         if (extsockclass) {
1265                 switch (family) {
1266                 case PF_AX25:
1267                         return SECCLASS_AX25_SOCKET;
1268                 case PF_IPX:
1269                         return SECCLASS_IPX_SOCKET;
1270                 case PF_NETROM:
1271                         return SECCLASS_NETROM_SOCKET;
1272                 case PF_ATMPVC:
1273                         return SECCLASS_ATMPVC_SOCKET;
1274                 case PF_X25:
1275                         return SECCLASS_X25_SOCKET;
1276                 case PF_ROSE:
1277                         return SECCLASS_ROSE_SOCKET;
1278                 case PF_DECnet:
1279                         return SECCLASS_DECNET_SOCKET;
1280                 case PF_ATMSVC:
1281                         return SECCLASS_ATMSVC_SOCKET;
1282                 case PF_RDS:
1283                         return SECCLASS_RDS_SOCKET;
1284                 case PF_IRDA:
1285                         return SECCLASS_IRDA_SOCKET;
1286                 case PF_PPPOX:
1287                         return SECCLASS_PPPOX_SOCKET;
1288                 case PF_LLC:
1289                         return SECCLASS_LLC_SOCKET;
1290                 case PF_CAN:
1291                         return SECCLASS_CAN_SOCKET;
1292                 case PF_TIPC:
1293                         return SECCLASS_TIPC_SOCKET;
1294                 case PF_BLUETOOTH:
1295                         return SECCLASS_BLUETOOTH_SOCKET;
1296                 case PF_IUCV:
1297                         return SECCLASS_IUCV_SOCKET;
1298                 case PF_RXRPC:
1299                         return SECCLASS_RXRPC_SOCKET;
1300                 case PF_ISDN:
1301                         return SECCLASS_ISDN_SOCKET;
1302                 case PF_PHONET:
1303                         return SECCLASS_PHONET_SOCKET;
1304                 case PF_IEEE802154:
1305                         return SECCLASS_IEEE802154_SOCKET;
1306                 case PF_CAIF:
1307                         return SECCLASS_CAIF_SOCKET;
1308                 case PF_ALG:
1309                         return SECCLASS_ALG_SOCKET;
1310                 case PF_NFC:
1311                         return SECCLASS_NFC_SOCKET;
1312                 case PF_VSOCK:
1313                         return SECCLASS_VSOCK_SOCKET;
1314                 case PF_KCM:
1315                         return SECCLASS_KCM_SOCKET;
1316                 case PF_QIPCRTR:
1317                         return SECCLASS_QIPCRTR_SOCKET;
1318                 case PF_SMC:
1319                         return SECCLASS_SMC_SOCKET;
1320                 case PF_XDP:
1321                         return SECCLASS_XDP_SOCKET;
1322 #if PF_MAX > 45
1323 #error New address family defined, please update this function.
1324 #endif
1325                 }
1326         }
1327
1328         return SECCLASS_SOCKET;
1329 }
1330
1331 static int selinux_genfs_get_sid(struct dentry *dentry,
1332                                  u16 tclass,
1333                                  u16 flags,
1334                                  u32 *sid)
1335 {
1336         int rc;
1337         struct super_block *sb = dentry->d_sb;
1338         char *buffer, *path;
1339
1340         buffer = (char *)__get_free_page(GFP_KERNEL);
1341         if (!buffer)
1342                 return -ENOMEM;
1343
1344         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1345         if (IS_ERR(path))
1346                 rc = PTR_ERR(path);
1347         else {
1348                 if (flags & SE_SBPROC) {
1349                         /* each process gets a /proc/PID/ entry. Strip off the
1350                          * PID part to get a valid selinux labeling.
1351                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1352                         while (path[1] >= '0' && path[1] <= '9') {
1353                                 path[1] = '/';
1354                                 path++;
1355                         }
1356                 }
1357                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1358                                         path, tclass, sid);
1359                 if (rc == -ENOENT) {
1360                         /* No match in policy, mark as unlabeled. */
1361                         *sid = SECINITSID_UNLABELED;
1362                         rc = 0;
1363                 }
1364         }
1365         free_page((unsigned long)buffer);
1366         return rc;
1367 }
1368
1369 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1370                                   u32 def_sid, u32 *sid)
1371 {
1372 #define INITCONTEXTLEN 255
1373         char *context;
1374         unsigned int len;
1375         int rc;
1376
1377         len = INITCONTEXTLEN;
1378         context = kmalloc(len + 1, GFP_NOFS);
1379         if (!context)
1380                 return -ENOMEM;
1381
1382         context[len] = '\0';
1383         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1384         if (rc == -ERANGE) {
1385                 kfree(context);
1386
1387                 /* Need a larger buffer.  Query for the right size. */
1388                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1389                 if (rc < 0)
1390                         return rc;
1391
1392                 len = rc;
1393                 context = kmalloc(len + 1, GFP_NOFS);
1394                 if (!context)
1395                         return -ENOMEM;
1396
1397                 context[len] = '\0';
1398                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1399                                     context, len);
1400         }
1401         if (rc < 0) {
1402                 kfree(context);
1403                 if (rc != -ENODATA) {
1404                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1405                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1406                         return rc;
1407                 }
1408                 *sid = def_sid;
1409                 return 0;
1410         }
1411
1412         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1413                                              def_sid, GFP_NOFS);
1414         if (rc) {
1415                 char *dev = inode->i_sb->s_id;
1416                 unsigned long ino = inode->i_ino;
1417
1418                 if (rc == -EINVAL) {
1419                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1420                                               ino, dev, context);
1421                 } else {
1422                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1423                                 __func__, context, -rc, dev, ino);
1424                 }
1425         }
1426         kfree(context);
1427         return 0;
1428 }
1429
1430 /* The inode's security attributes must be initialized before first use. */
1431 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1432 {
1433         struct superblock_security_struct *sbsec = NULL;
1434         struct inode_security_struct *isec = selinux_inode(inode);
1435         u32 task_sid, sid = 0;
1436         u16 sclass;
1437         struct dentry *dentry;
1438         int rc = 0;
1439
1440         if (isec->initialized == LABEL_INITIALIZED)
1441                 return 0;
1442
1443         spin_lock(&isec->lock);
1444         if (isec->initialized == LABEL_INITIALIZED)
1445                 goto out_unlock;
1446
1447         if (isec->sclass == SECCLASS_FILE)
1448                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1449
1450         sbsec = inode->i_sb->s_security;
1451         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1452                 /* Defer initialization until selinux_complete_init,
1453                    after the initial policy is loaded and the security
1454                    server is ready to handle calls. */
1455                 spin_lock(&sbsec->isec_lock);
1456                 if (list_empty(&isec->list))
1457                         list_add(&isec->list, &sbsec->isec_head);
1458                 spin_unlock(&sbsec->isec_lock);
1459                 goto out_unlock;
1460         }
1461
1462         sclass = isec->sclass;
1463         task_sid = isec->task_sid;
1464         sid = isec->sid;
1465         isec->initialized = LABEL_PENDING;
1466         spin_unlock(&isec->lock);
1467
1468         switch (sbsec->behavior) {
1469         case SECURITY_FS_USE_NATIVE:
1470                 break;
1471         case SECURITY_FS_USE_XATTR:
1472                 if (!(inode->i_opflags & IOP_XATTR)) {
1473                         sid = sbsec->def_sid;
1474                         break;
1475                 }
1476                 /* Need a dentry, since the xattr API requires one.
1477                    Life would be simpler if we could just pass the inode. */
1478                 if (opt_dentry) {
1479                         /* Called from d_instantiate or d_splice_alias. */
1480                         dentry = dget(opt_dentry);
1481                 } else {
1482                         /*
1483                          * Called from selinux_complete_init, try to find a dentry.
1484                          * Some filesystems really want a connected one, so try
1485                          * that first.  We could split SECURITY_FS_USE_XATTR in
1486                          * two, depending upon that...
1487                          */
1488                         dentry = d_find_alias(inode);
1489                         if (!dentry)
1490                                 dentry = d_find_any_alias(inode);
1491                 }
1492                 if (!dentry) {
1493                         /*
1494                          * this is can be hit on boot when a file is accessed
1495                          * before the policy is loaded.  When we load policy we
1496                          * may find inodes that have no dentry on the
1497                          * sbsec->isec_head list.  No reason to complain as these
1498                          * will get fixed up the next time we go through
1499                          * inode_doinit with a dentry, before these inodes could
1500                          * be used again by userspace.
1501                          */
1502                         goto out;
1503                 }
1504
1505                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1506                                             &sid);
1507                 dput(dentry);
1508                 if (rc)
1509                         goto out;
1510                 break;
1511         case SECURITY_FS_USE_TASK:
1512                 sid = task_sid;
1513                 break;
1514         case SECURITY_FS_USE_TRANS:
1515                 /* Default to the fs SID. */
1516                 sid = sbsec->sid;
1517
1518                 /* Try to obtain a transition SID. */
1519                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1520                                              sclass, NULL, &sid);
1521                 if (rc)
1522                         goto out;
1523                 break;
1524         case SECURITY_FS_USE_MNTPOINT:
1525                 sid = sbsec->mntpoint_sid;
1526                 break;
1527         default:
1528                 /* Default to the fs superblock SID. */
1529                 sid = sbsec->sid;
1530
1531                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1532                         /* We must have a dentry to determine the label on
1533                          * procfs inodes */
1534                         if (opt_dentry) {
1535                                 /* Called from d_instantiate or
1536                                  * d_splice_alias. */
1537                                 dentry = dget(opt_dentry);
1538                         } else {
1539                                 /* Called from selinux_complete_init, try to
1540                                  * find a dentry.  Some filesystems really want
1541                                  * a connected one, so try that first.
1542                                  */
1543                                 dentry = d_find_alias(inode);
1544                                 if (!dentry)
1545                                         dentry = d_find_any_alias(inode);
1546                         }
1547                         /*
1548                          * This can be hit on boot when a file is accessed
1549                          * before the policy is loaded.  When we load policy we
1550                          * may find inodes that have no dentry on the
1551                          * sbsec->isec_head list.  No reason to complain as
1552                          * these will get fixed up the next time we go through
1553                          * inode_doinit() with a dentry, before these inodes
1554                          * could be used again by userspace.
1555                          */
1556                         if (!dentry)
1557                                 goto out;
1558                         rc = selinux_genfs_get_sid(dentry, sclass,
1559                                                    sbsec->flags, &sid);
1560                         if (rc) {
1561                                 dput(dentry);
1562                                 goto out;
1563                         }
1564
1565                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1566                             (inode->i_opflags & IOP_XATTR)) {
1567                                 rc = inode_doinit_use_xattr(inode, dentry,
1568                                                             sid, &sid);
1569                                 if (rc) {
1570                                         dput(dentry);
1571                                         goto out;
1572                                 }
1573                         }
1574                         dput(dentry);
1575                 }
1576                 break;
1577         }
1578
1579 out:
1580         spin_lock(&isec->lock);
1581         if (isec->initialized == LABEL_PENDING) {
1582                 if (!sid || rc) {
1583                         isec->initialized = LABEL_INVALID;
1584                         goto out_unlock;
1585                 }
1586
1587                 isec->initialized = LABEL_INITIALIZED;
1588                 isec->sid = sid;
1589         }
1590
1591 out_unlock:
1592         spin_unlock(&isec->lock);
1593         return rc;
1594 }
1595
1596 /* Convert a Linux signal to an access vector. */
1597 static inline u32 signal_to_av(int sig)
1598 {
1599         u32 perm = 0;
1600
1601         switch (sig) {
1602         case SIGCHLD:
1603                 /* Commonly granted from child to parent. */
1604                 perm = PROCESS__SIGCHLD;
1605                 break;
1606         case SIGKILL:
1607                 /* Cannot be caught or ignored */
1608                 perm = PROCESS__SIGKILL;
1609                 break;
1610         case SIGSTOP:
1611                 /* Cannot be caught or ignored */
1612                 perm = PROCESS__SIGSTOP;
1613                 break;
1614         default:
1615                 /* All other signals. */
1616                 perm = PROCESS__SIGNAL;
1617                 break;
1618         }
1619
1620         return perm;
1621 }
1622
1623 #if CAP_LAST_CAP > 63
1624 #error Fix SELinux to handle capabilities > 63.
1625 #endif
1626
1627 /* Check whether a task is allowed to use a capability. */
1628 static int cred_has_capability(const struct cred *cred,
1629                                int cap, unsigned int opts, bool initns)
1630 {
1631         struct common_audit_data ad;
1632         struct av_decision avd;
1633         u16 sclass;
1634         u32 sid = cred_sid(cred);
1635         u32 av = CAP_TO_MASK(cap);
1636         int rc;
1637
1638         ad.type = LSM_AUDIT_DATA_CAP;
1639         ad.u.cap = cap;
1640
1641         switch (CAP_TO_INDEX(cap)) {
1642         case 0:
1643                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1644                 break;
1645         case 1:
1646                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1647                 break;
1648         default:
1649                 pr_err("SELinux:  out of range capability %d\n", cap);
1650                 BUG();
1651                 return -EINVAL;
1652         }
1653
1654         rc = avc_has_perm_noaudit(&selinux_state,
1655                                   sid, sid, sclass, av, 0, &avd);
1656         if (!(opts & CAP_OPT_NOAUDIT)) {
1657                 int rc2 = avc_audit(&selinux_state,
1658                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1659                 if (rc2)
1660                         return rc2;
1661         }
1662         return rc;
1663 }
1664
1665 /* Check whether a task has a particular permission to an inode.
1666    The 'adp' parameter is optional and allows other audit
1667    data to be passed (e.g. the dentry). */
1668 static int inode_has_perm(const struct cred *cred,
1669                           struct inode *inode,
1670                           u32 perms,
1671                           struct common_audit_data *adp)
1672 {
1673         struct inode_security_struct *isec;
1674         u32 sid;
1675
1676         validate_creds(cred);
1677
1678         if (unlikely(IS_PRIVATE(inode)))
1679                 return 0;
1680
1681         sid = cred_sid(cred);
1682         isec = selinux_inode(inode);
1683
1684         return avc_has_perm(&selinux_state,
1685                             sid, isec->sid, isec->sclass, perms, adp);
1686 }
1687
1688 /* Same as inode_has_perm, but pass explicit audit data containing
1689    the dentry to help the auditing code to more easily generate the
1690    pathname if needed. */
1691 static inline int dentry_has_perm(const struct cred *cred,
1692                                   struct dentry *dentry,
1693                                   u32 av)
1694 {
1695         struct inode *inode = d_backing_inode(dentry);
1696         struct common_audit_data ad;
1697
1698         ad.type = LSM_AUDIT_DATA_DENTRY;
1699         ad.u.dentry = dentry;
1700         __inode_security_revalidate(inode, dentry, true);
1701         return inode_has_perm(cred, inode, av, &ad);
1702 }
1703
1704 /* Same as inode_has_perm, but pass explicit audit data containing
1705    the path to help the auditing code to more easily generate the
1706    pathname if needed. */
1707 static inline int path_has_perm(const struct cred *cred,
1708                                 const struct path *path,
1709                                 u32 av)
1710 {
1711         struct inode *inode = d_backing_inode(path->dentry);
1712         struct common_audit_data ad;
1713
1714         ad.type = LSM_AUDIT_DATA_PATH;
1715         ad.u.path = *path;
1716         __inode_security_revalidate(inode, path->dentry, true);
1717         return inode_has_perm(cred, inode, av, &ad);
1718 }
1719
1720 /* Same as path_has_perm, but uses the inode from the file struct. */
1721 static inline int file_path_has_perm(const struct cred *cred,
1722                                      struct file *file,
1723                                      u32 av)
1724 {
1725         struct common_audit_data ad;
1726
1727         ad.type = LSM_AUDIT_DATA_FILE;
1728         ad.u.file = file;
1729         return inode_has_perm(cred, file_inode(file), av, &ad);
1730 }
1731
1732 #ifdef CONFIG_BPF_SYSCALL
1733 static int bpf_fd_pass(struct file *file, u32 sid);
1734 #endif
1735
1736 /* Check whether a task can use an open file descriptor to
1737    access an inode in a given way.  Check access to the
1738    descriptor itself, and then use dentry_has_perm to
1739    check a particular permission to the file.
1740    Access to the descriptor is implicitly granted if it
1741    has the same SID as the process.  If av is zero, then
1742    access to the file is not checked, e.g. for cases
1743    where only the descriptor is affected like seek. */
1744 static int file_has_perm(const struct cred *cred,
1745                          struct file *file,
1746                          u32 av)
1747 {
1748         struct file_security_struct *fsec = selinux_file(file);
1749         struct inode *inode = file_inode(file);
1750         struct common_audit_data ad;
1751         u32 sid = cred_sid(cred);
1752         int rc;
1753
1754         ad.type = LSM_AUDIT_DATA_FILE;
1755         ad.u.file = file;
1756
1757         if (sid != fsec->sid) {
1758                 rc = avc_has_perm(&selinux_state,
1759                                   sid, fsec->sid,
1760                                   SECCLASS_FD,
1761                                   FD__USE,
1762                                   &ad);
1763                 if (rc)
1764                         goto out;
1765         }
1766
1767 #ifdef CONFIG_BPF_SYSCALL
1768         rc = bpf_fd_pass(file, cred_sid(cred));
1769         if (rc)
1770                 return rc;
1771 #endif
1772
1773         /* av is zero if only checking access to the descriptor. */
1774         rc = 0;
1775         if (av)
1776                 rc = inode_has_perm(cred, inode, av, &ad);
1777
1778 out:
1779         return rc;
1780 }
1781
1782 /*
1783  * Determine the label for an inode that might be unioned.
1784  */
1785 static int
1786 selinux_determine_inode_label(const struct task_security_struct *tsec,
1787                                  struct inode *dir,
1788                                  const struct qstr *name, u16 tclass,
1789                                  u32 *_new_isid)
1790 {
1791         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1792
1793         if ((sbsec->flags & SE_SBINITIALIZED) &&
1794             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1795                 *_new_isid = sbsec->mntpoint_sid;
1796         } else if ((sbsec->flags & SBLABEL_MNT) &&
1797                    tsec->create_sid) {
1798                 *_new_isid = tsec->create_sid;
1799         } else {
1800                 const struct inode_security_struct *dsec = inode_security(dir);
1801                 return security_transition_sid(&selinux_state, tsec->sid,
1802                                                dsec->sid, tclass,
1803                                                name, _new_isid);
1804         }
1805
1806         return 0;
1807 }
1808
1809 /* Check whether a task can create a file. */
1810 static int may_create(struct inode *dir,
1811                       struct dentry *dentry,
1812                       u16 tclass)
1813 {
1814         const struct task_security_struct *tsec = selinux_cred(current_cred());
1815         struct inode_security_struct *dsec;
1816         struct superblock_security_struct *sbsec;
1817         u32 sid, newsid;
1818         struct common_audit_data ad;
1819         int rc;
1820
1821         dsec = inode_security(dir);
1822         sbsec = dir->i_sb->s_security;
1823
1824         sid = tsec->sid;
1825
1826         ad.type = LSM_AUDIT_DATA_DENTRY;
1827         ad.u.dentry = dentry;
1828
1829         rc = avc_has_perm(&selinux_state,
1830                           sid, dsec->sid, SECCLASS_DIR,
1831                           DIR__ADD_NAME | DIR__SEARCH,
1832                           &ad);
1833         if (rc)
1834                 return rc;
1835
1836         rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1837                                            &dentry->d_name, tclass, &newsid);
1838         if (rc)
1839                 return rc;
1840
1841         rc = avc_has_perm(&selinux_state,
1842                           sid, newsid, tclass, FILE__CREATE, &ad);
1843         if (rc)
1844                 return rc;
1845
1846         return avc_has_perm(&selinux_state,
1847                             newsid, sbsec->sid,
1848                             SECCLASS_FILESYSTEM,
1849                             FILESYSTEM__ASSOCIATE, &ad);
1850 }
1851
1852 #define MAY_LINK        0
1853 #define MAY_UNLINK      1
1854 #define MAY_RMDIR       2
1855
1856 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1857 static int may_link(struct inode *dir,
1858                     struct dentry *dentry,
1859                     int kind)
1860
1861 {
1862         struct inode_security_struct *dsec, *isec;
1863         struct common_audit_data ad;
1864         u32 sid = current_sid();
1865         u32 av;
1866         int rc;
1867
1868         dsec = inode_security(dir);
1869         isec = backing_inode_security(dentry);
1870
1871         ad.type = LSM_AUDIT_DATA_DENTRY;
1872         ad.u.dentry = dentry;
1873
1874         av = DIR__SEARCH;
1875         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1876         rc = avc_has_perm(&selinux_state,
1877                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1878         if (rc)
1879                 return rc;
1880
1881         switch (kind) {
1882         case MAY_LINK:
1883                 av = FILE__LINK;
1884                 break;
1885         case MAY_UNLINK:
1886                 av = FILE__UNLINK;
1887                 break;
1888         case MAY_RMDIR:
1889                 av = DIR__RMDIR;
1890                 break;
1891         default:
1892                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1893                         __func__, kind);
1894                 return 0;
1895         }
1896
1897         rc = avc_has_perm(&selinux_state,
1898                           sid, isec->sid, isec->sclass, av, &ad);
1899         return rc;
1900 }
1901
1902 static inline int may_rename(struct inode *old_dir,
1903                              struct dentry *old_dentry,
1904                              struct inode *new_dir,
1905                              struct dentry *new_dentry)
1906 {
1907         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1908         struct common_audit_data ad;
1909         u32 sid = current_sid();
1910         u32 av;
1911         int old_is_dir, new_is_dir;
1912         int rc;
1913
1914         old_dsec = inode_security(old_dir);
1915         old_isec = backing_inode_security(old_dentry);
1916         old_is_dir = d_is_dir(old_dentry);
1917         new_dsec = inode_security(new_dir);
1918
1919         ad.type = LSM_AUDIT_DATA_DENTRY;
1920
1921         ad.u.dentry = old_dentry;
1922         rc = avc_has_perm(&selinux_state,
1923                           sid, old_dsec->sid, SECCLASS_DIR,
1924                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1925         if (rc)
1926                 return rc;
1927         rc = avc_has_perm(&selinux_state,
1928                           sid, old_isec->sid,
1929                           old_isec->sclass, FILE__RENAME, &ad);
1930         if (rc)
1931                 return rc;
1932         if (old_is_dir && new_dir != old_dir) {
1933                 rc = avc_has_perm(&selinux_state,
1934                                   sid, old_isec->sid,
1935                                   old_isec->sclass, DIR__REPARENT, &ad);
1936                 if (rc)
1937                         return rc;
1938         }
1939
1940         ad.u.dentry = new_dentry;
1941         av = DIR__ADD_NAME | DIR__SEARCH;
1942         if (d_is_positive(new_dentry))
1943                 av |= DIR__REMOVE_NAME;
1944         rc = avc_has_perm(&selinux_state,
1945                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1946         if (rc)
1947                 return rc;
1948         if (d_is_positive(new_dentry)) {
1949                 new_isec = backing_inode_security(new_dentry);
1950                 new_is_dir = d_is_dir(new_dentry);
1951                 rc = avc_has_perm(&selinux_state,
1952                                   sid, new_isec->sid,
1953                                   new_isec->sclass,
1954                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1955                 if (rc)
1956                         return rc;
1957         }
1958
1959         return 0;
1960 }
1961
1962 /* Check whether a task can perform a filesystem operation. */
1963 static int superblock_has_perm(const struct cred *cred,
1964                                struct super_block *sb,
1965                                u32 perms,
1966                                struct common_audit_data *ad)
1967 {
1968         struct superblock_security_struct *sbsec;
1969         u32 sid = cred_sid(cred);
1970
1971         sbsec = sb->s_security;
1972         return avc_has_perm(&selinux_state,
1973                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1974 }
1975
1976 /* Convert a Linux mode and permission mask to an access vector. */
1977 static inline u32 file_mask_to_av(int mode, int mask)
1978 {
1979         u32 av = 0;
1980
1981         if (!S_ISDIR(mode)) {
1982                 if (mask & MAY_EXEC)
1983                         av |= FILE__EXECUTE;
1984                 if (mask & MAY_READ)
1985                         av |= FILE__READ;
1986
1987                 if (mask & MAY_APPEND)
1988                         av |= FILE__APPEND;
1989                 else if (mask & MAY_WRITE)
1990                         av |= FILE__WRITE;
1991
1992         } else {
1993                 if (mask & MAY_EXEC)
1994                         av |= DIR__SEARCH;
1995                 if (mask & MAY_WRITE)
1996                         av |= DIR__WRITE;
1997                 if (mask & MAY_READ)
1998                         av |= DIR__READ;
1999         }
2000
2001         return av;
2002 }
2003
2004 /* Convert a Linux file to an access vector. */
2005 static inline u32 file_to_av(struct file *file)
2006 {
2007         u32 av = 0;
2008
2009         if (file->f_mode & FMODE_READ)
2010                 av |= FILE__READ;
2011         if (file->f_mode & FMODE_WRITE) {
2012                 if (file->f_flags & O_APPEND)
2013                         av |= FILE__APPEND;
2014                 else
2015                         av |= FILE__WRITE;
2016         }
2017         if (!av) {
2018                 /*
2019                  * Special file opened with flags 3 for ioctl-only use.
