security/selinux/hooks.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  NSA Security-Enhanced Linux (SELinux) security module
   4  *
   5  *  This file contains the SELinux hook function implementations.
   6  *
   7  *  Authors:  Stephen Smalley, <sds@tycho.nsa.gov>
   8  *            Chris Vance, <cvance@nai.com>
   9  *            Wayne Salamon, <wsalamon@nai.com>
  10  *            James Morris <jmorris@redhat.com>
  11  *
  12  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  13  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  14  *                                         Eric Paris <eparis@redhat.com>
  15  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  16  *                          <dgoeddel@trustedcs.com>
  17  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  18  *      Paul Moore <paul@paul-moore.com>
  19  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  20  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  21  *  Copyright (C) 2016 Mellanox Technologies
  22  */
  23
  24 #include <linux/init.h>
  25 #include <linux/kd.h>
  26 #include <linux/kernel.h>
  27 #include <linux/tracehook.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched/signal.h>
  30 #include <linux/sched/task.h>
  31 #include <linux/lsm_hooks.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/proc_fs.h>
  40 #include <linux/swap.h>
  41 #include <linux/spinlock.h>
  42 #include <linux/syscalls.h>
  43 #include <linux/dcache.h>
  44 #include <linux/file.h>
  45 #include <linux/fdtable.h>
  46 #include <linux/namei.h>
  47 #include <linux/mount.h>
  48 #include <linux/fs_context.h>
  49 #include <linux/fs_parser.h>
  50 #include <linux/netfilter_ipv4.h>
  51 #include <linux/netfilter_ipv6.h>
  52 #include <linux/tty.h>
  53 #include <net/icmp.h>
  54 #include <net/ip.h>             /* for local_port_range[] */
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/sctp.h>
  70 #include <net/sctp/structs.h>
  71 #include <linux/quota.h>
  72 #include <linux/un.h>           /* for Unix socket types */
  73 #include <net/af_unix.h>        /* for Unix socket types */
  74 #include <linux/parser.h>
  75 #include <linux/nfs_mount.h>
  76 #include <net/ipv6.h>
  77 #include <linux/hugetlb.h>
  78 #include <linux/personality.h>
  79 #include <linux/audit.h>
  80 #include <linux/string.h>
  81 #include <linux/mutex.h>
  82 #include <linux/posix-timers.h>
  83 #include <linux/syslog.h>
  84 #include <linux/user_namespace.h>
  85 #include <linux/export.h>
  86 #include <linux/msg.h>
  87 #include <linux/shm.h>
  88 #include <linux/bpf.h>
  89 #include <linux/kernfs.h>
  90 #include <linux/stringhash.h>   /* for hashlen_string() */
  91 #include <uapi/linux/mount.h>
  92
  93 #include "avc.h"
  94 #include "objsec.h"
  95 #include "netif.h"
  96 #include "netnode.h"
  97 #include "netport.h"
  98 #include "ibpkey.h"
  99 #include "xfrm.h"
 100 #include "netlabel.h"
 101 #include "audit.h"
 102 #include "avc_ss.h"
 103
 104 struct selinux_state selinux_state;
 105
 106 /* SECMARK reference count */
 107 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 108
 109 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 110 static int selinux_enforcing_boot;
 111
 112 static int __init enforcing_setup(char *str)
 113 {
 114         unsigned long enforcing;
 115         if (!kstrtoul(str, 0, &enforcing))
 116                 selinux_enforcing_boot = enforcing ? 1 : 0;
 117         return 1;
 118 }
 119 __setup("enforcing=", enforcing_setup);
 120 #else
 121 #define selinux_enforcing_boot 1
 122 #endif
 123
 124 int selinux_enabled __lsm_ro_after_init = 1;
 125 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 126 static int __init selinux_enabled_setup(char *str)
 127 {
 128         unsigned long enabled;
 129         if (!kstrtoul(str, 0, &enabled))
 130                 selinux_enabled = enabled ? 1 : 0;
 131         return 1;
 132 }
 133 __setup("selinux=", selinux_enabled_setup);
 134 #endif
 135
 136 static unsigned int selinux_checkreqprot_boot =
 137         CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
 138
 139 static int __init checkreqprot_setup(char *str)
 140 {
 141         unsigned long checkreqprot;
 142
 143         if (!kstrtoul(str, 0, &checkreqprot))
 144                 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
 145         return 1;
 146 }
 147 __setup("checkreqprot=", checkreqprot_setup);
 148
 149 /**
 150  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 151  *
 152  * Description:
 153  * This function checks the SECMARK reference counter to see if any SECMARK
 154  * targets are currently configured, if the reference counter is greater than
 155  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 156  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 157  * policy capability is enabled, SECMARK is always considered enabled.
 158  *
 159  */
 160 static int selinux_secmark_enabled(void)
 161 {
 162         return (selinux_policycap_alwaysnetwork() ||
 163                 atomic_read(&selinux_secmark_refcount));
 164 }
 165
 166 /**
 167  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 168  *
 169  * Description:
 170  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 171  * (1) if any are enabled or false (0) if neither are enabled.  If the
 172  * always_check_network policy capability is enabled, peer labeling
 173  * is always considered enabled.
 174  *
 175  */
 176 static int selinux_peerlbl_enabled(void)
 177 {
 178         return (selinux_policycap_alwaysnetwork() ||
 179                 netlbl_enabled() || selinux_xfrm_enabled());
 180 }
 181
 182 static int selinux_netcache_avc_callback(u32 event)
 183 {
 184         if (event == AVC_CALLBACK_RESET) {
 185                 sel_netif_flush();
 186                 sel_netnode_flush();
 187                 sel_netport_flush();
 188                 synchronize_net();
 189         }
 190         return 0;
 191 }
 192
 193 static int selinux_lsm_notifier_avc_callback(u32 event)
 194 {
 195         if (event == AVC_CALLBACK_RESET) {
 196                 sel_ib_pkey_flush();
 197                 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
 198         }
 199
 200         return 0;
 201 }
 202
 203 /*
 204  * initialise the security for the init task
 205  */
 206 static void cred_init_security(void)
 207 {
 208         struct cred *cred = (struct cred *) current->real_cred;
 209         struct task_security_struct *tsec;
 210
 211         tsec = selinux_cred(cred);
 212         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 213 }
 214
 215 /*
 216  * get the security ID of a set of credentials
 217  */
 218 static inline u32 cred_sid(const struct cred *cred)
 219 {
 220         const struct task_security_struct *tsec;
 221
 222         tsec = selinux_cred(cred);
 223         return tsec->sid;
 224 }
 225
 226 /*
 227  * get the objective security ID of a task
 228  */
 229 static inline u32 task_sid(const struct task_struct *task)
 230 {
 231         u32 sid;
 232
 233         rcu_read_lock();
 234         sid = cred_sid(__task_cred(task));
 235         rcu_read_unlock();
 236         return sid;
 237 }
 238
 239 /* Allocate and free functions for each kind of security blob. */
 240
 241 static int inode_alloc_security(struct inode *inode)
 242 {
 243         struct inode_security_struct *isec = selinux_inode(inode);
 244         u32 sid = current_sid();
 245
 246         spin_lock_init(&isec->lock);
 247         INIT_LIST_HEAD(&isec->list);
 248         isec->inode = inode;
 249         isec->sid = SECINITSID_UNLABELED;
 250         isec->sclass = SECCLASS_FILE;
 251         isec->task_sid = sid;
 252         isec->initialized = LABEL_INVALID;
 253
 254         return 0;
 255 }
 256
 257 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 258
 259 /*
 260  * Try reloading inode security labels that have been marked as invalid.  The
 261  * @may_sleep parameter indicates when sleeping and thus reloading labels is
 262  * allowed; when set to false, returns -ECHILD when the label is
 263  * invalid.  The @dentry parameter should be set to a dentry of the inode.
 264  */
 265 static int __inode_security_revalidate(struct inode *inode,
 266                                        struct dentry *dentry,
 267                                        bool may_sleep)
 268 {
 269         struct inode_security_struct *isec = selinux_inode(inode);
 270
 271         might_sleep_if(may_sleep);
 272
 273         if (selinux_state.initialized &&
 274             isec->initialized != LABEL_INITIALIZED) {
 275                 if (!may_sleep)
 276                         return -ECHILD;
 277
 278                 /*
 279                  * Try reloading the inode security label.  This will fail if
 280                  * @opt_dentry is NULL and no dentry for this inode can be
 281                  * found; in that case, continue using the old label.
 282                  */
 283                 inode_doinit_with_dentry(inode, dentry);
 284         }
 285         return 0;
 286 }
 287
 288 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
 289 {
 290         return selinux_inode(inode);
 291 }
 292
 293 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
 294 {
 295         int error;
 296
 297         error = __inode_security_revalidate(inode, NULL, !rcu);
 298         if (error)
 299                 return ERR_PTR(error);
 300         return selinux_inode(inode);
 301 }
 302
 303 /*
 304  * Get the security label of an inode.
 305  */
 306 static struct inode_security_struct *inode_security(struct inode *inode)
 307 {
 308         __inode_security_revalidate(inode, NULL, true);
 309         return selinux_inode(inode);
 310 }
 311
 312 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
 313 {
 314         struct inode *inode = d_backing_inode(dentry);
 315
 316         return selinux_inode(inode);
 317 }
 318
 319 /*
 320  * Get the security label of a dentry's backing inode.
 321  */
 322 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
 323 {
 324         struct inode *inode = d_backing_inode(dentry);
 325
 326         __inode_security_revalidate(inode, dentry, true);
 327         return selinux_inode(inode);
 328 }
 329
 330 static void inode_free_security(struct inode *inode)
 331 {
 332         struct inode_security_struct *isec = selinux_inode(inode);
 333         struct superblock_security_struct *sbsec;
 334
 335         if (!isec)
 336                 return;
 337         sbsec = inode->i_sb->s_security;
 338         /*
 339          * As not all inode security structures are in a list, we check for
 340          * empty list outside of the lock to make sure that we won't waste
 341          * time taking a lock doing nothing.
 342          *
 343          * The list_del_init() function can be safely called more than once.
 344          * It should not be possible for this function to be called with
 345          * concurrent list_add(), but for better safety against future changes
 346          * in the code, we use list_empty_careful() here.
 347          */
 348         if (!list_empty_careful(&isec->list)) {
 349                 spin_lock(&sbsec->isec_lock);
 350                 list_del_init(&isec->list);
 351                 spin_unlock(&sbsec->isec_lock);
 352         }
 353 }
 354
 355 static int file_alloc_security(struct file *file)
 356 {
 357         struct file_security_struct *fsec = selinux_file(file);
 358         u32 sid = current_sid();
 359
 360         fsec->sid = sid;
 361         fsec->fown_sid = sid;
 362
 363         return 0;
 364 }
 365
 366 static int superblock_alloc_security(struct super_block *sb)
 367 {
 368         struct superblock_security_struct *sbsec;
 369
 370         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 371         if (!sbsec)
 372                 return -ENOMEM;
 373
 374         mutex_init(&sbsec->lock);
 375         INIT_LIST_HEAD(&sbsec->isec_head);
 376         spin_lock_init(&sbsec->isec_lock);
 377         sbsec->sb = sb;
 378         sbsec->sid = SECINITSID_UNLABELED;
 379         sbsec->def_sid = SECINITSID_FILE;
 380         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 381         sb->s_security = sbsec;
 382
 383         return 0;
 384 }
 385
 386 static void superblock_free_security(struct super_block *sb)
 387 {
 388         struct superblock_security_struct *sbsec = sb->s_security;
 389         sb->s_security = NULL;
 390         kfree(sbsec);
 391 }
 392
 393 struct selinux_mnt_opts {
 394         const char *fscontext, *context, *rootcontext, *defcontext;
 395 };
 396
 397 static void selinux_free_mnt_opts(void *mnt_opts)
 398 {
 399         struct selinux_mnt_opts *opts = mnt_opts;
 400         kfree(opts->fscontext);
 401         kfree(opts->context);
 402         kfree(opts->rootcontext);
 403         kfree(opts->defcontext);
 404         kfree(opts);
 405 }
 406
 407 static inline int inode_doinit(struct inode *inode)
 408 {
 409         return inode_doinit_with_dentry(inode, NULL);
 410 }
 411
 412 enum {
 413         Opt_error = -1,
 414         Opt_context = 0,
 415         Opt_defcontext = 1,
 416         Opt_fscontext = 2,
 417         Opt_rootcontext = 3,
 418         Opt_seclabel = 4,
 419 };
 420
 421 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
 422 static struct {
 423         const char *name;
 424         int len;
 425         int opt;
 426         bool has_arg;
 427 } tokens[] = {
 428         A(context, true),
 429         A(fscontext, true),
 430         A(defcontext, true),
 431         A(rootcontext, true),
 432         A(seclabel, false),
 433 };
 434 #undef A
 435
 436 static int match_opt_prefix(char *s, int l, char **arg)
 437 {
 438         int i;
 439
 440         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
 441                 size_t len = tokens[i].len;
 442                 if (len > l || memcmp(s, tokens[i].name, len))
 443                         continue;
 444                 if (tokens[i].has_arg) {
 445                         if (len == l || s[len] != '=')
 446                                 continue;
 447                         *arg = s + len + 1;
 448                 } else if (len != l)
 449                         continue;
 450                 return tokens[i].opt;
 451         }
 452         return Opt_error;
 453 }
 454
 455 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 456
 457 static int may_context_mount_sb_relabel(u32 sid,
 458                         struct superblock_security_struct *sbsec,
 459                         const struct cred *cred)
 460 {
 461         const struct task_security_struct *tsec = selinux_cred(cred);
 462         int rc;
 463
 464         rc = avc_has_perm(&selinux_state,
 465                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 466                           FILESYSTEM__RELABELFROM, NULL);
 467         if (rc)
 468                 return rc;
 469
 470         rc = avc_has_perm(&selinux_state,
 471                           tsec->sid, sid, SECCLASS_FILESYSTEM,
 472                           FILESYSTEM__RELABELTO, NULL);
 473         return rc;
 474 }
 475
 476 static int may_context_mount_inode_relabel(u32 sid,
 477                         struct superblock_security_struct *sbsec,
 478                         const struct cred *cred)
 479 {
 480         const struct task_security_struct *tsec = selinux_cred(cred);
 481         int rc;
 482         rc = avc_has_perm(&selinux_state,
 483                           tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 484                           FILESYSTEM__RELABELFROM, NULL);
 485         if (rc)
 486                 return rc;
 487
 488         rc = avc_has_perm(&selinux_state,
 489                           sid, sbsec->sid, SECCLASS_FILESYSTEM,
 490                           FILESYSTEM__ASSOCIATE, NULL);
 491         return rc;
 492 }
 493
 494 static int selinux_is_genfs_special_handling(struct super_block *sb)
 495 {
 496         /* Special handling. Genfs but also in-core setxattr handler */
 497         return  !strcmp(sb->s_type->name, "sysfs") ||
 498                 !strcmp(sb->s_type->name, "pstore") ||
 499                 !strcmp(sb->s_type->name, "debugfs") ||
 500                 !strcmp(sb->s_type->name, "tracefs") ||
 501                 !strcmp(sb->s_type->name, "rootfs") ||
 502                 (selinux_policycap_cgroupseclabel() &&
 503                  (!strcmp(sb->s_type->name, "cgroup") ||
 504                   !strcmp(sb->s_type->name, "cgroup2")));
 505 }
 506
 507 static int selinux_is_sblabel_mnt(struct super_block *sb)
 508 {
 509         struct superblock_security_struct *sbsec = sb->s_security;
 510
 511         /*
 512          * IMPORTANT: Double-check logic in this function when adding a new
 513          * SECURITY_FS_USE_* definition!
 514          */
 515         BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
 516
 517         switch (sbsec->behavior) {
 518         case SECURITY_FS_USE_XATTR:
 519         case SECURITY_FS_USE_TRANS:
 520         case SECURITY_FS_USE_TASK:
 521         case SECURITY_FS_USE_NATIVE:
 522                 return 1;
 523
 524         case SECURITY_FS_USE_GENFS:
 525                 return selinux_is_genfs_special_handling(sb);
 526
 527         /* Never allow relabeling on context mounts */
 528         case SECURITY_FS_USE_MNTPOINT:
 529         case SECURITY_FS_USE_NONE:
 530         default:
 531                 return 0;
 532         }
 533 }
 534
 535 static int sb_finish_set_opts(struct super_block *sb)
 536 {
 537         struct superblock_security_struct *sbsec = sb->s_security;
 538         struct dentry *root = sb->s_root;
 539         struct inode *root_inode = d_backing_inode(root);
 540         int rc = 0;
 541
 542         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 543                 /* Make sure that the xattr handler exists and that no
 544                    error other than -ENODATA is returned by getxattr on
 545                    the root directory.  -ENODATA is ok, as this may be
 546                    the first boot of the SELinux kernel before we have
 547                    assigned xattr values to the filesystem. */
 548                 if (!(root_inode->i_opflags & IOP_XATTR)) {
 549                         pr_warn("SELinux: (dev %s, type %s) has no "
 550                                "xattr support\n", sb->s_id, sb->s_type->name);
 551                         rc = -EOPNOTSUPP;
 552                         goto out;
 553                 }
 554
 555                 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
 556                 if (rc < 0 && rc != -ENODATA) {
 557                         if (rc == -EOPNOTSUPP)
 558                                 pr_warn("SELinux: (dev %s, type "
 559                                        "%s) has no security xattr handler\n",
 560                                        sb->s_id, sb->s_type->name);
 561                         else
 562                                 pr_warn("SELinux: (dev %s, type "
 563                                        "%s) getxattr errno %d\n", sb->s_id,
 564                                        sb->s_type->name, -rc);
 565                         goto out;
 566                 }
 567         }
 568
 569         sbsec->flags |= SE_SBINITIALIZED;
 570
 571         /*
 572          * Explicitly set or clear SBLABEL_MNT.  It's not sufficient to simply
 573          * leave the flag untouched because sb_clone_mnt_opts might be handing
 574          * us a superblock that needs the flag to be cleared.
 575          */
 576         if (selinux_is_sblabel_mnt(sb))
 577                 sbsec->flags |= SBLABEL_MNT;
 578         else
 579                 sbsec->flags &= ~SBLABEL_MNT;
 580
 581         /* Initialize the root inode. */
 582         rc = inode_doinit_with_dentry(root_inode, root);
 583
 584         /* Initialize any other inodes associated with the superblock, e.g.
 585            inodes created prior to initial policy load or inodes created
 586            during get_sb by a pseudo filesystem that directly
 587            populates itself. */
 588         spin_lock(&sbsec->isec_lock);
 589         while (!list_empty(&sbsec->isec_head)) {
 590                 struct inode_security_struct *isec =
 591                                 list_first_entry(&sbsec->isec_head,
 592                                            struct inode_security_struct, list);
 593                 struct inode *inode = isec->inode;
 594                 list_del_init(&isec->list);
 595                 spin_unlock(&sbsec->isec_lock);
 596                 inode = igrab(inode);
 597                 if (inode) {
 598                         if (!IS_PRIVATE(inode))
 599                                 inode_doinit(inode);
 600                         iput(inode);
 601                 }
 602                 spin_lock(&sbsec->isec_lock);
 603         }
 604         spin_unlock(&sbsec->isec_lock);
 605 out:
 606         return rc;
 607 }
 608
 609 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 610                       u32 old_sid, u32 new_sid)
 611 {
 612         char mnt_flags = sbsec->flags & SE_MNTMASK;
 613
 614         /* check if the old mount command had the same options */
 615         if (sbsec->flags & SE_SBINITIALIZED)
 616                 if (!(sbsec->flags & flag) ||
 617                     (old_sid != new_sid))
 618                         return 1;
 619
 620         /* check if we were passed the same options twice,
 621          * aka someone passed context=a,context=b
 622          */
 623         if (!(sbsec->flags & SE_SBINITIALIZED))
 624                 if (mnt_flags & flag)
 625                         return 1;
 626         return 0;
 627 }
 628
 629 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
 630 {
 631         int rc = security_context_str_to_sid(&selinux_state, s,
 632                                              sid, GFP_KERNEL);
 633         if (rc)
 634                 pr_warn("SELinux: security_context_str_to_sid"
 635                        "(%s) failed for (dev %s, type %s) errno=%d\n",
 636                        s, sb->s_id, sb->s_type->name, rc);
 637         return rc;
 638 }
 639
 640 /*
 641  * Allow filesystems with binary mount data to explicitly set mount point
 642  * labeling information.
 643  */
 644 static int selinux_set_mnt_opts(struct super_block *sb,
 645                                 void *mnt_opts,
 646                                 unsigned long kern_flags,
 647                                 unsigned long *set_kern_flags)
 648 {
 649         const struct cred *cred = current_cred();
 650         struct superblock_security_struct *sbsec = sb->s_security;
 651         struct dentry *root = sbsec->sb->s_root;
 652         struct selinux_mnt_opts *opts = mnt_opts;
 653         struct inode_security_struct *root_isec;
 654         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 655         u32 defcontext_sid = 0;
 656         int rc = 0;
 657
 658         mutex_lock(&sbsec->lock);
 659
 660         if (!selinux_state.initialized) {
 661                 if (!opts) {
 662                         /* Defer initialization until selinux_complete_init,
 663                            after the initial policy is loaded and the security
 664                            server is ready to handle calls. */
 665                         goto out;
 666                 }
 667                 rc = -EINVAL;
 668                 pr_warn("SELinux: Unable to set superblock options "
 669                         "before the security server is initialized\n");
 670                 goto out;
 671         }
 672         if (kern_flags && !set_kern_flags) {
 673                 /* Specifying internal flags without providing a place to
 674                  * place the results is not allowed */
 675                 rc = -EINVAL;
 676                 goto out;
 677         }
 678
 679         /*
 680          * Binary mount data FS will come through this function twice.  Once
 681          * from an explicit call and once from the generic calls from the vfs.
 682          * Since the generic VFS calls will not contain any security mount data
 683          * we need to skip the double mount verification.
 684          *
 685          * This does open a hole in which we will not notice if the first
 686          * mount using this sb set explict options and a second mount using
 687          * this sb does not set any security options.  (The first options
 688          * will be used for both mounts)
 689          */
 690         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 691             && !opts)
 692                 goto out;
 693
 694         root_isec = backing_inode_security_novalidate(root);
 695
 696         /*
 697          * parse the mount options, check if they are valid sids.
 698          * also check if someone is trying to mount the same sb more
 699          * than once with different security options.
 700          */
 701         if (opts) {
 702                 if (opts->fscontext) {
 703                         rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
 704                         if (rc)
 705                                 goto out;
 706                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 707                                         fscontext_sid))
 708                                 goto out_double_mount;
 709                         sbsec->flags |= FSCONTEXT_MNT;
 710                 }
 711                 if (opts->context) {
 712                         rc = parse_sid(sb, opts->context, &context_sid);
 713                         if (rc)
 714                                 goto out;
 715                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 716                                         context_sid))
 717                                 goto out_double_mount;
 718                         sbsec->flags |= CONTEXT_MNT;
 719                 }
 720                 if (opts->rootcontext) {
 721                         rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
 722                         if (rc)
 723                                 goto out;
 724                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 725                                         rootcontext_sid))
 726                                 goto out_double_mount;
 727                         sbsec->flags |= ROOTCONTEXT_MNT;
 728                 }
 729                 if (opts->defcontext) {
 730                         rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
 731                         if (rc)
 732                                 goto out;
 733                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 734                                         defcontext_sid))
 735                                 goto out_double_mount;
 736                         sbsec->flags |= DEFCONTEXT_MNT;
 737                 }
 738         }
 739
 740         if (sbsec->flags & SE_SBINITIALIZED) {
 741                 /* previously mounted with options, but not on this attempt? */
 742                 if ((sbsec->flags & SE_MNTMASK) && !opts)
 743                         goto out_double_mount;
 744                 rc = 0;
 745                 goto out;
 746         }
 747
 748         if (strcmp(sb->s_type->name, "proc") == 0)
 749                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 750
 751         if (!strcmp(sb->s_type->name, "debugfs") ||
 752             !strcmp(sb->s_type->name, "tracefs") ||
 753             !strcmp(sb->s_type->name, "pstore"))
 754                 sbsec->flags |= SE_SBGENFS;
 755
 756         if (!strcmp(sb->s_type->name, "sysfs") ||
 757             !strcmp(sb->s_type->name, "cgroup") ||
 758             !strcmp(sb->s_type->name, "cgroup2"))
 759                 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
 760
 761         if (!sbsec->behavior) {
 762                 /*
 763                  * Determine the labeling behavior to use for this
 764                  * filesystem type.
 765                  */
 766                 rc = security_fs_use(&selinux_state, sb);
 767                 if (rc) {
 768                         pr_warn("%s: security_fs_use(%s) returned %d\n",
 769                                         __func__, sb->s_type->name, rc);
 770                         goto out;
 771                 }
 772         }
 773
 774         /*
 775          * If this is a user namespace mount and the filesystem type is not
 776          * explicitly whitelisted, then no contexts are allowed on the command
 777          * line and security labels must be ignored.
 778          */
 779         if (sb->s_user_ns != &init_user_ns &&
 780             strcmp(sb->s_type->name, "tmpfs") &&
 781             strcmp(sb->s_type->name, "ramfs") &&
 782             strcmp(sb->s_type->name, "devpts")) {
 783                 if (context_sid || fscontext_sid || rootcontext_sid ||
 784                     defcontext_sid) {
 785                         rc = -EACCES;
 786                         goto out;
 787                 }
 788                 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 789                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 790                         rc = security_transition_sid(&selinux_state,
 791                                                      current_sid(),
 792                                                      current_sid(),
 793                                                      SECCLASS_FILE, NULL,
 794                                                      &sbsec->mntpoint_sid);
 795                         if (rc)
 796                                 goto out;
 797                 }
 798                 goto out_set_opts;
 799         }
 800
 801         /* sets the context of the superblock for the fs being mounted. */
 802         if (fscontext_sid) {
 803                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 804                 if (rc)
 805                         goto out;
 806
 807                 sbsec->sid = fscontext_sid;
 808         }
 809
 810         /*
 811          * Switch to using mount point labeling behavior.
 812          * sets the label used on all file below the mountpoint, and will set
 813          * the superblock context if not already set.
