security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/kernel_read_file.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched/signal.h>
  30 #include <linux/sched/task.h>
  31 #include <linux/lsm_hooks.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/proc_fs.h>
  40 #include <linux/swap.h>
  41 #include <linux/spinlock.h>
  42 #include <linux/syscalls.h>
  43 #include <linux/dcache.h>
  44 #include <linux/file.h>
  45 #include <linux/fdtable.h>
  46 #include <linux/namei.h>
  47 #include <linux/mount.h>
  48 #include <linux/fs_context.h>
  49 #include <linux/fs_parser.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/sctp.h>
  70 #include <net/sctp/structs.h>
  71 #include <linux/quota.h>
  72 #include <linux/un.h>           /* for Unix socket types */
  73 #include <net/af_unix.h>        /* for Unix socket types */
  74 #include <linux/parser.h>
  75 #include <linux/nfs_mount.h>
  76 #include <net/ipv6.h>
  77 #include <linux/hugetlb.h>
  78 #include <linux/personality.h>
  79 #include <linux/audit.h>
  80 #include <linux/string.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89 #include <linux/kernfs.h>
  90 #include <linux/stringhash.h>   /* for hashlen_string() */
  91 #include <uapi/linux/mount.h>
  92 #include <linux/fsnotify.h>
  93 #include <linux/fanotify.h>
  94 #include <linux/io_uring.h>
  95
  96 #include "avc.h"
  97 #include "objsec.h"
  98 #include "netif.h"
  99 #include "netnode.h"
 100 #include "netport.h"
 101 #include "ibpkey.h"
 102 #include "xfrm.h"
 103 #include "netlabel.h"
 104 #include "audit.h"
 105 #include "avc_ss.h"
 106
 107 struct selinux_state selinux_state;
 108
 109 /* SECMARK reference count */
 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 111
 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 113 static int selinux_enforcing_boot __initdata;
 114
 115 static int __init enforcing_setup(char *str)
 116 {
 117         unsigned long enforcing;
 118         if (!kstrtoul(str, 0, &enforcing))
 119                 selinux_enforcing_boot = enforcing ? 1 : 0;
 120         return 1;
 121 }
 122 __setup("enforcing=", enforcing_setup);
 123 #else
 124 #define selinux_enforcing_boot 1
 125 #endif
 126
 127 int selinux_enabled_boot __initdata = 1;
 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 129 static int __init selinux_enabled_setup(char *str)
 130 {
 131         unsigned long enabled;
 132         if (!kstrtoul(str, 0, &enabled))
 133                 selinux_enabled_boot = enabled ? 1 : 0;
 134         return 1;
 135 }
 136 __setup("selinux=", selinux_enabled_setup);
 137 #endif
 138
 139 static unsigned int selinux_checkreqprot_boot =
 140         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 141
 142 static int __init checkreqprot_setup(char *str)
 143 {
 144         unsigned long checkreqprot;
 145
 146         if (!kstrtoul(str, 0, &checkreqprot)) {
 147                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 148                 if (checkreqprot)
 149                         pr_err("SELinux: checkreqprot set to 1 via kernel parameter.  This is deprecated and will be rejected in a future kernel release.\n");
 150         }
 151         return 1;
 152 }
 153 __setup("checkreqprot=", checkreqprot_setup);
 154
 155 /**
 156  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 157  *
 158  * Description:
 159  * This function checks the SECMARK reference counter to see if any SECMARK
 160  * targets are currently configured, if the reference counter is greater than
 161  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 162  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 163  * policy capability is enabled, SECMARK is always considered enabled.
 164  *
 165  */
 166 static int selinux_secmark_enabled(void)
 167 {
 168         return (selinux_policycap_alwaysnetwork() ||
 169                 atomic_read(&selinux_secmark_refcount));
 170 }
 171
 172 /**
 173  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 174  *
 175  * Description:
 176  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 177  * (1) if any are enabled or false (0) if neither are enabled.  If the
 178  * always_check_network policy capability is enabled, peer labeling
 179  * is always considered enabled.
 180  *
 181  */
 182 static int selinux_peerlbl_enabled(void)
 183 {
 184         return (selinux_policycap_alwaysnetwork() ||
 185                 netlbl_enabled() || selinux_xfrm_enabled());
 186 }
 187
 188 static int selinux_netcache_avc_callback(u32 event)
 189 {
 190         if (event == AVC_CALLBACK_RESET) {
 191                 sel_netif_flush();
 192                 sel_netnode_flush();
 193                 sel_netport_flush();
 194                 synchronize_net();
 195         }
 196         return 0;
 197 }
 198
 199 static int selinux_lsm_notifier_avc_callback(u32 event)
 200 {
 201         if (event == AVC_CALLBACK_RESET) {
 202                 sel_ib_pkey_flush();
 203                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 204         }
 205
 206         return 0;
 207 }
 208
 209 /*
 210  * initialise the security for the init task
 211  */
 212 static void cred_init_security(void)
 213 {
 214         struct task_security_struct *tsec;
 215
 216         tsec = selinux_cred(unrcu_pointer(current->real_cred));
 217         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 218 }
 219
 220 /*
 221  * get the security ID of a set of credentials
 222  */
 223 static inline u32 cred_sid(const struct cred *cred)
 224 {
 225         const struct task_security_struct *tsec;
 226
 227         tsec = selinux_cred(cred);
 228         return tsec->sid;
 229 }
 230
 231 /*
 232  * get the objective security ID of a task
 233  */
 234 static inline u32 task_sid_obj(const struct task_struct *task)
 235 {
 236         u32 sid;
 237
 238         rcu_read_lock();
 239         sid = cred_sid(__task_cred(task));
 240         rcu_read_unlock();
 241         return sid;
 242 }
 243
 244 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 245
 246 /*
 247  * Try reloading inode security labels that have been marked as invalid.  The
 248  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 249  * allowed; when set to false, returns -ECHILD when the label is
 250  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 251  */
 252 static int __inode_security_revalidate(struct inode *inode,
 253                                        struct dentry *dentry,
 254                                        bool may_sleep)
 255 {
 256         struct inode_security_struct *isec = selinux_inode(inode);
 257
 258         might_sleep_if(may_sleep);
 259
 260         if (selinux_initialized(&selinux_state) &&
 261             isec->initialized != LABEL_INITIALIZED) {
 262                 if (!may_sleep)
 263                         return -ECHILD;
 264
 265                 /*
 266                  * Try reloading the inode security label.  This will fail if
 267                  * @opt_dentry is NULL and no dentry for this inode can be
 268                  * found; in that case, continue using the old label.
 269                  */
 270                 inode_doinit_with_dentry(inode, dentry);
 271         }
 272         return 0;
 273 }
 274
 275 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 276 {
 277         return selinux_inode(inode);
 278 }
 279
 280 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 281 {
 282         int error;
 283
 284         error = __inode_security_revalidate(inode, NULL, !rcu);
 285         if (error)
 286                 return ERR_PTR(error);
 287         return selinux_inode(inode);
 288 }
 289
 290 /*
 291  * Get the security label of an inode.
 292  */
 293 static struct inode_security_struct *inode_security(struct inode *inode)
 294 {
 295         __inode_security_revalidate(inode, NULL, true);
 296         return selinux_inode(inode);
 297 }
 298
 299 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 300 {
 301         struct inode *inode = d_backing_inode(dentry);
 302
 303         return selinux_inode(inode);
 304 }
 305
 306 /*
 307  * Get the security label of a dentry's backing inode.
 308  */
 309 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 310 {
 311         struct inode *inode = d_backing_inode(dentry);
 312
 313         __inode_security_revalidate(inode, dentry, true);
 314         return selinux_inode(inode);
 315 }
 316
 317 static void inode_free_security(struct inode *inode)
 318 {
 319         struct inode_security_struct *isec = selinux_inode(inode);
 320         struct superblock_security_struct *sbsec;
 321
 322         if (!isec)
 323                 return;
 324         sbsec = selinux_superblock(inode->i_sb);
 325         /*
 326          * As not all inode security structures are in a list, we check for
 327          * empty list outside of the lock to make sure that we won't waste
 328          * time taking a lock doing nothing.
 329          *
 330          * The list_del_init() function can be safely called more than once.
 331          * It should not be possible for this function to be called with
 332          * concurrent list_add(), but for better safety against future changes
 333          * in the code, we use list_empty_careful() here.
 334          */
 335         if (!list_empty_careful(&isec->list)) {
 336                 spin_lock(&sbsec->isec_lock);
 337                 list_del_init(&isec->list);
 338                 spin_unlock(&sbsec->isec_lock);
 339         }
 340 }
 341
 342 struct selinux_mnt_opts {
 343         u32 fscontext_sid;
 344         u32 context_sid;
 345         u32 rootcontext_sid;
 346         u32 defcontext_sid;
 347 };
 348
 349 static void selinux_free_mnt_opts(void *mnt_opts)
 350 {
 351         kfree(mnt_opts);
 352 }
 353
 354 enum {
 355         Opt_error = -1,
 356         Opt_context = 0,
 357         Opt_defcontext = 1,
 358         Opt_fscontext = 2,
 359         Opt_rootcontext = 3,
 360         Opt_seclabel = 4,
 361 };
 362
 363 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 364 static struct {
 365         const char *name;
 366         int len;
 367         int opt;
 368         bool has_arg;
 369 } tokens[] = {
 370         A(context, true),
 371         A(fscontext, true),
 372         A(defcontext, true),
 373         A(rootcontext, true),
 374         A(seclabel, false),
 375 };
 376 #undef A
 377
 378 static int match_opt_prefix(char *s, int l, char **arg)
 379 {
 380         int i;
 381
 382         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 383                 size_t len = tokens[i].len;
 384                 if (len > l || memcmp(s, tokens[i].name, len))
 385                         continue;
 386                 if (tokens[i].has_arg) {
 387                         if (len == l || s[len] != '=')
 388                                 continue;
 389                         *arg = s + len + 1;
 390                 } else if (len != l)
 391                         continue;
 392                 return tokens[i].opt;
 393         }
 394         return Opt_error;
 395 }
 396
 397 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 398
 399 static int may_context_mount_sb_relabel(u32 sid,
 400                         struct superblock_security_struct *sbsec,
 401                         const struct cred *cred)
 402 {
 403         const struct task_security_struct *tsec = selinux_cred(cred);
 404         int rc;
 405
 406         rc = avc_has_perm(&selinux_state,
 407                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 408                           FILESYSTEM__RELABELFROM, NULL);
 409         if (rc)
 410                 return rc;
 411
 412         rc = avc_has_perm(&selinux_state,
 413                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 414                           FILESYSTEM__RELABELTO, NULL);
 415         return rc;
 416 }
 417
 418 static int may_context_mount_inode_relabel(u32 sid,
 419                         struct superblock_security_struct *sbsec,
 420                         const struct cred *cred)
 421 {
 422         const struct task_security_struct *tsec = selinux_cred(cred);
 423         int rc;
 424         rc = avc_has_perm(&selinux_state,
 425                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 426                           FILESYSTEM__RELABELFROM, NULL);
 427         if (rc)
 428                 return rc;
 429
 430         rc = avc_has_perm(&selinux_state,
 431                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 432                           FILESYSTEM__ASSOCIATE, NULL);
 433         return rc;
 434 }
 435
 436 static int selinux_is_genfs_special_handling(struct super_block *sb)
 437 {
 438         /* Special handling. Genfs but also in-core setxattr handler */
 439         return  !strcmp(sb->s_type->name, "sysfs") ||
 440                 !strcmp(sb->s_type->name, "pstore") ||
 441                 !strcmp(sb->s_type->name, "debugfs") ||
 442                 !strcmp(sb->s_type->name, "tracefs") ||
 443                 !strcmp(sb->s_type->name, "rootfs") ||
 444                 (selinux_policycap_cgroupseclabel() &&
 445                  (!strcmp(sb->s_type->name, "cgroup") ||
 446                   !strcmp(sb->s_type->name, "cgroup2")));
 447 }
 448
 449 static int selinux_is_sblabel_mnt(struct super_block *sb)
 450 {
 451         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 452
 453         /*
 454          * IMPORTANT: Double-check logic in this function when adding a new
 455          * SECURITY_FS_USE_* definition!
 456          */
 457         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 458
 459         switch (sbsec->behavior) {
 460         case SECURITY_FS_USE_XATTR:
 461         case SECURITY_FS_USE_TRANS:
 462         case SECURITY_FS_USE_TASK:
 463         case SECURITY_FS_USE_NATIVE:
 464                 return 1;
 465
 466         case SECURITY_FS_USE_GENFS:
 467                 return selinux_is_genfs_special_handling(sb);
 468
 469         /* Never allow relabeling on context mounts */
 470         case SECURITY_FS_USE_MNTPOINT:
 471         case SECURITY_FS_USE_NONE:
 472         default:
 473                 return 0;
 474         }
 475 }
 476
 477 static int sb_check_xattr_support(struct super_block *sb)
 478 {
 479         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 480         struct dentry *root = sb->s_root;
 481         struct inode *root_inode = d_backing_inode(root);
 482         u32 sid;
 483         int rc;
 484
 485         /*
 486          * Make sure that the xattr handler exists and that no
 487          * error other than -ENODATA is returned by getxattr on
 488          * the root directory.  -ENODATA is ok, as this may be
 489          * the first boot of the SELinux kernel before we have
 490          * assigned xattr values to the filesystem.
 491          */
 492         if (!(root_inode->i_opflags & IOP_XATTR)) {
 493                 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
 494                         sb->s_id, sb->s_type->name);
 495                 goto fallback;
 496         }
 497
 498         rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 499         if (rc < 0 && rc != -ENODATA) {
 500                 if (rc == -EOPNOTSUPP) {
 501                         pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
 502                                 sb->s_id, sb->s_type->name);
 503                         goto fallback;
 504                 } else {
 505                         pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
 506                                 sb->s_id, sb->s_type->name, -rc);
 507                         return rc;
 508                 }
 509         }
 510         return 0;
 511
 512 fallback:
 513         /* No xattr support - try to fallback to genfs if possible. */
 514         rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
 515                                 SECCLASS_DIR, &sid);
 516         if (rc)
 517                 return -EOPNOTSUPP;
 518
 519         pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
 520                 sb->s_id, sb->s_type->name);
 521         sbsec->behavior = SECURITY_FS_USE_GENFS;
 522         sbsec->sid = sid;
 523         return 0;
 524 }
 525
 526 static int sb_finish_set_opts(struct super_block *sb)
 527 {
 528         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 529         struct dentry *root = sb->s_root;
 530         struct inode *root_inode = d_backing_inode(root);
 531         int rc = 0;
 532
 533         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 534                 rc = sb_check_xattr_support(sb);
 535                 if (rc)
 536                         return rc;
 537         }
 538
 539         sbsec->flags |= SE_SBINITIALIZED;
 540
 541         /*
 542          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 543          * leave the flag untouched because sb_clone_mnt_opts might be handing
 544          * us a superblock that needs the flag to be cleared.
 545          */
 546         if (selinux_is_sblabel_mnt(sb))
 547                 sbsec->flags |= SBLABEL_MNT;
 548         else
 549                 sbsec->flags &= ~SBLABEL_MNT;
 550
 551         /* Initialize the root inode. */
 552         rc = inode_doinit_with_dentry(root_inode, root);
 553
 554         /* Initialize any other inodes associated with the superblock, e.g.
 555            inodes created prior to initial policy load or inodes created
 556            during get_sb by a pseudo filesystem that directly
 557            populates itself. */
 558         spin_lock(&sbsec->isec_lock);
 559         while (!list_empty(&sbsec->isec_head)) {
 560                 struct inode_security_struct *isec =
 561                                 list_first_entry(&sbsec->isec_head,
 562                                            struct inode_security_struct, list);
 563                 struct inode *inode = isec->inode;
 564                 list_del_init(&isec->list);
 565                 spin_unlock(&sbsec->isec_lock);
 566                 inode = igrab(inode);
 567                 if (inode) {
 568                         if (!IS_PRIVATE(inode))
 569                                 inode_doinit_with_dentry(inode, NULL);
 570                         iput(inode);
 571                 }
 572                 spin_lock(&sbsec->isec_lock);
 573         }
 574         spin_unlock(&sbsec->isec_lock);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 void *mnt_opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         struct superblock_security_struct *sbsec = selinux_superblock(sb);
 609         struct dentry *root = sb->s_root;
 610         struct selinux_mnt_opts *opts = mnt_opts;
 611         struct inode_security_struct *root_isec;
 612         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 613         u32 defcontext_sid = 0;
 614         int rc = 0;
 615
 616         mutex_lock(&sbsec->lock);
 617
 618         if (!selinux_initialized(&selinux_state)) {
 619                 if (!opts) {
 620                         /* Defer initialization until selinux_complete_init,
 621                            after the initial policy is loaded and the security
 622                            server is ready to handle calls. */
 623                         goto out;
 624                 }
 625                 rc = -EINVAL;
 626                 pr_warn("SELinux: Unable to set superblock options "
 627                         "before the security server is initialized\n");
 628                 goto out;
 629         }
 630         if (kern_flags && !set_kern_flags) {
 631                 /* Specifying internal flags without providing a place to
 632                  * place the results is not allowed */
 633                 rc = -EINVAL;
 634                 goto out;
 635         }
 636
 637         /*
 638          * Binary mount data FS will come through this function twice.  Once
 639          * from an explicit call and once from the generic calls from the vfs.
 640          * Since the generic VFS calls will not contain any security mount data
 641          * we need to skip the double mount verification.
 642          *
 643          * This does open a hole in which we will not notice if the first
 644          * mount using this sb set explicit options and a second mount using
 645          * this sb does not set any security options.  (The first options
 646          * will be used for both mounts)
 647          */
 648         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 649             && !opts)
 650                 goto out;
 651
 652         root_isec = backing_inode_security_novalidate(root);
 653
 654         /*
 655          * parse the mount options, check if they are valid sids.
 656          * also check if someone is trying to mount the same sb more
 657          * than once with different security options.
 658          */
 659         if (opts) {
 660                 if (opts->fscontext_sid) {
 661                         fscontext_sid = opts->fscontext_sid;
 662                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 663                                         fscontext_sid))
 664                                 goto out_double_mount;
 665                         sbsec->flags |= FSCONTEXT_MNT;
 666                 }
 667                 if (opts->context_sid) {
 668                         context_sid = opts->context_sid;
 669                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 670                                         context_sid))
 671                                 goto out_double_mount;
 672                         sbsec->flags |= CONTEXT_MNT;
 673                 }
 674                 if (opts->rootcontext_sid) {
 675                         rootcontext_sid = opts->rootcontext_sid;
 676                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 677                                         rootcontext_sid))
 678                                 goto out_double_mount;
 679                         sbsec->flags |= ROOTCONTEXT_MNT;
 680                 }
 681                 if (opts->defcontext_sid) {
 682                         defcontext_sid = opts->defcontext_sid;
 683                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 684                                         defcontext_sid))
 685                                 goto out_double_mount;
 686                         sbsec->flags |= DEFCONTEXT_MNT;
 687                 }
 688         }
 689
 690         if (sbsec->flags & SE_SBINITIALIZED) {
 691                 /* previously mounted with options, but not on this attempt? */
 692                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 693                         goto out_double_mount;
 694                 rc = 0;
 695                 goto out;
 696         }
 697
 698         if (strcmp(sb->s_type->name, "proc") == 0)
 699                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 700
 701         if (!strcmp(sb->s_type->name, "debugfs") ||
 702             !strcmp(sb->s_type->name, "tracefs") ||
 703             !strcmp(sb->s_type->name, "binder") ||
 704             !strcmp(sb->s_type->name, "bpf") ||
 705             !strcmp(sb->s_type->name, "pstore") ||
 706             !strcmp(sb->s_type->name, "securityfs"))
 707                 sbsec->flags |= SE_SBGENFS;
 708
 709         if (!strcmp(sb->s_type->name, "sysfs") ||
 710             !strcmp(sb->s_type->name, "cgroup") ||
 711             !strcmp(sb->s_type->name, "cgroup2"))
 712                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 713
 714         if (!sbsec->behavior) {
 715                 /*
 716                  * Determine the labeling behavior to use for this
 717                  * filesystem type.
 718                  */
 719                 rc = security_fs_use(&selinux_state, sb);
 720                 if (rc) {
 721                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 722                                         __func__, sb->s_type->name, rc);
 723                         goto out;
 724                 }
 725         }
 726
 727         /*
 728          * If this is a user namespace mount and the filesystem type is not
 729          * explicitly whitelisted, then no contexts are allowed on the command
 730          * line and security labels must be ignored.
 731          */
 732         if (sb->s_user_ns != &init_user_ns &&
 733             strcmp(sb->s_type->name, "tmpfs") &&
 734             strcmp(sb->s_type->name, "ramfs") &&
 735             strcmp(sb->s_type->name, "devpts") &&
 736             strcmp(sb->s_type->name, "overlay")) {
 737                 if (context_sid || fscontext_sid || rootcontext_sid ||
 738                     defcontext_sid) {
 739                         rc = -EACCES;
 740                         goto out;
 741                 }
 742                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 743                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 744                         rc = security_transition_sid(&selinux_state,
 745                                                      current_sid(),
 746                                                      current_sid(),
 747                                                      SECCLASS_FILE, NULL,
 748                                                      &sbsec->mntpoint_sid);
 749                         if (rc)
 750                                 goto out;
 751                 }
 752                 goto out_set_opts;
 753         }
 754
 755         /* sets the context of the superblock for the fs being mounted. */
 756         if (fscontext_sid) {
 757                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 758                 if (rc)
 759                         goto out;
 760
 761                 sbsec->sid = fscontext_sid;
 762         }
 763
 764         /*
 765          * Switch to using mount point labeling behavior.
 766          * sets the label used on all file below the mountpoint, and will set
 767          * the superblock context if not already set.
 768          */
 769         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 770                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 771                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 772         }
 773
 774         if (context_sid) {
 775                 if (!fscontext_sid) {
 776                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 777                                                           cred);
 778                         if (rc)
 779                                 goto out;
 780                         sbsec->sid = context_sid;
 781                 } else {
 782                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 783                                                              cred);
 784                         if (rc)
 785                                 goto out;
 786                 }
 787                 if (!rootcontext_sid)
 788                         rootcontext_sid = context_sid;
 789
 790                 sbsec->mntpoint_sid = context_sid;
 791                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 792         }
 793
 794         if (rootcontext_sid) {
 795                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 796                                                      cred);
 797                 if (rc)
 798                         goto out;
 799
 800                 root_isec->sid = rootcontext_sid;
 801                 root_isec->initialized = LABEL_INITIALIZED;
 802         }
 803
 804         if (defcontext_sid) {
 805                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 806                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 807                         rc = -EINVAL;
 808                         pr_warn("SELinux: defcontext option is "
 809                                "invalid for this filesystem type\n");
 810                         goto out;
 811                 }
 812
 813                 if (defcontext_sid != sbsec->def_sid) {
 814                         rc = may_context_mount_inode_relabel(defcontext_sid,
 815                                                              sbsec, cred);
 816                         if (rc)
 817                                 goto out;
 818                 }
 819
 820                 sbsec->def_sid = defcontext_sid;
 821         }
 822
 823 out_set_opts:
 824         rc = sb_finish_set_opts(sb);
 825 out:
 826         mutex_unlock(&sbsec->lock);
 827         return rc;
 828 out_double_mount:
 829         rc = -EINVAL;
 830         pr_warn("SELinux: mount invalid.  Same superblock, different "
 831                "security settings for (dev %s, type %s)\n", sb->s_id,
 832                sb->s_type->name);
 833         goto out;
 834 }
 835
 836 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 837                                     const struct super_block *newsb)
 838 {
 839         struct superblock_security_struct *old = selinux_superblock(oldsb);
 840         struct superblock_security_struct *new = selinux_superblock(newsb);
 841         char oldflags = old->flags & SE_MNTMASK;
 842         char newflags = new->flags & SE_MNTMASK;
 843
 844         if (oldflags != newflags)
 845                 goto mismatch;
 846         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 847                 goto mismatch;
 848         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 849                 goto mismatch;
 850         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 851                 goto mismatch;
 852         if (oldflags & ROOTCONTEXT_MNT) {
 853                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 854                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 855                 if (oldroot->sid != newroot->sid)
 856                         goto mismatch;
 857         }
 858         return 0;
 859 mismatch:
 860         pr_warn("SELinux: mount invalid.  Same superblock, "
 861                             "different security settings for (dev %s, "
 862                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 863         return -EBUSY;
 864 }
 865
 866 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 867                                         struct super_block *newsb,
 868                                         unsigned long kern_flags,
 869                                         unsigned long *set_kern_flags)
 870 {
 871         int rc = 0;
 872         const struct superblock_security_struct *oldsbsec =
 873                                                 selinux_superblock(oldsb);
 874         struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
 875
 876         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 877         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 878         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 879
 880         /*
 881          * if the parent was able to be mounted it clearly had no special lsm
 882          * mount options.  thus we can safely deal with this superblock later
 883          */
 884         if (!selinux_initialized(&selinux_state))
 885                 return 0;
 886
 887         /*
 888          * Specifying internal flags without providing a place to
 889          * place the results is not allowed.
 890          */
 891         if (kern_flags && !set_kern_flags)
 892                 return -EINVAL;
 893
 894         /* how can we clone if the old one wasn't set up?? */
 895         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 896
 897         /* if fs is reusing a sb, make sure that the contexts match */
 898         if (newsbsec->flags & SE_SBINITIALIZED) {
 899                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 900                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 901                 return selinux_cmp_sb_context(oldsb, newsb);
 902         }
 903
 904         mutex_lock(&newsbsec->lock);
 905
 906         newsbsec->flags = oldsbsec->flags;
 907
 908         newsbsec->sid = oldsbsec->sid;
 909         newsbsec->def_sid = oldsbsec->def_sid;
 910         newsbsec->behavior = oldsbsec->behavior;
 911
 912         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 913                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 914                 rc = security_fs_use(&selinux_state, newsb);
 915                 if (rc)
 916                         goto out;
 917         }
 918
 919         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 920                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 921                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 922         }
 923
 924         if (set_context) {
 925                 u32 sid = oldsbsec->mntpoint_sid;
 926
 927                 if (!set_fscontext)
 928                         newsbsec->sid = sid;
 929                 if (!set_rootcontext) {
 930                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 931                         newisec->sid = sid;
 932                 }
 933                 newsbsec->mntpoint_sid = sid;
 934         }
 935         if (set_rootcontext) {
 936                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 937                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 938
 939                 newisec->sid = oldisec->sid;
 940         }
 941
 942         sb_finish_set_opts(newsb);
 943 out:
 944         mutex_unlock(&newsbsec->lock);
 945         return rc;
 946 }
 947
 948 /*
 949  * NOTE: the caller is resposible for freeing the memory even if on error.