2020                  */
2021                 av = FILE__IOCTL;
2022         }
2023
2024         return av;
2025 }
2026
2027 /*
2028  * Convert a file to an access vector and include the correct open
2029  * open permission.
2030  */
2031 static inline u32 open_file_to_av(struct file *file)
2032 {
2033         u32 av = file_to_av(file);
2034         struct inode *inode = file_inode(file);
2035
2036         if (selinux_policycap_openperm() &&
2037             inode->i_sb->s_magic != SOCKFS_MAGIC)
2038                 av |= FILE__OPEN;
2039
2040         return av;
2041 }
2042
2043 /* Hook functions begin here. */
2044
2045 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2046 {
2047         u32 mysid = current_sid();
2048         u32 mgrsid = task_sid(mgr);
2049
2050         return avc_has_perm(&selinux_state,
2051                             mysid, mgrsid, SECCLASS_BINDER,
2052                             BINDER__SET_CONTEXT_MGR, NULL);
2053 }
2054
2055 static int selinux_binder_transaction(struct task_struct *from,
2056                                       struct task_struct *to)
2057 {
2058         u32 mysid = current_sid();
2059         u32 fromsid = task_sid(from);
2060         u32 tosid = task_sid(to);
2061         int rc;
2062
2063         if (mysid != fromsid) {
2064                 rc = avc_has_perm(&selinux_state,
2065                                   mysid, fromsid, SECCLASS_BINDER,
2066                                   BINDER__IMPERSONATE, NULL);
2067                 if (rc)
2068                         return rc;
2069         }
2070
2071         return avc_has_perm(&selinux_state,
2072                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2073                             NULL);
2074 }
2075
2076 static int selinux_binder_transfer_binder(struct task_struct *from,
2077                                           struct task_struct *to)
2078 {
2079         u32 fromsid = task_sid(from);
2080         u32 tosid = task_sid(to);
2081
2082         return avc_has_perm(&selinux_state,
2083                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2084                             NULL);
2085 }
2086
2087 static int selinux_binder_transfer_file(struct task_struct *from,
2088                                         struct task_struct *to,
2089                                         struct file *file)
2090 {
2091         u32 sid = task_sid(to);
2092         struct file_security_struct *fsec = selinux_file(file);
2093         struct dentry *dentry = file->f_path.dentry;
2094         struct inode_security_struct *isec;
2095         struct common_audit_data ad;
2096         int rc;
2097
2098         ad.type = LSM_AUDIT_DATA_PATH;
2099         ad.u.path = file->f_path;
2100
2101         if (sid != fsec->sid) {
2102                 rc = avc_has_perm(&selinux_state,
2103                                   sid, fsec->sid,
2104                                   SECCLASS_FD,
2105                                   FD__USE,
2106                                   &ad);
2107                 if (rc)
2108                         return rc;
2109         }
2110
2111 #ifdef CONFIG_BPF_SYSCALL
2112         rc = bpf_fd_pass(file, sid);
2113         if (rc)
2114                 return rc;
2115 #endif
2116
2117         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2118                 return 0;
2119
2120         isec = backing_inode_security(dentry);
2121         return avc_has_perm(&selinux_state,
2122                             sid, isec->sid, isec->sclass, file_to_av(file),
2123                             &ad);
2124 }
2125
2126 static int selinux_ptrace_access_check(struct task_struct *child,
2127                                      unsigned int mode)
2128 {
2129         u32 sid = current_sid();
2130         u32 csid = task_sid(child);
2131
2132         if (mode & PTRACE_MODE_READ)
2133                 return avc_has_perm(&selinux_state,
2134                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2135
2136         return avc_has_perm(&selinux_state,
2137                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2138 }
2139
2140 static int selinux_ptrace_traceme(struct task_struct *parent)
2141 {
2142         return avc_has_perm(&selinux_state,
2143                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2144                             PROCESS__PTRACE, NULL);
2145 }
2146
2147 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2148                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2149 {
2150         return avc_has_perm(&selinux_state,
2151                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2152                             PROCESS__GETCAP, NULL);
2153 }
2154
2155 static int selinux_capset(struct cred *new, const struct cred *old,
2156                           const kernel_cap_t *effective,
2157                           const kernel_cap_t *inheritable,
2158                           const kernel_cap_t *permitted)
2159 {
2160         return avc_has_perm(&selinux_state,
2161                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2162                             PROCESS__SETCAP, NULL);
2163 }
2164
2165 /*
2166  * (This comment used to live with the selinux_task_setuid hook,
2167  * which was removed).
2168  *
2169  * Since setuid only affects the current process, and since the SELinux
2170  * controls are not based on the Linux identity attributes, SELinux does not
2171  * need to control this operation.  However, SELinux does control the use of
2172  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2173  */
2174
2175 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2176                            int cap, unsigned int opts)
2177 {
2178         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2179 }
2180
2181 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2182 {
2183         const struct cred *cred = current_cred();
2184         int rc = 0;
2185
2186         if (!sb)
2187                 return 0;
2188
2189         switch (cmds) {
2190         case Q_SYNC:
2191         case Q_QUOTAON:
2192         case Q_QUOTAOFF:
2193         case Q_SETINFO:
2194         case Q_SETQUOTA:
2195                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2196                 break;
2197         case Q_GETFMT:
2198         case Q_GETINFO:
2199         case Q_GETQUOTA:
2200                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2201                 break;
2202         default:
2203                 rc = 0;  /* let the kernel handle invalid cmds */
2204                 break;
2205         }
2206         return rc;
2207 }
2208
2209 static int selinux_quota_on(struct dentry *dentry)
2210 {
2211         const struct cred *cred = current_cred();
2212
2213         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2214 }
2215
2216 static int selinux_syslog(int type)
2217 {
2218         switch (type) {
2219         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2220         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2221                 return avc_has_perm(&selinux_state,
2222                                     current_sid(), SECINITSID_KERNEL,
2223                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2224         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2225         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2226         /* Set level of messages printed to console */
2227         case SYSLOG_ACTION_CONSOLE_LEVEL:
2228                 return avc_has_perm(&selinux_state,
2229                                     current_sid(), SECINITSID_KERNEL,
2230                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2231                                     NULL);
2232         }
2233         /* All other syslog types */
2234         return avc_has_perm(&selinux_state,
2235                             current_sid(), SECINITSID_KERNEL,
2236                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2237 }
2238
2239 /*
2240  * Check that a process has enough memory to allocate a new virtual
2241  * mapping. 0 means there is enough memory for the allocation to
2242  * succeed and -ENOMEM implies there is not.
2243  *
2244  * Do not audit the selinux permission check, as this is applied to all
2245  * processes that allocate mappings.
2246  */
2247 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2248 {
2249         int rc, cap_sys_admin = 0;
2250
2251         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2252                                  CAP_OPT_NOAUDIT, true);
2253         if (rc == 0)
2254                 cap_sys_admin = 1;
2255
2256         return cap_sys_admin;
2257 }
2258
2259 /* binprm security operations */
2260
2261 static u32 ptrace_parent_sid(void)
2262 {
2263         u32 sid = 0;
2264         struct task_struct *tracer;
2265
2266         rcu_read_lock();
2267         tracer = ptrace_parent(current);
2268         if (tracer)
2269                 sid = task_sid(tracer);
2270         rcu_read_unlock();
2271
2272         return sid;
2273 }
2274
2275 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2276                             const struct task_security_struct *old_tsec,
2277                             const struct task_security_struct *new_tsec)
2278 {
2279         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2280         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2281         int rc;
2282         u32 av;
2283
2284         if (!nnp && !nosuid)
2285                 return 0; /* neither NNP nor nosuid */
2286
2287         if (new_tsec->sid == old_tsec->sid)
2288                 return 0; /* No change in credentials */
2289
2290         /*
2291          * If the policy enables the nnp_nosuid_transition policy capability,
2292          * then we permit transitions under NNP or nosuid if the
2293          * policy allows the corresponding permission between
2294          * the old and new contexts.
2295          */
2296         if (selinux_policycap_nnp_nosuid_transition()) {
2297                 av = 0;
2298                 if (nnp)
2299                         av |= PROCESS2__NNP_TRANSITION;
2300                 if (nosuid)
2301                         av |= PROCESS2__NOSUID_TRANSITION;
2302                 rc = avc_has_perm(&selinux_state,
2303                                   old_tsec->sid, new_tsec->sid,
2304                                   SECCLASS_PROCESS2, av, NULL);
2305                 if (!rc)
2306                         return 0;
2307         }
2308
2309         /*
2310          * We also permit NNP or nosuid transitions to bounded SIDs,
2311          * i.e. SIDs that are guaranteed to only be allowed a subset
2312          * of the permissions of the current SID.
2313          */
2314         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2315                                          new_tsec->sid);
2316         if (!rc)
2317                 return 0;
2318
2319         /*
2320          * On failure, preserve the errno values for NNP vs nosuid.
2321          * NNP:  Operation not permitted for caller.
2322          * nosuid:  Permission denied to file.
2323          */
2324         if (nnp)
2325                 return -EPERM;
2326         return -EACCES;
2327 }
2328
2329 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2330 {
2331         const struct task_security_struct *old_tsec;
2332         struct task_security_struct *new_tsec;
2333         struct inode_security_struct *isec;
2334         struct common_audit_data ad;
2335         struct inode *inode = file_inode(bprm->file);
2336         int rc;
2337
2338         /* SELinux context only depends on initial program or script and not
2339          * the script interpreter */
2340         if (bprm->called_set_creds)
2341                 return 0;
2342
2343         old_tsec = selinux_cred(current_cred());
2344         new_tsec = selinux_cred(bprm->cred);
2345         isec = inode_security(inode);
2346
2347         /* Default to the current task SID. */
2348         new_tsec->sid = old_tsec->sid;
2349         new_tsec->osid = old_tsec->sid;
2350
2351         /* Reset fs, key, and sock SIDs on execve. */
2352         new_tsec->create_sid = 0;
2353         new_tsec->keycreate_sid = 0;
2354         new_tsec->sockcreate_sid = 0;
2355
2356         if (old_tsec->exec_sid) {
2357                 new_tsec->sid = old_tsec->exec_sid;
2358                 /* Reset exec SID on execve. */
2359                 new_tsec->exec_sid = 0;
2360
2361                 /* Fail on NNP or nosuid if not an allowed transition. */
2362                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2363                 if (rc)
2364                         return rc;
2365         } else {
2366                 /* Check for a default transition on this program. */
2367                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2368                                              isec->sid, SECCLASS_PROCESS, NULL,
2369                                              &new_tsec->sid);
2370                 if (rc)
2371                         return rc;
2372
2373                 /*
2374                  * Fallback to old SID on NNP or nosuid if not an allowed
2375                  * transition.
2376                  */
2377                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2378                 if (rc)
2379                         new_tsec->sid = old_tsec->sid;
2380         }
2381
2382         ad.type = LSM_AUDIT_DATA_FILE;
2383         ad.u.file = bprm->file;
2384
2385         if (new_tsec->sid == old_tsec->sid) {
2386                 rc = avc_has_perm(&selinux_state,
2387                                   old_tsec->sid, isec->sid,
2388                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2389                 if (rc)
2390                         return rc;
2391         } else {
2392                 /* Check permissions for the transition. */
2393                 rc = avc_has_perm(&selinux_state,
2394                                   old_tsec->sid, new_tsec->sid,
2395                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2396                 if (rc)
2397                         return rc;
2398
2399                 rc = avc_has_perm(&selinux_state,
2400                                   new_tsec->sid, isec->sid,
2401                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2402                 if (rc)
2403                         return rc;
2404
2405                 /* Check for shared state */
2406                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2407                         rc = avc_has_perm(&selinux_state,
2408                                           old_tsec->sid, new_tsec->sid,
2409                                           SECCLASS_PROCESS, PROCESS__SHARE,
2410                                           NULL);
2411                         if (rc)
2412                                 return -EPERM;
2413                 }
2414
2415                 /* Make sure that anyone attempting to ptrace over a task that
2416                  * changes its SID has the appropriate permit */
2417                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2418                         u32 ptsid = ptrace_parent_sid();
2419                         if (ptsid != 0) {
2420                                 rc = avc_has_perm(&selinux_state,
2421                                                   ptsid, new_tsec->sid,
2422                                                   SECCLASS_PROCESS,
2423                                                   PROCESS__PTRACE, NULL);
2424                                 if (rc)
2425                                         return -EPERM;
2426                         }
2427                 }
2428
2429                 /* Clear any possibly unsafe personality bits on exec: */
2430                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2431
2432                 /* Enable secure mode for SIDs transitions unless
2433                    the noatsecure permission is granted between
2434                    the two SIDs, i.e. ahp returns 0. */
2435                 rc = avc_has_perm(&selinux_state,
2436                                   old_tsec->sid, new_tsec->sid,
2437                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2438                                   NULL);
2439                 bprm->secureexec |= !!rc;
2440         }
2441
2442         return 0;
2443 }
2444
2445 static int match_file(const void *p, struct file *file, unsigned fd)
2446 {
2447         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2448 }
2449
2450 /* Derived from fs/exec.c:flush_old_files. */
2451 static inline void flush_unauthorized_files(const struct cred *cred,
2452                                             struct files_struct *files)
2453 {
2454         struct file *file, *devnull = NULL;
2455         struct tty_struct *tty;
2456         int drop_tty = 0;
2457         unsigned n;
2458
2459         tty = get_current_tty();
2460         if (tty) {
2461                 spin_lock(&tty->files_lock);
2462                 if (!list_empty(&tty->tty_files)) {
2463                         struct tty_file_private *file_priv;
2464
2465                         /* Revalidate access to controlling tty.
2466                            Use file_path_has_perm on the tty path directly
2467                            rather than using file_has_perm, as this particular
2468                            open file may belong to another process and we are
2469                            only interested in the inode-based check here. */
2470                         file_priv = list_first_entry(&tty->tty_files,
2471                                                 struct tty_file_private, list);
2472                         file = file_priv->file;
2473                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2474                                 drop_tty = 1;
2475                 }
2476                 spin_unlock(&tty->files_lock);
2477                 tty_kref_put(tty);
2478         }
2479         /* Reset controlling tty. */
2480         if (drop_tty)
2481                 no_tty();
2482
2483         /* Revalidate access to inherited open files. */
2484         n = iterate_fd(files, 0, match_file, cred);
2485         if (!n) /* none found? */
2486                 return;
2487
2488         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2489         if (IS_ERR(devnull))
2490                 devnull = NULL;
2491         /* replace all the matching ones with this */
2492         do {
2493                 replace_fd(n - 1, devnull, 0);
2494         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2495         if (devnull)
2496                 fput(devnull);
2497 }
2498
2499 /*
2500  * Prepare a process for imminent new credential changes due to exec
2501  */
2502 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2503 {
2504         struct task_security_struct *new_tsec;
2505         struct rlimit *rlim, *initrlim;
2506         int rc, i;
2507
2508         new_tsec = selinux_cred(bprm->cred);
2509         if (new_tsec->sid == new_tsec->osid)
2510                 return;
2511
2512         /* Close files for which the new task SID is not authorized. */
2513         flush_unauthorized_files(bprm->cred, current->files);
2514
2515         /* Always clear parent death signal on SID transitions. */
2516         current->pdeath_signal = 0;
2517
2518         /* Check whether the new SID can inherit resource limits from the old
2519          * SID.  If not, reset all soft limits to the lower of the current
2520          * task's hard limit and the init task's soft limit.
2521          *
2522          * Note that the setting of hard limits (even to lower them) can be
2523          * controlled by the setrlimit check.  The inclusion of the init task's
2524          * soft limit into the computation is to avoid resetting soft limits
2525          * higher than the default soft limit for cases where the default is
2526          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2527          */
2528         rc = avc_has_perm(&selinux_state,
2529                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2530                           PROCESS__RLIMITINH, NULL);
2531         if (rc) {
2532                 /* protect against do_prlimit() */
2533                 task_lock(current);
2534                 for (i = 0; i < RLIM_NLIMITS; i++) {
2535                         rlim = current->signal->rlim + i;
2536                         initrlim = init_task.signal->rlim + i;
2537                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2538                 }
2539                 task_unlock(current);
2540                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2541                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2542         }
2543 }
2544
2545 /*
2546  * Clean up the process immediately after the installation of new credentials
2547  * due to exec
2548  */
2549 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2550 {
2551         const struct task_security_struct *tsec = selinux_cred(current_cred());
2552         u32 osid, sid;
2553         int rc;
2554
2555         osid = tsec->osid;
2556         sid = tsec->sid;
2557
2558         if (sid == osid)
2559                 return;
2560
2561         /* Check whether the new SID can inherit signal state from the old SID.
2562          * If not, clear itimers to avoid subsequent signal generation and
2563          * flush and unblock signals.
2564          *
2565          * This must occur _after_ the task SID has been updated so that any
2566          * kill done after the flush will be checked against the new SID.