 814          */
 815         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 816                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 817                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 818         }
 819
 820         if (context_sid) {
 821                 if (!fscontext_sid) {
 822                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 823                                                           cred);
 824                         if (rc)
 825                                 goto out;
 826                         sbsec->sid = context_sid;
 827                 } else {
 828                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 829                                                              cred);
 830                         if (rc)
 831                                 goto out;
 832                 }
 833                 if (!rootcontext_sid)
 834                         rootcontext_sid = context_sid;
 835
 836                 sbsec->mntpoint_sid = context_sid;
 837                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 838         }
 839
 840         if (rootcontext_sid) {
 841                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 842                                                      cred);
 843                 if (rc)
 844                         goto out;
 845
 846                 root_isec->sid = rootcontext_sid;
 847                 root_isec->initialized = LABEL_INITIALIZED;
 848         }
 849
 850         if (defcontext_sid) {
 851                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 852                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 853                         rc = -EINVAL;
 854                         pr_warn("SELinux: defcontext option is "
 855                                "invalid for this filesystem type\n");
 856                         goto out;
 857                 }
 858
 859                 if (defcontext_sid != sbsec->def_sid) {
 860                         rc = may_context_mount_inode_relabel(defcontext_sid,
 861                                                              sbsec, cred);
 862                         if (rc)
 863                                 goto out;
 864                 }
 865
 866                 sbsec->def_sid = defcontext_sid;
 867         }
 868
 869 out_set_opts:
 870         rc = sb_finish_set_opts(sb);
 871 out:
 872         mutex_unlock(&sbsec->lock);
 873         return rc;
 874 out_double_mount:
 875         rc = -EINVAL;
 876         pr_warn("SELinux: mount invalid.  Same superblock, different "
 877                "security settings for (dev %s, type %s)\n", sb->s_id,
 878                sb->s_type->name);
 879         goto out;
 880 }
 881
 882 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 883                                     const struct super_block *newsb)
 884 {
 885         struct superblock_security_struct *old = oldsb->s_security;
 886         struct superblock_security_struct *new = newsb->s_security;
 887         char oldflags = old->flags & SE_MNTMASK;
 888         char newflags = new->flags & SE_MNTMASK;
 889
 890         if (oldflags != newflags)
 891                 goto mismatch;
 892         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 893                 goto mismatch;
 894         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 895                 goto mismatch;
 896         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 897                 goto mismatch;
 898         if (oldflags & ROOTCONTEXT_MNT) {
 899                 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
 900                 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
 901                 if (oldroot->sid != newroot->sid)
 902                         goto mismatch;
 903         }
 904         return 0;
 905 mismatch:
 906         pr_warn("SELinux: mount invalid.  Same superblock, "
 907                             "different security settings for (dev %s, "
 908                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 909         return -EBUSY;
 910 }
 911
 912 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 913                                         struct super_block *newsb,
 914                                         unsigned long kern_flags,
 915                                         unsigned long *set_kern_flags)
 916 {
 917         int rc = 0;
 918         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 919         struct superblock_security_struct *newsbsec = newsb->s_security;
 920
 921         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 922         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 923         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 924
 925         /*
 926          * if the parent was able to be mounted it clearly had no special lsm
 927          * mount options.  thus we can safely deal with this superblock later
 928          */
 929         if (!selinux_state.initialized)
 930                 return 0;
 931
 932         /*
 933          * Specifying internal flags without providing a place to
 934          * place the results is not allowed.
 935          */
 936         if (kern_flags && !set_kern_flags)
 937                 return -EINVAL;
 938
 939         /* how can we clone if the old one wasn't set up?? */
 940         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 941
 942         /* if fs is reusing a sb, make sure that the contexts match */
 943         if (newsbsec->flags & SE_SBINITIALIZED) {
 944                 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
 945                         *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 946                 return selinux_cmp_sb_context(oldsb, newsb);
 947         }
 948
 949         mutex_lock(&newsbsec->lock);
 950
 951         newsbsec->flags = oldsbsec->flags;
 952
 953         newsbsec->sid = oldsbsec->sid;
 954         newsbsec->def_sid = oldsbsec->def_sid;
 955         newsbsec->behavior = oldsbsec->behavior;
 956
 957         if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
 958                 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
 959                 rc = security_fs_use(&selinux_state, newsb);
 960                 if (rc)
 961                         goto out;
 962         }
 963
 964         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
 965                 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
 966                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 967         }
 968
 969         if (set_context) {
 970                 u32 sid = oldsbsec->mntpoint_sid;
 971
 972                 if (!set_fscontext)
 973                         newsbsec->sid = sid;
 974                 if (!set_rootcontext) {
 975                         struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 976                         newisec->sid = sid;
 977                 }
 978                 newsbsec->mntpoint_sid = sid;
 979         }
 980         if (set_rootcontext) {
 981                 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
 982                 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
 983
 984                 newisec->sid = oldisec->sid;
 985         }
 986
 987         sb_finish_set_opts(newsb);
 988 out:
 989         mutex_unlock(&newsbsec->lock);
 990         return rc;
 991 }
 992
 993 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
 994 {
 995         struct selinux_mnt_opts *opts = *mnt_opts;
 996
 997         if (token == Opt_seclabel)      /* eaten and completely ignored */
 998                 return 0;
 999
1000         if (!opts) {
1001                 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1002                 if (!opts)
1003                         return -ENOMEM;
1004                 *mnt_opts = opts;
1005         }
1006         if (!s)
1007                 return -ENOMEM;
1008         switch (token) {
1009         case Opt_context:
1010                 if (opts->context || opts->defcontext)
1011                         goto Einval;
1012                 opts->context = s;
1013                 break;
1014         case Opt_fscontext:
1015                 if (opts->fscontext)
1016                         goto Einval;
1017                 opts->fscontext = s;
1018                 break;
1019         case Opt_rootcontext:
1020                 if (opts->rootcontext)
1021                         goto Einval;
1022                 opts->rootcontext = s;
1023                 break;
1024         case Opt_defcontext:
1025                 if (opts->context || opts->defcontext)
1026                         goto Einval;
1027                 opts->defcontext = s;
1028                 break;
1029         }
1030         return 0;
1031 Einval:
1032         pr_warn(SEL_MOUNT_FAIL_MSG);
1033         return -EINVAL;
1034 }
1035
1036 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1037                                void **mnt_opts)
1038 {
1039         int token = Opt_error;
1040         int rc, i;
1041
1042         for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1043                 if (strcmp(option, tokens[i].name) == 0) {
1044                         token = tokens[i].opt;
1045                         break;
1046                 }
1047         }
1048
1049         if (token == Opt_error)
1050                 return -EINVAL;
1051
1052         if (token != Opt_seclabel) {
1053                 val = kmemdup_nul(val, len, GFP_KERNEL);
1054                 if (!val) {
1055                         rc = -ENOMEM;
1056                         goto free_opt;
1057                 }
1058         }
1059         rc = selinux_add_opt(token, val, mnt_opts);
1060         if (unlikely(rc)) {
1061                 kfree(val);
1062                 goto free_opt;
1063         }
1064         return rc;
1065
1066 free_opt:
1067         if (*mnt_opts) {
1068                 selinux_free_mnt_opts(*mnt_opts);
1069                 *mnt_opts = NULL;
1070         }
1071         return rc;
1072 }
1073
1074 static int show_sid(struct seq_file *m, u32 sid)
1075 {
1076         char *context = NULL;
1077         u32 len;
1078         int rc;
1079
1080         rc = security_sid_to_context(&selinux_state, sid,
1081                                              &context, &len);
1082         if (!rc) {
1083                 bool has_comma = context && strchr(context, ',');
1084
1085                 seq_putc(m, '=');
1086                 if (has_comma)
1087                         seq_putc(m, '\"');
1088                 seq_escape(m, context, "\"\n\\");
1089                 if (has_comma)
1090                         seq_putc(m, '\"');
1091         }
1092         kfree(context);
1093         return rc;
1094 }
1095
1096 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1097 {
1098         struct superblock_security_struct *sbsec = sb->s_security;
1099         int rc;
1100
1101         if (!(sbsec->flags & SE_SBINITIALIZED))
1102                 return 0;
1103
1104         if (!selinux_state.initialized)
1105                 return 0;
1106
1107         if (sbsec->flags & FSCONTEXT_MNT) {
1108                 seq_putc(m, ',');
1109                 seq_puts(m, FSCONTEXT_STR);
1110                 rc = show_sid(m, sbsec->sid);
1111                 if (rc)
1112                         return rc;
1113         }
1114         if (sbsec->flags & CONTEXT_MNT) {
1115                 seq_putc(m, ',');
1116                 seq_puts(m, CONTEXT_STR);
1117                 rc = show_sid(m, sbsec->mntpoint_sid);
1118                 if (rc)
1119                         return rc;
1120         }
1121         if (sbsec->flags & DEFCONTEXT_MNT) {
1122                 seq_putc(m, ',');
1123                 seq_puts(m, DEFCONTEXT_STR);
1124                 rc = show_sid(m, sbsec->def_sid);
1125                 if (rc)
1126                         return rc;
1127         }
1128         if (sbsec->flags & ROOTCONTEXT_MNT) {
1129                 struct dentry *root = sbsec->sb->s_root;
1130                 struct inode_security_struct *isec = backing_inode_security(root);
1131                 seq_putc(m, ',');
1132                 seq_puts(m, ROOTCONTEXT_STR);
1133                 rc = show_sid(m, isec->sid);
1134                 if (rc)
1135                         return rc;
1136         }
1137         if (sbsec->flags & SBLABEL_MNT) {
1138                 seq_putc(m, ',');
1139                 seq_puts(m, SECLABEL_STR);
1140         }
1141         return 0;
1142 }
1143
1144 static inline u16 inode_mode_to_security_class(umode_t mode)
1145 {
1146         switch (mode & S_IFMT) {
1147         case S_IFSOCK:
1148                 return SECCLASS_SOCK_FILE;
1149         case S_IFLNK:
1150                 return SECCLASS_LNK_FILE;
1151         case S_IFREG:
1152                 return SECCLASS_FILE;
1153         case S_IFBLK:
1154                 return SECCLASS_BLK_FILE;
1155         case S_IFDIR:
1156                 return SECCLASS_DIR;
1157         case S_IFCHR:
1158                 return SECCLASS_CHR_FILE;
1159         case S_IFIFO:
1160                 return SECCLASS_FIFO_FILE;
1161
1162         }
1163
1164         return SECCLASS_FILE;
1165 }
1166
1167 static inline int default_protocol_stream(int protocol)
1168 {
1169         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1170 }
1171
1172 static inline int default_protocol_dgram(int protocol)
1173 {
1174         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1175 }
1176
1177 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1178 {
1179         int extsockclass = selinux_policycap_extsockclass();
1180
1181         switch (family) {
1182         case PF_UNIX:
1183                 switch (type) {
1184                 case SOCK_STREAM:
1185                 case SOCK_SEQPACKET:
1186                         return SECCLASS_UNIX_STREAM_SOCKET;
1187                 case SOCK_DGRAM:
1188                 case SOCK_RAW:
1189                         return SECCLASS_UNIX_DGRAM_SOCKET;
1190                 }
1191                 break;
1192         case PF_INET:
1193         case PF_INET6:
1194                 switch (type) {
1195                 case SOCK_STREAM:
1196                 case SOCK_SEQPACKET:
1197                         if (default_protocol_stream(protocol))
1198                                 return SECCLASS_TCP_SOCKET;
1199                         else if (extsockclass && protocol == IPPROTO_SCTP)
1200                                 return SECCLASS_SCTP_SOCKET;
1201                         else
1202                                 return SECCLASS_RAWIP_SOCKET;
1203                 case SOCK_DGRAM:
1204                         if (default_protocol_dgram(protocol))
1205                                 return SECCLASS_UDP_SOCKET;
1206                         else if (extsockclass && (protocol == IPPROTO_ICMP ||
1207                                                   protocol == IPPROTO_ICMPV6))
1208                                 return SECCLASS_ICMP_SOCKET;
1209                         else
1210                                 return SECCLASS_RAWIP_SOCKET;
1211                 case SOCK_DCCP:
1212                         return SECCLASS_DCCP_SOCKET;
1213                 default:
1214                         return SECCLASS_RAWIP_SOCKET;
1215                 }
1216                 break;
1217         case PF_NETLINK:
1218                 switch (protocol) {
1219                 case NETLINK_ROUTE:
1220                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1221                 case NETLINK_SOCK_DIAG:
1222                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1223                 case NETLINK_NFLOG:
1224                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1225                 case NETLINK_XFRM:
1226                         return SECCLASS_NETLINK_XFRM_SOCKET;
1227                 case NETLINK_SELINUX:
1228                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1229                 case NETLINK_ISCSI:
1230                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1231                 case NETLINK_AUDIT:
1232                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1233                 case NETLINK_FIB_LOOKUP:
1234                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1235                 case NETLINK_CONNECTOR:
1236                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1237                 case NETLINK_NETFILTER:
1238                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1239                 case NETLINK_DNRTMSG:
1240                         return SECCLASS_NETLINK_DNRT_SOCKET;
1241                 case NETLINK_KOBJECT_UEVENT:
1242                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1243                 case NETLINK_GENERIC:
1244                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1245                 case NETLINK_SCSITRANSPORT:
1246                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1247                 case NETLINK_RDMA:
1248                         return SECCLASS_NETLINK_RDMA_SOCKET;
1249                 case NETLINK_CRYPTO:
1250                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1251                 default:
1252                         return SECCLASS_NETLINK_SOCKET;
1253                 }
1254         case PF_PACKET:
1255                 return SECCLASS_PACKET_SOCKET;
1256         case PF_KEY:
1257                 return SECCLASS_KEY_SOCKET;
1258         case PF_APPLETALK:
1259                 return SECCLASS_APPLETALK_SOCKET;
1260         }
1261
1262         if (extsockclass) {
1263                 switch (family) {
1264                 case PF_AX25:
1265                         return SECCLASS_AX25_SOCKET;
1266                 case PF_IPX:
1267                         return SECCLASS_IPX_SOCKET;
1268                 case PF_NETROM:
1269                         return SECCLASS_NETROM_SOCKET;
1270                 case PF_ATMPVC:
1271                         return SECCLASS_ATMPVC_SOCKET;
1272                 case PF_X25:
1273                         return SECCLASS_X25_SOCKET;
1274                 case PF_ROSE:
1275                         return SECCLASS_ROSE_SOCKET;
1276                 case PF_DECnet:
1277                         return SECCLASS_DECNET_SOCKET;
1278                 case PF_ATMSVC:
1279                         return SECCLASS_ATMSVC_SOCKET;
1280                 case PF_RDS:
1281                         return SECCLASS_RDS_SOCKET;
1282                 case PF_IRDA:
1283                         return SECCLASS_IRDA_SOCKET;
1284                 case PF_PPPOX:
1285                         return SECCLASS_PPPOX_SOCKET;
1286                 case PF_LLC:
1287                         return SECCLASS_LLC_SOCKET;
1288                 case PF_CAN:
1289                         return SECCLASS_CAN_SOCKET;
1290                 case PF_TIPC:
1291                         return SECCLASS_TIPC_SOCKET;
1292                 case PF_BLUETOOTH:
1293                         return SECCLASS_BLUETOOTH_SOCKET;
1294                 case PF_IUCV:
1295                         return SECCLASS_IUCV_SOCKET;
1296                 case PF_RXRPC:
1297                         return SECCLASS_RXRPC_SOCKET;
1298                 case PF_ISDN:
1299                         return SECCLASS_ISDN_SOCKET;
1300                 case PF_PHONET:
1301                         return SECCLASS_PHONET_SOCKET;
1302                 case PF_IEEE802154:
1303                         return SECCLASS_IEEE802154_SOCKET;
1304                 case PF_CAIF:
1305                         return SECCLASS_CAIF_SOCKET;
1306                 case PF_ALG:
1307                         return SECCLASS_ALG_SOCKET;
1308                 case PF_NFC:
1309                         return SECCLASS_NFC_SOCKET;
1310                 case PF_VSOCK:
1311                         return SECCLASS_VSOCK_SOCKET;
1312                 case PF_KCM:
1313                         return SECCLASS_KCM_SOCKET;
1314                 case PF_QIPCRTR:
1315                         return SECCLASS_QIPCRTR_SOCKET;
1316                 case PF_SMC:
1317                         return SECCLASS_SMC_SOCKET;
1318                 case PF_XDP:
1319                         return SECCLASS_XDP_SOCKET;
1320 #if PF_MAX > 45
1321 #error New address family defined, please update this function.
1322 #endif
1323                 }
1324         }
1325
1326         return SECCLASS_SOCKET;
1327 }
1328
1329 static int selinux_genfs_get_sid(struct dentry *dentry,
1330                                  u16 tclass,
1331                                  u16 flags,
1332                                  u32 *sid)
1333 {
1334         int rc;
1335         struct super_block *sb = dentry->d_sb;
1336         char *buffer, *path;
1337
1338         buffer = (char *)__get_free_page(GFP_KERNEL);
1339         if (!buffer)
1340                 return -ENOMEM;
1341
1342         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1343         if (IS_ERR(path))
1344                 rc = PTR_ERR(path);
1345         else {
1346                 if (flags & SE_SBPROC) {
1347                         /* each process gets a /proc/PID/ entry. Strip off the
1348                          * PID part to get a valid selinux labeling.
1349                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1350                         while (path[1] >= '0' && path[1] <= '9') {
1351                                 path[1] = '/';
1352                                 path++;
1353                         }
1354                 }
1355                 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1356                                         path, tclass, sid);
1357                 if (rc == -ENOENT) {
1358                         /* No match in policy, mark as unlabeled. */
1359                         *sid = SECINITSID_UNLABELED;
1360                         rc = 0;
1361                 }
1362         }
1363         free_page((unsigned long)buffer);
1364         return rc;
1365 }
1366
1367 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1368                                   u32 def_sid, u32 *sid)
1369 {
1370 #define INITCONTEXTLEN 255
1371         char *context;
1372         unsigned int len;
1373         int rc;
1374
1375         len = INITCONTEXTLEN;
1376         context = kmalloc(len + 1, GFP_NOFS);
1377         if (!context)
1378                 return -ENOMEM;
1379
1380         context[len] = '\0';
1381         rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1382         if (rc == -ERANGE) {
1383                 kfree(context);
1384
1385                 /* Need a larger buffer.  Query for the right size. */
1386                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1387                 if (rc < 0)
1388                         return rc;
1389
1390                 len = rc;
1391                 context = kmalloc(len + 1, GFP_NOFS);
1392                 if (!context)
1393                         return -ENOMEM;
1394
1395                 context[len] = '\0';
1396                 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1397                                     context, len);
1398         }
1399         if (rc < 0) {
1400                 kfree(context);
1401                 if (rc != -ENODATA) {
1402                         pr_warn("SELinux: %s:  getxattr returned %d for dev=%s ino=%ld\n",
1403                                 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1404                         return rc;
1405                 }
1406                 *sid = def_sid;
1407                 return 0;
1408         }
1409
1410         rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1411                                              def_sid, GFP_NOFS);
1412         if (rc) {
1413                 char *dev = inode->i_sb->s_id;
1414                 unsigned long ino = inode->i_ino;
1415
1416                 if (rc == -EINVAL) {
1417                         pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s.  This indicates you may need to relabel the inode or the filesystem in question.\n",
1418                                               ino, dev, context);
1419                 } else {
1420                         pr_warn("SELinux: %s:  context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1421                                 __func__, context, -rc, dev, ino);
1422                 }
1423         }
1424         kfree(context);
1425         return 0;
1426 }
1427
1428 /* The inode's security attributes must be initialized before first use. */
1429 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1430 {
1431         struct superblock_security_struct *sbsec = NULL;
1432         struct inode_security_struct *isec = selinux_inode(inode);
1433         u32 task_sid, sid = 0;
1434         u16 sclass;
1435         struct dentry *dentry;
1436         int rc = 0;
1437
1438         if (isec->initialized == LABEL_INITIALIZED)
1439                 return 0;
1440
1441         spin_lock(&isec->lock);
1442         if (isec->initialized == LABEL_INITIALIZED)
1443                 goto out_unlock;
1444
1445         if (isec->sclass == SECCLASS_FILE)
1446                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1447
1448         sbsec = inode->i_sb->s_security;
1449         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1450                 /* Defer initialization until selinux_complete_init,
1451                    after the initial policy is loaded and the security
1452                    server is ready to handle calls. */
1453                 spin_lock(&sbsec->isec_lock);
1454                 if (list_empty(&isec->list))
1455                         list_add(&isec->list, &sbsec->isec_head);
1456                 spin_unlock(&sbsec->isec_lock);
1457                 goto out_unlock;
1458         }
1459
1460         sclass = isec->sclass;
1461         task_sid = isec->task_sid;
1462         sid = isec->sid;
1463         isec->initialized = LABEL_PENDING;
1464         spin_unlock(&isec->lock);
1465
1466         switch (sbsec->behavior) {
1467         case SECURITY_FS_USE_NATIVE:
1468                 break;
1469         case SECURITY_FS_USE_XATTR:
1470                 if (!(inode->i_opflags & IOP_XATTR)) {
1471                         sid = sbsec->def_sid;
1472                         break;
1473                 }
1474                 /* Need a dentry, since the xattr API requires one.
1475                    Life would be simpler if we could just pass the inode. */
1476                 if (opt_dentry) {
1477                         /* Called from d_instantiate or d_splice_alias. */
1478                         dentry = dget(opt_dentry);
1479                 } else {
1480                         /*
1481                          * Called from selinux_complete_init, try to find a dentry.
1482                          * Some filesystems really want a connected one, so try
1483                          * that first.  We could split SECURITY_FS_USE_XATTR in
1484                          * two, depending upon that...
1485                          */
1486                         dentry = d_find_alias(inode);
1487                         if (!dentry)
1488                                 dentry = d_find_any_alias(inode);
1489                 }
1490                 if (!dentry) {
1491                         /*
1492                          * this is can be hit on boot when a file is accessed
1493                          * before the policy is loaded.  When we load policy we
1494                          * may find inodes that have no dentry on the
1495                          * sbsec->isec_head list.  No reason to complain as these
1496                          * will get fixed up the next time we go through
1497                          * inode_doinit with a dentry, before these inodes could
1498                          * be used again by userspace.
1499                          */
1500                         goto out;
1501                 }
1502
1503                 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1504                                             &sid);
1505                 dput(dentry);
1506                 if (rc)
1507                         goto out;
1508                 break;
1509         case SECURITY_FS_USE_TASK:
1510                 sid = task_sid;
1511                 break;
1512         case SECURITY_FS_USE_TRANS:
1513                 /* Default to the fs SID. */
1514                 sid = sbsec->sid;
1515
1516                 /* Try to obtain a transition SID. */
1517                 rc = security_transition_sid(&selinux_state, task_sid, sid,
1518                                              sclass, NULL, &sid);
1519                 if (rc)
1520                         goto out;
1521                 break;
1522         case SECURITY_FS_USE_MNTPOINT:
1523                 sid = sbsec->mntpoint_sid;
1524                 break;
1525         default:
1526                 /* Default to the fs superblock SID. */
1527                 sid = sbsec->sid;
1528
1529                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1530                         /* We must have a dentry to determine the label on
1531                          * procfs inodes */
1532                         if (opt_dentry) {
1533                                 /* Called from d_instantiate or
1534                                  * d_splice_alias. */
1535                                 dentry = dget(opt_dentry);
1536                         } else {
1537                                 /* Called from selinux_complete_init, try to
1538                                  * find a dentry.  Some filesystems really want
1539                                  * a connected one, so try that first.
1540                                  */
1541                                 dentry = d_find_alias(inode);
1542                                 if (!dentry)
1543                                         dentry = d_find_any_alias(inode);
1544                         }
1545                         /*
1546                          * This can be hit on boot when a file is accessed
1547                          * before the policy is loaded.  When we load policy we
1548                          * may find inodes that have no dentry on the
1549                          * sbsec->isec_head list.  No reason to complain as
1550                          * these will get fixed up the next time we go through
1551                          * inode_doinit() with a dentry, before these inodes
1552                          * could be used again by userspace.
1553                          */
1554                         if (!dentry)
1555                                 goto out;
1556                         rc = selinux_genfs_get_sid(dentry, sclass,
1557                                                    sbsec->flags, &sid);
1558                         if (rc) {
1559                                 dput(dentry);
1560                                 goto out;
1561                         }
1562
1563                         if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1564                             (inode->i_opflags & IOP_XATTR)) {
1565                                 rc = inode_doinit_use_xattr(inode, dentry,
1566                                                             sid, &sid);
1567                                 if (rc) {
1568                                         dput(dentry);
1569                                         goto out;
1570                                 }
1571                         }
1572                         dput(dentry);
1573                 }
1574                 break;
1575         }
1576
1577 out:
1578         spin_lock(&isec->lock);
1579         if (isec->initialized == LABEL_PENDING) {
1580                 if (!sid || rc) {
1581                         isec->initialized = LABEL_INVALID;
1582                         goto out_unlock;
1583                 }
1584
1585                 isec->initialized = LABEL_INITIALIZED;
1586                 isec->sid = sid;
1587         }
1588
1589 out_unlock:
1590         spin_unlock(&isec->lock);
1591         return rc;
1592 }
1593
1594 /* Convert a Linux signal to an access vector. */
1595 static inline u32 signal_to_av(int sig)
1596 {
1597         u32 perm = 0;
1598
1599         switch (sig) {
1600         case SIGCHLD:
1601                 /* Commonly granted from child to parent. */
1602                 perm = PROCESS__SIGCHLD;
1603                 break;
1604         case SIGKILL:
1605                 /* Cannot be caught or ignored */
1606                 perm = PROCESS__SIGKILL;
1607                 break;
1608         case SIGSTOP:
1609                 /* Cannot be caught or ignored */
1610                 perm = PROCESS__SIGSTOP;
1611                 break;
1612         default:
1613                 /* All other signals. */
1614                 perm = PROCESS__SIGNAL;
1615                 break;
1616         }
1617
1618         return perm;
1619 }
1620
1621 #if CAP_LAST_CAP > 63
1622 #error Fix SELinux to handle capabilities > 63.
1623 #endif
1624
1625 /* Check whether a task is allowed to use a capability. */
1626 static int cred_has_capability(const struct cred *cred,
1627                                int cap, unsigned int opts, bool initns)
1628 {
1629         struct common_audit_data ad;
1630         struct av_decision avd;
1631         u16 sclass;
1632         u32 sid = cred_sid(cred);
1633         u32 av = CAP_TO_MASK(cap);
1634         int rc;
1635
1636         ad.type = LSM_AUDIT_DATA_CAP;
1637         ad.u.cap = cap;
1638
1639         switch (CAP_TO_INDEX(cap)) {
1640         case 0:
1641                 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1642                 break;
1643         case 1:
1644                 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1645                 break;
1646         default:
1647                 pr_err("SELinux:  out of range capability %d\n", cap);
1648                 BUG();
1649                 return -EINVAL;
1650         }
1651
1652         rc = avc_has_perm_noaudit(&selinux_state,
1653                                   sid, sid, sclass, av, 0, &avd);
1654         if (!(opts & CAP_OPT_NOAUDIT)) {
1655                 int rc2 = avc_audit(&selinux_state,
1656                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
1657                 if (rc2)
1658                         return rc2;
1659         }
1660         return rc;
1661 }
1662
1663 /* Check whether a task has a particular permission to an inode.