 950  */
 951 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 952 {
 953         struct selinux_mnt_opts *opts = *mnt_opts;
 954         u32 *dst_sid;
 955         int rc;
 956
 957         if (token == Opt_seclabel)
 958                 /* eaten and completely ignored */
 959                 return 0;
 960         if (!s)
 961                 return -EINVAL;
 962
 963         if (!selinux_initialized(&selinux_state)) {
 964                 pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
 965                 return -EINVAL;
 966         }
 967
 968         if (!opts) {
 969                 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
 970                 if (!opts)
 971                         return -ENOMEM;
 972                 *mnt_opts = opts;
 973         }
 974
 975         switch (token) {
 976         case Opt_context:
 977                 if (opts->context_sid || opts->defcontext_sid)
 978                         goto err;
 979                 dst_sid = &opts->context_sid;
 980                 break;
 981         case Opt_fscontext:
 982                 if (opts->fscontext_sid)
 983                         goto err;
 984                 dst_sid = &opts->fscontext_sid;
 985                 break;
 986         case Opt_rootcontext:
 987                 if (opts->rootcontext_sid)
 988                         goto err;
 989                 dst_sid = &opts->rootcontext_sid;
 990                 break;
 991         case Opt_defcontext:
 992                 if (opts->context_sid || opts->defcontext_sid)
 993                         goto err;
 994                 dst_sid = &opts->defcontext_sid;
 995                 break;
 996         default:
 997                 WARN_ON(1);
 998                 return -EINVAL;
 999         }
1000         rc = security_context_str_to_sid(&selinux_state, s, dst_sid, GFP_KERNEL);
1001         if (rc)
1002                 pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1003                         s, rc);
1004         return rc;
1005
1006 err:
1007         pr_warn(SEL_MOUNT_FAIL_MSG);
1008         return -EINVAL;
1009 }
1010
1011 static int show_sid(struct seq_file *m, u32 sid)
1012 {
1013         char *context = NULL;
1014         u32 len;
1015         int rc;
1016
1017         rc = security_sid_to_context(&selinux_state, sid,
1018                                              &context, &len);
1019         if (!rc) {
1020                 bool has_comma = strchr(context, ',');
1021
1022                 seq_putc(m, '=');
1023                 if (has_comma)
1024                         seq_putc(m, '\"');
1025                 seq_escape(m, context, "\"\n\\");
1026                 if (has_comma)
1027                         seq_putc(m, '\"');
1028         }
1029         kfree(context);
1030         return rc;
1031 }
1032
1033 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1034 {
1035         struct superblock_security_struct *sbsec = selinux_superblock(sb);
1036         int rc;
1037
1038         if (!(sbsec->flags & SE_SBINITIALIZED))
1039                 return 0;
1040
1041         if (!selinux_initialized(&selinux_state))
1042                 return 0;
1043
1044         if (sbsec->flags & FSCONTEXT_MNT) {
1045                 seq_putc(m, ',');
1046                 seq_puts(m, FSCONTEXT_STR);
1047                 rc = show_sid(m, sbsec->sid);
1048                 if (rc)
1049                         return rc;
1050         }
1051         if (sbsec->flags & CONTEXT_MNT) {
1052                 seq_putc(m, ',');
1053                 seq_puts(m, CONTEXT_STR);
1054                 rc = show_sid(m, sbsec->mntpoint_sid);
1055                 if (rc)
1056                         return rc;
1057         }
1058         if (sbsec->flags & DEFCONTEXT_MNT) {
1059                 seq_putc(m, ',');
1060                 seq_puts(m, DEFCONTEXT_STR);
1061                 rc = show_sid(m, sbsec->def_sid);
1062                 if (rc)
1063                         return rc;
1064         }
1065         if (sbsec->flags & ROOTCONTEXT_MNT) {
1066                 struct dentry *root = sb->s_root;
1067                 struct inode_security_struct *isec = backing_inode_security(root);
1068                 seq_putc(m, ',');
1069                 seq_puts(m, ROOTCONTEXT_STR);
1070                 rc = show_sid(m, isec->sid);
1071                 if (rc)
1072                         return rc;
1073         }
1074         if (sbsec->flags & SBLABEL_MNT) {
1075                 seq_putc(m, ',');
1076                 seq_puts(m, SECLABEL_STR);
1077         }
1078         return 0;
1079 }
1080
1081 static inline u16 inode_mode_to_security_class(umode_t mode)
1082 {
1083         switch (mode & S_IFMT) {
1084         case S_IFSOCK:
1085                 return SECCLASS_SOCK_FILE;
1086         case S_IFLNK:
1087                 return SECCLASS_LNK_FILE;
1088         case S_IFREG:
1089                 return SECCLASS_FILE;
1090         case S_IFBLK:
1091                 return SECCLASS_BLK_FILE;
1092         case S_IFDIR:
1093                 return SECCLASS_DIR;
1094         case S_IFCHR:
1095                 return SECCLASS_CHR_FILE;
1096         case S_IFIFO:
1097                 return SECCLASS_FIFO_FILE;
1098
1099         }
1100
1101         return SECCLASS_FILE;
1102 }
1103
1104 static inline int default_protocol_stream(int protocol)
1105 {
1106         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1107                 protocol == IPPROTO_MPTCP);
1108 }
1109
1110 static inline int default_protocol_dgram(int protocol)
1111 {
1112         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1113 }
1114
1115 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1116 {
1117         int extsockclass = selinux_policycap_extsockclass();
1118
1119         switch (family) {
1120         case PF_UNIX:
1121                 switch (type) {
1122                 case SOCK_STREAM:
1123                 case SOCK_SEQPACKET:
1124                         return SECCLASS_UNIX_STREAM_SOCKET;
1125                 case SOCK_DGRAM:
1126                 case SOCK_RAW:
1127                         return SECCLASS_UNIX_DGRAM_SOCKET;
1128                 }
1129                 break;
1130         case PF_INET:
1131         case PF_INET6:
1132                 switch (type) {
1133                 case SOCK_STREAM:
1134                 case SOCK_SEQPACKET:
1135                         if (default_protocol_stream(protocol))
1136                                 return SECCLASS_TCP_SOCKET;
1137                         else if (extsockclass && protocol == IPPROTO_SCTP)
1138                                 return SECCLASS_SCTP_SOCKET;
1139                         else
1140                                 return SECCLASS_RAWIP_SOCKET;
1141                 case SOCK_DGRAM:
1142                         if (default_protocol_dgram(protocol))
1143                                 return SECCLASS_UDP_SOCKET;
1144                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1145                                                   protocol == IPPROTO_ICMPV6))
1146                                 return SECCLASS_ICMP_SOCKET;
1147                         else
1148                                 return SECCLASS_RAWIP_SOCKET;
1149                 case SOCK_DCCP:
1150                         return SECCLASS_DCCP_SOCKET;
1151                 default:
1152                         return SECCLASS_RAWIP_SOCKET;
1153                 }
1154                 break;
1155         case PF_NETLINK:
1156                 switch (protocol) {
1157                 case NETLINK_ROUTE:
1158                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1159                 case NETLINK_SOCK_DIAG:
1160                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1161                 case NETLINK_NFLOG:
1162                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1163                 case NETLINK_XFRM:
1164                         return SECCLASS_NETLINK_XFRM_SOCKET;
1165                 case NETLINK_SELINUX:
1166                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1167                 case NETLINK_ISCSI:
1168                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1169                 case NETLINK_AUDIT:
1170                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1171                 case NETLINK_FIB_LOOKUP:
1172                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1173                 case NETLINK_CONNECTOR:
1174                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1175                 case NETLINK_NETFILTER:
1176                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1177                 case NETLINK_DNRTMSG:
1178                         return SECCLASS_NETLINK_DNRT_SOCKET;
1179                 case NETLINK_KOBJECT_UEVENT:
1180                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1181                 case NETLINK_GENERIC:
1182                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1183                 case NETLINK_SCSITRANSPORT:
1184                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1185                 case NETLINK_RDMA:
1186                         return SECCLASS_NETLINK_RDMA_SOCKET;
1187                 case NETLINK_CRYPTO:
1188                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1189                 default:
1190                         return SECCLASS_NETLINK_SOCKET;
1191                 }
1192         case PF_PACKET:
1193                 return SECCLASS_PACKET_SOCKET;
1194         case PF_KEY:
1195                 return SECCLASS_KEY_SOCKET;
1196         case PF_APPLETALK:
1197                 return SECCLASS_APPLETALK_SOCKET;
1198         }
1199
1200         if (extsockclass) {
1201                 switch (family) {
1202                 case PF_AX25:
1203                         return SECCLASS_AX25_SOCKET;
1204                 case PF_IPX:
1205                         return SECCLASS_IPX_SOCKET;
1206                 case PF_NETROM:
1207                         return SECCLASS_NETROM_SOCKET;
1208                 case PF_ATMPVC:
1209                         return SECCLASS_ATMPVC_SOCKET;
1210                 case PF_X25:
1211                         return SECCLASS_X25_SOCKET;
1212                 case PF_ROSE:
1213                         return SECCLASS_ROSE_SOCKET;
1214                 case PF_DECnet:
1215                         return SECCLASS_DECNET_SOCKET;
1216                 case PF_ATMSVC:
1217                         return SECCLASS_ATMSVC_SOCKET;
1218                 case PF_RDS:
1219                         return SECCLASS_RDS_SOCKET;
1220                 case PF_IRDA:
1221                         return SECCLASS_IRDA_SOCKET;
1222                 case PF_PPPOX:
1223                         return SECCLASS_PPPOX_SOCKET;
1224                 case PF_LLC:
1225                         return SECCLASS_LLC_SOCKET;
1226                 case PF_CAN:
1227                         return SECCLASS_CAN_SOCKET;
1228                 case PF_TIPC:
1229                         return SECCLASS_TIPC_SOCKET;
1230                 case PF_BLUETOOTH:
1231                         return SECCLASS_BLUETOOTH_SOCKET;
1232                 case PF_IUCV:
1233                         return SECCLASS_IUCV_SOCKET;
1234                 case PF_RXRPC:
1235                         return SECCLASS_RXRPC_SOCKET;
1236                 case PF_ISDN:
1237                         return SECCLASS_ISDN_SOCKET;
1238                 case PF_PHONET:
1239                         return SECCLASS_PHONET_SOCKET;
1240                 case PF_IEEE802154:
1241                         return SECCLASS_IEEE802154_SOCKET;
1242                 case PF_CAIF:
1243                         return SECCLASS_CAIF_SOCKET;
1244                 case PF_ALG:
1245                         return SECCLASS_ALG_SOCKET;
1246                 case PF_NFC:
1247                         return SECCLASS_NFC_SOCKET;
1248                 case PF_VSOCK:
1249                         return SECCLASS_VSOCK_SOCKET;
1250                 case PF_KCM:
1251                         return SECCLASS_KCM_SOCKET;
1252                 case PF_QIPCRTR:
1253                         return SECCLASS_QIPCRTR_SOCKET;
1254                 case PF_SMC:
1255                         return SECCLASS_SMC_SOCKET;
1256                 case PF_XDP:
1257                         return SECCLASS_XDP_SOCKET;
1258                 case PF_MCTP:
1259                         return SECCLASS_MCTP_SOCKET;
1260 #if PF_MAX > 46
1261 #error New address family defined, please update this function.
1262 #endif
1263                 }
1264         }
1265
1266         return SECCLASS_SOCKET;
1267 }
1268
1269 static int selinux_genfs_get_sid(struct dentry *dentry,
1270                                  u16 tclass,
1271                                  u16 flags,
1272                                  u32 *sid)
1273 {
1274         int rc;
1275         struct super_block *sb = dentry->d_sb;
1276         char *buffer, *path;
1277
1278         buffer = (char *)__get_free_page(GFP_KERNEL);
1279         if (!buffer)
1280                 return -ENOMEM;
1281
1282         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1283         if (IS_ERR(path))
1284                 rc = PTR_ERR(path);
1285         else {
1286                 if (flags & SE_SBPROC) {
1287                         /* each process gets a /proc/PID/ entry. Strip off the
1288                          * PID part to get a valid selinux labeling.
1289                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1290                         while (path[1] >= '0' && path[1] <= '9') {
1291                                 path[1] = '/';
1292                                 path++;
1293                         }
1294                 }
1295                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1296                                         path, tclass, sid);
1297                 if (rc == -ENOENT) {
1298                         /* No match in policy, mark as unlabeled. */
1299                         *sid = SECINITSID_UNLABELED;
1300                         rc = 0;
1301                 }
1302         }
1303         free_page((unsigned long)buffer);
1304         return rc;
1305 }
1306
1307 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1308                                   u32 def_sid, u32 *sid)
1309 {
1310 #define INITCONTEXTLEN 255
1311         char *context;
1312         unsigned int len;
1313         int rc;
1314
1315         len = INITCONTEXTLEN;
1316         context = kmalloc(len + 1, GFP_NOFS);
1317         if (!context)
1318                 return -ENOMEM;
1319
1320         context[len] = '\0';
1321         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1322         if (rc == -ERANGE) {
1323                 kfree(context);
1324
1325                 /* Need a larger buffer.  Query for the right size. */
1326                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1327                 if (rc < 0)
1328                         return rc;
1329
1330                 len = rc;
1331                 context = kmalloc(len + 1, GFP_NOFS);
1332                 if (!context)
1333                         return -ENOMEM;
1334
1335                 context[len] = '\0';
1336                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1337                                     context, len);
1338         }
1339         if (rc < 0) {
1340                 kfree(context);
1341                 if (rc != -ENODATA) {
1342                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1343                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1344                         return rc;
1345                 }
1346                 *sid = def_sid;
1347                 return 0;
1348         }
1349
1350         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1351                                              def_sid, GFP_NOFS);
1352         if (rc) {
1353                 char *dev = inode->i_sb->s_id;
1354                 unsigned long ino = inode->i_ino;
1355
1356                 if (rc == -EINVAL) {
1357                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1358                                               ino, dev, context);
1359                 } else {
1360                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1361                                 __func__, context, -rc, dev, ino);
1362                 }
1363         }
1364         kfree(context);
1365         return 0;
1366 }
1367
1368 /* The inode's security attributes must be initialized before first use. */
1369 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1370 {
1371         struct superblock_security_struct *sbsec = NULL;
1372         struct inode_security_struct *isec = selinux_inode(inode);
1373         u32 task_sid, sid = 0;
1374         u16 sclass;
1375         struct dentry *dentry;
1376         int rc = 0;
1377
1378         if (isec->initialized == LABEL_INITIALIZED)
1379                 return 0;
1380
1381         spin_lock(&isec->lock);
1382         if (isec->initialized == LABEL_INITIALIZED)
1383                 goto out_unlock;
1384
1385         if (isec->sclass == SECCLASS_FILE)
1386                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1387
1388         sbsec = selinux_superblock(inode->i_sb);
1389         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1390                 /* Defer initialization until selinux_complete_init,
1391                    after the initial policy is loaded and the security
1392                    server is ready to handle calls. */
1393                 spin_lock(&sbsec->isec_lock);
1394                 if (list_empty(&isec->list))
1395                         list_add(&isec->list, &sbsec->isec_head);
1396                 spin_unlock(&sbsec->isec_lock);
1397                 goto out_unlock;
1398         }
1399
1400         sclass = isec->sclass;
1401         task_sid = isec->task_sid;
1402         sid = isec->sid;
1403         isec->initialized = LABEL_PENDING;
1404         spin_unlock(&isec->lock);
1405
1406         switch (sbsec->behavior) {
1407         case SECURITY_FS_USE_NATIVE:
1408                 break;
1409         case SECURITY_FS_USE_XATTR:
1410                 if (!(inode->i_opflags & IOP_XATTR)) {
1411                         sid = sbsec->def_sid;
1412                         break;
1413                 }
1414                 /* Need a dentry, since the xattr API requires one.
1415                    Life would be simpler if we could just pass the inode. */
1416                 if (opt_dentry) {
1417                         /* Called from d_instantiate or d_splice_alias. */
1418                         dentry = dget(opt_dentry);
1419                 } else {
1420                         /*
1421                          * Called from selinux_complete_init, try to find a dentry.
1422                          * Some filesystems really want a connected one, so try
1423                          * that first.  We could split SECURITY_FS_USE_XATTR in
1424                          * two, depending upon that...
1425                          */
1426                         dentry = d_find_alias(inode);
1427                         if (!dentry)
1428                                 dentry = d_find_any_alias(inode);
1429                 }
1430                 if (!dentry) {
1431                         /*
1432                          * this is can be hit on boot when a file is accessed
1433                          * before the policy is loaded.  When we load policy we
1434                          * may find inodes that have no dentry on the
1435                          * sbsec->isec_head list.  No reason to complain as these
1436                          * will get fixed up the next time we go through
1437                          * inode_doinit with a dentry, before these inodes could
1438                          * be used again by userspace.
1439                          */
1440                         goto out_invalid;
1441                 }
1442
1443                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1444                                             &sid);
1445                 dput(dentry);
1446                 if (rc)
1447                         goto out;
1448                 break;
1449         case SECURITY_FS_USE_TASK:
1450                 sid = task_sid;
1451                 break;
1452         case SECURITY_FS_USE_TRANS:
1453                 /* Default to the fs SID. */
1454                 sid = sbsec->sid;
1455
1456                 /* Try to obtain a transition SID. */
1457                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1458                                              sclass, NULL, &sid);
1459                 if (rc)
1460                         goto out;
1461                 break;
1462         case SECURITY_FS_USE_MNTPOINT:
1463                 sid = sbsec->mntpoint_sid;
1464                 break;
1465         default:
1466                 /* Default to the fs superblock SID. */
1467                 sid = sbsec->sid;
1468
1469                 if ((sbsec->flags & SE_SBGENFS) &&
1470                      (!S_ISLNK(inode->i_mode) ||
1471                       selinux_policycap_genfs_seclabel_symlinks())) {
1472                         /* We must have a dentry to determine the label on
1473                          * procfs inodes */
1474                         if (opt_dentry) {
1475                                 /* Called from d_instantiate or
1476                                  * d_splice_alias. */
1477                                 dentry = dget(opt_dentry);
1478                         } else {
1479                                 /* Called from selinux_complete_init, try to
1480                                  * find a dentry.  Some filesystems really want
1481                                  * a connected one, so try that first.
1482                                  */
1483                                 dentry = d_find_alias(inode);
1484                                 if (!dentry)
1485                                         dentry = d_find_any_alias(inode);
1486                         }
1487                         /*
1488                          * This can be hit on boot when a file is accessed
1489                          * before the policy is loaded.  When we load policy we
1490                          * may find inodes that have no dentry on the
1491                          * sbsec->isec_head list.  No reason to complain as
1492                          * these will get fixed up the next time we go through
1493                          * inode_doinit() with a dentry, before these inodes
1494                          * could be used again by userspace.
1495                          */
1496                         if (!dentry)
1497                                 goto out_invalid;
1498                         rc = selinux_genfs_get_sid(dentry, sclass,
1499                                                    sbsec->flags, &sid);
1500                         if (rc) {
1501                                 dput(dentry);
1502                                 goto out;
1503                         }
1504
1505                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1506                             (inode->i_opflags & IOP_XATTR)) {
1507                                 rc = inode_doinit_use_xattr(inode, dentry,
1508                                                             sid, &sid);
1509                                 if (rc) {
1510                                         dput(dentry);
1511                                         goto out;
1512                                 }
1513                         }
1514                         dput(dentry);
1515                 }
1516                 break;
1517         }
1518
1519 out:
1520         spin_lock(&isec->lock);
1521         if (isec->initialized == LABEL_PENDING) {
1522                 if (rc) {
1523                         isec->initialized = LABEL_INVALID;
1524                         goto out_unlock;
1525                 }
1526                 isec->initialized = LABEL_INITIALIZED;
1527                 isec->sid = sid;
1528         }
1529
1530 out_unlock:
1531         spin_unlock(&isec->lock);
1532         return rc;
1533
1534 out_invalid:
1535         spin_lock(&isec->lock);
1536         if (isec->initialized == LABEL_PENDING) {
1537                 isec->initialized = LABEL_INVALID;
1538                 isec->sid = sid;
1539         }
1540         spin_unlock(&isec->lock);
1541         return 0;
1542 }
1543
1544 /* Convert a Linux signal to an access vector. */
1545 static inline u32 signal_to_av(int sig)
1546 {
1547         u32 perm = 0;
1548
1549         switch (sig) {
1550         case SIGCHLD:
1551                 /* Commonly granted from child to parent. */
1552                 perm = PROCESS__SIGCHLD;
1553                 break;
1554         case SIGKILL:
1555                 /* Cannot be caught or ignored */
1556                 perm = PROCESS__SIGKILL;
1557                 break;
1558         case SIGSTOP:
1559                 /* Cannot be caught or ignored */
1560                 perm = PROCESS__SIGSTOP;
1561                 break;
1562         default:
1563                 /* All other signals. */
1564                 perm = PROCESS__SIGNAL;
1565                 break;
1566         }
1567
1568         return perm;
1569 }
1570
1571 #if CAP_LAST_CAP > 63
1572 #error Fix SELinux to handle capabilities > 63.
1573 #endif
1574
1575 /* Check whether a task is allowed to use a capability. */
1576 static int cred_has_capability(const struct cred *cred,
1577                                int cap, unsigned int opts, bool initns)
1578 {
1579         struct common_audit_data ad;
1580         struct av_decision avd;
1581         u16 sclass;
1582         u32 sid = cred_sid(cred);
1583         u32 av = CAP_TO_MASK(cap);
1584         int rc;
1585
1586         ad.type = LSM_AUDIT_DATA_CAP;
1587         ad.u.cap = cap;
1588
1589         switch (CAP_TO_INDEX(cap)) {
1590         case 0:
1591                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1592                 break;
1593         case 1:
1594                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1595                 break;
1596         default:
1597                 pr_err("SELinux:  out of range capability %d\n", cap);
1598                 BUG();
1599                 return -EINVAL;
1600         }
1601
1602         rc = avc_has_perm_noaudit(&selinux_state,
1603                                   sid, sid, sclass, av, 0, &avd);
1604         if (!(opts & CAP_OPT_NOAUDIT)) {
1605                 int rc2 = avc_audit(&selinux_state,
1606                                     sid, sid, sclass, av, &avd, rc, &ad);
1607                 if (rc2)
1608                         return rc2;
1609         }
1610         return rc;
1611 }
1612
1613 /* Check whether a task has a particular permission to an inode.
1614    The 'adp' parameter is optional and allows other audit
1615    data to be passed (e.g. the dentry). */
1616 static int inode_has_perm(const struct cred *cred,
1617                           struct inode *inode,
1618                           u32 perms,
1619                           struct common_audit_data *adp)
1620 {
1621         struct inode_security_struct *isec;
1622         u32 sid;
1623
1624         validate_creds(cred);
1625
1626         if (unlikely(IS_PRIVATE(inode)))
1627                 return 0;
1628
1629         sid = cred_sid(cred);
1630         isec = selinux_inode(inode);
1631
1632         return avc_has_perm(&selinux_state,
1633                             sid, isec->sid, isec->sclass, perms, adp);
1634 }
1635
1636 /* Same as inode_has_perm, but pass explicit audit data containing
1637    the dentry to help the auditing code to more easily generate the
1638    pathname if needed. */
1639 static inline int dentry_has_perm(const struct cred *cred,
1640                                   struct dentry *dentry,
1641                                   u32 av)
1642 {
1643         struct inode *inode = d_backing_inode(dentry);
1644         struct common_audit_data ad;
1645
1646         ad.type = LSM_AUDIT_DATA_DENTRY;
1647         ad.u.dentry = dentry;
1648         __inode_security_revalidate(inode, dentry, true);
1649         return inode_has_perm(cred, inode, av, &ad);
1650 }
1651
1652 /* Same as inode_has_perm, but pass explicit audit data containing
1653    the path to help the auditing code to more easily generate the
1654    pathname if needed. */
1655 static inline int path_has_perm(const struct cred *cred,
1656                                 const struct path *path,
1657                                 u32 av)
1658 {
1659         struct inode *inode = d_backing_inode(path->dentry);
1660         struct common_audit_data ad;
1661
1662         ad.type = LSM_AUDIT_DATA_PATH;
1663         ad.u.path = *path;
1664         __inode_security_revalidate(inode, path->dentry, true);
1665         return inode_has_perm(cred, inode, av, &ad);
1666 }
1667
1668 /* Same as path_has_perm, but uses the inode from the file struct. */
1669 static inline int file_path_has_perm(const struct cred *cred,
1670                                      struct file *file,
1671                                      u32 av)
1672 {
1673         struct common_audit_data ad;
1674
1675         ad.type = LSM_AUDIT_DATA_FILE;
1676         ad.u.file = file;
1677         return inode_has_perm(cred, file_inode(file), av, &ad);
1678 }
1679
1680 #ifdef CONFIG_BPF_SYSCALL
1681 static int bpf_fd_pass(struct file *file, u32 sid);
1682 #endif
1683
1684 /* Check whether a task can use an open file descriptor to
1685    access an inode in a given way.  Check access to the
1686    descriptor itself, and then use dentry_has_perm to
1687    check a particular permission to the file.
1688    Access to the descriptor is implicitly granted if it
1689    has the same SID as the process.  If av is zero, then
1690    access to the file is not checked, e.g. for cases
1691    where only the descriptor is affected like seek. */
1692 static int file_has_perm(const struct cred *cred,
1693                          struct file *file,
1694                          u32 av)
1695 {
1696         struct file_security_struct *fsec = selinux_file(file);
1697         struct inode *inode = file_inode(file);
1698         struct common_audit_data ad;
1699         u32 sid = cred_sid(cred);
1700         int rc;
1701
1702         ad.type = LSM_AUDIT_DATA_FILE;
1703         ad.u.file = file;
1704
1705         if (sid != fsec->sid) {
1706                 rc = avc_has_perm(&selinux_state,
1707                                   sid, fsec->sid,
1708                                   SECCLASS_FD,
1709                                   FD__USE,
1710                                   &ad);
1711                 if (rc)
1712                         goto out;
1713         }
1714
1715 #ifdef CONFIG_BPF_SYSCALL
1716         rc = bpf_fd_pass(file, cred_sid(cred));
1717         if (rc)
1718                 return rc;
1719 #endif
1720
1721         /* av is zero if only checking access to the descriptor. */
1722         rc = 0;
1723         if (av)
1724                 rc = inode_has_perm(cred, inode, av, &ad);
1725
1726 out:
1727         return rc;
1728 }
1729
1730 /*
1731  * Determine the label for an inode that might be unioned.