2567          */
2568         rc = avc_has_perm(&selinux_state,
2569                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2570         if (rc) {
2571                 clear_itimer();
2572
2573                 spin_lock_irq(&current->sighand->siglock);
2574                 if (!fatal_signal_pending(current)) {
2575                         flush_sigqueue(&current->pending);
2576                         flush_sigqueue(&current->signal->shared_pending);
2577                         flush_signal_handlers(current, 1);
2578                         sigemptyset(&current->blocked);
2579                         recalc_sigpending();
2580                 }
2581                 spin_unlock_irq(&current->sighand->siglock);
2582         }
2583
2584         /* Wake up the parent if it is waiting so that it can recheck
2585          * wait permission to the new task SID. */
2586         read_lock(&tasklist_lock);
2587         __wake_up_parent(current, current->real_parent);
2588         read_unlock(&tasklist_lock);
2589 }
2590
2591 /* superblock security operations */
2592
2593 static int selinux_sb_alloc_security(struct super_block *sb)
2594 {
2595         return superblock_alloc_security(sb);
2596 }
2597
2598 static void selinux_sb_free_security(struct super_block *sb)
2599 {
2600         superblock_free_security(sb);
2601 }
2602
2603 static inline int opt_len(const char *s)
2604 {
2605         bool open_quote = false;
2606         int len;
2607         char c;
2608
2609         for (len = 0; (c = s[len]) != '\0'; len++) {
2610                 if (c == '"')
2611                         open_quote = !open_quote;
2612                 if (c == ',' && !open_quote)
2613                         break;
2614         }
2615         return len;
2616 }
2617
2618 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2619 {
2620         char *from = options;
2621         char *to = options;
2622         bool first = true;
2623         int rc;
2624
2625         while (1) {
2626                 int len = opt_len(from);
2627                 int token;
2628                 char *arg = NULL;
2629
2630                 token = match_opt_prefix(from, len, &arg);
2631
2632                 if (token != Opt_error) {
2633                         char *p, *q;
2634
2635                         /* strip quotes */
2636                         if (arg) {
2637                                 for (p = q = arg; p < from + len; p++) {
2638                                         char c = *p;
2639                                         if (c != '"')
2640                                                 *q++ = c;
2641                                 }
2642                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2643                                 if (!arg) {
2644                                         rc = -ENOMEM;
2645                                         goto free_opt;
2646                                 }
2647                         }
2648                         rc = selinux_add_opt(token, arg, mnt_opts);
2649                         if (unlikely(rc)) {
2650                                 kfree(arg);
2651                                 goto free_opt;
2652                         }
2653                 } else {
2654                         if (!first) {   // copy with preceding comma
2655                                 from--;
2656                                 len++;
2657                         }
2658                         if (to != from)
2659                                 memmove(to, from, len);
2660                         to += len;
2661                         first = false;
2662                 }
2663                 if (!from[len])
2664                         break;
2665                 from += len + 1;
2666         }
2667         *to = '\0';
2668         return 0;
2669
2670 free_opt:
2671         if (*mnt_opts) {
2672                 selinux_free_mnt_opts(*mnt_opts);
2673                 *mnt_opts = NULL;
2674         }
2675         return rc;
2676 }
2677
2678 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2679 {
2680         struct selinux_mnt_opts *opts = mnt_opts;
2681         struct superblock_security_struct *sbsec = sb->s_security;
2682         u32 sid;
2683         int rc;
2684
2685         if (!(sbsec->flags & SE_SBINITIALIZED))
2686                 return 0;
2687
2688         if (!opts)
2689                 return 0;
2690
2691         if (opts->fscontext) {
2692                 rc = parse_sid(sb, opts->fscontext, &sid);
2693                 if (rc)
2694                         return rc;
2695                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2696                         goto out_bad_option;
2697         }
2698         if (opts->context) {
2699                 rc = parse_sid(sb, opts->context, &sid);
2700                 if (rc)
2701                         return rc;
2702                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2703                         goto out_bad_option;
2704         }
2705         if (opts->rootcontext) {
2706                 struct inode_security_struct *root_isec;
2707                 root_isec = backing_inode_security(sb->s_root);
2708                 rc = parse_sid(sb, opts->rootcontext, &sid);
2709                 if (rc)
2710                         return rc;
2711                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2712                         goto out_bad_option;
2713         }
2714         if (opts->defcontext) {
2715                 rc = parse_sid(sb, opts->defcontext, &sid);
2716                 if (rc)
2717                         return rc;
2718                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2719                         goto out_bad_option;
2720         }
2721         return 0;
2722
2723 out_bad_option:
2724         pr_warn("SELinux: unable to change security options "
2725                "during remount (dev %s, type=%s)\n", sb->s_id,
2726                sb->s_type->name);
2727         return -EINVAL;
2728 }
2729
2730 static int selinux_sb_kern_mount(struct super_block *sb)
2731 {
2732         const struct cred *cred = current_cred();
2733         struct common_audit_data ad;
2734
2735         ad.type = LSM_AUDIT_DATA_DENTRY;
2736         ad.u.dentry = sb->s_root;
2737         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2738 }
2739
2740 static int selinux_sb_statfs(struct dentry *dentry)
2741 {
2742         const struct cred *cred = current_cred();
2743         struct common_audit_data ad;
2744
2745         ad.type = LSM_AUDIT_DATA_DENTRY;
2746         ad.u.dentry = dentry->d_sb->s_root;
2747         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2748 }
2749
2750 static int selinux_mount(const char *dev_name,
2751                          const struct path *path,
2752                          const char *type,
2753                          unsigned long flags,
2754                          void *data)
2755 {
2756         const struct cred *cred = current_cred();
2757
2758         if (flags & MS_REMOUNT)
2759                 return superblock_has_perm(cred, path->dentry->d_sb,
2760                                            FILESYSTEM__REMOUNT, NULL);
2761         else
2762                 return path_has_perm(cred, path, FILE__MOUNTON);
2763 }
2764
2765 static int selinux_umount(struct vfsmount *mnt, int flags)
2766 {
2767         const struct cred *cred = current_cred();
2768
2769         return superblock_has_perm(cred, mnt->mnt_sb,
2770                                    FILESYSTEM__UNMOUNT, NULL);
2771 }
2772
2773 static int selinux_fs_context_dup(struct fs_context *fc,
2774                                   struct fs_context *src_fc)
2775 {
2776         const struct selinux_mnt_opts *src = src_fc->security;
2777         struct selinux_mnt_opts *opts;
2778
2779         if (!src)
2780                 return 0;
2781
2782         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2783         if (!fc->security)
2784                 return -ENOMEM;
2785
2786         opts = fc->security;
2787
2788         if (src->fscontext) {
2789                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2790                 if (!opts->fscontext)
2791                         return -ENOMEM;
2792         }
2793         if (src->context) {
2794                 opts->context = kstrdup(src->context, GFP_KERNEL);
2795                 if (!opts->context)
2796                         return -ENOMEM;
2797         }
2798         if (src->rootcontext) {
2799                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2800                 if (!opts->rootcontext)
2801                         return -ENOMEM;
2802         }
2803         if (src->defcontext) {
2804                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2805                 if (!opts->defcontext)
2806                         return -ENOMEM;
2807         }
2808         return 0;
2809 }
2810
2811 static const struct fs_parameter_spec selinux_param_specs[] = {
2812         fsparam_string(CONTEXT_STR,     Opt_context),
2813         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2814         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2815         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2816         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2817         {}
2818 };
2819
2820 static const struct fs_parameter_description selinux_fs_parameters = {
2821         .name           = "SELinux",
2822         .specs          = selinux_param_specs,
2823 };
2824
2825 static int selinux_fs_context_parse_param(struct fs_context *fc,
2826                                           struct fs_parameter *param)
2827 {
2828         struct fs_parse_result result;
2829         int opt, rc;
2830
2831         opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2832         if (opt < 0)
2833                 return opt;
2834
2835         rc = selinux_add_opt(opt, param->string, &fc->security);
2836         if (!rc) {
2837                 param->string = NULL;
2838                 rc = 1;
2839         }
2840         return rc;
2841 }
2842
2843 /* inode security operations */
2844
2845 static int selinux_inode_alloc_security(struct inode *inode)
2846 {
2847         return inode_alloc_security(inode);
2848 }
2849
2850 static void selinux_inode_free_security(struct inode *inode)
2851 {
2852         inode_free_security(inode);
2853 }
2854
2855 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2856                                         const struct qstr *name, void **ctx,
2857                                         u32 *ctxlen)
2858 {
2859         u32 newsid;
2860         int rc;
2861
2862         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2863                                            d_inode(dentry->d_parent), name,
2864                                            inode_mode_to_security_class(mode),
2865                                            &newsid);
2866         if (rc)
2867                 return rc;
2868
2869         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2870                                        ctxlen);
2871 }
2872
2873 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2874                                           struct qstr *name,
2875                                           const struct cred *old,
2876                                           struct cred *new)
2877 {
2878         u32 newsid;
2879         int rc;
2880         struct task_security_struct *tsec;
2881
2882         rc = selinux_determine_inode_label(selinux_cred(old),
2883                                            d_inode(dentry->d_parent), name,
2884                                            inode_mode_to_security_class(mode),
2885                                            &newsid);
2886         if (rc)
2887                 return rc;
2888
2889         tsec = selinux_cred(new);
2890         tsec->create_sid = newsid;
2891         return 0;
2892 }
2893
2894 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2895                                        const struct qstr *qstr,
2896                                        const char **name,
2897                                        void **value, size_t *len)
2898 {
2899         const struct task_security_struct *tsec = selinux_cred(current_cred());
2900         struct superblock_security_struct *sbsec;
2901         u32 newsid, clen;
2902         int rc;
2903         char *context;
2904
2905         sbsec = dir->i_sb->s_security;
2906
2907         newsid = tsec->create_sid;
2908
2909         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2910                 dir, qstr,
2911                 inode_mode_to_security_class(inode->i_mode),
2912                 &newsid);
2913         if (rc)
2914                 return rc;
2915
2916         /* Possibly defer initialization to selinux_complete_init. */
2917         if (sbsec->flags & SE_SBINITIALIZED) {
2918                 struct inode_security_struct *isec = selinux_inode(inode);
2919                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2920                 isec->sid = newsid;
2921                 isec->initialized = LABEL_INITIALIZED;
2922         }
2923
2924         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2925                 return -EOPNOTSUPP;
2926
2927         if (name)
2928                 *name = XATTR_SELINUX_SUFFIX;
2929
2930         if (value && len) {
2931                 rc = security_sid_to_context_force(&selinux_state, newsid,
2932                                                    &context, &clen);
2933                 if (rc)
2934                         return rc;
2935                 *value = context;
2936                 *len = clen;
2937         }
2938
2939         return 0;
2940 }
2941
2942 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2943 {
2944         return may_create(dir, dentry, SECCLASS_FILE);
2945 }
2946
2947 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2948 {
2949         return may_link(dir, old_dentry, MAY_LINK);
2950 }
2951
2952 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2953 {
2954         return may_link(dir, dentry, MAY_UNLINK);
2955 }
2956
2957 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2958 {
2959         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2960 }
2961
2962 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2963 {
2964         return may_create(dir, dentry, SECCLASS_DIR);
2965 }
2966
2967 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2968 {
2969         return may_link(dir, dentry, MAY_RMDIR);
2970 }
2971
2972 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2973 {
2974         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2975 }
2976
2977 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2978                                 struct inode *new_inode, struct dentry *new_dentry)
2979 {
2980         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2981 }
2982
2983 static int selinux_inode_readlink(struct dentry *dentry)
2984 {
2985         const struct cred *cred = current_cred();
2986
2987         return dentry_has_perm(cred, dentry, FILE__READ);
2988 }
2989
2990 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2991                                      bool rcu)
2992 {
2993         const struct cred *cred = current_cred();
2994         struct common_audit_data ad;
2995         struct inode_security_struct *isec;
2996         u32 sid;
2997
2998         validate_creds(cred);
2999
3000         ad.type = LSM_AUDIT_DATA_DENTRY;
3001         ad.u.dentry = dentry;
3002         sid = cred_sid(cred);
3003         isec = inode_security_rcu(inode, rcu);
3004         if (IS_ERR(isec))
3005                 return PTR_ERR(isec);
3006
3007         return avc_has_perm(&selinux_state,
3008                             sid, isec->sid, isec->sclass, FILE__READ, &ad);
3009 }
3010
3011 static noinline int audit_inode_permission(struct inode *inode,
3012                                            u32 perms, u32 audited, u32 denied,
3013                                            int result,
3014                                            unsigned flags)
3015 {
3016         struct common_audit_data ad;
3017         struct inode_security_struct *isec = selinux_inode(inode);
3018         int rc;
3019
3020         ad.type = LSM_AUDIT_DATA_INODE;
3021         ad.u.inode = inode;
3022
3023         rc = slow_avc_audit(&selinux_state,
3024                             current_sid(), isec->sid, isec->sclass, perms,
3025                             audited, denied, result, &ad, flags);
3026         if (rc)
3027                 return rc;
3028         return 0;
3029 }
3030
3031 static int selinux_inode_permission(struct inode *inode, int mask)
3032 {
3033         const struct cred *cred = current_cred();
3034         u32 perms;
3035         bool from_access;
3036         unsigned flags = mask & MAY_NOT_BLOCK;
3037         struct inode_security_struct *isec;
3038         u32 sid;
3039         struct av_decision avd;
3040         int rc, rc2;
3041         u32 audited, denied;
3042
3043         from_access = mask & MAY_ACCESS;
3044         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3045
3046         /* No permission to check.  Existence test. */
3047         if (!mask)
3048                 return 0;
3049
3050         validate_creds(cred);
3051
3052         if (unlikely(IS_PRIVATE(inode)))
3053                 return 0;
3054
3055         perms = file_mask_to_av(inode->i_mode, mask);
3056
3057         sid = cred_sid(cred);
3058         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3059         if (IS_ERR(isec))
3060                 return PTR_ERR(isec);
3061
3062         rc = avc_has_perm_noaudit(&selinux_state,
3063                                   sid, isec->sid, isec->sclass, perms,
3064                                   (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3065                                   &avd);
3066         audited = avc_audit_required(perms, &avd, rc,
3067                                      from_access ? FILE__AUDIT_ACCESS : 0,
3068                                      &denied);
3069         if (likely(!audited))
3070                 return rc;
3071
3072         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3073         if (rc2)
3074                 return rc2;
3075         return rc;
3076 }
3077
3078 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3079 {
3080         const struct cred *cred = current_cred();
3081         struct inode *inode = d_backing_inode(dentry);
3082         unsigned int ia_valid = iattr->ia_valid;
3083         __u32 av = FILE__WRITE;
3084
3085         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3086         if (ia_valid & ATTR_FORCE) {
3087                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3088                               ATTR_FORCE);
3089                 if (!ia_valid)
3090                         return 0;
3091         }
3092
3093         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3094                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3095                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3096
3097         if (selinux_policycap_openperm() &&
3098             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3099             (ia_valid & ATTR_SIZE) &&
3100             !(ia_valid & ATTR_FILE))
3101                 av |= FILE__OPEN;
3102
3103         return dentry_has_perm(cred, dentry, av);
3104 }
3105
3106 static int selinux_inode_getattr(const struct path *path)
3107 {
3108         return path_has_perm(current_cred(), path, FILE__GETATTR);
3109 }
3110
3111 static bool has_cap_mac_admin(bool audit)
3112 {
3113         const struct cred *cred = current_cred();
3114         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3115
3116         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3117                 return false;
3118         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3119                 return false;
3120         return true;
3121 }
3122
3123 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3124                                   const void *value, size_t size, int flags)
3125 {
3126         struct inode *inode = d_backing_inode(dentry);
3127         struct inode_security_struct *isec;
3128         struct superblock_security_struct *sbsec;
3129         struct common_audit_data ad;
3130         u32 newsid, sid = current_sid();
3131         int rc = 0;
3132
3133         if (strcmp(name, XATTR_NAME_SELINUX)) {
3134                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3135                 if (rc)
3136                         return rc;
3137
3138                 /* Not an attribute we recognize, so just check the
3139                    ordinary setattr permission. */
3140                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3141         }
3142
3143         if (!selinux_state.initialized)
3144                 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3145
3146         sbsec = inode->i_sb->s_security;
3147         if (!(sbsec->flags & SBLABEL_MNT))
3148                 return -EOPNOTSUPP;
3149
3150         if (!inode_owner_or_capable(inode))
3151                 return -EPERM;
3152
3153         ad.type = LSM_AUDIT_DATA_DENTRY;
3154         ad.u.dentry = dentry;
3155
3156         isec = backing_inode_security(dentry);
3157         rc = avc_has_perm(&selinux_state,
3158                           sid, isec->sid, isec->sclass,
3159                           FILE__RELABELFROM, &ad);
3160         if (rc)
3161                 return rc;
3162
3163         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3164                                      GFP_KERNEL);
3165         if (rc == -EINVAL) {
3166                 if (!has_cap_mac_admin(true)) {
3167                         struct audit_buffer *ab;
3168                         size_t audit_size;
3169
3170                         /* We strip a nul only if it is at the end, otherwise the
3171                          * context contains a nul and we should audit that */
3172                         if (value) {
3173                                 const char *str = value;
3174
3175                                 if (str[size - 1] == '\0')
3176                                         audit_size = size - 1;
3177                                 else
3178                                         audit_size = size;
3179                         } else {
3180                                 audit_size = 0;
3181                         }
3182                         ab = audit_log_start(audit_context(),
3183                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3184                         audit_log_format(ab, "op=setxattr invalid_context=");
3185                         audit_log_n_untrustedstring(ab, value, audit_size);
3186                         audit_log_end(ab);
3187
3188                         return rc;
3189                 }
3190                 rc = security_context_to_sid_force(&selinux_state, value,
3191                                                    size, &newsid);
3192         }
3193         if (rc)
3194                 return rc;
3195
3196         rc = avc_has_perm(&selinux_state,
3197                           sid, newsid, isec->sclass,
3198                           FILE__RELABELTO, &ad);
3199         if (rc)
3200                 return rc;
3201
3202         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3203                                           sid, isec->sclass);
3204         if (rc)
3205                 return rc;
3206
3207         return avc_has_perm(&selinux_state,
3208                             newsid,
3209                             sbsec->sid,
3210                             SECCLASS_FILESYSTEM,
3211                             FILESYSTEM__ASSOCIATE,
3212                             &ad);
3213 }
3214
3215 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3216                                         const void *value, size_t size,
3217                                         int flags)
3218 {
3219         struct inode *inode = d_backing_inode(dentry);
3220         struct inode_security_struct *isec;
3221         u32 newsid;
3222         int rc;
3223
3224         if (strcmp(name, XATTR_NAME_SELINUX)) {
3225                 /* Not an attribute we recognize, so nothing to do. */
3226                 return;
3227         }
3228
3229         if (!selinux_state.initialized) {
3230                 /* If we haven't even been initialized, then we can't validate
3231                  * against a policy, so leave the label as invalid. It may
3232                  * resolve to a valid label on the next revalidation try if
3233                  * we've since initialized.
3234                  */
3235                 return;
3236         }
3237
3238         rc = security_context_to_sid_force(&selinux_state, value, size,
3239                                            &newsid);
3240         if (rc) {
3241                 pr_err("SELinux:  unable to map context to SID"
3242                        "for (%s, %lu), rc=%d\n",
3243                        inode->i_sb->s_id, inode->i_ino, -rc);
3244                 return;
3245         }
3246
3247         isec = backing_inode_security(dentry);
3248         spin_lock(&isec->lock);
3249         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3250         isec->sid = newsid;
3251         isec->initialized = LABEL_INITIALIZED;
3252         spin_unlock(&isec->lock);
3253
3254         return;
3255 }
3256
3257 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3258 {
3259         const struct cred *cred = current_cred();
3260
3261         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3262 }
3263
3264 static int selinux_inode_listxattr(struct dentry *dentry)
3265 {
3266         const struct cred *cred = current_cred();
3267
3268         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3269 }
3270
3271 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3272 {
3273         if (strcmp(name, XATTR_NAME_SELINUX)) {
3274                 int rc = cap_inode_removexattr(dentry, name);
3275                 if (rc)
3276                         return rc;
3277
3278                 /* Not an attribute we recognize, so just check the
3279                    ordinary setattr permission. */
3280                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3281         }
3282
3283         /* No one is allowed to remove a SELinux security label.
3284            You can change the label, but all data must be labeled. */
3285         return -EACCES;
3286 }
3287
3288 static int selinux_path_notify(const struct path *path, u64 mask,
3289                                                 unsigned int obj_type)
3290 {
3291         int ret;
3292         u32 perm;
3293
3294         struct common_audit_data ad;
3295
3296         ad.type = LSM_AUDIT_DATA_PATH;
3297         ad.u.path = *path;
3298
3299         /*
3300          * Set permission needed based on the type of mark being set.
3301          * Performs an additional check for sb watches.
3302          */
3303         switch (obj_type) {
3304         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3305                 perm = FILE__WATCH_MOUNT;
3306                 break;
3307         case FSNOTIFY_OBJ_TYPE_SB:
3308                 perm = FILE__WATCH_SB;
3309                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3310                                                 FILESYSTEM__WATCH, &ad);
3311                 if (ret)
3312                         return ret;
3313                 break;
3314         case FSNOTIFY_OBJ_TYPE_INODE:
3315                 perm = FILE__WATCH;
3316                 break;
3317         default:
3318                 return -EINVAL;
3319         }
3320
3321         /* blocking watches require the file:watch_with_perm permission */
3322         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3323                 perm |= FILE__WATCH_WITH_PERM;
3324
3325         /* watches on read-like events need the file:watch_reads permission */
3326         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3327                 perm |= FILE__WATCH_READS;
3328
3329         return path_has_perm(current_cred(), path, perm);
3330 }
3331
3332 /*
3333  * Copy the inode security context value to the user.
3334  *
3335  * Permission check is handled by selinux_inode_getxattr hook.
3336  */
3337 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3338 {
3339         u32 size;
3340         int error;
3341         char *context = NULL;
3342         struct inode_security_struct *isec;
3343
3344         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3345                 return -EOPNOTSUPP;
3346
3347         /*
3348          * If the caller has CAP_MAC_ADMIN, then get the raw context
3349          * value even if it is not defined by current policy; otherwise,
3350          * use the in-core value under current policy.
3351          * Use the non-auditing forms of the permission checks since
3352          * getxattr may be called by unprivileged processes commonly
3353          * and lack of permission just means that we fall back to the
3354          * in-core context value, not a denial.
3355          */
3356         isec = inode_security(inode);
3357         if (has_cap_mac_admin(false))
3358                 error = security_sid_to_context_force(&selinux_state,
3359                                                       isec->sid, &context,
3360                                                       &size);
3361         else
3362                 error = security_sid_to_context(&selinux_state, isec->sid,
3363                                                 &context, &size);
3364         if (error)
3365                 return error;
3366         error = size;
3367         if (alloc) {
3368                 *buffer = context;
3369                 goto out_nofree;
3370         }
3371         kfree(context);
3372 out_nofree:
3373         return error;
3374 }
3375
3376 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3377                                      const void *value, size_t size, int flags)
3378 {
3379         struct inode_security_struct *isec = inode_security_novalidate(inode);
3380         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3381         u32 newsid;
3382         int rc;
3383
3384         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3385                 return -EOPNOTSUPP;
3386
3387         if (!(sbsec->flags & SBLABEL_MNT))
3388                 return -EOPNOTSUPP;
3389
3390         if (!value || !size)
3391                 return -EACCES;
3392
3393         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3394                                      GFP_KERNEL);
3395         if (rc)
3396                 return rc;
3397
3398         spin_lock(&isec->lock);
3399         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3400         isec->sid = newsid;
3401         isec->initialized = LABEL_INITIALIZED;
3402         spin_unlock(&isec->lock);
3403         return 0;
3404 }
3405
3406 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3407 {
3408         const int len = sizeof(XATTR_NAME_SELINUX);
3409         if (buffer && len <= buffer_size)
3410                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3411         return len;
3412 }
3413
3414 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3415 {
3416         struct inode_security_struct *isec = inode_security_novalidate(inode);
3417         *secid = isec->sid;
3418 }
3419
3420 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3421 {
3422         u32 sid;
3423         struct task_security_struct *tsec;
3424         struct cred *new_creds = *new;
3425
3426         if (new_creds == NULL) {
3427                 new_creds = prepare_creds();
3428                 if (!new_creds)
3429                         return -ENOMEM;
3430         }
3431
3432         tsec = selinux_cred(new_creds);
3433         /* Get label from overlay inode and set it in create_sid */
3434         selinux_inode_getsecid(d_inode(src), &sid);
3435         tsec->create_sid = sid;
3436         *new = new_creds;
3437         return 0;
3438 }
3439
3440 static int selinux_inode_copy_up_xattr(const char *name)
3441 {
3442         /* The copy_up hook above sets the initial context on an inode, but we
3443          * don't then want to overwrite it by blindly copying all the lower
3444          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3445          */
3446         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3447                 return 1; /* Discard */
3448         /*
3449          * Any other attribute apart from SELINUX is not claimed, supported
3450          * by selinux.