1664    The 'adp' parameter is optional and allows other audit
1665    data to be passed (e.g. the dentry). */
1666 static int inode_has_perm(const struct cred *cred,
1667                           struct inode *inode,
1668                           u32 perms,
1669                           struct common_audit_data *adp)
1670 {
1671         struct inode_security_struct *isec;
1672         u32 sid;
1673
1674         validate_creds(cred);
1675
1676         if (unlikely(IS_PRIVATE(inode)))
1677                 return 0;
1678
1679         sid = cred_sid(cred);
1680         isec = selinux_inode(inode);
1681
1682         return avc_has_perm(&selinux_state,
1683                             sid, isec->sid, isec->sclass, perms, adp);
1684 }
1685
1686 /* Same as inode_has_perm, but pass explicit audit data containing
1687    the dentry to help the auditing code to more easily generate the
1688    pathname if needed. */
1689 static inline int dentry_has_perm(const struct cred *cred,
1690                                   struct dentry *dentry,
1691                                   u32 av)
1692 {
1693         struct inode *inode = d_backing_inode(dentry);
1694         struct common_audit_data ad;
1695
1696         ad.type = LSM_AUDIT_DATA_DENTRY;
1697         ad.u.dentry = dentry;
1698         __inode_security_revalidate(inode, dentry, true);
1699         return inode_has_perm(cred, inode, av, &ad);
1700 }
1701
1702 /* Same as inode_has_perm, but pass explicit audit data containing
1703    the path to help the auditing code to more easily generate the
1704    pathname if needed. */
1705 static inline int path_has_perm(const struct cred *cred,
1706                                 const struct path *path,
1707                                 u32 av)
1708 {
1709         struct inode *inode = d_backing_inode(path->dentry);
1710         struct common_audit_data ad;
1711
1712         ad.type = LSM_AUDIT_DATA_PATH;
1713         ad.u.path = *path;
1714         __inode_security_revalidate(inode, path->dentry, true);
1715         return inode_has_perm(cred, inode, av, &ad);
1716 }
1717
1718 /* Same as path_has_perm, but uses the inode from the file struct. */
1719 static inline int file_path_has_perm(const struct cred *cred,
1720                                      struct file *file,
1721                                      u32 av)
1722 {
1723         struct common_audit_data ad;
1724
1725         ad.type = LSM_AUDIT_DATA_FILE;
1726         ad.u.file = file;
1727         return inode_has_perm(cred, file_inode(file), av, &ad);
1728 }
1729
1730 #ifdef CONFIG_BPF_SYSCALL
1731 static int bpf_fd_pass(struct file *file, u32 sid);
1732 #endif
1733
1734 /* Check whether a task can use an open file descriptor to
1735    access an inode in a given way.  Check access to the
1736    descriptor itself, and then use dentry_has_perm to
1737    check a particular permission to the file.
1738    Access to the descriptor is implicitly granted if it
1739    has the same SID as the process.  If av is zero, then
1740    access to the file is not checked, e.g. for cases
1741    where only the descriptor is affected like seek. */
1742 static int file_has_perm(const struct cred *cred,
1743                          struct file *file,
1744                          u32 av)
1745 {
1746         struct file_security_struct *fsec = selinux_file(file);
1747         struct inode *inode = file_inode(file);
1748         struct common_audit_data ad;
1749         u32 sid = cred_sid(cred);
1750         int rc;
1751
1752         ad.type = LSM_AUDIT_DATA_FILE;
1753         ad.u.file = file;
1754
1755         if (sid != fsec->sid) {
1756                 rc = avc_has_perm(&selinux_state,
1757                                   sid, fsec->sid,
1758                                   SECCLASS_FD,
1759                                   FD__USE,
1760                                   &ad);
1761                 if (rc)
1762                         goto out;
1763         }
1764
1765 #ifdef CONFIG_BPF_SYSCALL
1766         rc = bpf_fd_pass(file, cred_sid(cred));
1767         if (rc)
1768                 return rc;
1769 #endif
1770
1771         /* av is zero if only checking access to the descriptor. */
1772         rc = 0;
1773         if (av)
1774                 rc = inode_has_perm(cred, inode, av, &ad);
1775
1776 out:
1777         return rc;
1778 }
1779
1780 /*
1781  * Determine the label for an inode that might be unioned.
1782  */
1783 static int
1784 selinux_determine_inode_label(const struct task_security_struct *tsec,
1785                                  struct inode *dir,
1786                                  const struct qstr *name, u16 tclass,
1787                                  u32 *_new_isid)
1788 {
1789         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1790
1791         if ((sbsec->flags & SE_SBINITIALIZED) &&
1792             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1793                 *_new_isid = sbsec->mntpoint_sid;
1794         } else if ((sbsec->flags & SBLABEL_MNT) &&
1795                    tsec->create_sid) {
1796                 *_new_isid = tsec->create_sid;
1797         } else {
1798                 const struct inode_security_struct *dsec = inode_security(dir);
1799                 return security_transition_sid(&selinux_state, tsec->sid,
1800                                                dsec->sid, tclass,
1801                                                name, _new_isid);
1802         }
1803
1804         return 0;
1805 }
1806
1807 /* Check whether a task can create a file. */
1808 static int may_create(struct inode *dir,
1809                       struct dentry *dentry,
1810                       u16 tclass)
1811 {
1812         const struct task_security_struct *tsec = selinux_cred(current_cred());
1813         struct inode_security_struct *dsec;
1814         struct superblock_security_struct *sbsec;
1815         u32 sid, newsid;
1816         struct common_audit_data ad;
1817         int rc;
1818
1819         dsec = inode_security(dir);
1820         sbsec = dir->i_sb->s_security;
1821
1822         sid = tsec->sid;
1823
1824         ad.type = LSM_AUDIT_DATA_DENTRY;
1825         ad.u.dentry = dentry;
1826
1827         rc = avc_has_perm(&selinux_state,
1828                           sid, dsec->sid, SECCLASS_DIR,
1829                           DIR__ADD_NAME | DIR__SEARCH,
1830                           &ad);
1831         if (rc)
1832                 return rc;
1833
1834         rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1835                                            &dentry->d_name, tclass, &newsid);
1836         if (rc)
1837                 return rc;
1838
1839         rc = avc_has_perm(&selinux_state,
1840                           sid, newsid, tclass, FILE__CREATE, &ad);
1841         if (rc)
1842                 return rc;
1843
1844         return avc_has_perm(&selinux_state,
1845                             newsid, sbsec->sid,
1846                             SECCLASS_FILESYSTEM,
1847                             FILESYSTEM__ASSOCIATE, &ad);
1848 }
1849
1850 #define MAY_LINK        0
1851 #define MAY_UNLINK      1
1852 #define MAY_RMDIR       2
1853
1854 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1855 static int may_link(struct inode *dir,
1856                     struct dentry *dentry,
1857                     int kind)
1858
1859 {
1860         struct inode_security_struct *dsec, *isec;
1861         struct common_audit_data ad;
1862         u32 sid = current_sid();
1863         u32 av;
1864         int rc;
1865
1866         dsec = inode_security(dir);
1867         isec = backing_inode_security(dentry);
1868
1869         ad.type = LSM_AUDIT_DATA_DENTRY;
1870         ad.u.dentry = dentry;
1871
1872         av = DIR__SEARCH;
1873         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1874         rc = avc_has_perm(&selinux_state,
1875                           sid, dsec->sid, SECCLASS_DIR, av, &ad);
1876         if (rc)
1877                 return rc;
1878
1879         switch (kind) {
1880         case MAY_LINK:
1881                 av = FILE__LINK;
1882                 break;
1883         case MAY_UNLINK:
1884                 av = FILE__UNLINK;
1885                 break;
1886         case MAY_RMDIR:
1887                 av = DIR__RMDIR;
1888                 break;
1889         default:
1890                 pr_warn("SELinux: %s:  unrecognized kind %d\n",
1891                         __func__, kind);
1892                 return 0;
1893         }
1894
1895         rc = avc_has_perm(&selinux_state,
1896                           sid, isec->sid, isec->sclass, av, &ad);
1897         return rc;
1898 }
1899
1900 static inline int may_rename(struct inode *old_dir,
1901                              struct dentry *old_dentry,
1902                              struct inode *new_dir,
1903                              struct dentry *new_dentry)
1904 {
1905         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1906         struct common_audit_data ad;
1907         u32 sid = current_sid();
1908         u32 av;
1909         int old_is_dir, new_is_dir;
1910         int rc;
1911
1912         old_dsec = inode_security(old_dir);
1913         old_isec = backing_inode_security(old_dentry);
1914         old_is_dir = d_is_dir(old_dentry);
1915         new_dsec = inode_security(new_dir);
1916
1917         ad.type = LSM_AUDIT_DATA_DENTRY;
1918
1919         ad.u.dentry = old_dentry;
1920         rc = avc_has_perm(&selinux_state,
1921                           sid, old_dsec->sid, SECCLASS_DIR,
1922                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1923         if (rc)
1924                 return rc;
1925         rc = avc_has_perm(&selinux_state,
1926                           sid, old_isec->sid,
1927                           old_isec->sclass, FILE__RENAME, &ad);
1928         if (rc)
1929                 return rc;
1930         if (old_is_dir && new_dir != old_dir) {
1931                 rc = avc_has_perm(&selinux_state,
1932                                   sid, old_isec->sid,
1933                                   old_isec->sclass, DIR__REPARENT, &ad);
1934                 if (rc)
1935                         return rc;
1936         }
1937
1938         ad.u.dentry = new_dentry;
1939         av = DIR__ADD_NAME | DIR__SEARCH;
1940         if (d_is_positive(new_dentry))
1941                 av |= DIR__REMOVE_NAME;
1942         rc = avc_has_perm(&selinux_state,
1943                           sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1944         if (rc)
1945                 return rc;
1946         if (d_is_positive(new_dentry)) {
1947                 new_isec = backing_inode_security(new_dentry);
1948                 new_is_dir = d_is_dir(new_dentry);
1949                 rc = avc_has_perm(&selinux_state,
1950                                   sid, new_isec->sid,
1951                                   new_isec->sclass,
1952                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1953                 if (rc)
1954                         return rc;
1955         }
1956
1957         return 0;
1958 }
1959
1960 /* Check whether a task can perform a filesystem operation. */
1961 static int superblock_has_perm(const struct cred *cred,
1962                                struct super_block *sb,
1963                                u32 perms,
1964                                struct common_audit_data *ad)
1965 {
1966         struct superblock_security_struct *sbsec;
1967         u32 sid = cred_sid(cred);
1968
1969         sbsec = sb->s_security;
1970         return avc_has_perm(&selinux_state,
1971                             sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1972 }
1973
1974 /* Convert a Linux mode and permission mask to an access vector. */
1975 static inline u32 file_mask_to_av(int mode, int mask)
1976 {
1977         u32 av = 0;
1978
1979         if (!S_ISDIR(mode)) {
1980                 if (mask & MAY_EXEC)
1981                         av |= FILE__EXECUTE;
1982                 if (mask & MAY_READ)
1983                         av |= FILE__READ;
1984
1985                 if (mask & MAY_APPEND)
1986                         av |= FILE__APPEND;
1987                 else if (mask & MAY_WRITE)
1988                         av |= FILE__WRITE;
1989
1990         } else {
1991                 if (mask & MAY_EXEC)
1992                         av |= DIR__SEARCH;
1993                 if (mask & MAY_WRITE)
1994                         av |= DIR__WRITE;
1995                 if (mask & MAY_READ)
1996                         av |= DIR__READ;
1997         }
1998
1999         return av;
2000 }
2001
2002 /* Convert a Linux file to an access vector. */
2003 static inline u32 file_to_av(struct file *file)
2004 {
2005         u32 av = 0;
2006
2007         if (file->f_mode & FMODE_READ)
2008                 av |= FILE__READ;
2009         if (file->f_mode & FMODE_WRITE) {
2010                 if (file->f_flags & O_APPEND)
2011                         av |= FILE__APPEND;
2012                 else
2013                         av |= FILE__WRITE;
2014         }
2015         if (!av) {
2016                 /*
2017                  * Special file opened with flags 3 for ioctl-only use.
2018                  */
2019                 av = FILE__IOCTL;
2020         }
2021
2022         return av;
2023 }
2024
2025 /*
2026  * Convert a file to an access vector and include the correct open
2027  * open permission.
2028  */
2029 static inline u32 open_file_to_av(struct file *file)
2030 {
2031         u32 av = file_to_av(file);
2032         struct inode *inode = file_inode(file);
2033
2034         if (selinux_policycap_openperm() &&
2035             inode->i_sb->s_magic != SOCKFS_MAGIC)
2036                 av |= FILE__OPEN;
2037
2038         return av;
2039 }
2040
2041 /* Hook functions begin here. */
2042
2043 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2044 {
2045         u32 mysid = current_sid();
2046         u32 mgrsid = task_sid(mgr);
2047
2048         return avc_has_perm(&selinux_state,
2049                             mysid, mgrsid, SECCLASS_BINDER,
2050                             BINDER__SET_CONTEXT_MGR, NULL);
2051 }
2052
2053 static int selinux_binder_transaction(struct task_struct *from,
2054                                       struct task_struct *to)
2055 {
2056         u32 mysid = current_sid();
2057         u32 fromsid = task_sid(from);
2058         u32 tosid = task_sid(to);
2059         int rc;
2060
2061         if (mysid != fromsid) {
2062                 rc = avc_has_perm(&selinux_state,
2063                                   mysid, fromsid, SECCLASS_BINDER,
2064                                   BINDER__IMPERSONATE, NULL);
2065                 if (rc)
2066                         return rc;
2067         }
2068
2069         return avc_has_perm(&selinux_state,
2070                             fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2071                             NULL);
2072 }
2073
2074 static int selinux_binder_transfer_binder(struct task_struct *from,
2075                                           struct task_struct *to)
2076 {
2077         u32 fromsid = task_sid(from);
2078         u32 tosid = task_sid(to);
2079
2080         return avc_has_perm(&selinux_state,
2081                             fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2082                             NULL);
2083 }
2084
2085 static int selinux_binder_transfer_file(struct task_struct *from,
2086                                         struct task_struct *to,
2087                                         struct file *file)
2088 {
2089         u32 sid = task_sid(to);
2090         struct file_security_struct *fsec = selinux_file(file);
2091         struct dentry *dentry = file->f_path.dentry;
2092         struct inode_security_struct *isec;
2093         struct common_audit_data ad;
2094         int rc;
2095
2096         ad.type = LSM_AUDIT_DATA_PATH;
2097         ad.u.path = file->f_path;
2098
2099         if (sid != fsec->sid) {
2100                 rc = avc_has_perm(&selinux_state,
2101                                   sid, fsec->sid,
2102                                   SECCLASS_FD,
2103                                   FD__USE,
2104                                   &ad);
2105                 if (rc)
2106                         return rc;
2107         }
2108
2109 #ifdef CONFIG_BPF_SYSCALL
2110         rc = bpf_fd_pass(file, sid);
2111         if (rc)
2112                 return rc;
2113 #endif
2114
2115         if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2116                 return 0;
2117
2118         isec = backing_inode_security(dentry);
2119         return avc_has_perm(&selinux_state,
2120                             sid, isec->sid, isec->sclass, file_to_av(file),
2121                             &ad);
2122 }
2123
2124 static int selinux_ptrace_access_check(struct task_struct *child,
2125                                      unsigned int mode)
2126 {
2127         u32 sid = current_sid();
2128         u32 csid = task_sid(child);
2129
2130         if (mode & PTRACE_MODE_READ)
2131                 return avc_has_perm(&selinux_state,
2132                                     sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2133
2134         return avc_has_perm(&selinux_state,
2135                             sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2136 }
2137
2138 static int selinux_ptrace_traceme(struct task_struct *parent)
2139 {
2140         return avc_has_perm(&selinux_state,
2141                             task_sid(parent), current_sid(), SECCLASS_PROCESS,
2142                             PROCESS__PTRACE, NULL);
2143 }
2144
2145 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2146                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2147 {
2148         return avc_has_perm(&selinux_state,
2149                             current_sid(), task_sid(target), SECCLASS_PROCESS,
2150                             PROCESS__GETCAP, NULL);
2151 }
2152
2153 static int selinux_capset(struct cred *new, const struct cred *old,
2154                           const kernel_cap_t *effective,
2155                           const kernel_cap_t *inheritable,
2156                           const kernel_cap_t *permitted)
2157 {
2158         return avc_has_perm(&selinux_state,
2159                             cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2160                             PROCESS__SETCAP, NULL);
2161 }
2162
2163 /*
2164  * (This comment used to live with the selinux_task_setuid hook,
2165  * which was removed).
2166  *
2167  * Since setuid only affects the current process, and since the SELinux
2168  * controls are not based on the Linux identity attributes, SELinux does not
2169  * need to control this operation.  However, SELinux does control the use of
2170  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2171  */
2172
2173 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2174                            int cap, unsigned int opts)
2175 {
2176         return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2177 }
2178
2179 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2180 {
2181         const struct cred *cred = current_cred();
2182         int rc = 0;
2183
2184         if (!sb)
2185                 return 0;
2186
2187         switch (cmds) {
2188         case Q_SYNC:
2189         case Q_QUOTAON:
2190         case Q_QUOTAOFF:
2191         case Q_SETINFO:
2192         case Q_SETQUOTA:
2193                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2194                 break;
2195         case Q_GETFMT:
2196         case Q_GETINFO:
2197         case Q_GETQUOTA:
2198                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2199                 break;
2200         default:
2201                 rc = 0;  /* let the kernel handle invalid cmds */
2202                 break;
2203         }
2204         return rc;
2205 }
2206
2207 static int selinux_quota_on(struct dentry *dentry)
2208 {
2209         const struct cred *cred = current_cred();
2210
2211         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2212 }
2213
2214 static int selinux_syslog(int type)
2215 {
2216         switch (type) {
2217         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2218         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2219                 return avc_has_perm(&selinux_state,
2220                                     current_sid(), SECINITSID_KERNEL,
2221                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2222         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2223         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2224         /* Set level of messages printed to console */
2225         case SYSLOG_ACTION_CONSOLE_LEVEL:
2226                 return avc_has_perm(&selinux_state,
2227                                     current_sid(), SECINITSID_KERNEL,
2228                                     SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2229                                     NULL);
2230         }
2231         /* All other syslog types */
2232         return avc_has_perm(&selinux_state,
2233                             current_sid(), SECINITSID_KERNEL,
2234                             SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2235 }
2236
2237 /*
2238  * Check that a process has enough memory to allocate a new virtual
2239  * mapping. 0 means there is enough memory for the allocation to
2240  * succeed and -ENOMEM implies there is not.
2241  *
2242  * Do not audit the selinux permission check, as this is applied to all
2243  * processes that allocate mappings.
2244  */
2245 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2246 {
2247         int rc, cap_sys_admin = 0;
2248
2249         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2250                                  CAP_OPT_NOAUDIT, true);
2251         if (rc == 0)
2252                 cap_sys_admin = 1;
2253
2254         return cap_sys_admin;
2255 }
2256
2257 /* binprm security operations */
2258
2259 static u32 ptrace_parent_sid(void)
2260 {
2261         u32 sid = 0;
2262         struct task_struct *tracer;
2263
2264         rcu_read_lock();
2265         tracer = ptrace_parent(current);
2266         if (tracer)
2267                 sid = task_sid(tracer);
2268         rcu_read_unlock();
2269
2270         return sid;
2271 }
2272
2273 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2274                             const struct task_security_struct *old_tsec,
2275                             const struct task_security_struct *new_tsec)
2276 {
2277         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2278         int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2279         int rc;
2280         u32 av;
2281
2282         if (!nnp && !nosuid)
2283                 return 0; /* neither NNP nor nosuid */
2284
2285         if (new_tsec->sid == old_tsec->sid)
2286                 return 0; /* No change in credentials */
2287
2288         /*
2289          * If the policy enables the nnp_nosuid_transition policy capability,
2290          * then we permit transitions under NNP or nosuid if the
2291          * policy allows the corresponding permission between
2292          * the old and new contexts.
2293          */
2294         if (selinux_policycap_nnp_nosuid_transition()) {
2295                 av = 0;
2296                 if (nnp)
2297                         av |= PROCESS2__NNP_TRANSITION;
2298                 if (nosuid)
2299                         av |= PROCESS2__NOSUID_TRANSITION;
2300                 rc = avc_has_perm(&selinux_state,
2301                                   old_tsec->sid, new_tsec->sid,
2302                                   SECCLASS_PROCESS2, av, NULL);
2303                 if (!rc)
2304                         return 0;
2305         }
2306
2307         /*
2308          * We also permit NNP or nosuid transitions to bounded SIDs,
2309          * i.e. SIDs that are guaranteed to only be allowed a subset
2310          * of the permissions of the current SID.
2311          */
2312         rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2313                                          new_tsec->sid);
2314         if (!rc)
2315                 return 0;
2316
2317         /*
2318          * On failure, preserve the errno values for NNP vs nosuid.
2319          * NNP:  Operation not permitted for caller.
2320          * nosuid:  Permission denied to file.
2321          */
2322         if (nnp)
2323                 return -EPERM;
2324         return -EACCES;
2325 }
2326
2327 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2328 {
2329         const struct task_security_struct *old_tsec;
2330         struct task_security_struct *new_tsec;
2331         struct inode_security_struct *isec;
2332         struct common_audit_data ad;
2333         struct inode *inode = file_inode(bprm->file);
2334         int rc;
2335
2336         /* SELinux context only depends on initial program or script and not
2337          * the script interpreter */
2338         if (bprm->called_set_creds)
2339                 return 0;
2340
2341         old_tsec = selinux_cred(current_cred());
2342         new_tsec = selinux_cred(bprm->cred);
2343         isec = inode_security(inode);
2344
2345         /* Default to the current task SID. */
2346         new_tsec->sid = old_tsec->sid;
2347         new_tsec->osid = old_tsec->sid;
2348
2349         /* Reset fs, key, and sock SIDs on execve. */
2350         new_tsec->create_sid = 0;
2351         new_tsec->keycreate_sid = 0;
2352         new_tsec->sockcreate_sid = 0;
2353
2354         if (old_tsec->exec_sid) {
2355                 new_tsec->sid = old_tsec->exec_sid;
2356                 /* Reset exec SID on execve. */
2357                 new_tsec->exec_sid = 0;
2358
2359                 /* Fail on NNP or nosuid if not an allowed transition. */
2360                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2361                 if (rc)
2362                         return rc;
2363         } else {
2364                 /* Check for a default transition on this program. */
2365                 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2366                                              isec->sid, SECCLASS_PROCESS, NULL,
2367                                              &new_tsec->sid);
2368                 if (rc)
2369                         return rc;
2370
2371                 /*
2372                  * Fallback to old SID on NNP or nosuid if not an allowed
2373                  * transition.
2374                  */
2375                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2376                 if (rc)
2377                         new_tsec->sid = old_tsec->sid;
2378         }
2379
2380         ad.type = LSM_AUDIT_DATA_FILE;
2381         ad.u.file = bprm->file;
2382
2383         if (new_tsec->sid == old_tsec->sid) {
2384                 rc = avc_has_perm(&selinux_state,
2385                                   old_tsec->sid, isec->sid,
2386                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2387                 if (rc)
2388                         return rc;
2389         } else {
2390                 /* Check permissions for the transition. */
2391                 rc = avc_has_perm(&selinux_state,
2392                                   old_tsec->sid, new_tsec->sid,
2393                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2394                 if (rc)
2395                         return rc;
2396
2397                 rc = avc_has_perm(&selinux_state,
2398                                   new_tsec->sid, isec->sid,
2399                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2400                 if (rc)
2401                         return rc;
2402
2403                 /* Check for shared state */
2404                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2405                         rc = avc_has_perm(&selinux_state,
2406                                           old_tsec->sid, new_tsec->sid,
2407                                           SECCLASS_PROCESS, PROCESS__SHARE,
2408                                           NULL);
2409                         if (rc)
2410                                 return -EPERM;
2411                 }
2412
2413                 /* Make sure that anyone attempting to ptrace over a task that
2414                  * changes its SID has the appropriate permit */
2415                 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2416                         u32 ptsid = ptrace_parent_sid();
2417                         if (ptsid != 0) {
2418                                 rc = avc_has_perm(&selinux_state,
2419                                                   ptsid, new_tsec->sid,
2420                                                   SECCLASS_PROCESS,
2421                                                   PROCESS__PTRACE, NULL);
2422                                 if (rc)
2423                                         return -EPERM;
2424                         }
2425                 }
2426
2427                 /* Clear any possibly unsafe personality bits on exec: */
2428                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2429
2430                 /* Enable secure mode for SIDs transitions unless
2431                    the noatsecure permission is granted between
2432                    the two SIDs, i.e. ahp returns 0. */
2433                 rc = avc_has_perm(&selinux_state,
2434                                   old_tsec->sid, new_tsec->sid,
2435                                   SECCLASS_PROCESS, PROCESS__NOATSECURE,
2436                                   NULL);
2437                 bprm->secureexec |= !!rc;
2438         }
2439
2440         return 0;
2441 }
2442
2443 static int match_file(const void *p, struct file *file, unsigned fd)
2444 {
2445         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2446 }
2447
2448 /* Derived from fs/exec.c:flush_old_files. */
2449 static inline void flush_unauthorized_files(const struct cred *cred,
2450                                             struct files_struct *files)
2451 {
2452         struct file *file, *devnull = NULL;
2453         struct tty_struct *tty;
2454         int drop_tty = 0;
2455         unsigned n;
2456
2457         tty = get_current_tty();
2458         if (tty) {
2459                 spin_lock(&tty->files_lock);
2460                 if (!list_empty(&tty->tty_files)) {
2461                         struct tty_file_private *file_priv;
2462
2463                         /* Revalidate access to controlling tty.
2464                            Use file_path_has_perm on the tty path directly
2465                            rather than using file_has_perm, as this particular
2466                            open file may belong to another process and we are
2467                            only interested in the inode-based check here. */
2468                         file_priv = list_first_entry(&tty->tty_files,
2469                                                 struct tty_file_private, list);
2470                         file = file_priv->file;
2471                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2472                                 drop_tty = 1;
2473                 }
2474                 spin_unlock(&tty->files_lock);
2475                 tty_kref_put(tty);
2476         }
2477         /* Reset controlling tty. */
2478         if (drop_tty)
2479                 no_tty();
2480
2481         /* Revalidate access to inherited open files. */
2482         n = iterate_fd(files, 0, match_file, cred);
2483         if (!n) /* none found? */
2484                 return;
2485
2486         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2487         if (IS_ERR(devnull))
2488                 devnull = NULL;
2489         /* replace all the matching ones with this */
2490         do {
2491                 replace_fd(n - 1, devnull, 0);
2492         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2493         if (devnull)
2494                 fput(devnull);
2495 }
2496
2497 /*
2498  * Prepare a process for imminent new credential changes due to exec
2499  */
2500 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2501 {
2502         struct task_security_struct *new_tsec;
2503         struct rlimit *rlim, *initrlim;
2504         int rc, i;
2505
2506         new_tsec = selinux_cred(bprm->cred);
2507         if (new_tsec->sid == new_tsec->osid)
2508                 return;
2509
2510         /* Close files for which the new task SID is not authorized. */
2511         flush_unauthorized_files(bprm->cred, current->files);
2512
2513         /* Always clear parent death signal on SID transitions. */
2514         current->pdeath_signal = 0;
2515
2516         /* Check whether the new SID can inherit resource limits from the old
2517          * SID.  If not, reset all soft limits to the lower of the current
2518          * task's hard limit and the init task's soft limit.
2519          *
2520          * Note that the setting of hard limits (even to lower them) can be
2521          * controlled by the setrlimit check.  The inclusion of the init task's
2522          * soft limit into the computation is to avoid resetting soft limits
2523          * higher than the default soft limit for cases where the default is
2524          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525          */
2526         rc = avc_has_perm(&selinux_state,
2527                           new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2528                           PROCESS__RLIMITINH, NULL);
2529         if (rc) {
2530                 /* protect against do_prlimit() */
2531                 task_lock(current);
2532                 for (i = 0; i < RLIM_NLIMITS; i++) {
2533                         rlim = current->signal->rlim + i;
2534                         initrlim = init_task.signal->rlim + i;
2535                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2536                 }
2537                 task_unlock(current);
2538                 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2539                         update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2540         }
2541 }
2542
2543 /*
2544  * Clean up the process immediately after the installation of new credentials
2545  * due to exec
2546  */
2547 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2548 {
2549         const struct task_security_struct *tsec = selinux_cred(current_cred());
2550         struct itimerval itimer;
2551         u32 osid, sid;
2552         int rc, i;
2553
2554         osid = tsec->osid;
2555         sid = tsec->sid;
2556
2557         if (sid == osid)
2558                 return;
2559
2560         /* Check whether the new SID can inherit signal state from the old SID.