1732  */
1733 static int
1734 selinux_determine_inode_label(const struct task_security_struct *tsec,
1735                                  struct inode *dir,
1736                                  const struct qstr *name, u16 tclass,
1737                                  u32 *_new_isid)
1738 {
1739         const struct superblock_security_struct *sbsec =
1740                                                 selinux_superblock(dir->i_sb);
1741
1742         if ((sbsec->flags & SE_SBINITIALIZED) &&
1743             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1744                 *_new_isid = sbsec->mntpoint_sid;
1745         } else if ((sbsec->flags & SBLABEL_MNT) &&
1746                    tsec->create_sid) {
1747                 *_new_isid = tsec->create_sid;
1748         } else {
1749                 const struct inode_security_struct *dsec = inode_security(dir);
1750                 return security_transition_sid(&selinux_state, tsec->sid,
1751                                                dsec->sid, tclass,
1752                                                name, _new_isid);
1753         }
1754
1755         return 0;
1756 }
1757
1758 /* Check whether a task can create a file. */
1759 static int may_create(struct inode *dir,
1760                       struct dentry *dentry,
1761                       u16 tclass)
1762 {
1763         const struct task_security_struct *tsec = selinux_cred(current_cred());
1764         struct inode_security_struct *dsec;
1765         struct superblock_security_struct *sbsec;
1766         u32 sid, newsid;
1767         struct common_audit_data ad;
1768         int rc;
1769
1770         dsec = inode_security(dir);
1771         sbsec = selinux_superblock(dir->i_sb);
1772
1773         sid = tsec->sid;
1774
1775         ad.type = LSM_AUDIT_DATA_DENTRY;
1776         ad.u.dentry = dentry;
1777
1778         rc = avc_has_perm(&selinux_state,
1779                           sid, dsec->sid, SECCLASS_DIR,
1780                           DIR__ADD_NAME | DIR__SEARCH,
1781                           &ad);
1782         if (rc)
1783                 return rc;
1784
1785         rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1786                                            &newsid);
1787         if (rc)
1788                 return rc;
1789
1790         rc = avc_has_perm(&selinux_state,
1791                           sid, newsid, tclass, FILE__CREATE, &ad);
1792         if (rc)
1793                 return rc;
1794
1795         return avc_has_perm(&selinux_state,
1796                             newsid, sbsec->sid,
1797                             SECCLASS_FILESYSTEM,
1798                             FILESYSTEM__ASSOCIATE, &ad);
1799 }
1800
1801 #define MAY_LINK        0
1802 #define MAY_UNLINK      1
1803 #define MAY_RMDIR       2
1804
1805 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1806 static int may_link(struct inode *dir,
1807                     struct dentry *dentry,
1808                     int kind)
1809
1810 {
1811         struct inode_security_struct *dsec, *isec;
1812         struct common_audit_data ad;
1813         u32 sid = current_sid();
1814         u32 av;
1815         int rc;
1816
1817         dsec = inode_security(dir);
1818         isec = backing_inode_security(dentry);
1819
1820         ad.type = LSM_AUDIT_DATA_DENTRY;
1821         ad.u.dentry = dentry;
1822
1823         av = DIR__SEARCH;
1824         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1825         rc = avc_has_perm(&selinux_state,
1826                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1827         if (rc)
1828                 return rc;
1829
1830         switch (kind) {
1831         case MAY_LINK:
1832                 av = FILE__LINK;
1833                 break;
1834         case MAY_UNLINK:
1835                 av = FILE__UNLINK;
1836                 break;
1837         case MAY_RMDIR:
1838                 av = DIR__RMDIR;
1839                 break;
1840         default:
1841                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1842                         __func__, kind);
1843                 return 0;
1844         }
1845
1846         rc = avc_has_perm(&selinux_state,
1847                           sid, isec->sid, isec->sclass, av, &ad);
1848         return rc;
1849 }
1850
1851 static inline int may_rename(struct inode *old_dir,
1852                              struct dentry *old_dentry,
1853                              struct inode *new_dir,
1854                              struct dentry *new_dentry)
1855 {
1856         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1857         struct common_audit_data ad;
1858         u32 sid = current_sid();
1859         u32 av;
1860         int old_is_dir, new_is_dir;
1861         int rc;
1862
1863         old_dsec = inode_security(old_dir);
1864         old_isec = backing_inode_security(old_dentry);
1865         old_is_dir = d_is_dir(old_dentry);
1866         new_dsec = inode_security(new_dir);
1867
1868         ad.type = LSM_AUDIT_DATA_DENTRY;
1869
1870         ad.u.dentry = old_dentry;
1871         rc = avc_has_perm(&selinux_state,
1872                           sid, old_dsec->sid, SECCLASS_DIR,
1873                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1874         if (rc)
1875                 return rc;
1876         rc = avc_has_perm(&selinux_state,
1877                           sid, old_isec->sid,
1878                           old_isec->sclass, FILE__RENAME, &ad);
1879         if (rc)
1880                 return rc;
1881         if (old_is_dir && new_dir != old_dir) {
1882                 rc = avc_has_perm(&selinux_state,
1883                                   sid, old_isec->sid,
1884                                   old_isec->sclass, DIR__REPARENT, &ad);
1885                 if (rc)
1886                         return rc;
1887         }
1888
1889         ad.u.dentry = new_dentry;
1890         av = DIR__ADD_NAME | DIR__SEARCH;
1891         if (d_is_positive(new_dentry))
1892                 av |= DIR__REMOVE_NAME;
1893         rc = avc_has_perm(&selinux_state,
1894                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1895         if (rc)
1896                 return rc;
1897         if (d_is_positive(new_dentry)) {
1898                 new_isec = backing_inode_security(new_dentry);
1899                 new_is_dir = d_is_dir(new_dentry);
1900                 rc = avc_has_perm(&selinux_state,
1901                                   sid, new_isec->sid,
1902                                   new_isec->sclass,
1903                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1904                 if (rc)
1905                         return rc;
1906         }
1907
1908         return 0;
1909 }
1910
1911 /* Check whether a task can perform a filesystem operation. */
1912 static int superblock_has_perm(const struct cred *cred,
1913                                struct super_block *sb,
1914                                u32 perms,
1915                                struct common_audit_data *ad)
1916 {
1917         struct superblock_security_struct *sbsec;
1918         u32 sid = cred_sid(cred);
1919
1920         sbsec = selinux_superblock(sb);
1921         return avc_has_perm(&selinux_state,
1922                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1923 }
1924
1925 /* Convert a Linux mode and permission mask to an access vector. */
1926 static inline u32 file_mask_to_av(int mode, int mask)
1927 {
1928         u32 av = 0;
1929
1930         if (!S_ISDIR(mode)) {
1931                 if (mask & MAY_EXEC)
1932                         av |= FILE__EXECUTE;
1933                 if (mask & MAY_READ)
1934                         av |= FILE__READ;
1935
1936                 if (mask & MAY_APPEND)
1937                         av |= FILE__APPEND;
1938                 else if (mask & MAY_WRITE)
1939                         av |= FILE__WRITE;
1940
1941         } else {
1942                 if (mask & MAY_EXEC)
1943                         av |= DIR__SEARCH;
1944                 if (mask & MAY_WRITE)
1945                         av |= DIR__WRITE;
1946                 if (mask & MAY_READ)
1947                         av |= DIR__READ;
1948         }
1949
1950         return av;
1951 }
1952
1953 /* Convert a Linux file to an access vector. */
1954 static inline u32 file_to_av(struct file *file)
1955 {
1956         u32 av = 0;
1957
1958         if (file->f_mode & FMODE_READ)
1959                 av |= FILE__READ;
1960         if (file->f_mode & FMODE_WRITE) {
1961                 if (file->f_flags & O_APPEND)
1962                         av |= FILE__APPEND;
1963                 else
1964                         av |= FILE__WRITE;
1965         }
1966         if (!av) {
1967                 /*
1968                  * Special file opened with flags 3 for ioctl-only use.
1969                  */
1970                 av = FILE__IOCTL;
1971         }
1972
1973         return av;
1974 }
1975
1976 /*
1977  * Convert a file to an access vector and include the correct
1978  * open permission.
1979  */
1980 static inline u32 open_file_to_av(struct file *file)
1981 {
1982         u32 av = file_to_av(file);
1983         struct inode *inode = file_inode(file);
1984
1985         if (selinux_policycap_openperm() &&
1986             inode->i_sb->s_magic != SOCKFS_MAGIC)
1987                 av |= FILE__OPEN;
1988
1989         return av;
1990 }
1991
1992 /* Hook functions begin here. */
1993
1994 static int selinux_binder_set_context_mgr(const struct cred *mgr)
1995 {
1996         return avc_has_perm(&selinux_state,
1997                             current_sid(), cred_sid(mgr), SECCLASS_BINDER,
1998                             BINDER__SET_CONTEXT_MGR, NULL);
1999 }
2000
2001 static int selinux_binder_transaction(const struct cred *from,
2002                                       const struct cred *to)
2003 {
2004         u32 mysid = current_sid();
2005         u32 fromsid = cred_sid(from);
2006         u32 tosid = cred_sid(to);
2007         int rc;
2008
2009         if (mysid != fromsid) {
2010                 rc = avc_has_perm(&selinux_state,
2011                                   mysid, fromsid, SECCLASS_BINDER,
2012                                   BINDER__IMPERSONATE, NULL);
2013                 if (rc)
2014                         return rc;
2015         }
2016
2017         return avc_has_perm(&selinux_state, fromsid, tosid,
2018                             SECCLASS_BINDER, BINDER__CALL, NULL);
2019 }
2020
2021 static int selinux_binder_transfer_binder(const struct cred *from,
2022                                           const struct cred *to)
2023 {
2024         return avc_has_perm(&selinux_state,
2025                             cred_sid(from), cred_sid(to),
2026                             SECCLASS_BINDER, BINDER__TRANSFER,
2027                             NULL);
2028 }
2029
2030 static int selinux_binder_transfer_file(const struct cred *from,
2031                                         const struct cred *to,
2032                                         struct file *file)
2033 {
2034         u32 sid = cred_sid(to);
2035         struct file_security_struct *fsec = selinux_file(file);
2036         struct dentry *dentry = file->f_path.dentry;
2037         struct inode_security_struct *isec;
2038         struct common_audit_data ad;
2039         int rc;
2040
2041         ad.type = LSM_AUDIT_DATA_PATH;
2042         ad.u.path = file->f_path;
2043
2044         if (sid != fsec->sid) {
2045                 rc = avc_has_perm(&selinux_state,
2046                                   sid, fsec->sid,
2047                                   SECCLASS_FD,
2048                                   FD__USE,
2049                                   &ad);
2050                 if (rc)
2051                         return rc;
2052         }
2053
2054 #ifdef CONFIG_BPF_SYSCALL
2055         rc = bpf_fd_pass(file, sid);
2056         if (rc)
2057                 return rc;
2058 #endif
2059
2060         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2061                 return 0;
2062
2063         isec = backing_inode_security(dentry);
2064         return avc_has_perm(&selinux_state,
2065                             sid, isec->sid, isec->sclass, file_to_av(file),
2066                             &ad);
2067 }
2068
2069 static int selinux_ptrace_access_check(struct task_struct *child,
2070                                        unsigned int mode)
2071 {
2072         u32 sid = current_sid();
2073         u32 csid = task_sid_obj(child);
2074
2075         if (mode & PTRACE_MODE_READ)
2076                 return avc_has_perm(&selinux_state,
2077                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2078
2079         return avc_has_perm(&selinux_state,
2080                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2081 }
2082
2083 static int selinux_ptrace_traceme(struct task_struct *parent)
2084 {
2085         return avc_has_perm(&selinux_state,
2086                             task_sid_obj(parent), task_sid_obj(current),
2087                             SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2088 }
2089
2090 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2091                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2092 {
2093         return avc_has_perm(&selinux_state,
2094                             current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2095                             PROCESS__GETCAP, NULL);
2096 }
2097
2098 static int selinux_capset(struct cred *new, const struct cred *old,
2099                           const kernel_cap_t *effective,
2100                           const kernel_cap_t *inheritable,
2101                           const kernel_cap_t *permitted)
2102 {
2103         return avc_has_perm(&selinux_state,
2104                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2105                             PROCESS__SETCAP, NULL);
2106 }
2107
2108 /*
2109  * (This comment used to live with the selinux_task_setuid hook,
2110  * which was removed).
2111  *
2112  * Since setuid only affects the current process, and since the SELinux
2113  * controls are not based on the Linux identity attributes, SELinux does not
2114  * need to control this operation.  However, SELinux does control the use of
2115  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2116  */
2117
2118 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2119                            int cap, unsigned int opts)
2120 {
2121         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2122 }
2123
2124 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2125 {
2126         const struct cred *cred = current_cred();
2127         int rc = 0;
2128
2129         if (!sb)
2130                 return 0;
2131
2132         switch (cmds) {
2133         case Q_SYNC:
2134         case Q_QUOTAON:
2135         case Q_QUOTAOFF:
2136         case Q_SETINFO:
2137         case Q_SETQUOTA:
2138         case Q_XQUOTAOFF:
2139         case Q_XQUOTAON:
2140         case Q_XSETQLIM:
2141                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2142                 break;
2143         case Q_GETFMT:
2144         case Q_GETINFO:
2145         case Q_GETQUOTA:
2146         case Q_XGETQUOTA:
2147         case Q_XGETQSTAT:
2148         case Q_XGETQSTATV:
2149         case Q_XGETNEXTQUOTA:
2150                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2151                 break;
2152         default:
2153                 rc = 0;  /* let the kernel handle invalid cmds */
2154                 break;
2155         }
2156         return rc;
2157 }
2158
2159 static int selinux_quota_on(struct dentry *dentry)
2160 {
2161         const struct cred *cred = current_cred();
2162
2163         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2164 }
2165
2166 static int selinux_syslog(int type)
2167 {
2168         switch (type) {
2169         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2170         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2171                 return avc_has_perm(&selinux_state,
2172                                     current_sid(), SECINITSID_KERNEL,
2173                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2174         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2175         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2176         /* Set level of messages printed to console */
2177         case SYSLOG_ACTION_CONSOLE_LEVEL:
2178                 return avc_has_perm(&selinux_state,
2179                                     current_sid(), SECINITSID_KERNEL,
2180                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2181                                     NULL);
2182         }
2183         /* All other syslog types */
2184         return avc_has_perm(&selinux_state,
2185                             current_sid(), SECINITSID_KERNEL,
2186                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2187 }
2188
2189 /*
2190  * Check that a process has enough memory to allocate a new virtual
2191  * mapping. 0 means there is enough memory for the allocation to
2192  * succeed and -ENOMEM implies there is not.
2193  *
2194  * Do not audit the selinux permission check, as this is applied to all
2195  * processes that allocate mappings.
2196  */
2197 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2198 {
2199         int rc, cap_sys_admin = 0;
2200
2201         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2202                                  CAP_OPT_NOAUDIT, true);
2203         if (rc == 0)
2204                 cap_sys_admin = 1;
2205
2206         return cap_sys_admin;
2207 }
2208
2209 /* binprm security operations */
2210
2211 static u32 ptrace_parent_sid(void)
2212 {
2213         u32 sid = 0;
2214         struct task_struct *tracer;
2215
2216         rcu_read_lock();
2217         tracer = ptrace_parent(current);
2218         if (tracer)
2219                 sid = task_sid_obj(tracer);
2220         rcu_read_unlock();
2221
2222         return sid;
2223 }
2224
2225 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2226                             const struct task_security_struct *old_tsec,
2227                             const struct task_security_struct *new_tsec)
2228 {
2229         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2230         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2231         int rc;
2232         u32 av;
2233
2234         if (!nnp && !nosuid)
2235                 return 0; /* neither NNP nor nosuid */
2236
2237         if (new_tsec->sid == old_tsec->sid)
2238                 return 0; /* No change in credentials */
2239
2240         /*
2241          * If the policy enables the nnp_nosuid_transition policy capability,
2242          * then we permit transitions under NNP or nosuid if the
2243          * policy allows the corresponding permission between
2244          * the old and new contexts.
2245          */
2246         if (selinux_policycap_nnp_nosuid_transition()) {
2247                 av = 0;
2248                 if (nnp)
2249                         av |= PROCESS2__NNP_TRANSITION;
2250                 if (nosuid)
2251                         av |= PROCESS2__NOSUID_TRANSITION;
2252                 rc = avc_has_perm(&selinux_state,
2253                                   old_tsec->sid, new_tsec->sid,
2254                                   SECCLASS_PROCESS2, av, NULL);
2255                 if (!rc)
2256                         return 0;
2257         }
2258
2259         /*
2260          * We also permit NNP or nosuid transitions to bounded SIDs,
2261          * i.e. SIDs that are guaranteed to only be allowed a subset
2262          * of the permissions of the current SID.
2263          */
2264         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2265                                          new_tsec->sid);
2266         if (!rc)
2267                 return 0;
2268
2269         /*
2270          * On failure, preserve the errno values for NNP vs nosuid.
2271          * NNP:  Operation not permitted for caller.
2272          * nosuid:  Permission denied to file.
2273          */
2274         if (nnp)
2275                 return -EPERM;
2276         return -EACCES;
2277 }
2278
2279 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2280 {
2281         const struct task_security_struct *old_tsec;
2282         struct task_security_struct *new_tsec;
2283         struct inode_security_struct *isec;
2284         struct common_audit_data ad;
2285         struct inode *inode = file_inode(bprm->file);
2286         int rc;
2287
2288         /* SELinux context only depends on initial program or script and not
2289          * the script interpreter */
2290
2291         old_tsec = selinux_cred(current_cred());
2292         new_tsec = selinux_cred(bprm->cred);
2293         isec = inode_security(inode);
2294
2295         /* Default to the current task SID. */
2296         new_tsec->sid = old_tsec->sid;
2297         new_tsec->osid = old_tsec->sid;
2298
2299         /* Reset fs, key, and sock SIDs on execve. */
2300         new_tsec->create_sid = 0;
2301         new_tsec->keycreate_sid = 0;
2302         new_tsec->sockcreate_sid = 0;
2303
2304         if (old_tsec->exec_sid) {
2305                 new_tsec->sid = old_tsec->exec_sid;
2306                 /* Reset exec SID on execve. */
2307                 new_tsec->exec_sid = 0;
2308
2309                 /* Fail on NNP or nosuid if not an allowed transition. */
2310                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2311                 if (rc)
2312                         return rc;
2313         } else {
2314                 /* Check for a default transition on this program. */
2315                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2316                                              isec->sid, SECCLASS_PROCESS, NULL,
2317                                              &new_tsec->sid);
2318                 if (rc)
2319                         return rc;
2320
2321                 /*
2322                  * Fallback to old SID on NNP or nosuid if not an allowed
2323                  * transition.
2324                  */
2325                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2326                 if (rc)
2327                         new_tsec->sid = old_tsec->sid;
2328         }
2329
2330         ad.type = LSM_AUDIT_DATA_FILE;
2331         ad.u.file = bprm->file;
2332
2333         if (new_tsec->sid == old_tsec->sid) {
2334                 rc = avc_has_perm(&selinux_state,
2335                                   old_tsec->sid, isec->sid,
2336                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2337                 if (rc)
2338                         return rc;
2339         } else {
2340                 /* Check permissions for the transition. */
2341                 rc = avc_has_perm(&selinux_state,
2342                                   old_tsec->sid, new_tsec->sid,
2343                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2344                 if (rc)
2345                         return rc;
2346
2347                 rc = avc_has_perm(&selinux_state,
2348                                   new_tsec->sid, isec->sid,
2349                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2350                 if (rc)
2351                         return rc;
2352
2353                 /* Check for shared state */
2354                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2355                         rc = avc_has_perm(&selinux_state,
2356                                           old_tsec->sid, new_tsec->sid,
2357                                           SECCLASS_PROCESS, PROCESS__SHARE,
2358                                           NULL);
2359                         if (rc)
2360                                 return -EPERM;
2361                 }
2362
2363                 /* Make sure that anyone attempting to ptrace over a task that
2364                  * changes its SID has the appropriate permit */
2365                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2366                         u32 ptsid = ptrace_parent_sid();
2367                         if (ptsid != 0) {
2368                                 rc = avc_has_perm(&selinux_state,
2369                                                   ptsid, new_tsec->sid,
2370                                                   SECCLASS_PROCESS,
2371                                                   PROCESS__PTRACE, NULL);
2372                                 if (rc)
2373                                         return -EPERM;
2374                         }
2375                 }
2376
2377                 /* Clear any possibly unsafe personality bits on exec: */
2378                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2379
2380                 /* Enable secure mode for SIDs transitions unless
2381                    the noatsecure permission is granted between
2382                    the two SIDs, i.e. ahp returns 0. */
2383                 rc = avc_has_perm(&selinux_state,
2384                                   old_tsec->sid, new_tsec->sid,
2385                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2386                                   NULL);
2387                 bprm->secureexec |= !!rc;
2388         }
2389
2390         return 0;
2391 }
2392
2393 static int match_file(const void *p, struct file *file, unsigned fd)
2394 {
2395         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2396 }
2397
2398 /* Derived from fs/exec.c:flush_old_files. */
2399 static inline void flush_unauthorized_files(const struct cred *cred,
2400                                             struct files_struct *files)
2401 {
2402         struct file *file, *devnull = NULL;
2403         struct tty_struct *tty;
2404         int drop_tty = 0;
2405         unsigned n;
2406
2407         tty = get_current_tty();
2408         if (tty) {
2409                 spin_lock(&tty->files_lock);
2410                 if (!list_empty(&tty->tty_files)) {
2411                         struct tty_file_private *file_priv;
2412
2413                         /* Revalidate access to controlling tty.
2414                            Use file_path_has_perm on the tty path directly
2415                            rather than using file_has_perm, as this particular
2416                            open file may belong to another process and we are
2417                            only interested in the inode-based check here. */
2418                         file_priv = list_first_entry(&tty->tty_files,
2419                                                 struct tty_file_private, list);
2420                         file = file_priv->file;
2421                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2422                                 drop_tty = 1;
2423                 }
2424                 spin_unlock(&tty->files_lock);
2425                 tty_kref_put(tty);
2426         }
2427         /* Reset controlling tty. */
2428         if (drop_tty)
2429                 no_tty();
2430
2431         /* Revalidate access to inherited open files. */
2432         n = iterate_fd(files, 0, match_file, cred);
2433         if (!n) /* none found? */
2434                 return;
2435
2436         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2437         if (IS_ERR(devnull))
2438                 devnull = NULL;
2439         /* replace all the matching ones with this */
2440         do {
2441                 replace_fd(n - 1, devnull, 0);
2442         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2443         if (devnull)
2444                 fput(devnull);
2445 }
2446
2447 /*
2448  * Prepare a process for imminent new credential changes due to exec
2449  */
2450 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2451 {
2452         struct task_security_struct *new_tsec;
2453         struct rlimit *rlim, *initrlim;
2454         int rc, i;
2455
2456         new_tsec = selinux_cred(bprm->cred);
2457         if (new_tsec->sid == new_tsec->osid)
2458                 return;
2459
2460         /* Close files for which the new task SID is not authorized. */
2461         flush_unauthorized_files(bprm->cred, current->files);
2462
2463         /* Always clear parent death signal on SID transitions. */
2464         current->pdeath_signal = 0;
2465
2466         /* Check whether the new SID can inherit resource limits from the old
2467          * SID.  If not, reset all soft limits to the lower of the current
2468          * task's hard limit and the init task's soft limit.
2469          *
2470          * Note that the setting of hard limits (even to lower them) can be
2471          * controlled by the setrlimit check.  The inclusion of the init task's
2472          * soft limit into the computation is to avoid resetting soft limits
2473          * higher than the default soft limit for cases where the default is
2474          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2475          */
2476         rc = avc_has_perm(&selinux_state,
2477                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2478                           PROCESS__RLIMITINH, NULL);
2479         if (rc) {
2480                 /* protect against do_prlimit() */
2481                 task_lock(current);
2482                 for (i = 0; i < RLIM_NLIMITS; i++) {
2483                         rlim = current->signal->rlim + i;
2484                         initrlim = init_task.signal->rlim + i;
2485                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2486                 }
2487                 task_unlock(current);
2488                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2489                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2490         }
2491 }
2492
2493 /*
2494  * Clean up the process immediately after the installation of new credentials
2495  * due to exec
2496  */
2497 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2498 {
2499         const struct task_security_struct *tsec = selinux_cred(current_cred());
2500         u32 osid, sid;
2501         int rc;
2502
2503         osid = tsec->osid;
2504         sid = tsec->sid;
2505
2506         if (sid == osid)
2507                 return;
2508
2509         /* Check whether the new SID can inherit signal state from the old SID.
2510          * If not, clear itimers to avoid subsequent signal generation and
2511          * flush and unblock signals.
2512          *
2513          * This must occur _after_ the task SID has been updated so that any
2514          * kill done after the flush will be checked against the new SID.
2515          */
2516         rc = avc_has_perm(&selinux_state,
2517                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2518         if (rc) {
2519                 clear_itimer();
2520
2521                 spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2522                 if (!fatal_signal_pending(current)) {
2523                         flush_sigqueue(&current->pending);
2524                         flush_sigqueue(&current->signal->shared_pending);
2525                         flush_signal_handlers(current, 1);
2526                         sigemptyset(&current->blocked);
2527                         recalc_sigpending();
2528                 }
2529                 spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2530         }
2531
2532         /* Wake up the parent if it is waiting so that it can recheck
2533          * wait permission to the new task SID. */
2534         read_lock(&tasklist_lock);
2535         __wake_up_parent(current, unrcu_pointer(current->real_parent));
2536         read_unlock(&tasklist_lock);
2537 }
2538
2539 /* superblock security operations */
2540
2541 static int selinux_sb_alloc_security(struct super_block *sb)
2542 {
2543         struct superblock_security_struct *sbsec = selinux_superblock(sb);
2544
2545         mutex_init(&sbsec->lock);
2546         INIT_LIST_HEAD(&sbsec->isec_head);
2547         spin_lock_init(&sbsec->isec_lock);
2548         sbsec->sid = SECINITSID_UNLABELED;
2549         sbsec->def_sid = SECINITSID_FILE;
2550         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2551
2552         return 0;
2553 }
2554
2555 static inline int opt_len(const char *s)
2556 {
2557         bool open_quote = false;
2558         int len;
2559         char c;
2560
2561         for (len = 0; (c = s[len]) != '\0'; len++) {
2562                 if (c == '"')
2563                         open_quote = !open_quote;
2564                 if (c == ',' && !open_quote)
2565                         break;
2566         }
2567         return len;
2568 }
2569
2570 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2571 {
2572         char *from = options;
2573         char *to = options;
2574         bool first = true;
2575         int rc;
2576
2577         while (1) {
2578                 int len = opt_len(from);
2579                 int token;
2580                 char *arg = NULL;
2581
2582                 token = match_opt_prefix(from, len, &arg);
2583
2584                 if (token != Opt_error) {
2585                         char *p, *q;
2586
2587                         /* strip quotes */
2588                         if (arg) {
2589                                 for (p = q = arg; p < from + len; p++) {
2590                                         char c = *p;
2591                                         if (c != '"')
2592                                                 *q++ = c;
2593                                 }
2594                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2595                                 if (!arg) {
2596                                         rc = -ENOMEM;
2597                                         goto free_opt;
2598                                 }
2599                         }
2600                         rc = selinux_add_opt(token, arg, mnt_opts);
2601                         kfree(arg);
2602                         arg = NULL;
2603                         if (unlikely(rc)) {
2604                                 goto free_opt;
2605                         }
2606                 } else {
2607                         if (!first) {   // copy with preceding comma
2608                                 from--;
2609                                 len++;
2610                         }
2611                         if (to != from)
2612                                 memmove(to, from, len);
2613                         to += len;
2614                         first = false;
2615                 }
2616                 if (!from[len])
2617                         break;
2618                 from += len + 1;
2619         }
2620         *to = '\0';
2621         return 0;
2622
2623 free_opt:
2624         if (*mnt_opts) {
2625                 selinux_free_mnt_opts(*mnt_opts);
2626                 *mnt_opts = NULL;
2627         }
2628         return rc;
2629 }
2630
2631 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2632 {
2633         struct selinux_mnt_opts *opts = mnt_opts;
2634         struct superblock_security_struct *sbsec = selinux_superblock(sb);
2635
2636         /*
2637          * Superblock not initialized (i.e. no options) - reject if any
2638          * options specified, otherwise accept.
2639          */
2640         if (!(sbsec->flags & SE_SBINITIALIZED))
2641                 return opts ? 1 : 0;
2642
2643         /*
2644          * Superblock initialized and no options specified - reject if
2645          * superblock has any options set, otherwise accept.