3451          */
3452         return -EOPNOTSUPP;
3453 }
3454
3455 /* kernfs node operations */
3456
3457 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3458                                         struct kernfs_node *kn)
3459 {
3460         const struct task_security_struct *tsec = selinux_cred(current_cred());
3461         u32 parent_sid, newsid, clen;
3462         int rc;
3463         char *context;
3464
3465         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3466         if (rc == -ENODATA)
3467                 return 0;
3468         else if (rc < 0)
3469                 return rc;
3470
3471         clen = (u32)rc;
3472         context = kmalloc(clen, GFP_KERNEL);
3473         if (!context)
3474                 return -ENOMEM;
3475
3476         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3477         if (rc < 0) {
3478                 kfree(context);
3479                 return rc;
3480         }
3481
3482         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3483                                      GFP_KERNEL);
3484         kfree(context);
3485         if (rc)
3486                 return rc;
3487
3488         if (tsec->create_sid) {
3489                 newsid = tsec->create_sid;
3490         } else {
3491                 u16 secclass = inode_mode_to_security_class(kn->mode);
3492                 struct qstr q;
3493
3494                 q.name = kn->name;
3495                 q.hash_len = hashlen_string(kn_dir, kn->name);
3496
3497                 rc = security_transition_sid(&selinux_state, tsec->sid,
3498                                              parent_sid, secclass, &q,
3499                                              &newsid);
3500                 if (rc)
3501                         return rc;
3502         }
3503
3504         rc = security_sid_to_context_force(&selinux_state, newsid,
3505                                            &context, &clen);
3506         if (rc)
3507                 return rc;
3508
3509         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3510                               XATTR_CREATE);
3511         kfree(context);
3512         return rc;
3513 }
3514
3515
3516 /* file security operations */
3517
3518 static int selinux_revalidate_file_permission(struct file *file, int mask)
3519 {
3520         const struct cred *cred = current_cred();
3521         struct inode *inode = file_inode(file);
3522
3523         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3524         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3525                 mask |= MAY_APPEND;
3526
3527         return file_has_perm(cred, file,
3528                              file_mask_to_av(inode->i_mode, mask));
3529 }
3530
3531 static int selinux_file_permission(struct file *file, int mask)
3532 {
3533         struct inode *inode = file_inode(file);
3534         struct file_security_struct *fsec = selinux_file(file);
3535         struct inode_security_struct *isec;
3536         u32 sid = current_sid();
3537
3538         if (!mask)
3539                 /* No permission to check.  Existence test. */
3540                 return 0;
3541
3542         isec = inode_security(inode);
3543         if (sid == fsec->sid && fsec->isid == isec->sid &&
3544             fsec->pseqno == avc_policy_seqno(&selinux_state))
3545                 /* No change since file_open check. */
3546                 return 0;
3547
3548         return selinux_revalidate_file_permission(file, mask);
3549 }
3550
3551 static int selinux_file_alloc_security(struct file *file)
3552 {
3553         return file_alloc_security(file);
3554 }
3555
3556 /*
3557  * Check whether a task has the ioctl permission and cmd
3558  * operation to an inode.
3559  */
3560 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3561                 u32 requested, u16 cmd)
3562 {
3563         struct common_audit_data ad;
3564         struct file_security_struct *fsec = selinux_file(file);
3565         struct inode *inode = file_inode(file);
3566         struct inode_security_struct *isec;
3567         struct lsm_ioctlop_audit ioctl;
3568         u32 ssid = cred_sid(cred);
3569         int rc;
3570         u8 driver = cmd >> 8;
3571         u8 xperm = cmd & 0xff;
3572
3573         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3574         ad.u.op = &ioctl;
3575         ad.u.op->cmd = cmd;
3576         ad.u.op->path = file->f_path;
3577
3578         if (ssid != fsec->sid) {
3579                 rc = avc_has_perm(&selinux_state,
3580                                   ssid, fsec->sid,
3581                                 SECCLASS_FD,
3582                                 FD__USE,
3583                                 &ad);
3584                 if (rc)
3585                         goto out;
3586         }
3587
3588         if (unlikely(IS_PRIVATE(inode)))
3589                 return 0;
3590
3591         isec = inode_security(inode);
3592         rc = avc_has_extended_perms(&selinux_state,
3593                                     ssid, isec->sid, isec->sclass,
3594                                     requested, driver, xperm, &ad);
3595 out:
3596         return rc;
3597 }
3598
3599 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3600                               unsigned long arg)
3601 {
3602         const struct cred *cred = current_cred();
3603         int error = 0;
3604
3605         switch (cmd) {
3606         case FIONREAD:
3607         /* fall through */
3608         case FIBMAP:
3609         /* fall through */
3610         case FIGETBSZ:
3611         /* fall through */
3612         case FS_IOC_GETFLAGS:
3613         /* fall through */
3614         case FS_IOC_GETVERSION:
3615                 error = file_has_perm(cred, file, FILE__GETATTR);
3616                 break;
3617
3618         case FS_IOC_SETFLAGS:
3619         /* fall through */
3620         case FS_IOC_SETVERSION:
3621                 error = file_has_perm(cred, file, FILE__SETATTR);
3622                 break;
3623
3624         /* sys_ioctl() checks */
3625         case FIONBIO:
3626         /* fall through */
3627         case FIOASYNC:
3628                 error = file_has_perm(cred, file, 0);
3629                 break;
3630
3631         case KDSKBENT:
3632         case KDSKBSENT:
3633                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3634                                             CAP_OPT_NONE, true);
3635                 break;
3636
3637         /* default case assumes that the command will go
3638          * to the file's ioctl() function.
3639          */
3640         default:
3641                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3642         }
3643         return error;
3644 }
3645
3646 static int default_noexec;
3647
3648 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3649 {
3650         const struct cred *cred = current_cred();
3651         u32 sid = cred_sid(cred);
3652         int rc = 0;
3653
3654         if (default_noexec &&
3655             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3656                                    (!shared && (prot & PROT_WRITE)))) {
3657                 /*
3658                  * We are making executable an anonymous mapping or a
3659                  * private file mapping that will also be writable.
3660                  * This has an additional check.
3661                  */
3662                 rc = avc_has_perm(&selinux_state,
3663                                   sid, sid, SECCLASS_PROCESS,
3664                                   PROCESS__EXECMEM, NULL);
3665                 if (rc)
3666                         goto error;
3667         }
3668
3669         if (file) {
3670                 /* read access is always possible with a mapping */
3671                 u32 av = FILE__READ;
3672
3673                 /* write access only matters if the mapping is shared */
3674                 if (shared && (prot & PROT_WRITE))
3675                         av |= FILE__WRITE;
3676
3677                 if (prot & PROT_EXEC)
3678                         av |= FILE__EXECUTE;
3679
3680                 return file_has_perm(cred, file, av);
3681         }
3682
3683 error:
3684         return rc;
3685 }
3686
3687 static int selinux_mmap_addr(unsigned long addr)
3688 {
3689         int rc = 0;
3690
3691         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3692                 u32 sid = current_sid();
3693                 rc = avc_has_perm(&selinux_state,
3694                                   sid, sid, SECCLASS_MEMPROTECT,
3695                                   MEMPROTECT__MMAP_ZERO, NULL);
3696         }
3697
3698         return rc;
3699 }
3700
3701 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3702                              unsigned long prot, unsigned long flags)
3703 {
3704         struct common_audit_data ad;
3705         int rc;
3706
3707         if (file) {
3708                 ad.type = LSM_AUDIT_DATA_FILE;
3709                 ad.u.file = file;
3710                 rc = inode_has_perm(current_cred(), file_inode(file),
3711                                     FILE__MAP, &ad);
3712                 if (rc)
3713                         return rc;
3714         }
3715
3716         if (selinux_state.checkreqprot)
3717                 prot = reqprot;
3718
3719         return file_map_prot_check(file, prot,
3720                                    (flags & MAP_TYPE) == MAP_SHARED);
3721 }
3722
3723 static int selinux_file_mprotect(struct vm_area_struct *vma,
3724                                  unsigned long reqprot,
3725                                  unsigned long prot)
3726 {
3727         const struct cred *cred = current_cred();
3728         u32 sid = cred_sid(cred);
3729
3730         if (selinux_state.checkreqprot)
3731                 prot = reqprot;
3732
3733         if (default_noexec &&
3734             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3735                 int rc = 0;
3736                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3737                     vma->vm_end <= vma->vm_mm->brk) {
3738                         rc = avc_has_perm(&selinux_state,
3739                                           sid, sid, SECCLASS_PROCESS,
3740                                           PROCESS__EXECHEAP, NULL);
3741                 } else if (!vma->vm_file &&
3742                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3743                              vma->vm_end >= vma->vm_mm->start_stack) ||
3744                             vma_is_stack_for_current(vma))) {
3745                         rc = avc_has_perm(&selinux_state,
3746                                           sid, sid, SECCLASS_PROCESS,
3747                                           PROCESS__EXECSTACK, NULL);
3748                 } else if (vma->vm_file && vma->anon_vma) {
3749                         /*
3750                          * We are making executable a file mapping that has
3751                          * had some COW done. Since pages might have been
3752                          * written, check ability to execute the possibly
3753                          * modified content.  This typically should only
3754                          * occur for text relocations.
3755                          */
3756                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3757                 }
3758                 if (rc)
3759                         return rc;
3760         }
3761
3762         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3763 }
3764
3765 static int selinux_file_lock(struct file *file, unsigned int cmd)
3766 {
3767         const struct cred *cred = current_cred();
3768
3769         return file_has_perm(cred, file, FILE__LOCK);
3770 }
3771
3772 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3773                               unsigned long arg)
3774 {
3775         const struct cred *cred = current_cred();
3776         int err = 0;
3777
3778         switch (cmd) {
3779         case F_SETFL:
3780                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3781                         err = file_has_perm(cred, file, FILE__WRITE);
3782                         break;
3783                 }
3784                 /* fall through */
3785         case F_SETOWN:
3786         case F_SETSIG:
3787         case F_GETFL:
3788         case F_GETOWN:
3789         case F_GETSIG:
3790         case F_GETOWNER_UIDS:
3791                 /* Just check FD__USE permission */
3792                 err = file_has_perm(cred, file, 0);
3793                 break;
3794         case F_GETLK:
3795         case F_SETLK:
3796         case F_SETLKW:
3797         case F_OFD_GETLK:
3798         case F_OFD_SETLK:
3799         case F_OFD_SETLKW:
3800 #if BITS_PER_LONG == 32
3801         case F_GETLK64:
3802         case F_SETLK64:
3803         case F_SETLKW64:
3804 #endif
3805                 err = file_has_perm(cred, file, FILE__LOCK);
3806                 break;
3807         }
3808
3809         return err;
3810 }
3811
3812 static void selinux_file_set_fowner(struct file *file)
3813 {
3814         struct file_security_struct *fsec;
3815
3816         fsec = selinux_file(file);
3817         fsec->fown_sid = current_sid();
3818 }
3819
3820 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3821                                        struct fown_struct *fown, int signum)
3822 {
3823         struct file *file;
3824         u32 sid = task_sid(tsk);
3825         u32 perm;
3826         struct file_security_struct *fsec;
3827
3828         /* struct fown_struct is never outside the context of a struct file */
3829         file = container_of(fown, struct file, f_owner);
3830
3831         fsec = selinux_file(file);
3832
3833         if (!signum)
3834                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3835         else
3836                 perm = signal_to_av(signum);
3837
3838         return avc_has_perm(&selinux_state,
3839                             fsec->fown_sid, sid,
3840                             SECCLASS_PROCESS, perm, NULL);
3841 }
3842
3843 static int selinux_file_receive(struct file *file)
3844 {
3845         const struct cred *cred = current_cred();
3846
3847         return file_has_perm(cred, file, file_to_av(file));
3848 }
3849
3850 static int selinux_file_open(struct file *file)
3851 {
3852         struct file_security_struct *fsec;
3853         struct inode_security_struct *isec;
3854
3855         fsec = selinux_file(file);
3856         isec = inode_security(file_inode(file));
3857         /*
3858          * Save inode label and policy sequence number
3859          * at open-time so that selinux_file_permission
3860          * can determine whether revalidation is necessary.
3861          * Task label is already saved in the file security
3862          * struct as its SID.
3863          */
3864         fsec->isid = isec->sid;
3865         fsec->pseqno = avc_policy_seqno(&selinux_state);
3866         /*
3867          * Since the inode label or policy seqno may have changed
3868          * between the selinux_inode_permission check and the saving
3869          * of state above, recheck that access is still permitted.
3870          * Otherwise, access might never be revalidated against the
3871          * new inode label or new policy.
3872          * This check is not redundant - do not remove.
3873          */
3874         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3875 }
3876
3877 /* task security operations */
3878
3879 static int selinux_task_alloc(struct task_struct *task,
3880                               unsigned long clone_flags)
3881 {
3882         u32 sid = current_sid();
3883
3884         return avc_has_perm(&selinux_state,
3885                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3886 }
3887
3888 /*
3889  * prepare a new set of credentials for modification
3890  */
3891 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3892                                 gfp_t gfp)
3893 {
3894         const struct task_security_struct *old_tsec = selinux_cred(old);
3895         struct task_security_struct *tsec = selinux_cred(new);
3896
3897         *tsec = *old_tsec;
3898         return 0;
3899 }
3900
3901 /*
3902  * transfer the SELinux data to a blank set of creds
3903  */
3904 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3905 {
3906         const struct task_security_struct *old_tsec = selinux_cred(old);
3907         struct task_security_struct *tsec = selinux_cred(new);
3908
3909         *tsec = *old_tsec;
3910 }
3911
3912 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3913 {
3914         *secid = cred_sid(c);
3915 }
3916
3917 /*
3918  * set the security data for a kernel service
3919  * - all the creation contexts are set to unlabelled
3920  */
3921 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3922 {
3923         struct task_security_struct *tsec = selinux_cred(new);
3924         u32 sid = current_sid();
3925         int ret;
3926
3927         ret = avc_has_perm(&selinux_state,
3928                            sid, secid,
3929                            SECCLASS_KERNEL_SERVICE,
3930                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3931                            NULL);
3932         if (ret == 0) {
3933                 tsec->sid = secid;
3934                 tsec->create_sid = 0;
3935                 tsec->keycreate_sid = 0;
3936                 tsec->sockcreate_sid = 0;
3937         }
3938         return ret;
3939 }
3940
3941 /*
3942  * set the file creation context in a security record to the same as the
3943  * objective context of the specified inode
3944  */
3945 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3946 {
3947         struct inode_security_struct *isec = inode_security(inode);
3948         struct task_security_struct *tsec = selinux_cred(new);
3949         u32 sid = current_sid();
3950         int ret;
3951
3952         ret = avc_has_perm(&selinux_state,
3953                            sid, isec->sid,
3954                            SECCLASS_KERNEL_SERVICE,
3955                            KERNEL_SERVICE__CREATE_FILES_AS,
3956                            NULL);
3957
3958         if (ret == 0)
3959                 tsec->create_sid = isec->sid;
3960         return ret;
3961 }
3962
3963 static int selinux_kernel_module_request(char *kmod_name)
3964 {
3965         struct common_audit_data ad;
3966
3967         ad.type = LSM_AUDIT_DATA_KMOD;
3968         ad.u.kmod_name = kmod_name;
3969
3970         return avc_has_perm(&selinux_state,
3971                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3972                             SYSTEM__MODULE_REQUEST, &ad);
3973 }
3974
3975 static int selinux_kernel_module_from_file(struct file *file)
3976 {
3977         struct common_audit_data ad;
3978         struct inode_security_struct *isec;
3979         struct file_security_struct *fsec;
3980         u32 sid = current_sid();
3981         int rc;
3982
3983         /* init_module */
3984         if (file == NULL)
3985                 return avc_has_perm(&selinux_state,
3986                                     sid, sid, SECCLASS_SYSTEM,
3987                                         SYSTEM__MODULE_LOAD, NULL);
3988
3989         /* finit_module */
3990
3991         ad.type = LSM_AUDIT_DATA_FILE;
3992         ad.u.file = file;
3993
3994         fsec = selinux_file(file);
3995         if (sid != fsec->sid) {
3996                 rc = avc_has_perm(&selinux_state,
3997                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3998                 if (rc)
3999                         return rc;
4000         }
4001
4002         isec = inode_security(file_inode(file));
4003         return avc_has_perm(&selinux_state,
4004                             sid, isec->sid, SECCLASS_SYSTEM,
4005                                 SYSTEM__MODULE_LOAD, &ad);
4006 }
4007
4008 static int selinux_kernel_read_file(struct file *file,
4009                                     enum kernel_read_file_id id)
4010 {
4011         int rc = 0;
4012
4013         switch (id) {
4014         case READING_MODULE:
4015                 rc = selinux_kernel_module_from_file(file);
4016                 break;
4017         default:
4018                 break;
4019         }
4020
4021         return rc;
4022 }
4023
4024 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4025 {
4026         int rc = 0;
4027
4028         switch (id) {
4029         case LOADING_MODULE:
4030                 rc = selinux_kernel_module_from_file(NULL);
4031         default:
4032                 break;
4033         }
4034
4035         return rc;
4036 }
4037
4038 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4039 {
4040         return avc_has_perm(&selinux_state,
4041                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4042                             PROCESS__SETPGID, NULL);
4043 }
4044
4045 static int selinux_task_getpgid(struct task_struct *p)
4046 {
4047         return avc_has_perm(&selinux_state,
4048                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4049                             PROCESS__GETPGID, NULL);
4050 }
4051
4052 static int selinux_task_getsid(struct task_struct *p)
4053 {
4054         return avc_has_perm(&selinux_state,
4055                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4056                             PROCESS__GETSESSION, NULL);
4057 }
4058
4059 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4060 {
4061         *secid = task_sid(p);
4062 }
4063
4064 static int selinux_task_setnice(struct task_struct *p, int nice)
4065 {
4066         return avc_has_perm(&selinux_state,
4067                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4068                             PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4072 {
4073         return avc_has_perm(&selinux_state,
4074                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4075                             PROCESS__SETSCHED, NULL);
4076 }
4077
4078 static int selinux_task_getioprio(struct task_struct *p)
4079 {
4080         return avc_has_perm(&selinux_state,
4081                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4082                             PROCESS__GETSCHED, NULL);
4083 }
4084
4085 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4086                                 unsigned int flags)
4087 {
4088         u32 av = 0;
4089
4090         if (!flags)
4091                 return 0;
4092         if (flags & LSM_PRLIMIT_WRITE)
4093                 av |= PROCESS__SETRLIMIT;
4094         if (flags & LSM_PRLIMIT_READ)
4095                 av |= PROCESS__GETRLIMIT;
4096         return avc_has_perm(&selinux_state,
4097                             cred_sid(cred), cred_sid(tcred),
4098                             SECCLASS_PROCESS, av, NULL);
4099 }
4100
4101 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4102                 struct rlimit *new_rlim)
4103 {
4104         struct rlimit *old_rlim = p->signal->rlim + resource;
4105
4106         /* Control the ability to change the hard limit (whether
4107            lowering or raising it), so that the hard limit can
4108            later be used as a safe reset point for the soft limit
4109            upon context transitions.  See selinux_bprm_committing_creds. */
4110         if (old_rlim->rlim_max != new_rlim->rlim_max)
4111                 return avc_has_perm(&selinux_state,
4112                                     current_sid(), task_sid(p),
4113                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4114
4115         return 0;
4116 }
4117
4118 static int selinux_task_setscheduler(struct task_struct *p)
4119 {
4120         return avc_has_perm(&selinux_state,
4121                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4122                             PROCESS__SETSCHED, NULL);
4123 }
4124
4125 static int selinux_task_getscheduler(struct task_struct *p)
4126 {
4127         return avc_has_perm(&selinux_state,
4128                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4129                             PROCESS__GETSCHED, NULL);
4130 }
4131
4132 static int selinux_task_movememory(struct task_struct *p)
4133 {
4134         return avc_has_perm(&selinux_state,
4135                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4136                             PROCESS__SETSCHED, NULL);
4137 }
4138
4139 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4140                                 int sig, const struct cred *cred)
4141 {
4142         u32 secid;
4143         u32 perm;
4144
4145         if (!sig)
4146                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4147         else
4148                 perm = signal_to_av(sig);
4149         if (!cred)
4150                 secid = current_sid();
4151         else
4152                 secid = cred_sid(cred);
4153         return avc_has_perm(&selinux_state,
4154                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4155 }
4156
4157 static void selinux_task_to_inode(struct task_struct *p,
4158                                   struct inode *inode)
4159 {
4160         struct inode_security_struct *isec = selinux_inode(inode);
4161         u32 sid = task_sid(p);
4162
4163         spin_lock(&isec->lock);
4164         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4165         isec->sid = sid;
4166         isec->initialized = LABEL_INITIALIZED;
4167         spin_unlock(&isec->lock);
4168 }
4169
4170 /* Returns error only if unable to parse addresses */
4171 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4172                         struct common_audit_data *ad, u8 *proto)
4173 {
4174         int offset, ihlen, ret = -EINVAL;
4175         struct iphdr _iph, *ih;
4176
4177         offset = skb_network_offset(skb);
4178         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4179         if (ih == NULL)
4180                 goto out;
4181
4182         ihlen = ih->ihl * 4;
4183         if (ihlen < sizeof(_iph))
4184                 goto out;
4185
4186         ad->u.net->v4info.saddr = ih->saddr;
4187         ad->u.net->v4info.daddr = ih->daddr;
4188         ret = 0;
4189
4190         if (proto)
4191                 *proto = ih->protocol;
4192
4193         switch (ih->protocol) {
4194         case IPPROTO_TCP: {
4195                 struct tcphdr _tcph, *th;
4196
4197                 if (ntohs(ih->frag_off) & IP_OFFSET)
4198                         break;
4199
4200                 offset += ihlen;
4201                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4202                 if (th == NULL)
4203                         break;
4204
4205                 ad->u.net->sport = th->source;
4206                 ad->u.net->dport = th->dest;
4207                 break;
4208         }
4209
4210         case IPPROTO_UDP: {
4211                 struct udphdr _udph, *uh;
4212
4213                 if (ntohs(ih->frag_off) & IP_OFFSET)
4214                         break;
4215
4216                 offset += ihlen;
4217                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4218                 if (uh == NULL)
4219                         break;
4220
4221                 ad->u.net->sport = uh->source;
4222                 ad->u.net->dport = uh->dest;
4223                 break;
4224         }
4225
4226         case IPPROTO_DCCP: {
4227                 struct dccp_hdr _dccph, *dh;
4228
4229                 if (ntohs(ih->frag_off) & IP_OFFSET)
4230                         break;
4231
4232                 offset += ihlen;
4233                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4234                 if (dh == NULL)
4235                         break;
4236
4237                 ad->u.net->sport = dh->dccph_sport;
4238                 ad->u.net->dport = dh->dccph_dport;
4239                 break;
4240         }
4241
4242 #if IS_ENABLED(CONFIG_IP_SCTP)
4243         case IPPROTO_SCTP: {
4244                 struct sctphdr _sctph, *sh;
4245
4246                 if (ntohs(ih->frag_off) & IP_OFFSET)
4247                         break;
4248
4249                 offset += ihlen;
4250                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4251                 if (sh == NULL)
4252                         break;
4253
4254                 ad->u.net->sport = sh->source;
4255                 ad->u.net->dport = sh->dest;
4256                 break;
4257         }
4258 #endif
4259         default:
4260                 break;
4261         }
4262 out:
4263         return ret;
4264 }
4265
4266 #if IS_ENABLED(CONFIG_IPV6)
4267
4268 /* Returns error only if unable to parse addresses */
4269 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4270                         struct common_audit_data *ad, u8 *proto)
4271 {
4272         u8 nexthdr;
4273         int ret = -EINVAL, offset;
4274         struct ipv6hdr _ipv6h, *ip6;
4275         __be16 frag_off;
4276
4277         offset = skb_network_offset(skb);
4278         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4279         if (ip6 == NULL)
4280                 goto out;
4281
4282         ad->u.net->v6info.saddr = ip6->saddr;
4283         ad->u.net->v6info.daddr = ip6->daddr;
4284         ret = 0;
4285
4286         nexthdr = ip6->nexthdr;
4287         offset += sizeof(_ipv6h);
4288         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4289         if (offset < 0)
4290                 goto out;
4291
4292         if (proto)
4293                 *proto = nexthdr;
4294
4295         switch (nexthdr) {
4296         case IPPROTO_TCP: {
4297                 struct tcphdr _tcph, *th;
4298
4299                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4300                 if (th == NULL)
4301                         break;
4302
4303                 ad->u.net->sport = th->source;
4304                 ad->u.net->dport = th->dest;
4305                 break;
4306         }
4307
4308         case IPPROTO_UDP: {
4309                 struct udphdr _udph, *uh;
4310
4311                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4312                 if (uh == NULL)
4313                         break;
4314
4315                 ad->u.net->sport = uh->source;
4316                 ad->u.net->dport = uh->dest;
4317                 break;
4318         }
4319
4320         case IPPROTO_DCCP: {
4321                 struct dccp_hdr _dccph, *dh;
4322
4323                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4324                 if (dh == NULL)
4325                         break;
4326
4327                 ad->u.net->sport = dh->dccph_sport;
4328                 ad->u.net->dport = dh->dccph_dport;
4329                 break;
4330         }
4331
4332 #if IS_ENABLED(CONFIG_IP_SCTP)
4333         case IPPROTO_SCTP: {
4334                 struct sctphdr _sctph, *sh;
4335
4336                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4337                 if (sh == NULL)
4338                         break;
4339
4340                 ad->u.net->sport = sh->source;
4341                 ad->u.net->dport = sh->dest;
4342                 break;
4343         }
4344 #endif
4345         /* includes fragments */
4346         default:
4347                 break;
4348         }
4349 out:
4350         return ret;
4351 }
4352
4353 #endif /* IPV6 */
4354
4355 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4356                              char **_addrp, int src, u8 *proto)
4357 {
4358         char *addrp;
4359         int ret;
4360
4361         switch (ad->u.net->family) {
4362         case PF_INET:
4363                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4364                 if (ret)
4365                         goto parse_error;
4366                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4367                                        &ad->u.net->v4info.daddr);
4368                 goto okay;
4369
4370 #if IS_ENABLED(CONFIG_IPV6)
4371         case PF_INET6:
4372                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4373                 if (ret)
4374                         goto parse_error;
4375                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4376                                        &ad->u.net->v6info.daddr);
4377                 goto okay;
4378 #endif  /* IPV6 */
4379         default:
4380                 addrp = NULL;
4381                 goto okay;
4382         }
4383
4384 parse_error:
4385         pr_warn(
4386                "SELinux: failure in selinux_parse_skb(),"
4387                " unable to parse packet\n");
4388         return ret;
4389
4390 okay:
4391         if (_addrp)
4392                 *_addrp = addrp;
4393         return 0;
4394 }
4395
4396 /**
4397  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4398  * @skb: the packet
4399  * @family: protocol family
4400  * @sid: the packet's peer label SID
4401  *
4402  * Description:
4403  * Check the various different forms of network peer labeling and determine
4404  * the peer label/SID for the packet; most of the magic actually occurs in
4405  * the security server function security_net_peersid_cmp().  The function
4406  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4407  * or -EACCES if @sid is invalid due to inconsistencies with the different
4408  * peer labels.