2561          * If not, clear itimers to avoid subsequent signal generation and
2562          * flush and unblock signals.
2563          *
2564          * This must occur _after_ the task SID has been updated so that any
2565          * kill done after the flush will be checked against the new SID.
2566          */
2567         rc = avc_has_perm(&selinux_state,
2568                           osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2569         if (rc) {
2570                 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2571                         memset(&itimer, 0, sizeof itimer);
2572                         for (i = 0; i < 3; i++)
2573                                 do_setitimer(i, &itimer, NULL);
2574                 }
2575                 spin_lock_irq(&current->sighand->siglock);
2576                 if (!fatal_signal_pending(current)) {
2577                         flush_sigqueue(&current->pending);
2578                         flush_sigqueue(&current->signal->shared_pending);
2579                         flush_signal_handlers(current, 1);
2580                         sigemptyset(&current->blocked);
2581                         recalc_sigpending();
2582                 }
2583                 spin_unlock_irq(&current->sighand->siglock);
2584         }
2585
2586         /* Wake up the parent if it is waiting so that it can recheck
2587          * wait permission to the new task SID. */
2588         read_lock(&tasklist_lock);
2589         __wake_up_parent(current, current->real_parent);
2590         read_unlock(&tasklist_lock);
2591 }
2592
2593 /* superblock security operations */
2594
2595 static int selinux_sb_alloc_security(struct super_block *sb)
2596 {
2597         return superblock_alloc_security(sb);
2598 }
2599
2600 static void selinux_sb_free_security(struct super_block *sb)
2601 {
2602         superblock_free_security(sb);
2603 }
2604
2605 static inline int opt_len(const char *s)
2606 {
2607         bool open_quote = false;
2608         int len;
2609         char c;
2610
2611         for (len = 0; (c = s[len]) != '\0'; len++) {
2612                 if (c == '"')
2613                         open_quote = !open_quote;
2614                 if (c == ',' && !open_quote)
2615                         break;
2616         }
2617         return len;
2618 }
2619
2620 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2621 {
2622         char *from = options;
2623         char *to = options;
2624         bool first = true;
2625         int rc;
2626
2627         while (1) {
2628                 int len = opt_len(from);
2629                 int token;
2630                 char *arg = NULL;
2631
2632                 token = match_opt_prefix(from, len, &arg);
2633
2634                 if (token != Opt_error) {
2635                         char *p, *q;
2636
2637                         /* strip quotes */
2638                         if (arg) {
2639                                 for (p = q = arg; p < from + len; p++) {
2640                                         char c = *p;
2641                                         if (c != '"')
2642                                                 *q++ = c;
2643                                 }
2644                                 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2645                                 if (!arg) {
2646                                         rc = -ENOMEM;
2647                                         goto free_opt;
2648                                 }
2649                         }
2650                         rc = selinux_add_opt(token, arg, mnt_opts);
2651                         if (unlikely(rc)) {
2652                                 kfree(arg);
2653                                 goto free_opt;
2654                         }
2655                 } else {
2656                         if (!first) {   // copy with preceding comma
2657                                 from--;
2658                                 len++;
2659                         }
2660                         if (to != from)
2661                                 memmove(to, from, len);
2662                         to += len;
2663                         first = false;
2664                 }
2665                 if (!from[len])
2666                         break;
2667                 from += len + 1;
2668         }
2669         *to = '\0';
2670         return 0;
2671
2672 free_opt:
2673         if (*mnt_opts) {
2674                 selinux_free_mnt_opts(*mnt_opts);
2675                 *mnt_opts = NULL;
2676         }
2677         return rc;
2678 }
2679
2680 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2681 {
2682         struct selinux_mnt_opts *opts = mnt_opts;
2683         struct superblock_security_struct *sbsec = sb->s_security;
2684         u32 sid;
2685         int rc;
2686
2687         if (!(sbsec->flags & SE_SBINITIALIZED))
2688                 return 0;
2689
2690         if (!opts)
2691                 return 0;
2692
2693         if (opts->fscontext) {
2694                 rc = parse_sid(sb, opts->fscontext, &sid);
2695                 if (rc)
2696                         return rc;
2697                 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2698                         goto out_bad_option;
2699         }
2700         if (opts->context) {
2701                 rc = parse_sid(sb, opts->context, &sid);
2702                 if (rc)
2703                         return rc;
2704                 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2705                         goto out_bad_option;
2706         }
2707         if (opts->rootcontext) {
2708                 struct inode_security_struct *root_isec;
2709                 root_isec = backing_inode_security(sb->s_root);
2710                 rc = parse_sid(sb, opts->rootcontext, &sid);
2711                 if (rc)
2712                         return rc;
2713                 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2714                         goto out_bad_option;
2715         }
2716         if (opts->defcontext) {
2717                 rc = parse_sid(sb, opts->defcontext, &sid);
2718                 if (rc)
2719                         return rc;
2720                 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2721                         goto out_bad_option;
2722         }
2723         return 0;
2724
2725 out_bad_option:
2726         pr_warn("SELinux: unable to change security options "
2727                "during remount (dev %s, type=%s)\n", sb->s_id,
2728                sb->s_type->name);
2729         return -EINVAL;
2730 }
2731
2732 static int selinux_sb_kern_mount(struct super_block *sb)
2733 {
2734         const struct cred *cred = current_cred();
2735         struct common_audit_data ad;
2736
2737         ad.type = LSM_AUDIT_DATA_DENTRY;
2738         ad.u.dentry = sb->s_root;
2739         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2740 }
2741
2742 static int selinux_sb_statfs(struct dentry *dentry)
2743 {
2744         const struct cred *cred = current_cred();
2745         struct common_audit_data ad;
2746
2747         ad.type = LSM_AUDIT_DATA_DENTRY;
2748         ad.u.dentry = dentry->d_sb->s_root;
2749         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2750 }
2751
2752 static int selinux_mount(const char *dev_name,
2753                          const struct path *path,
2754                          const char *type,
2755                          unsigned long flags,
2756                          void *data)
2757 {
2758         const struct cred *cred = current_cred();
2759
2760         if (flags & MS_REMOUNT)
2761                 return superblock_has_perm(cred, path->dentry->d_sb,
2762                                            FILESYSTEM__REMOUNT, NULL);
2763         else
2764                 return path_has_perm(cred, path, FILE__MOUNTON);
2765 }
2766
2767 static int selinux_umount(struct vfsmount *mnt, int flags)
2768 {
2769         const struct cred *cred = current_cred();
2770
2771         return superblock_has_perm(cred, mnt->mnt_sb,
2772                                    FILESYSTEM__UNMOUNT, NULL);
2773 }
2774
2775 static int selinux_fs_context_dup(struct fs_context *fc,
2776                                   struct fs_context *src_fc)
2777 {
2778         const struct selinux_mnt_opts *src = src_fc->security;
2779         struct selinux_mnt_opts *opts;
2780
2781         if (!src)
2782                 return 0;
2783
2784         fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2785         if (!fc->security)
2786                 return -ENOMEM;
2787
2788         opts = fc->security;
2789
2790         if (src->fscontext) {
2791                 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2792                 if (!opts->fscontext)
2793                         return -ENOMEM;
2794         }
2795         if (src->context) {
2796                 opts->context = kstrdup(src->context, GFP_KERNEL);
2797                 if (!opts->context)
2798                         return -ENOMEM;
2799         }
2800         if (src->rootcontext) {
2801                 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2802                 if (!opts->rootcontext)
2803                         return -ENOMEM;
2804         }
2805         if (src->defcontext) {
2806                 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2807                 if (!opts->defcontext)
2808                         return -ENOMEM;
2809         }
2810         return 0;
2811 }
2812
2813 static const struct fs_parameter_spec selinux_param_specs[] = {
2814         fsparam_string(CONTEXT_STR,     Opt_context),
2815         fsparam_string(DEFCONTEXT_STR,  Opt_defcontext),
2816         fsparam_string(FSCONTEXT_STR,   Opt_fscontext),
2817         fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2818         fsparam_flag  (SECLABEL_STR,    Opt_seclabel),
2819         {}
2820 };
2821
2822 static const struct fs_parameter_description selinux_fs_parameters = {
2823         .name           = "SELinux",
2824         .specs          = selinux_param_specs,
2825 };
2826
2827 static int selinux_fs_context_parse_param(struct fs_context *fc,
2828                                           struct fs_parameter *param)
2829 {
2830         struct fs_parse_result result;
2831         int opt, rc;
2832
2833         opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2834         if (opt < 0)
2835                 return opt;
2836
2837         rc = selinux_add_opt(opt, param->string, &fc->security);
2838         if (!rc) {
2839                 param->string = NULL;
2840                 rc = 1;
2841         }
2842         return rc;
2843 }
2844
2845 /* inode security operations */
2846
2847 static int selinux_inode_alloc_security(struct inode *inode)
2848 {
2849         return inode_alloc_security(inode);
2850 }
2851
2852 static void selinux_inode_free_security(struct inode *inode)
2853 {
2854         inode_free_security(inode);
2855 }
2856
2857 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2858                                         const struct qstr *name, void **ctx,
2859                                         u32 *ctxlen)
2860 {
2861         u32 newsid;
2862         int rc;
2863
2864         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2865                                            d_inode(dentry->d_parent), name,
2866                                            inode_mode_to_security_class(mode),
2867                                            &newsid);
2868         if (rc)
2869                 return rc;
2870
2871         return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2872                                        ctxlen);
2873 }
2874
2875 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2876                                           struct qstr *name,
2877                                           const struct cred *old,
2878                                           struct cred *new)
2879 {
2880         u32 newsid;
2881         int rc;
2882         struct task_security_struct *tsec;
2883
2884         rc = selinux_determine_inode_label(selinux_cred(old),
2885                                            d_inode(dentry->d_parent), name,
2886                                            inode_mode_to_security_class(mode),
2887                                            &newsid);
2888         if (rc)
2889                 return rc;
2890
2891         tsec = selinux_cred(new);
2892         tsec->create_sid = newsid;
2893         return 0;
2894 }
2895
2896 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2897                                        const struct qstr *qstr,
2898                                        const char **name,
2899                                        void **value, size_t *len)
2900 {
2901         const struct task_security_struct *tsec = selinux_cred(current_cred());
2902         struct superblock_security_struct *sbsec;
2903         u32 newsid, clen;
2904         int rc;
2905         char *context;
2906
2907         sbsec = dir->i_sb->s_security;
2908
2909         newsid = tsec->create_sid;
2910
2911         rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2912                 dir, qstr,
2913                 inode_mode_to_security_class(inode->i_mode),
2914                 &newsid);
2915         if (rc)
2916                 return rc;
2917
2918         /* Possibly defer initialization to selinux_complete_init. */
2919         if (sbsec->flags & SE_SBINITIALIZED) {
2920                 struct inode_security_struct *isec = selinux_inode(inode);
2921                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2922                 isec->sid = newsid;
2923                 isec->initialized = LABEL_INITIALIZED;
2924         }
2925
2926         if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2927                 return -EOPNOTSUPP;
2928
2929         if (name)
2930                 *name = XATTR_SELINUX_SUFFIX;
2931
2932         if (value && len) {
2933                 rc = security_sid_to_context_force(&selinux_state, newsid,
2934                                                    &context, &clen);
2935                 if (rc)
2936                         return rc;
2937                 *value = context;
2938                 *len = clen;
2939         }
2940
2941         return 0;
2942 }
2943
2944 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2945 {
2946         return may_create(dir, dentry, SECCLASS_FILE);
2947 }
2948
2949 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2950 {
2951         return may_link(dir, old_dentry, MAY_LINK);
2952 }
2953
2954 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2955 {
2956         return may_link(dir, dentry, MAY_UNLINK);
2957 }
2958
2959 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2960 {
2961         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2962 }
2963
2964 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2965 {
2966         return may_create(dir, dentry, SECCLASS_DIR);
2967 }
2968
2969 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2970 {
2971         return may_link(dir, dentry, MAY_RMDIR);
2972 }
2973
2974 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2975 {
2976         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2977 }
2978
2979 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2980                                 struct inode *new_inode, struct dentry *new_dentry)
2981 {
2982         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2983 }
2984
2985 static int selinux_inode_readlink(struct dentry *dentry)
2986 {
2987         const struct cred *cred = current_cred();
2988
2989         return dentry_has_perm(cred, dentry, FILE__READ);
2990 }
2991
2992 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2993                                      bool rcu)
2994 {
2995         const struct cred *cred = current_cred();
2996         struct common_audit_data ad;
2997         struct inode_security_struct *isec;
2998         u32 sid;
2999
3000         validate_creds(cred);
3001
3002         ad.type = LSM_AUDIT_DATA_DENTRY;
3003         ad.u.dentry = dentry;
3004         sid = cred_sid(cred);
3005         isec = inode_security_rcu(inode, rcu);
3006         if (IS_ERR(isec))
3007                 return PTR_ERR(isec);
3008
3009         return avc_has_perm(&selinux_state,
3010                             sid, isec->sid, isec->sclass, FILE__READ, &ad);
3011 }
3012
3013 static noinline int audit_inode_permission(struct inode *inode,
3014                                            u32 perms, u32 audited, u32 denied,
3015                                            int result,
3016                                            unsigned flags)
3017 {
3018         struct common_audit_data ad;
3019         struct inode_security_struct *isec = selinux_inode(inode);
3020         int rc;
3021
3022         ad.type = LSM_AUDIT_DATA_INODE;
3023         ad.u.inode = inode;
3024
3025         rc = slow_avc_audit(&selinux_state,
3026                             current_sid(), isec->sid, isec->sclass, perms,
3027                             audited, denied, result, &ad, flags);
3028         if (rc)
3029                 return rc;
3030         return 0;
3031 }
3032
3033 static int selinux_inode_permission(struct inode *inode, int mask)
3034 {
3035         const struct cred *cred = current_cred();
3036         u32 perms;
3037         bool from_access;
3038         unsigned flags = mask & MAY_NOT_BLOCK;
3039         struct inode_security_struct *isec;
3040         u32 sid;
3041         struct av_decision avd;
3042         int rc, rc2;
3043         u32 audited, denied;
3044
3045         from_access = mask & MAY_ACCESS;
3046         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3047
3048         /* No permission to check.  Existence test. */
3049         if (!mask)
3050                 return 0;
3051
3052         validate_creds(cred);
3053
3054         if (unlikely(IS_PRIVATE(inode)))
3055                 return 0;
3056
3057         perms = file_mask_to_av(inode->i_mode, mask);
3058
3059         sid = cred_sid(cred);
3060         isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3061         if (IS_ERR(isec))
3062                 return PTR_ERR(isec);
3063
3064         rc = avc_has_perm_noaudit(&selinux_state,
3065                                   sid, isec->sid, isec->sclass, perms,
3066                                   (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3067                                   &avd);
3068         audited = avc_audit_required(perms, &avd, rc,
3069                                      from_access ? FILE__AUDIT_ACCESS : 0,
3070                                      &denied);
3071         if (likely(!audited))
3072                 return rc;
3073
3074         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3075         if (rc2)
3076                 return rc2;
3077         return rc;
3078 }
3079
3080 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3081 {
3082         const struct cred *cred = current_cred();
3083         struct inode *inode = d_backing_inode(dentry);
3084         unsigned int ia_valid = iattr->ia_valid;
3085         __u32 av = FILE__WRITE;
3086
3087         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3088         if (ia_valid & ATTR_FORCE) {
3089                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3090                               ATTR_FORCE);
3091                 if (!ia_valid)
3092                         return 0;
3093         }
3094
3095         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3096                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3097                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3098
3099         if (selinux_policycap_openperm() &&
3100             inode->i_sb->s_magic != SOCKFS_MAGIC &&
3101             (ia_valid & ATTR_SIZE) &&
3102             !(ia_valid & ATTR_FILE))
3103                 av |= FILE__OPEN;
3104
3105         return dentry_has_perm(cred, dentry, av);
3106 }
3107
3108 static int selinux_inode_getattr(const struct path *path)
3109 {
3110         return path_has_perm(current_cred(), path, FILE__GETATTR);
3111 }
3112
3113 static bool has_cap_mac_admin(bool audit)
3114 {
3115         const struct cred *cred = current_cred();
3116         unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3117
3118         if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3119                 return false;
3120         if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3121                 return false;
3122         return true;
3123 }
3124
3125 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3126                                   const void *value, size_t size, int flags)
3127 {
3128         struct inode *inode = d_backing_inode(dentry);
3129         struct inode_security_struct *isec;
3130         struct superblock_security_struct *sbsec;
3131         struct common_audit_data ad;
3132         u32 newsid, sid = current_sid();
3133         int rc = 0;
3134
3135         if (strcmp(name, XATTR_NAME_SELINUX)) {
3136                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3137                 if (rc)
3138                         return rc;
3139
3140                 /* Not an attribute we recognize, so just check the
3141                    ordinary setattr permission. */
3142                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3143         }
3144
3145         sbsec = inode->i_sb->s_security;
3146         if (!(sbsec->flags & SBLABEL_MNT))
3147                 return -EOPNOTSUPP;
3148
3149         if (!inode_owner_or_capable(inode))
3150                 return -EPERM;
3151
3152         ad.type = LSM_AUDIT_DATA_DENTRY;
3153         ad.u.dentry = dentry;
3154
3155         isec = backing_inode_security(dentry);
3156         rc = avc_has_perm(&selinux_state,
3157                           sid, isec->sid, isec->sclass,
3158                           FILE__RELABELFROM, &ad);
3159         if (rc)
3160                 return rc;
3161
3162         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3163                                      GFP_KERNEL);
3164         if (rc == -EINVAL) {
3165                 if (!has_cap_mac_admin(true)) {
3166                         struct audit_buffer *ab;
3167                         size_t audit_size;
3168
3169                         /* We strip a nul only if it is at the end, otherwise the
3170                          * context contains a nul and we should audit that */
3171                         if (value) {
3172                                 const char *str = value;
3173
3174                                 if (str[size - 1] == '\0')
3175                                         audit_size = size - 1;
3176                                 else
3177                                         audit_size = size;
3178                         } else {
3179                                 audit_size = 0;
3180                         }
3181                         ab = audit_log_start(audit_context(),
3182                                              GFP_ATOMIC, AUDIT_SELINUX_ERR);
3183                         audit_log_format(ab, "op=setxattr invalid_context=");
3184                         audit_log_n_untrustedstring(ab, value, audit_size);
3185                         audit_log_end(ab);
3186
3187                         return rc;
3188                 }
3189                 rc = security_context_to_sid_force(&selinux_state, value,
3190                                                    size, &newsid);
3191         }
3192         if (rc)
3193                 return rc;
3194
3195         rc = avc_has_perm(&selinux_state,
3196                           sid, newsid, isec->sclass,
3197                           FILE__RELABELTO, &ad);
3198         if (rc)
3199                 return rc;
3200
3201         rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3202                                           sid, isec->sclass);
3203         if (rc)
3204                 return rc;
3205
3206         return avc_has_perm(&selinux_state,
3207                             newsid,
3208                             sbsec->sid,
3209                             SECCLASS_FILESYSTEM,
3210                             FILESYSTEM__ASSOCIATE,
3211                             &ad);
3212 }
3213
3214 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3215                                         const void *value, size_t size,
3216                                         int flags)
3217 {
3218         struct inode *inode = d_backing_inode(dentry);
3219         struct inode_security_struct *isec;
3220         u32 newsid;
3221         int rc;
3222
3223         if (strcmp(name, XATTR_NAME_SELINUX)) {
3224                 /* Not an attribute we recognize, so nothing to do. */
3225                 return;
3226         }
3227
3228         rc = security_context_to_sid_force(&selinux_state, value, size,
3229                                            &newsid);
3230         if (rc) {
3231                 pr_err("SELinux:  unable to map context to SID"
3232                        "for (%s, %lu), rc=%d\n",
3233                        inode->i_sb->s_id, inode->i_ino, -rc);
3234                 return;
3235         }
3236
3237         isec = backing_inode_security(dentry);
3238         spin_lock(&isec->lock);
3239         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3240         isec->sid = newsid;
3241         isec->initialized = LABEL_INITIALIZED;
3242         spin_unlock(&isec->lock);
3243
3244         return;
3245 }
3246
3247 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3248 {
3249         const struct cred *cred = current_cred();
3250
3251         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3252 }
3253
3254 static int selinux_inode_listxattr(struct dentry *dentry)
3255 {
3256         const struct cred *cred = current_cred();
3257
3258         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3259 }
3260
3261 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3262 {
3263         if (strcmp(name, XATTR_NAME_SELINUX)) {
3264                 int rc = cap_inode_removexattr(dentry, name);
3265                 if (rc)
3266                         return rc;
3267
3268                 /* Not an attribute we recognize, so just check the
3269                    ordinary setattr permission. */
3270                 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3271         }
3272
3273         /* No one is allowed to remove a SELinux security label.
3274            You can change the label, but all data must be labeled. */
3275         return -EACCES;
3276 }
3277
3278 /*
3279  * Copy the inode security context value to the user.
3280  *
3281  * Permission check is handled by selinux_inode_getxattr hook.
3282  */
3283 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3284 {
3285         u32 size;
3286         int error;
3287         char *context = NULL;
3288         struct inode_security_struct *isec;
3289
3290         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3291                 return -EOPNOTSUPP;
3292
3293         /*
3294          * If the caller has CAP_MAC_ADMIN, then get the raw context
3295          * value even if it is not defined by current policy; otherwise,
3296          * use the in-core value under current policy.
3297          * Use the non-auditing forms of the permission checks since
3298          * getxattr may be called by unprivileged processes commonly
3299          * and lack of permission just means that we fall back to the
3300          * in-core context value, not a denial.
3301          */
3302         isec = inode_security(inode);
3303         if (has_cap_mac_admin(false))
3304                 error = security_sid_to_context_force(&selinux_state,
3305                                                       isec->sid, &context,
3306                                                       &size);
3307         else
3308                 error = security_sid_to_context(&selinux_state, isec->sid,
3309                                                 &context, &size);
3310         if (error)
3311                 return error;
3312         error = size;
3313         if (alloc) {
3314                 *buffer = context;
3315                 goto out_nofree;
3316         }
3317         kfree(context);
3318 out_nofree:
3319         return error;
3320 }
3321
3322 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3323                                      const void *value, size_t size, int flags)
3324 {
3325         struct inode_security_struct *isec = inode_security_novalidate(inode);
3326         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3327         u32 newsid;
3328         int rc;
3329
3330         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3331                 return -EOPNOTSUPP;
3332
3333         if (!(sbsec->flags & SBLABEL_MNT))
3334                 return -EOPNOTSUPP;
3335
3336         if (!value || !size)
3337                 return -EACCES;
3338
3339         rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3340                                      GFP_KERNEL);
3341         if (rc)
3342                 return rc;
3343
3344         spin_lock(&isec->lock);
3345         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3346         isec->sid = newsid;
3347         isec->initialized = LABEL_INITIALIZED;
3348         spin_unlock(&isec->lock);
3349         return 0;
3350 }
3351
3352 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3353 {
3354         const int len = sizeof(XATTR_NAME_SELINUX);
3355         if (buffer && len <= buffer_size)
3356                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3357         return len;
3358 }
3359
3360 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3361 {
3362         struct inode_security_struct *isec = inode_security_novalidate(inode);
3363         *secid = isec->sid;
3364 }
3365
3366 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3367 {
3368         u32 sid;
3369         struct task_security_struct *tsec;
3370         struct cred *new_creds = *new;
3371
3372         if (new_creds == NULL) {
3373                 new_creds = prepare_creds();
3374                 if (!new_creds)
3375                         return -ENOMEM;
3376         }
3377
3378         tsec = selinux_cred(new_creds);
3379         /* Get label from overlay inode and set it in create_sid */
3380         selinux_inode_getsecid(d_inode(src), &sid);
3381         tsec->create_sid = sid;
3382         *new = new_creds;
3383         return 0;
3384 }
3385
3386 static int selinux_inode_copy_up_xattr(const char *name)
3387 {
3388         /* The copy_up hook above sets the initial context on an inode, but we
3389          * don't then want to overwrite it by blindly copying all the lower
3390          * xattrs up.  Instead, we have to filter out SELinux-related xattrs.
3391          */
3392         if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3393                 return 1; /* Discard */
3394         /*
3395          * Any other attribute apart from SELINUX is not claimed, supported
3396          * by selinux.
3397          */
3398         return -EOPNOTSUPP;
3399 }
3400
3401 /* kernfs node operations */
3402
3403 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3404                                         struct kernfs_node *kn)
3405 {
3406         const struct task_security_struct *tsec = current_security();
3407         u32 parent_sid, newsid, clen;
3408         int rc;
3409         char *context;
3410
3411         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3412         if (rc == -ENODATA)
3413                 return 0;
3414         else if (rc < 0)
3415                 return rc;
3416
3417         clen = (u32)rc;
3418         context = kmalloc(clen, GFP_KERNEL);
3419         if (!context)
3420                 return -ENOMEM;
3421
3422         rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3423         if (rc < 0) {
3424                 kfree(context);
3425                 return rc;
3426         }
3427
3428         rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3429                                      GFP_KERNEL);
3430         kfree(context);
3431         if (rc)
3432                 return rc;
3433
3434         if (tsec->create_sid) {
3435                 newsid = tsec->create_sid;
3436         } else {
3437                 u16 secclass = inode_mode_to_security_class(kn->mode);
3438                 struct qstr q;
3439
3440                 q.name = kn->name;
3441                 q.hash_len = hashlen_string(kn_dir, kn->name);
3442
3443                 rc = security_transition_sid(&selinux_state, tsec->sid,
3444                                              parent_sid, secclass, &q,
3445                                              &newsid);
3446                 if (rc)
3447                         return rc;
3448         }
3449
3450         rc = security_sid_to_context_force(&selinux_state, newsid,
3451                                            &context, &clen);
3452         if (rc)
3453                 return rc;
3454
3455         rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3456                               XATTR_CREATE);
3457         kfree(context);
3458         return rc;
3459 }
3460
3461
3462 /* file security operations */
3463
3464 static int selinux_revalidate_file_permission(struct file *file, int mask)
3465 {
3466         const struct cred *cred = current_cred();
3467         struct inode *inode = file_inode(file);
3468
3469         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3470         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3471                 mask |= MAY_APPEND;
3472
3473         return file_has_perm(cred, file,
3474                              file_mask_to_av(inode->i_mode, mask));
3475 }
3476
3477 static int selinux_file_permission(struct file *file, int mask)
3478 {
3479         struct inode *inode = file_inode(file);
3480         struct file_security_struct *fsec = selinux_file(file);
3481         struct inode_security_struct *isec;
3482         u32 sid = current_sid();
3483
3484         if (!mask)
3485                 /* No permission to check.  Existence test. */
3486                 return 0;
3487
3488         isec = inode_security(inode);
3489         if (sid == fsec->sid && fsec->isid == isec->sid &&
3490             fsec->pseqno == avc_policy_seqno(&selinux_state))
3491                 /* No change since file_open check. */
3492                 return 0;
3493
3494         return selinux_revalidate_file_permission(file, mask);
3495 }
3496
3497 static int selinux_file_alloc_security(struct file *file)
3498 {
3499         return file_alloc_security(file);
3500 }
3501
3502 /*
3503  * Check whether a task has the ioctl permission and cmd
3504  * operation to an inode.