2646          */
2647         if (!opts)
2648                 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2649
2650         if (opts->fscontext_sid) {
2651                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2652                                opts->fscontext_sid))
2653                         return 1;
2654         }
2655         if (opts->context_sid) {
2656                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2657                                opts->context_sid))
2658                         return 1;
2659         }
2660         if (opts->rootcontext_sid) {
2661                 struct inode_security_struct *root_isec;
2662
2663                 root_isec = backing_inode_security(sb->s_root);
2664                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2665                                opts->rootcontext_sid))
2666                         return 1;
2667         }
2668         if (opts->defcontext_sid) {
2669                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2670                                opts->defcontext_sid))
2671                         return 1;
2672         }
2673         return 0;
2674 }
2675
2676 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2677 {
2678         struct selinux_mnt_opts *opts = mnt_opts;
2679         struct superblock_security_struct *sbsec = selinux_superblock(sb);
2680
2681         if (!(sbsec->flags & SE_SBINITIALIZED))
2682                 return 0;
2683
2684         if (!opts)
2685                 return 0;
2686
2687         if (opts->fscontext_sid) {
2688                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2689                                opts->fscontext_sid))
2690                         goto out_bad_option;
2691         }
2692         if (opts->context_sid) {
2693                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2694                                opts->context_sid))
2695                         goto out_bad_option;
2696         }
2697         if (opts->rootcontext_sid) {
2698                 struct inode_security_struct *root_isec;
2699                 root_isec = backing_inode_security(sb->s_root);
2700                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2701                                opts->rootcontext_sid))
2702                         goto out_bad_option;
2703         }
2704         if (opts->defcontext_sid) {
2705                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2706                                opts->defcontext_sid))
2707                         goto out_bad_option;
2708         }
2709         return 0;
2710
2711 out_bad_option:
2712         pr_warn("SELinux: unable to change security options "
2713                "during remount (dev %s, type=%s)\n", sb->s_id,
2714                sb->s_type->name);
2715         return -EINVAL;
2716 }
2717
2718 static int selinux_sb_kern_mount(struct super_block *sb)
2719 {
2720         const struct cred *cred = current_cred();
2721         struct common_audit_data ad;
2722
2723         ad.type = LSM_AUDIT_DATA_DENTRY;
2724         ad.u.dentry = sb->s_root;
2725         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2726 }
2727
2728 static int selinux_sb_statfs(struct dentry *dentry)
2729 {
2730         const struct cred *cred = current_cred();
2731         struct common_audit_data ad;
2732
2733         ad.type = LSM_AUDIT_DATA_DENTRY;
2734         ad.u.dentry = dentry->d_sb->s_root;
2735         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2736 }
2737
2738 static int selinux_mount(const char *dev_name,
2739                          const struct path *path,
2740                          const char *type,
2741                          unsigned long flags,
2742                          void *data)
2743 {
2744         const struct cred *cred = current_cred();
2745
2746         if (flags & MS_REMOUNT)
2747                 return superblock_has_perm(cred, path->dentry->d_sb,
2748                                            FILESYSTEM__REMOUNT, NULL);
2749         else
2750                 return path_has_perm(cred, path, FILE__MOUNTON);
2751 }
2752
2753 static int selinux_move_mount(const struct path *from_path,
2754                               const struct path *to_path)
2755 {
2756         const struct cred *cred = current_cred();
2757
2758         return path_has_perm(cred, to_path, FILE__MOUNTON);
2759 }
2760
2761 static int selinux_umount(struct vfsmount *mnt, int flags)
2762 {
2763         const struct cred *cred = current_cred();
2764
2765         return superblock_has_perm(cred, mnt->mnt_sb,
2766                                    FILESYSTEM__UNMOUNT, NULL);
2767 }
2768
2769 static int selinux_fs_context_dup(struct fs_context *fc,
2770                                   struct fs_context *src_fc)
2771 {
2772         const struct selinux_mnt_opts *src = src_fc->security;
2773
2774         if (!src)
2775                 return 0;
2776
2777         fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2778         return fc->security ? 0 : -ENOMEM;
2779 }
2780
2781 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2782         fsparam_string(CONTEXT_STR,     Opt_context),
2783         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2784         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2785         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2786         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2787         {}
2788 };
2789
2790 static int selinux_fs_context_parse_param(struct fs_context *fc,
2791                                           struct fs_parameter *param)
2792 {
2793         struct fs_parse_result result;
2794         int opt;
2795
2796         opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2797         if (opt < 0)
2798                 return opt;
2799
2800         return selinux_add_opt(opt, param->string, &fc->security);
2801 }
2802
2803 /* inode security operations */
2804
2805 static int selinux_inode_alloc_security(struct inode *inode)
2806 {
2807         struct inode_security_struct *isec = selinux_inode(inode);
2808         u32 sid = current_sid();
2809
2810         spin_lock_init(&isec->lock);
2811         INIT_LIST_HEAD(&isec->list);
2812         isec->inode = inode;
2813         isec->sid = SECINITSID_UNLABELED;
2814         isec->sclass = SECCLASS_FILE;
2815         isec->task_sid = sid;
2816         isec->initialized = LABEL_INVALID;
2817
2818         return 0;
2819 }
2820
2821 static void selinux_inode_free_security(struct inode *inode)
2822 {
2823         inode_free_security(inode);
2824 }
2825
2826 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2827                                         const struct qstr *name,
2828                                         const char **xattr_name, void **ctx,
2829                                         u32 *ctxlen)
2830 {
2831         u32 newsid;
2832         int rc;
2833
2834         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2835                                            d_inode(dentry->d_parent), name,
2836                                            inode_mode_to_security_class(mode),
2837                                            &newsid);
2838         if (rc)
2839                 return rc;
2840
2841         if (xattr_name)
2842                 *xattr_name = XATTR_NAME_SELINUX;
2843
2844         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2845                                        ctxlen);
2846 }
2847
2848 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2849                                           struct qstr *name,
2850                                           const struct cred *old,
2851                                           struct cred *new)
2852 {
2853         u32 newsid;
2854         int rc;
2855         struct task_security_struct *tsec;
2856
2857         rc = selinux_determine_inode_label(selinux_cred(old),
2858                                            d_inode(dentry->d_parent), name,
2859                                            inode_mode_to_security_class(mode),
2860                                            &newsid);
2861         if (rc)
2862                 return rc;
2863
2864         tsec = selinux_cred(new);
2865         tsec->create_sid = newsid;
2866         return 0;
2867 }
2868
2869 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2870                                        const struct qstr *qstr,
2871                                        const char **name,
2872                                        void **value, size_t *len)
2873 {
2874         const struct task_security_struct *tsec = selinux_cred(current_cred());
2875         struct superblock_security_struct *sbsec;
2876         u32 newsid, clen;
2877         int rc;
2878         char *context;
2879
2880         sbsec = selinux_superblock(dir->i_sb);
2881
2882         newsid = tsec->create_sid;
2883
2884         rc = selinux_determine_inode_label(tsec, dir, qstr,
2885                 inode_mode_to_security_class(inode->i_mode),
2886                 &newsid);
2887         if (rc)
2888                 return rc;
2889
2890         /* Possibly defer initialization to selinux_complete_init. */
2891         if (sbsec->flags & SE_SBINITIALIZED) {
2892                 struct inode_security_struct *isec = selinux_inode(inode);
2893                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2894                 isec->sid = newsid;
2895                 isec->initialized = LABEL_INITIALIZED;
2896         }
2897
2898         if (!selinux_initialized(&selinux_state) ||
2899             !(sbsec->flags & SBLABEL_MNT))
2900                 return -EOPNOTSUPP;
2901
2902         if (name)
2903                 *name = XATTR_SELINUX_SUFFIX;
2904
2905         if (value && len) {
2906                 rc = security_sid_to_context_force(&selinux_state, newsid,
2907                                                    &context, &clen);
2908                 if (rc)
2909                         return rc;
2910                 *value = context;
2911                 *len = clen;
2912         }
2913
2914         return 0;
2915 }
2916
2917 static int selinux_inode_init_security_anon(struct inode *inode,
2918                                             const struct qstr *name,
2919                                             const struct inode *context_inode)
2920 {
2921         const struct task_security_struct *tsec = selinux_cred(current_cred());
2922         struct common_audit_data ad;
2923         struct inode_security_struct *isec;
2924         int rc;
2925
2926         if (unlikely(!selinux_initialized(&selinux_state)))
2927                 return 0;
2928
2929         isec = selinux_inode(inode);
2930
2931         /*
2932          * We only get here once per ephemeral inode.  The inode has
2933          * been initialized via inode_alloc_security but is otherwise
2934          * untouched.
2935          */
2936
2937         if (context_inode) {
2938                 struct inode_security_struct *context_isec =
2939                         selinux_inode(context_inode);
2940                 if (context_isec->initialized != LABEL_INITIALIZED) {
2941                         pr_err("SELinux:  context_inode is not initialized");
2942                         return -EACCES;
2943                 }
2944
2945                 isec->sclass = context_isec->sclass;
2946                 isec->sid = context_isec->sid;
2947         } else {
2948                 isec->sclass = SECCLASS_ANON_INODE;
2949                 rc = security_transition_sid(
2950                         &selinux_state, tsec->sid, tsec->sid,
2951                         isec->sclass, name, &isec->sid);
2952                 if (rc)
2953                         return rc;
2954         }
2955
2956         isec->initialized = LABEL_INITIALIZED;
2957         /*
2958          * Now that we've initialized security, check whether we're
2959          * allowed to actually create this type of anonymous inode.
2960          */
2961
2962         ad.type = LSM_AUDIT_DATA_ANONINODE;
2963         ad.u.anonclass = name ? (const char *)name->name : "?";
2964
2965         return avc_has_perm(&selinux_state,
2966                             tsec->sid,
2967                             isec->sid,
2968                             isec->sclass,
2969                             FILE__CREATE,
2970                             &ad);
2971 }
2972
2973 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2974 {
2975         return may_create(dir, dentry, SECCLASS_FILE);
2976 }
2977
2978 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2979 {
2980         return may_link(dir, old_dentry, MAY_LINK);
2981 }
2982
2983 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2984 {
2985         return may_link(dir, dentry, MAY_UNLINK);
2986 }
2987
2988 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2989 {
2990         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2991 }
2992
2993 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2994 {
2995         return may_create(dir, dentry, SECCLASS_DIR);
2996 }
2997
2998 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2999 {
3000         return may_link(dir, dentry, MAY_RMDIR);
3001 }
3002
3003 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3004 {
3005         return may_create(dir, dentry, inode_mode_to_security_class(mode));
3006 }
3007
3008 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3009                                 struct inode *new_inode, struct dentry *new_dentry)
3010 {
3011         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3012 }
3013
3014 static int selinux_inode_readlink(struct dentry *dentry)
3015 {
3016         const struct cred *cred = current_cred();
3017
3018         return dentry_has_perm(cred, dentry, FILE__READ);
3019 }
3020
3021 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3022                                      bool rcu)
3023 {
3024         const struct cred *cred = current_cred();
3025         struct common_audit_data ad;
3026         struct inode_security_struct *isec;
3027         u32 sid;
3028
3029         validate_creds(cred);
3030
3031         ad.type = LSM_AUDIT_DATA_DENTRY;
3032         ad.u.dentry = dentry;
3033         sid = cred_sid(cred);
3034         isec = inode_security_rcu(inode, rcu);
3035         if (IS_ERR(isec))
3036                 return PTR_ERR(isec);
3037
3038         return avc_has_perm(&selinux_state,
3039                                   sid, isec->sid, isec->sclass, FILE__READ, &ad);
3040 }
3041
3042 static noinline int audit_inode_permission(struct inode *inode,
3043                                            u32 perms, u32 audited, u32 denied,
3044                                            int result)
3045 {
3046         struct common_audit_data ad;
3047         struct inode_security_struct *isec = selinux_inode(inode);
3048
3049         ad.type = LSM_AUDIT_DATA_INODE;
3050         ad.u.inode = inode;
3051
3052         return slow_avc_audit(&selinux_state,
3053                             current_sid(), isec->sid, isec->sclass, perms,
3054                             audited, denied, result, &ad);
3055 }
3056
3057 static int selinux_inode_permission(struct inode *inode, int mask)
3058 {
3059         const struct cred *cred = current_cred();
3060         u32 perms;
3061         bool from_access;
3062         bool no_block = mask & MAY_NOT_BLOCK;
3063         struct inode_security_struct *isec;
3064         u32 sid;
3065         struct av_decision avd;
3066         int rc, rc2;
3067         u32 audited, denied;
3068
3069         from_access = mask & MAY_ACCESS;
3070         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3071
3072         /* No permission to check.  Existence test. */
3073         if (!mask)
3074                 return 0;
3075
3076         validate_creds(cred);
3077
3078         if (unlikely(IS_PRIVATE(inode)))
3079                 return 0;
3080
3081         perms = file_mask_to_av(inode->i_mode, mask);
3082
3083         sid = cred_sid(cred);
3084         isec = inode_security_rcu(inode, no_block);
3085         if (IS_ERR(isec))
3086                 return PTR_ERR(isec);
3087
3088         rc = avc_has_perm_noaudit(&selinux_state,
3089                                   sid, isec->sid, isec->sclass, perms, 0,
3090                                   &avd);
3091         audited = avc_audit_required(perms, &avd, rc,
3092                                      from_access ? FILE__AUDIT_ACCESS : 0,
3093                                      &denied);
3094         if (likely(!audited))
3095                 return rc;
3096
3097         rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3098         if (rc2)
3099                 return rc2;
3100         return rc;
3101 }
3102
3103 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3104 {
3105         const struct cred *cred = current_cred();
3106         struct inode *inode = d_backing_inode(dentry);
3107         unsigned int ia_valid = iattr->ia_valid;
3108         __u32 av = FILE__WRITE;
3109
3110         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3111         if (ia_valid & ATTR_FORCE) {
3112                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3113                               ATTR_FORCE);
3114                 if (!ia_valid)
3115                         return 0;
3116         }
3117
3118         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3119                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3120                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3121
3122         if (selinux_policycap_openperm() &&
3123             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3124             (ia_valid & ATTR_SIZE) &&
3125             !(ia_valid & ATTR_FILE))
3126                 av |= FILE__OPEN;
3127
3128         return dentry_has_perm(cred, dentry, av);
3129 }
3130
3131 static int selinux_inode_getattr(const struct path *path)
3132 {
3133         return path_has_perm(current_cred(), path, FILE__GETATTR);
3134 }
3135
3136 static bool has_cap_mac_admin(bool audit)
3137 {
3138         const struct cred *cred = current_cred();
3139         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3140
3141         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3142                 return false;
3143         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3144                 return false;
3145         return true;
3146 }
3147
3148 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3149                                   struct dentry *dentry, const char *name,
3150                                   const void *value, size_t size, int flags)
3151 {
3152         struct inode *inode = d_backing_inode(dentry);
3153         struct inode_security_struct *isec;
3154         struct superblock_security_struct *sbsec;
3155         struct common_audit_data ad;
3156         u32 newsid, sid = current_sid();
3157         int rc = 0;
3158
3159         if (strcmp(name, XATTR_NAME_SELINUX)) {
3160                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3161                 if (rc)
3162                         return rc;
3163
3164                 /* Not an attribute we recognize, so just check the
3165                    ordinary setattr permission. */
3166                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3167         }
3168
3169         if (!selinux_initialized(&selinux_state))
3170                 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3171
3172         sbsec = selinux_superblock(inode->i_sb);
3173         if (!(sbsec->flags & SBLABEL_MNT))
3174                 return -EOPNOTSUPP;
3175
3176         if (!inode_owner_or_capable(mnt_userns, inode))
3177                 return -EPERM;
3178
3179         ad.type = LSM_AUDIT_DATA_DENTRY;
3180         ad.u.dentry = dentry;
3181
3182         isec = backing_inode_security(dentry);
3183         rc = avc_has_perm(&selinux_state,
3184                           sid, isec->sid, isec->sclass,
3185                           FILE__RELABELFROM, &ad);
3186         if (rc)
3187                 return rc;
3188
3189         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3190                                      GFP_KERNEL);
3191         if (rc == -EINVAL) {
3192                 if (!has_cap_mac_admin(true)) {
3193                         struct audit_buffer *ab;
3194                         size_t audit_size;
3195
3196                         /* We strip a nul only if it is at the end, otherwise the
3197                          * context contains a nul and we should audit that */
3198                         if (value) {
3199                                 const char *str = value;
3200
3201                                 if (str[size - 1] == '\0')
3202                                         audit_size = size - 1;
3203                                 else
3204                                         audit_size = size;
3205                         } else {
3206                                 audit_size = 0;
3207                         }
3208                         ab = audit_log_start(audit_context(),
3209                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3210                         if (!ab)
3211                                 return rc;
3212                         audit_log_format(ab, "op=setxattr invalid_context=");
3213                         audit_log_n_untrustedstring(ab, value, audit_size);
3214                         audit_log_end(ab);
3215
3216                         return rc;
3217                 }
3218                 rc = security_context_to_sid_force(&selinux_state, value,
3219                                                    size, &newsid);
3220         }
3221         if (rc)
3222                 return rc;
3223
3224         rc = avc_has_perm(&selinux_state,
3225                           sid, newsid, isec->sclass,
3226                           FILE__RELABELTO, &ad);
3227         if (rc)
3228                 return rc;
3229
3230         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3231                                           sid, isec->sclass);
3232         if (rc)
3233                 return rc;
3234
3235         return avc_has_perm(&selinux_state,
3236                             newsid,
3237                             sbsec->sid,
3238                             SECCLASS_FILESYSTEM,
3239                             FILESYSTEM__ASSOCIATE,
3240                             &ad);
3241 }
3242
3243 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3244                                         const void *value, size_t size,
3245                                         int flags)
3246 {
3247         struct inode *inode = d_backing_inode(dentry);
3248         struct inode_security_struct *isec;
3249         u32 newsid;
3250         int rc;
3251
3252         if (strcmp(name, XATTR_NAME_SELINUX)) {
3253                 /* Not an attribute we recognize, so nothing to do. */
3254                 return;
3255         }
3256
3257         if (!selinux_initialized(&selinux_state)) {
3258                 /* If we haven't even been initialized, then we can't validate
3259                  * against a policy, so leave the label as invalid. It may
3260                  * resolve to a valid label on the next revalidation try if
3261                  * we've since initialized.
3262                  */
3263                 return;
3264         }
3265
3266         rc = security_context_to_sid_force(&selinux_state, value, size,
3267                                            &newsid);
3268         if (rc) {
3269                 pr_err("SELinux:  unable to map context to SID"
3270                        "for (%s, %lu), rc=%d\n",
3271                        inode->i_sb->s_id, inode->i_ino, -rc);
3272                 return;
3273         }
3274
3275         isec = backing_inode_security(dentry);
3276         spin_lock(&isec->lock);
3277         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3278         isec->sid = newsid;
3279         isec->initialized = LABEL_INITIALIZED;
3280         spin_unlock(&isec->lock);
3281 }
3282
3283 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3284 {
3285         const struct cred *cred = current_cred();
3286
3287         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3288 }
3289
3290 static int selinux_inode_listxattr(struct dentry *dentry)
3291 {
3292         const struct cred *cred = current_cred();
3293
3294         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3295 }
3296
3297 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3298                                      struct dentry *dentry, const char *name)
3299 {
3300         if (strcmp(name, XATTR_NAME_SELINUX)) {
3301                 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3302                 if (rc)
3303                         return rc;
3304
3305                 /* Not an attribute we recognize, so just check the
3306                    ordinary setattr permission. */
3307                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3308         }
3309
3310         if (!selinux_initialized(&selinux_state))
3311                 return 0;
3312
3313         /* No one is allowed to remove a SELinux security label.
3314            You can change the label, but all data must be labeled. */
3315         return -EACCES;
3316 }
3317
3318 static int selinux_path_notify(const struct path *path, u64 mask,
3319                                                 unsigned int obj_type)
3320 {
3321         int ret;
3322         u32 perm;
3323
3324         struct common_audit_data ad;
3325
3326         ad.type = LSM_AUDIT_DATA_PATH;
3327         ad.u.path = *path;
3328
3329         /*
3330          * Set permission needed based on the type of mark being set.
3331          * Performs an additional check for sb watches.
3332          */
3333         switch (obj_type) {
3334         case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3335                 perm = FILE__WATCH_MOUNT;
3336                 break;
3337         case FSNOTIFY_OBJ_TYPE_SB:
3338                 perm = FILE__WATCH_SB;
3339                 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3340                                                 FILESYSTEM__WATCH, &ad);
3341                 if (ret)
3342                         return ret;
3343                 break;
3344         case FSNOTIFY_OBJ_TYPE_INODE:
3345                 perm = FILE__WATCH;
3346                 break;
3347         default:
3348                 return -EINVAL;
3349         }
3350
3351         /* blocking watches require the file:watch_with_perm permission */
3352         if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3353                 perm |= FILE__WATCH_WITH_PERM;
3354
3355         /* watches on read-like events need the file:watch_reads permission */
3356         if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3357                 perm |= FILE__WATCH_READS;
3358
3359         return path_has_perm(current_cred(), path, perm);
3360 }
3361
3362 /*
3363  * Copy the inode security context value to the user.
3364  *
3365  * Permission check is handled by selinux_inode_getxattr hook.
3366  */
3367 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3368                                      struct inode *inode, const char *name,
3369                                      void **buffer, bool alloc)
3370 {
3371         u32 size;
3372         int error;
3373         char *context = NULL;
3374         struct inode_security_struct *isec;
3375
3376         /*
3377          * If we're not initialized yet, then we can't validate contexts, so
3378          * just let vfs_getxattr fall back to using the on-disk xattr.
3379          */
3380         if (!selinux_initialized(&selinux_state) ||
3381             strcmp(name, XATTR_SELINUX_SUFFIX))
3382                 return -EOPNOTSUPP;
3383
3384         /*
3385          * If the caller has CAP_MAC_ADMIN, then get the raw context
3386          * value even if it is not defined by current policy; otherwise,
3387          * use the in-core value under current policy.
3388          * Use the non-auditing forms of the permission checks since
3389          * getxattr may be called by unprivileged processes commonly
3390          * and lack of permission just means that we fall back to the
3391          * in-core context value, not a denial.
3392          */
3393         isec = inode_security(inode);
3394         if (has_cap_mac_admin(false))
3395                 error = security_sid_to_context_force(&selinux_state,
3396                                                       isec->sid, &context,
3397                                                       &size);
3398         else
3399                 error = security_sid_to_context(&selinux_state, isec->sid,
3400                                                 &context, &size);
3401         if (error)
3402                 return error;
3403         error = size;
3404         if (alloc) {
3405                 *buffer = context;
3406                 goto out_nofree;
3407         }
3408         kfree(context);
3409 out_nofree:
3410         return error;
3411 }
3412
3413 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3414                                      const void *value, size_t size, int flags)
3415 {
3416         struct inode_security_struct *isec = inode_security_novalidate(inode);
3417         struct superblock_security_struct *sbsec;
3418         u32 newsid;
3419         int rc;
3420
3421         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3422                 return -EOPNOTSUPP;
3423
3424         sbsec = selinux_superblock(inode->i_sb);
3425         if (!(sbsec->flags & SBLABEL_MNT))
3426                 return -EOPNOTSUPP;
3427
3428         if (!value || !size)
3429                 return -EACCES;
3430
3431         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3432                                      GFP_KERNEL);
3433         if (rc)
3434                 return rc;
3435
3436         spin_lock(&isec->lock);
3437         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3438         isec->sid = newsid;
3439         isec->initialized = LABEL_INITIALIZED;
3440         spin_unlock(&isec->lock);
3441         return 0;
3442 }
3443
3444 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3445 {
3446         const int len = sizeof(XATTR_NAME_SELINUX);
3447
3448         if (!selinux_initialized(&selinux_state))
3449                 return 0;
3450
3451         if (buffer && len <= buffer_size)
3452                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3453         return len;
3454 }
3455
3456 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3457 {
3458         struct inode_security_struct *isec = inode_security_novalidate(inode);
3459         *secid = isec->sid;
3460 }
3461
3462 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3463 {
3464         u32 sid;
3465         struct task_security_struct *tsec;
3466         struct cred *new_creds = *new;
3467
3468         if (new_creds == NULL) {
3469                 new_creds = prepare_creds();
3470                 if (!new_creds)
3471                         return -ENOMEM;
3472         }
3473
3474         tsec = selinux_cred(new_creds);
3475         /* Get label from overlay inode and set it in create_sid */
3476         selinux_inode_getsecid(d_inode(src), &sid);
3477         tsec->create_sid = sid;
3478         *new = new_creds;
3479         return 0;
3480 }
3481
3482 static int selinux_inode_copy_up_xattr(const char *name)
3483 {
3484         /* The copy_up hook above sets the initial context on an inode, but we
3485          * don't then want to overwrite it by blindly copying all the lower
3486          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3487          */
3488         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3489                 return 1; /* Discard */
3490         /*
3491          * Any other attribute apart from SELINUX is not claimed, supported
3492          * by selinux.
3493          */
3494         return -EOPNOTSUPP;
3495 }
3496
3497 /* kernfs node operations */
3498
3499 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3500                                         struct kernfs_node *kn)
3501 {
3502         const struct task_security_struct *tsec = selinux_cred(current_cred());
3503         u32 parent_sid, newsid, clen;
3504         int rc;
3505         char *context;
3506
3507         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3508         if (rc == -ENODATA)
3509                 return 0;
3510         else if (rc < 0)
3511                 return rc;
3512
3513         clen = (u32)rc;
3514         context = kmalloc(clen, GFP_KERNEL);
3515         if (!context)
3516                 return -ENOMEM;
3517
3518         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3519         if (rc < 0) {
3520                 kfree(context);
3521                 return rc;
3522         }
3523
3524         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3525                                      GFP_KERNEL);
3526         kfree(context);
3527         if (rc)
3528                 return rc;
3529
3530         if (tsec->create_sid) {
3531                 newsid = tsec->create_sid;
3532         } else {
3533                 u16 secclass = inode_mode_to_security_class(kn->mode);
3534                 struct qstr q;
3535
3536                 q.name = kn->name;
3537                 q.hash_len = hashlen_string(kn_dir, kn->name);
3538
3539                 rc = security_transition_sid(&selinux_state, tsec->sid,
3540                                              parent_sid, secclass, &q,
3541                                              &newsid);
3542                 if (rc)
3543                         return rc;
3544         }
3545
3546         rc = security_sid_to_context_force(&selinux_state, newsid,
3547                                            &context, &clen);
3548         if (rc)
3549                 return rc;
3550
3551         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3552                               XATTR_CREATE);
3553         kfree(context);
3554         return rc;
3555 }
3556
3557
3558 /* file security operations */
3559
3560 static int selinux_revalidate_file_permission(struct file *file, int mask)
3561 {
3562         const struct cred *cred = current_cred();
3563         struct inode *inode = file_inode(file);
3564
3565         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3566         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3567                 mask |= MAY_APPEND;
3568
3569         return file_has_perm(cred, file,
3570                              file_mask_to_av(inode->i_mode, mask));
3571 }
3572
3573 static int selinux_file_permission(struct file *file, int mask)
3574 {
3575         struct inode *inode = file_inode(file);
3576         struct file_security_struct *fsec = selinux_file(file);
3577         struct inode_security_struct *isec;
3578         u32 sid = current_sid();
3579
3580         if (!mask)
3581                 /* No permission to check.  Existence test. */
3582                 return 0;
3583
3584         isec = inode_security(inode);
3585         if (sid == fsec->sid && fsec->isid == isec->sid &&
3586             fsec->pseqno == avc_policy_seqno(&selinux_state))
3587                 /* No change since file_open check. */
3588                 return 0;
3589
3590         return selinux_revalidate_file_permission(file, mask);
3591 }
3592
3593 static int selinux_file_alloc_security(struct file *file)
3594 {
3595         struct file_security_struct *fsec = selinux_file(file);
3596         u32 sid = current_sid();
3597
3598         fsec->sid = sid;
3599         fsec->fown_sid = sid;
3600
3601         return 0;
3602 }
3603
3604 /*
3605  * Check whether a task has the ioctl permission and cmd
3606  * operation to an inode.
3607  */
3608 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3609                 u32 requested, u16 cmd)
3610 {
3611         struct common_audit_data ad;
3612         struct file_security_struct *fsec = selinux_file(file);
3613         struct inode *inode = file_inode(file);
3614         struct inode_security_struct *isec;
3615         struct lsm_ioctlop_audit ioctl;
3616         u32 ssid = cred_sid(cred);
3617         int rc;
3618         u8 driver = cmd >> 8;
3619         u8 xperm = cmd & 0xff;
3620
3621         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3622         ad.u.op = &ioctl;
3623         ad.u.op->cmd = cmd;
3624         ad.u.op->path = file->f_path;
3625
3626         if (ssid != fsec->sid) {
3627                 rc = avc_has_perm(&selinux_state,
3628                                   ssid, fsec->sid,
3629                                 SECCLASS_FD,
3630                                 FD__USE,
3631                                 &ad);
3632                 if (rc)
3633                         goto out;
3634         }
3635
3636         if (unlikely(IS_PRIVATE(inode)))
3637                 return 0;
3638
3639         isec = inode_security(inode);
3640         rc = avc_has_extended_perms(&selinux_state,
3641                                     ssid, isec->sid, isec->sclass,
3642                                     requested, driver, xperm, &ad);
3643 out:
3644         return rc;
3645 }
3646
3647 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3648                               unsigned long arg)
3649 {
3650         const struct cred *cred = current_cred();
3651         int error = 0;
3652
3653         switch (cmd) {
3654         case FIONREAD:
3655         case FIBMAP:
3656         case FIGETBSZ:
3657         case FS_IOC_GETFLAGS:
3658         case FS_IOC_GETVERSION:
3659                 error = file_has_perm(cred, file, FILE__GETATTR);
3660                 break;
3661
3662         case FS_IOC_SETFLAGS:
3663         case FS_IOC_SETVERSION:
3664                 error = file_has_perm(cred, file, FILE__SETATTR);
3665                 break;
3666
3667         /* sys_ioctl() checks */
3668         case FIONBIO:
3669         case FIOASYNC:
3670                 error = file_has_perm(cred, file, 0);
3671                 break;
3672
3673         case KDSKBENT:
3674         case KDSKBSENT:
3675                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3676                                             CAP_OPT_NONE, true);
3677                 break;
3678
3679         case FIOCLEX:
3680         case FIONCLEX:
3681                 if (!selinux_policycap_ioctl_skip_cloexec())
3682                         error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3683                 break;
3684
3685         /* default case assumes that the command will go
3686          * to the file's ioctl() function.