4409  *
4410  */
4411 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4412 {
4413         int err;
4414         u32 xfrm_sid;
4415         u32 nlbl_sid;
4416         u32 nlbl_type;
4417
4418         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4419         if (unlikely(err))
4420                 return -EACCES;
4421         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4422         if (unlikely(err))
4423                 return -EACCES;
4424
4425         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4426                                            nlbl_type, xfrm_sid, sid);
4427         if (unlikely(err)) {
4428                 pr_warn(
4429                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4430                        " unable to determine packet's peer label\n");
4431                 return -EACCES;
4432         }
4433
4434         return 0;
4435 }
4436
4437 /**
4438  * selinux_conn_sid - Determine the child socket label for a connection
4439  * @sk_sid: the parent socket's SID
4440  * @skb_sid: the packet's SID
4441  * @conn_sid: the resulting connection SID
4442  *
4443  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4444  * combined with the MLS information from @skb_sid in order to create
4445  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4446  * of @sk_sid.  Returns zero on success, negative values on failure.
4447  *
4448  */
4449 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4450 {
4451         int err = 0;
4452
4453         if (skb_sid != SECSID_NULL)
4454                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4455                                             conn_sid);
4456         else
4457                 *conn_sid = sk_sid;
4458
4459         return err;
4460 }
4461
4462 /* socket security operations */
4463
4464 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4465                                  u16 secclass, u32 *socksid)
4466 {
4467         if (tsec->sockcreate_sid > SECSID_NULL) {
4468                 *socksid = tsec->sockcreate_sid;
4469                 return 0;
4470         }
4471
4472         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4473                                        secclass, NULL, socksid);
4474 }
4475
4476 static int sock_has_perm(struct sock *sk, u32 perms)
4477 {
4478         struct sk_security_struct *sksec = sk->sk_security;
4479         struct common_audit_data ad;
4480         struct lsm_network_audit net = {0,};
4481
4482         if (sksec->sid == SECINITSID_KERNEL)
4483                 return 0;
4484
4485         ad.type = LSM_AUDIT_DATA_NET;
4486         ad.u.net = &net;
4487         ad.u.net->sk = sk;
4488
4489         return avc_has_perm(&selinux_state,
4490                             current_sid(), sksec->sid, sksec->sclass, perms,
4491                             &ad);
4492 }
4493
4494 static int selinux_socket_create(int family, int type,
4495                                  int protocol, int kern)
4496 {
4497         const struct task_security_struct *tsec = selinux_cred(current_cred());
4498         u32 newsid;
4499         u16 secclass;
4500         int rc;
4501
4502         if (kern)
4503                 return 0;
4504
4505         secclass = socket_type_to_security_class(family, type, protocol);
4506         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4507         if (rc)
4508                 return rc;
4509
4510         return avc_has_perm(&selinux_state,
4511                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4512 }
4513
4514 static int selinux_socket_post_create(struct socket *sock, int family,
4515                                       int type, int protocol, int kern)
4516 {
4517         const struct task_security_struct *tsec = selinux_cred(current_cred());
4518         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4519         struct sk_security_struct *sksec;
4520         u16 sclass = socket_type_to_security_class(family, type, protocol);
4521         u32 sid = SECINITSID_KERNEL;
4522         int err = 0;
4523
4524         if (!kern) {
4525                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4526                 if (err)
4527                         return err;
4528         }
4529
4530         isec->sclass = sclass;
4531         isec->sid = sid;
4532         isec->initialized = LABEL_INITIALIZED;
4533
4534         if (sock->sk) {
4535                 sksec = sock->sk->sk_security;
4536                 sksec->sclass = sclass;
4537                 sksec->sid = sid;
4538                 /* Allows detection of the first association on this socket */
4539                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4540                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4541
4542                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4543         }
4544
4545         return err;
4546 }
4547
4548 static int selinux_socket_socketpair(struct socket *socka,
4549                                      struct socket *sockb)
4550 {
4551         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4552         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4553
4554         sksec_a->peer_sid = sksec_b->sid;
4555         sksec_b->peer_sid = sksec_a->sid;
4556
4557         return 0;
4558 }
4559
4560 /* Range of port numbers used to automatically bind.
4561    Need to determine whether we should perform a name_bind
4562    permission check between the socket and the port number. */
4563
4564 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4565 {
4566         struct sock *sk = sock->sk;
4567         struct sk_security_struct *sksec = sk->sk_security;
4568         u16 family;
4569         int err;
4570
4571         err = sock_has_perm(sk, SOCKET__BIND);
4572         if (err)
4573                 goto out;
4574
4575         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4576         family = sk->sk_family;
4577         if (family == PF_INET || family == PF_INET6) {
4578                 char *addrp;
4579                 struct common_audit_data ad;
4580                 struct lsm_network_audit net = {0,};
4581                 struct sockaddr_in *addr4 = NULL;
4582                 struct sockaddr_in6 *addr6 = NULL;
4583                 u16 family_sa;
4584                 unsigned short snum;
4585                 u32 sid, node_perm;
4586
4587                 /*
4588                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4589                  * that validates multiple binding addresses. Because of this
4590                  * need to check address->sa_family as it is possible to have
4591                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4592                  */
4593                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4594                         return -EINVAL;
4595                 family_sa = address->sa_family;
4596                 switch (family_sa) {
4597                 case AF_UNSPEC:
4598                 case AF_INET:
4599                         if (addrlen < sizeof(struct sockaddr_in))
4600                                 return -EINVAL;
4601                         addr4 = (struct sockaddr_in *)address;
4602                         if (family_sa == AF_UNSPEC) {
4603                                 /* see __inet_bind(), we only want to allow
4604                                  * AF_UNSPEC if the address is INADDR_ANY
4605                                  */
4606                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4607                                         goto err_af;
4608                                 family_sa = AF_INET;
4609                         }
4610                         snum = ntohs(addr4->sin_port);
4611                         addrp = (char *)&addr4->sin_addr.s_addr;
4612                         break;
4613                 case AF_INET6:
4614                         if (addrlen < SIN6_LEN_RFC2133)
4615                                 return -EINVAL;
4616                         addr6 = (struct sockaddr_in6 *)address;
4617                         snum = ntohs(addr6->sin6_port);
4618                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4619                         break;
4620                 default:
4621                         goto err_af;
4622                 }
4623
4624                 ad.type = LSM_AUDIT_DATA_NET;
4625                 ad.u.net = &net;
4626                 ad.u.net->sport = htons(snum);
4627                 ad.u.net->family = family_sa;
4628
4629                 if (snum) {
4630                         int low, high;
4631
4632                         inet_get_local_port_range(sock_net(sk), &low, &high);
4633
4634                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4635                             snum < low || snum > high) {
4636                                 err = sel_netport_sid(sk->sk_protocol,
4637                                                       snum, &sid);
4638                                 if (err)
4639                                         goto out;
4640                                 err = avc_has_perm(&selinux_state,
4641                                                    sksec->sid, sid,
4642                                                    sksec->sclass,
4643                                                    SOCKET__NAME_BIND, &ad);
4644                                 if (err)
4645                                         goto out;
4646                         }
4647                 }
4648
4649                 switch (sksec->sclass) {
4650                 case SECCLASS_TCP_SOCKET:
4651                         node_perm = TCP_SOCKET__NODE_BIND;
4652                         break;
4653
4654                 case SECCLASS_UDP_SOCKET:
4655                         node_perm = UDP_SOCKET__NODE_BIND;
4656                         break;
4657
4658                 case SECCLASS_DCCP_SOCKET:
4659                         node_perm = DCCP_SOCKET__NODE_BIND;
4660                         break;
4661
4662                 case SECCLASS_SCTP_SOCKET:
4663                         node_perm = SCTP_SOCKET__NODE_BIND;
4664                         break;
4665
4666                 default:
4667                         node_perm = RAWIP_SOCKET__NODE_BIND;
4668                         break;
4669                 }
4670
4671                 err = sel_netnode_sid(addrp, family_sa, &sid);
4672                 if (err)
4673                         goto out;
4674
4675                 if (family_sa == AF_INET)
4676                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4677                 else
4678                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4679
4680                 err = avc_has_perm(&selinux_state,
4681                                    sksec->sid, sid,
4682                                    sksec->sclass, node_perm, &ad);
4683                 if (err)
4684                         goto out;
4685         }
4686 out:
4687         return err;
4688 err_af:
4689         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4690         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4691                 return -EINVAL;
4692         return -EAFNOSUPPORT;
4693 }
4694
4695 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4696  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4697  */
4698 static int selinux_socket_connect_helper(struct socket *sock,
4699                                          struct sockaddr *address, int addrlen)
4700 {
4701         struct sock *sk = sock->sk;
4702         struct sk_security_struct *sksec = sk->sk_security;
4703         int err;
4704
4705         err = sock_has_perm(sk, SOCKET__CONNECT);
4706         if (err)
4707                 return err;
4708         if (addrlen < offsetofend(struct sockaddr, sa_family))
4709                 return -EINVAL;
4710
4711         /* connect(AF_UNSPEC) has special handling, as it is a documented
4712          * way to disconnect the socket
4713          */
4714         if (address->sa_family == AF_UNSPEC)
4715                 return 0;
4716
4717         /*
4718          * If a TCP, DCCP or SCTP socket, check name_connect permission
4719          * for the port.
4720          */
4721         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4722             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4723             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4724                 struct common_audit_data ad;
4725                 struct lsm_network_audit net = {0,};
4726                 struct sockaddr_in *addr4 = NULL;
4727                 struct sockaddr_in6 *addr6 = NULL;
4728                 unsigned short snum;
4729                 u32 sid, perm;
4730
4731                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4732                  * that validates multiple connect addresses. Because of this
4733                  * need to check address->sa_family as it is possible to have
4734                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4735                  */
4736                 switch (address->sa_family) {
4737                 case AF_INET:
4738                         addr4 = (struct sockaddr_in *)address;
4739                         if (addrlen < sizeof(struct sockaddr_in))
4740                                 return -EINVAL;
4741                         snum = ntohs(addr4->sin_port);
4742                         break;
4743                 case AF_INET6:
4744                         addr6 = (struct sockaddr_in6 *)address;
4745                         if (addrlen < SIN6_LEN_RFC2133)
4746                                 return -EINVAL;
4747                         snum = ntohs(addr6->sin6_port);
4748                         break;
4749                 default:
4750                         /* Note that SCTP services expect -EINVAL, whereas
4751                          * others expect -EAFNOSUPPORT.
4752                          */
4753                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4754                                 return -EINVAL;
4755                         else
4756                                 return -EAFNOSUPPORT;
4757                 }
4758
4759                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4760                 if (err)
4761                         return err;
4762
4763                 switch (sksec->sclass) {
4764                 case SECCLASS_TCP_SOCKET:
4765                         perm = TCP_SOCKET__NAME_CONNECT;
4766                         break;
4767                 case SECCLASS_DCCP_SOCKET:
4768                         perm = DCCP_SOCKET__NAME_CONNECT;
4769                         break;
4770                 case SECCLASS_SCTP_SOCKET:
4771                         perm = SCTP_SOCKET__NAME_CONNECT;
4772                         break;
4773                 }
4774
4775                 ad.type = LSM_AUDIT_DATA_NET;
4776                 ad.u.net = &net;
4777                 ad.u.net->dport = htons(snum);
4778                 ad.u.net->family = address->sa_family;
4779                 err = avc_has_perm(&selinux_state,
4780                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4781                 if (err)
4782                         return err;
4783         }
4784
4785         return 0;
4786 }
4787
4788 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4789 static int selinux_socket_connect(struct socket *sock,
4790                                   struct sockaddr *address, int addrlen)
4791 {
4792         int err;
4793         struct sock *sk = sock->sk;
4794
4795         err = selinux_socket_connect_helper(sock, address, addrlen);
4796         if (err)
4797                 return err;
4798
4799         return selinux_netlbl_socket_connect(sk, address);
4800 }
4801
4802 static int selinux_socket_listen(struct socket *sock, int backlog)
4803 {
4804         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4805 }
4806
4807 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4808 {
4809         int err;
4810         struct inode_security_struct *isec;
4811         struct inode_security_struct *newisec;
4812         u16 sclass;
4813         u32 sid;
4814
4815         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4816         if (err)
4817                 return err;
4818
4819         isec = inode_security_novalidate(SOCK_INODE(sock));
4820         spin_lock(&isec->lock);
4821         sclass = isec->sclass;
4822         sid = isec->sid;
4823         spin_unlock(&isec->lock);
4824
4825         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4826         newisec->sclass = sclass;
4827         newisec->sid = sid;
4828         newisec->initialized = LABEL_INITIALIZED;
4829
4830         return 0;
4831 }
4832
4833 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4834                                   int size)
4835 {
4836         return sock_has_perm(sock->sk, SOCKET__WRITE);
4837 }
4838
4839 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4840                                   int size, int flags)
4841 {
4842         return sock_has_perm(sock->sk, SOCKET__READ);
4843 }
4844
4845 static int selinux_socket_getsockname(struct socket *sock)
4846 {
4847         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4848 }
4849
4850 static int selinux_socket_getpeername(struct socket *sock)
4851 {
4852         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4853 }
4854
4855 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4856 {
4857         int err;
4858
4859         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4860         if (err)
4861                 return err;
4862
4863         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4864 }
4865
4866 static int selinux_socket_getsockopt(struct socket *sock, int level,
4867                                      int optname)
4868 {
4869         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4870 }
4871
4872 static int selinux_socket_shutdown(struct socket *sock, int how)
4873 {
4874         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4875 }
4876
4877 static int selinux_socket_unix_stream_connect(struct sock *sock,
4878                                               struct sock *other,
4879                                               struct sock *newsk)
4880 {
4881         struct sk_security_struct *sksec_sock = sock->sk_security;
4882         struct sk_security_struct *sksec_other = other->sk_security;
4883         struct sk_security_struct *sksec_new = newsk->sk_security;
4884         struct common_audit_data ad;
4885         struct lsm_network_audit net = {0,};
4886         int err;
4887
4888         ad.type = LSM_AUDIT_DATA_NET;
4889         ad.u.net = &net;
4890         ad.u.net->sk = other;
4891
4892         err = avc_has_perm(&selinux_state,
4893                            sksec_sock->sid, sksec_other->sid,
4894                            sksec_other->sclass,
4895                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4896         if (err)
4897                 return err;
4898
4899         /* server child socket */
4900         sksec_new->peer_sid = sksec_sock->sid;
4901         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4902                                     sksec_sock->sid, &sksec_new->sid);
4903         if (err)
4904                 return err;
4905
4906         /* connecting socket */
4907         sksec_sock->peer_sid = sksec_new->sid;
4908
4909         return 0;
4910 }
4911
4912 static int selinux_socket_unix_may_send(struct socket *sock,
4913                                         struct socket *other)
4914 {
4915         struct sk_security_struct *ssec = sock->sk->sk_security;
4916         struct sk_security_struct *osec = other->sk->sk_security;
4917         struct common_audit_data ad;
4918         struct lsm_network_audit net = {0,};
4919
4920         ad.type = LSM_AUDIT_DATA_NET;
4921         ad.u.net = &net;
4922         ad.u.net->sk = other->sk;
4923
4924         return avc_has_perm(&selinux_state,
4925                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4926                             &ad);
4927 }
4928
4929 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4930                                     char *addrp, u16 family, u32 peer_sid,
4931                                     struct common_audit_data *ad)
4932 {
4933         int err;
4934         u32 if_sid;
4935         u32 node_sid;
4936
4937         err = sel_netif_sid(ns, ifindex, &if_sid);
4938         if (err)
4939                 return err;
4940         err = avc_has_perm(&selinux_state,
4941                            peer_sid, if_sid,
4942                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4943         if (err)
4944                 return err;
4945
4946         err = sel_netnode_sid(addrp, family, &node_sid);
4947         if (err)
4948                 return err;
4949         return avc_has_perm(&selinux_state,
4950                             peer_sid, node_sid,
4951                             SECCLASS_NODE, NODE__RECVFROM, ad);
4952 }
4953
4954 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4955                                        u16 family)
4956 {
4957         int err = 0;
4958         struct sk_security_struct *sksec = sk->sk_security;
4959         u32 sk_sid = sksec->sid;
4960         struct common_audit_data ad;
4961         struct lsm_network_audit net = {0,};
4962         char *addrp;
4963
4964         ad.type = LSM_AUDIT_DATA_NET;
4965         ad.u.net = &net;
4966         ad.u.net->netif = skb->skb_iif;
4967         ad.u.net->family = family;
4968         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4969         if (err)
4970                 return err;
4971
4972         if (selinux_secmark_enabled()) {
4973                 err = avc_has_perm(&selinux_state,
4974                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4975                                    PACKET__RECV, &ad);
4976                 if (err)
4977                         return err;
4978         }
4979
4980         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4981         if (err)
4982                 return err;
4983         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4984
4985         return err;
4986 }
4987
4988 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4989 {
4990         int err;
4991         struct sk_security_struct *sksec = sk->sk_security;
4992         u16 family = sk->sk_family;
4993         u32 sk_sid = sksec->sid;
4994         struct common_audit_data ad;
4995         struct lsm_network_audit net = {0,};
4996         char *addrp;
4997         u8 secmark_active;
4998         u8 peerlbl_active;
4999
5000         if (family != PF_INET && family != PF_INET6)
5001                 return 0;
5002
5003         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5004         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5005                 family = PF_INET;
5006
5007         /* If any sort of compatibility mode is enabled then handoff processing
5008          * to the selinux_sock_rcv_skb_compat() function to deal with the
5009          * special handling.  We do this in an attempt to keep this function
5010          * as fast and as clean as possible. */
5011         if (!selinux_policycap_netpeer())
5012                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5013
5014         secmark_active = selinux_secmark_enabled();
5015         peerlbl_active = selinux_peerlbl_enabled();
5016         if (!secmark_active && !peerlbl_active)
5017                 return 0;
5018
5019         ad.type = LSM_AUDIT_DATA_NET;
5020         ad.u.net = &net;
5021         ad.u.net->netif = skb->skb_iif;
5022         ad.u.net->family = family;
5023         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5024         if (err)
5025                 return err;
5026
5027         if (peerlbl_active) {
5028                 u32 peer_sid;
5029
5030                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5031                 if (err)
5032                         return err;
5033                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5034                                                addrp, family, peer_sid, &ad);
5035                 if (err) {
5036                         selinux_netlbl_err(skb, family, err, 0);
5037                         return err;
5038                 }
5039                 err = avc_has_perm(&selinux_state,
5040                                    sk_sid, peer_sid, SECCLASS_PEER,
5041                                    PEER__RECV, &ad);
5042                 if (err) {
5043                         selinux_netlbl_err(skb, family, err, 0);
5044                         return err;
5045                 }
5046         }
5047
5048         if (secmark_active) {
5049                 err = avc_has_perm(&selinux_state,
5050                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5051                                    PACKET__RECV, &ad);
5052                 if (err)
5053                         return err;
5054         }
5055
5056         return err;
5057 }
5058
5059 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5060                                             int __user *optlen, unsigned len)
5061 {
5062         int err = 0;
5063         char *scontext;
5064         u32 scontext_len;
5065         struct sk_security_struct *sksec = sock->sk->sk_security;
5066         u32 peer_sid = SECSID_NULL;
5067
5068         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5069             sksec->sclass == SECCLASS_TCP_SOCKET ||
5070             sksec->sclass == SECCLASS_SCTP_SOCKET)
5071                 peer_sid = sksec->peer_sid;
5072         if (peer_sid == SECSID_NULL)
5073                 return -ENOPROTOOPT;
5074
5075         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5076                                       &scontext_len);
5077         if (err)
5078                 return err;
5079
5080         if (scontext_len > len) {
5081                 err = -ERANGE;
5082                 goto out_len;
5083         }
5084
5085         if (copy_to_user(optval, scontext, scontext_len))
5086                 err = -EFAULT;
5087
5088 out_len:
5089         if (put_user(scontext_len, optlen))
5090                 err = -EFAULT;
5091         kfree(scontext);
5092         return err;
5093 }
5094
5095 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5096 {
5097         u32 peer_secid = SECSID_NULL;
5098         u16 family;
5099         struct inode_security_struct *isec;
5100
5101         if (skb && skb->protocol == htons(ETH_P_IP))
5102                 family = PF_INET;
5103         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5104                 family = PF_INET6;
5105         else if (sock)
5106                 family = sock->sk->sk_family;
5107         else
5108                 goto out;
5109
5110         if (sock && family == PF_UNIX) {
5111                 isec = inode_security_novalidate(SOCK_INODE(sock));
5112                 peer_secid = isec->sid;
5113         } else if (skb)
5114                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5115
5116 out:
5117         *secid = peer_secid;
5118         if (peer_secid == SECSID_NULL)
5119                 return -EINVAL;
5120         return 0;
5121 }
5122
5123 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5124 {
5125         struct sk_security_struct *sksec;
5126
5127         sksec = kzalloc(sizeof(*sksec), priority);
5128         if (!sksec)
5129                 return -ENOMEM;
5130
5131         sksec->peer_sid = SECINITSID_UNLABELED;
5132         sksec->sid = SECINITSID_UNLABELED;
5133         sksec->sclass = SECCLASS_SOCKET;
5134         selinux_netlbl_sk_security_reset(sksec);
5135         sk->sk_security = sksec;
5136
5137         return 0;
5138 }
5139
5140 static void selinux_sk_free_security(struct sock *sk)
5141 {
5142         struct sk_security_struct *sksec = sk->sk_security;
5143
5144         sk->sk_security = NULL;
5145         selinux_netlbl_sk_security_free(sksec);
5146         kfree(sksec);
5147 }
5148
5149 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5150 {
5151         struct sk_security_struct *sksec = sk->sk_security;
5152         struct sk_security_struct *newsksec = newsk->sk_security;
5153
5154         newsksec->sid = sksec->sid;
5155         newsksec->peer_sid = sksec->peer_sid;
5156         newsksec->sclass = sksec->sclass;
5157
5158         selinux_netlbl_sk_security_reset(newsksec);
5159 }
5160
5161 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5162 {
5163         if (!sk)
5164                 *secid = SECINITSID_ANY_SOCKET;
5165         else {
5166                 struct sk_security_struct *sksec = sk->sk_security;
5167
5168                 *secid = sksec->sid;
5169         }
5170 }
5171
5172 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5173 {
5174         struct inode_security_struct *isec =
5175                 inode_security_novalidate(SOCK_INODE(parent));
5176         struct sk_security_struct *sksec = sk->sk_security;
5177
5178         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5179             sk->sk_family == PF_UNIX)
5180                 isec->sid = sksec->sid;
5181         sksec->sclass = isec->sclass;
5182 }
5183
5184 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5185  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5186  * already present).