3505  */
3506 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3507                 u32 requested, u16 cmd)
3508 {
3509         struct common_audit_data ad;
3510         struct file_security_struct *fsec = selinux_file(file);
3511         struct inode *inode = file_inode(file);
3512         struct inode_security_struct *isec;
3513         struct lsm_ioctlop_audit ioctl;
3514         u32 ssid = cred_sid(cred);
3515         int rc;
3516         u8 driver = cmd >> 8;
3517         u8 xperm = cmd & 0xff;
3518
3519         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3520         ad.u.op = &ioctl;
3521         ad.u.op->cmd = cmd;
3522         ad.u.op->path = file->f_path;
3523
3524         if (ssid != fsec->sid) {
3525                 rc = avc_has_perm(&selinux_state,
3526                                   ssid, fsec->sid,
3527                                 SECCLASS_FD,
3528                                 FD__USE,
3529                                 &ad);
3530                 if (rc)
3531                         goto out;
3532         }
3533
3534         if (unlikely(IS_PRIVATE(inode)))
3535                 return 0;
3536
3537         isec = inode_security(inode);
3538         rc = avc_has_extended_perms(&selinux_state,
3539                                     ssid, isec->sid, isec->sclass,
3540                                     requested, driver, xperm, &ad);
3541 out:
3542         return rc;
3543 }
3544
3545 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3546                               unsigned long arg)
3547 {
3548         const struct cred *cred = current_cred();
3549         int error = 0;
3550
3551         switch (cmd) {
3552         case FIONREAD:
3553         /* fall through */
3554         case FIBMAP:
3555         /* fall through */
3556         case FIGETBSZ:
3557         /* fall through */
3558         case FS_IOC_GETFLAGS:
3559         /* fall through */
3560         case FS_IOC_GETVERSION:
3561                 error = file_has_perm(cred, file, FILE__GETATTR);
3562                 break;
3563
3564         case FS_IOC_SETFLAGS:
3565         /* fall through */
3566         case FS_IOC_SETVERSION:
3567                 error = file_has_perm(cred, file, FILE__SETATTR);
3568                 break;
3569
3570         /* sys_ioctl() checks */
3571         case FIONBIO:
3572         /* fall through */
3573         case FIOASYNC:
3574                 error = file_has_perm(cred, file, 0);
3575                 break;
3576
3577         case KDSKBENT:
3578         case KDSKBSENT:
3579                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3580                                             CAP_OPT_NONE, true);
3581                 break;
3582
3583         /* default case assumes that the command will go
3584          * to the file's ioctl() function.
3585          */
3586         default:
3587                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3588         }
3589         return error;
3590 }
3591
3592 static int default_noexec;
3593
3594 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3595 {
3596         const struct cred *cred = current_cred();
3597         u32 sid = cred_sid(cred);
3598         int rc = 0;
3599
3600         if (default_noexec &&
3601             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3602                                    (!shared && (prot & PROT_WRITE)))) {
3603                 /*
3604                  * We are making executable an anonymous mapping or a
3605                  * private file mapping that will also be writable.
3606                  * This has an additional check.
3607                  */
3608                 rc = avc_has_perm(&selinux_state,
3609                                   sid, sid, SECCLASS_PROCESS,
3610                                   PROCESS__EXECMEM, NULL);
3611                 if (rc)
3612                         goto error;
3613         }
3614
3615         if (file) {
3616                 /* read access is always possible with a mapping */
3617                 u32 av = FILE__READ;
3618
3619                 /* write access only matters if the mapping is shared */
3620                 if (shared && (prot & PROT_WRITE))
3621                         av |= FILE__WRITE;
3622
3623                 if (prot & PROT_EXEC)
3624                         av |= FILE__EXECUTE;
3625
3626                 return file_has_perm(cred, file, av);
3627         }
3628
3629 error:
3630         return rc;
3631 }
3632
3633 static int selinux_mmap_addr(unsigned long addr)
3634 {
3635         int rc = 0;
3636
3637         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3638                 u32 sid = current_sid();
3639                 rc = avc_has_perm(&selinux_state,
3640                                   sid, sid, SECCLASS_MEMPROTECT,
3641                                   MEMPROTECT__MMAP_ZERO, NULL);
3642         }
3643
3644         return rc;
3645 }
3646
3647 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3648                              unsigned long prot, unsigned long flags)
3649 {
3650         struct common_audit_data ad;
3651         int rc;
3652
3653         if (file) {
3654                 ad.type = LSM_AUDIT_DATA_FILE;
3655                 ad.u.file = file;
3656                 rc = inode_has_perm(current_cred(), file_inode(file),
3657                                     FILE__MAP, &ad);
3658                 if (rc)
3659                         return rc;
3660         }
3661
3662         if (selinux_state.checkreqprot)
3663                 prot = reqprot;
3664
3665         return file_map_prot_check(file, prot,
3666                                    (flags & MAP_TYPE) == MAP_SHARED);
3667 }
3668
3669 static int selinux_file_mprotect(struct vm_area_struct *vma,
3670                                  unsigned long reqprot,
3671                                  unsigned long prot)
3672 {
3673         const struct cred *cred = current_cred();
3674         u32 sid = cred_sid(cred);
3675
3676         if (selinux_state.checkreqprot)
3677                 prot = reqprot;
3678
3679         if (default_noexec &&
3680             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3681                 int rc = 0;
3682                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3683                     vma->vm_end <= vma->vm_mm->brk) {
3684                         rc = avc_has_perm(&selinux_state,
3685                                           sid, sid, SECCLASS_PROCESS,
3686                                           PROCESS__EXECHEAP, NULL);
3687                 } else if (!vma->vm_file &&
3688                            ((vma->vm_start <= vma->vm_mm->start_stack &&
3689                              vma->vm_end >= vma->vm_mm->start_stack) ||
3690                             vma_is_stack_for_current(vma))) {
3691                         rc = avc_has_perm(&selinux_state,
3692                                           sid, sid, SECCLASS_PROCESS,
3693                                           PROCESS__EXECSTACK, NULL);
3694                 } else if (vma->vm_file && vma->anon_vma) {
3695                         /*
3696                          * We are making executable a file mapping that has
3697                          * had some COW done. Since pages might have been
3698                          * written, check ability to execute the possibly
3699                          * modified content.  This typically should only
3700                          * occur for text relocations.
3701                          */
3702                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3703                 }
3704                 if (rc)
3705                         return rc;
3706         }
3707
3708         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3709 }
3710
3711 static int selinux_file_lock(struct file *file, unsigned int cmd)
3712 {
3713         const struct cred *cred = current_cred();
3714
3715         return file_has_perm(cred, file, FILE__LOCK);
3716 }
3717
3718 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3719                               unsigned long arg)
3720 {
3721         const struct cred *cred = current_cred();
3722         int err = 0;
3723
3724         switch (cmd) {
3725         case F_SETFL:
3726                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3727                         err = file_has_perm(cred, file, FILE__WRITE);
3728                         break;
3729                 }
3730                 /* fall through */
3731         case F_SETOWN:
3732         case F_SETSIG:
3733         case F_GETFL:
3734         case F_GETOWN:
3735         case F_GETSIG:
3736         case F_GETOWNER_UIDS:
3737                 /* Just check FD__USE permission */
3738                 err = file_has_perm(cred, file, 0);
3739                 break;
3740         case F_GETLK:
3741         case F_SETLK:
3742         case F_SETLKW:
3743         case F_OFD_GETLK:
3744         case F_OFD_SETLK:
3745         case F_OFD_SETLKW:
3746 #if BITS_PER_LONG == 32
3747         case F_GETLK64:
3748         case F_SETLK64:
3749         case F_SETLKW64:
3750 #endif
3751                 err = file_has_perm(cred, file, FILE__LOCK);
3752                 break;
3753         }
3754
3755         return err;
3756 }
3757
3758 static void selinux_file_set_fowner(struct file *file)
3759 {
3760         struct file_security_struct *fsec;
3761
3762         fsec = selinux_file(file);
3763         fsec->fown_sid = current_sid();
3764 }
3765
3766 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3767                                        struct fown_struct *fown, int signum)
3768 {
3769         struct file *file;
3770         u32 sid = task_sid(tsk);
3771         u32 perm;
3772         struct file_security_struct *fsec;
3773
3774         /* struct fown_struct is never outside the context of a struct file */
3775         file = container_of(fown, struct file, f_owner);
3776
3777         fsec = selinux_file(file);
3778
3779         if (!signum)
3780                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3781         else
3782                 perm = signal_to_av(signum);
3783
3784         return avc_has_perm(&selinux_state,
3785                             fsec->fown_sid, sid,
3786                             SECCLASS_PROCESS, perm, NULL);
3787 }
3788
3789 static int selinux_file_receive(struct file *file)
3790 {
3791         const struct cred *cred = current_cred();
3792
3793         return file_has_perm(cred, file, file_to_av(file));
3794 }
3795
3796 static int selinux_file_open(struct file *file)
3797 {
3798         struct file_security_struct *fsec;
3799         struct inode_security_struct *isec;
3800
3801         fsec = selinux_file(file);
3802         isec = inode_security(file_inode(file));
3803         /*
3804          * Save inode label and policy sequence number
3805          * at open-time so that selinux_file_permission
3806          * can determine whether revalidation is necessary.
3807          * Task label is already saved in the file security
3808          * struct as its SID.
3809          */
3810         fsec->isid = isec->sid;
3811         fsec->pseqno = avc_policy_seqno(&selinux_state);
3812         /*
3813          * Since the inode label or policy seqno may have changed
3814          * between the selinux_inode_permission check and the saving
3815          * of state above, recheck that access is still permitted.
3816          * Otherwise, access might never be revalidated against the
3817          * new inode label or new policy.
3818          * This check is not redundant - do not remove.
3819          */
3820         return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3821 }
3822
3823 /* task security operations */
3824
3825 static int selinux_task_alloc(struct task_struct *task,
3826                               unsigned long clone_flags)
3827 {
3828         u32 sid = current_sid();
3829
3830         return avc_has_perm(&selinux_state,
3831                             sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3832 }
3833
3834 /*
3835  * prepare a new set of credentials for modification
3836  */
3837 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3838                                 gfp_t gfp)
3839 {
3840         const struct task_security_struct *old_tsec = selinux_cred(old);
3841         struct task_security_struct *tsec = selinux_cred(new);
3842
3843         *tsec = *old_tsec;
3844         return 0;
3845 }
3846
3847 /*
3848  * transfer the SELinux data to a blank set of creds
3849  */
3850 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3851 {
3852         const struct task_security_struct *old_tsec = selinux_cred(old);
3853         struct task_security_struct *tsec = selinux_cred(new);
3854
3855         *tsec = *old_tsec;
3856 }
3857
3858 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3859 {
3860         *secid = cred_sid(c);
3861 }
3862
3863 /*
3864  * set the security data for a kernel service
3865  * - all the creation contexts are set to unlabelled
3866  */
3867 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3868 {
3869         struct task_security_struct *tsec = selinux_cred(new);
3870         u32 sid = current_sid();
3871         int ret;
3872
3873         ret = avc_has_perm(&selinux_state,
3874                            sid, secid,
3875                            SECCLASS_KERNEL_SERVICE,
3876                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3877                            NULL);
3878         if (ret == 0) {
3879                 tsec->sid = secid;
3880                 tsec->create_sid = 0;
3881                 tsec->keycreate_sid = 0;
3882                 tsec->sockcreate_sid = 0;
3883         }
3884         return ret;
3885 }
3886
3887 /*
3888  * set the file creation context in a security record to the same as the
3889  * objective context of the specified inode
3890  */
3891 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3892 {
3893         struct inode_security_struct *isec = inode_security(inode);
3894         struct task_security_struct *tsec = selinux_cred(new);
3895         u32 sid = current_sid();
3896         int ret;
3897
3898         ret = avc_has_perm(&selinux_state,
3899                            sid, isec->sid,
3900                            SECCLASS_KERNEL_SERVICE,
3901                            KERNEL_SERVICE__CREATE_FILES_AS,
3902                            NULL);
3903
3904         if (ret == 0)
3905                 tsec->create_sid = isec->sid;
3906         return ret;
3907 }
3908
3909 static int selinux_kernel_module_request(char *kmod_name)
3910 {
3911         struct common_audit_data ad;
3912
3913         ad.type = LSM_AUDIT_DATA_KMOD;
3914         ad.u.kmod_name = kmod_name;
3915
3916         return avc_has_perm(&selinux_state,
3917                             current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3918                             SYSTEM__MODULE_REQUEST, &ad);
3919 }
3920
3921 static int selinux_kernel_module_from_file(struct file *file)
3922 {
3923         struct common_audit_data ad;
3924         struct inode_security_struct *isec;
3925         struct file_security_struct *fsec;
3926         u32 sid = current_sid();
3927         int rc;
3928
3929         /* init_module */
3930         if (file == NULL)
3931                 return avc_has_perm(&selinux_state,
3932                                     sid, sid, SECCLASS_SYSTEM,
3933                                         SYSTEM__MODULE_LOAD, NULL);
3934
3935         /* finit_module */
3936
3937         ad.type = LSM_AUDIT_DATA_FILE;
3938         ad.u.file = file;
3939
3940         fsec = selinux_file(file);
3941         if (sid != fsec->sid) {
3942                 rc = avc_has_perm(&selinux_state,
3943                                   sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3944                 if (rc)
3945                         return rc;
3946         }
3947
3948         isec = inode_security(file_inode(file));
3949         return avc_has_perm(&selinux_state,
3950                             sid, isec->sid, SECCLASS_SYSTEM,
3951                                 SYSTEM__MODULE_LOAD, &ad);
3952 }
3953
3954 static int selinux_kernel_read_file(struct file *file,
3955                                     enum kernel_read_file_id id)
3956 {
3957         int rc = 0;
3958
3959         switch (id) {
3960         case READING_MODULE:
3961                 rc = selinux_kernel_module_from_file(file);
3962                 break;
3963         default:
3964                 break;
3965         }
3966
3967         return rc;
3968 }
3969
3970 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3971 {
3972         int rc = 0;
3973
3974         switch (id) {
3975         case LOADING_MODULE:
3976                 rc = selinux_kernel_module_from_file(NULL);
3977         default:
3978                 break;
3979         }
3980
3981         return rc;
3982 }
3983
3984 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3985 {
3986         return avc_has_perm(&selinux_state,
3987                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3988                             PROCESS__SETPGID, NULL);
3989 }
3990
3991 static int selinux_task_getpgid(struct task_struct *p)
3992 {
3993         return avc_has_perm(&selinux_state,
3994                             current_sid(), task_sid(p), SECCLASS_PROCESS,
3995                             PROCESS__GETPGID, NULL);
3996 }
3997
3998 static int selinux_task_getsid(struct task_struct *p)
3999 {
4000         return avc_has_perm(&selinux_state,
4001                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4002                             PROCESS__GETSESSION, NULL);
4003 }
4004
4005 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4006 {
4007         *secid = task_sid(p);
4008 }
4009
4010 static int selinux_task_setnice(struct task_struct *p, int nice)
4011 {
4012         return avc_has_perm(&selinux_state,
4013                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4014                             PROCESS__SETSCHED, NULL);
4015 }
4016
4017 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4018 {
4019         return avc_has_perm(&selinux_state,
4020                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4021                             PROCESS__SETSCHED, NULL);
4022 }
4023
4024 static int selinux_task_getioprio(struct task_struct *p)
4025 {
4026         return avc_has_perm(&selinux_state,
4027                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4028                             PROCESS__GETSCHED, NULL);
4029 }
4030
4031 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4032                                 unsigned int flags)
4033 {
4034         u32 av = 0;
4035
4036         if (!flags)
4037                 return 0;
4038         if (flags & LSM_PRLIMIT_WRITE)
4039                 av |= PROCESS__SETRLIMIT;
4040         if (flags & LSM_PRLIMIT_READ)
4041                 av |= PROCESS__GETRLIMIT;
4042         return avc_has_perm(&selinux_state,
4043                             cred_sid(cred), cred_sid(tcred),
4044                             SECCLASS_PROCESS, av, NULL);
4045 }
4046
4047 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4048                 struct rlimit *new_rlim)
4049 {
4050         struct rlimit *old_rlim = p->signal->rlim + resource;
4051
4052         /* Control the ability to change the hard limit (whether
4053            lowering or raising it), so that the hard limit can
4054            later be used as a safe reset point for the soft limit
4055            upon context transitions.  See selinux_bprm_committing_creds. */
4056         if (old_rlim->rlim_max != new_rlim->rlim_max)
4057                 return avc_has_perm(&selinux_state,
4058                                     current_sid(), task_sid(p),
4059                                     SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4060
4061         return 0;
4062 }
4063
4064 static int selinux_task_setscheduler(struct task_struct *p)
4065 {
4066         return avc_has_perm(&selinux_state,
4067                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4068                             PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_getscheduler(struct task_struct *p)
4072 {
4073         return avc_has_perm(&selinux_state,
4074                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4075                             PROCESS__GETSCHED, NULL);
4076 }
4077
4078 static int selinux_task_movememory(struct task_struct *p)
4079 {
4080         return avc_has_perm(&selinux_state,
4081                             current_sid(), task_sid(p), SECCLASS_PROCESS,
4082                             PROCESS__SETSCHED, NULL);
4083 }
4084
4085 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4086                                 int sig, const struct cred *cred)
4087 {
4088         u32 secid;
4089         u32 perm;
4090
4091         if (!sig)
4092                 perm = PROCESS__SIGNULL; /* null signal; existence test */
4093         else
4094                 perm = signal_to_av(sig);
4095         if (!cred)
4096                 secid = current_sid();
4097         else
4098                 secid = cred_sid(cred);
4099         return avc_has_perm(&selinux_state,
4100                             secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4101 }
4102
4103 static void selinux_task_to_inode(struct task_struct *p,
4104                                   struct inode *inode)
4105 {
4106         struct inode_security_struct *isec = selinux_inode(inode);
4107         u32 sid = task_sid(p);
4108
4109         spin_lock(&isec->lock);
4110         isec->sclass = inode_mode_to_security_class(inode->i_mode);
4111         isec->sid = sid;
4112         isec->initialized = LABEL_INITIALIZED;
4113         spin_unlock(&isec->lock);
4114 }
4115
4116 /* Returns error only if unable to parse addresses */
4117 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4118                         struct common_audit_data *ad, u8 *proto)
4119 {
4120         int offset, ihlen, ret = -EINVAL;
4121         struct iphdr _iph, *ih;
4122
4123         offset = skb_network_offset(skb);
4124         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4125         if (ih == NULL)
4126                 goto out;
4127
4128         ihlen = ih->ihl * 4;
4129         if (ihlen < sizeof(_iph))
4130                 goto out;
4131
4132         ad->u.net->v4info.saddr = ih->saddr;
4133         ad->u.net->v4info.daddr = ih->daddr;
4134         ret = 0;
4135
4136         if (proto)
4137                 *proto = ih->protocol;
4138
4139         switch (ih->protocol) {
4140         case IPPROTO_TCP: {
4141                 struct tcphdr _tcph, *th;
4142
4143                 if (ntohs(ih->frag_off) & IP_OFFSET)
4144                         break;
4145
4146                 offset += ihlen;
4147                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4148                 if (th == NULL)
4149                         break;
4150
4151                 ad->u.net->sport = th->source;
4152                 ad->u.net->dport = th->dest;
4153                 break;
4154         }
4155
4156         case IPPROTO_UDP: {
4157                 struct udphdr _udph, *uh;
4158
4159                 if (ntohs(ih->frag_off) & IP_OFFSET)
4160                         break;
4161
4162                 offset += ihlen;
4163                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4164                 if (uh == NULL)
4165                         break;
4166
4167                 ad->u.net->sport = uh->source;
4168                 ad->u.net->dport = uh->dest;
4169                 break;
4170         }
4171
4172         case IPPROTO_DCCP: {
4173                 struct dccp_hdr _dccph, *dh;
4174
4175                 if (ntohs(ih->frag_off) & IP_OFFSET)
4176                         break;
4177
4178                 offset += ihlen;
4179                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4180                 if (dh == NULL)
4181                         break;
4182
4183                 ad->u.net->sport = dh->dccph_sport;
4184                 ad->u.net->dport = dh->dccph_dport;
4185                 break;
4186         }
4187
4188 #if IS_ENABLED(CONFIG_IP_SCTP)
4189         case IPPROTO_SCTP: {
4190                 struct sctphdr _sctph, *sh;
4191
4192                 if (ntohs(ih->frag_off) & IP_OFFSET)
4193                         break;
4194
4195                 offset += ihlen;
4196                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4197                 if (sh == NULL)
4198                         break;
4199
4200                 ad->u.net->sport = sh->source;
4201                 ad->u.net->dport = sh->dest;
4202                 break;
4203         }
4204 #endif
4205         default:
4206                 break;
4207         }
4208 out:
4209         return ret;
4210 }
4211
4212 #if IS_ENABLED(CONFIG_IPV6)
4213
4214 /* Returns error only if unable to parse addresses */
4215 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4216                         struct common_audit_data *ad, u8 *proto)
4217 {
4218         u8 nexthdr;
4219         int ret = -EINVAL, offset;
4220         struct ipv6hdr _ipv6h, *ip6;
4221         __be16 frag_off;
4222
4223         offset = skb_network_offset(skb);
4224         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4225         if (ip6 == NULL)
4226                 goto out;
4227
4228         ad->u.net->v6info.saddr = ip6->saddr;
4229         ad->u.net->v6info.daddr = ip6->daddr;
4230         ret = 0;
4231
4232         nexthdr = ip6->nexthdr;
4233         offset += sizeof(_ipv6h);
4234         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4235         if (offset < 0)
4236                 goto out;
4237
4238         if (proto)
4239                 *proto = nexthdr;
4240
4241         switch (nexthdr) {
4242         case IPPROTO_TCP: {
4243                 struct tcphdr _tcph, *th;
4244
4245                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4246                 if (th == NULL)
4247                         break;
4248
4249                 ad->u.net->sport = th->source;
4250                 ad->u.net->dport = th->dest;
4251                 break;
4252         }
4253
4254         case IPPROTO_UDP: {
4255                 struct udphdr _udph, *uh;
4256
4257                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4258                 if (uh == NULL)
4259                         break;
4260
4261                 ad->u.net->sport = uh->source;
4262                 ad->u.net->dport = uh->dest;
4263                 break;
4264         }
4265
4266         case IPPROTO_DCCP: {
4267                 struct dccp_hdr _dccph, *dh;
4268
4269                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4270                 if (dh == NULL)
4271                         break;
4272
4273                 ad->u.net->sport = dh->dccph_sport;
4274                 ad->u.net->dport = dh->dccph_dport;
4275                 break;
4276         }
4277
4278 #if IS_ENABLED(CONFIG_IP_SCTP)
4279         case IPPROTO_SCTP: {
4280                 struct sctphdr _sctph, *sh;
4281
4282                 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4283                 if (sh == NULL)
4284                         break;
4285
4286                 ad->u.net->sport = sh->source;
4287                 ad->u.net->dport = sh->dest;
4288                 break;
4289         }
4290 #endif
4291         /* includes fragments */
4292         default:
4293                 break;
4294         }
4295 out:
4296         return ret;
4297 }
4298
4299 #endif /* IPV6 */
4300
4301 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4302                              char **_addrp, int src, u8 *proto)
4303 {
4304         char *addrp;
4305         int ret;
4306
4307         switch (ad->u.net->family) {
4308         case PF_INET:
4309                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4310                 if (ret)
4311                         goto parse_error;
4312                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4313                                        &ad->u.net->v4info.daddr);
4314                 goto okay;
4315
4316 #if IS_ENABLED(CONFIG_IPV6)
4317         case PF_INET6:
4318                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4319                 if (ret)
4320                         goto parse_error;
4321                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4322                                        &ad->u.net->v6info.daddr);
4323                 goto okay;
4324 #endif  /* IPV6 */
4325         default:
4326                 addrp = NULL;
4327                 goto okay;
4328         }
4329
4330 parse_error:
4331         pr_warn(
4332                "SELinux: failure in selinux_parse_skb(),"
4333                " unable to parse packet\n");
4334         return ret;
4335
4336 okay:
4337         if (_addrp)
4338                 *_addrp = addrp;
4339         return 0;
4340 }
4341
4342 /**
4343  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4344  * @skb: the packet
4345  * @family: protocol family
4346  * @sid: the packet's peer label SID
4347  *
4348  * Description:
4349  * Check the various different forms of network peer labeling and determine
4350  * the peer label/SID for the packet; most of the magic actually occurs in
4351  * the security server function security_net_peersid_cmp().  The function
4352  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4353  * or -EACCES if @sid is invalid due to inconsistencies with the different
4354  * peer labels.
4355  *
4356  */
4357 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4358 {
4359         int err;
4360         u32 xfrm_sid;
4361         u32 nlbl_sid;
4362         u32 nlbl_type;
4363
4364         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4365         if (unlikely(err))
4366                 return -EACCES;
4367         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4368         if (unlikely(err))
4369                 return -EACCES;
4370
4371         err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4372                                            nlbl_type, xfrm_sid, sid);
4373         if (unlikely(err)) {
4374                 pr_warn(
4375                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4376                        " unable to determine packet's peer label\n");
4377                 return -EACCES;
4378         }
4379
4380         return 0;
4381 }
4382
4383 /**
4384  * selinux_conn_sid - Determine the child socket label for a connection
4385  * @sk_sid: the parent socket's SID
4386  * @skb_sid: the packet's SID
4387  * @conn_sid: the resulting connection SID
4388  *
4389  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4390  * combined with the MLS information from @skb_sid in order to create
4391  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4392  * of @sk_sid.  Returns zero on success, negative values on failure.