3687          */
3688         default:
3689                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3690         }
3691         return error;
3692 }
3693
3694 static int default_noexec __ro_after_init;
3695
3696 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3697 {
3698         const struct cred *cred = current_cred();
3699         u32 sid = cred_sid(cred);
3700         int rc = 0;
3701
3702         if (default_noexec &&
3703             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3704                                    (!shared && (prot & PROT_WRITE)))) {
3705                 /*
3706                  * We are making executable an anonymous mapping or a
3707                  * private file mapping that will also be writable.
3708                  * This has an additional check.
3709                  */
3710                 rc = avc_has_perm(&selinux_state,
3711                                   sid, sid, SECCLASS_PROCESS,
3712                                   PROCESS__EXECMEM, NULL);
3713                 if (rc)
3714                         goto error;
3715         }
3716
3717         if (file) {
3718                 /* read access is always possible with a mapping */
3719                 u32 av = FILE__READ;
3720
3721                 /* write access only matters if the mapping is shared */
3722                 if (shared && (prot & PROT_WRITE))
3723                         av |= FILE__WRITE;
3724
3725                 if (prot & PROT_EXEC)
3726                         av |= FILE__EXECUTE;
3727
3728                 return file_has_perm(cred, file, av);
3729         }
3730
3731 error:
3732         return rc;
3733 }
3734
3735 static int selinux_mmap_addr(unsigned long addr)
3736 {
3737         int rc = 0;
3738
3739         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3740                 u32 sid = current_sid();
3741                 rc = avc_has_perm(&selinux_state,
3742                                   sid, sid, SECCLASS_MEMPROTECT,
3743                                   MEMPROTECT__MMAP_ZERO, NULL);
3744         }
3745
3746         return rc;
3747 }
3748
3749 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3750                              unsigned long prot, unsigned long flags)
3751 {
3752         struct common_audit_data ad;
3753         int rc;
3754
3755         if (file) {
3756                 ad.type = LSM_AUDIT_DATA_FILE;
3757                 ad.u.file = file;
3758                 rc = inode_has_perm(current_cred(), file_inode(file),
3759                                     FILE__MAP, &ad);
3760                 if (rc)
3761                         return rc;
3762         }
3763
3764         if (checkreqprot_get(&selinux_state))
3765                 prot = reqprot;
3766
3767         return file_map_prot_check(file, prot,
3768                                    (flags & MAP_TYPE) == MAP_SHARED);
3769 }
3770
3771 static int selinux_file_mprotect(struct vm_area_struct *vma,
3772                                  unsigned long reqprot,
3773                                  unsigned long prot)
3774 {
3775         const struct cred *cred = current_cred();
3776         u32 sid = cred_sid(cred);
3777
3778         if (checkreqprot_get(&selinux_state))
3779                 prot = reqprot;
3780
3781         if (default_noexec &&
3782             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3783                 int rc = 0;
3784                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3785                     vma->vm_end <= vma->vm_mm->brk) {
3786                         rc = avc_has_perm(&selinux_state,
3787                                           sid, sid, SECCLASS_PROCESS,
3788                                           PROCESS__EXECHEAP, NULL);
3789                 } else if (!vma->vm_file &&
3790                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3791                              vma->vm_end >= vma->vm_mm->start_stack) ||
3792                             vma_is_stack_for_current(vma))) {
3793                         rc = avc_has_perm(&selinux_state,
3794                                           sid, sid, SECCLASS_PROCESS,
3795                                           PROCESS__EXECSTACK, NULL);
3796                 } else if (vma->vm_file && vma->anon_vma) {
3797                         /*
3798                          * We are making executable a file mapping that has
3799                          * had some COW done. Since pages might have been
3800                          * written, check ability to execute the possibly
3801                          * modified content.  This typically should only
3802                          * occur for text relocations.
3803                          */
3804                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3805                 }
3806                 if (rc)
3807                         return rc;
3808         }
3809
3810         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3811 }
3812
3813 static int selinux_file_lock(struct file *file, unsigned int cmd)
3814 {
3815         const struct cred *cred = current_cred();
3816
3817         return file_has_perm(cred, file, FILE__LOCK);
3818 }
3819
3820 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3821                               unsigned long arg)
3822 {
3823         const struct cred *cred = current_cred();
3824         int err = 0;
3825
3826         switch (cmd) {
3827         case F_SETFL:
3828                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3829                         err = file_has_perm(cred, file, FILE__WRITE);
3830                         break;
3831                 }
3832                 fallthrough;
3833         case F_SETOWN:
3834         case F_SETSIG:
3835         case F_GETFL:
3836         case F_GETOWN:
3837         case F_GETSIG:
3838         case F_GETOWNER_UIDS:
3839                 /* Just check FD__USE permission */
3840                 err = file_has_perm(cred, file, 0);
3841                 break;
3842         case F_GETLK:
3843         case F_SETLK:
3844         case F_SETLKW:
3845         case F_OFD_GETLK:
3846         case F_OFD_SETLK:
3847         case F_OFD_SETLKW:
3848 #if BITS_PER_LONG == 32
3849         case F_GETLK64:
3850         case F_SETLK64:
3851         case F_SETLKW64:
3852 #endif
3853                 err = file_has_perm(cred, file, FILE__LOCK);
3854                 break;
3855         }
3856
3857         return err;
3858 }
3859
3860 static void selinux_file_set_fowner(struct file *file)
3861 {
3862         struct file_security_struct *fsec;
3863
3864         fsec = selinux_file(file);
3865         fsec->fown_sid = current_sid();
3866 }
3867
3868 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3869                                        struct fown_struct *fown, int signum)
3870 {
3871         struct file *file;
3872         u32 sid = task_sid_obj(tsk);
3873         u32 perm;
3874         struct file_security_struct *fsec;
3875
3876         /* struct fown_struct is never outside the context of a struct file */
3877         file = container_of(fown, struct file, f_owner);
3878
3879         fsec = selinux_file(file);
3880
3881         if (!signum)
3882                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3883         else
3884                 perm = signal_to_av(signum);
3885
3886         return avc_has_perm(&selinux_state,
3887                             fsec->fown_sid, sid,
3888                             SECCLASS_PROCESS, perm, NULL);
3889 }
3890
3891 static int selinux_file_receive(struct file *file)
3892 {
3893         const struct cred *cred = current_cred();
3894
3895         return file_has_perm(cred, file, file_to_av(file));
3896 }
3897
3898 static int selinux_file_open(struct file *file)
3899 {
3900         struct file_security_struct *fsec;
3901         struct inode_security_struct *isec;
3902
3903         fsec = selinux_file(file);
3904         isec = inode_security(file_inode(file));
3905         /*
3906          * Save inode label and policy sequence number
3907          * at open-time so that selinux_file_permission
3908          * can determine whether revalidation is necessary.
3909          * Task label is already saved in the file security
3910          * struct as its SID.
3911          */
3912         fsec->isid = isec->sid;
3913         fsec->pseqno = avc_policy_seqno(&selinux_state);
3914         /*
3915          * Since the inode label or policy seqno may have changed
3916          * between the selinux_inode_permission check and the saving
3917          * of state above, recheck that access is still permitted.
3918          * Otherwise, access might never be revalidated against the
3919          * new inode label or new policy.
3920          * This check is not redundant - do not remove.
3921          */
3922         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3923 }
3924
3925 /* task security operations */
3926
3927 static int selinux_task_alloc(struct task_struct *task,
3928                               unsigned long clone_flags)
3929 {
3930         u32 sid = current_sid();
3931
3932         return avc_has_perm(&selinux_state,
3933                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3934 }
3935
3936 /*
3937  * prepare a new set of credentials for modification
3938  */
3939 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3940                                 gfp_t gfp)
3941 {
3942         const struct task_security_struct *old_tsec = selinux_cred(old);
3943         struct task_security_struct *tsec = selinux_cred(new);
3944
3945         *tsec = *old_tsec;
3946         return 0;
3947 }
3948
3949 /*
3950  * transfer the SELinux data to a blank set of creds
3951  */
3952 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3953 {
3954         const struct task_security_struct *old_tsec = selinux_cred(old);
3955         struct task_security_struct *tsec = selinux_cred(new);
3956
3957         *tsec = *old_tsec;
3958 }
3959
3960 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3961 {
3962         *secid = cred_sid(c);
3963 }
3964
3965 /*
3966  * set the security data for a kernel service
3967  * - all the creation contexts are set to unlabelled
3968  */
3969 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3970 {
3971         struct task_security_struct *tsec = selinux_cred(new);
3972         u32 sid = current_sid();
3973         int ret;
3974
3975         ret = avc_has_perm(&selinux_state,
3976                            sid, secid,
3977                            SECCLASS_KERNEL_SERVICE,
3978                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3979                            NULL);
3980         if (ret == 0) {
3981                 tsec->sid = secid;
3982                 tsec->create_sid = 0;
3983                 tsec->keycreate_sid = 0;
3984                 tsec->sockcreate_sid = 0;
3985         }
3986         return ret;
3987 }
3988
3989 /*
3990  * set the file creation context in a security record to the same as the
3991  * objective context of the specified inode
3992  */
3993 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3994 {
3995         struct inode_security_struct *isec = inode_security(inode);
3996         struct task_security_struct *tsec = selinux_cred(new);
3997         u32 sid = current_sid();
3998         int ret;
3999
4000         ret = avc_has_perm(&selinux_state,
4001                            sid, isec->sid,
4002                            SECCLASS_KERNEL_SERVICE,
4003                            KERNEL_SERVICE__CREATE_FILES_AS,
4004                            NULL);
4005
4006         if (ret == 0)
4007                 tsec->create_sid = isec->sid;
4008         return ret;
4009 }
4010
4011 static int selinux_kernel_module_request(char *kmod_name)
4012 {
4013         struct common_audit_data ad;
4014
4015         ad.type = LSM_AUDIT_DATA_KMOD;
4016         ad.u.kmod_name = kmod_name;
4017
4018         return avc_has_perm(&selinux_state,
4019                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4020                             SYSTEM__MODULE_REQUEST, &ad);
4021 }
4022
4023 static int selinux_kernel_module_from_file(struct file *file)
4024 {
4025         struct common_audit_data ad;
4026         struct inode_security_struct *isec;
4027         struct file_security_struct *fsec;
4028         u32 sid = current_sid();
4029         int rc;
4030
4031         /* init_module */
4032         if (file == NULL)
4033                 return avc_has_perm(&selinux_state,
4034                                     sid, sid, SECCLASS_SYSTEM,
4035                                         SYSTEM__MODULE_LOAD, NULL);
4036
4037         /* finit_module */
4038
4039         ad.type = LSM_AUDIT_DATA_FILE;
4040         ad.u.file = file;
4041
4042         fsec = selinux_file(file);
4043         if (sid != fsec->sid) {
4044                 rc = avc_has_perm(&selinux_state,
4045                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4046                 if (rc)
4047                         return rc;
4048         }
4049
4050         isec = inode_security(file_inode(file));
4051         return avc_has_perm(&selinux_state,
4052                             sid, isec->sid, SECCLASS_SYSTEM,
4053                                 SYSTEM__MODULE_LOAD, &ad);
4054 }
4055
4056 static int selinux_kernel_read_file(struct file *file,
4057                                     enum kernel_read_file_id id,
4058                                     bool contents)
4059 {
4060         int rc = 0;
4061
4062         switch (id) {
4063         case READING_MODULE:
4064                 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4065                 break;
4066         default:
4067                 break;
4068         }
4069
4070         return rc;
4071 }
4072
4073 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4074 {
4075         int rc = 0;
4076
4077         switch (id) {
4078         case LOADING_MODULE:
4079                 rc = selinux_kernel_module_from_file(NULL);
4080                 break;
4081         default:
4082                 break;
4083         }
4084
4085         return rc;
4086 }
4087
4088 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4089 {
4090         return avc_has_perm(&selinux_state,
4091                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4092                             PROCESS__SETPGID, NULL);
4093 }
4094
4095 static int selinux_task_getpgid(struct task_struct *p)
4096 {
4097         return avc_has_perm(&selinux_state,
4098                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4099                             PROCESS__GETPGID, NULL);
4100 }
4101
4102 static int selinux_task_getsid(struct task_struct *p)
4103 {
4104         return avc_has_perm(&selinux_state,
4105                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4106                             PROCESS__GETSESSION, NULL);
4107 }
4108
4109 static void selinux_current_getsecid_subj(u32 *secid)
4110 {
4111         *secid = current_sid();
4112 }
4113
4114 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4115 {
4116         *secid = task_sid_obj(p);
4117 }
4118
4119 static int selinux_task_setnice(struct task_struct *p, int nice)
4120 {
4121         return avc_has_perm(&selinux_state,
4122                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4123                             PROCESS__SETSCHED, NULL);
4124 }
4125
4126 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4127 {
4128         return avc_has_perm(&selinux_state,
4129                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4130                             PROCESS__SETSCHED, NULL);
4131 }
4132
4133 static int selinux_task_getioprio(struct task_struct *p)
4134 {
4135         return avc_has_perm(&selinux_state,
4136                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4137                             PROCESS__GETSCHED, NULL);
4138 }
4139
4140 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4141                                 unsigned int flags)
4142 {
4143         u32 av = 0;
4144
4145         if (!flags)
4146                 return 0;
4147         if (flags & LSM_PRLIMIT_WRITE)
4148                 av |= PROCESS__SETRLIMIT;
4149         if (flags & LSM_PRLIMIT_READ)
4150                 av |= PROCESS__GETRLIMIT;
4151         return avc_has_perm(&selinux_state,
4152                             cred_sid(cred), cred_sid(tcred),
4153                             SECCLASS_PROCESS, av, NULL);
4154 }
4155
4156 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4157                 struct rlimit *new_rlim)
4158 {
4159         struct rlimit *old_rlim = p->signal->rlim + resource;
4160
4161         /* Control the ability to change the hard limit (whether
4162            lowering or raising it), so that the hard limit can
4163            later be used as a safe reset point for the soft limit
4164            upon context transitions.  See selinux_bprm_committing_creds. */
4165         if (old_rlim->rlim_max != new_rlim->rlim_max)
4166                 return avc_has_perm(&selinux_state,
4167                                     current_sid(), task_sid_obj(p),
4168                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4169
4170         return 0;
4171 }
4172
4173 static int selinux_task_setscheduler(struct task_struct *p)
4174 {
4175         return avc_has_perm(&selinux_state,
4176                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4177                             PROCESS__SETSCHED, NULL);
4178 }
4179
4180 static int selinux_task_getscheduler(struct task_struct *p)
4181 {
4182         return avc_has_perm(&selinux_state,
4183                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4184                             PROCESS__GETSCHED, NULL);
4185 }
4186
4187 static int selinux_task_movememory(struct task_struct *p)
4188 {
4189         return avc_has_perm(&selinux_state,
4190                             current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4191                             PROCESS__SETSCHED, NULL);
4192 }
4193
4194 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4195                                 int sig, const struct cred *cred)
4196 {
4197         u32 secid;
4198         u32 perm;
4199
4200         if (!sig)
4201                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4202         else
4203                 perm = signal_to_av(sig);
4204         if (!cred)
4205                 secid = current_sid();
4206         else
4207                 secid = cred_sid(cred);
4208         return avc_has_perm(&selinux_state,
4209                             secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4210 }
4211
4212 static void selinux_task_to_inode(struct task_struct *p,
4213                                   struct inode *inode)
4214 {
4215         struct inode_security_struct *isec = selinux_inode(inode);
4216         u32 sid = task_sid_obj(p);
4217
4218         spin_lock(&isec->lock);
4219         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4220         isec->sid = sid;
4221         isec->initialized = LABEL_INITIALIZED;
4222         spin_unlock(&isec->lock);
4223 }
4224
4225 static int selinux_userns_create(const struct cred *cred)
4226 {
4227         u32 sid = current_sid();
4228
4229         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_USER_NAMESPACE,
4230                                                 USER_NAMESPACE__CREATE, NULL);
4231 }
4232
4233 /* Returns error only if unable to parse addresses */
4234 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4235                         struct common_audit_data *ad, u8 *proto)
4236 {
4237         int offset, ihlen, ret = -EINVAL;
4238         struct iphdr _iph, *ih;
4239
4240         offset = skb_network_offset(skb);
4241         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4242         if (ih == NULL)
4243                 goto out;
4244
4245         ihlen = ih->ihl * 4;
4246         if (ihlen < sizeof(_iph))
4247                 goto out;
4248
4249         ad->u.net->v4info.saddr = ih->saddr;
4250         ad->u.net->v4info.daddr = ih->daddr;
4251         ret = 0;
4252
4253         if (proto)
4254                 *proto = ih->protocol;
4255
4256         switch (ih->protocol) {
4257         case IPPROTO_TCP: {
4258                 struct tcphdr _tcph, *th;
4259
4260                 if (ntohs(ih->frag_off) & IP_OFFSET)
4261                         break;
4262
4263                 offset += ihlen;
4264                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4265                 if (th == NULL)
4266                         break;
4267
4268                 ad->u.net->sport = th->source;
4269                 ad->u.net->dport = th->dest;
4270                 break;
4271         }
4272
4273         case IPPROTO_UDP: {
4274                 struct udphdr _udph, *uh;
4275
4276                 if (ntohs(ih->frag_off) & IP_OFFSET)
4277                         break;
4278
4279                 offset += ihlen;
4280                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4281                 if (uh == NULL)
4282                         break;
4283
4284                 ad->u.net->sport = uh->source;
4285                 ad->u.net->dport = uh->dest;
4286                 break;
4287         }
4288
4289         case IPPROTO_DCCP: {
4290                 struct dccp_hdr _dccph, *dh;
4291
4292                 if (ntohs(ih->frag_off) & IP_OFFSET)
4293                         break;
4294
4295                 offset += ihlen;
4296                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4297                 if (dh == NULL)
4298                         break;
4299
4300                 ad->u.net->sport = dh->dccph_sport;
4301                 ad->u.net->dport = dh->dccph_dport;
4302                 break;
4303         }
4304
4305 #if IS_ENABLED(CONFIG_IP_SCTP)
4306         case IPPROTO_SCTP: {
4307                 struct sctphdr _sctph, *sh;
4308
4309                 if (ntohs(ih->frag_off) & IP_OFFSET)
4310                         break;
4311
4312                 offset += ihlen;
4313                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4314                 if (sh == NULL)
4315                         break;
4316
4317                 ad->u.net->sport = sh->source;
4318                 ad->u.net->dport = sh->dest;
4319                 break;
4320         }
4321 #endif
4322         default:
4323                 break;
4324         }
4325 out:
4326         return ret;
4327 }
4328
4329 #if IS_ENABLED(CONFIG_IPV6)
4330
4331 /* Returns error only if unable to parse addresses */
4332 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4333                         struct common_audit_data *ad, u8 *proto)
4334 {
4335         u8 nexthdr;
4336         int ret = -EINVAL, offset;
4337         struct ipv6hdr _ipv6h, *ip6;
4338         __be16 frag_off;
4339
4340         offset = skb_network_offset(skb);
4341         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4342         if (ip6 == NULL)
4343                 goto out;
4344
4345         ad->u.net->v6info.saddr = ip6->saddr;
4346         ad->u.net->v6info.daddr = ip6->daddr;
4347         ret = 0;
4348
4349         nexthdr = ip6->nexthdr;
4350         offset += sizeof(_ipv6h);
4351         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4352         if (offset < 0)
4353                 goto out;
4354
4355         if (proto)
4356                 *proto = nexthdr;
4357
4358         switch (nexthdr) {
4359         case IPPROTO_TCP: {
4360                 struct tcphdr _tcph, *th;
4361
4362                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4363                 if (th == NULL)
4364                         break;
4365
4366                 ad->u.net->sport = th->source;
4367                 ad->u.net->dport = th->dest;
4368                 break;
4369         }
4370
4371         case IPPROTO_UDP: {
4372                 struct udphdr _udph, *uh;
4373
4374                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4375                 if (uh == NULL)
4376                         break;
4377
4378                 ad->u.net->sport = uh->source;
4379                 ad->u.net->dport = uh->dest;
4380                 break;
4381         }
4382
4383         case IPPROTO_DCCP: {
4384                 struct dccp_hdr _dccph, *dh;
4385
4386                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4387                 if (dh == NULL)
4388                         break;
4389
4390                 ad->u.net->sport = dh->dccph_sport;
4391                 ad->u.net->dport = dh->dccph_dport;
4392                 break;
4393         }
4394
4395 #if IS_ENABLED(CONFIG_IP_SCTP)
4396         case IPPROTO_SCTP: {
4397                 struct sctphdr _sctph, *sh;
4398
4399                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4400                 if (sh == NULL)
4401                         break;
4402
4403                 ad->u.net->sport = sh->source;
4404                 ad->u.net->dport = sh->dest;
4405                 break;
4406         }
4407 #endif
4408         /* includes fragments */
4409         default:
4410                 break;
4411         }
4412 out:
4413         return ret;
4414 }
4415
4416 #endif /* IPV6 */
4417
4418 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4419                              char **_addrp, int src, u8 *proto)
4420 {
4421         char *addrp;
4422         int ret;
4423
4424         switch (ad->u.net->family) {
4425         case PF_INET:
4426                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4427                 if (ret)
4428                         goto parse_error;
4429                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4430                                        &ad->u.net->v4info.daddr);
4431                 goto okay;
4432
4433 #if IS_ENABLED(CONFIG_IPV6)
4434         case PF_INET6:
4435                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4436                 if (ret)
4437                         goto parse_error;
4438                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4439                                        &ad->u.net->v6info.daddr);
4440                 goto okay;
4441 #endif  /* IPV6 */
4442         default:
4443                 addrp = NULL;
4444                 goto okay;
4445         }
4446
4447 parse_error:
4448         pr_warn(
4449                "SELinux: failure in selinux_parse_skb(),"
4450                " unable to parse packet\n");
4451         return ret;
4452
4453 okay:
4454         if (_addrp)
4455                 *_addrp = addrp;
4456         return 0;
4457 }
4458
4459 /**
4460  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4461  * @skb: the packet
4462  * @family: protocol family
4463  * @sid: the packet's peer label SID
4464  *
4465  * Description:
4466  * Check the various different forms of network peer labeling and determine
4467  * the peer label/SID for the packet; most of the magic actually occurs in
4468  * the security server function security_net_peersid_cmp().  The function
4469  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4470  * or -EACCES if @sid is invalid due to inconsistencies with the different
4471  * peer labels.
4472  *
4473  */
4474 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4475 {
4476         int err;
4477         u32 xfrm_sid;
4478         u32 nlbl_sid;
4479         u32 nlbl_type;
4480
4481         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4482         if (unlikely(err))
4483                 return -EACCES;
4484         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4485         if (unlikely(err))
4486                 return -EACCES;
4487
4488         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4489                                            nlbl_type, xfrm_sid, sid);
4490         if (unlikely(err)) {
4491                 pr_warn(
4492                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4493                        " unable to determine packet's peer label\n");
4494                 return -EACCES;
4495         }
4496
4497         return 0;
4498 }
4499
4500 /**
4501  * selinux_conn_sid - Determine the child socket label for a connection
4502  * @sk_sid: the parent socket's SID
4503  * @skb_sid: the packet's SID
4504  * @conn_sid: the resulting connection SID
4505  *
4506  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4507  * combined with the MLS information from @skb_sid in order to create
4508  * @conn_sid.  If @skb_sid is not valid then @conn_sid is simply a copy
4509  * of @sk_sid.  Returns zero on success, negative values on failure.
4510  *
4511  */
4512 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4513 {
4514         int err = 0;
4515
4516         if (skb_sid != SECSID_NULL)
4517                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4518                                             conn_sid);
4519         else
4520                 *conn_sid = sk_sid;
4521
4522         return err;
4523 }
4524
4525 /* socket security operations */
4526
4527 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4528                                  u16 secclass, u32 *socksid)
4529 {
4530         if (tsec->sockcreate_sid > SECSID_NULL) {
4531                 *socksid = tsec->sockcreate_sid;
4532                 return 0;
4533         }
4534
4535         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4536                                        secclass, NULL, socksid);
4537 }
4538
4539 static int sock_has_perm(struct sock *sk, u32 perms)
4540 {
4541         struct sk_security_struct *sksec = sk->sk_security;
4542         struct common_audit_data ad;
4543         struct lsm_network_audit net = {0,};
4544
4545         if (sksec->sid == SECINITSID_KERNEL)
4546                 return 0;
4547
4548         ad.type = LSM_AUDIT_DATA_NET;
4549         ad.u.net = &net;
4550         ad.u.net->sk = sk;
4551
4552         return avc_has_perm(&selinux_state,
4553                             current_sid(), sksec->sid, sksec->sclass, perms,
4554                             &ad);
4555 }
4556
4557 static int selinux_socket_create(int family, int type,
4558                                  int protocol, int kern)
4559 {
4560         const struct task_security_struct *tsec = selinux_cred(current_cred());
4561         u32 newsid;
4562         u16 secclass;
4563         int rc;
4564
4565         if (kern)
4566                 return 0;
4567
4568         secclass = socket_type_to_security_class(family, type, protocol);
4569         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4570         if (rc)
4571                 return rc;
4572
4573         return avc_has_perm(&selinux_state,
4574                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4575 }
4576
4577 static int selinux_socket_post_create(struct socket *sock, int family,
4578                                       int type, int protocol, int kern)
4579 {
4580         const struct task_security_struct *tsec = selinux_cred(current_cred());
4581         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4582         struct sk_security_struct *sksec;
4583         u16 sclass = socket_type_to_security_class(family, type, protocol);
4584         u32 sid = SECINITSID_KERNEL;
4585         int err = 0;
4586
4587         if (!kern) {
4588                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4589                 if (err)
4590                         return err;
4591         }
4592
4593         isec->sclass = sclass;
4594         isec->sid = sid;
4595         isec->initialized = LABEL_INITIALIZED;
4596
4597         if (sock->sk) {
4598                 sksec = sock->sk->sk_security;
4599                 sksec->sclass = sclass;
4600                 sksec->sid = sid;
4601                 /* Allows detection of the first association on this socket */
4602                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4603                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4604
4605                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4606         }
4607
4608         return err;
4609 }
4610
4611 static int selinux_socket_socketpair(struct socket *socka,
4612                                      struct socket *sockb)
4613 {
4614         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4615         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4616
4617         sksec_a->peer_sid = sksec_b->sid;
4618         sksec_b->peer_sid = sksec_a->sid;
4619
4620         return 0;
4621 }
4622
4623 /* Range of port numbers used to automatically bind.