5187  */
5188 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5189                                       struct sk_buff *skb)
5190 {
5191         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5192         struct common_audit_data ad;
5193         struct lsm_network_audit net = {0,};
5194         u8 peerlbl_active;
5195         u32 peer_sid = SECINITSID_UNLABELED;
5196         u32 conn_sid;
5197         int err = 0;
5198
5199         if (!selinux_policycap_extsockclass())
5200                 return 0;
5201
5202         peerlbl_active = selinux_peerlbl_enabled();
5203
5204         if (peerlbl_active) {
5205                 /* This will return peer_sid = SECSID_NULL if there are
5206                  * no peer labels, see security_net_peersid_resolve().
5207                  */
5208                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5209                                               &peer_sid);
5210                 if (err)
5211                         return err;
5212
5213                 if (peer_sid == SECSID_NULL)
5214                         peer_sid = SECINITSID_UNLABELED;
5215         }
5216
5217         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5218                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5219
5220                 /* Here as first association on socket. As the peer SID
5221                  * was allowed by peer recv (and the netif/node checks),
5222                  * then it is approved by policy and used as the primary
5223                  * peer SID for getpeercon(3).
5224                  */
5225                 sksec->peer_sid = peer_sid;
5226         } else if  (sksec->peer_sid != peer_sid) {
5227                 /* Other association peer SIDs are checked to enforce
5228                  * consistency among the peer SIDs.
5229                  */
5230                 ad.type = LSM_AUDIT_DATA_NET;
5231                 ad.u.net = &net;
5232                 ad.u.net->sk = ep->base.sk;
5233                 err = avc_has_perm(&selinux_state,
5234                                    sksec->peer_sid, peer_sid, sksec->sclass,
5235                                    SCTP_SOCKET__ASSOCIATION, &ad);
5236                 if (err)
5237                         return err;
5238         }
5239
5240         /* Compute the MLS component for the connection and store
5241          * the information in ep. This will be used by SCTP TCP type
5242          * sockets and peeled off connections as they cause a new
5243          * socket to be generated. selinux_sctp_sk_clone() will then
5244          * plug this into the new socket.
5245          */
5246         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5247         if (err)
5248                 return err;
5249
5250         ep->secid = conn_sid;
5251         ep->peer_secid = peer_sid;
5252
5253         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5254         return selinux_netlbl_sctp_assoc_request(ep, skb);
5255 }
5256
5257 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5258  * based on their @optname.
5259  */
5260 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5261                                      struct sockaddr *address,
5262                                      int addrlen)
5263 {
5264         int len, err = 0, walk_size = 0;
5265         void *addr_buf;
5266         struct sockaddr *addr;
5267         struct socket *sock;
5268
5269         if (!selinux_policycap_extsockclass())
5270                 return 0;
5271
5272         /* Process one or more addresses that may be IPv4 or IPv6 */
5273         sock = sk->sk_socket;
5274         addr_buf = address;
5275
5276         while (walk_size < addrlen) {
5277                 if (walk_size + sizeof(sa_family_t) > addrlen)
5278                         return -EINVAL;
5279
5280                 addr = addr_buf;
5281                 switch (addr->sa_family) {
5282                 case AF_UNSPEC:
5283                 case AF_INET:
5284                         len = sizeof(struct sockaddr_in);
5285                         break;
5286                 case AF_INET6:
5287                         len = sizeof(struct sockaddr_in6);
5288                         break;
5289                 default:
5290                         return -EINVAL;
5291                 }
5292
5293                 if (walk_size + len > addrlen)
5294                         return -EINVAL;
5295
5296                 err = -EINVAL;
5297                 switch (optname) {
5298                 /* Bind checks */
5299                 case SCTP_PRIMARY_ADDR:
5300                 case SCTP_SET_PEER_PRIMARY_ADDR:
5301                 case SCTP_SOCKOPT_BINDX_ADD:
5302                         err = selinux_socket_bind(sock, addr, len);
5303                         break;
5304                 /* Connect checks */
5305                 case SCTP_SOCKOPT_CONNECTX:
5306                 case SCTP_PARAM_SET_PRIMARY:
5307                 case SCTP_PARAM_ADD_IP:
5308                 case SCTP_SENDMSG_CONNECT:
5309                         err = selinux_socket_connect_helper(sock, addr, len);
5310                         if (err)
5311                                 return err;
5312
5313                         /* As selinux_sctp_bind_connect() is called by the
5314                          * SCTP protocol layer, the socket is already locked,
5315                          * therefore selinux_netlbl_socket_connect_locked() is
5316                          * is called here. The situations handled are:
5317                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5318                          * whenever a new IP address is added or when a new
5319                          * primary address is selected.
5320                          * Note that an SCTP connect(2) call happens before
5321                          * the SCTP protocol layer and is handled via
5322                          * selinux_socket_connect().
5323                          */
5324                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5325                         break;
5326                 }
5327
5328                 if (err)
5329                         return err;
5330
5331                 addr_buf += len;
5332                 walk_size += len;
5333         }
5334
5335         return 0;
5336 }
5337
5338 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5339 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5340                                   struct sock *newsk)
5341 {
5342         struct sk_security_struct *sksec = sk->sk_security;
5343         struct sk_security_struct *newsksec = newsk->sk_security;
5344
5345         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5346          * the non-sctp clone version.
5347          */
5348         if (!selinux_policycap_extsockclass())
5349                 return selinux_sk_clone_security(sk, newsk);
5350
5351         newsksec->sid = ep->secid;
5352         newsksec->peer_sid = ep->peer_secid;
5353         newsksec->sclass = sksec->sclass;
5354         selinux_netlbl_sctp_sk_clone(sk, newsk);
5355 }
5356
5357 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5358                                      struct request_sock *req)
5359 {
5360         struct sk_security_struct *sksec = sk->sk_security;
5361         int err;
5362         u16 family = req->rsk_ops->family;
5363         u32 connsid;
5364         u32 peersid;
5365
5366         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5367         if (err)
5368                 return err;
5369         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5370         if (err)
5371                 return err;
5372         req->secid = connsid;
5373         req->peer_secid = peersid;
5374
5375         return selinux_netlbl_inet_conn_request(req, family);
5376 }
5377
5378 static void selinux_inet_csk_clone(struct sock *newsk,
5379                                    const struct request_sock *req)
5380 {
5381         struct sk_security_struct *newsksec = newsk->sk_security;
5382
5383         newsksec->sid = req->secid;
5384         newsksec->peer_sid = req->peer_secid;
5385         /* NOTE: Ideally, we should also get the isec->sid for the
5386            new socket in sync, but we don't have the isec available yet.
5387            So we will wait until sock_graft to do it, by which
5388            time it will have been created and available. */
5389
5390         /* We don't need to take any sort of lock here as we are the only
5391          * thread with access to newsksec */
5392         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5393 }
5394
5395 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5396 {
5397         u16 family = sk->sk_family;
5398         struct sk_security_struct *sksec = sk->sk_security;
5399
5400         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5401         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5402                 family = PF_INET;
5403
5404         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5405 }
5406
5407 static int selinux_secmark_relabel_packet(u32 sid)
5408 {
5409         const struct task_security_struct *__tsec;
5410         u32 tsid;
5411
5412         __tsec = selinux_cred(current_cred());
5413         tsid = __tsec->sid;
5414
5415         return avc_has_perm(&selinux_state,
5416                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5417                             NULL);
5418 }
5419
5420 static void selinux_secmark_refcount_inc(void)
5421 {
5422         atomic_inc(&selinux_secmark_refcount);
5423 }
5424
5425 static void selinux_secmark_refcount_dec(void)
5426 {
5427         atomic_dec(&selinux_secmark_refcount);
5428 }
5429
5430 static void selinux_req_classify_flow(const struct request_sock *req,
5431                                       struct flowi *fl)
5432 {
5433         fl->flowi_secid = req->secid;
5434 }
5435
5436 static int selinux_tun_dev_alloc_security(void **security)
5437 {
5438         struct tun_security_struct *tunsec;
5439
5440         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5441         if (!tunsec)
5442                 return -ENOMEM;
5443         tunsec->sid = current_sid();
5444
5445         *security = tunsec;
5446         return 0;
5447 }
5448
5449 static void selinux_tun_dev_free_security(void *security)
5450 {
5451         kfree(security);
5452 }
5453
5454 static int selinux_tun_dev_create(void)
5455 {
5456         u32 sid = current_sid();
5457
5458         /* we aren't taking into account the "sockcreate" SID since the socket
5459          * that is being created here is not a socket in the traditional sense,
5460          * instead it is a private sock, accessible only to the kernel, and
5461          * representing a wide range of network traffic spanning multiple
5462          * connections unlike traditional sockets - check the TUN driver to
5463          * get a better understanding of why this socket is special */
5464
5465         return avc_has_perm(&selinux_state,
5466                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5467                             NULL);
5468 }
5469
5470 static int selinux_tun_dev_attach_queue(void *security)
5471 {
5472         struct tun_security_struct *tunsec = security;
5473
5474         return avc_has_perm(&selinux_state,
5475                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5476                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5477 }
5478
5479 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5480 {
5481         struct tun_security_struct *tunsec = security;
5482         struct sk_security_struct *sksec = sk->sk_security;
5483
5484         /* we don't currently perform any NetLabel based labeling here and it
5485          * isn't clear that we would want to do so anyway; while we could apply
5486          * labeling without the support of the TUN user the resulting labeled
5487          * traffic from the other end of the connection would almost certainly
5488          * cause confusion to the TUN user that had no idea network labeling
5489          * protocols were being used */
5490
5491         sksec->sid = tunsec->sid;
5492         sksec->sclass = SECCLASS_TUN_SOCKET;
5493
5494         return 0;
5495 }
5496
5497 static int selinux_tun_dev_open(void *security)
5498 {
5499         struct tun_security_struct *tunsec = security;
5500         u32 sid = current_sid();
5501         int err;
5502
5503         err = avc_has_perm(&selinux_state,
5504                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5505                            TUN_SOCKET__RELABELFROM, NULL);
5506         if (err)
5507                 return err;
5508         err = avc_has_perm(&selinux_state,
5509                            sid, sid, SECCLASS_TUN_SOCKET,
5510                            TUN_SOCKET__RELABELTO, NULL);
5511         if (err)
5512                 return err;
5513         tunsec->sid = sid;
5514
5515         return 0;
5516 }
5517
5518 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5519 {
5520         int err = 0;
5521         u32 perm;
5522         struct nlmsghdr *nlh;
5523         struct sk_security_struct *sksec = sk->sk_security;
5524
5525         if (skb->len < NLMSG_HDRLEN) {
5526                 err = -EINVAL;
5527                 goto out;
5528         }
5529         nlh = nlmsg_hdr(skb);
5530
5531         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5532         if (err) {
5533                 if (err == -EINVAL) {
5534                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5535                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5536                                " pig=%d comm=%s\n",
5537                                sk->sk_protocol, nlh->nlmsg_type,
5538                                secclass_map[sksec->sclass - 1].name,
5539                                task_pid_nr(current), current->comm);
5540                         if (!enforcing_enabled(&selinux_state) ||
5541                             security_get_allow_unknown(&selinux_state))
5542                                 err = 0;
5543                 }
5544
5545                 /* Ignore */
5546                 if (err == -ENOENT)
5547                         err = 0;
5548                 goto out;
5549         }
5550
5551         err = sock_has_perm(sk, perm);
5552 out:
5553         return err;
5554 }
5555
5556 #ifdef CONFIG_NETFILTER
5557
5558 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5559                                        const struct net_device *indev,
5560                                        u16 family)
5561 {
5562         int err;
5563         char *addrp;
5564         u32 peer_sid;
5565         struct common_audit_data ad;
5566         struct lsm_network_audit net = {0,};
5567         u8 secmark_active;
5568         u8 netlbl_active;
5569         u8 peerlbl_active;
5570
5571         if (!selinux_policycap_netpeer())
5572                 return NF_ACCEPT;
5573
5574         secmark_active = selinux_secmark_enabled();
5575         netlbl_active = netlbl_enabled();
5576         peerlbl_active = selinux_peerlbl_enabled();
5577         if (!secmark_active && !peerlbl_active)
5578                 return NF_ACCEPT;
5579
5580         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5581                 return NF_DROP;
5582
5583         ad.type = LSM_AUDIT_DATA_NET;
5584         ad.u.net = &net;
5585         ad.u.net->netif = indev->ifindex;
5586         ad.u.net->family = family;
5587         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5588                 return NF_DROP;
5589
5590         if (peerlbl_active) {
5591                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5592                                                addrp, family, peer_sid, &ad);
5593                 if (err) {
5594                         selinux_netlbl_err(skb, family, err, 1);
5595                         return NF_DROP;
5596                 }
5597         }
5598
5599         if (secmark_active)
5600                 if (avc_has_perm(&selinux_state,
5601                                  peer_sid, skb->secmark,
5602                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5603                         return NF_DROP;
5604
5605         if (netlbl_active)
5606                 /* we do this in the FORWARD path and not the POST_ROUTING
5607                  * path because we want to make sure we apply the necessary
5608                  * labeling before IPsec is applied so we can leverage AH
5609                  * protection */
5610                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5611                         return NF_DROP;
5612
5613         return NF_ACCEPT;
5614 }
5615
5616 static unsigned int selinux_ipv4_forward(void *priv,
5617                                          struct sk_buff *skb,
5618                                          const struct nf_hook_state *state)
5619 {
5620         return selinux_ip_forward(skb, state->in, PF_INET);
5621 }
5622
5623 #if IS_ENABLED(CONFIG_IPV6)
5624 static unsigned int selinux_ipv6_forward(void *priv,
5625                                          struct sk_buff *skb,
5626                                          const struct nf_hook_state *state)
5627 {
5628         return selinux_ip_forward(skb, state->in, PF_INET6);
5629 }
5630 #endif  /* IPV6 */
5631
5632 static unsigned int selinux_ip_output(struct sk_buff *skb,
5633                                       u16 family)
5634 {
5635         struct sock *sk;
5636         u32 sid;
5637
5638         if (!netlbl_enabled())
5639                 return NF_ACCEPT;
5640
5641         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5642          * because we want to make sure we apply the necessary labeling
5643          * before IPsec is applied so we can leverage AH protection */
5644         sk = skb->sk;
5645         if (sk) {
5646                 struct sk_security_struct *sksec;
5647
5648                 if (sk_listener(sk))
5649                         /* if the socket is the listening state then this
5650                          * packet is a SYN-ACK packet which means it needs to
5651                          * be labeled based on the connection/request_sock and
5652                          * not the parent socket.  unfortunately, we can't
5653                          * lookup the request_sock yet as it isn't queued on
5654                          * the parent socket until after the SYN-ACK is sent.
5655                          * the "solution" is to simply pass the packet as-is
5656                          * as any IP option based labeling should be copied
5657                          * from the initial connection request (in the IP
5658                          * layer).  it is far from ideal, but until we get a
5659                          * security label in the packet itself this is the
5660                          * best we can do. */
5661                         return NF_ACCEPT;
5662
5663                 /* standard practice, label using the parent socket */
5664                 sksec = sk->sk_security;
5665                 sid = sksec->sid;
5666         } else
5667                 sid = SECINITSID_KERNEL;
5668         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5669                 return NF_DROP;
5670
5671         return NF_ACCEPT;
5672 }
5673
5674 static unsigned int selinux_ipv4_output(void *priv,
5675                                         struct sk_buff *skb,
5676                                         const struct nf_hook_state *state)
5677 {
5678         return selinux_ip_output(skb, PF_INET);
5679 }
5680
5681 #if IS_ENABLED(CONFIG_IPV6)
5682 static unsigned int selinux_ipv6_output(void *priv,
5683                                         struct sk_buff *skb,
5684                                         const struct nf_hook_state *state)
5685 {
5686         return selinux_ip_output(skb, PF_INET6);
5687 }
5688 #endif  /* IPV6 */
5689
5690 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5691                                                 int ifindex,
5692                                                 u16 family)
5693 {
5694         struct sock *sk = skb_to_full_sk(skb);
5695         struct sk_security_struct *sksec;
5696         struct common_audit_data ad;
5697         struct lsm_network_audit net = {0,};
5698         char *addrp;
5699         u8 proto;
5700
5701         if (sk == NULL)
5702                 return NF_ACCEPT;
5703         sksec = sk->sk_security;
5704
5705         ad.type = LSM_AUDIT_DATA_NET;
5706         ad.u.net = &net;
5707         ad.u.net->netif = ifindex;
5708         ad.u.net->family = family;
5709         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5710                 return NF_DROP;
5711
5712         if (selinux_secmark_enabled())
5713                 if (avc_has_perm(&selinux_state,
5714                                  sksec->sid, skb->secmark,
5715                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5716                         return NF_DROP_ERR(-ECONNREFUSED);
5717
5718         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5719                 return NF_DROP_ERR(-ECONNREFUSED);
5720
5721         return NF_ACCEPT;
5722 }
5723
5724 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5725                                          const struct net_device *outdev,
5726                                          u16 family)
5727 {
5728         u32 secmark_perm;
5729         u32 peer_sid;
5730         int ifindex = outdev->ifindex;
5731         struct sock *sk;
5732         struct common_audit_data ad;
5733         struct lsm_network_audit net = {0,};
5734         char *addrp;
5735         u8 secmark_active;
5736         u8 peerlbl_active;
5737
5738         /* If any sort of compatibility mode is enabled then handoff processing
5739          * to the selinux_ip_postroute_compat() function to deal with the
5740          * special handling.  We do this in an attempt to keep this function
5741          * as fast and as clean as possible. */
5742         if (!selinux_policycap_netpeer())
5743                 return selinux_ip_postroute_compat(skb, ifindex, family);
5744
5745         secmark_active = selinux_secmark_enabled();
5746         peerlbl_active = selinux_peerlbl_enabled();
5747         if (!secmark_active && !peerlbl_active)
5748                 return NF_ACCEPT;
5749
5750         sk = skb_to_full_sk(skb);
5751
5752 #ifdef CONFIG_XFRM
5753         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5754          * packet transformation so allow the packet to pass without any checks
5755          * since we'll have another chance to perform access control checks
5756          * when the packet is on it's final way out.