4393  *
4394  */
4395 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4396 {
4397         int err = 0;
4398
4399         if (skb_sid != SECSID_NULL)
4400                 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4401                                             conn_sid);
4402         else
4403                 *conn_sid = sk_sid;
4404
4405         return err;
4406 }
4407
4408 /* socket security operations */
4409
4410 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4411                                  u16 secclass, u32 *socksid)
4412 {
4413         if (tsec->sockcreate_sid > SECSID_NULL) {
4414                 *socksid = tsec->sockcreate_sid;
4415                 return 0;
4416         }
4417
4418         return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4419                                        secclass, NULL, socksid);
4420 }
4421
4422 static int sock_has_perm(struct sock *sk, u32 perms)
4423 {
4424         struct sk_security_struct *sksec = sk->sk_security;
4425         struct common_audit_data ad;
4426         struct lsm_network_audit net = {0,};
4427
4428         if (sksec->sid == SECINITSID_KERNEL)
4429                 return 0;
4430
4431         ad.type = LSM_AUDIT_DATA_NET;
4432         ad.u.net = &net;
4433         ad.u.net->sk = sk;
4434
4435         return avc_has_perm(&selinux_state,
4436                             current_sid(), sksec->sid, sksec->sclass, perms,
4437                             &ad);
4438 }
4439
4440 static int selinux_socket_create(int family, int type,
4441                                  int protocol, int kern)
4442 {
4443         const struct task_security_struct *tsec = selinux_cred(current_cred());
4444         u32 newsid;
4445         u16 secclass;
4446         int rc;
4447
4448         if (kern)
4449                 return 0;
4450
4451         secclass = socket_type_to_security_class(family, type, protocol);
4452         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4453         if (rc)
4454                 return rc;
4455
4456         return avc_has_perm(&selinux_state,
4457                             tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4458 }
4459
4460 static int selinux_socket_post_create(struct socket *sock, int family,
4461                                       int type, int protocol, int kern)
4462 {
4463         const struct task_security_struct *tsec = selinux_cred(current_cred());
4464         struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4465         struct sk_security_struct *sksec;
4466         u16 sclass = socket_type_to_security_class(family, type, protocol);
4467         u32 sid = SECINITSID_KERNEL;
4468         int err = 0;
4469
4470         if (!kern) {
4471                 err = socket_sockcreate_sid(tsec, sclass, &sid);
4472                 if (err)
4473                         return err;
4474         }
4475
4476         isec->sclass = sclass;
4477         isec->sid = sid;
4478         isec->initialized = LABEL_INITIALIZED;
4479
4480         if (sock->sk) {
4481                 sksec = sock->sk->sk_security;
4482                 sksec->sclass = sclass;
4483                 sksec->sid = sid;
4484                 /* Allows detection of the first association on this socket */
4485                 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4486                         sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4487
4488                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4489         }
4490
4491         return err;
4492 }
4493
4494 static int selinux_socket_socketpair(struct socket *socka,
4495                                      struct socket *sockb)
4496 {
4497         struct sk_security_struct *sksec_a = socka->sk->sk_security;
4498         struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4499
4500         sksec_a->peer_sid = sksec_b->sid;
4501         sksec_b->peer_sid = sksec_a->sid;
4502
4503         return 0;
4504 }
4505
4506 /* Range of port numbers used to automatically bind.
4507    Need to determine whether we should perform a name_bind
4508    permission check between the socket and the port number. */
4509
4510 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4511 {
4512         struct sock *sk = sock->sk;
4513         struct sk_security_struct *sksec = sk->sk_security;
4514         u16 family;
4515         int err;
4516
4517         err = sock_has_perm(sk, SOCKET__BIND);
4518         if (err)
4519                 goto out;
4520
4521         /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4522         family = sk->sk_family;
4523         if (family == PF_INET || family == PF_INET6) {
4524                 char *addrp;
4525                 struct common_audit_data ad;
4526                 struct lsm_network_audit net = {0,};
4527                 struct sockaddr_in *addr4 = NULL;
4528                 struct sockaddr_in6 *addr6 = NULL;
4529                 u16 family_sa;
4530                 unsigned short snum;
4531                 u32 sid, node_perm;
4532
4533                 /*
4534                  * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4535                  * that validates multiple binding addresses. Because of this
4536                  * need to check address->sa_family as it is possible to have
4537                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4538                  */
4539                 if (addrlen < offsetofend(struct sockaddr, sa_family))
4540                         return -EINVAL;
4541                 family_sa = address->sa_family;
4542                 switch (family_sa) {
4543                 case AF_UNSPEC:
4544                 case AF_INET:
4545                         if (addrlen < sizeof(struct sockaddr_in))
4546                                 return -EINVAL;
4547                         addr4 = (struct sockaddr_in *)address;
4548                         if (family_sa == AF_UNSPEC) {
4549                                 /* see __inet_bind(), we only want to allow
4550                                  * AF_UNSPEC if the address is INADDR_ANY
4551                                  */
4552                                 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4553                                         goto err_af;
4554                                 family_sa = AF_INET;
4555                         }
4556                         snum = ntohs(addr4->sin_port);
4557                         addrp = (char *)&addr4->sin_addr.s_addr;
4558                         break;
4559                 case AF_INET6:
4560                         if (addrlen < SIN6_LEN_RFC2133)
4561                                 return -EINVAL;
4562                         addr6 = (struct sockaddr_in6 *)address;
4563                         snum = ntohs(addr6->sin6_port);
4564                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4565                         break;
4566                 default:
4567                         goto err_af;
4568                 }
4569
4570                 ad.type = LSM_AUDIT_DATA_NET;
4571                 ad.u.net = &net;
4572                 ad.u.net->sport = htons(snum);
4573                 ad.u.net->family = family_sa;
4574
4575                 if (snum) {
4576                         int low, high;
4577
4578                         inet_get_local_port_range(sock_net(sk), &low, &high);
4579
4580                         if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4581                             snum > high) {
4582                                 err = sel_netport_sid(sk->sk_protocol,
4583                                                       snum, &sid);
4584                                 if (err)
4585                                         goto out;
4586                                 err = avc_has_perm(&selinux_state,
4587                                                    sksec->sid, sid,
4588                                                    sksec->sclass,
4589                                                    SOCKET__NAME_BIND, &ad);
4590                                 if (err)
4591                                         goto out;
4592                         }
4593                 }
4594
4595                 switch (sksec->sclass) {
4596                 case SECCLASS_TCP_SOCKET:
4597                         node_perm = TCP_SOCKET__NODE_BIND;
4598                         break;
4599
4600                 case SECCLASS_UDP_SOCKET:
4601                         node_perm = UDP_SOCKET__NODE_BIND;
4602                         break;
4603
4604                 case SECCLASS_DCCP_SOCKET:
4605                         node_perm = DCCP_SOCKET__NODE_BIND;
4606                         break;
4607
4608                 case SECCLASS_SCTP_SOCKET:
4609                         node_perm = SCTP_SOCKET__NODE_BIND;
4610                         break;
4611
4612                 default:
4613                         node_perm = RAWIP_SOCKET__NODE_BIND;
4614                         break;
4615                 }
4616
4617                 err = sel_netnode_sid(addrp, family_sa, &sid);
4618                 if (err)
4619                         goto out;
4620
4621                 if (family_sa == AF_INET)
4622                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4623                 else
4624                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4625
4626                 err = avc_has_perm(&selinux_state,
4627                                    sksec->sid, sid,
4628                                    sksec->sclass, node_perm, &ad);
4629                 if (err)
4630                         goto out;
4631         }
4632 out:
4633         return err;
4634 err_af:
4635         /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4636         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4637                 return -EINVAL;
4638         return -EAFNOSUPPORT;
4639 }
4640
4641 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4642  * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4643  */
4644 static int selinux_socket_connect_helper(struct socket *sock,
4645                                          struct sockaddr *address, int addrlen)
4646 {
4647         struct sock *sk = sock->sk;
4648         struct sk_security_struct *sksec = sk->sk_security;
4649         int err;
4650
4651         err = sock_has_perm(sk, SOCKET__CONNECT);
4652         if (err)
4653                 return err;
4654         if (addrlen < offsetofend(struct sockaddr, sa_family))
4655                 return -EINVAL;
4656
4657         /* connect(AF_UNSPEC) has special handling, as it is a documented
4658          * way to disconnect the socket
4659          */
4660         if (address->sa_family == AF_UNSPEC)
4661                 return 0;
4662
4663         /*
4664          * If a TCP, DCCP or SCTP socket, check name_connect permission
4665          * for the port.
4666          */
4667         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4668             sksec->sclass == SECCLASS_DCCP_SOCKET ||
4669             sksec->sclass == SECCLASS_SCTP_SOCKET) {
4670                 struct common_audit_data ad;
4671                 struct lsm_network_audit net = {0,};
4672                 struct sockaddr_in *addr4 = NULL;
4673                 struct sockaddr_in6 *addr6 = NULL;
4674                 unsigned short snum;
4675                 u32 sid, perm;
4676
4677                 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4678                  * that validates multiple connect addresses. Because of this
4679                  * need to check address->sa_family as it is possible to have
4680                  * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4681                  */
4682                 switch (address->sa_family) {
4683                 case AF_INET:
4684                         addr4 = (struct sockaddr_in *)address;
4685                         if (addrlen < sizeof(struct sockaddr_in))
4686                                 return -EINVAL;
4687                         snum = ntohs(addr4->sin_port);
4688                         break;
4689                 case AF_INET6:
4690                         addr6 = (struct sockaddr_in6 *)address;
4691                         if (addrlen < SIN6_LEN_RFC2133)
4692                                 return -EINVAL;
4693                         snum = ntohs(addr6->sin6_port);
4694                         break;
4695                 default:
4696                         /* Note that SCTP services expect -EINVAL, whereas
4697                          * others expect -EAFNOSUPPORT.
4698                          */
4699                         if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4700                                 return -EINVAL;
4701                         else
4702                                 return -EAFNOSUPPORT;
4703                 }
4704
4705                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4706                 if (err)
4707                         return err;
4708
4709                 switch (sksec->sclass) {
4710                 case SECCLASS_TCP_SOCKET:
4711                         perm = TCP_SOCKET__NAME_CONNECT;
4712                         break;
4713                 case SECCLASS_DCCP_SOCKET:
4714                         perm = DCCP_SOCKET__NAME_CONNECT;
4715                         break;
4716                 case SECCLASS_SCTP_SOCKET:
4717                         perm = SCTP_SOCKET__NAME_CONNECT;
4718                         break;
4719                 }
4720
4721                 ad.type = LSM_AUDIT_DATA_NET;
4722                 ad.u.net = &net;
4723                 ad.u.net->dport = htons(snum);
4724                 ad.u.net->family = address->sa_family;
4725                 err = avc_has_perm(&selinux_state,
4726                                    sksec->sid, sid, sksec->sclass, perm, &ad);
4727                 if (err)
4728                         return err;
4729         }
4730
4731         return 0;
4732 }
4733
4734 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4735 static int selinux_socket_connect(struct socket *sock,
4736                                   struct sockaddr *address, int addrlen)
4737 {
4738         int err;
4739         struct sock *sk = sock->sk;
4740
4741         err = selinux_socket_connect_helper(sock, address, addrlen);
4742         if (err)
4743                 return err;
4744
4745         return selinux_netlbl_socket_connect(sk, address);
4746 }
4747
4748 static int selinux_socket_listen(struct socket *sock, int backlog)
4749 {
4750         return sock_has_perm(sock->sk, SOCKET__LISTEN);
4751 }
4752
4753 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4754 {
4755         int err;
4756         struct inode_security_struct *isec;
4757         struct inode_security_struct *newisec;
4758         u16 sclass;
4759         u32 sid;
4760
4761         err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4762         if (err)
4763                 return err;
4764
4765         isec = inode_security_novalidate(SOCK_INODE(sock));
4766         spin_lock(&isec->lock);
4767         sclass = isec->sclass;
4768         sid = isec->sid;
4769         spin_unlock(&isec->lock);
4770
4771         newisec = inode_security_novalidate(SOCK_INODE(newsock));
4772         newisec->sclass = sclass;
4773         newisec->sid = sid;
4774         newisec->initialized = LABEL_INITIALIZED;
4775
4776         return 0;
4777 }
4778
4779 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4780                                   int size)
4781 {
4782         return sock_has_perm(sock->sk, SOCKET__WRITE);
4783 }
4784
4785 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4786                                   int size, int flags)
4787 {
4788         return sock_has_perm(sock->sk, SOCKET__READ);
4789 }
4790
4791 static int selinux_socket_getsockname(struct socket *sock)
4792 {
4793         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4794 }
4795
4796 static int selinux_socket_getpeername(struct socket *sock)
4797 {
4798         return sock_has_perm(sock->sk, SOCKET__GETATTR);
4799 }
4800
4801 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4802 {
4803         int err;
4804
4805         err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4806         if (err)
4807                 return err;
4808
4809         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4810 }
4811
4812 static int selinux_socket_getsockopt(struct socket *sock, int level,
4813                                      int optname)
4814 {
4815         return sock_has_perm(sock->sk, SOCKET__GETOPT);
4816 }
4817
4818 static int selinux_socket_shutdown(struct socket *sock, int how)
4819 {
4820         return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4821 }
4822
4823 static int selinux_socket_unix_stream_connect(struct sock *sock,
4824                                               struct sock *other,
4825                                               struct sock *newsk)
4826 {
4827         struct sk_security_struct *sksec_sock = sock->sk_security;
4828         struct sk_security_struct *sksec_other = other->sk_security;
4829         struct sk_security_struct *sksec_new = newsk->sk_security;
4830         struct common_audit_data ad;
4831         struct lsm_network_audit net = {0,};
4832         int err;
4833
4834         ad.type = LSM_AUDIT_DATA_NET;
4835         ad.u.net = &net;
4836         ad.u.net->sk = other;
4837
4838         err = avc_has_perm(&selinux_state,
4839                            sksec_sock->sid, sksec_other->sid,
4840                            sksec_other->sclass,
4841                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4842         if (err)
4843                 return err;
4844
4845         /* server child socket */
4846         sksec_new->peer_sid = sksec_sock->sid;
4847         err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4848                                     sksec_sock->sid, &sksec_new->sid);
4849         if (err)
4850                 return err;
4851
4852         /* connecting socket */
4853         sksec_sock->peer_sid = sksec_new->sid;
4854
4855         return 0;
4856 }
4857
4858 static int selinux_socket_unix_may_send(struct socket *sock,
4859                                         struct socket *other)
4860 {
4861         struct sk_security_struct *ssec = sock->sk->sk_security;
4862         struct sk_security_struct *osec = other->sk->sk_security;
4863         struct common_audit_data ad;
4864         struct lsm_network_audit net = {0,};
4865
4866         ad.type = LSM_AUDIT_DATA_NET;
4867         ad.u.net = &net;
4868         ad.u.net->sk = other->sk;
4869
4870         return avc_has_perm(&selinux_state,
4871                             ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4872                             &ad);
4873 }
4874
4875 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4876                                     char *addrp, u16 family, u32 peer_sid,
4877                                     struct common_audit_data *ad)
4878 {
4879         int err;
4880         u32 if_sid;
4881         u32 node_sid;
4882
4883         err = sel_netif_sid(ns, ifindex, &if_sid);
4884         if (err)
4885                 return err;
4886         err = avc_has_perm(&selinux_state,
4887                            peer_sid, if_sid,
4888                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4889         if (err)
4890                 return err;
4891
4892         err = sel_netnode_sid(addrp, family, &node_sid);
4893         if (err)
4894                 return err;
4895         return avc_has_perm(&selinux_state,
4896                             peer_sid, node_sid,
4897                             SECCLASS_NODE, NODE__RECVFROM, ad);
4898 }
4899
4900 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4901                                        u16 family)
4902 {
4903         int err = 0;
4904         struct sk_security_struct *sksec = sk->sk_security;
4905         u32 sk_sid = sksec->sid;
4906         struct common_audit_data ad;
4907         struct lsm_network_audit net = {0,};
4908         char *addrp;
4909
4910         ad.type = LSM_AUDIT_DATA_NET;
4911         ad.u.net = &net;
4912         ad.u.net->netif = skb->skb_iif;
4913         ad.u.net->family = family;
4914         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4915         if (err)
4916                 return err;
4917
4918         if (selinux_secmark_enabled()) {
4919                 err = avc_has_perm(&selinux_state,
4920                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4921                                    PACKET__RECV, &ad);
4922                 if (err)
4923                         return err;
4924         }
4925
4926         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4927         if (err)
4928                 return err;
4929         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4930
4931         return err;
4932 }
4933
4934 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4935 {
4936         int err;
4937         struct sk_security_struct *sksec = sk->sk_security;
4938         u16 family = sk->sk_family;
4939         u32 sk_sid = sksec->sid;
4940         struct common_audit_data ad;
4941         struct lsm_network_audit net = {0,};
4942         char *addrp;
4943         u8 secmark_active;
4944         u8 peerlbl_active;
4945
4946         if (family != PF_INET && family != PF_INET6)
4947                 return 0;
4948
4949         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4950         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4951                 family = PF_INET;
4952
4953         /* If any sort of compatibility mode is enabled then handoff processing
4954          * to the selinux_sock_rcv_skb_compat() function to deal with the
4955          * special handling.  We do this in an attempt to keep this function
4956          * as fast and as clean as possible. */
4957         if (!selinux_policycap_netpeer())
4958                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4959
4960         secmark_active = selinux_secmark_enabled();
4961         peerlbl_active = selinux_peerlbl_enabled();
4962         if (!secmark_active && !peerlbl_active)
4963                 return 0;
4964
4965         ad.type = LSM_AUDIT_DATA_NET;
4966         ad.u.net = &net;
4967         ad.u.net->netif = skb->skb_iif;
4968         ad.u.net->family = family;
4969         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4970         if (err)
4971                 return err;
4972
4973         if (peerlbl_active) {
4974                 u32 peer_sid;
4975
4976                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4977                 if (err)
4978                         return err;
4979                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4980                                                addrp, family, peer_sid, &ad);
4981                 if (err) {
4982                         selinux_netlbl_err(skb, family, err, 0);
4983                         return err;
4984                 }
4985                 err = avc_has_perm(&selinux_state,
4986                                    sk_sid, peer_sid, SECCLASS_PEER,
4987                                    PEER__RECV, &ad);
4988                 if (err) {
4989                         selinux_netlbl_err(skb, family, err, 0);
4990                         return err;
4991                 }
4992         }
4993
4994         if (secmark_active) {
4995                 err = avc_has_perm(&selinux_state,
4996                                    sk_sid, skb->secmark, SECCLASS_PACKET,
4997                                    PACKET__RECV, &ad);
4998                 if (err)
4999                         return err;
5000         }
5001
5002         return err;
5003 }
5004
5005 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5006                                             int __user *optlen, unsigned len)
5007 {
5008         int err = 0;
5009         char *scontext;
5010         u32 scontext_len;
5011         struct sk_security_struct *sksec = sock->sk->sk_security;
5012         u32 peer_sid = SECSID_NULL;
5013
5014         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5015             sksec->sclass == SECCLASS_TCP_SOCKET ||
5016             sksec->sclass == SECCLASS_SCTP_SOCKET)
5017                 peer_sid = sksec->peer_sid;
5018         if (peer_sid == SECSID_NULL)
5019                 return -ENOPROTOOPT;
5020
5021         err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5022                                       &scontext_len);
5023         if (err)
5024                 return err;
5025
5026         if (scontext_len > len) {
5027                 err = -ERANGE;
5028                 goto out_len;
5029         }
5030
5031         if (copy_to_user(optval, scontext, scontext_len))
5032                 err = -EFAULT;
5033
5034 out_len:
5035         if (put_user(scontext_len, optlen))
5036                 err = -EFAULT;
5037         kfree(scontext);
5038         return err;
5039 }
5040
5041 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5042 {
5043         u32 peer_secid = SECSID_NULL;
5044         u16 family;
5045         struct inode_security_struct *isec;
5046
5047         if (skb && skb->protocol == htons(ETH_P_IP))
5048                 family = PF_INET;
5049         else if (skb && skb->protocol == htons(ETH_P_IPV6))
5050                 family = PF_INET6;
5051         else if (sock)
5052                 family = sock->sk->sk_family;
5053         else
5054                 goto out;
5055
5056         if (sock && family == PF_UNIX) {
5057                 isec = inode_security_novalidate(SOCK_INODE(sock));
5058                 peer_secid = isec->sid;
5059         } else if (skb)
5060                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5061
5062 out:
5063         *secid = peer_secid;
5064         if (peer_secid == SECSID_NULL)
5065                 return -EINVAL;
5066         return 0;
5067 }
5068
5069 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5070 {
5071         struct sk_security_struct *sksec;
5072
5073         sksec = kzalloc(sizeof(*sksec), priority);
5074         if (!sksec)
5075                 return -ENOMEM;
5076
5077         sksec->peer_sid = SECINITSID_UNLABELED;
5078         sksec->sid = SECINITSID_UNLABELED;
5079         sksec->sclass = SECCLASS_SOCKET;
5080         selinux_netlbl_sk_security_reset(sksec);
5081         sk->sk_security = sksec;
5082
5083         return 0;
5084 }
5085
5086 static void selinux_sk_free_security(struct sock *sk)
5087 {
5088         struct sk_security_struct *sksec = sk->sk_security;
5089
5090         sk->sk_security = NULL;
5091         selinux_netlbl_sk_security_free(sksec);
5092         kfree(sksec);
5093 }
5094
5095 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5096 {
5097         struct sk_security_struct *sksec = sk->sk_security;
5098         struct sk_security_struct *newsksec = newsk->sk_security;
5099
5100         newsksec->sid = sksec->sid;
5101         newsksec->peer_sid = sksec->peer_sid;
5102         newsksec->sclass = sksec->sclass;
5103
5104         selinux_netlbl_sk_security_reset(newsksec);
5105 }
5106
5107 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5108 {
5109         if (!sk)
5110                 *secid = SECINITSID_ANY_SOCKET;
5111         else {
5112                 struct sk_security_struct *sksec = sk->sk_security;
5113
5114                 *secid = sksec->sid;
5115         }
5116 }
5117
5118 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5119 {
5120         struct inode_security_struct *isec =
5121                 inode_security_novalidate(SOCK_INODE(parent));
5122         struct sk_security_struct *sksec = sk->sk_security;
5123
5124         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5125             sk->sk_family == PF_UNIX)
5126                 isec->sid = sksec->sid;
5127         sksec->sclass = isec->sclass;
5128 }
5129
5130 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5131  * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5132  * already present).
5133  */
5134 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5135                                       struct sk_buff *skb)
5136 {
5137         struct sk_security_struct *sksec = ep->base.sk->sk_security;
5138         struct common_audit_data ad;
5139         struct lsm_network_audit net = {0,};
5140         u8 peerlbl_active;
5141         u32 peer_sid = SECINITSID_UNLABELED;
5142         u32 conn_sid;
5143         int err = 0;
5144
5145         if (!selinux_policycap_extsockclass())
5146                 return 0;
5147
5148         peerlbl_active = selinux_peerlbl_enabled();
5149
5150         if (peerlbl_active) {
5151                 /* This will return peer_sid = SECSID_NULL if there are
5152                  * no peer labels, see security_net_peersid_resolve().
5153                  */
5154                 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5155                                               &peer_sid);
5156                 if (err)
5157                         return err;
5158
5159                 if (peer_sid == SECSID_NULL)
5160                         peer_sid = SECINITSID_UNLABELED;
5161         }
5162
5163         if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5164                 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5165
5166                 /* Here as first association on socket. As the peer SID
5167                  * was allowed by peer recv (and the netif/node checks),
5168                  * then it is approved by policy and used as the primary
5169                  * peer SID for getpeercon(3).
5170                  */
5171                 sksec->peer_sid = peer_sid;
5172         } else if  (sksec->peer_sid != peer_sid) {
5173                 /* Other association peer SIDs are checked to enforce
5174                  * consistency among the peer SIDs.
5175                  */
5176                 ad.type = LSM_AUDIT_DATA_NET;
5177                 ad.u.net = &net;
5178                 ad.u.net->sk = ep->base.sk;
5179                 err = avc_has_perm(&selinux_state,
5180                                    sksec->peer_sid, peer_sid, sksec->sclass,
5181                                    SCTP_SOCKET__ASSOCIATION, &ad);
5182                 if (err)
5183                         return err;
5184         }
5185
5186         /* Compute the MLS component for the connection and store
5187          * the information in ep. This will be used by SCTP TCP type
5188          * sockets and peeled off connections as they cause a new
5189          * socket to be generated. selinux_sctp_sk_clone() will then
5190          * plug this into the new socket.
5191          */
5192         err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5193         if (err)
5194                 return err;
5195
5196         ep->secid = conn_sid;
5197         ep->peer_secid = peer_sid;
5198
5199         /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5200         return selinux_netlbl_sctp_assoc_request(ep, skb);
5201 }
5202
5203 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5204  * based on their @optname.
5205  */
5206 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5207                                      struct sockaddr *address,
5208                                      int addrlen)
5209 {
5210         int len, err = 0, walk_size = 0;
5211         void *addr_buf;
5212         struct sockaddr *addr;
5213         struct socket *sock;
5214
5215         if (!selinux_policycap_extsockclass())
5216                 return 0;
5217
5218         /* Process one or more addresses that may be IPv4 or IPv6 */
5219         sock = sk->sk_socket;
5220         addr_buf = address;
5221
5222         while (walk_size < addrlen) {
5223                 if (walk_size + sizeof(sa_family_t) > addrlen)
5224                         return -EINVAL;
5225
5226                 addr = addr_buf;
5227                 switch (addr->sa_family) {
5228                 case AF_UNSPEC:
5229                 case AF_INET:
5230                         len = sizeof(struct sockaddr_in);
5231                         break;
5232                 case AF_INET6:
5233                         len = sizeof(struct sockaddr_in6);
5234                         break;
5235                 default:
5236                         return -EINVAL;
5237                 }
5238
5239                 if (walk_size + len > addrlen)
5240                         return -EINVAL;
5241
5242                 err = -EINVAL;
5243                 switch (optname) {
5244                 /* Bind checks */
5245                 case SCTP_PRIMARY_ADDR:
5246                 case SCTP_SET_PEER_PRIMARY_ADDR:
5247                 case SCTP_SOCKOPT_BINDX_ADD:
5248                         err = selinux_socket_bind(sock, addr, len);
5249                         break;
5250                 /* Connect checks */
5251                 case SCTP_SOCKOPT_CONNECTX:
5252                 case SCTP_PARAM_SET_PRIMARY:
5253                 case SCTP_PARAM_ADD_IP:
5254                 case SCTP_SENDMSG_CONNECT:
5255                         err = selinux_socket_connect_helper(sock, addr, len);
5256                         if (err)
5257                                 return err;
5258
5259                         /* As selinux_sctp_bind_connect() is called by the
5260                          * SCTP protocol layer, the socket is already locked,
5261                          * therefore selinux_netlbl_socket_connect_locked() is
5262                          * is called here. The situations handled are:
5263                          * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5264                          * whenever a new IP address is added or when a new
5265                          * primary address is selected.
5266                          * Note that an SCTP connect(2) call happens before
5267                          * the SCTP protocol layer and is handled via
5268                          * selinux_socket_connect().
5269                          */
5270                         err = selinux_netlbl_socket_connect_locked(sk, addr);
5271                         break;
5272                 }
5273
5274                 if (err)
5275                         return err;
5276
5277                 addr_buf += len;
5278                 walk_size += len;
5279         }
5280
5281         return 0;
5282 }
5283
5284 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5285 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5286                                   struct sock *newsk)
5287 {
5288         struct sk_security_struct *sksec = sk->sk_security;
5289         struct sk_security_struct *newsksec = newsk->sk_security;
5290
5291         /* If policy does not support SECCLASS_SCTP_SOCKET then call
5292          * the non-sctp clone version.
5293          */
5294         if (!selinux_policycap_extsockclass())
5295                 return selinux_sk_clone_security(sk, newsk);
5296
5297         newsksec->sid = ep->secid;
5298         newsksec->peer_sid = ep->peer_secid;
5299         newsksec->sclass = sksec->sclass;
5300         selinux_netlbl_sctp_sk_clone(sk, newsk);
5301 }
5302
5303 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5304                                      struct request_sock *req)
5305 {
5306         struct sk_security_struct *sksec = sk->sk_security;
5307         int err;
5308         u16 family = req->rsk_ops->family;
5309         u32 connsid;
5310         u32 peersid;
5311
5312         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5313         if (err)
5314                 return err;
5315         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5316         if (err)
5317                 return err;
5318         req->secid = connsid;
5319         req->peer_secid = peersid;
5320
5321         return selinux_netlbl_inet_conn_request(req, family);
5322 }
5323
5324 static void selinux_inet_csk_clone(struct sock *newsk,
5325                                    const struct request_sock *req)
5326 {
5327         struct sk_security_struct *newsksec = newsk->sk_security;
5328
5329         newsksec->sid = req->secid;
5330         newsksec->peer_sid = req->peer_secid;
5331         /* NOTE: Ideally, we should also get the isec->sid for the
5332            new socket in sync, but we don't have the isec available yet.