4624    Need to determine whether we should perform a name_bind
4625    permission check between the socket and the port number. */
4626
4627 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4628 {
4629         struct sock *sk = sock->sk;
4630         struct sk_security_struct *sksec = sk->sk_security;
4631         u16 family;
4632         int err;
4633
4634         err = sock_has_perm(sk, SOCKET__BIND);
4635         if (err)
4636                 goto out;
4637
4638         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4639         family = sk->sk_family;
4640         if (family == PF_INET || family == PF_INET6) {
4641                 char *addrp;
4642                 struct common_audit_data ad;
4643                 struct lsm_network_audit net = {0,};
4644                 struct sockaddr_in *addr4 = NULL;
4645                 struct sockaddr_in6 *addr6 = NULL;
4646                 u16 family_sa;
4647                 unsigned short snum;
4648                 u32 sid, node_perm;
4649
4650                 /*
4651                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4652                  * that validates multiple binding addresses. Because of this
4653                  * need to check address->sa_family as it is possible to have
4654                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4655                  */
4656                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4657                         return -EINVAL;
4658                 family_sa = address->sa_family;
4659                 switch (family_sa) {
4660                 case AF_UNSPEC:
4661                 case AF_INET:
4662                         if (addrlen < sizeof(struct sockaddr_in))
4663                                 return -EINVAL;
4664                         addr4 = (struct sockaddr_in *)address;
4665                         if (family_sa == AF_UNSPEC) {
4666                                 /* see __inet_bind(), we only want to allow
4667                                  * AF_UNSPEC if the address is INADDR_ANY
4668                                  */
4669                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4670                                         goto err_af;
4671                                 family_sa = AF_INET;
4672                         }
4673                         snum = ntohs(addr4->sin_port);
4674                         addrp = (char *)&addr4->sin_addr.s_addr;
4675                         break;
4676                 case AF_INET6:
4677                         if (addrlen < SIN6_LEN_RFC2133)
4678                                 return -EINVAL;
4679                         addr6 = (struct sockaddr_in6 *)address;
4680                         snum = ntohs(addr6->sin6_port);
4681                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4682                         break;
4683                 default:
4684                         goto err_af;
4685                 }
4686
4687                 ad.type = LSM_AUDIT_DATA_NET;
4688                 ad.u.net = &net;
4689                 ad.u.net->sport = htons(snum);
4690                 ad.u.net->family = family_sa;
4691
4692                 if (snum) {
4693                         int low, high;
4694
4695                         inet_get_local_port_range(sock_net(sk), &low, &high);
4696
4697                         if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4698                             snum < low || snum > high) {
4699                                 err = sel_netport_sid(sk->sk_protocol,
4700                                                       snum, &sid);
4701                                 if (err)
4702                                         goto out;
4703                                 err = avc_has_perm(&selinux_state,
4704                                                    sksec->sid, sid,
4705                                                    sksec->sclass,
4706                                                    SOCKET__NAME_BIND, &ad);
4707                                 if (err)
4708                                         goto out;
4709                         }
4710                 }
4711
4712                 switch (sksec->sclass) {
4713                 case SECCLASS_TCP_SOCKET:
4714                         node_perm = TCP_SOCKET__NODE_BIND;
4715                         break;
4716
4717                 case SECCLASS_UDP_SOCKET:
4718                         node_perm = UDP_SOCKET__NODE_BIND;
4719                         break;
4720
4721                 case SECCLASS_DCCP_SOCKET:
4722                         node_perm = DCCP_SOCKET__NODE_BIND;
4723                         break;
4724
4725                 case SECCLASS_SCTP_SOCKET:
4726                         node_perm = SCTP_SOCKET__NODE_BIND;
4727                         break;
4728
4729                 default:
4730                         node_perm = RAWIP_SOCKET__NODE_BIND;
4731                         break;
4732                 }
4733
4734                 err = sel_netnode_sid(addrp, family_sa, &sid);
4735                 if (err)
4736                         goto out;
4737
4738                 if (family_sa == AF_INET)
4739                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4740                 else
4741                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4742
4743                 err = avc_has_perm(&selinux_state,
4744                                    sksec->sid, sid,
4745                                    sksec->sclass, node_perm, &ad);
4746                 if (err)
4747                         goto out;
4748         }
4749 out:
4750         return err;
4751 err_af:
4752         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4753         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4754                 return -EINVAL;
4755         return -EAFNOSUPPORT;
4756 }
4757
4758 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4759  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4760  */
4761 static int selinux_socket_connect_helper(struct socket *sock,
4762                                          struct sockaddr *address, int addrlen)
4763 {
4764         struct sock *sk = sock->sk;
4765         struct sk_security_struct *sksec = sk->sk_security;
4766         int err;
4767
4768         err = sock_has_perm(sk, SOCKET__CONNECT);
4769         if (err)
4770                 return err;
4771         if (addrlen < offsetofend(struct sockaddr, sa_family))
4772                 return -EINVAL;
4773
4774         /* connect(AF_UNSPEC) has special handling, as it is a documented
4775          * way to disconnect the socket
4776          */
4777         if (address->sa_family == AF_UNSPEC)
4778                 return 0;
4779
4780         /*
4781          * If a TCP, DCCP or SCTP socket, check name_connect permission
4782          * for the port.
4783          */
4784         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4785             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4786             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4787                 struct common_audit_data ad;
4788                 struct lsm_network_audit net = {0,};
4789                 struct sockaddr_in *addr4 = NULL;
4790                 struct sockaddr_in6 *addr6 = NULL;
4791                 unsigned short snum;
4792                 u32 sid, perm;
4793
4794                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4795                  * that validates multiple connect addresses. Because of this
4796                  * need to check address->sa_family as it is possible to have
4797                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4798                  */
4799                 switch (address->sa_family) {
4800                 case AF_INET:
4801                         addr4 = (struct sockaddr_in *)address;
4802                         if (addrlen < sizeof(struct sockaddr_in))
4803                                 return -EINVAL;
4804                         snum = ntohs(addr4->sin_port);
4805                         break;
4806                 case AF_INET6:
4807                         addr6 = (struct sockaddr_in6 *)address;
4808                         if (addrlen < SIN6_LEN_RFC2133)
4809                                 return -EINVAL;
4810                         snum = ntohs(addr6->sin6_port);
4811                         break;
4812                 default:
4813                         /* Note that SCTP services expect -EINVAL, whereas
4814                          * others expect -EAFNOSUPPORT.
4815                          */
4816                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4817                                 return -EINVAL;
4818                         else
4819                                 return -EAFNOSUPPORT;
4820                 }
4821
4822                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4823                 if (err)
4824                         return err;
4825
4826                 switch (sksec->sclass) {
4827                 case SECCLASS_TCP_SOCKET:
4828                         perm = TCP_SOCKET__NAME_CONNECT;
4829                         break;
4830                 case SECCLASS_DCCP_SOCKET:
4831                         perm = DCCP_SOCKET__NAME_CONNECT;
4832                         break;
4833                 case SECCLASS_SCTP_SOCKET:
4834                         perm = SCTP_SOCKET__NAME_CONNECT;
4835                         break;
4836                 }
4837
4838                 ad.type = LSM_AUDIT_DATA_NET;
4839                 ad.u.net = &net;
4840                 ad.u.net->dport = htons(snum);
4841                 ad.u.net->family = address->sa_family;
4842                 err = avc_has_perm(&selinux_state,
4843                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4844                 if (err)
4845                         return err;
4846         }
4847
4848         return 0;
4849 }
4850
4851 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4852 static int selinux_socket_connect(struct socket *sock,
4853                                   struct sockaddr *address, int addrlen)
4854 {
4855         int err;
4856         struct sock *sk = sock->sk;
4857
4858         err = selinux_socket_connect_helper(sock, address, addrlen);
4859         if (err)
4860                 return err;
4861
4862         return selinux_netlbl_socket_connect(sk, address);
4863 }
4864
4865 static int selinux_socket_listen(struct socket *sock, int backlog)
4866 {
4867         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4868 }
4869
4870 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4871 {
4872         int err;
4873         struct inode_security_struct *isec;
4874         struct inode_security_struct *newisec;
4875         u16 sclass;
4876         u32 sid;
4877
4878         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4879         if (err)
4880                 return err;
4881
4882         isec = inode_security_novalidate(SOCK_INODE(sock));
4883         spin_lock(&isec->lock);
4884         sclass = isec->sclass;
4885         sid = isec->sid;
4886         spin_unlock(&isec->lock);
4887
4888         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4889         newisec->sclass = sclass;
4890         newisec->sid = sid;
4891         newisec->initialized = LABEL_INITIALIZED;
4892
4893         return 0;
4894 }
4895
4896 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4897                                   int size)
4898 {
4899         return sock_has_perm(sock->sk, SOCKET__WRITE);
4900 }
4901
4902 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4903                                   int size, int flags)
4904 {
4905         return sock_has_perm(sock->sk, SOCKET__READ);
4906 }
4907
4908 static int selinux_socket_getsockname(struct socket *sock)
4909 {
4910         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4911 }
4912
4913 static int selinux_socket_getpeername(struct socket *sock)
4914 {
4915         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4916 }
4917
4918 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4919 {
4920         int err;
4921
4922         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4923         if (err)
4924                 return err;
4925
4926         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4927 }
4928
4929 static int selinux_socket_getsockopt(struct socket *sock, int level,
4930                                      int optname)
4931 {
4932         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4933 }
4934
4935 static int selinux_socket_shutdown(struct socket *sock, int how)
4936 {
4937         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4938 }
4939
4940 static int selinux_socket_unix_stream_connect(struct sock *sock,
4941                                               struct sock *other,
4942                                               struct sock *newsk)
4943 {
4944         struct sk_security_struct *sksec_sock = sock->sk_security;
4945         struct sk_security_struct *sksec_other = other->sk_security;
4946         struct sk_security_struct *sksec_new = newsk->sk_security;
4947         struct common_audit_data ad;
4948         struct lsm_network_audit net = {0,};
4949         int err;
4950
4951         ad.type = LSM_AUDIT_DATA_NET;
4952         ad.u.net = &net;
4953         ad.u.net->sk = other;
4954
4955         err = avc_has_perm(&selinux_state,
4956                            sksec_sock->sid, sksec_other->sid,
4957                            sksec_other->sclass,
4958                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4959         if (err)
4960                 return err;
4961
4962         /* server child socket */
4963         sksec_new->peer_sid = sksec_sock->sid;
4964         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4965                                     sksec_sock->sid, &sksec_new->sid);
4966         if (err)
4967                 return err;
4968
4969         /* connecting socket */
4970         sksec_sock->peer_sid = sksec_new->sid;
4971
4972         return 0;
4973 }
4974
4975 static int selinux_socket_unix_may_send(struct socket *sock,
4976                                         struct socket *other)
4977 {
4978         struct sk_security_struct *ssec = sock->sk->sk_security;
4979         struct sk_security_struct *osec = other->sk->sk_security;
4980         struct common_audit_data ad;
4981         struct lsm_network_audit net = {0,};
4982
4983         ad.type = LSM_AUDIT_DATA_NET;
4984         ad.u.net = &net;
4985         ad.u.net->sk = other->sk;
4986
4987         return avc_has_perm(&selinux_state,
4988                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4989                             &ad);
4990 }
4991
4992 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4993                                     char *addrp, u16 family, u32 peer_sid,
4994                                     struct common_audit_data *ad)
4995 {
4996         int err;
4997         u32 if_sid;
4998         u32 node_sid;
4999
5000         err = sel_netif_sid(ns, ifindex, &if_sid);
5001         if (err)
5002                 return err;
5003         err = avc_has_perm(&selinux_state,
5004                            peer_sid, if_sid,
5005                            SECCLASS_NETIF, NETIF__INGRESS, ad);
5006         if (err)
5007                 return err;
5008
5009         err = sel_netnode_sid(addrp, family, &node_sid);
5010         if (err)
5011                 return err;
5012         return avc_has_perm(&selinux_state,
5013                             peer_sid, node_sid,
5014                             SECCLASS_NODE, NODE__RECVFROM, ad);
5015 }
5016
5017 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5018                                        u16 family)
5019 {
5020         int err = 0;
5021         struct sk_security_struct *sksec = sk->sk_security;
5022         u32 sk_sid = sksec->sid;
5023         struct common_audit_data ad;
5024         struct lsm_network_audit net = {0,};
5025         char *addrp;
5026
5027         ad.type = LSM_AUDIT_DATA_NET;
5028         ad.u.net = &net;
5029         ad.u.net->netif = skb->skb_iif;
5030         ad.u.net->family = family;
5031         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5032         if (err)
5033                 return err;
5034
5035         if (selinux_secmark_enabled()) {
5036                 err = avc_has_perm(&selinux_state,
5037                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5038                                    PACKET__RECV, &ad);
5039                 if (err)
5040                         return err;
5041         }
5042
5043         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5044         if (err)
5045                 return err;
5046         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5047
5048         return err;
5049 }
5050
5051 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5052 {
5053         int err;
5054         struct sk_security_struct *sksec = sk->sk_security;
5055         u16 family = sk->sk_family;
5056         u32 sk_sid = sksec->sid;
5057         struct common_audit_data ad;
5058         struct lsm_network_audit net = {0,};
5059         char *addrp;
5060         u8 secmark_active;
5061         u8 peerlbl_active;
5062
5063         if (family != PF_INET && family != PF_INET6)
5064                 return 0;
5065
5066         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5067         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5068                 family = PF_INET;
5069
5070         /* If any sort of compatibility mode is enabled then handoff processing
5071          * to the selinux_sock_rcv_skb_compat() function to deal with the
5072          * special handling.  We do this in an attempt to keep this function
5073          * as fast and as clean as possible. */
5074         if (!selinux_policycap_netpeer())
5075                 return selinux_sock_rcv_skb_compat(sk, skb, family);
5076
5077         secmark_active = selinux_secmark_enabled();
5078         peerlbl_active = selinux_peerlbl_enabled();
5079         if (!secmark_active && !peerlbl_active)
5080                 return 0;
5081
5082         ad.type = LSM_AUDIT_DATA_NET;
5083         ad.u.net = &net;
5084         ad.u.net->netif = skb->skb_iif;
5085         ad.u.net->family = family;
5086         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5087         if (err)
5088                 return err;
5089
5090         if (peerlbl_active) {
5091                 u32 peer_sid;
5092
5093                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5094                 if (err)
5095                         return err;
5096                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5097                                                addrp, family, peer_sid, &ad);
5098                 if (err) {
5099                         selinux_netlbl_err(skb, family, err, 0);
5100                         return err;
5101                 }
5102                 err = avc_has_perm(&selinux_state,
5103                                    sk_sid, peer_sid, SECCLASS_PEER,
5104                                    PEER__RECV, &ad);
5105                 if (err) {
5106                         selinux_netlbl_err(skb, family, err, 0);
5107                         return err;
5108                 }
5109         }
5110
5111         if (secmark_active) {
5112                 err = avc_has_perm(&selinux_state,
5113                                    sk_sid, skb->secmark, SECCLASS_PACKET,
5114                                    PACKET__RECV, &ad);
5115                 if (err)
5116                         return err;
5117         }
5118
5119         return err;
5120 }
5121
5122 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5123                                             int __user *optlen, unsigned len)
5124 {
5125         int err = 0;
5126         char *scontext;
5127         u32 scontext_len;
5128         struct sk_security_struct *sksec = sock->sk->sk_security;
5129         u32 peer_sid = SECSID_NULL;
5130
5131         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5132             sksec->sclass == SECCLASS_TCP_SOCKET ||
5133             sksec->sclass == SECCLASS_SCTP_SOCKET)
5134                 peer_sid = sksec->peer_sid;
5135         if (peer_sid == SECSID_NULL)
5136                 return -ENOPROTOOPT;
5137
5138         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5139                                       &scontext_len);
5140         if (err)
5141                 return err;
5142
5143         if (scontext_len > len) {
5144                 err = -ERANGE;
5145                 goto out_len;
5146         }
5147
5148         if (copy_to_user(optval, scontext, scontext_len))
5149                 err = -EFAULT;
5150
5151 out_len:
5152         if (put_user(scontext_len, optlen))
5153                 err = -EFAULT;
5154         kfree(scontext);
5155         return err;
5156 }
5157
5158 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5159 {
5160         u32 peer_secid = SECSID_NULL;
5161         u16 family;
5162         struct inode_security_struct *isec;
5163
5164         if (skb && skb->protocol == htons(ETH_P_IP))
5165                 family = PF_INET;
5166         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5167                 family = PF_INET6;
5168         else if (sock)
5169                 family = sock->sk->sk_family;
5170         else
5171                 goto out;
5172
5173         if (sock && family == PF_UNIX) {
5174                 isec = inode_security_novalidate(SOCK_INODE(sock));
5175                 peer_secid = isec->sid;
5176         } else if (skb)
5177                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5178
5179 out:
5180         *secid = peer_secid;
5181         if (peer_secid == SECSID_NULL)
5182                 return -EINVAL;
5183         return 0;
5184 }
5185
5186 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5187 {
5188         struct sk_security_struct *sksec;
5189
5190         sksec = kzalloc(sizeof(*sksec), priority);
5191         if (!sksec)
5192                 return -ENOMEM;
5193
5194         sksec->peer_sid = SECINITSID_UNLABELED;
5195         sksec->sid = SECINITSID_UNLABELED;
5196         sksec->sclass = SECCLASS_SOCKET;
5197         selinux_netlbl_sk_security_reset(sksec);
5198         sk->sk_security = sksec;
5199
5200         return 0;
5201 }
5202
5203 static void selinux_sk_free_security(struct sock *sk)
5204 {
5205         struct sk_security_struct *sksec = sk->sk_security;
5206
5207         sk->sk_security = NULL;
5208         selinux_netlbl_sk_security_free(sksec);
5209         kfree(sksec);
5210 }
5211
5212 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5213 {
5214         struct sk_security_struct *sksec = sk->sk_security;
5215         struct sk_security_struct *newsksec = newsk->sk_security;
5216
5217         newsksec->sid = sksec->sid;
5218         newsksec->peer_sid = sksec->peer_sid;
5219         newsksec->sclass = sksec->sclass;
5220
5221         selinux_netlbl_sk_security_reset(newsksec);
5222 }
5223
5224 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5225 {
5226         if (!sk)
5227                 *secid = SECINITSID_ANY_SOCKET;
5228         else {
5229                 struct sk_security_struct *sksec = sk->sk_security;
5230
5231                 *secid = sksec->sid;
5232         }
5233 }
5234
5235 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5236 {
5237         struct inode_security_struct *isec =
5238                 inode_security_novalidate(SOCK_INODE(parent));
5239         struct sk_security_struct *sksec = sk->sk_security;
5240
5241         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5242             sk->sk_family == PF_UNIX)
5243                 isec->sid = sksec->sid;
5244         sksec->sclass = isec->sclass;
5245 }
5246
5247 /*
5248  * Determines peer_secid for the asoc and updates socket's peer label
5249  * if it's the first association on the socket.
5250  */
5251 static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5252                                           struct sk_buff *skb)
5253 {
5254         struct sock *sk = asoc->base.sk;
5255         u16 family = sk->sk_family;
5256         struct sk_security_struct *sksec = sk->sk_security;
5257         struct common_audit_data ad;
5258         struct lsm_network_audit net = {0,};
5259         int err;
5260
5261         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5262         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5263                 family = PF_INET;
5264
5265         if (selinux_peerlbl_enabled()) {
5266                 asoc->peer_secid = SECSID_NULL;
5267
5268                 /* This will return peer_sid = SECSID_NULL if there are
5269                  * no peer labels, see security_net_peersid_resolve().
5270                  */
5271                 err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
5272                 if (err)
5273                         return err;
5274
5275                 if (asoc->peer_secid == SECSID_NULL)
5276                         asoc->peer_secid = SECINITSID_UNLABELED;
5277         } else {
5278                 asoc->peer_secid = SECINITSID_UNLABELED;
5279         }
5280
5281         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5282                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5283
5284                 /* Here as first association on socket. As the peer SID
5285                  * was allowed by peer recv (and the netif/node checks),
5286                  * then it is approved by policy and used as the primary
5287                  * peer SID for getpeercon(3).
5288                  */
5289                 sksec->peer_sid = asoc->peer_secid;
5290         } else if (sksec->peer_sid != asoc->peer_secid) {
5291                 /* Other association peer SIDs are checked to enforce
5292                  * consistency among the peer SIDs.
5293                  */
5294                 ad.type = LSM_AUDIT_DATA_NET;
5295                 ad.u.net = &net;
5296                 ad.u.net->sk = asoc->base.sk;
5297                 err = avc_has_perm(&selinux_state,
5298                                    sksec->peer_sid, asoc->peer_secid,
5299                                    sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5300                                    &ad);
5301                 if (err)
5302                         return err;
5303         }
5304         return 0;
5305 }
5306
5307 /* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5308  * happens on an incoming connect(2), sctp_connectx(3) or
5309  * sctp_sendmsg(3) (with no association already present).
5310  */
5311 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5312                                       struct sk_buff *skb)
5313 {
5314         struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5315         u32 conn_sid;
5316         int err;
5317
5318         if (!selinux_policycap_extsockclass())
5319                 return 0;
5320
5321         err = selinux_sctp_process_new_assoc(asoc, skb);
5322         if (err)
5323                 return err;
5324
5325         /* Compute the MLS component for the connection and store
5326          * the information in asoc. This will be used by SCTP TCP type
5327          * sockets and peeled off connections as they cause a new
5328          * socket to be generated. selinux_sctp_sk_clone() will then
5329          * plug this into the new socket.
5330          */
5331         err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5332         if (err)
5333                 return err;
5334
5335         asoc->secid = conn_sid;
5336
5337         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5338         return selinux_netlbl_sctp_assoc_request(asoc, skb);
5339 }
5340
5341 /* Called when SCTP receives a COOKIE ACK chunk as the final
5342  * response to an association request (initited by us).
5343  */
5344 static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5345                                           struct sk_buff *skb)
5346 {
5347         struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5348
5349         if (!selinux_policycap_extsockclass())
5350                 return 0;
5351
5352         /* Inherit secid from the parent socket - this will be picked up
5353          * by selinux_sctp_sk_clone() if the association gets peeled off
5354          * into a new socket.
5355          */
5356         asoc->secid = sksec->sid;
5357
5358         return selinux_sctp_process_new_assoc(asoc, skb);
5359 }
5360
5361 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5362  * based on their @optname.
5363  */
5364 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5365                                      struct sockaddr *address,
5366                                      int addrlen)
5367 {
5368         int len, err = 0, walk_size = 0;
5369         void *addr_buf;
5370         struct sockaddr *addr;
5371         struct socket *sock;
5372
5373         if (!selinux_policycap_extsockclass())
5374                 return 0;
5375
5376         /* Process one or more addresses that may be IPv4 or IPv6 */
5377         sock = sk->sk_socket;
5378         addr_buf = address;
5379
5380         while (walk_size < addrlen) {
5381                 if (walk_size + sizeof(sa_family_t) > addrlen)
5382                         return -EINVAL;
5383
5384                 addr = addr_buf;
5385                 switch (addr->sa_family) {
5386                 case AF_UNSPEC:
5387                 case AF_INET:
5388                         len = sizeof(struct sockaddr_in);
5389                         break;
5390                 case AF_INET6:
5391                         len = sizeof(struct sockaddr_in6);
5392                         break;
5393                 default:
5394                         return -EINVAL;
5395                 }
5396
5397                 if (walk_size + len > addrlen)
5398                         return -EINVAL;
5399
5400                 err = -EINVAL;
5401                 switch (optname) {
5402                 /* Bind checks */
5403                 case SCTP_PRIMARY_ADDR:
5404                 case SCTP_SET_PEER_PRIMARY_ADDR:
5405                 case SCTP_SOCKOPT_BINDX_ADD:
5406                         err = selinux_socket_bind(sock, addr, len);
5407                         break;
5408                 /* Connect checks */
5409                 case SCTP_SOCKOPT_CONNECTX:
5410                 case SCTP_PARAM_SET_PRIMARY:
5411                 case SCTP_PARAM_ADD_IP:
5412                 case SCTP_SENDMSG_CONNECT:
5413                         err = selinux_socket_connect_helper(sock, addr, len);
5414                         if (err)
5415                                 return err;
5416
5417                         /* As selinux_sctp_bind_connect() is called by the
5418                          * SCTP protocol layer, the socket is already locked,
5419                          * therefore selinux_netlbl_socket_connect_locked()
5420                          * is called here. The situations handled are:
5421                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5422                          * whenever a new IP address is added or when a new
5423                          * primary address is selected.
5424                          * Note that an SCTP connect(2) call happens before
5425                          * the SCTP protocol layer and is handled via
5426                          * selinux_socket_connect().
5427                          */
5428                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5429                         break;
5430                 }
5431
5432                 if (err)
5433                         return err;
5434
5435                 addr_buf += len;
5436                 walk_size += len;
5437         }
5438
5439         return 0;
5440 }
5441
5442 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5443 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5444                                   struct sock *newsk)
5445 {
5446         struct sk_security_struct *sksec = sk->sk_security;
5447         struct sk_security_struct *newsksec = newsk->sk_security;
5448
5449         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5450          * the non-sctp clone version.
5451          */
5452         if (!selinux_policycap_extsockclass())
5453                 return selinux_sk_clone_security(sk, newsk);
5454
5455         newsksec->sid = asoc->secid;
5456         newsksec->peer_sid = asoc->peer_secid;
5457         newsksec->sclass = sksec->sclass;
5458         selinux_netlbl_sctp_sk_clone(sk, newsk);
5459 }
5460
5461 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5462                                      struct request_sock *req)
5463 {
5464         struct sk_security_struct *sksec = sk->sk_security;
5465         int err;
5466         u16 family = req->rsk_ops->family;
5467         u32 connsid;
5468         u32 peersid;
5469
5470         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5471         if (err)
5472                 return err;
5473         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5474         if (err)
5475                 return err;
5476         req->secid = connsid;
5477         req->peer_secid = peersid;
5478
5479         return selinux_netlbl_inet_conn_request(req, family);
5480 }
5481
5482 static void selinux_inet_csk_clone(struct sock *newsk,
5483                                    const struct request_sock *req)
5484 {
5485         struct sk_security_struct *newsksec = newsk->sk_security;
5486
5487         newsksec->sid = req->secid;
5488         newsksec->peer_sid = req->peer_secid;
5489         /* NOTE: Ideally, we should also get the isec->sid for the
5490            new socket in sync, but we don't have the isec available yet.