5757          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5758          *       is NULL, in this case go ahead and apply access control.
5759          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5760          *       TCP listening state we cannot wait until the XFRM processing
5761          *       is done as we will miss out on the SA label if we do;
5762          *       unfortunately, this means more work, but it is only once per
5763          *       connection. */
5764         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5765             !(sk && sk_listener(sk)))
5766                 return NF_ACCEPT;
5767 #endif
5768
5769         if (sk == NULL) {
5770                 /* Without an associated socket the packet is either coming
5771                  * from the kernel or it is being forwarded; check the packet
5772                  * to determine which and if the packet is being forwarded
5773                  * query the packet directly to determine the security label. */
5774                 if (skb->skb_iif) {
5775                         secmark_perm = PACKET__FORWARD_OUT;
5776                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5777                                 return NF_DROP;
5778                 } else {
5779                         secmark_perm = PACKET__SEND;
5780                         peer_sid = SECINITSID_KERNEL;
5781                 }
5782         } else if (sk_listener(sk)) {
5783                 /* Locally generated packet but the associated socket is in the
5784                  * listening state which means this is a SYN-ACK packet.  In
5785                  * this particular case the correct security label is assigned
5786                  * to the connection/request_sock but unfortunately we can't
5787                  * query the request_sock as it isn't queued on the parent
5788                  * socket until after the SYN-ACK packet is sent; the only
5789                  * viable choice is to regenerate the label like we do in
5790                  * selinux_inet_conn_request().  See also selinux_ip_output()
5791                  * for similar problems. */
5792                 u32 skb_sid;
5793                 struct sk_security_struct *sksec;
5794
5795                 sksec = sk->sk_security;
5796                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5797                         return NF_DROP;
5798                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5799                  * and the packet has been through at least one XFRM
5800                  * transformation then we must be dealing with the "final"
5801                  * form of labeled IPsec packet; since we've already applied
5802                  * all of our access controls on this packet we can safely
5803                  * pass the packet. */
5804                 if (skb_sid == SECSID_NULL) {
5805                         switch (family) {
5806                         case PF_INET:
5807                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5808                                         return NF_ACCEPT;
5809                                 break;
5810                         case PF_INET6:
5811                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5812                                         return NF_ACCEPT;
5813                                 break;
5814                         default:
5815                                 return NF_DROP_ERR(-ECONNREFUSED);
5816                         }
5817                 }
5818                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5819                         return NF_DROP;
5820                 secmark_perm = PACKET__SEND;
5821         } else {
5822                 /* Locally generated packet, fetch the security label from the
5823                  * associated socket. */
5824                 struct sk_security_struct *sksec = sk->sk_security;
5825                 peer_sid = sksec->sid;
5826                 secmark_perm = PACKET__SEND;
5827         }
5828
5829         ad.type = LSM_AUDIT_DATA_NET;
5830         ad.u.net = &net;
5831         ad.u.net->netif = ifindex;
5832         ad.u.net->family = family;
5833         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5834                 return NF_DROP;
5835
5836         if (secmark_active)
5837                 if (avc_has_perm(&selinux_state,
5838                                  peer_sid, skb->secmark,
5839                                  SECCLASS_PACKET, secmark_perm, &ad))
5840                         return NF_DROP_ERR(-ECONNREFUSED);
5841
5842         if (peerlbl_active) {
5843                 u32 if_sid;
5844                 u32 node_sid;
5845
5846                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5847                         return NF_DROP;
5848                 if (avc_has_perm(&selinux_state,
5849                                  peer_sid, if_sid,
5850                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5851                         return NF_DROP_ERR(-ECONNREFUSED);
5852
5853                 if (sel_netnode_sid(addrp, family, &node_sid))
5854                         return NF_DROP;
5855                 if (avc_has_perm(&selinux_state,
5856                                  peer_sid, node_sid,
5857                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5858                         return NF_DROP_ERR(-ECONNREFUSED);
5859         }
5860
5861         return NF_ACCEPT;
5862 }
5863
5864 static unsigned int selinux_ipv4_postroute(void *priv,
5865                                            struct sk_buff *skb,
5866                                            const struct nf_hook_state *state)
5867 {
5868         return selinux_ip_postroute(skb, state->out, PF_INET);
5869 }
5870
5871 #if IS_ENABLED(CONFIG_IPV6)
5872 static unsigned int selinux_ipv6_postroute(void *priv,
5873                                            struct sk_buff *skb,
5874                                            const struct nf_hook_state *state)
5875 {
5876         return selinux_ip_postroute(skb, state->out, PF_INET6);
5877 }
5878 #endif  /* IPV6 */
5879
5880 #endif  /* CONFIG_NETFILTER */
5881
5882 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5883 {
5884         return selinux_nlmsg_perm(sk, skb);
5885 }
5886
5887 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5888 {
5889         isec->sclass = sclass;
5890         isec->sid = current_sid();
5891 }
5892
5893 static int msg_msg_alloc_security(struct msg_msg *msg)
5894 {
5895         struct msg_security_struct *msec;
5896
5897         msec = selinux_msg_msg(msg);
5898         msec->sid = SECINITSID_UNLABELED;
5899
5900         return 0;
5901 }
5902
5903 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5904                         u32 perms)
5905 {
5906         struct ipc_security_struct *isec;
5907         struct common_audit_data ad;
5908         u32 sid = current_sid();
5909
5910         isec = selinux_ipc(ipc_perms);
5911
5912         ad.type = LSM_AUDIT_DATA_IPC;
5913         ad.u.ipc_id = ipc_perms->key;
5914
5915         return avc_has_perm(&selinux_state,
5916                             sid, isec->sid, isec->sclass, perms, &ad);
5917 }
5918
5919 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5920 {
5921         return msg_msg_alloc_security(msg);
5922 }
5923
5924 /* message queue security operations */
5925 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5926 {
5927         struct ipc_security_struct *isec;
5928         struct common_audit_data ad;
5929         u32 sid = current_sid();
5930         int rc;
5931
5932         isec = selinux_ipc(msq);
5933         ipc_init_security(isec, SECCLASS_MSGQ);
5934
5935         ad.type = LSM_AUDIT_DATA_IPC;
5936         ad.u.ipc_id = msq->key;
5937
5938         rc = avc_has_perm(&selinux_state,
5939                           sid, isec->sid, SECCLASS_MSGQ,
5940                           MSGQ__CREATE, &ad);
5941         return rc;
5942 }
5943
5944 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5945 {
5946         struct ipc_security_struct *isec;
5947         struct common_audit_data ad;
5948         u32 sid = current_sid();
5949
5950         isec = selinux_ipc(msq);
5951
5952         ad.type = LSM_AUDIT_DATA_IPC;
5953         ad.u.ipc_id = msq->key;
5954
5955         return avc_has_perm(&selinux_state,
5956                             sid, isec->sid, SECCLASS_MSGQ,
5957                             MSGQ__ASSOCIATE, &ad);
5958 }
5959
5960 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5961 {
5962         int err;
5963         int perms;
5964
5965         switch (cmd) {
5966         case IPC_INFO:
5967         case MSG_INFO:
5968                 /* No specific object, just general system-wide information. */
5969                 return avc_has_perm(&selinux_state,
5970                                     current_sid(), SECINITSID_KERNEL,
5971                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5972         case IPC_STAT:
5973         case MSG_STAT:
5974         case MSG_STAT_ANY:
5975                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5976                 break;
5977         case IPC_SET:
5978                 perms = MSGQ__SETATTR;
5979                 break;
5980         case IPC_RMID:
5981                 perms = MSGQ__DESTROY;
5982                 break;
5983         default:
5984                 return 0;
5985         }
5986
5987         err = ipc_has_perm(msq, perms);
5988         return err;
5989 }
5990
5991 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5992 {
5993         struct ipc_security_struct *isec;
5994         struct msg_security_struct *msec;
5995         struct common_audit_data ad;
5996         u32 sid = current_sid();
5997         int rc;
5998
5999         isec = selinux_ipc(msq);
6000         msec = selinux_msg_msg(msg);
6001
6002         /*
6003          * First time through, need to assign label to the message
6004          */
6005         if (msec->sid == SECINITSID_UNLABELED) {
6006                 /*
6007                  * Compute new sid based on current process and
6008                  * message queue this message will be stored in
6009                  */
6010                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6011                                              SECCLASS_MSG, NULL, &msec->sid);
6012                 if (rc)
6013                         return rc;
6014         }
6015
6016         ad.type = LSM_AUDIT_DATA_IPC;
6017         ad.u.ipc_id = msq->key;
6018
6019         /* Can this process write to the queue? */
6020         rc = avc_has_perm(&selinux_state,
6021                           sid, isec->sid, SECCLASS_MSGQ,
6022                           MSGQ__WRITE, &ad);
6023         if (!rc)
6024                 /* Can this process send the message */
6025                 rc = avc_has_perm(&selinux_state,
6026                                   sid, msec->sid, SECCLASS_MSG,
6027                                   MSG__SEND, &ad);
6028         if (!rc)
6029                 /* Can the message be put in the queue? */
6030                 rc = avc_has_perm(&selinux_state,
6031                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6032                                   MSGQ__ENQUEUE, &ad);
6033
6034         return rc;
6035 }
6036
6037 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6038                                     struct task_struct *target,
6039                                     long type, int mode)
6040 {
6041         struct ipc_security_struct *isec;
6042         struct msg_security_struct *msec;
6043         struct common_audit_data ad;
6044         u32 sid = task_sid(target);
6045         int rc;
6046
6047         isec = selinux_ipc(msq);
6048         msec = selinux_msg_msg(msg);
6049
6050         ad.type = LSM_AUDIT_DATA_IPC;
6051         ad.u.ipc_id = msq->key;
6052
6053         rc = avc_has_perm(&selinux_state,
6054                           sid, isec->sid,
6055                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6056         if (!rc)
6057                 rc = avc_has_perm(&selinux_state,
6058                                   sid, msec->sid,
6059                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6060         return rc;
6061 }
6062
6063 /* Shared Memory security operations */
6064 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6065 {
6066         struct ipc_security_struct *isec;
6067         struct common_audit_data ad;
6068         u32 sid = current_sid();
6069         int rc;
6070
6071         isec = selinux_ipc(shp);
6072         ipc_init_security(isec, SECCLASS_SHM);
6073
6074         ad.type = LSM_AUDIT_DATA_IPC;
6075         ad.u.ipc_id = shp->key;
6076
6077         rc = avc_has_perm(&selinux_state,
6078                           sid, isec->sid, SECCLASS_SHM,
6079                           SHM__CREATE, &ad);
6080         return rc;
6081 }
6082
6083 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6084 {
6085         struct ipc_security_struct *isec;
6086         struct common_audit_data ad;
6087         u32 sid = current_sid();
6088
6089         isec = selinux_ipc(shp);
6090
6091         ad.type = LSM_AUDIT_DATA_IPC;
6092         ad.u.ipc_id = shp->key;
6093
6094         return avc_has_perm(&selinux_state,
6095                             sid, isec->sid, SECCLASS_SHM,
6096                             SHM__ASSOCIATE, &ad);
6097 }
6098
6099 /* Note, at this point, shp is locked down */
6100 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6101 {
6102         int perms;
6103         int err;
6104
6105         switch (cmd) {
6106         case IPC_INFO:
6107         case SHM_INFO:
6108                 /* No specific object, just general system-wide information. */
6109                 return avc_has_perm(&selinux_state,
6110                                     current_sid(), SECINITSID_KERNEL,
6111                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6112         case IPC_STAT:
6113         case SHM_STAT:
6114         case SHM_STAT_ANY:
6115                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6116                 break;
6117         case IPC_SET:
6118                 perms = SHM__SETATTR;
6119                 break;
6120         case SHM_LOCK:
6121         case SHM_UNLOCK:
6122                 perms = SHM__LOCK;
6123                 break;
6124         case IPC_RMID:
6125                 perms = SHM__DESTROY;
6126                 break;
6127         default:
6128                 return 0;
6129         }
6130
6131         err = ipc_has_perm(shp, perms);
6132         return err;
6133 }
6134
6135 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6136                              char __user *shmaddr, int shmflg)
6137 {
6138         u32 perms;
6139
6140         if (shmflg & SHM_RDONLY)
6141                 perms = SHM__READ;
6142         else
6143                 perms = SHM__READ | SHM__WRITE;
6144
6145         return ipc_has_perm(shp, perms);
6146 }
6147
6148 /* Semaphore security operations */
6149 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6150 {
6151         struct ipc_security_struct *isec;
6152         struct common_audit_data ad;
6153         u32 sid = current_sid();
6154         int rc;
6155
6156         isec = selinux_ipc(sma);
6157         ipc_init_security(isec, SECCLASS_SEM);
6158
6159         ad.type = LSM_AUDIT_DATA_IPC;
6160         ad.u.ipc_id = sma->key;
6161
6162         rc = avc_has_perm(&selinux_state,
6163                           sid, isec->sid, SECCLASS_SEM,
6164                           SEM__CREATE, &ad);
6165         return rc;
6166 }
6167
6168 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6169 {
6170         struct ipc_security_struct *isec;
6171         struct common_audit_data ad;
6172         u32 sid = current_sid();
6173
6174         isec = selinux_ipc(sma);
6175
6176         ad.type = LSM_AUDIT_DATA_IPC;
6177         ad.u.ipc_id = sma->key;
6178
6179         return avc_has_perm(&selinux_state,
6180                             sid, isec->sid, SECCLASS_SEM,
6181                             SEM__ASSOCIATE, &ad);
6182 }
6183
6184 /* Note, at this point, sma is locked down */
6185 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6186 {
6187         int err;
6188         u32 perms;
6189
6190         switch (cmd) {
6191         case IPC_INFO:
6192         case SEM_INFO:
6193                 /* No specific object, just general system-wide information. */
6194                 return avc_has_perm(&selinux_state,
6195                                     current_sid(), SECINITSID_KERNEL,
6196                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6197         case GETPID:
6198         case GETNCNT:
6199         case GETZCNT:
6200                 perms = SEM__GETATTR;
6201                 break;
6202         case GETVAL:
6203         case GETALL:
6204                 perms = SEM__READ;
6205                 break;
6206         case SETVAL:
6207         case SETALL:
6208                 perms = SEM__WRITE;
6209                 break;
6210         case IPC_RMID:
6211                 perms = SEM__DESTROY;
6212                 break;
6213         case IPC_SET:
6214                 perms = SEM__SETATTR;
6215                 break;
6216         case IPC_STAT:
6217         case SEM_STAT:
6218         case SEM_STAT_ANY:
6219                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6220                 break;
6221         default:
6222                 return 0;
6223         }
6224
6225         err = ipc_has_perm(sma, perms);
6226         return err;
6227 }
6228
6229 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6230                              struct sembuf *sops, unsigned nsops, int alter)
6231 {
6232         u32 perms;
6233
6234         if (alter)
6235                 perms = SEM__READ | SEM__WRITE;
6236         else
6237                 perms = SEM__READ;
6238
6239         return ipc_has_perm(sma, perms);
6240 }
6241
6242 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6243 {
6244         u32 av = 0;
6245
6246         av = 0;
6247         if (flag & S_IRUGO)
6248                 av |= IPC__UNIX_READ;
6249         if (flag & S_IWUGO)
6250                 av |= IPC__UNIX_WRITE;
6251
6252         if (av == 0)
6253                 return 0;
6254
6255         return ipc_has_perm(ipcp, av);
6256 }
6257
6258 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6259 {
6260         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6261         *secid = isec->sid;
6262 }
6263
6264 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6265 {
6266         if (inode)
6267                 inode_doinit_with_dentry(inode, dentry);
6268 }
6269
6270 static int selinux_getprocattr(struct task_struct *p,
6271                                char *name, char **value)
6272 {
6273         const struct task_security_struct *__tsec;
6274         u32 sid;
6275         int error;
6276         unsigned len;
6277
6278         rcu_read_lock();
6279         __tsec = selinux_cred(__task_cred(p));
6280
6281         if (current != p) {
6282                 error = avc_has_perm(&selinux_state,
6283                                      current_sid(), __tsec->sid,
6284                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6285                 if (error)
6286                         goto bad;
6287         }
6288
6289         if (!strcmp(name, "current"))
6290                 sid = __tsec->sid;
6291         else if (!strcmp(name, "prev"))
6292                 sid = __tsec->osid;
6293         else if (!strcmp(name, "exec"))
6294                 sid = __tsec->exec_sid;
6295         else if (!strcmp(name, "fscreate"))
6296                 sid = __tsec->create_sid;
6297         else if (!strcmp(name, "keycreate"))
6298                 sid = __tsec->keycreate_sid;
6299         else if (!strcmp(name, "sockcreate"))
6300                 sid = __tsec->sockcreate_sid;
6301         else {
6302                 error = -EINVAL;
6303                 goto bad;
6304         }
6305         rcu_read_unlock();
6306
6307         if (!sid)
6308                 return 0;
6309
6310         error = security_sid_to_context(&selinux_state, sid, value, &len);
6311         if (error)
6312                 return error;
6313         return len;
6314
6315 bad:
6316         rcu_read_unlock();
6317         return error;
6318 }
6319
6320 static int selinux_setprocattr(const char *name, void *value, size_t size)
6321 {
6322         struct task_security_struct *tsec;
6323         struct cred *new;
6324         u32 mysid = current_sid(), sid = 0, ptsid;
6325         int error;
6326         char *str = value;
6327
6328         /*
6329          * Basic control over ability to set these attributes at all.
6330          */
6331         if (!strcmp(name, "exec"))
6332                 error = avc_has_perm(&selinux_state,
6333                                      mysid, mysid, SECCLASS_PROCESS,
6334                                      PROCESS__SETEXEC, NULL);
6335         else if (!strcmp(name, "fscreate"))
6336                 error = avc_has_perm(&selinux_state,
6337                                      mysid, mysid, SECCLASS_PROCESS,
6338                                      PROCESS__SETFSCREATE, NULL);
6339         else if (!strcmp(name, "keycreate"))
6340                 error = avc_has_perm(&selinux_state,
6341                                      mysid, mysid, SECCLASS_PROCESS,
6342                                      PROCESS__SETKEYCREATE, NULL);
6343         else if (!strcmp(name, "sockcreate"))
6344                 error = avc_has_perm(&selinux_state,
6345                                      mysid, mysid, SECCLASS_PROCESS,
6346                                      PROCESS__SETSOCKCREATE, NULL);
6347         else if (!strcmp(name, "current"))
6348                 error = avc_has_perm(&selinux_state,
6349                                      mysid, mysid, SECCLASS_PROCESS,
6350                                      PROCESS__SETCURRENT, NULL);
6351         else
6352                 error = -EINVAL;
6353         if (error)
6354                 return error;
6355
6356         /* Obtain a SID for the context, if one was specified. */
6357         if (size && str[0] && str[0] != '\n') {
6358                 if (str[size-1] == '\n') {
6359                         str[size-1] = 0;
6360                         size--;
6361                 }
6362                 error = security_context_to_sid(&selinux_state, value, size,
6363                                                 &sid, GFP_KERNEL);
6364                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6365                         if (!has_cap_mac_admin(true)) {
6366                                 struct audit_buffer *ab;
6367                                 size_t audit_size;
6368
6369                                 /* We strip a nul only if it is at the end, otherwise the
6370                                  * context contains a nul and we should audit that */
6371                                 if (str[size - 1] == '\0')
6372                                         audit_size = size - 1;
6373                                 else
6374                                         audit_size = size;
6375                                 ab = audit_log_start(audit_context(),
6376                                                      GFP_ATOMIC,
6377                                                      AUDIT_SELINUX_ERR);
6378                                 audit_log_format(ab, "op=fscreate invalid_context=");
6379                                 audit_log_n_untrustedstring(ab, value, audit_size);
6380                                 audit_log_end(ab);
6381
6382                                 return error;
6383                         }
6384                         error = security_context_to_sid_force(
6385                                                       &selinux_state,
6386                                                       value, size, &sid);
6387                 }
6388                 if (error)
6389                         return error;
6390         }
6391
6392         new = prepare_creds();
6393         if (!new)
6394                 return -ENOMEM;
6395
6396         /* Permission checking based on the specified context is
6397            performed during the actual operation (execve,
6398            open/mkdir/...), when we know the full context of the
6399            operation.  See selinux_bprm_set_creds for the execve
6400            checks and may_create for the file creation checks. The
6401            operation will then fail if the context is not permitted. */
6402         tsec = selinux_cred(new);
6403         if (!strcmp(name, "exec")) {
6404                 tsec->exec_sid = sid;
6405         } else if (!strcmp(name, "fscreate")) {
6406                 tsec->create_sid = sid;
6407         } else if (!strcmp(name, "keycreate")) {
6408                 if (sid) {
6409                         error = avc_has_perm(&selinux_state, mysid, sid,
6410                                              SECCLASS_KEY, KEY__CREATE, NULL);
6411                         if (error)
6412                                 goto abort_change;
6413                 }
6414                 tsec->keycreate_sid = sid;
6415         } else if (!strcmp(name, "sockcreate")) {
6416                 tsec->sockcreate_sid = sid;
6417         } else if (!strcmp(name, "current")) {
6418                 error = -EINVAL;
6419                 if (sid == 0)
6420                         goto abort_change;
6421
6422                 /* Only allow single threaded processes to change context */
6423                 error = -EPERM;
6424                 if (!current_is_single_threaded()) {
6425                         error = security_bounded_transition(&selinux_state,
6426                                                             tsec->sid, sid);
6427                         if (error)
6428                                 goto abort_change;
6429                 }
6430
6431                 /* Check permissions for the transition. */
6432                 error = avc_has_perm(&selinux_state,
6433                                      tsec->sid, sid, SECCLASS_PROCESS,
6434                                      PROCESS__DYNTRANSITION, NULL);
6435                 if (error)
6436                         goto abort_change;
6437
6438                 /* Check for ptracing, and update the task SID if ok.