5333            So we will wait until sock_graft to do it, by which
5334            time it will have been created and available. */
5335
5336         /* We don't need to take any sort of lock here as we are the only
5337          * thread with access to newsksec */
5338         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5339 }
5340
5341 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5342 {
5343         u16 family = sk->sk_family;
5344         struct sk_security_struct *sksec = sk->sk_security;
5345
5346         /* handle mapped IPv4 packets arriving via IPv6 sockets */
5347         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5348                 family = PF_INET;
5349
5350         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5351 }
5352
5353 static int selinux_secmark_relabel_packet(u32 sid)
5354 {
5355         const struct task_security_struct *__tsec;
5356         u32 tsid;
5357
5358         __tsec = selinux_cred(current_cred());
5359         tsid = __tsec->sid;
5360
5361         return avc_has_perm(&selinux_state,
5362                             tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5363                             NULL);
5364 }
5365
5366 static void selinux_secmark_refcount_inc(void)
5367 {
5368         atomic_inc(&selinux_secmark_refcount);
5369 }
5370
5371 static void selinux_secmark_refcount_dec(void)
5372 {
5373         atomic_dec(&selinux_secmark_refcount);
5374 }
5375
5376 static void selinux_req_classify_flow(const struct request_sock *req,
5377                                       struct flowi *fl)
5378 {
5379         fl->flowi_secid = req->secid;
5380 }
5381
5382 static int selinux_tun_dev_alloc_security(void **security)
5383 {
5384         struct tun_security_struct *tunsec;
5385
5386         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5387         if (!tunsec)
5388                 return -ENOMEM;
5389         tunsec->sid = current_sid();
5390
5391         *security = tunsec;
5392         return 0;
5393 }
5394
5395 static void selinux_tun_dev_free_security(void *security)
5396 {
5397         kfree(security);
5398 }
5399
5400 static int selinux_tun_dev_create(void)
5401 {
5402         u32 sid = current_sid();
5403
5404         /* we aren't taking into account the "sockcreate" SID since the socket
5405          * that is being created here is not a socket in the traditional sense,
5406          * instead it is a private sock, accessible only to the kernel, and
5407          * representing a wide range of network traffic spanning multiple
5408          * connections unlike traditional sockets - check the TUN driver to
5409          * get a better understanding of why this socket is special */
5410
5411         return avc_has_perm(&selinux_state,
5412                             sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5413                             NULL);
5414 }
5415
5416 static int selinux_tun_dev_attach_queue(void *security)
5417 {
5418         struct tun_security_struct *tunsec = security;
5419
5420         return avc_has_perm(&selinux_state,
5421                             current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5422                             TUN_SOCKET__ATTACH_QUEUE, NULL);
5423 }
5424
5425 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5426 {
5427         struct tun_security_struct *tunsec = security;
5428         struct sk_security_struct *sksec = sk->sk_security;
5429
5430         /* we don't currently perform any NetLabel based labeling here and it
5431          * isn't clear that we would want to do so anyway; while we could apply
5432          * labeling without the support of the TUN user the resulting labeled
5433          * traffic from the other end of the connection would almost certainly
5434          * cause confusion to the TUN user that had no idea network labeling
5435          * protocols were being used */
5436
5437         sksec->sid = tunsec->sid;
5438         sksec->sclass = SECCLASS_TUN_SOCKET;
5439
5440         return 0;
5441 }
5442
5443 static int selinux_tun_dev_open(void *security)
5444 {
5445         struct tun_security_struct *tunsec = security;
5446         u32 sid = current_sid();
5447         int err;
5448
5449         err = avc_has_perm(&selinux_state,
5450                            sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5451                            TUN_SOCKET__RELABELFROM, NULL);
5452         if (err)
5453                 return err;
5454         err = avc_has_perm(&selinux_state,
5455                            sid, sid, SECCLASS_TUN_SOCKET,
5456                            TUN_SOCKET__RELABELTO, NULL);
5457         if (err)
5458                 return err;
5459         tunsec->sid = sid;
5460
5461         return 0;
5462 }
5463
5464 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5465 {
5466         int err = 0;
5467         u32 perm;
5468         struct nlmsghdr *nlh;
5469         struct sk_security_struct *sksec = sk->sk_security;
5470
5471         if (skb->len < NLMSG_HDRLEN) {
5472                 err = -EINVAL;
5473                 goto out;
5474         }
5475         nlh = nlmsg_hdr(skb);
5476
5477         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5478         if (err) {
5479                 if (err == -EINVAL) {
5480                         pr_warn_ratelimited("SELinux: unrecognized netlink"
5481                                " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5482                                " pig=%d comm=%s\n",
5483                                sk->sk_protocol, nlh->nlmsg_type,
5484                                secclass_map[sksec->sclass - 1].name,
5485                                task_pid_nr(current), current->comm);
5486                         if (!enforcing_enabled(&selinux_state) ||
5487                             security_get_allow_unknown(&selinux_state))
5488                                 err = 0;
5489                 }
5490
5491                 /* Ignore */
5492                 if (err == -ENOENT)
5493                         err = 0;
5494                 goto out;
5495         }
5496
5497         err = sock_has_perm(sk, perm);
5498 out:
5499         return err;
5500 }
5501
5502 #ifdef CONFIG_NETFILTER
5503
5504 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5505                                        const struct net_device *indev,
5506                                        u16 family)
5507 {
5508         int err;
5509         char *addrp;
5510         u32 peer_sid;
5511         struct common_audit_data ad;
5512         struct lsm_network_audit net = {0,};
5513         u8 secmark_active;
5514         u8 netlbl_active;
5515         u8 peerlbl_active;
5516
5517         if (!selinux_policycap_netpeer())
5518                 return NF_ACCEPT;
5519
5520         secmark_active = selinux_secmark_enabled();
5521         netlbl_active = netlbl_enabled();
5522         peerlbl_active = selinux_peerlbl_enabled();
5523         if (!secmark_active && !peerlbl_active)
5524                 return NF_ACCEPT;
5525
5526         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5527                 return NF_DROP;
5528
5529         ad.type = LSM_AUDIT_DATA_NET;
5530         ad.u.net = &net;
5531         ad.u.net->netif = indev->ifindex;
5532         ad.u.net->family = family;
5533         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5534                 return NF_DROP;
5535
5536         if (peerlbl_active) {
5537                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5538                                                addrp, family, peer_sid, &ad);
5539                 if (err) {
5540                         selinux_netlbl_err(skb, family, err, 1);
5541                         return NF_DROP;
5542                 }
5543         }
5544
5545         if (secmark_active)
5546                 if (avc_has_perm(&selinux_state,
5547                                  peer_sid, skb->secmark,
5548                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5549                         return NF_DROP;
5550
5551         if (netlbl_active)
5552                 /* we do this in the FORWARD path and not the POST_ROUTING
5553                  * path because we want to make sure we apply the necessary
5554                  * labeling before IPsec is applied so we can leverage AH
5555                  * protection */
5556                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5557                         return NF_DROP;
5558
5559         return NF_ACCEPT;
5560 }
5561
5562 static unsigned int selinux_ipv4_forward(void *priv,
5563                                          struct sk_buff *skb,
5564                                          const struct nf_hook_state *state)
5565 {
5566         return selinux_ip_forward(skb, state->in, PF_INET);
5567 }
5568
5569 #if IS_ENABLED(CONFIG_IPV6)
5570 static unsigned int selinux_ipv6_forward(void *priv,
5571                                          struct sk_buff *skb,
5572                                          const struct nf_hook_state *state)
5573 {
5574         return selinux_ip_forward(skb, state->in, PF_INET6);
5575 }
5576 #endif  /* IPV6 */
5577
5578 static unsigned int selinux_ip_output(struct sk_buff *skb,
5579                                       u16 family)
5580 {
5581         struct sock *sk;
5582         u32 sid;
5583
5584         if (!netlbl_enabled())
5585                 return NF_ACCEPT;
5586
5587         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5588          * because we want to make sure we apply the necessary labeling
5589          * before IPsec is applied so we can leverage AH protection */
5590         sk = skb->sk;
5591         if (sk) {
5592                 struct sk_security_struct *sksec;
5593
5594                 if (sk_listener(sk))
5595                         /* if the socket is the listening state then this
5596                          * packet is a SYN-ACK packet which means it needs to
5597                          * be labeled based on the connection/request_sock and
5598                          * not the parent socket.  unfortunately, we can't
5599                          * lookup the request_sock yet as it isn't queued on
5600                          * the parent socket until after the SYN-ACK is sent.
5601                          * the "solution" is to simply pass the packet as-is
5602                          * as any IP option based labeling should be copied
5603                          * from the initial connection request (in the IP
5604                          * layer).  it is far from ideal, but until we get a
5605                          * security label in the packet itself this is the
5606                          * best we can do. */
5607                         return NF_ACCEPT;
5608
5609                 /* standard practice, label using the parent socket */
5610                 sksec = sk->sk_security;
5611                 sid = sksec->sid;
5612         } else
5613                 sid = SECINITSID_KERNEL;
5614         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5615                 return NF_DROP;
5616
5617         return NF_ACCEPT;
5618 }
5619
5620 static unsigned int selinux_ipv4_output(void *priv,
5621                                         struct sk_buff *skb,
5622                                         const struct nf_hook_state *state)
5623 {
5624         return selinux_ip_output(skb, PF_INET);
5625 }
5626
5627 #if IS_ENABLED(CONFIG_IPV6)
5628 static unsigned int selinux_ipv6_output(void *priv,
5629                                         struct sk_buff *skb,
5630                                         const struct nf_hook_state *state)
5631 {
5632         return selinux_ip_output(skb, PF_INET6);
5633 }
5634 #endif  /* IPV6 */
5635
5636 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5637                                                 int ifindex,
5638                                                 u16 family)
5639 {
5640         struct sock *sk = skb_to_full_sk(skb);
5641         struct sk_security_struct *sksec;
5642         struct common_audit_data ad;
5643         struct lsm_network_audit net = {0,};
5644         char *addrp;
5645         u8 proto;
5646
5647         if (sk == NULL)
5648                 return NF_ACCEPT;
5649         sksec = sk->sk_security;
5650
5651         ad.type = LSM_AUDIT_DATA_NET;
5652         ad.u.net = &net;
5653         ad.u.net->netif = ifindex;
5654         ad.u.net->family = family;
5655         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5656                 return NF_DROP;
5657
5658         if (selinux_secmark_enabled())
5659                 if (avc_has_perm(&selinux_state,
5660                                  sksec->sid, skb->secmark,
5661                                  SECCLASS_PACKET, PACKET__SEND, &ad))
5662                         return NF_DROP_ERR(-ECONNREFUSED);
5663
5664         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5665                 return NF_DROP_ERR(-ECONNREFUSED);
5666
5667         return NF_ACCEPT;
5668 }
5669
5670 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5671                                          const struct net_device *outdev,
5672                                          u16 family)
5673 {
5674         u32 secmark_perm;
5675         u32 peer_sid;
5676         int ifindex = outdev->ifindex;
5677         struct sock *sk;
5678         struct common_audit_data ad;
5679         struct lsm_network_audit net = {0,};
5680         char *addrp;
5681         u8 secmark_active;
5682         u8 peerlbl_active;
5683
5684         /* If any sort of compatibility mode is enabled then handoff processing
5685          * to the selinux_ip_postroute_compat() function to deal with the
5686          * special handling.  We do this in an attempt to keep this function
5687          * as fast and as clean as possible. */
5688         if (!selinux_policycap_netpeer())
5689                 return selinux_ip_postroute_compat(skb, ifindex, family);
5690
5691         secmark_active = selinux_secmark_enabled();
5692         peerlbl_active = selinux_peerlbl_enabled();
5693         if (!secmark_active && !peerlbl_active)
5694                 return NF_ACCEPT;
5695
5696         sk = skb_to_full_sk(skb);
5697
5698 #ifdef CONFIG_XFRM
5699         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5700          * packet transformation so allow the packet to pass without any checks
5701          * since we'll have another chance to perform access control checks
5702          * when the packet is on it's final way out.
5703          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5704          *       is NULL, in this case go ahead and apply access control.
5705          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5706          *       TCP listening state we cannot wait until the XFRM processing
5707          *       is done as we will miss out on the SA label if we do;
5708          *       unfortunately, this means more work, but it is only once per
5709          *       connection. */
5710         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5711             !(sk && sk_listener(sk)))
5712                 return NF_ACCEPT;
5713 #endif
5714
5715         if (sk == NULL) {
5716                 /* Without an associated socket the packet is either coming
5717                  * from the kernel or it is being forwarded; check the packet
5718                  * to determine which and if the packet is being forwarded
5719                  * query the packet directly to determine the security label. */
5720                 if (skb->skb_iif) {
5721                         secmark_perm = PACKET__FORWARD_OUT;
5722                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5723                                 return NF_DROP;
5724                 } else {
5725                         secmark_perm = PACKET__SEND;
5726                         peer_sid = SECINITSID_KERNEL;
5727                 }
5728         } else if (sk_listener(sk)) {
5729                 /* Locally generated packet but the associated socket is in the
5730                  * listening state which means this is a SYN-ACK packet.  In
5731                  * this particular case the correct security label is assigned
5732                  * to the connection/request_sock but unfortunately we can't
5733                  * query the request_sock as it isn't queued on the parent
5734                  * socket until after the SYN-ACK packet is sent; the only
5735                  * viable choice is to regenerate the label like we do in
5736                  * selinux_inet_conn_request().  See also selinux_ip_output()
5737                  * for similar problems. */
5738                 u32 skb_sid;
5739                 struct sk_security_struct *sksec;
5740
5741                 sksec = sk->sk_security;
5742                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5743                         return NF_DROP;
5744                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5745                  * and the packet has been through at least one XFRM
5746                  * transformation then we must be dealing with the "final"
5747                  * form of labeled IPsec packet; since we've already applied
5748                  * all of our access controls on this packet we can safely
5749                  * pass the packet. */
5750                 if (skb_sid == SECSID_NULL) {
5751                         switch (family) {
5752                         case PF_INET:
5753                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5754                                         return NF_ACCEPT;
5755                                 break;
5756                         case PF_INET6:
5757                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5758                                         return NF_ACCEPT;
5759                                 break;
5760                         default:
5761                                 return NF_DROP_ERR(-ECONNREFUSED);
5762                         }
5763                 }
5764                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5765                         return NF_DROP;
5766                 secmark_perm = PACKET__SEND;
5767         } else {
5768                 /* Locally generated packet, fetch the security label from the
5769                  * associated socket. */
5770                 struct sk_security_struct *sksec = sk->sk_security;
5771                 peer_sid = sksec->sid;
5772                 secmark_perm = PACKET__SEND;
5773         }
5774
5775         ad.type = LSM_AUDIT_DATA_NET;
5776         ad.u.net = &net;
5777         ad.u.net->netif = ifindex;
5778         ad.u.net->family = family;
5779         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5780                 return NF_DROP;
5781
5782         if (secmark_active)
5783                 if (avc_has_perm(&selinux_state,
5784                                  peer_sid, skb->secmark,
5785                                  SECCLASS_PACKET, secmark_perm, &ad))
5786                         return NF_DROP_ERR(-ECONNREFUSED);
5787
5788         if (peerlbl_active) {
5789                 u32 if_sid;
5790                 u32 node_sid;
5791
5792                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5793                         return NF_DROP;
5794                 if (avc_has_perm(&selinux_state,
5795                                  peer_sid, if_sid,
5796                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5797                         return NF_DROP_ERR(-ECONNREFUSED);
5798
5799                 if (sel_netnode_sid(addrp, family, &node_sid))
5800                         return NF_DROP;
5801                 if (avc_has_perm(&selinux_state,
5802                                  peer_sid, node_sid,
5803                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5804                         return NF_DROP_ERR(-ECONNREFUSED);
5805         }
5806
5807         return NF_ACCEPT;
5808 }
5809
5810 static unsigned int selinux_ipv4_postroute(void *priv,
5811                                            struct sk_buff *skb,
5812                                            const struct nf_hook_state *state)
5813 {
5814         return selinux_ip_postroute(skb, state->out, PF_INET);
5815 }
5816
5817 #if IS_ENABLED(CONFIG_IPV6)
5818 static unsigned int selinux_ipv6_postroute(void *priv,
5819                                            struct sk_buff *skb,
5820                                            const struct nf_hook_state *state)
5821 {
5822         return selinux_ip_postroute(skb, state->out, PF_INET6);
5823 }
5824 #endif  /* IPV6 */
5825
5826 #endif  /* CONFIG_NETFILTER */
5827
5828 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5829 {
5830         return selinux_nlmsg_perm(sk, skb);
5831 }
5832
5833 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5834 {
5835         isec->sclass = sclass;
5836         isec->sid = current_sid();
5837 }
5838
5839 static int msg_msg_alloc_security(struct msg_msg *msg)
5840 {
5841         struct msg_security_struct *msec;
5842
5843         msec = selinux_msg_msg(msg);
5844         msec->sid = SECINITSID_UNLABELED;
5845
5846         return 0;
5847 }
5848
5849 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5850                         u32 perms)
5851 {
5852         struct ipc_security_struct *isec;
5853         struct common_audit_data ad;
5854         u32 sid = current_sid();
5855
5856         isec = selinux_ipc(ipc_perms);
5857
5858         ad.type = LSM_AUDIT_DATA_IPC;
5859         ad.u.ipc_id = ipc_perms->key;
5860
5861         return avc_has_perm(&selinux_state,
5862                             sid, isec->sid, isec->sclass, perms, &ad);
5863 }
5864
5865 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5866 {
5867         return msg_msg_alloc_security(msg);
5868 }
5869
5870 /* message queue security operations */
5871 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5872 {
5873         struct ipc_security_struct *isec;
5874         struct common_audit_data ad;
5875         u32 sid = current_sid();
5876         int rc;
5877
5878         isec = selinux_ipc(msq);
5879         ipc_init_security(isec, SECCLASS_MSGQ);
5880
5881         ad.type = LSM_AUDIT_DATA_IPC;
5882         ad.u.ipc_id = msq->key;
5883
5884         rc = avc_has_perm(&selinux_state,
5885                           sid, isec->sid, SECCLASS_MSGQ,
5886                           MSGQ__CREATE, &ad);
5887         return rc;
5888 }
5889
5890 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5891 {
5892         struct ipc_security_struct *isec;
5893         struct common_audit_data ad;
5894         u32 sid = current_sid();
5895
5896         isec = selinux_ipc(msq);
5897
5898         ad.type = LSM_AUDIT_DATA_IPC;
5899         ad.u.ipc_id = msq->key;
5900
5901         return avc_has_perm(&selinux_state,
5902                             sid, isec->sid, SECCLASS_MSGQ,
5903                             MSGQ__ASSOCIATE, &ad);
5904 }
5905
5906 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5907 {
5908         int err;
5909         int perms;
5910
5911         switch (cmd) {
5912         case IPC_INFO:
5913         case MSG_INFO:
5914                 /* No specific object, just general system-wide information. */
5915                 return avc_has_perm(&selinux_state,
5916                                     current_sid(), SECINITSID_KERNEL,
5917                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5918         case IPC_STAT:
5919         case MSG_STAT:
5920         case MSG_STAT_ANY:
5921                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5922                 break;
5923         case IPC_SET:
5924                 perms = MSGQ__SETATTR;
5925                 break;
5926         case IPC_RMID:
5927                 perms = MSGQ__DESTROY;
5928                 break;
5929         default:
5930                 return 0;
5931         }
5932
5933         err = ipc_has_perm(msq, perms);
5934         return err;
5935 }
5936
5937 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5938 {
5939         struct ipc_security_struct *isec;
5940         struct msg_security_struct *msec;
5941         struct common_audit_data ad;
5942         u32 sid = current_sid();
5943         int rc;
5944
5945         isec = selinux_ipc(msq);
5946         msec = selinux_msg_msg(msg);
5947
5948         /*
5949          * First time through, need to assign label to the message
5950          */
5951         if (msec->sid == SECINITSID_UNLABELED) {
5952                 /*
5953                  * Compute new sid based on current process and
5954                  * message queue this message will be stored in
5955                  */
5956                 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5957                                              SECCLASS_MSG, NULL, &msec->sid);
5958                 if (rc)
5959                         return rc;
5960         }
5961
5962         ad.type = LSM_AUDIT_DATA_IPC;
5963         ad.u.ipc_id = msq->key;
5964
5965         /* Can this process write to the queue? */
5966         rc = avc_has_perm(&selinux_state,
5967                           sid, isec->sid, SECCLASS_MSGQ,
5968                           MSGQ__WRITE, &ad);
5969         if (!rc)
5970                 /* Can this process send the message */
5971                 rc = avc_has_perm(&selinux_state,
5972                                   sid, msec->sid, SECCLASS_MSG,
5973                                   MSG__SEND, &ad);
5974         if (!rc)
5975                 /* Can the message be put in the queue? */
5976                 rc = avc_has_perm(&selinux_state,
5977                                   msec->sid, isec->sid, SECCLASS_MSGQ,
5978                                   MSGQ__ENQUEUE, &ad);
5979
5980         return rc;
5981 }
5982
5983 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5984                                     struct task_struct *target,
5985                                     long type, int mode)
5986 {
5987         struct ipc_security_struct *isec;
5988         struct msg_security_struct *msec;
5989         struct common_audit_data ad;
5990         u32 sid = task_sid(target);
5991         int rc;
5992
5993         isec = selinux_ipc(msq);
5994         msec = selinux_msg_msg(msg);
5995
5996         ad.type = LSM_AUDIT_DATA_IPC;
5997         ad.u.ipc_id = msq->key;
5998
5999         rc = avc_has_perm(&selinux_state,
6000                           sid, isec->sid,
6001                           SECCLASS_MSGQ, MSGQ__READ, &ad);
6002         if (!rc)
6003                 rc = avc_has_perm(&selinux_state,
6004                                   sid, msec->sid,
6005                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
6006         return rc;
6007 }
6008
6009 /* Shared Memory security operations */
6010 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6011 {
6012         struct ipc_security_struct *isec;
6013         struct common_audit_data ad;
6014         u32 sid = current_sid();
6015         int rc;
6016
6017         isec = selinux_ipc(shp);
6018         ipc_init_security(isec, SECCLASS_SHM);
6019
6020         ad.type = LSM_AUDIT_DATA_IPC;
6021         ad.u.ipc_id = shp->key;
6022
6023         rc = avc_has_perm(&selinux_state,
6024                           sid, isec->sid, SECCLASS_SHM,
6025                           SHM__CREATE, &ad);
6026         return rc;
6027 }
6028
6029 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6030 {
6031         struct ipc_security_struct *isec;
6032         struct common_audit_data ad;
6033         u32 sid = current_sid();
6034
6035         isec = selinux_ipc(shp);
6036
6037         ad.type = LSM_AUDIT_DATA_IPC;
6038         ad.u.ipc_id = shp->key;
6039
6040         return avc_has_perm(&selinux_state,
6041                             sid, isec->sid, SECCLASS_SHM,
6042                             SHM__ASSOCIATE, &ad);
6043 }
6044
6045 /* Note, at this point, shp is locked down */
6046 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6047 {
6048         int perms;
6049         int err;
6050
6051         switch (cmd) {
6052         case IPC_INFO:
6053         case SHM_INFO:
6054                 /* No specific object, just general system-wide information. */
6055                 return avc_has_perm(&selinux_state,
6056                                     current_sid(), SECINITSID_KERNEL,
6057                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6058         case IPC_STAT:
6059         case SHM_STAT:
6060         case SHM_STAT_ANY:
6061                 perms = SHM__GETATTR | SHM__ASSOCIATE;
6062                 break;
6063         case IPC_SET:
6064                 perms = SHM__SETATTR;
6065                 break;
6066         case SHM_LOCK:
6067         case SHM_UNLOCK:
6068                 perms = SHM__LOCK;
6069                 break;
6070         case IPC_RMID:
6071                 perms = SHM__DESTROY;
6072                 break;
6073         default:
6074                 return 0;
6075         }
6076
6077         err = ipc_has_perm(shp, perms);
6078         return err;
6079 }
6080
6081 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6082                              char __user *shmaddr, int shmflg)
6083 {
6084         u32 perms;
6085
6086         if (shmflg & SHM_RDONLY)
6087                 perms = SHM__READ;
6088         else
6089                 perms = SHM__READ | SHM__WRITE;
6090
6091         return ipc_has_perm(shp, perms);
6092 }
6093
6094 /* Semaphore security operations */
6095 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6096 {
6097         struct ipc_security_struct *isec;
6098         struct common_audit_data ad;
6099         u32 sid = current_sid();
6100         int rc;
6101
6102         isec = selinux_ipc(sma);
6103         ipc_init_security(isec, SECCLASS_SEM);
6104
6105         ad.type = LSM_AUDIT_DATA_IPC;
6106         ad.u.ipc_id = sma->key;
6107
6108         rc = avc_has_perm(&selinux_state,
6109                           sid, isec->sid, SECCLASS_SEM,
6110                           SEM__CREATE, &ad);
6111         return rc;
6112 }
6113
6114 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6115 {
6116         struct ipc_security_struct *isec;
6117         struct common_audit_data ad;
6118         u32 sid = current_sid();
6119
6120         isec = selinux_ipc(sma);
6121
6122         ad.type = LSM_AUDIT_DATA_IPC;
6123         ad.u.ipc_id = sma->key;
6124
6125         return avc_has_perm(&selinux_state,
6126                             sid, isec->sid, SECCLASS_SEM,
6127                             SEM__ASSOCIATE, &ad);
6128 }
6129
6130 /* Note, at this point, sma is locked down */
6131 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6132 {
6133         int err;
6134         u32 perms;
6135
6136         switch (cmd) {
6137         case IPC_INFO:
6138         case SEM_INFO:
6139                 /* No specific object, just general system-wide information. */
6140                 return avc_has_perm(&selinux_state,
6141                                     current_sid(), SECINITSID_KERNEL,
6142                                     SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6143         case GETPID:
6144         case GETNCNT:
6145         case GETZCNT:
6146                 perms = SEM__GETATTR;
6147                 break;
6148         case GETVAL:
6149         case GETALL:
6150                 perms = SEM__READ;
6151                 break;
6152         case SETVAL:
6153         case SETALL:
6154                 perms = SEM__WRITE;
6155                 break;
6156         case IPC_RMID:
6157                 perms = SEM__DESTROY;
6158                 break;
6159         case IPC_SET:
6160                 perms = SEM__SETATTR;
6161                 break;
6162         case IPC_STAT:
6163         case SEM_STAT:
6164         case SEM_STAT_ANY:
6165                 perms = SEM__GETATTR | SEM__ASSOCIATE;
6166                 break;
6167         default:
6168                 return 0;
6169         }
6170
6171         err = ipc_has_perm(sma, perms);
6172         return err;
6173 }
6174
6175 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6176                              struct sembuf *sops, unsigned nsops, int alter)
6177 {
6178         u32 perms;
6179
6180         if (alter)
6181                 perms = SEM__READ | SEM__WRITE;
6182         else
6183                 perms = SEM__READ;
6184
6185         return ipc_has_perm(sma, perms);
6186 }
6187
6188 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6189 {
6190         u32 av = 0;
6191
6192         av = 0;
6193         if (flag & S_IRUGO)
6194                 av |= IPC__UNIX_READ;
6195         if (flag & S_IWUGO)
6196                 av |= IPC__UNIX_WRITE;
6197
6198         if (av == 0)
6199                 return 0;
6200
6201         return ipc_has_perm(ipcp, av);
6202 }
6203
6204 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6205 {
6206         struct ipc_security_struct *isec = selinux_ipc(ipcp);
6207         *secid = isec->sid;
6208 }
6209
6210 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6211 {
6212         if (inode)
6213                 inode_doinit_with_dentry(inode, dentry);
6214 }
6215
6216 static int selinux_getprocattr(struct task_struct *p,
6217                                char *name, char **value)
6218 {
6219         const struct task_security_struct *__tsec;
6220         u32 sid;
6221         int error;
6222         unsigned len;
6223
6224         rcu_read_lock();
6225         __tsec = selinux_cred(__task_cred(p));
6226
6227         if (current != p) {
6228                 error = avc_has_perm(&selinux_state,
6229                                      current_sid(), __tsec->sid,
6230                                      SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6231                 if (error)
6232                         goto bad;
6233         }
6234
6235         if (!strcmp(name, "current"))
6236                 sid = __tsec->sid;
6237         else if (!strcmp(name, "prev"))
6238                 sid = __tsec->osid;
6239         else if (!strcmp(name, "exec"))
6240                 sid = __tsec->exec_sid;
6241         else if (!strcmp(name, "fscreate"))
6242                 sid = __tsec->create_sid;
6243         else if (!strcmp(name, "keycreate"))
6244                 sid = __tsec->keycreate_sid;
6245         else if (!strcmp(name, "sockcreate"))
6246                 sid = __tsec->sockcreate_sid;
6247         else {
6248                 error = -EINVAL;
6249                 goto bad;
6250         }
6251         rcu_read_unlock();
6252
6253         if (!sid)
6254                 return 0;
6255
6256         error = security_sid_to_context(&selinux_state, sid, value, &len);
6257         if (error)
6258                 return error;
6259         return len;
6260
6261 bad:
6262         rcu_read_unlock();
6263         return error;
6264 }
6265
6266 static int selinux_setprocattr(const char *name, void *value, size_t size)
6267 {
6268         struct task_security_struct *tsec;
6269         struct cred *new;
6270         u32 mysid = current_sid(), sid = 0, ptsid;
6271         int error;
6272         char *str = value;
6273
6274         /*
6275          * Basic control over ability to set these attributes at all.