5491            So we will wait until sock_graft to do it, by which
5492            time it will have been created and available. */
5493
5494         /* We don't need to take any sort of lock here as we are the only
5495          * thread with access to newsksec */
5496         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5497 }
5498
5499 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5500 {
5501         u16 family = sk->sk_family;
5502         struct sk_security_struct *sksec = sk->sk_security;
5503
5504         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5505         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5506                 family = PF_INET;
5507
5508         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5509 }
5510
5511 static int selinux_secmark_relabel_packet(u32 sid)
5512 {
5513         const struct task_security_struct *__tsec;
5514         u32 tsid;
5515
5516         __tsec = selinux_cred(current_cred());
5517         tsid = __tsec->sid;
5518
5519         return avc_has_perm(&selinux_state,
5520                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5521                             NULL);
5522 }
5523
5524 static void selinux_secmark_refcount_inc(void)
5525 {
5526         atomic_inc(&selinux_secmark_refcount);
5527 }
5528
5529 static void selinux_secmark_refcount_dec(void)
5530 {
5531         atomic_dec(&selinux_secmark_refcount);
5532 }
5533
5534 static void selinux_req_classify_flow(const struct request_sock *req,
5535                                       struct flowi_common *flic)
5536 {
5537         flic->flowic_secid = req->secid;
5538 }
5539
5540 static int selinux_tun_dev_alloc_security(void **security)
5541 {
5542         struct tun_security_struct *tunsec;
5543
5544         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5545         if (!tunsec)
5546                 return -ENOMEM;
5547         tunsec->sid = current_sid();
5548
5549         *security = tunsec;
5550         return 0;
5551 }
5552
5553 static void selinux_tun_dev_free_security(void *security)
5554 {
5555         kfree(security);
5556 }
5557
5558 static int selinux_tun_dev_create(void)
5559 {
5560         u32 sid = current_sid();
5561
5562         /* we aren't taking into account the "sockcreate" SID since the socket
5563          * that is being created here is not a socket in the traditional sense,
5564          * instead it is a private sock, accessible only to the kernel, and
5565          * representing a wide range of network traffic spanning multiple
5566          * connections unlike traditional sockets - check the TUN driver to
5567          * get a better understanding of why this socket is special */
5568
5569         return avc_has_perm(&selinux_state,
5570                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5571                             NULL);
5572 }
5573
5574 static int selinux_tun_dev_attach_queue(void *security)
5575 {
5576         struct tun_security_struct *tunsec = security;
5577
5578         return avc_has_perm(&selinux_state,
5579                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5580                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5581 }
5582
5583 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5584 {
5585         struct tun_security_struct *tunsec = security;
5586         struct sk_security_struct *sksec = sk->sk_security;
5587
5588         /* we don't currently perform any NetLabel based labeling here and it
5589          * isn't clear that we would want to do so anyway; while we could apply
5590          * labeling without the support of the TUN user the resulting labeled
5591          * traffic from the other end of the connection would almost certainly
5592          * cause confusion to the TUN user that had no idea network labeling
5593          * protocols were being used */
5594
5595         sksec->sid = tunsec->sid;
5596         sksec->sclass = SECCLASS_TUN_SOCKET;
5597
5598         return 0;
5599 }
5600
5601 static int selinux_tun_dev_open(void *security)
5602 {
5603         struct tun_security_struct *tunsec = security;
5604         u32 sid = current_sid();
5605         int err;
5606
5607         err = avc_has_perm(&selinux_state,
5608                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5609                            TUN_SOCKET__RELABELFROM, NULL);
5610         if (err)
5611                 return err;
5612         err = avc_has_perm(&selinux_state,
5613                            sid, sid, SECCLASS_TUN_SOCKET,
5614                            TUN_SOCKET__RELABELTO, NULL);
5615         if (err)
5616                 return err;
5617         tunsec->sid = sid;
5618
5619         return 0;
5620 }
5621
5622 #ifdef CONFIG_NETFILTER
5623
5624 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5625                                        const struct nf_hook_state *state)
5626 {
5627         int ifindex;
5628         u16 family;
5629         char *addrp;
5630         u32 peer_sid;
5631         struct common_audit_data ad;
5632         struct lsm_network_audit net = {0,};
5633         int secmark_active, peerlbl_active;
5634
5635         if (!selinux_policycap_netpeer())
5636                 return NF_ACCEPT;
5637
5638         secmark_active = selinux_secmark_enabled();
5639         peerlbl_active = selinux_peerlbl_enabled();
5640         if (!secmark_active && !peerlbl_active)
5641                 return NF_ACCEPT;
5642
5643         family = state->pf;
5644         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5645                 return NF_DROP;
5646
5647         ifindex = state->in->ifindex;
5648         ad.type = LSM_AUDIT_DATA_NET;
5649         ad.u.net = &net;
5650         ad.u.net->netif = ifindex;
5651         ad.u.net->family = family;
5652         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5653                 return NF_DROP;
5654
5655         if (peerlbl_active) {
5656                 int err;
5657
5658                 err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5659                                                addrp, family, peer_sid, &ad);
5660                 if (err) {
5661                         selinux_netlbl_err(skb, family, err, 1);
5662                         return NF_DROP;
5663                 }
5664         }
5665
5666         if (secmark_active)
5667                 if (avc_has_perm(&selinux_state,
5668                                  peer_sid, skb->secmark,
5669                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5670                         return NF_DROP;
5671
5672         if (netlbl_enabled())
5673                 /* we do this in the FORWARD path and not the POST_ROUTING
5674                  * path because we want to make sure we apply the necessary
5675                  * labeling before IPsec is applied so we can leverage AH
5676                  * protection */
5677                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5678                         return NF_DROP;
5679
5680         return NF_ACCEPT;
5681 }
5682
5683 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5684                                       const struct nf_hook_state *state)
5685 {
5686         struct sock *sk;
5687         u32 sid;
5688
5689         if (!netlbl_enabled())
5690                 return NF_ACCEPT;
5691
5692         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5693          * because we want to make sure we apply the necessary labeling
5694          * before IPsec is applied so we can leverage AH protection */
5695         sk = skb->sk;
5696         if (sk) {
5697                 struct sk_security_struct *sksec;
5698
5699                 if (sk_listener(sk))
5700                         /* if the socket is the listening state then this
5701                          * packet is a SYN-ACK packet which means it needs to
5702                          * be labeled based on the connection/request_sock and
5703                          * not the parent socket.  unfortunately, we can't
5704                          * lookup the request_sock yet as it isn't queued on
5705                          * the parent socket until after the SYN-ACK is sent.
5706                          * the "solution" is to simply pass the packet as-is
5707                          * as any IP option based labeling should be copied
5708                          * from the initial connection request (in the IP
5709                          * layer).  it is far from ideal, but until we get a
5710                          * security label in the packet itself this is the
5711                          * best we can do. */
5712                         return NF_ACCEPT;
5713
5714                 /* standard practice, label using the parent socket */
5715                 sksec = sk->sk_security;
5716                 sid = sksec->sid;
5717         } else
5718                 sid = SECINITSID_KERNEL;
5719         if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5720                 return NF_DROP;
5721
5722         return NF_ACCEPT;
5723 }
5724
5725
5726 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5727                                         const struct nf_hook_state *state)
5728 {
5729         struct sock *sk;
5730         struct sk_security_struct *sksec;
5731         struct common_audit_data ad;
5732         struct lsm_network_audit net = {0,};
5733         u8 proto = 0;
5734
5735         sk = skb_to_full_sk(skb);
5736         if (sk == NULL)
5737                 return NF_ACCEPT;
5738         sksec = sk->sk_security;
5739
5740         ad.type = LSM_AUDIT_DATA_NET;
5741         ad.u.net = &net;
5742         ad.u.net->netif = state->out->ifindex;
5743         ad.u.net->family = state->pf;
5744         if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
5745                 return NF_DROP;
5746
5747         if (selinux_secmark_enabled())
5748                 if (avc_has_perm(&selinux_state,
5749                                  sksec->sid, skb->secmark,
5750                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5751                         return NF_DROP_ERR(-ECONNREFUSED);
5752
5753         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5754                 return NF_DROP_ERR(-ECONNREFUSED);
5755
5756         return NF_ACCEPT;
5757 }
5758
5759 static unsigned int selinux_ip_postroute(void *priv,
5760                                          struct sk_buff *skb,
5761                                          const struct nf_hook_state *state)
5762 {
5763         u16 family;
5764         u32 secmark_perm;
5765         u32 peer_sid;
5766         int ifindex;
5767         struct sock *sk;
5768         struct common_audit_data ad;
5769         struct lsm_network_audit net = {0,};
5770         char *addrp;
5771         int secmark_active, peerlbl_active;
5772
5773         /* If any sort of compatibility mode is enabled then handoff processing
5774          * to the selinux_ip_postroute_compat() function to deal with the
5775          * special handling.  We do this in an attempt to keep this function
5776          * as fast and as clean as possible. */
5777         if (!selinux_policycap_netpeer())
5778                 return selinux_ip_postroute_compat(skb, state);
5779
5780         secmark_active = selinux_secmark_enabled();
5781         peerlbl_active = selinux_peerlbl_enabled();
5782         if (!secmark_active && !peerlbl_active)
5783                 return NF_ACCEPT;
5784
5785         sk = skb_to_full_sk(skb);
5786
5787 #ifdef CONFIG_XFRM
5788         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5789          * packet transformation so allow the packet to pass without any checks
5790          * since we'll have another chance to perform access control checks
5791          * when the packet is on it's final way out.
5792          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5793          *       is NULL, in this case go ahead and apply access control.
5794          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5795          *       TCP listening state we cannot wait until the XFRM processing
5796          *       is done as we will miss out on the SA label if we do;
5797          *       unfortunately, this means more work, but it is only once per
5798          *       connection. */
5799         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5800             !(sk && sk_listener(sk)))
5801                 return NF_ACCEPT;
5802 #endif
5803
5804         family = state->pf;
5805         if (sk == NULL) {
5806                 /* Without an associated socket the packet is either coming
5807                  * from the kernel or it is being forwarded; check the packet
5808                  * to determine which and if the packet is being forwarded
5809                  * query the packet directly to determine the security label. */
5810                 if (skb->skb_iif) {
5811                         secmark_perm = PACKET__FORWARD_OUT;
5812                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5813                                 return NF_DROP;
5814                 } else {
5815                         secmark_perm = PACKET__SEND;
5816                         peer_sid = SECINITSID_KERNEL;
5817                 }
5818         } else if (sk_listener(sk)) {
5819                 /* Locally generated packet but the associated socket is in the
5820                  * listening state which means this is a SYN-ACK packet.  In
5821                  * this particular case the correct security label is assigned
5822                  * to the connection/request_sock but unfortunately we can't
5823                  * query the request_sock as it isn't queued on the parent
5824                  * socket until after the SYN-ACK packet is sent; the only
5825                  * viable choice is to regenerate the label like we do in
5826                  * selinux_inet_conn_request().  See also selinux_ip_output()
5827                  * for similar problems. */
5828                 u32 skb_sid;
5829                 struct sk_security_struct *sksec;
5830
5831                 sksec = sk->sk_security;
5832                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5833                         return NF_DROP;
5834                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5835                  * and the packet has been through at least one XFRM
5836                  * transformation then we must be dealing with the "final"
5837                  * form of labeled IPsec packet; since we've already applied
5838                  * all of our access controls on this packet we can safely
5839                  * pass the packet. */
5840                 if (skb_sid == SECSID_NULL) {
5841                         switch (family) {
5842                         case PF_INET:
5843                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5844                                         return NF_ACCEPT;
5845                                 break;
5846                         case PF_INET6:
5847                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5848                                         return NF_ACCEPT;
5849                                 break;
5850                         default:
5851                                 return NF_DROP_ERR(-ECONNREFUSED);
5852                         }
5853                 }
5854                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5855                         return NF_DROP;
5856                 secmark_perm = PACKET__SEND;
5857         } else {
5858                 /* Locally generated packet, fetch the security label from the
5859                  * associated socket. */
5860                 struct sk_security_struct *sksec = sk->sk_security;
5861                 peer_sid = sksec->sid;
5862                 secmark_perm = PACKET__SEND;
5863         }
5864
5865         ifindex = state->out->ifindex;
5866         ad.type = LSM_AUDIT_DATA_NET;
5867         ad.u.net = &net;
5868         ad.u.net->netif = ifindex;
5869         ad.u.net->family = family;
5870         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5871                 return NF_DROP;
5872
5873         if (secmark_active)
5874                 if (avc_has_perm(&selinux_state,
5875                                  peer_sid, skb->secmark,
5876                                  SECCLASS_PACKET, secmark_perm, &ad))
5877                         return NF_DROP_ERR(-ECONNREFUSED);
5878
5879         if (peerlbl_active) {
5880                 u32 if_sid;
5881                 u32 node_sid;
5882
5883                 if (sel_netif_sid(state->net, ifindex, &if_sid))
5884                         return NF_DROP;
5885                 if (avc_has_perm(&selinux_state,
5886                                  peer_sid, if_sid,
5887                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5888                         return NF_DROP_ERR(-ECONNREFUSED);
5889
5890                 if (sel_netnode_sid(addrp, family, &node_sid))
5891                         return NF_DROP;
5892                 if (avc_has_perm(&selinux_state,
5893                                  peer_sid, node_sid,
5894                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5895                         return NF_DROP_ERR(-ECONNREFUSED);
5896         }
5897
5898         return NF_ACCEPT;
5899 }
5900 #endif  /* CONFIG_NETFILTER */
5901
5902 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5903 {
5904         int rc = 0;
5905         unsigned int msg_len;
5906         unsigned int data_len = skb->len;
5907         unsigned char *data = skb->data;
5908         struct nlmsghdr *nlh;
5909         struct sk_security_struct *sksec = sk->sk_security;
5910         u16 sclass = sksec->sclass;
5911         u32 perm;
5912
5913         while (data_len >= nlmsg_total_size(0)) {
5914                 nlh = (struct nlmsghdr *)data;
5915
5916                 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5917                  *       users which means we can't reject skb's with bogus
5918                  *       length fields; our solution is to follow what
5919                  *       netlink_rcv_skb() does and simply skip processing at
5920                  *       messages with length fields that are clearly junk
5921                  */
5922                 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5923                         return 0;
5924
5925                 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5926                 if (rc == 0) {
5927                         rc = sock_has_perm(sk, perm);
5928                         if (rc)
5929                                 return rc;
5930                 } else if (rc == -EINVAL) {
5931                         /* -EINVAL is a missing msg/perm mapping */
5932                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5933                                 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5934                                 " pid=%d comm=%s\n",
5935                                 sk->sk_protocol, nlh->nlmsg_type,
5936                                 secclass_map[sclass - 1].name,
5937                                 task_pid_nr(current), current->comm);
5938                         if (enforcing_enabled(&selinux_state) &&
5939                             !security_get_allow_unknown(&selinux_state))
5940                                 return rc;
5941                         rc = 0;
5942                 } else if (rc == -ENOENT) {
5943                         /* -ENOENT is a missing socket/class mapping, ignore */
5944                         rc = 0;
5945                 } else {
5946                         return rc;
5947                 }
5948
5949                 /* move to the next message after applying netlink padding */
5950                 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5951                 if (msg_len >= data_len)
5952                         return 0;
5953                 data_len -= msg_len;
5954                 data += msg_len;
5955         }
5956
5957         return rc;
5958 }
5959
5960 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5961 {
5962         isec->sclass = sclass;
5963         isec->sid = current_sid();
5964 }
5965
5966 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5967                         u32 perms)
5968 {
5969         struct ipc_security_struct *isec;
5970         struct common_audit_data ad;
5971         u32 sid = current_sid();
5972
5973         isec = selinux_ipc(ipc_perms);
5974
5975         ad.type = LSM_AUDIT_DATA_IPC;
5976         ad.u.ipc_id = ipc_perms->key;
5977
5978         return avc_has_perm(&selinux_state,
5979                             sid, isec->sid, isec->sclass, perms, &ad);
5980 }
5981
5982 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5983 {
5984         struct msg_security_struct *msec;
5985
5986         msec = selinux_msg_msg(msg);
5987         msec->sid = SECINITSID_UNLABELED;
5988
5989         return 0;
5990 }
5991
5992 /* message queue security operations */
5993 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5994 {
5995         struct ipc_security_struct *isec;
5996         struct common_audit_data ad;
5997         u32 sid = current_sid();
5998
5999         isec = selinux_ipc(msq);
6000         ipc_init_security(isec, SECCLASS_MSGQ);
6001
6002         ad.type = LSM_AUDIT_DATA_IPC;
6003         ad.u.ipc_id = msq->key;
6004
6005         return avc_has_perm(&selinux_state,
6006                             sid, isec->sid, SECCLASS_MSGQ,
6007                             MSGQ__CREATE, &ad);
6008 }
6009
6010 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6011 {
6012         struct ipc_security_struct *isec;
6013         struct common_audit_data ad;
6014         u32 sid = current_sid();
6015
6016         isec = selinux_ipc(msq);
6017
6018         ad.type = LSM_AUDIT_DATA_IPC;
6019         ad.u.ipc_id = msq->key;
6020
6021         return avc_has_perm(&selinux_state,
6022                             sid, isec->sid, SECCLASS_MSGQ,
6023                             MSGQ__ASSOCIATE, &ad);
6024 }
6025
6026 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6027 {
6028         int err;
6029         int perms;
6030
6031         switch (cmd) {
6032         case IPC_INFO:
6033         case MSG_INFO:
6034                 /* No specific object, just general system-wide information. */
6035                 return avc_has_perm(&selinux_state,
6036                                     current_sid(), SECINITSID_KERNEL,
6037                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6038         case IPC_STAT:
6039         case MSG_STAT:
6040         case MSG_STAT_ANY:
6041                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6042                 break;
6043         case IPC_SET:
6044                 perms = MSGQ__SETATTR;
6045                 break;
6046         case IPC_RMID:
6047                 perms = MSGQ__DESTROY;
6048                 break;
6049         default:
6050                 return 0;
6051         }
6052
6053         err = ipc_has_perm(msq, perms);
6054         return err;
6055 }
6056
6057 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6058 {
6059         struct ipc_security_struct *isec;
6060         struct msg_security_struct *msec;
6061         struct common_audit_data ad;
6062         u32 sid = current_sid();
6063         int rc;
6064
6065         isec = selinux_ipc(msq);
6066         msec = selinux_msg_msg(msg);
6067
6068         /*
6069          * First time through, need to assign label to the message
6070          */
6071         if (msec->sid == SECINITSID_UNLABELED) {
6072                 /*
6073                  * Compute new sid based on current process and
6074                  * message queue this message will be stored in
6075                  */
6076                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6077                                              SECCLASS_MSG, NULL, &msec->sid);
6078                 if (rc)
6079                         return rc;
6080         }
6081
6082         ad.type = LSM_AUDIT_DATA_IPC;
6083         ad.u.ipc_id = msq->key;
6084
6085         /* Can this process write to the queue? */
6086         rc = avc_has_perm(&selinux_state,
6087                           sid, isec->sid, SECCLASS_MSGQ,
6088                           MSGQ__WRITE, &ad);
6089         if (!rc)
6090                 /* Can this process send the message */
6091                 rc = avc_has_perm(&selinux_state,
6092                                   sid, msec->sid, SECCLASS_MSG,
6093                                   MSG__SEND, &ad);
6094         if (!rc)
6095                 /* Can the message be put in the queue? */
6096                 rc = avc_has_perm(&selinux_state,
6097                                   msec->sid, isec->sid, SECCLASS_MSGQ,
6098                                   MSGQ__ENQUEUE, &ad);
6099
6100         return rc;
6101 }
6102
6103 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6104                                     struct task_struct *target,
6105                                     long type, int mode)
6106 {
6107         struct ipc_security_struct *isec;
6108         struct msg_security_struct *msec;
6109         struct common_audit_data ad;
6110         u32 sid = task_sid_obj(target);
6111         int rc;
6112
6113         isec = selinux_ipc(msq);
6114         msec = selinux_msg_msg(msg);
6115
6116         ad.type = LSM_AUDIT_DATA_IPC;
6117         ad.u.ipc_id = msq->key;
6118
6119         rc = avc_has_perm(&selinux_state,
6120                           sid, isec->sid,
6121                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6122         if (!rc)
6123                 rc = avc_has_perm(&selinux_state,
6124                                   sid, msec->sid,
6125                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6126         return rc;
6127 }
6128
6129 /* Shared Memory security operations */
6130 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6131 {
6132         struct ipc_security_struct *isec;
6133         struct common_audit_data ad;
6134         u32 sid = current_sid();
6135
6136         isec = selinux_ipc(shp);
6137         ipc_init_security(isec, SECCLASS_SHM);
6138
6139         ad.type = LSM_AUDIT_DATA_IPC;
6140         ad.u.ipc_id = shp->key;
6141
6142         return avc_has_perm(&selinux_state,
6143                             sid, isec->sid, SECCLASS_SHM,
6144                             SHM__CREATE, &ad);
6145 }
6146
6147 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6148 {
6149         struct ipc_security_struct *isec;
6150         struct common_audit_data ad;
6151         u32 sid = current_sid();
6152
6153         isec = selinux_ipc(shp);
6154
6155         ad.type = LSM_AUDIT_DATA_IPC;
6156         ad.u.ipc_id = shp->key;
6157
6158         return avc_has_perm(&selinux_state,
6159                             sid, isec->sid, SECCLASS_SHM,
6160                             SHM__ASSOCIATE, &ad);
6161 }
6162
6163 /* Note, at this point, shp is locked down */
6164 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6165 {
6166         int perms;
6167         int err;
6168
6169         switch (cmd) {
6170         case IPC_INFO:
6171         case SHM_INFO:
6172                 /* No specific object, just general system-wide information. */
6173                 return avc_has_perm(&selinux_state,
6174                                     current_sid(), SECINITSID_KERNEL,
6175                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6176         case IPC_STAT:
6177         case SHM_STAT:
6178         case SHM_STAT_ANY:
6179                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6180                 break;
6181         case IPC_SET:
6182                 perms = SHM__SETATTR;
6183                 break;
6184         case SHM_LOCK:
6185         case SHM_UNLOCK:
6186                 perms = SHM__LOCK;
6187                 break;
6188         case IPC_RMID:
6189                 perms = SHM__DESTROY;
6190                 break;
6191         default:
6192                 return 0;
6193         }
6194
6195         err = ipc_has_perm(shp, perms);
6196         return err;
6197 }
6198
6199 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6200                              char __user *shmaddr, int shmflg)
6201 {
6202         u32 perms;
6203
6204         if (shmflg & SHM_RDONLY)
6205                 perms = SHM__READ;
6206         else
6207                 perms = SHM__READ | SHM__WRITE;
6208
6209         return ipc_has_perm(shp, perms);
6210 }
6211
6212 /* Semaphore security operations */
6213 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6214 {
6215         struct ipc_security_struct *isec;
6216         struct common_audit_data ad;
6217         u32 sid = current_sid();
6218
6219         isec = selinux_ipc(sma);
6220         ipc_init_security(isec, SECCLASS_SEM);
6221
6222         ad.type = LSM_AUDIT_DATA_IPC;
6223         ad.u.ipc_id = sma->key;
6224
6225         return avc_has_perm(&selinux_state,
6226                             sid, isec->sid, SECCLASS_SEM,
6227                             SEM__CREATE, &ad);
6228 }
6229
6230 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6231 {
6232         struct ipc_security_struct *isec;
6233         struct common_audit_data ad;
6234         u32 sid = current_sid();
6235
6236         isec = selinux_ipc(sma);
6237
6238         ad.type = LSM_AUDIT_DATA_IPC;
6239         ad.u.ipc_id = sma->key;
6240
6241         return avc_has_perm(&selinux_state,
6242                             sid, isec->sid, SECCLASS_SEM,
6243                             SEM__ASSOCIATE, &ad);
6244 }
6245
6246 /* Note, at this point, sma is locked down */
6247 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6248 {
6249         int err;
6250         u32 perms;
6251
6252         switch (cmd) {
6253         case IPC_INFO:
6254         case SEM_INFO:
6255                 /* No specific object, just general system-wide information. */
6256                 return avc_has_perm(&selinux_state,
6257                                     current_sid(), SECINITSID_KERNEL,
6258                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6259         case GETPID:
6260         case GETNCNT:
6261         case GETZCNT:
6262                 perms = SEM__GETATTR;
6263                 break;
6264         case GETVAL:
6265         case GETALL:
6266                 perms = SEM__READ;
6267                 break;
6268         case SETVAL:
6269         case SETALL:
6270                 perms = SEM__WRITE;
6271                 break;
6272         case IPC_RMID:
6273                 perms = SEM__DESTROY;
6274                 break;
6275         case IPC_SET:
6276                 perms = SEM__SETATTR;
6277                 break;
6278         case IPC_STAT:
6279         case SEM_STAT:
6280         case SEM_STAT_ANY:
6281                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6282                 break;
6283         default:
6284                 return 0;
6285         }
6286
6287         err = ipc_has_perm(sma, perms);
6288         return err;
6289 }
6290
6291 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6292                              struct sembuf *sops, unsigned nsops, int alter)
6293 {
6294         u32 perms;
6295
6296         if (alter)
6297                 perms = SEM__READ | SEM__WRITE;
6298         else
6299                 perms = SEM__READ;
6300
6301         return ipc_has_perm(sma, perms);
6302 }
6303
6304 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6305 {
6306         u32 av = 0;
6307
6308         av = 0;
6309         if (flag & S_IRUGO)
6310                 av |= IPC__UNIX_READ;
6311         if (flag & S_IWUGO)
6312                 av |= IPC__UNIX_WRITE;
6313
6314         if (av == 0)
6315                 return 0;
6316
6317         return ipc_has_perm(ipcp, av);
6318 }
6319
6320 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6321 {
6322         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6323         *secid = isec->sid;
6324 }
6325
6326 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6327 {
6328         if (inode)
6329                 inode_doinit_with_dentry(inode, dentry);
6330 }
6331
6332 static int selinux_getprocattr(struct task_struct *p,
6333                                char *name, char **value)
6334 {
6335         const struct task_security_struct *__tsec;
6336         u32 sid;
6337         int error;
6338         unsigned len;
6339
6340         rcu_read_lock();
6341         __tsec = selinux_cred(__task_cred(p));
6342
6343         if (current != p) {
6344                 error = avc_has_perm(&selinux_state,
6345                                      current_sid(), __tsec->sid,
6346                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6347                 if (error)
6348                         goto bad;
6349         }
6350
6351         if (!strcmp(name, "current"))
6352                 sid = __tsec->sid;
6353         else if (!strcmp(name, "prev"))
6354                 sid = __tsec->osid;
6355         else if (!strcmp(name, "exec"))
6356                 sid = __tsec->exec_sid;
6357         else if (!strcmp(name, "fscreate"))
6358                 sid = __tsec->create_sid;
6359         else if (!strcmp(name, "keycreate"))
6360                 sid = __tsec->keycreate_sid;
6361         else if (!strcmp(name, "sockcreate"))
6362                 sid = __tsec->sockcreate_sid;
6363         else {
6364                 error = -EINVAL;
6365                 goto bad;
6366         }
6367         rcu_read_unlock();
6368
6369         if (!sid)
6370                 return 0;
6371
6372         error = security_sid_to_context(&selinux_state, sid, value, &len);
6373         if (error)
6374                 return error;
6375         return len;
6376
6377 bad:
6378         rcu_read_unlock();
6379         return error;
6380 }
6381
6382 static int selinux_setprocattr(const char *name, void *value, size_t size)
6383 {
6384         struct task_security_struct *tsec;
6385         struct cred *new;
6386         u32 mysid = current_sid(), sid = 0, ptsid;
6387         int error;
6388         char *str = value;
6389
6390         /*
6391          * Basic control over ability to set these attributes at all.
6392          */
6393         if (!strcmp(name, "exec"))
6394                 error = avc_has_perm(&selinux_state,
6395                                      mysid, mysid, SECCLASS_PROCESS,
6396                                      PROCESS__SETEXEC, NULL);
6397         else if (!strcmp(name, "fscreate"))
6398                 error = avc_has_perm(&selinux_state,
6399                                      mysid, mysid, SECCLASS_PROCESS,
6400                                      PROCESS__SETFSCREATE, NULL);
6401         else if (!strcmp(name, "keycreate"))
6402                 error = avc_has_perm(&selinux_state,
6403                                      mysid, mysid, SECCLASS_PROCESS,
6404                                      PROCESS__SETKEYCREATE, NULL);
6405         else if (!strcmp(name, "sockcreate"))
6406                 error = avc_has_perm(&selinux_state,
6407                                      mysid, mysid, SECCLASS_PROCESS,
6408                                      PROCESS__SETSOCKCREATE, NULL);
6409         else if (!strcmp(name, "current"))
6410                 error = avc_has_perm(&selinux_state,
6411                                      mysid, mysid, SECCLASS_PROCESS,
6412                                      PROCESS__SETCURRENT, NULL);
6413         else
6414                 error = -EINVAL;
6415         if (error)
6416                 return error;
6417
6418         /* Obtain a SID for the context, if one was specified. */
6419         if (size && str[0] && str[0] != '\n') {
6420                 if (str[size-1] == '\n') {
6421                         str[size-1] = 0;
6422                         size--;
6423                 }
6424                 error = security_context_to_sid(&selinux_state, value, size,
6425                                                 &sid, GFP_KERNEL);
6426                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6427                         if (!has_cap_mac_admin(true)) {
6428                                 struct audit_buffer *ab;
6429                                 size_t audit_size;
6430
6431                                 /* We strip a nul only if it is at the end, otherwise the
6432                                  * context contains a nul and we should audit that */
6433                                 if (str[size - 1] == '\0')
6434                                         audit_size = size - 1;
6435                                 else
6436                                         audit_size = size;
6437                                 ab = audit_log_start(audit_context(),
6438                                                      GFP_ATOMIC,
6439                                                      AUDIT_SELINUX_ERR);
6440                                 if (!ab)
6441                                         return error;
6442                                 audit_log_format(ab, "op=fscreate invalid_context=");
6443                                 audit_log_n_untrustedstring(ab, value, audit_size);
6444                                 audit_log_end(ab);
6445
6446                                 return error;
6447                         }
6448                         error = security_context_to_sid_force(
6449                                                       &selinux_state,
6450                                                       value, size, &sid);
6451                 }
6452                 if (error)
6453                         return error;
6454         }
6455
6456         new = prepare_creds();
6457         if (!new)
6458                 return -ENOMEM;
6459
6460         /* Permission checking based on the specified context is
6461            performed during the actual operation (execve,
6462            open/mkdir/...), when we know the full context of the
6463            operation.  See selinux_bprm_creds_for_exec for the execve
6464            checks and may_create for the file creation checks. The
6465            operation will then fail if the context is not permitted. */
6466         tsec = selinux_cred(new);
6467         if (!strcmp(name, "exec")) {
6468                 tsec->exec_sid = sid;
6469         } else if (!strcmp(name, "fscreate")) {
6470                 tsec->create_sid = sid;
6471         } else if (!strcmp(name, "keycreate")) {
6472                 if (sid) {
6473                         error = avc_has_perm(&selinux_state, mysid, sid,
6474                                              SECCLASS_KEY, KEY__CREATE, NULL);
6475                         if (error)
6476                                 goto abort_change;
6477                 }
6478                 tsec->keycreate_sid = sid;
6479         } else if (!strcmp(name, "sockcreate")) {
6480                 tsec->sockcreate_sid = sid;
6481         } else if (!strcmp(name, "current")) {
6482                 error = -EINVAL;
6483                 if (sid == 0)
6484                         goto abort_change;
6485
6486                 /* Only allow single threaded processes to change context */
6487                 if (!current_is_single_threaded()) {
6488                         error = security_bounded_transition(&selinux_state,
6489                                                             tsec->sid, sid);
6490                         if (error)
6491                                 goto abort_change;
6492                 }
6493
6494                 /* Check permissions for the transition. */
6495                 error = avc_has_perm(&selinux_state,
6496                                      tsec->sid, sid, SECCLASS_PROCESS,
6497                                      PROCESS__DYNTRANSITION, NULL);
6498                 if (error)
6499                         goto abort_change;
6500
6501                 /* Check for ptracing, and update the task SID if ok.