6439                    Otherwise, leave SID unchanged and fail. */
6440                 ptsid = ptrace_parent_sid();
6441                 if (ptsid != 0) {
6442                         error = avc_has_perm(&selinux_state,
6443                                              ptsid, sid, SECCLASS_PROCESS,
6444                                              PROCESS__PTRACE, NULL);
6445                         if (error)
6446                                 goto abort_change;
6447                 }
6448
6449                 tsec->sid = sid;
6450         } else {
6451                 error = -EINVAL;
6452                 goto abort_change;
6453         }
6454
6455         commit_creds(new);
6456         return size;
6457
6458 abort_change:
6459         abort_creds(new);
6460         return error;
6461 }
6462
6463 static int selinux_ismaclabel(const char *name)
6464 {
6465         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6466 }
6467
6468 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6469 {
6470         return security_sid_to_context(&selinux_state, secid,
6471                                        secdata, seclen);
6472 }
6473
6474 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6475 {
6476         return security_context_to_sid(&selinux_state, secdata, seclen,
6477                                        secid, GFP_KERNEL);
6478 }
6479
6480 static void selinux_release_secctx(char *secdata, u32 seclen)
6481 {
6482         kfree(secdata);
6483 }
6484
6485 static void selinux_inode_invalidate_secctx(struct inode *inode)
6486 {
6487         struct inode_security_struct *isec = selinux_inode(inode);
6488
6489         spin_lock(&isec->lock);
6490         isec->initialized = LABEL_INVALID;
6491         spin_unlock(&isec->lock);
6492 }
6493
6494 /*
6495  *      called with inode->i_mutex locked
6496  */
6497 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6498 {
6499         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6500                                            ctx, ctxlen, 0);
6501         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6502         return rc == -EOPNOTSUPP ? 0 : rc;
6503 }
6504
6505 /*
6506  *      called with inode->i_mutex locked
6507  */
6508 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6509 {
6510         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6511 }
6512
6513 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6514 {
6515         int len = 0;
6516         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6517                                                 ctx, true);
6518         if (len < 0)
6519                 return len;
6520         *ctxlen = len;
6521         return 0;
6522 }
6523 #ifdef CONFIG_KEYS
6524
6525 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6526                              unsigned long flags)
6527 {
6528         const struct task_security_struct *tsec;
6529         struct key_security_struct *ksec;
6530
6531         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6532         if (!ksec)
6533                 return -ENOMEM;
6534
6535         tsec = selinux_cred(cred);
6536         if (tsec->keycreate_sid)
6537                 ksec->sid = tsec->keycreate_sid;
6538         else
6539                 ksec->sid = tsec->sid;
6540
6541         k->security = ksec;
6542         return 0;
6543 }
6544
6545 static void selinux_key_free(struct key *k)
6546 {
6547         struct key_security_struct *ksec = k->security;
6548
6549         k->security = NULL;
6550         kfree(ksec);
6551 }
6552
6553 static int selinux_key_permission(key_ref_t key_ref,
6554                                   const struct cred *cred,
6555                                   unsigned perm)
6556 {
6557         struct key *key;
6558         struct key_security_struct *ksec;
6559         u32 sid;
6560
6561         /* if no specific permissions are requested, we skip the
6562            permission check. No serious, additional covert channels
6563            appear to be created. */
6564         if (perm == 0)
6565                 return 0;
6566
6567         sid = cred_sid(cred);
6568
6569         key = key_ref_to_ptr(key_ref);
6570         ksec = key->security;
6571
6572         return avc_has_perm(&selinux_state,
6573                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6574 }
6575
6576 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6577 {
6578         struct key_security_struct *ksec = key->security;
6579         char *context = NULL;
6580         unsigned len;
6581         int rc;
6582
6583         rc = security_sid_to_context(&selinux_state, ksec->sid,
6584                                      &context, &len);
6585         if (!rc)
6586                 rc = len;
6587         *_buffer = context;
6588         return rc;
6589 }
6590 #endif
6591
6592 #ifdef CONFIG_SECURITY_INFINIBAND
6593 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6594 {
6595         struct common_audit_data ad;
6596         int err;
6597         u32 sid = 0;
6598         struct ib_security_struct *sec = ib_sec;
6599         struct lsm_ibpkey_audit ibpkey;
6600
6601         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6602         if (err)
6603                 return err;
6604
6605         ad.type = LSM_AUDIT_DATA_IBPKEY;
6606         ibpkey.subnet_prefix = subnet_prefix;
6607         ibpkey.pkey = pkey_val;
6608         ad.u.ibpkey = &ibpkey;
6609         return avc_has_perm(&selinux_state,
6610                             sec->sid, sid,
6611                             SECCLASS_INFINIBAND_PKEY,
6612                             INFINIBAND_PKEY__ACCESS, &ad);
6613 }
6614
6615 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6616                                             u8 port_num)
6617 {
6618         struct common_audit_data ad;
6619         int err;
6620         u32 sid = 0;
6621         struct ib_security_struct *sec = ib_sec;
6622         struct lsm_ibendport_audit ibendport;
6623
6624         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6625                                       &sid);
6626
6627         if (err)
6628                 return err;
6629
6630         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6631         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6632         ibendport.port = port_num;
6633         ad.u.ibendport = &ibendport;
6634         return avc_has_perm(&selinux_state,
6635                             sec->sid, sid,
6636                             SECCLASS_INFINIBAND_ENDPORT,
6637                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6638 }
6639
6640 static int selinux_ib_alloc_security(void **ib_sec)
6641 {
6642         struct ib_security_struct *sec;
6643
6644         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6645         if (!sec)
6646                 return -ENOMEM;
6647         sec->sid = current_sid();
6648
6649         *ib_sec = sec;
6650         return 0;
6651 }
6652
6653 static void selinux_ib_free_security(void *ib_sec)
6654 {
6655         kfree(ib_sec);
6656 }
6657 #endif
6658
6659 #ifdef CONFIG_BPF_SYSCALL
6660 static int selinux_bpf(int cmd, union bpf_attr *attr,
6661                                      unsigned int size)
6662 {
6663         u32 sid = current_sid();
6664         int ret;
6665
6666         switch (cmd) {
6667         case BPF_MAP_CREATE:
6668                 ret = avc_has_perm(&selinux_state,
6669                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6670                                    NULL);
6671                 break;
6672         case BPF_PROG_LOAD:
6673                 ret = avc_has_perm(&selinux_state,
6674                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6675                                    NULL);
6676                 break;
6677         default:
6678                 ret = 0;
6679                 break;
6680         }
6681
6682         return ret;
6683 }
6684
6685 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6686 {
6687         u32 av = 0;
6688
6689         if (fmode & FMODE_READ)
6690                 av |= BPF__MAP_READ;
6691         if (fmode & FMODE_WRITE)
6692                 av |= BPF__MAP_WRITE;
6693         return av;
6694 }
6695
6696 /* This function will check the file pass through unix socket or binder to see
6697  * if it is a bpf related object. And apply correspinding checks on the bpf
6698  * object based on the type. The bpf maps and programs, not like other files and
6699  * socket, are using a shared anonymous inode inside the kernel as their inode.
6700  * So checking that inode cannot identify if the process have privilege to
6701  * access the bpf object and that's why we have to add this additional check in
6702  * selinux_file_receive and selinux_binder_transfer_files.
6703  */
6704 static int bpf_fd_pass(struct file *file, u32 sid)
6705 {
6706         struct bpf_security_struct *bpfsec;
6707         struct bpf_prog *prog;
6708         struct bpf_map *map;
6709         int ret;
6710
6711         if (file->f_op == &bpf_map_fops) {
6712                 map = file->private_data;
6713                 bpfsec = map->security;
6714                 ret = avc_has_perm(&selinux_state,
6715                                    sid, bpfsec->sid, SECCLASS_BPF,
6716                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6717                 if (ret)
6718                         return ret;
6719         } else if (file->f_op == &bpf_prog_fops) {
6720                 prog = file->private_data;
6721                 bpfsec = prog->aux->security;
6722                 ret = avc_has_perm(&selinux_state,
6723                                    sid, bpfsec->sid, SECCLASS_BPF,
6724                                    BPF__PROG_RUN, NULL);
6725                 if (ret)
6726                         return ret;
6727         }
6728         return 0;
6729 }
6730
6731 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6732 {
6733         u32 sid = current_sid();
6734         struct bpf_security_struct *bpfsec;
6735
6736         bpfsec = map->security;
6737         return avc_has_perm(&selinux_state,
6738                             sid, bpfsec->sid, SECCLASS_BPF,
6739                             bpf_map_fmode_to_av(fmode), NULL);
6740 }
6741
6742 static int selinux_bpf_prog(struct bpf_prog *prog)
6743 {
6744         u32 sid = current_sid();
6745         struct bpf_security_struct *bpfsec;
6746
6747         bpfsec = prog->aux->security;
6748         return avc_has_perm(&selinux_state,
6749                             sid, bpfsec->sid, SECCLASS_BPF,
6750                             BPF__PROG_RUN, NULL);
6751 }
6752
6753 static int selinux_bpf_map_alloc(struct bpf_map *map)
6754 {
6755         struct bpf_security_struct *bpfsec;
6756
6757         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6758         if (!bpfsec)
6759                 return -ENOMEM;
6760
6761         bpfsec->sid = current_sid();
6762         map->security = bpfsec;
6763
6764         return 0;
6765 }
6766
6767 static void selinux_bpf_map_free(struct bpf_map *map)
6768 {
6769         struct bpf_security_struct *bpfsec = map->security;
6770
6771         map->security = NULL;
6772         kfree(bpfsec);
6773 }
6774
6775 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6776 {
6777         struct bpf_security_struct *bpfsec;
6778
6779         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6780         if (!bpfsec)
6781                 return -ENOMEM;
6782
6783         bpfsec->sid = current_sid();
6784         aux->security = bpfsec;
6785
6786         return 0;
6787 }
6788
6789 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6790 {
6791         struct bpf_security_struct *bpfsec = aux->security;
6792
6793         aux->security = NULL;
6794         kfree(bpfsec);
6795 }
6796 #endif
6797
6798 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6799         .lbs_cred = sizeof(struct task_security_struct),
6800         .lbs_file = sizeof(struct file_security_struct),
6801         .lbs_inode = sizeof(struct inode_security_struct),
6802         .lbs_ipc = sizeof(struct ipc_security_struct),
6803         .lbs_msg_msg = sizeof(struct msg_security_struct),
6804 };
6805
6806 #ifdef CONFIG_PERF_EVENTS
6807 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6808 {
6809         u32 requested, sid = current_sid();
6810
6811         if (type == PERF_SECURITY_OPEN)
6812                 requested = PERF_EVENT__OPEN;
6813         else if (type == PERF_SECURITY_CPU)
6814                 requested = PERF_EVENT__CPU;
6815         else if (type == PERF_SECURITY_KERNEL)
6816                 requested = PERF_EVENT__KERNEL;
6817         else if (type == PERF_SECURITY_TRACEPOINT)
6818                 requested = PERF_EVENT__TRACEPOINT;
6819         else
6820                 return -EINVAL;
6821
6822         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6823                             requested, NULL);
6824 }
6825
6826 static int selinux_perf_event_alloc(struct perf_event *event)
6827 {
6828         struct perf_event_security_struct *perfsec;
6829
6830         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6831         if (!perfsec)
6832                 return -ENOMEM;
6833
6834         perfsec->sid = current_sid();
6835         event->security = perfsec;
6836
6837         return 0;
6838 }
6839
6840 static void selinux_perf_event_free(struct perf_event *event)
6841 {
6842         struct perf_event_security_struct *perfsec = event->security;
6843
6844         event->security = NULL;
6845         kfree(perfsec);
6846 }
6847
6848 static int selinux_perf_event_read(struct perf_event *event)
6849 {
6850         struct perf_event_security_struct *perfsec = event->security;
6851         u32 sid = current_sid();
6852
6853         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6854                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6855 }
6856
6857 static int selinux_perf_event_write(struct perf_event *event)
6858 {
6859         struct perf_event_security_struct *perfsec = event->security;
6860         u32 sid = current_sid();
6861
6862         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6863                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6864 }
6865 #endif
6866
6867 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6868         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6869         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6870         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6871         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6872
6873         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6874         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6875         LSM_HOOK_INIT(capget, selinux_capget),
6876         LSM_HOOK_INIT(capset, selinux_capset),
6877         LSM_HOOK_INIT(capable, selinux_capable),
6878         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6879         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6880         LSM_HOOK_INIT(syslog, selinux_syslog),
6881         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6882
6883         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6884
6885         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6886         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6887         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6888
6889         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6890         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6891
6892         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6893         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6894         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6895         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6896         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6897         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6898         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6899         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6900         LSM_HOOK_INIT(sb_mount, selinux_mount),
6901         LSM_HOOK_INIT(sb_umount, selinux_umount),
6902         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6903         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6904         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6905
6906         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6907         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6908
6909         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6910         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6911         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6912         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6913         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6914         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6915         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6916         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6917         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6918         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6919         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6920         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6921         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6922         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6923         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6924         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6925         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6926         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6927         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6928         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6929         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6930         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6931         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6932         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6933         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6934         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6935         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6936         LSM_HOOK_INIT(path_notify, selinux_path_notify),
6937
6938         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6939
6940         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6941         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6942         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6943         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6944         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6945         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6946         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6947         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6948         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6949         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6950         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6951
6952         LSM_HOOK_INIT(file_open, selinux_file_open),
6953
6954         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6955         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6956         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6957         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6958         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6959         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6960         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6961         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6962         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6963         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6964         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6965         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6966         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6967         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6968         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6969         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6970         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6971         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6972         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6973         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6974         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6975         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6976         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6977
6978         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6979         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6980
6981         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6982
6983         LSM_HOOK_INIT(msg_queue_alloc_security,
6984                         selinux_msg_queue_alloc_security),
6985         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6986         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6987         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6988         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6989
6990         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6991         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6992         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6993         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6994
6995         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6996         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6997         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6998         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6999
7000         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7001
7002         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7003         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7004
7005         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7006         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7007         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7008         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7009         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7010         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7011         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7012         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7013
7014         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7015         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7016
7017         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7018         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7019         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7020         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7021         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7022         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7023         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7024         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7025         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7026         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7027         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7028         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7029         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7030         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7031         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7032         LSM_HOOK_INIT(socket_getpeersec_stream,
7033                         selinux_socket_getpeersec_stream),
7034         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7035         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7036         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7037         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7038         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7039         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7040         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7041         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7042         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7043         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7044         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7045         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7046         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7047         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7048         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7049         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7050         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7051         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7052         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7053         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7054         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7055         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7056 #ifdef CONFIG_SECURITY_INFINIBAND
7057         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7058         LSM_HOOK_INIT(ib_endport_manage_subnet,
7059                       selinux_ib_endport_manage_subnet),
7060         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7061         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7062 #endif
7063 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7064         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7065         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7066         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7067         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7068         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7069         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7070                         selinux_xfrm_state_alloc_acquire),
7071         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7072         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7073         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7074         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7075                         selinux_xfrm_state_pol_flow_match),
7076         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7077 #endif
7078
7079 #ifdef CONFIG_KEYS
7080         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7081         LSM_HOOK_INIT(key_free, selinux_key_free),
7082         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7083         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7084 #endif
7085
7086 #ifdef CONFIG_AUDIT
7087         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7088         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7089         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7090         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7091 #endif
7092
7093 #ifdef CONFIG_BPF_SYSCALL
7094         LSM_HOOK_INIT(bpf, selinux_bpf),
7095         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7096         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7097         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7098         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7099         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7100         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7101 #endif
7102
7103 #ifdef CONFIG_PERF_EVENTS
7104         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7105         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7106         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7107         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7108         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7109 #endif
7110 };
7111
7112 static __init int selinux_init(void)
7113 {
7114         pr_info("SELinux:  Initializing.\n");
7115
7116         memset(&selinux_state, 0, sizeof(selinux_state));
7117         enforcing_set(&selinux_state, selinux_enforcing_boot);
7118         selinux_state.checkreqprot = selinux_checkreqprot_boot;
7119         selinux_ss_init(&selinux_state.ss);
7120         selinux_avc_init(&selinux_state.avc);
7121
7122         /* Set the security state for the initial task. */
7123         cred_init_security();
7124
7125         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7126
7127         avc_init();
7128
7129         avtab_cache_init();
7130
7131         ebitmap_cache_init();
7132
7133         hashtab_cache_init();
7134
7135         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7136
7137         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7138                 panic("SELinux: Unable to register AVC netcache callback\n");
7139
7140         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7141                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7142
7143         if (selinux_enforcing_boot)
7144                 pr_debug("SELinux:  Starting in enforcing mode\n");
7145         else
7146                 pr_debug("SELinux:  Starting in permissive mode\n");
7147
7148         fs_validate_description(&selinux_fs_parameters);
7149
7150         return 0;
7151 }
7152
7153 static void delayed_superblock_init(struct super_block *sb, void *unused)
7154 {
7155         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7156 }
7157
7158 void selinux_complete_init(void)
7159 {
7160         pr_debug("SELinux:  Completing initialization.\n");
7161
7162         /* Set up any superblocks initialized prior to the policy load. */
7163         pr_debug("SELinux:  Setting up existing superblocks.\n");
7164         iterate_supers(delayed_superblock_init, NULL);
7165 }
7166
7167 /* SELinux requires early initialization in order to label
7168    all processes and objects when they are created. */
7169 DEFINE_LSM(selinux) = {
7170         .name = "selinux",
7171         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7172         .enabled = &selinux_enabled,
7173         .blobs = &selinux_blob_sizes,
7174         .init = selinux_init,
7175 };
7176
7177 #if defined(CONFIG_NETFILTER)
7178
7179 static const struct nf_hook_ops selinux_nf_ops[] = {
7180         {
7181                 .hook =         selinux_ipv4_postroute,
7182                 .pf =           NFPROTO_IPV4,
7183                 .hooknum =      NF_INET_POST_ROUTING,
7184                 .priority =     NF_IP_PRI_SELINUX_LAST,
7185         },
7186         {
7187                 .hook =         selinux_ipv4_forward,
7188                 .pf =           NFPROTO_IPV4,
7189                 .hooknum =      NF_INET_FORWARD,
7190                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7191         },
7192         {
7193                 .hook =         selinux_ipv4_output,
7194                 .pf =           NFPROTO_IPV4,
7195                 .hooknum =      NF_INET_LOCAL_OUT,
7196                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7197         },
7198 #if IS_ENABLED(CONFIG_IPV6)
7199         {
7200                 .hook =         selinux_ipv6_postroute,
7201                 .pf =           NFPROTO_IPV6,
7202                 .hooknum =      NF_INET_POST_ROUTING,
7203                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7204         },
7205         {
7206                 .hook =         selinux_ipv6_forward,
7207                 .pf =           NFPROTO_IPV6,
7208                 .hooknum =      NF_INET_FORWARD,
7209                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7210         },
7211         {
7212                 .hook =         selinux_ipv6_output,
7213                 .pf =           NFPROTO_IPV6,
7214                 .hooknum =      NF_INET_LOCAL_OUT,
7215                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7216         },
7217 #endif  /* IPV6 */
7218 };
7219
7220 static int __net_init selinux_nf_register(struct net *net)
7221 {
7222         return nf_register_net_hooks(net, selinux_nf_ops,
7223                                      ARRAY_SIZE(selinux_nf_ops));
7224 }
7225
7226 static void __net_exit selinux_nf_unregister(struct net *net)
7227 {
7228         nf_unregister_net_hooks(net, selinux_nf_ops,
7229                                 ARRAY_SIZE(selinux_nf_ops));
7230 }
7231
7232 static struct pernet_operations selinux_net_ops = {
7233         .init = selinux_nf_register,
7234         .exit = selinux_nf_unregister,
7235 };
7236
7237 static int __init selinux_nf_ip_init(void)
7238 {
7239         int err;
7240
7241         if (!selinux_enabled)
7242                 return 0;
7243
7244         pr_debug("SELinux:  Registering netfilter hooks\n");
7245
7246         err = register_pernet_subsys(&selinux_net_ops);
7247         if (err)
7248                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7249
7250         return 0;
7251 }
7252 __initcall(selinux_nf_ip_init);
7253
7254 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7255 static void selinux_nf_ip_exit(void)
7256 {
7257         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7258
7259         unregister_pernet_subsys(&selinux_net_ops);
7260 }
7261 #endif
7262
7263 #else /* CONFIG_NETFILTER */
7264
7265 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7266 #define selinux_nf_ip_exit()
7267 #endif
7268
7269 #endif /* CONFIG_NETFILTER */
7270
7271 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7272 int selinux_disable(struct selinux_state *state)
7273 {
7274         if (state->initialized) {
7275                 /* Not permitted after initial policy load. */
7276                 return -EINVAL;
7277         }
7278
7279         if (state->disabled) {
7280                 /* Only do this once. */
7281                 return -EINVAL;
7282         }
7283
7284         state->disabled = 1;
7285
7286         pr_info("SELinux:  Disabled at runtime.\n");
7287
7288         selinux_enabled = 0;
7289
7290         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7291
7292         /* Try to destroy the avc node cache */
7293         avc_disable();
7294
7295         /* Unregister netfilter hooks. */
7296         selinux_nf_ip_exit();
7297
7298         /* Unregister selinuxfs. */
7299         exit_sel_fs();
7300
7301         return 0;
7302 }
7303 #endif