6276          */
6277         if (!strcmp(name, "exec"))
6278                 error = avc_has_perm(&selinux_state,
6279                                      mysid, mysid, SECCLASS_PROCESS,
6280                                      PROCESS__SETEXEC, NULL);
6281         else if (!strcmp(name, "fscreate"))
6282                 error = avc_has_perm(&selinux_state,
6283                                      mysid, mysid, SECCLASS_PROCESS,
6284                                      PROCESS__SETFSCREATE, NULL);
6285         else if (!strcmp(name, "keycreate"))
6286                 error = avc_has_perm(&selinux_state,
6287                                      mysid, mysid, SECCLASS_PROCESS,
6288                                      PROCESS__SETKEYCREATE, NULL);
6289         else if (!strcmp(name, "sockcreate"))
6290                 error = avc_has_perm(&selinux_state,
6291                                      mysid, mysid, SECCLASS_PROCESS,
6292                                      PROCESS__SETSOCKCREATE, NULL);
6293         else if (!strcmp(name, "current"))
6294                 error = avc_has_perm(&selinux_state,
6295                                      mysid, mysid, SECCLASS_PROCESS,
6296                                      PROCESS__SETCURRENT, NULL);
6297         else
6298                 error = -EINVAL;
6299         if (error)
6300                 return error;
6301
6302         /* Obtain a SID for the context, if one was specified. */
6303         if (size && str[0] && str[0] != '\n') {
6304                 if (str[size-1] == '\n') {
6305                         str[size-1] = 0;
6306                         size--;
6307                 }
6308                 error = security_context_to_sid(&selinux_state, value, size,
6309                                                 &sid, GFP_KERNEL);
6310                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6311                         if (!has_cap_mac_admin(true)) {
6312                                 struct audit_buffer *ab;
6313                                 size_t audit_size;
6314
6315                                 /* We strip a nul only if it is at the end, otherwise the
6316                                  * context contains a nul and we should audit that */
6317                                 if (str[size - 1] == '\0')
6318                                         audit_size = size - 1;
6319                                 else
6320                                         audit_size = size;
6321                                 ab = audit_log_start(audit_context(),
6322                                                      GFP_ATOMIC,
6323                                                      AUDIT_SELINUX_ERR);
6324                                 audit_log_format(ab, "op=fscreate invalid_context=");
6325                                 audit_log_n_untrustedstring(ab, value, audit_size);
6326                                 audit_log_end(ab);
6327
6328                                 return error;
6329                         }
6330                         error = security_context_to_sid_force(
6331                                                       &selinux_state,
6332                                                       value, size, &sid);
6333                 }
6334                 if (error)
6335                         return error;
6336         }
6337
6338         new = prepare_creds();
6339         if (!new)
6340                 return -ENOMEM;
6341
6342         /* Permission checking based on the specified context is
6343            performed during the actual operation (execve,
6344            open/mkdir/...), when we know the full context of the
6345            operation.  See selinux_bprm_set_creds for the execve
6346            checks and may_create for the file creation checks. The
6347            operation will then fail if the context is not permitted. */
6348         tsec = selinux_cred(new);
6349         if (!strcmp(name, "exec")) {
6350                 tsec->exec_sid = sid;
6351         } else if (!strcmp(name, "fscreate")) {
6352                 tsec->create_sid = sid;
6353         } else if (!strcmp(name, "keycreate")) {
6354                 if (sid) {
6355                         error = avc_has_perm(&selinux_state, mysid, sid,
6356                                              SECCLASS_KEY, KEY__CREATE, NULL);
6357                         if (error)
6358                                 goto abort_change;
6359                 }
6360                 tsec->keycreate_sid = sid;
6361         } else if (!strcmp(name, "sockcreate")) {
6362                 tsec->sockcreate_sid = sid;
6363         } else if (!strcmp(name, "current")) {
6364                 error = -EINVAL;
6365                 if (sid == 0)
6366                         goto abort_change;
6367
6368                 /* Only allow single threaded processes to change context */
6369                 error = -EPERM;
6370                 if (!current_is_single_threaded()) {
6371                         error = security_bounded_transition(&selinux_state,
6372                                                             tsec->sid, sid);
6373                         if (error)
6374                                 goto abort_change;
6375                 }
6376
6377                 /* Check permissions for the transition. */
6378                 error = avc_has_perm(&selinux_state,
6379                                      tsec->sid, sid, SECCLASS_PROCESS,
6380                                      PROCESS__DYNTRANSITION, NULL);
6381                 if (error)
6382                         goto abort_change;
6383
6384                 /* Check for ptracing, and update the task SID if ok.
6385                    Otherwise, leave SID unchanged and fail. */
6386                 ptsid = ptrace_parent_sid();
6387                 if (ptsid != 0) {
6388                         error = avc_has_perm(&selinux_state,
6389                                              ptsid, sid, SECCLASS_PROCESS,
6390                                              PROCESS__PTRACE, NULL);
6391                         if (error)
6392                                 goto abort_change;
6393                 }
6394
6395                 tsec->sid = sid;
6396         } else {
6397                 error = -EINVAL;
6398                 goto abort_change;
6399         }
6400
6401         commit_creds(new);
6402         return size;
6403
6404 abort_change:
6405         abort_creds(new);
6406         return error;
6407 }
6408
6409 static int selinux_ismaclabel(const char *name)
6410 {
6411         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6412 }
6413
6414 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6415 {
6416         return security_sid_to_context(&selinux_state, secid,
6417                                        secdata, seclen);
6418 }
6419
6420 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6421 {
6422         return security_context_to_sid(&selinux_state, secdata, seclen,
6423                                        secid, GFP_KERNEL);
6424 }
6425
6426 static void selinux_release_secctx(char *secdata, u32 seclen)
6427 {
6428         kfree(secdata);
6429 }
6430
6431 static void selinux_inode_invalidate_secctx(struct inode *inode)
6432 {
6433         struct inode_security_struct *isec = selinux_inode(inode);
6434
6435         spin_lock(&isec->lock);
6436         isec->initialized = LABEL_INVALID;
6437         spin_unlock(&isec->lock);
6438 }
6439
6440 /*
6441  *      called with inode->i_mutex locked
6442  */
6443 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6444 {
6445         int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6446                                            ctx, ctxlen, 0);
6447         /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6448         return rc == -EOPNOTSUPP ? 0 : rc;
6449 }
6450
6451 /*
6452  *      called with inode->i_mutex locked
6453  */
6454 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6455 {
6456         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6457 }
6458
6459 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6460 {
6461         int len = 0;
6462         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6463                                                 ctx, true);
6464         if (len < 0)
6465                 return len;
6466         *ctxlen = len;
6467         return 0;
6468 }
6469 #ifdef CONFIG_KEYS
6470
6471 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6472                              unsigned long flags)
6473 {
6474         const struct task_security_struct *tsec;
6475         struct key_security_struct *ksec;
6476
6477         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6478         if (!ksec)
6479                 return -ENOMEM;
6480
6481         tsec = selinux_cred(cred);
6482         if (tsec->keycreate_sid)
6483                 ksec->sid = tsec->keycreate_sid;
6484         else
6485                 ksec->sid = tsec->sid;
6486
6487         k->security = ksec;
6488         return 0;
6489 }
6490
6491 static void selinux_key_free(struct key *k)
6492 {
6493         struct key_security_struct *ksec = k->security;
6494
6495         k->security = NULL;
6496         kfree(ksec);
6497 }
6498
6499 static int selinux_key_permission(key_ref_t key_ref,
6500                                   const struct cred *cred,
6501                                   unsigned perm)
6502 {
6503         struct key *key;
6504         struct key_security_struct *ksec;
6505         u32 sid;
6506
6507         /* if no specific permissions are requested, we skip the
6508            permission check. No serious, additional covert channels
6509            appear to be created. */
6510         if (perm == 0)
6511                 return 0;
6512
6513         sid = cred_sid(cred);
6514
6515         key = key_ref_to_ptr(key_ref);
6516         ksec = key->security;
6517
6518         return avc_has_perm(&selinux_state,
6519                             sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6520 }
6521
6522 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6523 {
6524         struct key_security_struct *ksec = key->security;
6525         char *context = NULL;
6526         unsigned len;
6527         int rc;
6528
6529         rc = security_sid_to_context(&selinux_state, ksec->sid,
6530                                      &context, &len);
6531         if (!rc)
6532                 rc = len;
6533         *_buffer = context;
6534         return rc;
6535 }
6536 #endif
6537
6538 #ifdef CONFIG_SECURITY_INFINIBAND
6539 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6540 {
6541         struct common_audit_data ad;
6542         int err;
6543         u32 sid = 0;
6544         struct ib_security_struct *sec = ib_sec;
6545         struct lsm_ibpkey_audit ibpkey;
6546
6547         err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6548         if (err)
6549                 return err;
6550
6551         ad.type = LSM_AUDIT_DATA_IBPKEY;
6552         ibpkey.subnet_prefix = subnet_prefix;
6553         ibpkey.pkey = pkey_val;
6554         ad.u.ibpkey = &ibpkey;
6555         return avc_has_perm(&selinux_state,
6556                             sec->sid, sid,
6557                             SECCLASS_INFINIBAND_PKEY,
6558                             INFINIBAND_PKEY__ACCESS, &ad);
6559 }
6560
6561 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6562                                             u8 port_num)
6563 {
6564         struct common_audit_data ad;
6565         int err;
6566         u32 sid = 0;
6567         struct ib_security_struct *sec = ib_sec;
6568         struct lsm_ibendport_audit ibendport;
6569
6570         err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6571                                       &sid);
6572
6573         if (err)
6574                 return err;
6575
6576         ad.type = LSM_AUDIT_DATA_IBENDPORT;
6577         strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6578         ibendport.port = port_num;
6579         ad.u.ibendport = &ibendport;
6580         return avc_has_perm(&selinux_state,
6581                             sec->sid, sid,
6582                             SECCLASS_INFINIBAND_ENDPORT,
6583                             INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6584 }
6585
6586 static int selinux_ib_alloc_security(void **ib_sec)
6587 {
6588         struct ib_security_struct *sec;
6589
6590         sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6591         if (!sec)
6592                 return -ENOMEM;
6593         sec->sid = current_sid();
6594
6595         *ib_sec = sec;
6596         return 0;
6597 }
6598
6599 static void selinux_ib_free_security(void *ib_sec)
6600 {
6601         kfree(ib_sec);
6602 }
6603 #endif
6604
6605 #ifdef CONFIG_BPF_SYSCALL
6606 static int selinux_bpf(int cmd, union bpf_attr *attr,
6607                                      unsigned int size)
6608 {
6609         u32 sid = current_sid();
6610         int ret;
6611
6612         switch (cmd) {
6613         case BPF_MAP_CREATE:
6614                 ret = avc_has_perm(&selinux_state,
6615                                    sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6616                                    NULL);
6617                 break;
6618         case BPF_PROG_LOAD:
6619                 ret = avc_has_perm(&selinux_state,
6620                                    sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6621                                    NULL);
6622                 break;
6623         default:
6624                 ret = 0;
6625                 break;
6626         }
6627
6628         return ret;
6629 }
6630
6631 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6632 {
6633         u32 av = 0;
6634
6635         if (fmode & FMODE_READ)
6636                 av |= BPF__MAP_READ;
6637         if (fmode & FMODE_WRITE)
6638                 av |= BPF__MAP_WRITE;
6639         return av;
6640 }
6641
6642 /* This function will check the file pass through unix socket or binder to see
6643  * if it is a bpf related object. And apply correspinding checks on the bpf
6644  * object based on the type. The bpf maps and programs, not like other files and
6645  * socket, are using a shared anonymous inode inside the kernel as their inode.
6646  * So checking that inode cannot identify if the process have privilege to
6647  * access the bpf object and that's why we have to add this additional check in
6648  * selinux_file_receive and selinux_binder_transfer_files.
6649  */
6650 static int bpf_fd_pass(struct file *file, u32 sid)
6651 {
6652         struct bpf_security_struct *bpfsec;
6653         struct bpf_prog *prog;
6654         struct bpf_map *map;
6655         int ret;
6656
6657         if (file->f_op == &bpf_map_fops) {
6658                 map = file->private_data;
6659                 bpfsec = map->security;
6660                 ret = avc_has_perm(&selinux_state,
6661                                    sid, bpfsec->sid, SECCLASS_BPF,
6662                                    bpf_map_fmode_to_av(file->f_mode), NULL);
6663                 if (ret)
6664                         return ret;
6665         } else if (file->f_op == &bpf_prog_fops) {
6666                 prog = file->private_data;
6667                 bpfsec = prog->aux->security;
6668                 ret = avc_has_perm(&selinux_state,
6669                                    sid, bpfsec->sid, SECCLASS_BPF,
6670                                    BPF__PROG_RUN, NULL);
6671                 if (ret)
6672                         return ret;
6673         }
6674         return 0;
6675 }
6676
6677 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6678 {
6679         u32 sid = current_sid();
6680         struct bpf_security_struct *bpfsec;
6681
6682         bpfsec = map->security;
6683         return avc_has_perm(&selinux_state,
6684                             sid, bpfsec->sid, SECCLASS_BPF,
6685                             bpf_map_fmode_to_av(fmode), NULL);
6686 }
6687
6688 static int selinux_bpf_prog(struct bpf_prog *prog)
6689 {
6690         u32 sid = current_sid();
6691         struct bpf_security_struct *bpfsec;
6692
6693         bpfsec = prog->aux->security;
6694         return avc_has_perm(&selinux_state,
6695                             sid, bpfsec->sid, SECCLASS_BPF,
6696                             BPF__PROG_RUN, NULL);
6697 }
6698
6699 static int selinux_bpf_map_alloc(struct bpf_map *map)
6700 {
6701         struct bpf_security_struct *bpfsec;
6702
6703         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6704         if (!bpfsec)
6705                 return -ENOMEM;
6706
6707         bpfsec->sid = current_sid();
6708         map->security = bpfsec;
6709
6710         return 0;
6711 }
6712
6713 static void selinux_bpf_map_free(struct bpf_map *map)
6714 {
6715         struct bpf_security_struct *bpfsec = map->security;
6716
6717         map->security = NULL;
6718         kfree(bpfsec);
6719 }
6720
6721 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6722 {
6723         struct bpf_security_struct *bpfsec;
6724
6725         bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6726         if (!bpfsec)
6727                 return -ENOMEM;
6728
6729         bpfsec->sid = current_sid();
6730         aux->security = bpfsec;
6731
6732         return 0;
6733 }
6734
6735 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6736 {
6737         struct bpf_security_struct *bpfsec = aux->security;
6738
6739         aux->security = NULL;
6740         kfree(bpfsec);
6741 }
6742 #endif
6743
6744 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6745         .lbs_cred = sizeof(struct task_security_struct),
6746         .lbs_file = sizeof(struct file_security_struct),
6747         .lbs_inode = sizeof(struct inode_security_struct),
6748         .lbs_ipc = sizeof(struct ipc_security_struct),
6749         .lbs_msg_msg = sizeof(struct msg_security_struct),
6750 };
6751
6752 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6753         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6754         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6755         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6756         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6757
6758         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6759         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6760         LSM_HOOK_INIT(capget, selinux_capget),
6761         LSM_HOOK_INIT(capset, selinux_capset),
6762         LSM_HOOK_INIT(capable, selinux_capable),
6763         LSM_HOOK_INIT(quotactl, selinux_quotactl),
6764         LSM_HOOK_INIT(quota_on, selinux_quota_on),
6765         LSM_HOOK_INIT(syslog, selinux_syslog),
6766         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6767
6768         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6769
6770         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6771         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6772         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6773
6774         LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6775         LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6776
6777         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6778         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6779         LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6780         LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6781         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6782         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6783         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6784         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6785         LSM_HOOK_INIT(sb_mount, selinux_mount),
6786         LSM_HOOK_INIT(sb_umount, selinux_umount),
6787         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6788         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6789         LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6790
6791         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6792         LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6793
6794         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6795         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6796         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6797         LSM_HOOK_INIT(inode_create, selinux_inode_create),
6798         LSM_HOOK_INIT(inode_link, selinux_inode_link),
6799         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6800         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6801         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6802         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6803         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6804         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6805         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6806         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6807         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6808         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6809         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6810         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6811         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6812         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6813         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6814         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6815         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6816         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6817         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6818         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6819         LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6820         LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6821
6822         LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6823
6824         LSM_HOOK_INIT(file_permission, selinux_file_permission),
6825         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6826         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6827         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6828         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6829         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6830         LSM_HOOK_INIT(file_lock, selinux_file_lock),
6831         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6832         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6833         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6834         LSM_HOOK_INIT(file_receive, selinux_file_receive),
6835
6836         LSM_HOOK_INIT(file_open, selinux_file_open),
6837
6838         LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6839         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6840         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6841         LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6842         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6843         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6844         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6845         LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6846         LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6847         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6848         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6849         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6850         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6851         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6852         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6853         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6854         LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6855         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6856         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6857         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6858         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6859         LSM_HOOK_INIT(task_kill, selinux_task_kill),
6860         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6861
6862         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6863         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6864
6865         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6866
6867         LSM_HOOK_INIT(msg_queue_alloc_security,
6868                         selinux_msg_queue_alloc_security),
6869         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6870         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6871         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6872         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6873
6874         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6875         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6876         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6877         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6878
6879         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6880         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6881         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6882         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6883
6884         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6885
6886         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6887         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6888
6889         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6890         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6891         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6892         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6893         LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6894         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6895         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6896         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6897
6898         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6899         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6900
6901         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6902         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6903         LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6904         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6905         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6906         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6907         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6908         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6909         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6910         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6911         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6912         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6913         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6914         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6915         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6916         LSM_HOOK_INIT(socket_getpeersec_stream,
6917                         selinux_socket_getpeersec_stream),
6918         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6919         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6920         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6921         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6922         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6923         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6924         LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6925         LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6926         LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6927         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6928         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6929         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6930         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6931         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6932         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6933         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6934         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6935         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6936         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6937         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6938         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6939         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6940 #ifdef CONFIG_SECURITY_INFINIBAND
6941         LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6942         LSM_HOOK_INIT(ib_endport_manage_subnet,
6943                       selinux_ib_endport_manage_subnet),
6944         LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6945         LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6946 #endif
6947 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6948         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6949         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6950         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6951         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6952         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6953         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6954                         selinux_xfrm_state_alloc_acquire),
6955         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6956         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6957         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6958         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6959                         selinux_xfrm_state_pol_flow_match),
6960         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6961 #endif
6962
6963 #ifdef CONFIG_KEYS
6964         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6965         LSM_HOOK_INIT(key_free, selinux_key_free),
6966         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6967         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6968 #endif
6969
6970 #ifdef CONFIG_AUDIT
6971         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6972         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6973         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6974         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6975 #endif
6976
6977 #ifdef CONFIG_BPF_SYSCALL
6978         LSM_HOOK_INIT(bpf, selinux_bpf),
6979         LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6980         LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6981         LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6982         LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6983         LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6984         LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6985 #endif
6986 };
6987
6988 static __init int selinux_init(void)
6989 {
6990         pr_info("SELinux:  Initializing.\n");
6991
6992         memset(&selinux_state, 0, sizeof(selinux_state));
6993         enforcing_set(&selinux_state, selinux_enforcing_boot);
6994         selinux_state.checkreqprot = selinux_checkreqprot_boot;
6995         selinux_ss_init(&selinux_state.ss);
6996         selinux_avc_init(&selinux_state.avc);
6997
6998         /* Set the security state for the initial task. */
6999         cred_init_security();
7000
7001         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7002
7003         avc_init();
7004
7005         avtab_cache_init();
7006
7007         ebitmap_cache_init();
7008
7009         hashtab_cache_init();
7010
7011         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7012
7013         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7014                 panic("SELinux: Unable to register AVC netcache callback\n");
7015
7016         if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7017                 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7018
7019         if (selinux_enforcing_boot)
7020                 pr_debug("SELinux:  Starting in enforcing mode\n");
7021         else
7022                 pr_debug("SELinux:  Starting in permissive mode\n");
7023
7024         fs_validate_description(&selinux_fs_parameters);
7025
7026         return 0;
7027 }
7028
7029 static void delayed_superblock_init(struct super_block *sb, void *unused)
7030 {
7031         selinux_set_mnt_opts(sb, NULL, 0, NULL);
7032 }
7033
7034 void selinux_complete_init(void)
7035 {
7036         pr_debug("SELinux:  Completing initialization.\n");
7037
7038         /* Set up any superblocks initialized prior to the policy load. */
7039         pr_debug("SELinux:  Setting up existing superblocks.\n");
7040         iterate_supers(delayed_superblock_init, NULL);
7041 }
7042
7043 /* SELinux requires early initialization in order to label
7044    all processes and objects when they are created. */
7045 DEFINE_LSM(selinux) = {
7046         .name = "selinux",
7047         .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7048         .enabled = &selinux_enabled,
7049         .blobs = &selinux_blob_sizes,
7050         .init = selinux_init,
7051 };
7052
7053 #if defined(CONFIG_NETFILTER)
7054
7055 static const struct nf_hook_ops selinux_nf_ops[] = {
7056         {
7057                 .hook =         selinux_ipv4_postroute,
7058                 .pf =           NFPROTO_IPV4,
7059                 .hooknum =      NF_INET_POST_ROUTING,
7060                 .priority =     NF_IP_PRI_SELINUX_LAST,
7061         },
7062         {
7063                 .hook =         selinux_ipv4_forward,
7064                 .pf =           NFPROTO_IPV4,
7065                 .hooknum =      NF_INET_FORWARD,
7066                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7067         },
7068         {
7069                 .hook =         selinux_ipv4_output,
7070                 .pf =           NFPROTO_IPV4,
7071                 .hooknum =      NF_INET_LOCAL_OUT,
7072                 .priority =     NF_IP_PRI_SELINUX_FIRST,
7073         },
7074 #if IS_ENABLED(CONFIG_IPV6)
7075         {
7076                 .hook =         selinux_ipv6_postroute,
7077                 .pf =           NFPROTO_IPV6,
7078                 .hooknum =      NF_INET_POST_ROUTING,
7079                 .priority =     NF_IP6_PRI_SELINUX_LAST,
7080         },
7081         {
7082                 .hook =         selinux_ipv6_forward,
7083                 .pf =           NFPROTO_IPV6,
7084                 .hooknum =      NF_INET_FORWARD,
7085                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7086         },
7087         {
7088                 .hook =         selinux_ipv6_output,
7089                 .pf =           NFPROTO_IPV6,
7090                 .hooknum =      NF_INET_LOCAL_OUT,
7091                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
7092         },
7093 #endif  /* IPV6 */
7094 };
7095
7096 static int __net_init selinux_nf_register(struct net *net)
7097 {
7098         return nf_register_net_hooks(net, selinux_nf_ops,
7099                                      ARRAY_SIZE(selinux_nf_ops));
7100 }
7101
7102 static void __net_exit selinux_nf_unregister(struct net *net)
7103 {
7104         nf_unregister_net_hooks(net, selinux_nf_ops,
7105                                 ARRAY_SIZE(selinux_nf_ops));
7106 }
7107
7108 static struct pernet_operations selinux_net_ops = {
7109         .init = selinux_nf_register,
7110         .exit = selinux_nf_unregister,
7111 };
7112
7113 static int __init selinux_nf_ip_init(void)
7114 {
7115         int err;
7116
7117         if (!selinux_enabled)
7118                 return 0;
7119
7120         pr_debug("SELinux:  Registering netfilter hooks\n");
7121
7122         err = register_pernet_subsys(&selinux_net_ops);
7123         if (err)
7124                 panic("SELinux: register_pernet_subsys: error %d\n", err);
7125
7126         return 0;
7127 }
7128 __initcall(selinux_nf_ip_init);
7129
7130 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7131 static void selinux_nf_ip_exit(void)
7132 {
7133         pr_debug("SELinux:  Unregistering netfilter hooks\n");
7134
7135         unregister_pernet_subsys(&selinux_net_ops);
7136 }
7137 #endif
7138
7139 #else /* CONFIG_NETFILTER */
7140
7141 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7142 #define selinux_nf_ip_exit()
7143 #endif
7144
7145 #endif /* CONFIG_NETFILTER */
7146
7147 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7148 int selinux_disable(struct selinux_state *state)
7149 {
7150         if (state->initialized) {
7151                 /* Not permitted after initial policy load. */
7152                 return -EINVAL;
7153         }
7154
7155         if (state->disabled) {
7156                 /* Only do this once. */
7157                 return -EINVAL;
7158         }
7159
7160         state->disabled = 1;
7161
7162         pr_info("SELinux:  Disabled at runtime.\n");
7163
7164         selinux_enabled = 0;
7165
7166         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7167
7168         /* Try to destroy the avc node cache */
7169         avc_disable();
7170
7171         /* Unregister netfilter hooks. */
7172         selinux_nf_ip_exit();
7173
7174         /* Unregister selinuxfs. */
7175         exit_sel_fs();
7176
7177         return 0;
7178 }
7179 #endif