6502                    Otherwise, leave SID unchanged and fail. */
6503                 ptsid = ptrace_parent_sid();
6504                 if (ptsid != 0) {
6505                         error = avc_has_perm(&selinux_state,
6506                                              ptsid, sid, SECCLASS_PROCESS,
6507                                              PROCESS__PTRACE, NULL);
6508                         if (error)
6509                                 goto abort_change;
6510                 }
6511
6512                 tsec->sid = sid;
6513         } else {
6514                 error = -EINVAL;
6515                 goto abort_change;
6516         }
6517
6518         commit_creds(new);
6519         return size;
6520
6521 abort_change:
6522         abort_creds(new);
6523         return error;
6524 }
6525
6526 static int selinux_ismaclabel(const char *name)
6527 {
6528         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6529 }
6530
6531 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6532 {
6533         return security_sid_to_context(&selinux_state, secid,
6534                                        secdata, seclen);
6535 }
6536
6537 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6538 {
6539         return security_context_to_sid(&selinux_state, secdata, seclen,
6540                                        secid, GFP_KERNEL);
6541 }
6542
6543 static void selinux_release_secctx(char *secdata, u32 seclen)
6544 {
6545         kfree(secdata);
6546 }
6547
6548 static void selinux_inode_invalidate_secctx(struct inode *inode)
6549 {
6550         struct inode_security_struct *isec = selinux_inode(inode);
6551
6552         spin_lock(&isec->lock);
6553         isec->initialized = LABEL_INVALID;
6554         spin_unlock(&isec->lock);
6555 }
6556
6557 /*
6558  *      called with inode->i_mutex locked
6559  */
6560 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6561 {
6562         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6563                                            ctx, ctxlen, 0);
6564         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6565         return rc == -EOPNOTSUPP ? 0 : rc;
6566 }
6567
6568 /*
6569  *      called with inode->i_mutex locked
6570  */
6571 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6572 {
6573         return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6574                                      ctx, ctxlen, 0);
6575 }
6576
6577 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6578 {
6579         int len = 0;
6580         len = selinux_inode_getsecurity(&init_user_ns, inode,
6581                                         XATTR_SELINUX_SUFFIX, ctx, true);
6582         if (len < 0)
6583                 return len;
6584         *ctxlen = len;
6585         return 0;
6586 }
6587 #ifdef CONFIG_KEYS
6588
6589 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6590                              unsigned long flags)
6591 {
6592         const struct task_security_struct *tsec;
6593         struct key_security_struct *ksec;
6594
6595         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6596         if (!ksec)
6597                 return -ENOMEM;
6598
6599         tsec = selinux_cred(cred);
6600         if (tsec->keycreate_sid)
6601                 ksec->sid = tsec->keycreate_sid;
6602         else
6603                 ksec->sid = tsec->sid;
6604
6605         k->security = ksec;
6606         return 0;
6607 }
6608
6609 static void selinux_key_free(struct key *k)
6610 {
6611         struct key_security_struct *ksec = k->security;
6612
6613         k->security = NULL;
6614         kfree(ksec);
6615 }
6616
6617 static int selinux_key_permission(key_ref_t key_ref,
6618                                   const struct cred *cred,
6619                                   enum key_need_perm need_perm)
6620 {
6621         struct key *key;
6622         struct key_security_struct *ksec;
6623         u32 perm, sid;
6624
6625         switch (need_perm) {
6626         case KEY_NEED_VIEW:
6627                 perm = KEY__VIEW;
6628                 break;
6629         case KEY_NEED_READ:
6630                 perm = KEY__READ;
6631                 break;
6632         case KEY_NEED_WRITE:
6633                 perm = KEY__WRITE;
6634                 break;
6635         case KEY_NEED_SEARCH:
6636                 perm = KEY__SEARCH;
6637                 break;
6638         case KEY_NEED_LINK:
6639                 perm = KEY__LINK;
6640                 break;
6641         case KEY_NEED_SETATTR:
6642                 perm = KEY__SETATTR;
6643                 break;
6644         case KEY_NEED_UNLINK:
6645         case KEY_SYSADMIN_OVERRIDE:
6646         case KEY_AUTHTOKEN_OVERRIDE:
6647         case KEY_DEFER_PERM_CHECK:
6648                 return 0;
6649         default:
6650                 WARN_ON(1);
6651                 return -EPERM;
6652
6653         }
6654
6655         sid = cred_sid(cred);
6656         key = key_ref_to_ptr(key_ref);
6657         ksec = key->security;
6658
6659         return avc_has_perm(&selinux_state,
6660                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6661 }
6662
6663 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6664 {
6665         struct key_security_struct *ksec = key->security;
6666         char *context = NULL;
6667         unsigned len;
6668         int rc;
6669
6670         rc = security_sid_to_context(&selinux_state, ksec->sid,
6671                                      &context, &len);
6672         if (!rc)
6673                 rc = len;
6674         *_buffer = context;
6675         return rc;
6676 }
6677
6678 #ifdef CONFIG_KEY_NOTIFICATIONS
6679 static int selinux_watch_key(struct key *key)
6680 {
6681         struct key_security_struct *ksec = key->security;
6682         u32 sid = current_sid();
6683
6684         return avc_has_perm(&selinux_state,
6685                             sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6686 }
6687 #endif
6688 #endif
6689
6690 #ifdef CONFIG_SECURITY_INFINIBAND
6691 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6692 {
6693         struct common_audit_data ad;
6694         int err;
6695         u32 sid = 0;
6696         struct ib_security_struct *sec = ib_sec;
6697         struct lsm_ibpkey_audit ibpkey;
6698
6699         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6700         if (err)
6701                 return err;
6702
6703         ad.type = LSM_AUDIT_DATA_IBPKEY;
6704         ibpkey.subnet_prefix = subnet_prefix;
6705         ibpkey.pkey = pkey_val;
6706         ad.u.ibpkey = &ibpkey;
6707         return avc_has_perm(&selinux_state,
6708                             sec->sid, sid,
6709                             SECCLASS_INFINIBAND_PKEY,
6710                             INFINIBAND_PKEY__ACCESS, &ad);
6711 }
6712
6713 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6714                                             u8 port_num)
6715 {
6716         struct common_audit_data ad;
6717         int err;
6718         u32 sid = 0;
6719         struct ib_security_struct *sec = ib_sec;
6720         struct lsm_ibendport_audit ibendport;
6721
6722         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6723                                       &sid);
6724
6725         if (err)
6726                 return err;
6727
6728         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6729         ibendport.dev_name = dev_name;
6730         ibendport.port = port_num;
6731         ad.u.ibendport = &ibendport;
6732         return avc_has_perm(&selinux_state,
6733                             sec->sid, sid,
6734                             SECCLASS_INFINIBAND_ENDPORT,
6735                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6736 }
6737
6738 static int selinux_ib_alloc_security(void **ib_sec)
6739 {
6740         struct ib_security_struct *sec;
6741
6742         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6743         if (!sec)
6744                 return -ENOMEM;
6745         sec->sid = current_sid();
6746
6747         *ib_sec = sec;
6748         return 0;
6749 }
6750
6751 static void selinux_ib_free_security(void *ib_sec)
6752 {
6753         kfree(ib_sec);
6754 }
6755 #endif
6756
6757 #ifdef CONFIG_BPF_SYSCALL
6758 static int selinux_bpf(int cmd, union bpf_attr *attr,
6759                                      unsigned int size)
6760 {
6761         u32 sid = current_sid();
6762         int ret;
6763
6764         switch (cmd) {
6765         case BPF_MAP_CREATE:
6766                 ret = avc_has_perm(&selinux_state,
6767                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6768                                    NULL);
6769                 break;
6770         case BPF_PROG_LOAD:
6771                 ret = avc_has_perm(&selinux_state,
6772                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6773                                    NULL);
6774                 break;
6775         default:
6776                 ret = 0;
6777                 break;
6778         }
6779
6780         return ret;
6781 }
6782
6783 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6784 {
6785         u32 av = 0;
6786
6787         if (fmode & FMODE_READ)
6788                 av |= BPF__MAP_READ;
6789         if (fmode & FMODE_WRITE)
6790                 av |= BPF__MAP_WRITE;
6791         return av;
6792 }
6793
6794 /* This function will check the file pass through unix socket or binder to see
6795  * if it is a bpf related object. And apply corresponding checks on the bpf
6796  * object based on the type. The bpf maps and programs, not like other files and
6797  * socket, are using a shared anonymous inode inside the kernel as their inode.
6798  * So checking that inode cannot identify if the process have privilege to
6799  * access the bpf object and that's why we have to add this additional check in
6800  * selinux_file_receive and selinux_binder_transfer_files.
6801  */
6802 static int bpf_fd_pass(struct file *file, u32 sid)
6803 {
6804         struct bpf_security_struct *bpfsec;
6805         struct bpf_prog *prog;
6806         struct bpf_map *map;
6807         int ret;
6808
6809         if (file->f_op == &bpf_map_fops) {
6810                 map = file->private_data;
6811                 bpfsec = map->security;
6812                 ret = avc_has_perm(&selinux_state,
6813                                    sid, bpfsec->sid, SECCLASS_BPF,
6814                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6815                 if (ret)
6816                         return ret;
6817         } else if (file->f_op == &bpf_prog_fops) {
6818                 prog = file->private_data;
6819                 bpfsec = prog->aux->security;
6820                 ret = avc_has_perm(&selinux_state,
6821                                    sid, bpfsec->sid, SECCLASS_BPF,
6822                                    BPF__PROG_RUN, NULL);
6823                 if (ret)
6824                         return ret;
6825         }
6826         return 0;
6827 }
6828
6829 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6830 {
6831         u32 sid = current_sid();
6832         struct bpf_security_struct *bpfsec;
6833
6834         bpfsec = map->security;
6835         return avc_has_perm(&selinux_state,
6836                             sid, bpfsec->sid, SECCLASS_BPF,
6837                             bpf_map_fmode_to_av(fmode), NULL);
6838 }
6839
6840 static int selinux_bpf_prog(struct bpf_prog *prog)
6841 {
6842         u32 sid = current_sid();
6843         struct bpf_security_struct *bpfsec;
6844
6845         bpfsec = prog->aux->security;
6846         return avc_has_perm(&selinux_state,
6847                             sid, bpfsec->sid, SECCLASS_BPF,
6848                             BPF__PROG_RUN, NULL);
6849 }
6850
6851 static int selinux_bpf_map_alloc(struct bpf_map *map)
6852 {
6853         struct bpf_security_struct *bpfsec;
6854
6855         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6856         if (!bpfsec)
6857                 return -ENOMEM;
6858
6859         bpfsec->sid = current_sid();
6860         map->security = bpfsec;
6861
6862         return 0;
6863 }
6864
6865 static void selinux_bpf_map_free(struct bpf_map *map)
6866 {
6867         struct bpf_security_struct *bpfsec = map->security;
6868
6869         map->security = NULL;
6870         kfree(bpfsec);
6871 }
6872
6873 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6874 {
6875         struct bpf_security_struct *bpfsec;
6876
6877         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6878         if (!bpfsec)
6879                 return -ENOMEM;
6880
6881         bpfsec->sid = current_sid();
6882         aux->security = bpfsec;
6883
6884         return 0;
6885 }
6886
6887 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6888 {
6889         struct bpf_security_struct *bpfsec = aux->security;
6890
6891         aux->security = NULL;
6892         kfree(bpfsec);
6893 }
6894 #endif
6895
6896 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6897         .lbs_cred = sizeof(struct task_security_struct),
6898         .lbs_file = sizeof(struct file_security_struct),
6899         .lbs_inode = sizeof(struct inode_security_struct),
6900         .lbs_ipc = sizeof(struct ipc_security_struct),
6901         .lbs_msg_msg = sizeof(struct msg_security_struct),
6902         .lbs_superblock = sizeof(struct superblock_security_struct),
6903 };
6904
6905 #ifdef CONFIG_PERF_EVENTS
6906 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6907 {
6908         u32 requested, sid = current_sid();
6909
6910         if (type == PERF_SECURITY_OPEN)
6911                 requested = PERF_EVENT__OPEN;
6912         else if (type == PERF_SECURITY_CPU)
6913                 requested = PERF_EVENT__CPU;
6914         else if (type == PERF_SECURITY_KERNEL)
6915                 requested = PERF_EVENT__KERNEL;
6916         else if (type == PERF_SECURITY_TRACEPOINT)
6917                 requested = PERF_EVENT__TRACEPOINT;
6918         else
6919                 return -EINVAL;
6920
6921         return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6922                             requested, NULL);
6923 }
6924
6925 static int selinux_perf_event_alloc(struct perf_event *event)
6926 {
6927         struct perf_event_security_struct *perfsec;
6928
6929         perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6930         if (!perfsec)
6931                 return -ENOMEM;
6932
6933         perfsec->sid = current_sid();
6934         event->security = perfsec;
6935
6936         return 0;
6937 }
6938
6939 static void selinux_perf_event_free(struct perf_event *event)
6940 {
6941         struct perf_event_security_struct *perfsec = event->security;
6942
6943         event->security = NULL;
6944         kfree(perfsec);
6945 }
6946
6947 static int selinux_perf_event_read(struct perf_event *event)
6948 {
6949         struct perf_event_security_struct *perfsec = event->security;
6950         u32 sid = current_sid();
6951
6952         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6953                             SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6954 }
6955
6956 static int selinux_perf_event_write(struct perf_event *event)
6957 {
6958         struct perf_event_security_struct *perfsec = event->security;
6959         u32 sid = current_sid();
6960
6961         return avc_has_perm(&selinux_state, sid, perfsec->sid,
6962                             SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6963 }
6964 #endif
6965
6966 #ifdef CONFIG_IO_URING
6967 /**
6968  * selinux_uring_override_creds - check the requested cred override
6969  * @new: the target creds
6970  *
6971  * Check to see if the current task is allowed to override it's credentials
6972  * to service an io_uring operation.
6973  */
6974 static int selinux_uring_override_creds(const struct cred *new)
6975 {
6976         return avc_has_perm(&selinux_state, current_sid(), cred_sid(new),
6977                             SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
6978 }
6979
6980 /**
6981  * selinux_uring_sqpoll - check if a io_uring polling thread can be created
6982  *
6983  * Check to see if the current task is allowed to create a new io_uring
6984  * kernel polling thread.
6985  */
6986 static int selinux_uring_sqpoll(void)
6987 {
6988         int sid = current_sid();
6989
6990         return avc_has_perm(&selinux_state, sid, sid,
6991                             SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
6992 }
6993
6994 /**
6995  * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
6996  * @ioucmd: the io_uring command structure
6997  *
6998  * Check to see if the current domain is allowed to execute an
6999  * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7000  *
7001  */
7002 static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7003 {
7004         struct file *file = ioucmd->file;
7005         struct inode *inode = file_inode(file);
7006         struct inode_security_struct *isec = selinux_inode(inode);
7007         struct common_audit_data ad;
7008
7009         ad.type = LSM_AUDIT_DATA_FILE;
7010         ad.u.file = file;
7011
7012         return avc_has_perm(&selinux_state, current_sid(), isec->sid,
7013                             SECCLASS_IO_URING, IO_URING__CMD, &ad);
7014 }
7015 #endif /* CONFIG_IO_URING */
7016
7017 /*
7018  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7019  * 1. any hooks that don't belong to (2.) or (3.) below,
7020  * 2. hooks that both access structures allocated by other hooks, and allocate
7021  *    structures that can be later accessed by other hooks (mostly "cloning"
7022  *    hooks),
7023  * 3. hooks that only allocate structures that can be later accessed by other
7024  *    hooks ("allocating" hooks).
7025  *
7026  * Please follow block comment delimiters in the list to keep this order.
7027  *
7028  * This ordering is needed for SELinux runtime disable to work at least somewhat
7029  * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7030  * when disabling SELinux at runtime.
7031  */
7032 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7033         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7034         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7035         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7036         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7037
7038         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7039         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7040         LSM_HOOK_INIT(capget, selinux_capget),
7041         LSM_HOOK_INIT(capset, selinux_capset),
7042         LSM_HOOK_INIT(capable, selinux_capable),
7043         LSM_HOOK_INIT(quotactl, selinux_quotactl),
7044         LSM_HOOK_INIT(quota_on, selinux_quota_on),
7045         LSM_HOOK_INIT(syslog, selinux_syslog),
7046         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7047
7048         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7049
7050         LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7051         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7052         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7053
7054         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7055         LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7056         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7057         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7058         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7059         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7060         LSM_HOOK_INIT(sb_mount, selinux_mount),
7061         LSM_HOOK_INIT(sb_umount, selinux_umount),
7062         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7063         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7064
7065         LSM_HOOK_INIT(move_mount, selinux_move_mount),
7066
7067         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7068         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7069
7070         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7071         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7072         LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7073         LSM_HOOK_INIT(inode_create, selinux_inode_create),
7074         LSM_HOOK_INIT(inode_link, selinux_inode_link),
7075         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7076         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7077         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7078         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7079         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7080         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7081         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7082         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7083         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7084         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7085         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7086         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7087         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7088         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7089         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7090         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7091         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7092         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7093         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7094         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7095         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7096         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7097         LSM_HOOK_INIT(path_notify, selinux_path_notify),
7098
7099         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7100
7101         LSM_HOOK_INIT(file_permission, selinux_file_permission),
7102         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7103         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7104         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7105         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7106         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7107         LSM_HOOK_INIT(file_lock, selinux_file_lock),
7108         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7109         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7110         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7111         LSM_HOOK_INIT(file_receive, selinux_file_receive),
7112
7113         LSM_HOOK_INIT(file_open, selinux_file_open),
7114
7115         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7116         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7117         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7118         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7119         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7120         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7121         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7122         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7123         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7124         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7125         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7126         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7127         LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7128         LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7129         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7130         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7131         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7132         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7133         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7134         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7135         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7136         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7137         LSM_HOOK_INIT(task_kill, selinux_task_kill),
7138         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7139         LSM_HOOK_INIT(userns_create, selinux_userns_create),
7140
7141         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7142         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7143
7144         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7145         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7146         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7147         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7148
7149         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7150         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7151         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7152
7153         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7154         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7155         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7156
7157         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7158
7159         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7160         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7161
7162         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7163         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7164         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7165         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7166         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7167         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7168
7169         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7170         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7171
7172         LSM_HOOK_INIT(socket_create, selinux_socket_create),
7173         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7174         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7175         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7176         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7177         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7178         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7179         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7180         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7181         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7182         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7183         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7184         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7185         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7186         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7187         LSM_HOOK_INIT(socket_getpeersec_stream,
7188                         selinux_socket_getpeersec_stream),
7189         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7190         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7191         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7192         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7193         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7194         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7195         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7196         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7197         LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7198         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7199         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7200         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7201         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7202         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7203         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7204         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7205         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7206         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7207         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7208         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7209         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7210 #ifdef CONFIG_SECURITY_INFINIBAND
7211         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7212         LSM_HOOK_INIT(ib_endport_manage_subnet,
7213                       selinux_ib_endport_manage_subnet),
7214         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7215 #endif
7216 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7217         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7218         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7219         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7220         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7221         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7222         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7223                         selinux_xfrm_state_pol_flow_match),
7224         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7225 #endif
7226
7227 #ifdef CONFIG_KEYS
7228         LSM_HOOK_INIT(key_free, selinux_key_free),
7229         LSM_HOOK_INIT(key_permission, selinux_key_permission),
7230         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7231 #ifdef CONFIG_KEY_NOTIFICATIONS
7232         LSM_HOOK_INIT(watch_key, selinux_watch_key),
7233 #endif
7234 #endif
7235
7236 #ifdef CONFIG_AUDIT
7237         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7238         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7239         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7240 #endif
7241
7242 #ifdef CONFIG_BPF_SYSCALL
7243         LSM_HOOK_INIT(bpf, selinux_bpf),
7244         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7245         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7246         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7247         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7248 #endif
7249
7250 #ifdef CONFIG_PERF_EVENTS
7251         LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7252         LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7253         LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7254         LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7255 #endif
7256
7257 #ifdef CONFIG_IO_URING
7258         LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7259         LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7260         LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7261 #endif
7262
7263         /*
7264          * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7265          */
7266         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7267         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7268         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7269 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7270         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7271 #endif
7272
7273         /*
7274          * PUT "ALLOCATING" HOOKS HERE
7275          */
7276         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7277         LSM_HOOK_INIT(msg_queue_alloc_security,
7278                       selinux_msg_queue_alloc_security),
7279         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7280         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7281         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7282         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7283         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7284         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7285         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7286         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7287 #ifdef CONFIG_SECURITY_INFINIBAND
7288         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7289 #endif
7290 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7291         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7292         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7293         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7294                       selinux_xfrm_state_alloc_acquire),
7295 #endif
7296 #ifdef CONFIG_KEYS
7297         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7298 #endif
7299 #ifdef CONFIG_AUDIT
7300         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7301 #endif
7302 #ifdef CONFIG_BPF_SYSCALL
7303         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7304         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7305 #endif
7306 #ifdef CONFIG_PERF_EVENTS
7307         LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7308 #endif
7309 };
7310
7311 static __init int selinux_init(void)
7312 {
7313         pr_info("SELinux:  Initializing.\n");
7314
7315         memset(&selinux_state, 0, sizeof(selinux_state));
7316         enforcing_set(&selinux_state, selinux_enforcing_boot);
7317         if (CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE)
7318                 pr_err("SELinux: CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE is non-zero.  This is deprecated and will be rejected in a future kernel release.\n");
7319         checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7320         selinux_avc_init(&selinux_state.avc);
7321         mutex_init(&selinux_state.status_lock);
7322         mutex_init(&selinux_state.policy_mutex);
7323
7324         /* Set the security state for the initial task. */
7325         cred_init_security();
7326
7327         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7328
7329         avc_init();
7330
7331         avtab_cache_init();
7332
7333         ebitmap_cache_init();
7334
7335         hashtab_cache_init();
7336
7337         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7338
7339         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7340                 panic("SELinux: Unable to register AVC netcache callback\n");
7341
7342         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7343                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7344
7345         if (selinux_enforcing_boot)
7346                 pr_debug("SELinux:  Starting in enforcing mode\n");
7347         else
7348                 pr_debug("SELinux:  Starting in permissive mode\n");
7349
7350         fs_validate_description("selinux", selinux_fs_parameters);
7351
7352         return 0;
7353 }
7354
7355 static void delayed_superblock_init(struct super_block *sb, void *unused)
7356 {
7357         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7358 }
7359
7360 void selinux_complete_init(void)
7361 {
7362         pr_debug("SELinux:  Completing initialization.\n");
7363
7364         /* Set up any superblocks initialized prior to the policy load. */
7365         pr_debug("SELinux:  Setting up existing superblocks.\n");
7366         iterate_supers(delayed_superblock_init, NULL);
7367 }
7368
7369 /* SELinux requires early initialization in order to label
7370    all processes and objects when they are created. */
7371 DEFINE_LSM(selinux) = {
7372         .name = "selinux",
7373         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7374         .enabled = &selinux_enabled_boot,
7375         .blobs = &selinux_blob_sizes,
7376         .init = selinux_init,
7377 };
7378
7379 #if defined(CONFIG_NETFILTER)
7380
7381 static const struct nf_hook_ops selinux_nf_ops[] = {
7382         {
7383                 .hook =         selinux_ip_postroute,
7384                 .pf =           NFPROTO_IPV4,
7385                 .hooknum =      NF_INET_POST_ROUTING,
7386                 .priority =     NF_IP_PRI_SELINUX_LAST,
7387         },
7388         {
7389                 .hook =         selinux_ip_forward,
7390                 .pf =           NFPROTO_IPV4,
7391                 .hooknum =      NF_INET_FORWARD,
7392                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7393         },
7394         {
7395                 .hook =         selinux_ip_output,
7396                 .pf =           NFPROTO_IPV4,
7397                 .hooknum =      NF_INET_LOCAL_OUT,
7398                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7399         },
7400 #if IS_ENABLED(CONFIG_IPV6)
7401         {
7402                 .hook =         selinux_ip_postroute,
7403                 .pf =           NFPROTO_IPV6,
7404                 .hooknum =      NF_INET_POST_ROUTING,
7405                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7406         },
7407         {
7408                 .hook =         selinux_ip_forward,
7409                 .pf =           NFPROTO_IPV6,
7410                 .hooknum =      NF_INET_FORWARD,
7411                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7412         },
7413         {
7414                 .hook =         selinux_ip_output,
7415                 .pf =           NFPROTO_IPV6,
7416                 .hooknum =      NF_INET_LOCAL_OUT,
7417                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7418         },
7419 #endif  /* IPV6 */
7420 };
7421
7422 static int __net_init selinux_nf_register(struct net *net)
7423 {
7424         return nf_register_net_hooks(net, selinux_nf_ops,
7425                                      ARRAY_SIZE(selinux_nf_ops));
7426 }
7427
7428 static void __net_exit selinux_nf_unregister(struct net *net)
7429 {
7430         nf_unregister_net_hooks(net, selinux_nf_ops,
7431                                 ARRAY_SIZE(selinux_nf_ops));
7432 }
7433
7434 static struct pernet_operations selinux_net_ops = {
7435         .init = selinux_nf_register,
7436         .exit = selinux_nf_unregister,
7437 };
7438
7439 static int __init selinux_nf_ip_init(void)
7440 {
7441         int err;
7442
7443         if (!selinux_enabled_boot)
7444                 return 0;
7445
7446         pr_debug("SELinux:  Registering netfilter hooks\n");
7447
7448         err = register_pernet_subsys(&selinux_net_ops);
7449         if (err)
7450                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7451
7452         return 0;
7453 }
7454 __initcall(selinux_nf_ip_init);
7455
7456 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7457 static void selinux_nf_ip_exit(void)
7458 {
7459         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7460
7461         unregister_pernet_subsys(&selinux_net_ops);
7462 }
7463 #endif
7464
7465 #else /* CONFIG_NETFILTER */
7466
7467 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7468 #define selinux_nf_ip_exit()
7469 #endif
7470
7471 #endif /* CONFIG_NETFILTER */
7472
7473 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7474 int selinux_disable(struct selinux_state *state)
7475 {
7476         if (selinux_initialized(state)) {
7477                 /* Not permitted after initial policy load. */
7478                 return -EINVAL;
7479         }
7480
7481         if (selinux_disabled(state)) {
7482                 /* Only do this once. */
7483                 return -EINVAL;
7484         }
7485
7486         selinux_mark_disabled(state);
7487
7488         pr_info("SELinux:  Disabled at runtime.\n");
7489
7490         /*
7491          * Unregister netfilter hooks.
7492          * Must be done before security_delete_hooks() to avoid breaking
7493          * runtime disable.
7494          */
7495         selinux_nf_ip_exit();
7496
7497         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7498
7499         /* Try to destroy the avc node cache */
7500         avc_disable();
7501
7502         /* Unregister selinuxfs. */
7503         exit_sel_fs();
7504
7505         return 0;
7506 }
7507 #endif